@seams/wallet-server 0.5.0

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.js

@@ -0,0 +1,539 @@
+import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
+import "../../../../shared-ts/src/utils/encoders.js";
+import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
+import "../../../../shared-ts/src/utils/validation.js";
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION, isWalletEmailOtpLoginOperation } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
+import { isB64uString, nonNegativeSafeInteger, parseJsonObject, positiveSafeInteger } from "../auth/d1RouterApiAuthBoundary.js";
+//#region src/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.ts
+function maskEmail(email) {
+	const trimmed = email.trim().toLowerCase();
+	const atIndex = trimmed.indexOf("@");
+	if (atIndex <= 0 || atIndex === trimmed.length - 1) return "hidden";
+	const local = trimmed.slice(0, atIndex);
+	const domain = trimmed.slice(atIndex + 1);
+	const localMask = local.length <= 2 ? `${local[0] || "*"}*` : `${local[0]}***${local.slice(-1)}`;
+	const domainParts = domain.split(".");
+	const domainName = domainParts[0] || "";
+	return `${localMask}@${[domainName.length <= 2 ? `${domainName[0] || "*"}*` : `${domainName[0]}***${domainName.slice(-1)}`, ...domainParts.slice(1)].join(".")}`;
+}
+function generateNumericOtp(length) {
+	if (typeof crypto === "undefined" || typeof crypto.getRandomValues !== "function") throw new Error("crypto.getRandomValues is unavailable in this runtime");
+	const bytes = crypto.getRandomValues(new Uint8Array(length));
+	let code = "";
+	for (const byte of bytes) code += String(byte % 10);
+	return code;
+}
+function clampedEmailOtpUnlockTtlMs(input) {
+	const value = typeof input === "number" ? input : Number(input);
+	if (!Number.isFinite(value) || value <= 0) return 5 * 6e4;
+	return Math.min(Math.max(Math.floor(value), 1e4), 10 * 6e4);
+}
+function decodeFixedBase64Url(input, byteLength) {
+	try {
+		const decoded = base64UrlDecode(input);
+		return decoded.length === byteLength ? decoded : null;
+	} catch {
+		return null;
+	}
+}
+function bytesEqual(left, right) {
+	if (left.length !== right.length) return false;
+	let difference = 0;
+	for (let index = 0; index < left.length; index += 1) difference |= (left[index] || 0) ^ (right[index] || 0);
+	return difference === 0;
+}
+function emailOtpRateLimitKeys(input) {
+	const keySuffix = [
+		`scope=${input.scope}`,
+		`action=${input.action || "default"}`,
+		`limit=${input.policy.limit}`,
+		`windowMs=${input.policy.windowMs}`
+	].join(":");
+	return [
+		input.clientIp ? `${keySuffix}:ip:${input.clientIp}` : "",
+		input.userId ? `${keySuffix}:user:${input.userId}` : "",
+		input.walletId ? `${keySuffix}:wallet:${input.walletId}` : "",
+		input.providerSubject ? `${keySuffix}:provider:${input.providerSubject}` : "",
+		input.orgId ? `${keySuffix}:org:${input.orgId}` : ""
+	].filter(Boolean);
+}
+function emailOtpRateLimitExceeded(row) {
+	const resetAtMs = positiveSafeInteger(row?.reset_at_ms);
+	const retryAfterMs = resetAtMs ? Math.max(0, resetAtMs - Date.now()) : void 0;
+	return {
+		ok: false,
+		code: "rate_limited",
+		message: "Email OTP rate limit exceeded",
+		...retryAfterMs !== void 0 ? { retryAfterMs } : {},
+		...resetAtMs ? { resetAtMs } : {}
+	};
+}
+function parseEmailOtpWalletEnrollmentRecord(input) {
+	const record = parseJsonObject(input);
+	if (!record || hasRecordField(record, "enrollmentEscrowCiphertextB64u")) return null;
+	const version = normalizeOptionalTrimmedString(record.version);
+	const walletId = normalizeOptionalTrimmedString(record.walletId);
+	const providerUserId = normalizeOptionalTrimmedString(record.providerUserId);
+	const orgId = normalizeOptionalTrimmedString(record.orgId);
+	const verifiedEmail = normalizeOptionalTrimmedString(record.verifiedEmail)?.toLowerCase() || "";
+	const enrollmentId = normalizeOptionalTrimmedString(record.enrollmentId);
+	const enrollmentVersion = normalizeOptionalTrimmedString(record.enrollmentVersion);
+	const enrollmentSealKeyVersion = normalizeOptionalTrimmedString(record.enrollmentSealKeyVersion);
+	const clientUnlockPublicKeyB64u = normalizeOptionalTrimmedString(record.clientUnlockPublicKeyB64u);
+	const unlockKeyVersion = normalizeOptionalTrimmedString(record.unlockKeyVersion);
+	const serverSealedFactorCiphertextB64u = normalizeOptionalTrimmedString(record.serverSealedFactorCiphertextB64u);
+	const createdAtMs = positiveSafeInteger(record.createdAtMs);
+	const updatedAtMs = positiveSafeInteger(record.updatedAtMs);
+	if (version !== "email_otp_wallet_enrollment_v1" || !walletId || !providerUserId || !orgId || !verifiedEmail || !enrollmentId || !enrollmentVersion || !enrollmentSealKeyVersion || !clientUnlockPublicKeyB64u || !unlockKeyVersion || !serverSealedFactorCiphertextB64u || !createdAtMs || !updatedAtMs || updatedAtMs < createdAtMs) return null;
+	return {
+		version: "email_otp_wallet_enrollment_v1",
+		walletId,
+		providerUserId,
+		orgId,
+		verifiedEmail,
+		enrollmentId,
+		enrollmentVersion,
+		enrollmentSealKeyVersion,
+		clientUnlockPublicKeyB64u,
+		unlockKeyVersion,
+		serverSealedFactorCiphertextB64u,
+		createdAtMs,
+		updatedAtMs
+	};
+}
+function parseEmailOtpWalletEnrollmentRow(row) {
+	const record = parseEmailOtpWalletEnrollmentRecord(row?.record_json);
+	const updatedAtMs = positiveSafeInteger(row?.updated_at_ms);
+	if (!record || !updatedAtMs || record.updatedAtMs !== updatedAtMs) return null;
+	return record;
+}
+function parseEmailOtpAuthStateRecord(input) {
+	const record = parseJsonObject(input);
+	if (!record) return null;
+	const version = normalizeOptionalTrimmedString(record.version);
+	const walletId = normalizeOptionalTrimmedString(record.walletId);
+	const providerUserId = normalizeOptionalTrimmedString(record.providerUserId);
+	const orgId = normalizeOptionalTrimmedString(record.orgId);
+	const createdAtMs = positiveSafeInteger(record.createdAtMs);
+	const updatedAtMs = positiveSafeInteger(record.updatedAtMs);
+	const otpFailureCount = optionalNonNegativeSafeIntegerField(record, "otpFailureCount");
+	const lastOtpFailureAtMs = optionalPositiveSafeIntegerField(record, "lastOtpFailureAtMs");
+	const otpLockedUntilMs = optionalPositiveSafeIntegerField(record, "otpLockedUntilMs");
+	const lastEmailOtpLoginAtMs = optionalPositiveSafeIntegerField(record, "lastEmailOtpLoginAtMs");
+	const lastStrongAuthAtMs = optionalPositiveSafeIntegerField(record, "lastStrongAuthAtMs");
+	if (version !== "email_otp_auth_state_v1" || !walletId || !providerUserId || !orgId || !createdAtMs || !updatedAtMs || otpFailureCount === null || lastOtpFailureAtMs === null || otpLockedUntilMs === null || lastEmailOtpLoginAtMs === null || lastStrongAuthAtMs === null || updatedAtMs < createdAtMs) return null;
+	return {
+		version: "email_otp_auth_state_v1",
+		walletId,
+		providerUserId,
+		orgId,
+		createdAtMs,
+		updatedAtMs,
+		...otpFailureCount != null ? { otpFailureCount } : {},
+		...lastOtpFailureAtMs != null ? { lastOtpFailureAtMs } : {},
+		...otpLockedUntilMs != null ? { otpLockedUntilMs } : {},
+		...lastEmailOtpLoginAtMs != null ? { lastEmailOtpLoginAtMs } : {},
+		...lastStrongAuthAtMs != null ? { lastStrongAuthAtMs } : {}
+	};
+}
+function parseEmailOtpAuthStateRow(row) {
+	const record = parseEmailOtpAuthStateRecord(row?.record_json);
+	const updatedAtMs = positiveSafeInteger(row?.updated_at_ms);
+	if (!record || !updatedAtMs || record.updatedAtMs !== updatedAtMs) return null;
+	return record;
+}
+function parseEmailOtpChallengeOperation(input) {
+	const operation = normalizeOptionalTrimmedString(input);
+	if (!operation) return null;
+	if (isWalletEmailOtpLoginOperation(operation)) return operation;
+	if (operation === "registration") return operation;
+	if (operation === "device_link") return operation;
+	return null;
+}
+function parseEmailOtpLoginOperation(input) {
+	const operation = normalizeOptionalTrimmedString(input);
+	if (operation && isWalletEmailOtpLoginOperation(operation)) return operation;
+	return WALLET_EMAIL_OTP_UNLOCK_OPERATION;
+}
+function parseEmailOtpChallengeRecord(input) {
+	const record = parseJsonObject(input);
+	if (!record) return null;
+	const version = normalizeOptionalTrimmedString(record.version);
+	const challengeId = normalizeOptionalTrimmedString(record.challengeId);
+	const challengeSubjectId = normalizeOptionalTrimmedString(record.challengeSubjectId);
+	const walletId = normalizeOptionalTrimmedString(record.walletId);
+	const orgId = normalizeOptionalTrimmedString(record.orgId);
+	const otpChannel = normalizeOptionalTrimmedString(record.otpChannel);
+	const email = normalizeOptionalTrimmedString(record.email)?.toLowerCase() || "";
+	const otpCode = normalizeOptionalTrimmedString(record.otpCode);
+	const ownerProofBindingDigest = normalizeOptionalTrimmedString(record.ownerProofBindingDigest);
+	const action = parseEmailOtpChallengeAction(record.action);
+	const operation = parseEmailOtpChallengeOperation(record.operation);
+	const createdAtMs = positiveSafeInteger(record.createdAtMs);
+	const expiresAtMs = positiveSafeInteger(record.expiresAtMs);
+	const attemptCount = nonNegativeSafeInteger(record.attemptCount);
+	const maxAttempts = positiveSafeInteger(record.maxAttempts);
+	if (version !== "email_otp_challenge_v1" || !challengeId || !challengeSubjectId || !walletId || !email || !otpCode || !ownerProofBindingDigest || !action || !operation || !emailOtpChallengePurposeIsValid({
+		action,
+		operation
+	}) || otpChannel !== "email_otp" || !createdAtMs || !expiresAtMs || attemptCount === null || !maxAttempts || expiresAtMs <= createdAtMs) return null;
+	return {
+		version: "email_otp_challenge_v1",
+		challengeId,
+		challengeSubjectId,
+		walletId,
+		...orgId ? { orgId } : {},
+		otpChannel: EMAIL_OTP_CHANNEL,
+		email,
+		otpCode,
+		ownerProofBindingDigest,
+		action,
+		operation,
+		createdAtMs,
+		expiresAtMs,
+		attemptCount,
+		maxAttempts
+	};
+}
+function parseEmailOtpChallengeRow(row) {
+	const record = parseEmailOtpChallengeRecord(row?.record_json);
+	const expiresAtMs = positiveSafeInteger(row?.expires_at_ms);
+	if (!record || !expiresAtMs || record.expiresAtMs !== expiresAtMs) return null;
+	return record;
+}
+function parseEmailOtpRegistrationVerificationReceiptV1(input) {
+	const record = parseJsonObject(input);
+	if (!record || !hasExactRecordFields(record, [
+		"version",
+		"requestFingerprint",
+		"verified",
+		"verifiedAtMs",
+		"expiresAtMs"
+	]) || record.version !== "email_otp_registration_verification_receipt_v1") return null;
+	const requestFingerprint = normalizeOptionalTrimmedString(record.requestFingerprint);
+	const verified = parseJsonObject(record.verified);
+	const verifiedAtMs = positiveSafeInteger(record.verifiedAtMs);
+	const expiresAtMs = positiveSafeInteger(record.expiresAtMs);
+	if (!requestFingerprint || !isB64uString(requestFingerprint) || !verified || !hasExactRecordFields(verified, [
+		"challengeId",
+		"challengeSubjectId",
+		"walletId",
+		"orgId",
+		"email",
+		"otpChannel"
+	]) || !verifiedAtMs || !expiresAtMs || expiresAtMs <= verifiedAtMs) return null;
+	const challengeId = normalizeOptionalTrimmedString(verified.challengeId);
+	const challengeSubjectId = normalizeOptionalTrimmedString(verified.challengeSubjectId);
+	const walletId = normalizeOptionalTrimmedString(verified.walletId);
+	const orgId = normalizeOptionalTrimmedString(verified.orgId);
+	const email = normalizeOptionalTrimmedString(verified.email)?.toLowerCase() || "";
+	if (!challengeId || !challengeSubjectId || !walletId || !orgId || !email || verified.otpChannel !== "email_otp") return null;
+	return {
+		version: "email_otp_registration_verification_receipt_v1",
+		requestFingerprint,
+		verified: {
+			challengeId,
+			challengeSubjectId,
+			walletId,
+			orgId,
+			email,
+			otpChannel: EMAIL_OTP_CHANNEL
+		},
+		verifiedAtMs,
+		expiresAtMs
+	};
+}
+function parseEmailOtpUnlockChallengeRecord(input) {
+	const record = parseJsonObject(input);
+	if (!record) return null;
+	const version = normalizeOptionalTrimmedString(record.version);
+	const challengeId = normalizeOptionalTrimmedString(record.challengeId);
+	const walletId = normalizeOptionalTrimmedString(record.walletId);
+	const userId = normalizeOptionalTrimmedString(record.userId);
+	const orgId = normalizeOptionalTrimmedString(record.orgId);
+	const challengeB64u = normalizeOptionalTrimmedString(record.challengeB64u);
+	const createdAtMs = positiveSafeInteger(record.createdAtMs);
+	const expiresAtMs = positiveSafeInteger(record.expiresAtMs);
+	if (version !== "email_otp_unlock_challenge_v1" || !challengeId || !walletId || !userId || !challengeB64u || !createdAtMs || !expiresAtMs || expiresAtMs <= createdAtMs) return null;
+	return {
+		version: "email_otp_unlock_challenge_v1",
+		challengeId,
+		walletId,
+		userId,
+		...orgId ? { orgId } : {},
+		challengeB64u,
+		createdAtMs,
+		expiresAtMs
+	};
+}
+function parseEmailOtpUnlockChallengeRow(row) {
+	const record = parseEmailOtpUnlockChallengeRecord(row?.record_json);
+	const expiresAtMs = positiveSafeInteger(row?.expires_at_ms);
+	if (!record || !expiresAtMs || record.expiresAtMs !== expiresAtMs) return null;
+	return record;
+}
+function emailOtpChallengeContextValues(input) {
+	return [
+		input.challengeSubjectId,
+		input.walletId,
+		input.orgId,
+		EMAIL_OTP_CHANNEL,
+		input.ownerProofBindingDigest,
+		input.action,
+		input.operation
+	];
+}
+function emailOtpChallengeRecord(input) {
+	return {
+		version: "email_otp_challenge_v1",
+		challengeId: input.challengeId,
+		challengeSubjectId: input.challengeSubjectId,
+		walletId: input.walletId,
+		orgId: input.orgId,
+		otpChannel: EMAIL_OTP_CHANNEL,
+		email: input.email,
+		otpCode: input.otpCode,
+		ownerProofBindingDigest: input.ownerProofBindingDigest,
+		action: input.action,
+		operation: input.operation,
+		createdAtMs: input.createdAtMs,
+		expiresAtMs: input.expiresAtMs,
+		attemptCount: 0,
+		maxAttempts: input.maxAttempts
+	};
+}
+function emailOtpChallengeWithAttemptCount(record, attemptCount) {
+	return {
+		version: "email_otp_challenge_v1",
+		challengeId: record.challengeId,
+		challengeSubjectId: record.challengeSubjectId,
+		walletId: record.walletId,
+		...record.orgId ? { orgId: record.orgId } : {},
+		otpChannel: EMAIL_OTP_CHANNEL,
+		email: record.email,
+		otpCode: record.otpCode,
+		ownerProofBindingDigest: record.ownerProofBindingDigest,
+		action: record.action,
+		operation: record.operation,
+		createdAtMs: record.createdAtMs,
+		expiresAtMs: record.expiresAtMs,
+		attemptCount,
+		maxAttempts: record.maxAttempts
+	};
+}
+function emailOtpChallengeBindingMismatchCode(input) {
+	if (input.record.otpChannel !== "email_otp") return "challenge_channel_mismatch";
+	if (input.record.challengeSubjectId !== input.userId) return "challenge_subject_mismatch";
+	if (input.record.walletId !== input.walletId) return "challenge_wallet_mismatch";
+	if (String(input.record.orgId || "") !== input.orgId) return "challenge_org_mismatch";
+	if (input.record.action !== input.action) return "challenge_purpose_mismatch";
+	if (input.record.operation !== input.operation) return "challenge_purpose_mismatch";
+	if (input.record.ownerProofBindingDigest !== input.ownerProofBindingDigest) return "challenge_session_mismatch";
+	return null;
+}
+function emailOtpRegistrationChallengeBindingMismatchCode(input) {
+	if (input.record.otpChannel !== "email_otp") return "challenge_channel_mismatch";
+	if (input.record.challengeSubjectId !== input.providerSubject) return "challenge_subject_mismatch";
+	if (normalizeOptionalTrimmedString(input.record.email)?.toLowerCase() !== input.proofEmail) return "challenge_email_mismatch";
+	if (String(input.record.orgId || "") !== input.orgId) return "challenge_org_mismatch";
+	if (input.record.action !== WALLET_EMAIL_OTP_ACTIONS.registration) return "challenge_purpose_mismatch";
+	if (input.record.operation !== "registration") return "challenge_purpose_mismatch";
+	if (input.record.walletId !== input.walletId) return "challenge_wallet_mismatch";
+	if (input.record.ownerProofBindingDigest !== input.ownerProofBindingDigest) return "challenge_session_mismatch";
+	return null;
+}
+function emailOtpChallengeInvalidOrExpired() {
+	return {
+		ok: false,
+		code: "challenge_expired_or_invalid",
+		message: "Email OTP challenge expired or invalid"
+	};
+}
+function emailOtpGrantRecord(input) {
+	return {
+		version: "email_otp_grant_v1",
+		grantToken: input.grantToken,
+		userId: input.userId,
+		walletId: input.walletId,
+		orgId: input.orgId,
+		challengeId: input.challengeId,
+		otpChannel: EMAIL_OTP_CHANNEL,
+		ownerProofBindingDigest: input.ownerProofBindingDigest,
+		action: input.action,
+		issuedAtMs: input.issuedAtMs,
+		expiresAtMs: input.expiresAtMs
+	};
+}
+function emailOtpUnlockChallengeRecord(input) {
+	return {
+		version: "email_otp_unlock_challenge_v1",
+		challengeId: input.challengeId,
+		walletId: input.walletId,
+		userId: input.userId,
+		orgId: input.orgId,
+		challengeB64u: input.challengeB64u,
+		createdAtMs: input.createdAtMs,
+		expiresAtMs: input.expiresAtMs
+	};
+}
+function parseEmailOtpGrantRecord(input) {
+	const record = parseJsonObject(input);
+	if (!record) return null;
+	const version = normalizeOptionalTrimmedString(record.version);
+	const grantToken = normalizeOptionalTrimmedString(record.grantToken);
+	const userId = normalizeOptionalTrimmedString(record.userId);
+	const walletId = normalizeOptionalTrimmedString(record.walletId);
+	const orgId = normalizeOptionalTrimmedString(record.orgId);
+	const challengeId = normalizeOptionalTrimmedString(record.challengeId);
+	const otpChannel = normalizeOptionalTrimmedString(record.otpChannel);
+	const ownerProofBindingDigest = normalizeOptionalTrimmedString(record.ownerProofBindingDigest);
+	const action = normalizeOptionalTrimmedString(record.action);
+	const issuedAtMs = positiveSafeInteger(record.issuedAtMs);
+	const expiresAtMs = positiveSafeInteger(record.expiresAtMs);
+	if (version !== "email_otp_grant_v1" || !grantToken || !userId || !walletId || !challengeId || otpChannel !== "email_otp" || !ownerProofBindingDigest || !action || !issuedAtMs || !expiresAtMs || expiresAtMs <= issuedAtMs) return null;
+	if (action !== WALLET_EMAIL_OTP_ACTIONS.unseal && action !== WALLET_EMAIL_OTP_ACTIONS.recoveryBootstrap) return null;
+	return {
+		version: "email_otp_grant_v1",
+		grantToken,
+		userId,
+		walletId,
+		...orgId ? { orgId } : {},
+		challengeId,
+		otpChannel: EMAIL_OTP_CHANNEL,
+		ownerProofBindingDigest,
+		action,
+		issuedAtMs,
+		expiresAtMs
+	};
+}
+function parseEmailOtpGrantRow(row) {
+	const record = parseEmailOtpGrantRecord(row?.record_json);
+	const expiresAtMs = positiveSafeInteger(row?.expires_at_ms);
+	if (!record || !expiresAtMs || record.expiresAtMs !== expiresAtMs) return null;
+	return record;
+}
+async function validateEmailOtpEnrollmentMaterial(input) {
+	const enrollmentSealKeyVersion = normalizeOptionalTrimmedString(input.material.enrollmentSealKeyVersion);
+	const clientUnlockPublicKeyB64u = normalizeOptionalTrimmedString(input.material.clientUnlockPublicKeyB64u);
+	const unlockKeyVersion = normalizeOptionalTrimmedString(input.material.unlockKeyVersion);
+	const serverSealedFactorCiphertextB64u = normalizeOptionalTrimmedString(input.material.serverSealedFactorCiphertextB64u);
+	if (!enrollmentSealKeyVersion) return {
+		ok: false,
+		code: "invalid_body",
+		message: "enrollmentSealKeyVersion is required"
+	};
+	if (!clientUnlockPublicKeyB64u) return {
+		ok: false,
+		code: "invalid_body",
+		message: "clientUnlockPublicKeyB64u is required"
+	};
+	if (!unlockKeyVersion) return {
+		ok: false,
+		code: "invalid_body",
+		message: "unlockKeyVersion is required"
+	};
+	if (!serverSealedFactorCiphertextB64u) return {
+		ok: false,
+		code: "invalid_body",
+		message: "serverSealedFactorCiphertextB64u is required"
+	};
+	let unlockPublicKeyBytes;
+	try {
+		unlockPublicKeyBytes = base64UrlDecode(clientUnlockPublicKeyB64u);
+	} catch {
+		return {
+			ok: false,
+			code: "invalid_body",
+			message: "clientUnlockPublicKeyB64u must be valid base64url"
+		};
+	}
+	if (unlockPublicKeyBytes.length !== 33) return {
+		ok: false,
+		code: "invalid_body",
+		message: "clientUnlockPublicKeyB64u must decode to 33 bytes (compressed secp256k1 pubkey)"
+	};
+	try {
+		await input.validateSecp256k1PublicKey33(unlockPublicKeyBytes);
+	} catch {
+		return {
+			ok: false,
+			code: "invalid_body",
+			message: "clientUnlockPublicKeyB64u is not a valid secp256k1 public key"
+		};
+	}
+	return {
+		ok: true,
+		enrollmentSealKeyVersion,
+		clientUnlockPublicKeyB64u,
+		unlockKeyVersion,
+		serverSealedFactorCiphertextB64u
+	};
+}
+function emailOtpAuthStateRecord(input) {
+	const otpFailureCount = patchedNonNegativeAuthStateValue(input.existing?.otpFailureCount, input.patch.otpFailureCount);
+	const lastOtpFailureAtMs = patchedPositiveAuthStateValue(input.existing?.lastOtpFailureAtMs, input.patch.lastOtpFailureAtMs);
+	const otpLockedUntilMs = patchedPositiveAuthStateValue(input.existing?.otpLockedUntilMs, input.patch.otpLockedUntilMs);
+	const lastEmailOtpLoginAtMs = patchedPositiveAuthStateValue(input.existing?.lastEmailOtpLoginAtMs, input.patch.lastEmailOtpLoginAtMs);
+	const lastStrongAuthAtMs = patchedPositiveAuthStateValue(input.existing?.lastStrongAuthAtMs, input.patch.lastStrongAuthAtMs);
+	return {
+		version: "email_otp_auth_state_v1",
+		walletId: input.enrollment.walletId,
+		providerUserId: input.enrollment.providerUserId,
+		orgId: input.enrollment.orgId,
+		createdAtMs: input.existing?.createdAtMs ?? input.updatedAtMs,
+		updatedAtMs: input.updatedAtMs,
+		...otpFailureCount != null ? { otpFailureCount } : {},
+		...lastOtpFailureAtMs != null ? { lastOtpFailureAtMs } : {},
+		...otpLockedUntilMs != null ? { otpLockedUntilMs } : {},
+		...lastEmailOtpLoginAtMs != null ? { lastEmailOtpLoginAtMs } : {},
+		...lastStrongAuthAtMs != null ? { lastStrongAuthAtMs } : {}
+	};
+}
+function parseEmailOtpChallengeAction(input) {
+	const action = normalizeOptionalTrimmedString(input);
+	switch (action) {
+		case WALLET_EMAIL_OTP_ACTIONS.login:
+		case WALLET_EMAIL_OTP_ACTIONS.registration:
+		case WALLET_EMAIL_OTP_ACTIONS.recoveryBootstrap:
+		case WALLET_EMAIL_OTP_ACTIONS.deviceLink: return action;
+		default: return null;
+	}
+}
+function emailOtpChallengePurposeIsValid(input) {
+	switch (input.action) {
+		case WALLET_EMAIL_OTP_ACTIONS.login: return isWalletEmailOtpLoginOperation(input.operation);
+		case WALLET_EMAIL_OTP_ACTIONS.registration: return input.operation === WALLET_EMAIL_OTP_REGISTRATION_OPERATION;
+		case WALLET_EMAIL_OTP_ACTIONS.recoveryBootstrap: return input.operation === WALLET_EMAIL_OTP_UNLOCK_OPERATION;
+		case WALLET_EMAIL_OTP_ACTIONS.deviceLink: return input.operation === WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION;
+	}
+}
+function optionalPositiveSafeIntegerField(record, field) {
+	if (!hasRecordField(record, field) || record[field] == null) return void 0;
+	return positiveSafeInteger(record[field]);
+}
+function optionalNonNegativeSafeIntegerField(record, field) {
+	if (!hasRecordField(record, field) || record[field] == null) return void 0;
+	return nonNegativeSafeInteger(record[field]);
+}
+function hasRecordField(record, field) {
+	return Object.prototype.hasOwnProperty.call(record, field);
+}
+function hasExactRecordFields(record, expectedFields) {
+	const actualFields = Object.keys(record).sort();
+	const expected = [...expectedFields].sort();
+	return actualFields.length === expected.length && actualFields.every((field, index) => field === expected[index]);
+}
+function patchedPositiveAuthStateValue(current, patch) {
+	if (patch === null) return void 0;
+	if (patch === void 0) return current;
+	return patch > 0 ? Math.floor(patch) : void 0;
+}
+function patchedNonNegativeAuthStateValue(current, patch) {
+	if (patch === null) return void 0;
+	if (patch === void 0) return current;
+	return patch >= 0 ? Math.floor(patch) : void 0;
+}
+//#endregion
+export { bytesEqual, clampedEmailOtpUnlockTtlMs, decodeFixedBase64Url, emailOtpAuthStateRecord, emailOtpChallengeBindingMismatchCode, emailOtpChallengeContextValues, emailOtpChallengeInvalidOrExpired, emailOtpChallengePurposeIsValid, emailOtpChallengeRecord, emailOtpChallengeWithAttemptCount, emailOtpGrantRecord, emailOtpRateLimitExceeded, emailOtpRateLimitKeys, emailOtpRegistrationChallengeBindingMismatchCode, emailOtpUnlockChallengeRecord, generateNumericOtp, maskEmail, parseEmailOtpAuthStateRecord, parseEmailOtpAuthStateRow, parseEmailOtpChallengeOperation, parseEmailOtpChallengeRecord, parseEmailOtpChallengeRow, parseEmailOtpGrantRecord, parseEmailOtpGrantRow, parseEmailOtpLoginOperation, parseEmailOtpRegistrationVerificationReceiptV1, parseEmailOtpUnlockChallengeRecord, parseEmailOtpUnlockChallengeRow, parseEmailOtpWalletEnrollmentRecord, parseEmailOtpWalletEnrollmentRow, validateEmailOtpEnrollmentMaterial };
+
+//# sourceMappingURL=d1EmailOtpRecords.js.map