@seams/wallet-server 0.6.1 → 0.7.1

package/dist/esm/core/EmailOtpStores.js

@@ -1,19 +1,12 @@
 import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../shared-ts/src/utils/validation.js";
-import { d1ChangedRows, formatD1ExecStatement, resolveD1DatabaseFromConfig } from "../storage/d1Sql.js";
-import "./defaultConfigsServer.js";
-import { parseCurrentEmailOtpAuthStateRecord, parseCurrentEmailOtpAuthStateRow, parseCurrentEmailOtpChallengeRecord, parseCurrentEmailOtpChallengeRow, parseCurrentEmailOtpGrantRecord, parseCurrentEmailOtpGrantRow, parseCurrentEmailOtpUnlockChallengeRecord, parseCurrentEmailOtpUnlockChallengeRow, parseCurrentEmailOtpWalletEnrollmentRecord, parseCurrentEmailOtpWalletEnrollmentRow, parseCurrentGoogleEmailOtpRegistrationAttemptRecord, parseCurrentGoogleEmailOtpRegistrationAttemptRow } from "./EmailOtpRecords.js";
+import { d1ChangedRows, resolveD1DatabaseFromConfig } from "../storage/d1Sql.js";
+import { D1TenantTable, d1TenantScopeFromConfig, resolveStorePrefix } from "./d1TenantStore.js";
+import { parseCurrentEmailOtpAuthStateRecord, parseCurrentEmailOtpAuthStateRow, parseCurrentEmailOtpChallengeRecord, parseCurrentEmailOtpChallengeRow, parseCurrentEmailOtpGrantRecord, parseCurrentEmailOtpGrantRow, parseCurrentEmailOtpUnlockChallengeRecord, parseCurrentEmailOtpUnlockChallengeRow, parseCurrentEmailOtpWalletEnrollmentRecord, parseCurrentEmailOtpWalletEnrollmentRow, parseCurrentGoogleEmailOtpRegistrationAttemptRecord, parseCurrentGoogleEmailOtpRegistrationAttemptRow, parseJsonRecord, registrationAttemptMatchesReplacementScope, registrationAttemptMatchesStartedScope } from "./EmailOtpRecords.js";
+import { emailOtpAuthStateRows, emailOtpChallengeRows, emailOtpGrantRows, emailOtpRegistrationAttemptRows, emailOtpUnlockChallengeRows, emailOtpWalletEnrollmentRows } from "./emailOtpD1Statements.js";
 //#region src/core/EmailOtpStores.ts
-function runtimePolicyScopeKey(scope) {
-	if (!scope) return "";
-	return `${scope.orgId}\n${scope.projectId}\n${scope.envId}\n${scope.signingRootVersion}`;
-}
-function registrationAttemptMatchesStartedScope(record, input) {
-	return record.providerSubject === input.providerSubject && record.email === input.email && record.ownerProofBindingDigest === input.ownerProofBindingDigest && record.runtimePolicyScope?.orgId === input.orgId && runtimePolicyScopeKey(record.runtimePolicyScope) === runtimePolicyScopeKey(input.runtimePolicyScope) && (record.state === "started" || record.state === "key_finalized") && record.expiresAtMs > input.nowMs;
-}
-function registrationAttemptMatchesReplacementScope(record, input) {
-	return record.providerSubject === input.providerSubject && record.email === input.email && record.ownerProofBindingDigest !== input.ownerProofBindingDigest && record.runtimePolicyScope?.orgId === input.orgId && runtimePolicyScopeKey(record.runtimePolicyScope) === runtimePolicyScopeKey(input.runtimePolicyScope) && (record.state === "started" || record.state === "key_finalized") && record.expiresAtMs > input.nowMs;
-}
+/** Names the Email OTP stores in D1 scope errors. */
+const EMAIL_OTP_D1_STORE = "Email OTP store";
 const EMAIL_OTP_STORE_D1_SCHEMA_SQL = Object.freeze([
 	`
     CREATE TABLE IF NOT EXISTS email_otp_challenges (
@@ -261,99 +254,109 @@ const EMAIL_OTP_STORE_D1_SCHEMA_SQL = Object.freeze([
       )
   `
 ]);
-async function ensureEmailOtpStoreD1Schema(options) {
-	for (const statement of EMAIL_OTP_STORE_D1_SCHEMA_SQL) await options.database.exec(formatD1ExecStatement(statement));
-}
-function toPrefixWithColon(prefix, defaultPrefix) {
-	const p = normalizeOptionalTrimmedString(prefix);
-	if (!p) return defaultPrefix;
-	return p.endsWith(":") ? p : `${p}:`;
-}
-function resolveEmailOtpStoreNamespace(config) {
-	const explicit = normalizeOptionalTrimmedString(config.EMAIL_OTP_PREFIX) || normalizeOptionalTrimmedString(config.EMAIL_OTP_STORE_PREFIX);
-	if (explicit) return toPrefixWithColon(explicit, "");
-	return `${toPrefixWithColon(normalizeOptionalTrimmedString(config.THRESHOLD_PREFIX) || "w3a", `w3a:`)}email-otp:`;
-}
-function getStoreConfig(input) {
-	return isPlainObject(input?.config) ? input.config : {};
-}
-function requireD1ScopeString(input, field) {
-	const normalized = normalizeOptionalTrimmedString(input);
-	if (!normalized) throw new Error(`${field} is required for D1 Email OTP store`);
-	return normalized;
-}
-function normalizeD1EmailOtpStoreOptions(input) {
-	return {
-		database: input.database,
-		namespace: requireD1ScopeString(input.namespace, "namespace"),
-		orgId: requireD1ScopeString(input.orgId, "orgId"),
-		projectId: requireD1ScopeString(input.projectId, "projectId"),
-		envId: requireD1ScopeString(input.envId, "envId"),
-		ensureSchema: input.ensureSchema !== false
-	};
-}
-function d1ScopeFromConfig(input) {
-	return {
-		namespace: requireD1ScopeString(input.namespace, "namespace"),
-		orgId: requireD1ScopeString(input.config.orgId || input.config.ORG_ID, "orgId"),
-		projectId: requireD1ScopeString(input.config.projectId || input.config.PROJECT_ID, "projectId"),
-		envId: requireD1ScopeString(input.config.envId || input.config.ENV_ID, "envId")
-	};
-}
-function bindD1EmailOtpScope(database, scope, statement, values = []) {
-	return database.prepare(statement).bind(scope.namespace, scope.orgId, scope.projectId, scope.envId, ...values);
-}
-function assertD1EmailOtpOrgScope(input) {
-	if (!input.recordOrgId) return;
-	if (input.recordOrgId !== input.scope.orgId) throw new Error(`${input.label} orgId must match D1 Email OTP store orgId`);
-}
-function resolveD1EmailOtpStoreOptions(input, storeLabel) {
-	const config = getStoreConfig(input);
-	if (normalizeOptionalTrimmedString(config.kind) !== "d1") return null;
-	const database = resolveD1DatabaseFromConfig(config);
-	if (!database) throw new Error(`[email-otp] D1 ${storeLabel} store selected but no D1 database was provided`);
-	return {
-		database,
-		...d1ScopeFromConfig({
-			config,
-			namespace: resolveEmailOtpStoreNamespace(config)
-		})
-	};
+/**
+* Selects a store's backend: D1 when the config's `kind` is `d1`, else in memory; any other
+* `kind` is an error. `label` names the store in log lines and errors; the unknown-kind error
+* uses `kindLabel`, which the wallet enrollment store shortens to `enrollment`. The store type
+* `S` comes from the caller's return type.
+*/
+function createEmailOtpStore(input, label, build, kindLabel = label) {
+	const config = isPlainObject(input?.config) ? input.config : {};
+	const kind = normalizeOptionalTrimmedString(config.kind);
+	if (kind === "d1") {
+		const database = resolveD1DatabaseFromConfig(config);
+		if (!database) throw new Error(`[email-otp] D1 ${label} store selected but no D1 database was provided`);
+		const scope = d1TenantScopeFromConfig(config, resolveStorePrefix(config, ["EMAIL_OTP_PREFIX", "EMAIL_OTP_STORE_PREFIX"], "email-otp:"), EMAIL_OTP_D1_STORE);
+		input?.logger?.info(`[email-otp] Using D1 ${label} store`);
+		return build.d1(database, scope);
+	}
+	if (kind && kind !== "in-memory") throw new Error(`[email-otp] Unknown ${kindLabel} store kind: ${kind}`);
+	input?.logger?.info(`[email-otp] Using in-memory ${label} store (non-persistent)`);
+	return build.inMemory();
 }
-function assertEmailOtpStoreKindKnown(input, storeLabel) {
-	const kind = normalizeOptionalTrimmedString(getStoreConfig(input).kind);
-	if (!kind || kind === "in-memory") return;
-	throw new Error(`[email-otp] Unknown ${storeLabel} store kind: ${kind}`);
+const CHALLENGE_RECORD = {
+	label: "Email OTP challenge",
+	parse: parseCurrentEmailOtpChallengeRecord,
+	id: (record) => record.challengeId,
+	orgId: (record) => record.orgId
+};
+const GRANT_RECORD = {
+	label: "Email OTP grant",
+	parse: parseCurrentEmailOtpGrantRecord,
+	id: (record) => record.grantToken,
+	orgId: (record) => record.orgId
+};
+const WALLET_ENROLLMENT_RECORD = {
+	label: "Email OTP wallet enrollment",
+	parse: parseCurrentEmailOtpWalletEnrollmentRecord,
+	id: (record) => record.walletId,
+	orgId: (record) => record.orgId
+};
+const AUTH_STATE_RECORD = {
+	label: "Email OTP auth state",
+	parse: parseCurrentEmailOtpAuthStateRecord,
+	id: (record) => record.walletId,
+	orgId: (record) => record.orgId
+};
+const UNLOCK_CHALLENGE_RECORD = {
+	label: "Email OTP unlock challenge",
+	parse: parseCurrentEmailOtpUnlockChallengeRecord,
+	id: (record) => record.challengeId,
+	orgId: (record) => record.orgId
+};
+const REGISTRATION_ATTEMPT_RECORD = {
+	label: "Google Email OTP registration attempt",
+	parse: parseCurrentGoogleEmailOtpRegistrationAttemptRecord,
+	id: (record) => record.attemptId,
+	orgId: (record) => record.runtimePolicyScope?.orgId
+};
+function parseEmailOtpRecord(spec, record) {
+	const parsed = spec.parse(record);
+	if (!parsed) throw new Error(`Invalid ${spec.label} record`);
+	return parsed;
 }
 function cloneRecord(value) {
 	return JSON.parse(JSON.stringify(value));
 }
-function parseJsonRecord(raw) {
-	if (typeof raw !== "string") return raw;
-	try {
-		return JSON.parse(raw);
-	} catch {
-		return raw;
-	}
-}
 function challengeContextMatches(record, input) {
 	return record.expiresAtMs > input.nowMs && record.challengeSubjectId === input.challengeSubjectId && record.walletId === input.walletId && String(record.orgId || "") === String(input.orgId || "") && record.otpChannel === input.otpChannel && record.ownerProofBindingDigest === input.ownerProofBindingDigest && record.action === input.action && record.operation === input.operation;
 }
-var InMemoryEmailOtpChallengeStore = class {
-	constructor() {
+/** Keeps copies of parsed records by id, so no caller shares a stored object. */
+var InMemoryEmailOtpStore = class {
+	constructor(spec) {
+		this.spec = spec;
 		this.map = /* @__PURE__ */ new Map();
 	}
 	async put(record) {
-		const parsed = parseCurrentEmailOtpChallengeRecord(record);
-		if (!parsed) throw new Error("Invalid Email OTP challenge record");
-		this.map.set(parsed.challengeId, cloneRecord(parsed));
+		this.set(parseEmailOtpRecord(this.spec, record));
 	}
-	async get(challengeId) {
-		const id = normalizeOptionalTrimmedString(challengeId);
-		if (!id) return null;
-		const record = this.map.get(id);
+	set(record) {
+		this.map.set(this.spec.id(record), cloneRecord(record));
+	}
+	async get(id) {
+		const key = normalizeOptionalTrimmedString(id);
+		if (!key) return null;
+		const record = this.map.get(key);
+		return record ? cloneRecord(record) : null;
+	}
+	/** Reads and deletes, so a one-time record is used at most once. */
+	async consume(id) {
+		const key = normalizeOptionalTrimmedString(id);
+		if (!key) return null;
+		const record = this.map.get(key);
+		this.map.delete(key);
 		return record ? cloneRecord(record) : null;
 	}
+	async del(id) {
+		const key = normalizeOptionalTrimmedString(id);
+		if (!key) return;
+		this.map.delete(key);
+	}
+};
+var InMemoryEmailOtpChallengeStore = class extends InMemoryEmailOtpStore {
+	constructor() {
+		super(CHALLENGE_RECORD);
+	}
 	async deleteExpired(nowMs) {
 		const deleted = [];
 		for (const [challengeId, record] of this.map.entries()) {
@@ -397,49 +400,10 @@ var InMemoryEmailOtpChallengeStore = class {
 		}
 		return null;
 	}
-	async del(challengeId) {
-		const id = normalizeOptionalTrimmedString(challengeId);
-		if (!id) return;
-		this.map.delete(id);
-	}
-};
-var InMemoryEmailOtpGrantStore = class {
-	constructor() {
-		this.map = /* @__PURE__ */ new Map();
-	}
-	async put(record) {
-		const parsed = parseCurrentEmailOtpGrantRecord(record);
-		if (!parsed) throw new Error("Invalid Email OTP grant record");
-		this.map.set(parsed.grantToken, cloneRecord(parsed));
-	}
-	async get(grantToken) {
-		const token = normalizeOptionalTrimmedString(grantToken);
-		if (!token) return null;
-		const record = this.map.get(token);
-		return record ? cloneRecord(record) : null;
-	}
-	async consume(grantToken) {
-		const token = normalizeOptionalTrimmedString(grantToken);
-		if (!token) return null;
-		const record = this.map.get(token);
-		this.map.delete(token);
-		return record ? cloneRecord(record) : null;
-	}
-	async del(grantToken) {
-		const token = normalizeOptionalTrimmedString(grantToken);
-		if (!token) return;
-		this.map.delete(token);
-	}
 };
-var InMemoryEmailOtpWalletEnrollmentStore = class {
+var InMemoryEmailOtpWalletEnrollmentStore = class extends InMemoryEmailOtpStore {
 	constructor() {
-		this.map = /* @__PURE__ */ new Map();
-	}
-	async get(walletId) {
-		const key = normalizeOptionalTrimmedString(walletId);
-		if (!key) return null;
-		const record = this.map.get(key);
-		return record ? cloneRecord(record) : null;
+		super(WALLET_ENROLLMENT_RECORD);
 	}
 	async getByProviderUserId(input) {
 		const providerUserId = normalizeOptionalTrimmedString(input.providerUserId);
@@ -449,74 +413,14 @@ var InMemoryEmailOtpWalletEnrollmentStore = class {
 		return record ? cloneRecord(record) : null;
 	}
 	async put(record) {
-		const parsed = parseCurrentEmailOtpWalletEnrollmentRecord(record);
-		if (!parsed) throw new Error("Invalid Email OTP wallet enrollment record");
+		const parsed = parseEmailOtpRecord(this.spec, record);
 		if (Array.from(this.map.values()).find((existing) => existing.walletId !== parsed.walletId && existing.orgId === parsed.orgId && existing.providerUserId === parsed.providerUserId)) throw new Error("Email OTP wallet enrollment already exists for this provider user in org");
-		this.map.set(parsed.walletId, cloneRecord(parsed));
-	}
-	async del(walletId) {
-		const key = normalizeOptionalTrimmedString(walletId);
-		if (!key) return;
-		this.map.delete(key);
-	}
-};
-var InMemoryEmailOtpAuthStateStore = class {
-	constructor() {
-		this.map = /* @__PURE__ */ new Map();
-	}
-	async get(walletId) {
-		const key = normalizeOptionalTrimmedString(walletId);
-		if (!key) return null;
-		const record = this.map.get(key);
-		return record ? cloneRecord(record) : null;
-	}
-	async put(record) {
-		const parsed = parseCurrentEmailOtpAuthStateRecord(record);
-		if (!parsed) throw new Error("Invalid Email OTP auth state record");
-		this.map.set(parsed.walletId, cloneRecord(parsed));
-	}
-	async del(walletId) {
-		const key = normalizeOptionalTrimmedString(walletId);
-		if (!key) return;
-		this.map.delete(key);
-	}
-};
-var InMemoryEmailOtpUnlockChallengeStore = class {
-	constructor() {
-		this.map = /* @__PURE__ */ new Map();
-	}
-	async put(record) {
-		const parsed = parseCurrentEmailOtpUnlockChallengeRecord(record);
-		if (!parsed) throw new Error("Invalid Email OTP unlock challenge record");
-		this.map.set(parsed.challengeId, cloneRecord(parsed));
-	}
-	async consume(challengeId) {
-		const id = normalizeOptionalTrimmedString(challengeId);
-		if (!id) return null;
-		const record = this.map.get(id);
-		this.map.delete(id);
-		return record ? cloneRecord(record) : null;
-	}
-	async del(challengeId) {
-		const id = normalizeOptionalTrimmedString(challengeId);
-		if (!id) return;
-		this.map.delete(id);
+		this.set(parsed);
 	}
 };
-var InMemoryEmailOtpRegistrationAttemptStore = class {
+var InMemoryEmailOtpRegistrationAttemptStore = class extends InMemoryEmailOtpStore {
 	constructor() {
-		this.map = /* @__PURE__ */ new Map();
-	}
-	async put(record) {
-		const parsed = parseCurrentGoogleEmailOtpRegistrationAttemptRecord(record);
-		if (!parsed) throw new Error("Invalid Google Email OTP registration attempt record");
-		this.map.set(parsed.attemptId, cloneRecord(parsed));
-	}
-	async get(attemptId) {
-		const id = normalizeOptionalTrimmedString(attemptId);
-		if (!id) return null;
-		const record = this.map.get(id);
-		return record ? cloneRecord(record) : null;
+		super(REGISTRATION_ATTEMPT_RECORD);
 	}
 	async findStartedBySubjectEmail(input) {
 		for (const record of this.map.values()) if (registrationAttemptMatchesStartedScope(record, input)) return cloneRecord(record);
@@ -549,93 +453,135 @@ var InMemoryEmailOtpRegistrationAttemptStore = class {
 		return deleted;
 	}
 };
-var D1EmailOtpStoreBase = class {
-	constructor(input) {
-		this.schemaReady = false;
-		const normalized = normalizeD1EmailOtpStoreOptions(input);
-		this.database = normalized.database;
-		this.scope = {
-			namespace: normalized.namespace,
-			orgId: normalized.orgId,
-			projectId: normalized.projectId,
-			envId: normalized.envId
-		};
-		this.ensureSchemaOnUse = normalized.ensureSchema;
+function challengeFromRow(row) {
+	return parseCurrentEmailOtpChallengeRow({
+		recordJson: parseJsonRecord(row?.record_json),
+		expiresAtMs: row?.expires_at_ms
+	});
+}
+function grantFromRow(row) {
+	return parseCurrentEmailOtpGrantRow({
+		recordJson: parseJsonRecord(row?.record_json),
+		expiresAtMs: row?.expires_at_ms
+	});
+}
+function walletEnrollmentFromRow(row) {
+	return parseCurrentEmailOtpWalletEnrollmentRow({
+		recordJson: parseJsonRecord(row?.record_json),
+		updatedAtMs: row?.updated_at_ms
+	});
+}
+function authStateFromRow(row) {
+	return parseCurrentEmailOtpAuthStateRow({
+		recordJson: parseJsonRecord(row?.record_json),
+		updatedAtMs: row?.updated_at_ms
+	});
+}
+function unlockChallengeFromRow(row) {
+	return parseCurrentEmailOtpUnlockChallengeRow({
+		recordJson: parseJsonRecord(row?.record_json),
+		expiresAtMs: row?.expires_at_ms
+	});
+}
+function registrationAttemptFromRow(row) {
+	return parseCurrentGoogleEmailOtpRegistrationAttemptRow({
+		recordJson: parseJsonRecord(row?.record_json),
+		expiresAtMs: row?.expires_at_ms,
+		updatedAtMs: row?.updated_at_ms
+	});
+}
+/**
+* A record's store in one D1 tenant scope. The core schema is created on first use, and a row
+* that no longer parses is deleted when it is read.
+*/
+var D1EmailOtpStore = class {
+	constructor(database, scope, spec, rows) {
+		this.spec = spec;
+		this.rows = rows;
+		this.adapterKind = "d1";
+		this.prepare = (sql, values) => this.table.prepare(sql, values);
+		this.table = new D1TenantTable({
+			database,
+			...scope
+		}, EMAIL_OTP_D1_STORE, EMAIL_OTP_STORE_D1_SCHEMA_SQL);
 	}
-	async ensureSchema() {
-		if (!this.ensureSchemaOnUse || this.schemaReady) return;
-		await ensureEmailOtpStoreD1Schema({ database: this.database });
-		this.schemaReady = true;
+	ensureSchema() {
+		return this.table.ensureSchema();
 	}
-	bindScope(statement, values = []) {
-		return bindD1EmailOtpScope(this.database, this.scope, statement, values);
+	async put(record) {
+		await this.ensureSchema();
+		const parsed = parseEmailOtpRecord(this.spec, record);
+		const recordOrgId = this.spec.orgId(parsed);
+		if (recordOrgId && recordOrgId !== this.table.scope.orgId) throw new Error(`${this.spec.label} orgId must match D1 Email OTP store orgId`);
+		await this.rows.upsert(this.prepare, parsed).run();
 	}
-};
-var D1EmailOtpChallengeStore = class extends D1EmailOtpStoreBase {
-	constructor(..._args) {
-		super(..._args);
-		this.adapterKind = "d1";
+	async getById(id, select) {
+		await this.ensureSchema();
+		const key = normalizeOptionalTrimmedString(id);
+		if (!key) return null;
+		const row = await select(this.prepare, key).first();
+		return row ? this.recordOrDiscard(row, key) : null;
 	}
-	async put(record) {
+	/** Reads and deletes, so a one-time record is used at most once. */
+	async consumeById(id, consume) {
 		await this.ensureSchema();
-		const parsed = parseCurrentEmailOtpChallengeRecord(record);
-		if (!parsed) throw new Error("Invalid Email OTP challenge record");
-		assertD1EmailOtpOrgScope({
-			recordOrgId: parsed.orgId,
-			scope: this.scope,
-			label: "Email OTP challenge"
+		const key = normalizeOptionalTrimmedString(id);
+		if (!key) return null;
+		const row = await consume(this.prepare, key).first();
+		const parsed = this.rows.fromRow(row);
+		return parsed ? cloneRecord(parsed) : null;
+	}
+	async deleteById(id, remove) {
+		await this.ensureSchema();
+		const key = normalizeOptionalTrimmedString(id);
+		if (!key) return;
+		await remove(this.prepare, key).run();
+	}
+	/** The row's record; a row that does not parse is deleted by `malformedId` and reads as null. */
+	async recordOrDiscard(row, malformedId) {
+		const parsed = this.rows.fromRow(row);
+		if (parsed) return cloneRecord(parsed);
+		const id = normalizeOptionalTrimmedString(malformedId);
+		if (id) await this.del(id);
+		return null;
+	}
+};
+const ACTIVE_CHALLENGE_CONTEXT_SQL = `WHERE namespace = ?
+          AND org_id = ?
+          AND project_id = ?
+          AND env_id = ?
+          AND expires_at_ms > ?
+          AND challenge_subject_id = ?
+          AND wallet_id = ?
+          AND record_org_id = ?
+          AND otp_channel = ?
+          AND owner_proof_binding_digest = ?
+          AND action = ?
+          AND operation = ?`;
+function challengeContextValues(input) {
+	return [
+		input.nowMs,
+		input.challengeSubjectId,
+		input.walletId,
+		String(input.orgId || ""),
+		input.otpChannel,
+		input.ownerProofBindingDigest,
+		input.action,
+		input.operation
+	];
+}
+var D1EmailOtpChallengeStore = class extends D1EmailOtpStore {
+	constructor(database, scope) {
+		super(database, scope, CHALLENGE_RECORD, {
+			fromRow: challengeFromRow,
+			upsert: emailOtpChallengeRows.upsert
 		});
-		await this.bindScope(`INSERT INTO email_otp_challenges (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        challenge_id,
-        challenge_subject_id,
-        wallet_id,
-        record_org_id,
-        otp_channel,
-        owner_proof_binding_digest,
-        action,
-        operation,
-        otp_code,
-        record_json,
-        created_at_ms,
-        expires_at_ms
-      )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT (namespace, org_id, project_id, env_id, challenge_id)
-      DO UPDATE SET
-        challenge_subject_id = EXCLUDED.challenge_subject_id,
-        wallet_id = EXCLUDED.wallet_id,
-        record_org_id = EXCLUDED.record_org_id,
-        otp_channel = EXCLUDED.otp_channel,
-        owner_proof_binding_digest = EXCLUDED.owner_proof_binding_digest,
-        action = EXCLUDED.action,
-        operation = EXCLUDED.operation,
-        otp_code = EXCLUDED.otp_code,
-        record_json = EXCLUDED.record_json,
-        created_at_ms = EXCLUDED.created_at_ms,
-        expires_at_ms = EXCLUDED.expires_at_ms`, [
-			parsed.challengeId,
-			parsed.challengeSubjectId,
-			parsed.walletId,
-			parsed.orgId || "",
-			parsed.otpChannel,
-			parsed.ownerProofBindingDigest,
-			parsed.action,
-			parsed.operation,
-			parsed.otpCode,
-			JSON.stringify(parsed),
-			parsed.createdAtMs,
-			parsed.expiresAtMs
-		]).run();
 	}
 	async get(challengeId) {
 		await this.ensureSchema();
 		const id = normalizeOptionalTrimmedString(challengeId);
 		if (!id) return null;
-		const row = await this.bindScope(`SELECT record_json, expires_at_ms, challenge_id
+		const row = await this.prepare(`SELECT record_json, expires_at_ms, challenge_id
          FROM email_otp_challenges
         WHERE namespace = ?
           AND org_id = ?
@@ -643,96 +589,37 @@ var D1EmailOtpChallengeStore = class extends D1EmailOtpStoreBase {
           AND env_id = ?
           AND challenge_id = ?
         LIMIT 1`, [id]).first();
-		const parsed = parseCurrentEmailOtpChallengeRow({
-			recordJson: parseJsonRecord(row?.record_json),
-			expiresAtMs: row?.expires_at_ms
-		});
-		if (!row) return null;
-		if (!parsed) {
-			await this.del(id);
-			return null;
-		}
-		return cloneRecord(parsed);
+		return row ? this.recordOrDiscard(row, id) : null;
 	}
 	async deleteExpired(nowMs) {
 		await this.ensureSchema();
-		return ((await this.bindScope(`DELETE FROM email_otp_challenges
+		return ((await this.prepare(`DELETE FROM email_otp_challenges
         WHERE namespace = ?
           AND org_id = ?
           AND project_id = ?
           AND env_id = ?
           AND expires_at_ms <= ?
-        RETURNING record_json, expires_at_ms`, [nowMs]).all()).results || []).map((row) => parseCurrentEmailOtpChallengeRow({
-			recordJson: parseJsonRecord(row.record_json),
-			expiresAtMs: row.expires_at_ms
-		})).filter((record) => Boolean(record)).map((record) => cloneRecord(record));
+        RETURNING record_json, expires_at_ms`, [nowMs]).all()).results || []).map((row) => challengeFromRow(row)).filter((record) => Boolean(record)).map((record) => cloneRecord(record));
 	}
 	async countActiveByContext(input) {
 		await this.ensureSchema();
-		const row = await this.bindScope(`SELECT COUNT(*) AS count
+		const row = await this.prepare(`SELECT COUNT(*) AS count
          FROM email_otp_challenges
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND expires_at_ms > ?
-          AND challenge_subject_id = ?
-          AND wallet_id = ?
-          AND record_org_id = ?
-          AND otp_channel = ?
-          AND owner_proof_binding_digest = ?
-          AND action = ?
-          AND operation = ?`, [
-			input.nowMs,
-			input.challengeSubjectId,
-			input.walletId,
-			String(input.orgId || ""),
-			input.otpChannel,
-			input.ownerProofBindingDigest,
-			input.action,
-			input.operation
-		]).first();
+        ${ACTIVE_CHALLENGE_CONTEXT_SQL}`, challengeContextValues(input)).first();
 		return Number(row?.count || 0);
 	}
 	async findLatestActiveByContext(input) {
 		await this.ensureSchema();
-		const row = await this.bindScope(`SELECT record_json, expires_at_ms, challenge_id
+		const row = await this.prepare(`SELECT record_json, expires_at_ms, challenge_id
          FROM email_otp_challenges
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND expires_at_ms > ?
-          AND challenge_subject_id = ?
-          AND wallet_id = ?
-          AND record_org_id = ?
-          AND otp_channel = ?
-          AND owner_proof_binding_digest = ?
-          AND action = ?
-          AND operation = ?
+        ${ACTIVE_CHALLENGE_CONTEXT_SQL}
         ORDER BY expires_at_ms DESC, created_at_ms DESC
-        LIMIT 1`, [
-			input.nowMs,
-			input.challengeSubjectId,
-			input.walletId,
-			String(input.orgId || ""),
-			input.otpChannel,
-			input.ownerProofBindingDigest,
-			input.action,
-			input.operation
-		]).first();
-		const parsed = parseCurrentEmailOtpChallengeRow({
-			recordJson: parseJsonRecord(row?.record_json),
-			expiresAtMs: row?.expires_at_ms
-		});
-		if (parsed) return cloneRecord(parsed);
-		const malformedId = normalizeOptionalTrimmedString(row?.challenge_id);
-		if (malformedId) await this.del(malformedId);
-		return null;
+        LIMIT 1`, challengeContextValues(input)).first();
+		return this.recordOrDiscard(row, row?.challenge_id);
 	}
 	async deleteOldestActiveByContext(input) {
 		await this.ensureSchema();
-		const row = await this.bindScope(`WITH oldest AS (
+		const row = await this.prepare(`WITH oldest AS (
         SELECT challenge_id
           FROM email_otp_challenges
          WHERE namespace = ?
@@ -757,191 +644,57 @@ var D1EmailOtpChallengeStore = class extends D1EmailOtpStoreBase {
          AND env_id = ?
          AND challenge_id IN (SELECT challenge_id FROM oldest)
       RETURNING record_json, expires_at_ms, challenge_id`, [
-			input.nowMs,
-			input.challengeSubjectId,
-			input.walletId,
-			String(input.orgId || ""),
-			input.otpChannel,
-			input.ownerProofBindingDigest,
-			input.action,
-			input.operation,
-			this.scope.namespace,
-			this.scope.orgId,
-			this.scope.projectId,
-			this.scope.envId
+			...challengeContextValues(input),
+			this.table.scope.namespace,
+			this.table.scope.orgId,
+			this.table.scope.projectId,
+			this.table.scope.envId
 		]).first();
-		const parsed = parseCurrentEmailOtpChallengeRow({
-			recordJson: parseJsonRecord(row?.record_json),
-			expiresAtMs: row?.expires_at_ms
-		});
-		if (parsed) return cloneRecord(parsed);
-		const malformedId = normalizeOptionalTrimmedString(row?.challenge_id);
-		if (malformedId) await this.del(malformedId);
-		return null;
+		return this.recordOrDiscard(row, row?.challenge_id);
 	}
 	async findActiveByContext(input) {
 		await this.ensureSchema();
-		const row = await this.bindScope(`SELECT record_json, expires_at_ms, challenge_id
+		const row = await this.prepare(`SELECT record_json, expires_at_ms, challenge_id
          FROM email_otp_challenges
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND expires_at_ms > ?
-          AND challenge_subject_id = ?
-          AND wallet_id = ?
-          AND record_org_id = ?
-          AND otp_channel = ?
-          AND owner_proof_binding_digest = ?
-          AND action = ?
-          AND operation = ?
+        ${ACTIVE_CHALLENGE_CONTEXT_SQL}
           AND otp_code = ?
         ORDER BY expires_at_ms DESC
-        LIMIT 1`, [
-			input.nowMs,
-			input.challengeSubjectId,
-			input.walletId,
-			String(input.orgId || ""),
-			input.otpChannel,
-			input.ownerProofBindingDigest,
-			input.action,
-			input.operation,
-			input.otpCode
-		]).first();
-		const parsed = parseCurrentEmailOtpChallengeRow({
-			recordJson: parseJsonRecord(row?.record_json),
-			expiresAtMs: row?.expires_at_ms
-		});
-		if (parsed) return cloneRecord(parsed);
-		const malformedId = normalizeOptionalTrimmedString(row?.challenge_id);
-		if (malformedId) await this.del(malformedId);
-		return null;
+        LIMIT 1`, [...challengeContextValues(input), input.otpCode]).first();
+		return this.recordOrDiscard(row, row?.challenge_id);
 	}
-	async del(challengeId) {
-		await this.ensureSchema();
-		const id = normalizeOptionalTrimmedString(challengeId);
-		if (!id) return;
-		await this.bindScope(`DELETE FROM email_otp_challenges
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND challenge_id = ?`, [id]).run();
+	del(challengeId) {
+		return this.deleteById(challengeId, emailOtpChallengeRows.delete);
 	}
 };
-var D1EmailOtpGrantStore = class extends D1EmailOtpStoreBase {
-	constructor(..._args2) {
-		super(..._args2);
-		this.adapterKind = "d1";
-	}
-	async put(record) {
-		await this.ensureSchema();
-		const parsed = parseCurrentEmailOtpGrantRecord(record);
-		if (!parsed) throw new Error("Invalid Email OTP grant record");
-		assertD1EmailOtpOrgScope({
-			recordOrgId: parsed.orgId,
-			scope: this.scope,
-			label: "Email OTP grant"
+var D1EmailOtpGrantStore = class extends D1EmailOtpStore {
+	constructor(database, scope) {
+		super(database, scope, GRANT_RECORD, {
+			fromRow: grantFromRow,
+			upsert: emailOtpGrantRows.upsert
 		});
-		await this.bindScope(`INSERT INTO email_otp_grants (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        grant_token,
-        user_id,
-        wallet_id,
-        record_org_id,
-        challenge_id,
-        action,
-        record_json,
-        issued_at_ms,
-        expires_at_ms
-      )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT (namespace, org_id, project_id, env_id, grant_token)
-      DO UPDATE SET
-        user_id = EXCLUDED.user_id,
-        wallet_id = EXCLUDED.wallet_id,
-        record_org_id = EXCLUDED.record_org_id,
-        challenge_id = EXCLUDED.challenge_id,
-        action = EXCLUDED.action,
-        record_json = EXCLUDED.record_json,
-        issued_at_ms = EXCLUDED.issued_at_ms,
-        expires_at_ms = EXCLUDED.expires_at_ms`, [
-			parsed.grantToken,
-			parsed.userId,
-			parsed.walletId,
-			parsed.orgId || "",
-			parsed.challengeId,
-			parsed.action,
-			JSON.stringify(parsed),
-			parsed.issuedAtMs,
-			parsed.expiresAtMs
-		]).run();
 	}
-	async get(grantToken) {
-		await this.ensureSchema();
-		const token = normalizeOptionalTrimmedString(grantToken);
-		if (!token) return null;
-		const row = await this.bindScope(`SELECT record_json, expires_at_ms
-         FROM email_otp_grants
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND grant_token = ?
-        LIMIT 1`, [token]).first();
-		const parsed = parseCurrentEmailOtpGrantRow({
-			recordJson: parseJsonRecord(row?.record_json),
-			expiresAtMs: row?.expires_at_ms
-		});
-		if (!row) return null;
-		if (!parsed) {
-			await this.del(token);
-			return null;
-		}
-		return cloneRecord(parsed);
+	get(grantToken) {
+		return this.getById(grantToken, emailOtpGrantRows.select);
 	}
-	async consume(grantToken) {
-		await this.ensureSchema();
-		const token = normalizeOptionalTrimmedString(grantToken);
-		if (!token) return null;
-		const row = await this.bindScope(`DELETE FROM email_otp_grants
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND grant_token = ?
-      RETURNING record_json, expires_at_ms`, [token]).first();
-		const parsed = parseCurrentEmailOtpGrantRow({
-			recordJson: parseJsonRecord(row?.record_json),
-			expiresAtMs: row?.expires_at_ms
-		});
-		return parsed ? cloneRecord(parsed) : null;
+	consume(grantToken) {
+		return this.consumeById(grantToken, emailOtpGrantRows.consume);
 	}
-	async del(grantToken) {
-		await this.ensureSchema();
-		const token = normalizeOptionalTrimmedString(grantToken);
-		if (!token) return;
-		await this.bindScope(`DELETE FROM email_otp_grants
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND grant_token = ?`, [token]).run();
+	del(grantToken) {
+		return this.deleteById(grantToken, emailOtpGrantRows.delete);
 	}
 };
-var D1EmailOtpWalletEnrollmentStore = class extends D1EmailOtpStoreBase {
-	constructor(..._args3) {
-		super(..._args3);
-		this.adapterKind = "d1";
+var D1EmailOtpWalletEnrollmentStore = class extends D1EmailOtpStore {
+	constructor(database, scope) {
+		super(database, scope, WALLET_ENROLLMENT_RECORD, {
+			fromRow: walletEnrollmentFromRow,
+			upsert: emailOtpWalletEnrollmentRows.upsert
+		});
 	}
 	async get(walletId) {
 		await this.ensureSchema();
 		const key = normalizeOptionalTrimmedString(walletId);
 		if (!key) return null;
-		const row = await this.bindScope(`SELECT record_json, updated_at_ms, wallet_id
+		const row = await this.prepare(`SELECT record_json, updated_at_ms, wallet_id
          FROM email_otp_wallet_enrollments
         WHERE namespace = ?
           AND org_id = ?
@@ -949,23 +702,14 @@ var D1EmailOtpWalletEnrollmentStore = class extends D1EmailOtpStoreBase {
           AND env_id = ?
           AND wallet_id = ?
         LIMIT 1`, [key]).first();
-		const parsed = parseCurrentEmailOtpWalletEnrollmentRow({
-			recordJson: parseJsonRecord(row?.record_json),
-			updatedAtMs: row?.updated_at_ms
-		});
-		if (!row) return null;
-		if (!parsed) {
-			await this.del(key);
-			return null;
-		}
-		return cloneRecord(parsed);
+		return row ? this.recordOrDiscard(row, key) : null;
 	}
 	async getByProviderUserId(input) {
 		await this.ensureSchema();
 		const providerUserId = normalizeOptionalTrimmedString(input.providerUserId);
 		const orgId = normalizeOptionalTrimmedString(input.orgId);
 		if (!providerUserId || !orgId) return null;
-		const row = await this.bindScope(`SELECT record_json, updated_at_ms, wallet_id
+		const row = await this.prepare(`SELECT record_json, updated_at_ms, wallet_id
          FROM email_otp_wallet_enrollments
         WHERE namespace = ?
           AND org_id = ?
@@ -975,137 +719,27 @@ var D1EmailOtpWalletEnrollmentStore = class extends D1EmailOtpStoreBase {
           AND provider_user_id = ?
         ORDER BY updated_at_ms DESC
         LIMIT 1`, [orgId, providerUserId]).first();
-		const parsed = parseCurrentEmailOtpWalletEnrollmentRow({
-			recordJson: parseJsonRecord(row?.record_json),
-			updatedAtMs: row?.updated_at_ms
-		});
-		if (parsed) return cloneRecord(parsed);
-		const malformedWalletId = normalizeOptionalTrimmedString(row?.wallet_id);
-		if (malformedWalletId) await this.del(malformedWalletId);
-		return null;
+		return this.recordOrDiscard(row, row?.wallet_id);
 	}
-	async put(record) {
-		await this.ensureSchema();
-		const parsed = parseCurrentEmailOtpWalletEnrollmentRecord(record);
-		if (!parsed) throw new Error("Invalid Email OTP wallet enrollment record");
-		assertD1EmailOtpOrgScope({
-			recordOrgId: parsed.orgId,
-			scope: this.scope,
-			label: "Email OTP wallet enrollment"
-		});
-		await this.bindScope(`INSERT INTO email_otp_wallet_enrollments (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        wallet_id,
-        provider_user_id,
-        record_org_id,
-        verified_email,
-        record_json,
-        created_at_ms,
-        updated_at_ms
-      )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT (namespace, org_id, project_id, env_id, wallet_id)
-      DO UPDATE SET
-        provider_user_id = EXCLUDED.provider_user_id,
-        record_org_id = EXCLUDED.record_org_id,
-        verified_email = EXCLUDED.verified_email,
-        record_json = EXCLUDED.record_json,
-        created_at_ms = EXCLUDED.created_at_ms,
-        updated_at_ms = EXCLUDED.updated_at_ms`, [
-			parsed.walletId,
-			parsed.providerUserId,
-			parsed.orgId,
-			parsed.verifiedEmail,
-			JSON.stringify(parsed),
-			parsed.createdAtMs,
-			parsed.updatedAtMs
-		]).run();
-	}
-	async del(walletId) {
-		await this.ensureSchema();
-		const key = normalizeOptionalTrimmedString(walletId);
-		if (!key) return;
-		await this.bindScope(`DELETE FROM email_otp_wallet_enrollments
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND wallet_id = ?`, [key]).run();
+	del(walletId) {
+		return this.deleteById(walletId, emailOtpWalletEnrollmentRows.delete);
 	}
 };
-var D1EmailOtpAuthStateStore = class extends D1EmailOtpStoreBase {
-	constructor(..._args4) {
-		super(..._args4);
-		this.adapterKind = "d1";
-	}
-	async get(walletId) {
-		await this.ensureSchema();
-		const key = normalizeOptionalTrimmedString(walletId);
-		if (!key) return null;
-		const row = await this.bindScope(`SELECT record_json, updated_at_ms
-         FROM email_otp_auth_states
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND wallet_id = ?
-        LIMIT 1`, [key]).first();
-		const parsed = parseCurrentEmailOtpAuthStateRow({
-			recordJson: parseJsonRecord(row?.record_json),
-			updatedAtMs: row?.updated_at_ms
+var D1EmailOtpAuthStateStore = class extends D1EmailOtpStore {
+	constructor(database, scope) {
+		super(database, scope, AUTH_STATE_RECORD, {
+			fromRow: authStateFromRow,
+			upsert: emailOtpAuthStateRows.upsert
 		});
-		if (!row) return null;
-		if (!parsed) {
-			await this.del(key);
-			return null;
-		}
-		return cloneRecord(parsed);
 	}
-	async put(record) {
-		await this.ensureSchema();
-		const parsed = parseCurrentEmailOtpAuthStateRecord(record);
-		if (!parsed) throw new Error("Invalid Email OTP auth state record");
-		assertD1EmailOtpOrgScope({
-			recordOrgId: parsed.orgId,
-			scope: this.scope,
-			label: "Email OTP auth state"
-		});
-		await this.bindScope(`INSERT INTO email_otp_auth_states (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        wallet_id,
-        provider_user_id,
-        record_org_id,
-        record_json,
-        created_at_ms,
-        updated_at_ms
-      )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT (namespace, org_id, project_id, env_id, wallet_id)
-      DO UPDATE SET
-        provider_user_id = EXCLUDED.provider_user_id,
-        record_org_id = EXCLUDED.record_org_id,
-        record_json = EXCLUDED.record_json,
-        created_at_ms = EXCLUDED.created_at_ms,
-        updated_at_ms = EXCLUDED.updated_at_ms`, [
-			parsed.walletId,
-			parsed.providerUserId,
-			parsed.orgId,
-			JSON.stringify(parsed),
-			parsed.createdAtMs,
-			parsed.updatedAtMs
-		]).run();
+	get(walletId) {
+		return this.getById(walletId, emailOtpAuthStateRows.select);
 	}
 	async del(walletId) {
 		await this.ensureSchema();
 		const key = normalizeOptionalTrimmedString(walletId);
 		if (!key) return;
-		await this.bindScope(`DELETE FROM email_otp_auth_states
+		await this.prepare(`DELETE FROM email_otp_auth_states
         WHERE namespace = ?
           AND org_id = ?
           AND project_id = ?
@@ -1113,73 +747,21 @@ var D1EmailOtpAuthStateStore = class extends D1EmailOtpStoreBase {
           AND wallet_id = ?`, [key]).run();
 	}
 };
-var D1EmailOtpUnlockChallengeStore = class extends D1EmailOtpStoreBase {
-	constructor(..._args5) {
-		super(..._args5);
-		this.adapterKind = "d1";
-	}
-	async put(record) {
-		await this.ensureSchema();
-		const parsed = parseCurrentEmailOtpUnlockChallengeRecord(record);
-		if (!parsed) throw new Error("Invalid Email OTP unlock challenge record");
-		assertD1EmailOtpOrgScope({
-			recordOrgId: parsed.orgId,
-			scope: this.scope,
-			label: "Email OTP unlock challenge"
+var D1EmailOtpUnlockChallengeStore = class extends D1EmailOtpStore {
+	constructor(database, scope) {
+		super(database, scope, UNLOCK_CHALLENGE_RECORD, {
+			fromRow: unlockChallengeFromRow,
+			upsert: emailOtpUnlockChallengeRows.upsert
 		});
-		await this.bindScope(`INSERT INTO email_otp_unlock_challenges (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        challenge_id,
-        wallet_id,
-        user_id,
-        record_org_id,
-        record_json,
-        created_at_ms,
-        expires_at_ms
-      )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT (namespace, org_id, project_id, env_id, challenge_id)
-      DO UPDATE SET
-        wallet_id = EXCLUDED.wallet_id,
-        user_id = EXCLUDED.user_id,
-        record_org_id = EXCLUDED.record_org_id,
-        record_json = EXCLUDED.record_json,
-        created_at_ms = EXCLUDED.created_at_ms,
-        expires_at_ms = EXCLUDED.expires_at_ms`, [
-			parsed.challengeId,
-			parsed.walletId,
-			parsed.userId,
-			parsed.orgId || "",
-			JSON.stringify(parsed),
-			parsed.createdAtMs,
-			parsed.expiresAtMs
-		]).run();
 	}
-	async consume(challengeId) {
-		await this.ensureSchema();
-		const id = normalizeOptionalTrimmedString(challengeId);
-		if (!id) return null;
-		const row = await this.bindScope(`DELETE FROM email_otp_unlock_challenges
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND challenge_id = ?
-      RETURNING record_json, expires_at_ms`, [id]).first();
-		const parsed = parseCurrentEmailOtpUnlockChallengeRow({
-			recordJson: parseJsonRecord(row?.record_json),
-			expiresAtMs: row?.expires_at_ms
-		});
-		return parsed ? cloneRecord(parsed) : null;
+	consume(challengeId) {
+		return this.consumeById(challengeId, emailOtpUnlockChallengeRows.consume);
 	}
 	async del(challengeId) {
 		await this.ensureSchema();
 		const id = normalizeOptionalTrimmedString(challengeId);
 		if (!id) return;
-		await this.bindScope(`DELETE FROM email_otp_unlock_challenges
+		await this.prepare(`DELETE FROM email_otp_unlock_challenges
         WHERE namespace = ?
           AND org_id = ?
           AND project_id = ?
@@ -1187,158 +769,31 @@ var D1EmailOtpUnlockChallengeStore = class extends D1EmailOtpStoreBase {
           AND challenge_id = ?`, [id]).run();
 	}
 };
-var D1EmailOtpRegistrationAttemptStore = class extends D1EmailOtpStoreBase {
-	constructor(..._args6) {
-		super(..._args6);
-		this.adapterKind = "d1";
-	}
-	async put(record) {
-		await this.ensureSchema();
-		const parsed = parseCurrentGoogleEmailOtpRegistrationAttemptRecord(record);
-		if (!parsed) throw new Error("Invalid Google Email OTP registration attempt record");
-		assertD1EmailOtpOrgScope({
-			recordOrgId: parsed.runtimePolicyScope?.orgId,
-			scope: this.scope,
-			label: "Google Email OTP registration attempt"
+var D1EmailOtpRegistrationAttemptStore = class extends D1EmailOtpStore {
+	constructor(database, scope) {
+		super(database, scope, REGISTRATION_ATTEMPT_RECORD, {
+			fromRow: registrationAttemptFromRow,
+			upsert: emailOtpRegistrationAttemptRows.upsert
 		});
-		await this.bindScope(`INSERT INTO email_otp_registration_attempts (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        attempt_id,
-        provider_subject,
-        email,
-        wallet_id,
-        state,
-        owner_proof_binding_digest,
-        runtime_org_id,
-        runtime_policy_key,
-        offer_wallet_ids_json,
-        record_json,
-        created_at_ms,
-        updated_at_ms,
-        expires_at_ms
-      )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT (namespace, org_id, project_id, env_id, attempt_id)
-      DO UPDATE SET
-        provider_subject = EXCLUDED.provider_subject,
-        email = EXCLUDED.email,
-        wallet_id = EXCLUDED.wallet_id,
-        state = EXCLUDED.state,
-        owner_proof_binding_digest = EXCLUDED.owner_proof_binding_digest,
-        runtime_org_id = EXCLUDED.runtime_org_id,
-        runtime_policy_key = EXCLUDED.runtime_policy_key,
-        offer_wallet_ids_json = EXCLUDED.offer_wallet_ids_json,
-        record_json = EXCLUDED.record_json,
-        created_at_ms = EXCLUDED.created_at_ms,
-        updated_at_ms = EXCLUDED.updated_at_ms,
-        expires_at_ms = EXCLUDED.expires_at_ms`, [
-			parsed.attemptId,
-			parsed.providerSubject,
-			parsed.email,
-			parsed.walletId,
-			parsed.state,
-			parsed.ownerProofBindingDigest,
-			parsed.runtimePolicyScope?.orgId || "",
-			runtimePolicyScopeKey(parsed.runtimePolicyScope),
-			JSON.stringify(parsed.offerCandidates.map((candidate) => candidate.walletId)),
-			JSON.stringify(parsed),
-			parsed.createdAtMs,
-			parsed.updatedAtMs,
-			parsed.expiresAtMs
-		]).run();
 	}
-	async get(attemptId) {
-		await this.ensureSchema();
-		const id = normalizeOptionalTrimmedString(attemptId);
-		if (!id) return null;
-		const row = await this.bindScope(`SELECT record_json, expires_at_ms, updated_at_ms, attempt_id
-         FROM email_otp_registration_attempts
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND attempt_id = ?
-        LIMIT 1`, [id]).first();
-		const parsed = parseCurrentGoogleEmailOtpRegistrationAttemptRow({
-			recordJson: parseJsonRecord(row?.record_json),
-			expiresAtMs: row?.expires_at_ms,
-			updatedAtMs: row?.updated_at_ms
-		});
-		if (!row) return null;
-		if (!parsed) {
-			await this.deleteAttempt(id);
-			return null;
-		}
-		return cloneRecord(parsed);
+	get(attemptId) {
+		return this.getById(attemptId, emailOtpRegistrationAttemptRows.select);
 	}
 	async findStartedBySubjectEmail(input) {
 		await this.ensureSchema();
-		const row = await this.bindScope(`SELECT record_json, expires_at_ms, updated_at_ms, attempt_id
-         FROM email_otp_registration_attempts
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND provider_subject = ?
-          AND email = ?
-          AND state IN ('started', 'key_finalized')
-          AND expires_at_ms > ?
-          AND owner_proof_binding_digest = ?
-          AND runtime_org_id = ?
-          AND runtime_policy_key = ?
-        ORDER BY updated_at_ms DESC
-        LIMIT 1`, [
-			input.providerSubject,
-			input.email,
-			input.nowMs,
-			input.ownerProofBindingDigest,
-			input.orgId,
-			runtimePolicyScopeKey(input.runtimePolicyScope)
-		]).first();
-		const parsed = parseCurrentGoogleEmailOtpRegistrationAttemptRow({
-			recordJson: parseJsonRecord(row?.record_json),
-			expiresAtMs: row?.expires_at_ms,
-			updatedAtMs: row?.updated_at_ms
-		});
-		if (parsed && registrationAttemptMatchesStartedScope(parsed, input)) return cloneRecord(parsed);
-		const malformedAttemptId = normalizeOptionalTrimmedString(row?.attempt_id);
-		if (row && !parsed && malformedAttemptId) await this.deleteAttempt(malformedAttemptId);
-		return null;
+		const row = await emailOtpRegistrationAttemptRows.selectStarted(this.prepare, input).first();
+		const record = await this.recordOrDiscard(row, row?.attempt_id);
+		return record && registrationAttemptMatchesStartedScope(record, input) ? record : null;
 	}
 	async abandonStartedBySubjectEmailExceptBinding(input) {
 		await this.ensureSchema();
-		const result = await this.bindScope(`SELECT record_json, expires_at_ms, updated_at_ms, attempt_id
-         FROM email_otp_registration_attempts
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND provider_subject = ?
-          AND email = ?
-          AND state IN ('started', 'key_finalized')
-          AND expires_at_ms > ?`, [
-			input.providerSubject,
-			input.email,
-			input.nowMs
-		]).all();
+		const result = await emailOtpRegistrationAttemptRows.selectPending(this.prepare, input).all();
 		let abandoned = 0;
 		for (const row of result.results || []) {
-			const parsed = parseCurrentGoogleEmailOtpRegistrationAttemptRow({
-				recordJson: parseJsonRecord(row.record_json),
-				expiresAtMs: row.expires_at_ms,
-				updatedAtMs: row.updated_at_ms
-			});
-			if (!parsed) {
-				const attemptId = normalizeOptionalTrimmedString(row.attempt_id);
-				if (attemptId) await this.deleteAttempt(attemptId);
-				continue;
-			}
-			if (!registrationAttemptMatchesReplacementScope(parsed, input)) continue;
+			const record = await this.recordOrDiscard(row, row.attempt_id);
+			if (!record || !registrationAttemptMatchesReplacementScope(record, input)) continue;
 			await this.put({
-				...parsed,
+				...record,
 				state: "abandoned",
 				failureCode: input.failureCode,
 				updatedAtMs: input.nowMs
@@ -1351,110 +806,54 @@ var D1EmailOtpRegistrationAttemptStore = class extends D1EmailOtpStoreBase {
 		await this.ensureSchema();
 		const walletId = normalizeOptionalTrimmedString(input.walletId);
 		if (!walletId) return false;
-		const row = await this.bindScope(`SELECT 1 AS found
-         FROM email_otp_registration_attempts
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND state IN ('started', 'key_finalized')
-          AND expires_at_ms > ?
-          AND (
-            wallet_id = ?
-            OR EXISTS (
-              SELECT 1
-                FROM json_each(offer_wallet_ids_json)
-               WHERE value = ?
-            )
-          )
-        LIMIT 1`, [
-			input.nowMs,
-			walletId,
-			walletId
-		]).first();
+		const row = await emailOtpRegistrationAttemptRows.selectLiveForWallet(this.prepare, walletId, input.nowMs).first();
 		return Boolean(row);
 	}
 	async deleteExpired(nowMs) {
 		await this.ensureSchema();
-		return d1ChangedRows(await this.bindScope(`DELETE FROM email_otp_registration_attempts
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND (expires_at_ms <= ? OR state = 'expired')`, [nowMs]).run());
+		return d1ChangedRows(await emailOtpRegistrationAttemptRows.deleteExpired(this.prepare, nowMs).run());
 	}
-	async deleteAttempt(attemptId) {
-		const id = normalizeOptionalTrimmedString(attemptId);
-		if (!id) return;
-		await this.bindScope(`DELETE FROM email_otp_registration_attempts
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND attempt_id = ?`, [id]).run();
+	del(attemptId) {
+		return this.deleteById(attemptId, emailOtpRegistrationAttemptRows.delete);
 	}
 };
 function createEmailOtpChallengeStore(input) {
-	const d1 = resolveD1EmailOtpStoreOptions(input, "challenge");
-	if (d1) {
-		input?.logger?.info("[email-otp] Using D1 challenge store");
-		return new D1EmailOtpChallengeStore(d1);
-	}
-	assertEmailOtpStoreKindKnown(input, "challenge");
-	input?.logger?.info("[email-otp] Using in-memory challenge store (non-persistent)");
-	return new InMemoryEmailOtpChallengeStore();
+	return createEmailOtpStore(input, "challenge", {
+		d1: (database, scope) => new D1EmailOtpChallengeStore(database, scope),
+		inMemory: () => new InMemoryEmailOtpChallengeStore()
+	});
 }
 function createEmailOtpGrantStore(input) {
-	const d1 = resolveD1EmailOtpStoreOptions(input, "grant");
-	if (d1) {
-		input?.logger?.info("[email-otp] Using D1 grant store");
-		return new D1EmailOtpGrantStore(d1);
-	}
-	assertEmailOtpStoreKindKnown(input, "grant");
-	input?.logger?.info("[email-otp] Using in-memory grant store (non-persistent)");
-	return new InMemoryEmailOtpGrantStore();
+	return createEmailOtpStore(input, "grant", {
+		d1: (database, scope) => new D1EmailOtpGrantStore(database, scope),
+		inMemory: () => new InMemoryEmailOtpStore(GRANT_RECORD)
+	});
 }
 function createEmailOtpWalletEnrollmentStore(input) {
-	const d1 = resolveD1EmailOtpStoreOptions(input, "wallet enrollment");
-	if (d1) {
-		input?.logger?.info("[email-otp] Using D1 wallet enrollment store");
-		return new D1EmailOtpWalletEnrollmentStore(d1);
-	}
-	assertEmailOtpStoreKindKnown(input, "enrollment");
-	input?.logger?.info("[email-otp] Using in-memory wallet enrollment store (non-persistent)");
-	return new InMemoryEmailOtpWalletEnrollmentStore();
+	return createEmailOtpStore(input, "wallet enrollment", {
+		d1: (database, scope) => new D1EmailOtpWalletEnrollmentStore(database, scope),
+		inMemory: () => new InMemoryEmailOtpWalletEnrollmentStore()
+	}, "enrollment");
 }
 function createEmailOtpAuthStateStore(input) {
-	const d1 = resolveD1EmailOtpStoreOptions(input, "auth state");
-	if (d1) {
-		input?.logger?.info("[email-otp] Using D1 auth state store");
-		return new D1EmailOtpAuthStateStore(d1);
-	}
-	assertEmailOtpStoreKindKnown(input, "auth state");
-	input?.logger?.info("[email-otp] Using in-memory auth state store (non-persistent)");
-	return new InMemoryEmailOtpAuthStateStore();
+	return createEmailOtpStore(input, "auth state", {
+		d1: (database, scope) => new D1EmailOtpAuthStateStore(database, scope),
+		inMemory: () => new InMemoryEmailOtpStore(AUTH_STATE_RECORD)
+	});
 }
 function createEmailOtpUnlockChallengeStore(input) {
-	const d1 = resolveD1EmailOtpStoreOptions(input, "unlock challenge");
-	if (d1) {
-		input?.logger?.info("[email-otp] Using D1 unlock challenge store");
-		return new D1EmailOtpUnlockChallengeStore(d1);
-	}
-	assertEmailOtpStoreKindKnown(input, "unlock challenge");
-	input?.logger?.info("[email-otp] Using in-memory unlock challenge store (non-persistent)");
-	return new InMemoryEmailOtpUnlockChallengeStore();
+	return createEmailOtpStore(input, "unlock challenge", {
+		d1: (database, scope) => new D1EmailOtpUnlockChallengeStore(database, scope),
+		inMemory: () => new InMemoryEmailOtpStore(UNLOCK_CHALLENGE_RECORD)
+	});
 }
 function createEmailOtpRegistrationAttemptStore(input) {
-	const d1 = resolveD1EmailOtpStoreOptions(input, "registration attempt");
-	if (d1) {
-		input?.logger?.info("[email-otp] Using D1 registration attempt store");
-		return new D1EmailOtpRegistrationAttemptStore(d1);
-	}
-	assertEmailOtpStoreKindKnown(input, "registration attempt");
-	input?.logger?.info("[email-otp] Using in-memory registration attempt store (non-persistent)");
-	return new InMemoryEmailOtpRegistrationAttemptStore();
+	return createEmailOtpStore(input, "registration attempt", {
+		d1: (database, scope) => new D1EmailOtpRegistrationAttemptStore(database, scope),
+		inMemory: () => new InMemoryEmailOtpRegistrationAttemptStore()
+	});
 }
 //#endregion
-export { D1EmailOtpAuthStateStore, D1EmailOtpChallengeStore, D1EmailOtpGrantStore, D1EmailOtpRegistrationAttemptStore, D1EmailOtpUnlockChallengeStore, D1EmailOtpWalletEnrollmentStore, EMAIL_OTP_STORE_D1_SCHEMA_SQL, createEmailOtpAuthStateStore, createEmailOtpChallengeStore, createEmailOtpGrantStore, createEmailOtpRegistrationAttemptStore, createEmailOtpUnlockChallengeStore, createEmailOtpWalletEnrollmentStore, ensureEmailOtpStoreD1Schema, resolveEmailOtpStoreNamespace };
+export { createEmailOtpAuthStateStore, createEmailOtpChallengeStore, createEmailOtpGrantStore, createEmailOtpRegistrationAttemptStore, createEmailOtpUnlockChallengeStore, createEmailOtpWalletEnrollmentStore };
 
 //# sourceMappingURL=EmailOtpStores.js.map