@seams/wallet-server 0.5.0

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpTargetFactor.js

@@ -0,0 +1,539 @@
+import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { computeLinkedDeviceTargetPreparationDigestV1 } from "../../../../shared-ts/src/device-linking/digests.js";
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, WALLET_EMAIL_OTP_REGISTRATION_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
+import { sealEmailOtpFactorSecretForWorker } from "../../../domains/emailOtp/emailOtpRouteHandlers.js";
+import { computeLinkedDeviceEmailOtpAuthorityDigestV1, computeLinkedDeviceEmailOtpChallengeBindingDigestV1, computeLinkedDeviceEmailOtpGrantTokenDigestV1, linkedDeviceEmailOtpDescriptorCredentialIdV1, linkedDeviceEmailOtpGrantAdmitsUseV1, parseLinkedDeviceEmailOtpGrantRecordV1 } from "../../../../core/deviceLinking/linkedDeviceEmailOtpGrant.js";
+//#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceEmailOtpTargetFactor.ts
+const DEFAULT_GRANT_TTL_MS = 300 * 1e3;
+const DEFAULT_RESEND_COOLDOWN_MS = 30 * 1e3;
+function resolveSentEmailOtpChallengeV1(session, challengeId) {
+	if (session.state.state !== "awaiting_target_factor" || session.targetFactor?.kind !== "email_otp") return null;
+	const challenge = session.emailOtpChallenge;
+	if (!challenge || challenge.state !== "sent" || challenge.challengeId !== challengeId) return null;
+	return challenge;
+}
+var D1LinkedDeviceEmailOtpTargetFactorV1 = class {
+	constructor(options) {
+		this.options = options;
+		this.grantTtlMs = requirePositiveMs(options.grantTtlMs ?? DEFAULT_GRANT_TTL_MS, "grantTtlMs");
+		this.resendCooldownMs = requirePositiveMs(options.resendCooldownMs ?? DEFAULT_RESEND_COOLDOWN_MS, "resendCooldownMs");
+	}
+	async resolveTargetEnrollmentV1(input) {
+		const enrollment = await this.options.enrollments.readEnrollment(String(input.walletId));
+		if (!enrollment) return {
+			kind: "new_enrollment",
+			targetEmail: input.targetEmail
+		};
+		if (enrollment.verifiedEmail !== input.targetEmail) return {
+			kind: "conflict",
+			message: "target Email OTP address conflicts with the wallet enrollment"
+		};
+		return (await this.listEligibleBaseFactorsV1(input.walletId)).length > 0 ? {
+			kind: "existing_enrollment",
+			targetEmail: input.targetEmail
+		} : {
+			kind: "new_enrollment",
+			targetEmail: input.targetEmail
+		};
+	}
+	async resolveBaseFactorSelectionV1(input) {
+		const candidates = await this.listEligibleBaseFactorsV1(input.walletId);
+		if (input.request.kind === "select") {
+			const selected = candidates.find((candidate) => candidate.baseWalletAuthMethodId === input.request.baseWalletAuthMethodId);
+			return selected ? {
+				kind: "selected",
+				choice: {
+					baseWalletAuthMethodId: selected.baseWalletAuthMethodId,
+					maskedEmailHint: selected.maskedEmailHint
+				}
+			} : {
+				kind: "unavailable",
+				reason: "no_active_email_otp_base_factor"
+			};
+		}
+		if (candidates.length === 0) return {
+			kind: "unavailable",
+			reason: "no_active_email_otp_base_factor"
+		};
+		const choices = candidates.map((candidate) => ({
+			baseWalletAuthMethodId: candidate.baseWalletAuthMethodId,
+			maskedEmailHint: candidate.maskedEmailHint
+		}));
+		if (choices.length === 1) return {
+			kind: "selected",
+			choice: choices[0]
+		};
+		return {
+			kind: "selection_required",
+			choices: [choices[0], ...choices.slice(1)]
+		};
+	}
+	async startChallengeV1(input) {
+		const context = await this.resolveChallengeContextV1(input.approval, input.preparation);
+		if (context.kind === "refused") return context;
+		let issued;
+		if (context.kind === "new_enrollment") issued = await this.options.issuer.create({
+			userId: context.providerUserId,
+			email: context.targetEmail,
+			walletId: String(input.approval.walletId),
+			orgId: context.orgId,
+			otpChannel: EMAIL_OTP_CHANNEL,
+			ownerProofBindingDigest: context.bindingDigestB64u,
+			action: WALLET_EMAIL_OTP_ACTIONS.registration,
+			operation: WALLET_EMAIL_OTP_REGISTRATION_OPERATION,
+			reuseActiveChallenge: !input.resend
+		});
+		else issued = await this.options.issuer.create({
+			userId: context.resolved.enrollment.providerUserId,
+			walletId: String(input.approval.walletId),
+			orgId: context.resolved.enrollment.orgId,
+			otpChannel: EMAIL_OTP_CHANNEL,
+			ownerProofBindingDigest: context.bindingDigestB64u,
+			action: WALLET_EMAIL_OTP_ACTIONS.deviceLink,
+			operation: WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION,
+			reuseActiveChallenge: !input.resend
+		});
+		if (!issued.ok) return {
+			kind: "refused",
+			code: issued.code,
+			message: issued.message
+		};
+		return {
+			kind: "sent",
+			challengeId: issued.challenge.challengeId,
+			maskedEmailHint: (context.kind === "existing_enrollment" ? context.resolved.maskedEmailHint : "") || issued.delivery.emailHint,
+			expiresAtMs: issued.challenge.expiresAtMs,
+			resendAvailableAtMs: issued.challenge.issuedAtMs + this.resendCooldownMs
+		};
+	}
+	async verifyChallengeV1(input) {
+		const context = await this.resolveChallengeContextV1(input.approval, input.preparation);
+		if (context.kind === "refused") return context;
+		const challenge = resolveSentEmailOtpChallengeV1(input.session, input.challengeId);
+		if (!challenge) return {
+			kind: "refused",
+			code: "release_recipient_missing",
+			message: "the link session has no worker recipient for this challenge"
+		};
+		if (context.kind === "new_enrollment") return await this.verifyNewEnrollmentChallengeV1({
+			input,
+			context,
+			challenge
+		});
+		const recipientKey = challenge.workerEphemeralPublicKey65B64u;
+		const verified = await this.options.verifier.verifyExisting({
+			userId: context.resolved.enrollment.providerUserId,
+			walletId: String(input.approval.walletId),
+			orgId: context.resolved.enrollment.orgId,
+			challengeId: input.challengeId,
+			otpCode: input.otpCode,
+			otpChannel: EMAIL_OTP_CHANNEL,
+			ownerProofBindingDigest: context.bindingDigestB64u,
+			action: WALLET_EMAIL_OTP_ACTIONS.deviceLink,
+			operation: WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION
+		});
+		if (!verified.ok) return {
+			kind: "refused",
+			code: verified.code,
+			message: verified.message
+		};
+		const issuedAtMs = input.requestedAtMs;
+		const expiresAtMs = Math.min(issuedAtMs + this.grantTtlMs, input.approval.expiresAtMs, input.preparation.expiresAtMs);
+		if (expiresAtMs <= issuedAtMs) return {
+			kind: "refused",
+			code: "enrollment_expired",
+			message: "linked-device enrollment has no remaining lifetime for a grant"
+		};
+		const grantId = randomTokenB64u(16);
+		const grantToken = randomTokenB64u(32);
+		const grantRecord = parseLinkedDeviceEmailOtpGrantRecordV1({
+			kind: "linked_device_email_otp_grant_record_v1",
+			grantId,
+			grantTokenDigestB64u: await computeLinkedDeviceEmailOtpGrantTokenDigestV1(grantToken),
+			walletId: input.approval.walletId,
+			linkSessionId: input.approval.linkSessionId,
+			enrollmentId: input.approval.enrollmentId,
+			deviceId: input.approval.deviceId,
+			targetFactor: { kind: "email_otp" },
+			targetPreparationDigestB64u: context.targetPreparationDigestB64u,
+			targetEmail: context.targetEmail,
+			enrollment: { kind: "existing_enrollment" },
+			emailHashHex: context.resolved.emailHashHex,
+			registrationAuthorityId: context.resolved.registrationAuthorityId,
+			providerUserId: context.resolved.enrollment.providerUserId,
+			baseWalletAuthMethodId: context.resolved.baseWalletAuthMethodId,
+			walletAuthMethodId: context.walletAuthMethodId,
+			authorityDigestB64u: context.authorityDigestB64u,
+			challengeId: verified.challengeId,
+			state: { kind: "issued" },
+			issuedAtMs,
+			expiresAtMs
+		});
+		const unsealed = await this.options.serverSeal.removeEmailOtpServerSeal({ wrappedCiphertext: context.resolved.enrollment.serverSealedFactorCiphertextB64u });
+		if (!unsealed.ok) return {
+			kind: "refused",
+			code: unsealed.code,
+			message: unsealed.message
+		};
+		if (unsealed.enrollmentSealKeyVersion !== context.resolved.enrollment.enrollmentSealKeyVersion) return {
+			kind: "refused",
+			code: "scope_mismatch",
+			message: "Email OTP factor release seal key version changed"
+		};
+		const sealed = await sealEmailOtpFactorSecretForWorker({
+			factorSecret32B64u: unsealed.ciphertext,
+			workerEphemeralPublicKey65B64u: recipientKey,
+			walletId: String(input.approval.walletId),
+			enrollmentId: context.resolved.enrollment.enrollmentId,
+			enrollmentSealKeyVersion: context.resolved.enrollment.enrollmentSealKeyVersion,
+			challengeId: verified.challengeId
+		});
+		if (!sealed.ok) return {
+			kind: "refused",
+			code: sealed.code,
+			message: sealed.message
+		};
+		await this.options.grants.issueV1(grantRecord);
+		return {
+			kind: "verified",
+			grant: {
+				kind: "linked_device_email_otp_verification_grant_v1",
+				grantId,
+				grantToken,
+				challengeId: verified.challengeId,
+				linkSessionId: input.approval.linkSessionId,
+				walletId: input.approval.walletId,
+				enrollmentId: input.approval.enrollmentId,
+				deviceId: input.approval.deviceId,
+				targetPreparationDigestB64u: context.targetPreparationDigestB64u,
+				targetEmail: context.targetEmail,
+				enrollment: { kind: "existing_enrollment" },
+				baseWalletAuthMethodId: context.resolved.baseWalletAuthMethodId,
+				emailHashHex: context.resolved.emailHashHex,
+				registrationAuthorityId: context.resolved.registrationAuthorityId,
+				providerUserId: context.resolved.enrollment.providerUserId,
+				authorityDigestB64u: context.authorityDigestB64u,
+				issuedAtMs,
+				expiresAtMs
+			},
+			factorRelease: {
+				kind: "email_otp_factor_release_v1",
+				challengeId: verified.challengeId,
+				enrollmentId: context.resolved.enrollment.enrollmentId,
+				enrollmentSealKeyVersion: context.resolved.enrollment.enrollmentSealKeyVersion,
+				serverEphemeralPublicKey65B64u: sealed.serverEphemeralPublicKey65B64u,
+				nonce12B64u: sealed.nonce12B64u,
+				ciphertextB64u: sealed.ciphertextB64u
+			}
+		};
+	}
+	async verifyNewEnrollmentChallengeV1(input) {
+		const verified = await this.options.verifier.verifyRegistration({
+			providerSubject: input.context.providerUserId,
+			walletId: String(input.input.approval.walletId),
+			orgId: input.context.orgId,
+			challengeId: input.input.challengeId,
+			otpCode: input.input.otpCode,
+			otpChannel: EMAIL_OTP_CHANNEL,
+			ownerProofBindingDigest: input.context.bindingDigestB64u,
+			proofEmail: input.context.targetEmail
+		});
+		if (!verified.ok) return {
+			kind: "refused",
+			code: verified.code,
+			message: verified.message
+		};
+		if (verified.email !== input.context.targetEmail || verified.challengeSubjectId !== input.context.providerUserId || verified.challengeId !== input.challenge.challengeId) return {
+			kind: "refused",
+			code: "scope_mismatch",
+			message: "Email OTP registration challenge identity changed"
+		};
+		const issuedAtMs = input.input.requestedAtMs;
+		const expiresAtMs = Math.min(issuedAtMs + this.grantTtlMs, input.input.approval.expiresAtMs, input.input.preparation.expiresAtMs);
+		if (expiresAtMs <= issuedAtMs) return {
+			kind: "refused",
+			code: "enrollment_expired",
+			message: "linked-device enrollment has no remaining lifetime for a grant"
+		};
+		const grantId = randomTokenB64u(16);
+		const grantToken = randomTokenB64u(32);
+		const emailHashHex = await sha256HexUtf8(input.context.targetEmail);
+		const grantRecord = parseLinkedDeviceEmailOtpGrantRecordV1({
+			kind: "linked_device_email_otp_grant_record_v1",
+			grantId,
+			grantTokenDigestB64u: await computeLinkedDeviceEmailOtpGrantTokenDigestV1(grantToken),
+			walletId: input.input.approval.walletId,
+			linkSessionId: input.input.approval.linkSessionId,
+			enrollmentId: input.input.approval.enrollmentId,
+			deviceId: input.input.approval.deviceId,
+			targetFactor: { kind: "email_otp" },
+			targetPreparationDigestB64u: input.context.targetPreparationDigestB64u,
+			targetEmail: input.context.targetEmail,
+			enrollment: { kind: "new_enrollment" },
+			emailHashHex,
+			registrationAuthorityId: verified.challengeId,
+			providerUserId: input.context.providerUserId,
+			walletAuthMethodId: input.context.walletAuthMethodId,
+			authorityDigestB64u: input.context.authorityDigestB64u,
+			challengeId: verified.challengeId,
+			state: { kind: "issued" },
+			issuedAtMs,
+			expiresAtMs
+		});
+		await this.options.grants.issueV1(grantRecord);
+		return {
+			kind: "verified",
+			grant: {
+				kind: "linked_device_email_otp_verification_grant_v1",
+				grantId,
+				grantToken,
+				challengeId: verified.challengeId,
+				linkSessionId: input.input.approval.linkSessionId,
+				walletId: input.input.approval.walletId,
+				enrollmentId: input.input.approval.enrollmentId,
+				deviceId: input.input.approval.deviceId,
+				targetPreparationDigestB64u: input.context.targetPreparationDigestB64u,
+				targetEmail: input.context.targetEmail,
+				enrollment: { kind: "new_enrollment" },
+				emailHashHex,
+				registrationAuthorityId: verified.challengeId,
+				providerUserId: input.context.providerUserId,
+				authorityDigestB64u: input.context.authorityDigestB64u,
+				issuedAtMs,
+				expiresAtMs
+			},
+			factorRelease: null
+		};
+	}
+	async verifyRegistrationGrantV1(input) {
+		const wireGrant = input.registration.emailOtpVerificationGrant;
+		if (input.registration.targetFactor.kind !== "email_otp" || !wireGrant) return {
+			kind: "rejected",
+			message: "Email OTP verification grant is missing"
+		};
+		const durable = await this.options.grants.readByIdV1(wireGrant.grantId);
+		if (!durable || !linkedDeviceEmailOtpGrantAdmitsUseV1(durable, input.requestedAtMs)) return {
+			kind: "rejected",
+			message: "Email OTP verification grant is unavailable"
+		};
+		const tokenDigest = await computeLinkedDeviceEmailOtpGrantTokenDigestV1(wireGrant.grantToken);
+		if (!isEmailOtpTargetPreparationV1(input.preparation)) return {
+			kind: "rejected",
+			message: "Email OTP target preparation is unavailable"
+		};
+		if (!(tokenDigest === durable.grantTokenDigestB64u && durable.walletId === input.preparation.walletId && durable.linkSessionId === input.preparation.linkSessionId && durable.enrollmentId === input.preparation.enrollmentId && durable.deviceId === input.preparation.deviceId && durable.walletAuthMethodId === input.preparation.walletAuthMethodId && durable.targetPreparationDigestB64u === input.registration.targetPreparationDigestB64u && durable.targetEmail === input.preparation.targetEmail && durable.targetEmail === wireGrant.targetEmail && durable.enrollment.kind === input.preparation.enrollment.kind && durable.enrollment.kind === wireGrant.enrollment.kind && durable.authorityDigestB64u === wireGrant.authorityDigestB64u && durable.challengeId === wireGrant.challengeId && durable.issuedAtMs === wireGrant.issuedAtMs && durable.expiresAtMs === wireGrant.expiresAtMs && durable.targetEmail === wireGrant.targetEmail && durable.emailHashHex === wireGrant.emailHashHex && durable.registrationAuthorityId === wireGrant.registrationAuthorityId && durable.providerUserId === wireGrant.providerUserId)) return {
+			kind: "rejected",
+			message: "Email OTP verification grant identity changed"
+		};
+		if (input.preparation.enrollment.kind === "new_enrollment") {
+			if (input.registration.emailOtpEnrollment === void 0) return {
+				kind: "rejected",
+				message: "new Email OTP enrollment material is missing"
+			};
+			if (durable.baseWalletAuthMethodId !== void 0 || wireGrant.baseWalletAuthMethodId !== void 0) return {
+				kind: "rejected",
+				message: "new Email OTP grant cannot carry a base factor"
+			};
+			if (durable.targetEmail !== wireGrant.targetEmail) return {
+				kind: "rejected",
+				message: "Email OTP target email changed"
+			};
+			if (await this.options.enrollments.readEnrollment(String(input.preparation.walletId))) return {
+				kind: "rejected",
+				message: "wallet already has an Email OTP enrollment"
+			};
+			return {
+				kind: "verified",
+				grant: {
+					grantId: durable.grantId,
+					targetEmail: durable.targetEmail,
+					enrollment: { kind: "new_enrollment" },
+					providerUserId: durable.providerUserId,
+					authorityDigestB64u: durable.authorityDigestB64u,
+					descriptorCredentialIdB64u: await linkedDeviceEmailOtpDescriptorCredentialIdV1(durable.walletAuthMethodId)
+				}
+			};
+		}
+		const baseWalletAuthMethodId = input.preparation.baseWalletAuthMethodId;
+		if (!baseWalletAuthMethodId) return {
+			kind: "rejected",
+			message: "existing Email OTP base factor is missing"
+		};
+		const baseFactor = await this.resolveBaseFactorV1(input.preparation.walletId, baseWalletAuthMethodId);
+		if (!baseFactor || durable.baseWalletAuthMethodId !== baseFactor.baseWalletAuthMethodId || durable.baseWalletAuthMethodId !== wireGrant.baseWalletAuthMethodId || baseFactor.emailHashHex !== wireGrant.emailHashHex || baseFactor.registrationAuthorityId !== wireGrant.registrationAuthorityId || baseFactor.enrollment.providerUserId !== wireGrant.providerUserId || baseFactor.enrollment.verifiedEmail !== input.preparation.targetEmail) return {
+			kind: "rejected",
+			message: "Email OTP verification grant identity changed"
+		};
+		return {
+			kind: "verified",
+			grant: {
+				grantId: durable.grantId,
+				targetEmail: durable.targetEmail,
+				enrollment: { kind: "existing_enrollment" },
+				providerUserId: durable.providerUserId,
+				baseWalletAuthMethodId: durable.baseWalletAuthMethodId,
+				authorityDigestB64u: durable.authorityDigestB64u,
+				descriptorCredentialIdB64u: await linkedDeviceEmailOtpDescriptorCredentialIdV1(durable.walletAuthMethodId)
+			}
+		};
+	}
+	async buildCompletionStatementsV1(input) {
+		return this.options.grants.buildConsumeStatementsV1({
+			grantId: input.grant.grantId,
+			consumedAtMs: input.consumedAtMs
+		});
+	}
+	async resolveChallengeContextV1(approval, preparation) {
+		if (approval.targetFactor.kind !== "email_otp") return {
+			kind: "refused",
+			code: "wrong_target_factor",
+			message: "approved target factor is not email OTP"
+		};
+		if (preparation.targetFactor.kind !== "email_otp") return {
+			kind: "refused",
+			code: "wrong_target_factor",
+			message: "target preparation is not email OTP"
+		};
+		const targetEmail = approval.targetFactor.targetEmail;
+		const enrollment = approval.targetFactor.enrollment;
+		if (!targetEmail || !enrollment || !preparation.targetEmail || !preparation.enrollment || targetEmail !== preparation.targetEmail || enrollment.kind !== preparation.enrollment.kind) return {
+			kind: "refused",
+			code: "target_changed",
+			message: "approved Email OTP target changed"
+		};
+		const targetPreparationDigestB64u = parseDigestB64u(await computeLinkedDeviceTargetPreparationDigestV1(preparation));
+		const walletAuthMethodId = preparation.walletAuthMethodId;
+		if (enrollment.kind === "existing_enrollment") {
+			const baseWalletAuthMethodId = preparation.baseWalletAuthMethodId;
+			if (!baseWalletAuthMethodId || !approval.targetFactor.baseWalletAuthMethodId) return {
+				kind: "refused",
+				code: "base_factor_unavailable",
+				message: "approved Email OTP base factor is missing"
+			};
+			if (approval.targetFactor.baseWalletAuthMethodId !== baseWalletAuthMethodId) return {
+				kind: "refused",
+				code: "base_factor_changed",
+				message: "approved Email OTP base factor changed"
+			};
+			const resolved = await this.resolveBaseFactorV1(approval.walletId, baseWalletAuthMethodId);
+			if (!resolved || resolved.enrollment.verifiedEmail !== targetEmail) return {
+				kind: "refused",
+				code: "base_factor_unavailable",
+				message: "wallet has no active verified Email OTP factor for the target address"
+			};
+			return {
+				kind: "existing_enrollment",
+				resolved,
+				targetEmail,
+				enrollment: { kind: "existing_enrollment" },
+				targetPreparationDigestB64u,
+				walletAuthMethodId,
+				authorityDigestB64u: await computeLinkedDeviceEmailOtpAuthorityDigestV1({
+					walletId: approval.walletId,
+					enrollmentId: approval.enrollmentId,
+					deviceId: approval.deviceId,
+					walletAuthMethodId,
+					targetEmail,
+					enrollment: { kind: "existing_enrollment" },
+					baseWalletAuthMethodId: resolved.baseWalletAuthMethodId
+				}),
+				bindingDigestB64u: await computeLinkedDeviceEmailOtpChallengeBindingDigestV1({
+					walletId: approval.walletId,
+					linkSessionId: approval.linkSessionId,
+					enrollmentId: approval.enrollmentId,
+					deviceId: approval.deviceId,
+					targetPreparationDigestB64u,
+					targetEmail,
+					enrollment: { kind: "existing_enrollment" },
+					baseWalletAuthMethodId: resolved.baseWalletAuthMethodId,
+					walletAuthMethodId
+				})
+			};
+		}
+		if (preparation.baseWalletAuthMethodId || approval.targetFactor.baseWalletAuthMethodId) return {
+			kind: "refused",
+			code: "base_factor_changed",
+			message: "new Email OTP enrollment cannot carry an existing base factor"
+		};
+		if (await this.options.enrollments.readEnrollment(String(approval.walletId))) return {
+			kind: "refused",
+			code: "target_enrollment_exists",
+			message: "wallet already has an Email OTP enrollment"
+		};
+		const providerUserId = String(targetEmail);
+		return {
+			kind: "new_enrollment",
+			targetEmail,
+			enrollment: { kind: "new_enrollment" },
+			targetPreparationDigestB64u,
+			walletAuthMethodId,
+			authorityDigestB64u: await computeLinkedDeviceEmailOtpAuthorityDigestV1({
+				walletId: approval.walletId,
+				enrollmentId: approval.enrollmentId,
+				deviceId: approval.deviceId,
+				walletAuthMethodId,
+				targetEmail,
+				enrollment: { kind: "new_enrollment" }
+			}),
+			bindingDigestB64u: await computeLinkedDeviceEmailOtpChallengeBindingDigestV1({
+				walletId: approval.walletId,
+				linkSessionId: approval.linkSessionId,
+				enrollmentId: approval.enrollmentId,
+				deviceId: approval.deviceId,
+				targetPreparationDigestB64u,
+				targetEmail,
+				enrollment: { kind: "new_enrollment" },
+				walletAuthMethodId
+			}),
+			providerUserId,
+			orgId: this.options.orgId
+		};
+	}
+	async listEligibleBaseFactorsV1(walletId) {
+		const enrollment = await this.options.enrollments.readEnrollment(String(walletId));
+		if (!enrollment || !enrollment.serverSealedFactorCiphertextB64u) return [];
+		const emailHashHex = await sha256HexUtf8(enrollment.verifiedEmail);
+		const active = (await this.options.walletAuthMethods.listForWalletV2({ walletId: String(walletId) })).filter((method) => method.kind === "email_otp" && method.status === "active");
+		const candidates = [];
+		for (const factor of active) {
+			if (factor.kind !== "email_otp" || factor.emailHashHex !== emailHashHex) continue;
+			const authority = await this.options.walletAuthorities.readById(factor.walletAuthorityId);
+			if (!authority || authority.state !== "active" || authority.walletId !== walletId) continue;
+			candidates.push({
+				enrollment,
+				emailHashHex,
+				registrationAuthorityId: factor.registrationAuthorityId,
+				baseWalletAuthMethodId: factor.walletAuthMethodId,
+				maskedEmailHint: enrollment.verifiedEmail.trim().toLowerCase()
+			});
+		}
+		return candidates.sort((left, right) => String(left.baseWalletAuthMethodId).localeCompare(String(right.baseWalletAuthMethodId)));
+	}
+	async resolveBaseFactorV1(walletId, baseWalletAuthMethodId) {
+		return (await this.listEligibleBaseFactorsV1(walletId)).find((candidate) => candidate.baseWalletAuthMethodId === baseWalletAuthMethodId) ?? null;
+	}
+};
+function isEmailOtpTargetPreparationV1(preparation) {
+	return preparation.targetFactor.kind === "email_otp";
+}
+function linkedDeviceEmailOtpGrantRegistrationPortV1(provider) {
+	return {
+		verifyRegistrationGrantV1: (input) => provider.verifyRegistrationGrantV1(input),
+		buildCompletionStatementsV1: (input) => provider.buildCompletionStatementsV1(input)
+	};
+}
+function requirePositiveMs(value, label) {
+	if (!Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive safe integer`);
+	return value;
+}
+function randomTokenB64u(byteLength) {
+	const bytes = new Uint8Array(byteLength);
+	crypto.getRandomValues(bytes);
+	return base64UrlEncode(bytes);
+}
+//#endregion
+export { D1LinkedDeviceEmailOtpTargetFactorV1, linkedDeviceEmailOtpGrantRegistrationPortV1 };
+
+//# sourceMappingURL=d1LinkedDeviceEmailOtpTargetFactor.js.map

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceManagementService.js

@@ -0,0 +1,92 @@
+import { LinkedDeviceManagementServiceV1 } from "../../../../core/deviceLinking/linkedDeviceManagement.js";
+//#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceManagementService.ts
+function createD1LinkedDeviceManagementServiceV1(input) {
+	return new LinkedDeviceManagementServiceV1({
+		tenantId: input.tenantId,
+		authenticator: ownerSessionPortV1(input.walletSessionAuthorizations),
+		authority: authorityPortV1({
+			store: input.authorityStore,
+			tenantId: input.tenantId,
+			walletSessionAuthorizations: input.walletSessionAuthorizations
+		}),
+		authMethod: authMethodPortV1(input.authMethodStore),
+		sessions: input.authorizationService,
+		credentials: {
+			readPasskeyDeviceInfoV1: async ({ walletId, credentialIdB64u }) => {
+				return (await input.webAuthnStore.readAuthenticator({
+					userId: String(walletId),
+					credentialIdB64u
+				}))?.deviceInfo ?? null;
+			},
+			readEmailOtpAddressV1: async ({ walletId }) => {
+				return (await input.emailOtpEnrollments?.readEnrollment(String(walletId)))?.verifiedEmail ?? null;
+			}
+		},
+		...input.materialDeactivation === void 0 ? {} : { materialDeactivation: input.materialDeactivation }
+	});
+}
+function ownerSessionPortV1(store) {
+	return { readActiveOwnerWalletSessionV1: async (identity) => {
+		const session = await store.readActiveWalletSessionAuthorizationV2ByIdentity(identity);
+		if (!session) return null;
+		return {
+			walletId: session.walletId,
+			walletSessionId: session.walletSessionId,
+			authorizationId: session.authorizationId,
+			walletAuthMethodId: session.walletAuthMethodId,
+			authorityDigestB64u: session.authorityDigestB64u,
+			expiresAtMs: session.expiresAtMs
+		};
+	} };
+}
+function authorityPortV1(input) {
+	return {
+		listActiveForWalletV1: async ({ walletId, limit, cursor }) => {
+			const page = await input.store.listForWallet({
+				walletId,
+				lifecycleState: "active",
+				limit,
+				cursor: cursor ? {
+					updatedAtMs: cursor.updatedAtMs,
+					authorityId: cursor.authorityId
+				} : null
+			});
+			const records = [];
+			for (const authority of page.records) {
+				if (authority.state !== "active") throw new Error("active wallet authority query returned a non-active authority");
+				records.push(authority);
+			}
+			return {
+				records,
+				nextCursor: page.nextCursor ? {
+					kind: "wallet_authority_v1",
+					updatedAtMs: page.nextCursor.updatedAtMs,
+					authorityId: page.nextCursor.authorityId
+				} : null
+			};
+		},
+		readByIdV1: async (authorityId) => await input.store.readById(authorityId),
+		revokeWalletAuthMethodV1: async (request) => await input.store.revokeWalletAuthMethod({
+			...request,
+			sessionRevocationStatements: input.walletSessionAuthorizations.prepareRetireWalletSessionAuthorizationsV2ForAuthority({
+				tenantId: input.tenantId,
+				walletId: request.walletId,
+				authorityId: request.authorityId,
+				nowMs: request.requestedAtMs
+			})
+		})
+	};
+}
+function authMethodPortV1(store) {
+	return {
+		listForAuthorityV1: async ({ walletId, authorityId }) => await store.listForWalletV2({
+			walletId,
+			walletAuthorityId: authorityId
+		}),
+		readByIdV1: async ({ walletAuthMethodId }) => await store.readByIdV2({ walletAuthMethodId })
+	};
+}
+//#endregion
+export { createD1LinkedDeviceManagementServiceV1 };
+
+//# sourceMappingURL=d1LinkedDeviceManagementService.js.map