@seams/wallet-server 0.5.0

package/dist/esm/core/authService/emailOtpEnrollment.js

@@ -0,0 +1,141 @@
+import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
+import "../../shared-ts/src/utils/validation.js";
+//#region src/core/authService/emailOtpEnrollment.ts
+async function readEmailOtpEnrollmentWithStore(input) {
+	const walletId = normalizeOptionalTrimmedString(input.request.walletId);
+	const orgId = normalizeOptionalTrimmedString(input.request.orgId);
+	if (!walletId) return {
+		ok: false,
+		code: "invalid_body",
+		message: "Missing walletId"
+	};
+	if (!orgId) return {
+		ok: false,
+		code: "invalid_body",
+		message: "Missing orgId"
+	};
+	const enrollment = await input.walletEnrollmentStore.get(walletId);
+	if (!enrollment) return {
+		ok: false,
+		code: "not_found",
+		message: "Email OTP enrollment not found"
+	};
+	if (enrollment.orgId !== orgId) return {
+		ok: false,
+		code: "tenant_scope_mismatch",
+		message: "Email OTP enrollment does not match the requested orgId"
+	};
+	return {
+		ok: true,
+		enrollment
+	};
+}
+async function readActiveEmailOtpEnrollmentWithStore(input) {
+	const result = await readEmailOtpEnrollmentWithStore(input);
+	if (!result.ok) return result;
+	const providerUserId = normalizeOptionalTrimmedString(input.request.providerUserId);
+	if (providerUserId && result.enrollment.providerUserId !== providerUserId) return {
+		ok: false,
+		code: "provider_identity_mismatch",
+		message: "Email OTP enrollment does not match the requested provider user"
+	};
+	return result;
+}
+async function readEmailOtpAuthStateForEnrollmentWithStore(input) {
+	const state = await input.authStateStore.get(input.enrollment.walletId);
+	if (!state) return {
+		ok: true,
+		state: null
+	};
+	if (state.orgId !== input.enrollment.orgId || state.providerUserId !== input.enrollment.providerUserId) return {
+		ok: false,
+		code: "auth_state_enrollment_mismatch",
+		message: "Email OTP auth state does not match the active enrollment"
+	};
+	return {
+		ok: true,
+		state
+	};
+}
+async function putEmailOtpAuthStateForEnrollmentWithStore(input) {
+	const existing = await input.authStateStore.get(input.enrollment.walletId);
+	if (existing && (existing.orgId !== input.enrollment.orgId || existing.providerUserId !== input.enrollment.providerUserId)) throw new Error("Email OTP auth state does not match the active enrollment");
+	const next = {
+		version: "email_otp_auth_state_v1",
+		walletId: input.enrollment.walletId,
+		providerUserId: input.enrollment.providerUserId,
+		orgId: input.enrollment.orgId,
+		createdAtMs: existing?.createdAtMs ?? input.nowMs,
+		updatedAtMs: input.nowMs,
+		...existing?.otpFailureCount != null ? { otpFailureCount: existing.otpFailureCount } : {},
+		...existing?.lastOtpFailureAtMs ? { lastOtpFailureAtMs: existing.lastOtpFailureAtMs } : {},
+		...existing?.otpLockedUntilMs ? { otpLockedUntilMs: existing.otpLockedUntilMs } : {},
+		...existing?.lastEmailOtpLoginAtMs ? { lastEmailOtpLoginAtMs: existing.lastEmailOtpLoginAtMs } : {},
+		...existing?.lastStrongAuthAtMs ? { lastStrongAuthAtMs: existing.lastStrongAuthAtMs } : {},
+		...input.patch
+	};
+	await input.authStateStore.put(next);
+	return next;
+}
+async function isEmailOtpStrongAuthRequiredWithStores(input) {
+	const walletId = normalizeOptionalTrimmedString(input.request.walletId);
+	if (!walletId) return {
+		ok: false,
+		code: "invalid_body",
+		message: "Missing walletId"
+	};
+	const enrollment = await input.walletEnrollmentStore.get(walletId);
+	if (!enrollment) return {
+		ok: true,
+		required: false,
+		walletId
+	};
+	const authState = await readEmailOtpAuthStateForEnrollmentWithStore({
+		authStateStore: input.authStateStore,
+		enrollment
+	});
+	if (!authState.ok) return authState;
+	const state = authState.state;
+	if (!state) return {
+		ok: true,
+		required: false,
+		walletId
+	};
+	const lastEmailOtpLoginAtMs = typeof state.lastEmailOtpLoginAtMs === "number" ? state.lastEmailOtpLoginAtMs : void 0;
+	const lastStrongAuthAtMs = typeof state.lastStrongAuthAtMs === "number" ? state.lastStrongAuthAtMs : void 0;
+	return {
+		ok: true,
+		required: Boolean(lastEmailOtpLoginAtMs && (!lastStrongAuthAtMs || lastEmailOtpLoginAtMs > lastStrongAuthAtMs)),
+		walletId,
+		...lastEmailOtpLoginAtMs ? { lastEmailOtpLoginAtMs } : {},
+		...lastStrongAuthAtMs ? { lastStrongAuthAtMs } : {}
+	};
+}
+async function markEmailOtpStrongAuthSatisfiedWithStores(input) {
+	const walletId = normalizeOptionalTrimmedString(input.request.walletId);
+	if (!walletId) return {
+		ok: false,
+		code: "invalid_body",
+		message: "Missing walletId"
+	};
+	const enrollment = await input.walletEnrollmentStore.get(walletId);
+	if (!enrollment) return {
+		ok: true,
+		walletId
+	};
+	await putEmailOtpAuthStateForEnrollmentWithStore({
+		authStateStore: input.authStateStore,
+		enrollment,
+		patch: { lastStrongAuthAtMs: input.nowMs },
+		nowMs: input.nowMs
+	});
+	return {
+		ok: true,
+		walletId,
+		lastStrongAuthAtMs: input.nowMs
+	};
+}
+//#endregion
+export { isEmailOtpStrongAuthRequiredWithStores, markEmailOtpStrongAuthSatisfiedWithStores, putEmailOtpAuthStateForEnrollmentWithStore, readActiveEmailOtpEnrollmentWithStore, readEmailOtpAuthStateForEnrollmentWithStore, readEmailOtpEnrollmentWithStore };
+
+//# sourceMappingURL=emailOtpEnrollment.js.map

package/dist/esm/core/authService/emailOtpGrant.js

@@ -0,0 +1,74 @@
+import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
+import "../../shared-ts/src/utils/validation.js";
+import { errorMessage } from "../../shared-ts/src/utils/errors.js";
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS } from "../../shared-ts/src/utils/emailOtpDomain.js";
+//#region src/core/authService/emailOtpGrant.ts
+async function consumeEmailOtpGrantWithStore(input) {
+	try {
+		const loginGrant = normalizeOptionalTrimmedString(input.request.loginGrant);
+		const userId = normalizeOptionalTrimmedString(input.request.userId);
+		const walletId = normalizeOptionalTrimmedString(input.request.walletId);
+		const orgId = normalizeOptionalTrimmedString(input.request.orgId) || "";
+		const otpChannel = normalizeOptionalTrimmedString(input.request.otpChannel);
+		const clientIp = normalizeOptionalTrimmedString(input.request.clientIp) || void 0;
+		if (!loginGrant) return {
+			ok: false,
+			code: "invalid_body",
+			message: "Missing loginGrant"
+		};
+		if (!userId) return {
+			ok: false,
+			code: "invalid_body",
+			message: "Missing userId"
+		};
+		if (!walletId) return {
+			ok: false,
+			code: "invalid_body",
+			message: "Missing walletId"
+		};
+		if (!orgId) return {
+			ok: false,
+			code: "invalid_body",
+			message: "Missing orgId"
+		};
+		if (otpChannel !== "email_otp") return {
+			ok: false,
+			code: "invalid_body",
+			message: "otpChannel must be email_otp"
+		};
+		const rateLimit = await input.consumeRateLimit({
+			scope: "grant",
+			userId,
+			walletId,
+			orgId,
+			clientIp
+		});
+		if (!rateLimit.ok) return rateLimit;
+		const record = await input.grantStore.consume(loginGrant);
+		if (!record || input.nowMs > record.expiresAtMs || record.action !== WALLET_EMAIL_OTP_ACTIONS.unseal) return {
+			ok: false,
+			code: "login_grant_invalid_or_expired",
+			message: "Login grant is invalid or expired"
+		};
+		if (record.userId !== userId || record.walletId !== walletId || record.otpChannel !== "email_otp" || record.orgId !== orgId) return {
+			ok: false,
+			code: "recovery_grant_binding_mismatch",
+			message: "Recovery grant is not valid for the current Email OTP authority"
+		};
+		return {
+			ok: true,
+			challengeId: record.challengeId,
+			otpChannel: EMAIL_OTP_CHANNEL
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			code: "internal",
+			message: errorMessage(error) || "Failed to consume Email OTP grant"
+		};
+	}
+}
+//#endregion
+export { consumeEmailOtpGrantWithStore };
+
+//# sourceMappingURL=emailOtpGrant.js.map

package/dist/esm/core/authService/emailOtpRegistrationEnrollment.js

@@ -0,0 +1,322 @@
+import { parseWalletId } from "../../shared-ts/src/utils/domainIds.js";
+import { base64UrlDecode } from "../../shared-ts/src/utils/base64.js";
+import "../../shared-ts/src/utils/encoders.js";
+import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
+import "../../shared-ts/src/utils/validation.js";
+import { validateSecp256k1PublicKey33 } from "../ThresholdService/evmCryptoWasm.js";
+import { WALLET_EMAIL_OTP_ACTIONS, emailOtpDeviceEnrollmentId } from "../../shared-ts/src/utils/emailOtpDomain.js";
+import { parseRawEmailOtpRegistrationChallengeProofInput } from "./emailOtpChallengeProof.js";
+import { completeGoogleEmailOtpRegistrationAttemptWithStore } from "./googleEmailOtpRegistration.js";
+//#region src/core/authService/emailOtpRegistrationEnrollment.ts
+function assertNever(value) {
+	throw new Error(`Unexpected value: ${String(value)}`);
+}
+async function validateEmailOtpEnrollmentMaterial(request) {
+	const enrollmentSealKeyVersion = normalizeOptionalTrimmedString(request.enrollmentSealKeyVersion);
+	const clientUnlockPublicKeyB64u = normalizeOptionalTrimmedString(request.clientUnlockPublicKeyB64u);
+	const unlockKeyVersion = normalizeOptionalTrimmedString(request.unlockKeyVersion);
+	const serverSealedFactorCiphertextB64u = normalizeOptionalTrimmedString(request.serverSealedFactorCiphertextB64u);
+	if (!enrollmentSealKeyVersion) return {
+		ok: false,
+		code: "invalid_body",
+		message: "enrollmentSealKeyVersion is required"
+	};
+	if (!clientUnlockPublicKeyB64u) return {
+		ok: false,
+		code: "invalid_body",
+		message: "clientUnlockPublicKeyB64u is required"
+	};
+	if (!unlockKeyVersion) return {
+		ok: false,
+		code: "invalid_body",
+		message: "unlockKeyVersion is required"
+	};
+	if (!serverSealedFactorCiphertextB64u) return {
+		ok: false,
+		code: "invalid_body",
+		message: "serverSealedFactorCiphertextB64u is required"
+	};
+	let unlockPublicKeyBytes;
+	try {
+		unlockPublicKeyBytes = base64UrlDecode(clientUnlockPublicKeyB64u);
+	} catch {
+		return {
+			ok: false,
+			code: "invalid_body",
+			message: "clientUnlockPublicKeyB64u must be valid base64url"
+		};
+	}
+	if (unlockPublicKeyBytes.length !== 33) return {
+		ok: false,
+		code: "invalid_body",
+		message: "clientUnlockPublicKeyB64u must decode to 33 bytes (compressed secp256k1 pubkey)"
+	};
+	try {
+		await validateSecp256k1PublicKey33(unlockPublicKeyBytes);
+	} catch {
+		return {
+			ok: false,
+			code: "invalid_body",
+			message: "clientUnlockPublicKeyB64u is not a valid secp256k1 public key"
+		};
+	}
+	return {
+		ok: true,
+		enrollmentSealKeyVersion,
+		clientUnlockPublicKeyB64u,
+		unlockKeyVersion,
+		serverSealedFactorCiphertextB64u
+	};
+}
+async function buildEmailOtpRegistrationEnrollmentPersistence(input) {
+	const enrollmentMaterial = await validateEmailOtpEnrollmentMaterial(input.material);
+	if (!enrollmentMaterial.ok) return enrollmentMaterial;
+	const orgId = normalizeOptionalTrimmedString(input.orgId) || "";
+	const walletId = normalizeOptionalTrimmedString(input.walletId) || "";
+	const authSubjectId = normalizeOptionalTrimmedString(input.authSubjectId) || "";
+	const verifiedEmail = normalizeOptionalTrimmedString(input.verifiedEmail)?.toLowerCase() || "";
+	if (!orgId || !walletId || !authSubjectId || !verifiedEmail) return {
+		ok: false,
+		code: "invalid_body",
+		message: "Email OTP registration enrollment requires wallet, org, and email identity"
+	};
+	const existing = await input.walletEnrollmentStore.get(walletId);
+	const existingState = await input.authStateStore.get(walletId);
+	const enrollment = {
+		version: "email_otp_wallet_enrollment_v1",
+		walletId,
+		providerUserId: authSubjectId,
+		orgId,
+		verifiedEmail,
+		enrollmentId: emailOtpDeviceEnrollmentId(walletId, authSubjectId),
+		enrollmentVersion: "1",
+		enrollmentSealKeyVersion: enrollmentMaterial.enrollmentSealKeyVersion,
+		serverSealedFactorCiphertextB64u: enrollmentMaterial.serverSealedFactorCiphertextB64u,
+		clientUnlockPublicKeyB64u: enrollmentMaterial.clientUnlockPublicKeyB64u,
+		unlockKeyVersion: enrollmentMaterial.unlockKeyVersion,
+		createdAtMs: existing?.createdAtMs ?? input.nowMs,
+		updatedAtMs: input.nowMs
+	};
+	const existingProviderEnrollment = await input.walletEnrollmentStore.getByProviderUserId({
+		providerUserId: enrollment.providerUserId,
+		orgId: enrollment.orgId
+	});
+	const authState = {
+		version: "email_otp_auth_state_v1",
+		walletId: enrollment.walletId,
+		providerUserId: enrollment.providerUserId,
+		orgId: enrollment.orgId,
+		createdAtMs: existingState && existingState.providerUserId === enrollment.providerUserId && existingState.orgId === enrollment.orgId ? existingState.createdAtMs : input.nowMs,
+		updatedAtMs: input.nowMs,
+		otpFailureCount: 0,
+		lastOtpFailureAtMs: void 0,
+		otpLockedUntilMs: void 0,
+		...existingState?.lastEmailOtpLoginAtMs && existingState.providerUserId === enrollment.providerUserId && existingState.orgId === enrollment.orgId ? { lastEmailOtpLoginAtMs: existingState.lastEmailOtpLoginAtMs } : {},
+		...existingState?.lastStrongAuthAtMs && existingState.providerUserId === enrollment.providerUserId && existingState.orgId === enrollment.orgId ? { lastStrongAuthAtMs: existingState.lastStrongAuthAtMs } : {}
+	};
+	return {
+		ok: true,
+		persistence: {
+			...existingProviderEnrollment && existingProviderEnrollment.walletId !== enrollment.walletId ? { previousProviderWalletId: existingProviderEnrollment.walletId } : {},
+			enrollment,
+			authState
+		}
+	};
+}
+async function emailOtpEnrollmentPersistenceForRegistrationFinalize(input) {
+	if (input.authority.kind !== "email_otp") {
+		if (input.request.emailOtpEnrollment) return {
+			ok: false,
+			code: "invalid_body",
+			message: "emailOtpEnrollment is only valid for Email OTP registration"
+		};
+		return { ok: true };
+	}
+	if (!input.request.emailOtpEnrollment) return {
+		ok: false,
+		code: "invalid_body",
+		message: "Email OTP registration finalize requires emailOtpEnrollment"
+	};
+	if (input.authority.walletId !== input.walletId || input.authority.finalWalletId !== input.walletId || input.authority.orgId !== input.orgId) return {
+		ok: false,
+		code: "authority_binding_mismatch",
+		message: "Email OTP registration authority does not match finalize scope"
+	};
+	const authSubjectId = normalizeOptionalTrimmedString(input.authority.providerSubject) || "";
+	const verifiedEmail = normalizeOptionalTrimmedString(input.authority.email)?.toLowerCase() || "";
+	const enrollment = await buildEmailOtpRegistrationEnrollmentPersistence({
+		walletEnrollmentStore: input.walletEnrollmentStore,
+		authStateStore: input.authStateStore,
+		walletId: input.walletId,
+		orgId: input.orgId,
+		authSubjectId,
+		verifiedEmail,
+		material: input.request.emailOtpEnrollment,
+		nowMs: input.nowMs
+	});
+	if (!enrollment.ok) return enrollment;
+	return {
+		ok: true,
+		persistence: enrollment.persistence
+	};
+}
+async function resolveEmailOtpRegistrationChallengeProof(input) {
+	const proofInput = input.proofInput;
+	switch (proofInput.kind) {
+		case "google_registration_attempt": {
+			const attempt = await input.registrationAttemptStore.get(proofInput.registrationAttemptId);
+			if (!attempt) return {
+				ok: false,
+				code: "registration_attempt_missing",
+				message: "Google Email OTP registration attempt expired or was not found"
+			};
+			if (attempt.providerSubject !== proofInput.providerSubject) return {
+				ok: false,
+				code: "challenge_subject_mismatch",
+				message: "Email OTP registration attempt does not match the provider subject"
+			};
+			if (attempt.expiresAtMs <= input.nowMs) return {
+				ok: false,
+				code: "registration_attempt_expired",
+				message: "Google Email OTP registration attempt expired"
+			};
+			if (attempt.walletId !== proofInput.walletId) return {
+				ok: false,
+				code: "wallet_identity_mismatch",
+				message: "registrationAttemptId does not match walletId"
+			};
+			return {
+				ok: true,
+				proof: {
+					kind: "registration_attempt",
+					providerSubject: proofInput.providerSubject,
+					challengeSubjectId: proofInput.challengeSubjectId,
+					proofEmail: attempt.email.toLowerCase(),
+					registrationAttemptId: proofInput.registrationAttemptId,
+					challengeId: proofInput.challengeId,
+					finalWalletId: proofInput.walletId,
+					orgId: proofInput.orgId,
+					ownerProofBindingDigest: proofInput.ownerProofBindingDigest
+				}
+			};
+		}
+		case "direct_proof_email": return {
+			ok: true,
+			proof: {
+				kind: "direct_proof_email",
+				providerSubject: proofInput.providerSubject,
+				challengeSubjectId: proofInput.challengeSubjectId,
+				proofEmail: proofInput.proofEmail,
+				challengeId: proofInput.challengeId,
+				finalWalletId: proofInput.finalWalletId,
+				orgId: proofInput.orgId,
+				ownerProofBindingDigest: proofInput.ownerProofBindingDigest
+			}
+		};
+	}
+	return assertNever(proofInput);
+}
+async function verifyEmailOtpEnrollment(input) {
+	const request = input.request;
+	const proofInput = parseRawEmailOtpRegistrationChallengeProofInput(request);
+	if (!proofInput.ok) return proofInput;
+	const proofResult = await resolveEmailOtpRegistrationChallengeProof({
+		proofInput: proofInput.input,
+		registrationAttemptStore: input.registrationAttemptStore,
+		nowMs: Date.now()
+	});
+	if (!proofResult.ok) return proofResult;
+	const verified = await input.verifyChallengeCode({
+		...request,
+		challengeSubjectId: proofResult.proof.challengeSubjectId,
+		registrationChallengeProof: proofResult.proof,
+		allowRegistrationChallengeReroll: true,
+		expectedAction: WALLET_EMAIL_OTP_ACTIONS.registration
+	});
+	if (!verified.ok) return verified;
+	const verifiedEmail = normalizeOptionalTrimmedString(verified.email)?.toLowerCase();
+	if (!verifiedEmail) return {
+		ok: false,
+		code: "internal",
+		message: "Email OTP enrollment verification did not include a verified email"
+	};
+	const enrollmentMaterial = await validateEmailOtpEnrollmentMaterial(request);
+	if (!enrollmentMaterial.ok) return enrollmentMaterial;
+	const orgId = normalizeOptionalTrimmedString(verified.orgId) || "";
+	if (!orgId) return {
+		ok: false,
+		code: "invalid_body",
+		message: "Email OTP enrollment requires orgId tenant scope"
+	};
+	const verifiedWalletId = parseWalletId(verified.walletId);
+	if (!verifiedWalletId.ok) return {
+		ok: false,
+		code: "invalid_body",
+		message: "Email OTP enrollment verification returned an invalid walletId"
+	};
+	if (!await input.walletStore.getWallet({ walletId: verifiedWalletId.value })) return {
+		ok: false,
+		code: "wallet_registration_incomplete",
+		message: "Email OTP enrollment requires a canonical wallet created by /wallets/register/activate."
+	};
+	const existing = await input.walletEnrollmentStore.get(verified.walletId);
+	const existingState = await input.authStateStore.get(verified.walletId);
+	const nowMs = Date.now();
+	const enrollmentRecord = {
+		version: "email_otp_wallet_enrollment_v1",
+		walletId: verified.walletId,
+		providerUserId: verified.challengeSubjectId,
+		orgId,
+		verifiedEmail,
+		enrollmentId: emailOtpDeviceEnrollmentId(verified.walletId, verified.challengeSubjectId),
+		enrollmentVersion: "1",
+		enrollmentSealKeyVersion: enrollmentMaterial.enrollmentSealKeyVersion,
+		serverSealedFactorCiphertextB64u: enrollmentMaterial.serverSealedFactorCiphertextB64u,
+		clientUnlockPublicKeyB64u: enrollmentMaterial.clientUnlockPublicKeyB64u,
+		unlockKeyVersion: enrollmentMaterial.unlockKeyVersion,
+		createdAtMs: existing?.createdAtMs ?? nowMs,
+		updatedAtMs: nowMs
+	};
+	const existingProviderEnrollment = await input.walletEnrollmentStore.getByProviderUserId({
+		providerUserId: enrollmentRecord.providerUserId,
+		orgId: enrollmentRecord.orgId
+	});
+	if (existingProviderEnrollment && existingProviderEnrollment.walletId !== enrollmentRecord.walletId) await input.walletEnrollmentStore.del(existingProviderEnrollment.walletId);
+	await input.walletEnrollmentStore.put(enrollmentRecord);
+	await input.authStateStore.put({
+		version: "email_otp_auth_state_v1",
+		walletId: enrollmentRecord.walletId,
+		providerUserId: enrollmentRecord.providerUserId,
+		orgId: enrollmentRecord.orgId,
+		createdAtMs: existingState && existingState.providerUserId === enrollmentRecord.providerUserId && existingState.orgId === enrollmentRecord.orgId ? existingState.createdAtMs : nowMs,
+		updatedAtMs: nowMs,
+		otpFailureCount: 0,
+		lastOtpFailureAtMs: void 0,
+		otpLockedUntilMs: void 0,
+		...existingState?.lastEmailOtpLoginAtMs && existingState.providerUserId === enrollmentRecord.providerUserId && existingState.orgId === enrollmentRecord.orgId ? { lastEmailOtpLoginAtMs: existingState.lastEmailOtpLoginAtMs } : {},
+		...existingState?.lastStrongAuthAtMs && existingState.providerUserId === enrollmentRecord.providerUserId && existingState.orgId === enrollmentRecord.orgId ? { lastStrongAuthAtMs: existingState.lastStrongAuthAtMs } : {}
+	});
+	const completedRegistration = await completeGoogleEmailOtpRegistrationAttemptWithStore({
+		registrationAttemptStore: input.registrationAttemptStore,
+		identityStore: input.identityStore,
+		nowMs: Date.now(),
+		registrationAttemptId: request.googleEmailOtpRegistrationAttemptId,
+		walletId: verified.walletId
+	});
+	if (!completedRegistration.ok) return completedRegistration;
+	return {
+		ok: true,
+		walletId: verified.walletId,
+		otpChannel: verified.otpChannel,
+		enrollment: {
+			createdAtMs: existing?.createdAtMs ?? nowMs,
+			updatedAtMs: nowMs,
+			enrollmentSealKeyVersion: enrollmentMaterial.enrollmentSealKeyVersion,
+			unlockKeyVersion: enrollmentMaterial.unlockKeyVersion
+		}
+	};
+}
+//#endregion
+export { buildEmailOtpRegistrationEnrollmentPersistence, emailOtpEnrollmentPersistenceForRegistrationFinalize, resolveEmailOtpRegistrationChallengeProof, validateEmailOtpEnrollmentMaterial, verifyEmailOtpEnrollment };
+
+//# sourceMappingURL=emailOtpRegistrationEnrollment.js.map

package/dist/esm/core/authService/emailOtpSeal.js

@@ -0,0 +1,78 @@
+import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
+import "../../shared-ts/src/utils/validation.js";
+import { errorMessage } from "../../shared-ts/src/utils/errors.js";
+import { createSigningSessionSealShamir3PassCipherAdapter } from "../../threshold/session/signingSessionSeal/crypto/cipher.js";
+import { parseSigningSessionSealRootConfig } from "../../threshold/session/signingSessionSeal/options.js";
+import "../../threshold/session/signingSessionSeal/index.js";
+//#region src/core/authService/emailOtpSeal.ts
+function createEmailOtpShamirCipherFromConfig(input) {
+	if (!input.rootSecretB64u || !input.currentKeyVersion) return {
+		ok: false,
+		code: "not_configured",
+		message: "Email OTP unseal requires a signing-session seal root and current key version"
+	};
+	try {
+		const config = parseSigningSessionSealRootConfig({
+			rootSecretB64u: input.rootSecretB64u,
+			currentKeyVersion: input.currentKeyVersion,
+			acceptedWarmKeyVersions: input.acceptedWarmKeyVersions
+		});
+		return {
+			ok: true,
+			keyVersion: config.currentKeyVersion,
+			cipher: createSigningSessionSealShamir3PassCipherAdapter({ config })
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			code: "not_configured",
+			message: errorMessage(error) || "Email OTP Shamir configuration is invalid"
+		};
+	}
+}
+function emailOtpServerSealThresholdSessionId(operation) {
+	switch (operation) {
+		case "apply-server-seal": return "email-otp-enroll";
+		case "remove-server-seal": return "email-otp-unseal";
+	}
+}
+function emailOtpServerSealFailureMessage(operation) {
+	switch (operation) {
+		case "apply-server-seal": return "Failed to apply Email OTP server seal";
+		case "remove-server-seal": return "Failed to remove Email OTP server seal";
+	}
+}
+async function runEmailOtpServerSealOperation(input) {
+	try {
+		const wrappedCiphertext = normalizeOptionalTrimmedString(input.request.wrappedCiphertext);
+		if (!wrappedCiphertext) return {
+			ok: false,
+			code: "invalid_body",
+			message: "Missing wrappedCiphertext"
+		};
+		if (!input.shamir.ok) return input.shamir;
+		const result = await input.shamir.cipher.run({
+			operation: input.operation,
+			thresholdSessionId: emailOtpServerSealThresholdSessionId(input.operation),
+			ciphertext: wrappedCiphertext,
+			keyVersion: input.shamir.keyVersion,
+			auth: { userId: "email_otp" }
+		});
+		if (!result.ok) return result;
+		return {
+			ok: true,
+			ciphertext: result.ciphertext,
+			enrollmentSealKeyVersion: result.keyVersion || input.shamir.keyVersion
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			code: "internal",
+			message: errorMessage(error) || emailOtpServerSealFailureMessage(input.operation)
+		};
+	}
+}
+//#endregion
+export { createEmailOtpShamirCipherFromConfig, runEmailOtpServerSealOperation };
+
+//# sourceMappingURL=emailOtpSeal.js.map