@seams/wallet-server 0.6.2 → 0.7.1

package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationRequestScopedCloudflare.js

@@ -1,9 +1,10 @@
 import { parseRouterAbEd25519YaoRegistrationActivationExecuteRequestV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { ROUTER_AB_TRACE_ID_HEADER_V1, createRouterAbTraceContextV1, parseRouterAbTraceContextV1 } from "../../../../shared-ts/src/utils/routerAbTraceContext.js";
 import { json, readJson } from "../../../framework/http.js";
-import { InMemoryRouterAbEd25519YaoRegistrationService, InMemoryRouterAbEd25519YaoRegistrationStateV1 } from "./routerAbEd25519YaoRegistration.js";
+import { InMemoryRouterAbEd25519YaoRegistrationService, routerAbEd25519YaoExecutionMatchesAdmissionV1 } from "./routerAbEd25519YaoRegistration.js";
 import { InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, routerAbEd25519YaoBearerCredentialDigestV1 } from "./routerAbEd25519YaoRegistrationIntentAuthorization.js";
-import { routerAbEd25519YaoRegistrationExecutionRequestDigestV1 } from "./routerAbEd25519YaoRegistrationExecutionRecord.js";
+import { pinRouterAbEd25519YaoRegistrationDispatchRootV1, routerAbEd25519YaoRegistrationResultFromRouterAnswerV1 } from "./routerAbEd25519YaoRegistrationExecutionRecord.js";
+import { routerAbEd25519YaoAdmittedRegistrationAuthorityV1 } from "../capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.js";
 import { runRouterAbEd25519YaoRegistrationTwoPhaseV1 } from "./routerAbEd25519YaoRegistrationTwoPhaseRunner.js";
 //#region src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationRequestScopedCloudflare.ts
 async function handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1(input) {
@@ -66,7 +67,8 @@ async function refreshContinuationAuthority(input, lifecycleId) {
 		if ((await input.store.commit({
 			lifecycleId,
 			state: loaded.state,
-			baseline: loaded.baseline
+			baseline: loaded.baseline,
+			companionWrite: null
 		})).kind === "stored") return null;
 	}
 	return {
@@ -78,6 +80,7 @@ async function refreshContinuationAuthority(input, lifecycleId) {
 }
 async function runAdmissionRequest(input, request, trace) {
 	const lifecycleId = request.scope.lifecycle_id;
+	let dispatchRoot = null;
 	return mapAdmissionRunResult(await runRouterAbEd25519YaoRegistrationTwoPhaseV1({
 		lifecycleId,
 		store: input.store,
@@ -104,11 +107,25 @@ async function runAdmissionRequest(input, request, trace) {
 					kind: "rejected",
 					value: preparation.failure
 				};
-				case "claimed": return {
-					kind: "claimed",
-					state,
-					claim: preparation.claim
-				};
+				case "claimed":
+					try {
+						dispatchRoot = await input.backend.resolveRegistrationDispatchRoot(request);
+					} catch (error) {
+						return {
+							kind: "rejected",
+							value: {
+								ok: false,
+								status: 503,
+								code: "admission_failed",
+								message: `registration tenant root is unavailable: ${error instanceof Error ? error.message : String(error)}`
+							}
+						};
+					}
+					return {
+						kind: "claimed",
+						state,
+						claim: preparation.claim
+					};
 			}
 		},
 		backend: async () => {
@@ -125,68 +142,60 @@ async function runAdmissionRequest(input, request, trace) {
 			}
 		},
 		complete: async (state, claim, backend) => {
+			const admitted = new InMemoryRouterAbEd25519YaoRegistrationService(input.backend, state.registration).commitAdmit({
+				request,
+				claim,
+				outcome: {
+					kind: "backend_response",
+					result: backend
+				}
+			});
+			if (admitted.ok) {
+				if (dispatchRoot === null) throw new Error("registration admission resolved no tenant root to pin");
+				pinRouterAbEd25519YaoRegistrationDispatchRootV1(state.registration, lifecycleId, dispatchRoot);
+			}
 			return {
+				kind: "state",
 				state,
-				value: new InMemoryRouterAbEd25519YaoRegistrationService(input.backend, state.registration).commitAdmit({
-					request,
-					claim,
-					outcome: {
-						kind: "backend_response",
-						result: backend
-					}
-				})
+				value: admitted
 			};
 		}
 	}));
 }
+/**
+* Checks the execute against this Gateway's admission, then asks the Router
+* to run it once, on the tenant root pinned at admission. The Router owns the
+* execution: it claims it in its wallet object, records the terminal answer
+* before replying, answers an exact retry from that record, and replays a run
+* cut short once its claim lapses. An execute never looks the active root up
+* again, so a completed execution's answer outlives the root's lineage.
+*/
 async function runExecutionRequest(input, request, trace) {
 	const lifecycleId = request.binding.lifecycle.lifecycle_id;
 	const credentialStartedAt = performance.now();
 	const credential = await routerAbEd25519YaoBearerCredentialDigestV1(input.request);
-	const credentialDigestMs = elapsedMs(credentialStartedAt);
-	if (!credential.ok) return timedExecutionResult(credential.result, {
-		credentialDigestMs,
-		requestDigestMs: 0,
-		d1ClaimMs: 0,
+	const timing = {
+		credentialDigestMs: elapsedMs(credentialStartedAt),
+		d1AdmissionReadMs: 0,
 		routerExecutionMs: 0,
 		routerServerTiming: null,
-		resultReconstructionMs: 0,
-		d1TerminalCommitMs: 0
-	});
-	const requestDigestStartedAt = performance.now();
-	const requestDigestSha256Hex = await routerAbEd25519YaoRegistrationExecutionRequestDigestV1(request);
-	const requestDigestMs = elapsedMs(requestDigestStartedAt);
-	const d1ClaimStartedAt = performance.now();
-	const claim = await input.store.claimRegistrationExecution({
-		lifecycleId,
-		request,
-		requestDigestSha256Hex,
-		credentialDigestSha256Hex: credential.digestSha256Hex,
-		nowMs: Date.now()
-	});
+		resultReconstructionMs: 0
+	};
+	if (!credential.ok) return timedExecutionResult(credential.result, timing);
+	const admissionStartedAt = performance.now();
+	const authority = routerAbEd25519YaoAdmittedRegistrationAuthorityV1((await input.store.load(lifecycleId)).state, lifecycleId);
 	const timingBeforeRouter = {
-		credentialDigestMs,
-		requestDigestMs,
-		d1ClaimMs: elapsedMs(d1ClaimStartedAt),
-		routerExecutionMs: 0,
-		routerServerTiming: null,
-		resultReconstructionMs: 0,
-		d1TerminalCommitMs: 0
+		...timing,
+		d1AdmissionReadMs: elapsedMs(admissionStartedAt)
 	};
-	switch (claim.kind) {
-		case "completed": return timedExecutionResult({
-			ok: true,
-			status: 200,
-			value: claim.value
-		}, timingBeforeRouter);
-		case "failed": return timedExecutionResult(claim.value, timingBeforeRouter);
-		case "rejected": return timedExecutionResult(executionClaimFailure(claim), timingBeforeRouter);
-		case "claimed": break;
-	}
+	if (!authority) return timedExecutionResult(executionRefusal("unknown_registration", "registration admission was not found"), timingBeforeRouter);
+	if (!routerAbEd25519YaoExecutionMatchesAdmissionV1(request, authority.admissionReceipt)) return timedExecutionResult(executionRefusal("binding_mismatch", "registration execution does not match the admitted binding"), timingBeforeRouter);
+	if (authority.credentialDigestSha256Hex !== credential.digestSha256Hex) return timedExecutionResult(executionRefusal("credential_rejected", "registration execution credential does not match its admission subject"), timingBeforeRouter);
+	if (authority.expiresAtMs <= Date.now()) return timedExecutionResult(executionRefusal("credential_expired", "registration intent credential is expired"), timingBeforeRouter);
 	let backend;
 	const routerExecutionStartedAt = performance.now();
 	try {
-		backend = await input.backend.execute(request, claim.value.admissionRequest, trace);
+		backend = await input.backend.executePinnedRegistration(request, authority.admissionRequest, authority.dispatchRoot, trace);
 	} catch (error) {
 		return timedExecutionResult({
 			ok: false,
@@ -198,52 +207,29 @@ async function runExecutionRequest(input, request, trace) {
 			routerExecutionMs: elapsedMs(routerExecutionStartedAt)
 		});
 	}
-	const routerExecutionMs = elapsedMs(routerExecutionStartedAt);
-	const routerServerTiming = input.backend.takeLastRouterServerTiming?.() ?? null;
+	const routerTiming = {
+		...timingBeforeRouter,
+		routerExecutionMs: elapsedMs(routerExecutionStartedAt),
+		routerServerTiming: input.backend.takeLastRouterServerTiming?.() ?? null
+	};
+	if (!backend.ok && backend.code === "execution_in_progress") return timedExecutionResult(executionRefusal("execution_in_progress", backend.message), routerTiming);
+	if (!backend.ok && backend.code === "execution_mismatch") return timedExecutionResult(executionRefusal("binding_mismatch", backend.message), routerTiming);
 	if (isRetryableRegistrationBackendFailure(backend)) return timedExecutionResult({
 		ok: false,
 		status: 503,
 		code: "execution_failed",
 		message: backend.message
-	}, {
-		...timingBeforeRouter,
-		routerExecutionMs,
-		routerServerTiming
-	});
+	}, routerTiming);
 	const reconstructionStartedAt = performance.now();
-	const terminal = completeClaimedExecution(input.backend, claim.value, request, backend);
-	const resultReconstructionMs = elapsedMs(reconstructionStartedAt);
-	const terminalCommitStartedAt = performance.now();
-	const committed = await input.store.commitRegistrationExecution({
-		claimed: claim.value,
-		claimedVersion: claim.version,
-		outcome: terminal.ok ? {
-			kind: "completed",
-			result: terminal.value
-		} : {
-			kind: "failed",
-			failure: terminal
-		}
+	return timedExecutionResult(routerAbEd25519YaoRegistrationResultFromRouterAnswerV1({
+		backend: input.backend,
+		authority,
+		request,
+		answer: backend
+	}), {
+		...routerTiming,
+		resultReconstructionMs: elapsedMs(reconstructionStartedAt)
 	});
-	const d1TerminalCommitMs = elapsedMs(terminalCommitStartedAt);
-	const timing = {
-		...timingBeforeRouter,
-		routerExecutionMs,
-		routerServerTiming,
-		resultReconstructionMs,
-		d1TerminalCommitMs
-	};
-	if (committed.kind === "uncertain") return timedExecutionResult({
-		ok: false,
-		status: 503,
-		code: "execution_failed",
-		message: "registration execution terminal persistence is uncertain"
-	}, timing);
-	return timedExecutionResult(isRegistrationFailure(committed.value) ? committed.value : {
-		ok: true,
-		status: 200,
-		value: committed.value
-	}, timing);
 }
 function elapsedMs(startedAt) {
 	return Math.max(0, performance.now() - startedAt);
@@ -254,69 +240,40 @@ function timedExecutionResult(result, timing) {
 		timing
 	};
 }
-function completeClaimedExecution(backendAdapter, claimed, request, backend) {
-	const state = new InMemoryRouterAbEd25519YaoRegistrationStateV1();
-	const sessionKey = bytesToHex(claimed.admissionReceipt.binding.session_id);
-	state.states.set(sessionKey, {
-		kind: "admitted",
-		admissionRequest: claimed.admissionRequest,
-		admissionReceipt: claimed.admissionReceipt
-	});
-	state.lifecycleSessions.set(claimed.lifecycleId, sessionKey);
-	const service = new InMemoryRouterAbEd25519YaoRegistrationService(backendAdapter, state);
-	const prepared = service.prepareExecute(request);
-	if (prepared.kind !== "claimed") throw new Error("claimed Yao registration execution could not be reconstructed");
-	return service.commitExecute({
-		request,
-		claim: prepared.claim,
-		outcome: {
-			kind: "backend_response",
-			result: backend
-		}
-	});
-}
-function executionClaimFailure(claim) {
-	switch (claim.code) {
+function executionRefusal(code, message) {
+	switch (code) {
 		case "unknown_registration": return {
 			ok: false,
 			status: 404,
 			code: "unknown_registration",
-			message: claim.message
+			message
 		};
 		case "binding_mismatch": return {
 			ok: false,
 			status: 409,
 			code: "binding_mismatch",
-			message: claim.message
+			message
 		};
 		case "credential_rejected": return {
 			ok: false,
 			status: 403,
 			code: "registration_intent_subject_mismatch",
-			message: claim.message
+			message
 		};
 		case "credential_expired": return {
 			ok: false,
 			status: 403,
 			code: "registration_intent_credential_expired",
-			message: claim.message
+			message
 		};
 		case "execution_in_progress": return {
 			ok: false,
 			status: 409,
 			code: "execution_in_progress",
-			message: claim.message
+			message
 		};
 	}
 }
-function bytesToHex(bytes) {
-	let encoded = "";
-	for (const byte of bytes) encoded += byte.toString(16).padStart(2, "0");
-	return encoded;
-}
-function isRegistrationFailure(value) {
-	return "ok" in value && value.ok === false;
-}
 function isRetryableRegistrationBackendFailure(result) {
 	return !result.ok && (result.code === "worker_unavailable" || result.code === "worker_rejected" || result.code === "router_execution_retryable");
 }
@@ -401,11 +358,9 @@ function registrationResultResponse(result, timing) {
 function registrationExecutionServerTiming(timing) {
 	const gatewayTiming = [
 		serverTimingMetric("yao_credential_digest", timing.credentialDigestMs),
-		serverTimingMetric("yao_request_digest", timing.requestDigestMs),
-		serverTimingMetric("yao_d1_claim", timing.d1ClaimMs),
+		serverTimingMetric("yao_d1_admission_read", timing.d1AdmissionReadMs),
 		serverTimingMetric("yao_router_execution", timing.routerExecutionMs),
-		serverTimingMetric("yao_result_reconstruction", timing.resultReconstructionMs),
-		serverTimingMetric("yao_d1_terminal_commit", timing.d1TerminalCommitMs)
+		serverTimingMetric("yao_result_reconstruction", timing.resultReconstructionMs)
 	];
 	if (timing.routerServerTiming) gatewayTiming.push(timing.routerServerTiming);
 	return gatewayTiming.join(", ");

package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationTwoPhaseRunner.js

@@ -13,7 +13,7 @@ async function runRouterAbEd25519YaoRegistrationTwoPhaseV1(input) {
 		case "completed": return prepared;
 		case "rejected": return prepared;
 		case "claimed": {
-			const preclaim = await input.store.commit(buildCommitInput(input.lifecycleId, loaded, prepared.state));
+			const preclaim = await input.store.commit(buildCommitInput(input.lifecycleId, loaded, prepared.state, null));
 			if (preclaim.kind === "version_mismatch") return {
 				kind: "preclaim_version_mismatch",
 				key: preclaim.key
@@ -30,7 +30,7 @@ async function runRouterAbEd25519YaoRegistrationTwoPhaseV1(input) {
 				commit: preclaim
 			});
 			const completion = await input.complete(terminalSnapshot.state, prepared.claim, backend.value);
-			const terminal = await input.store.commit(buildCommitInput(input.lifecycleId, terminalSnapshot, completion.state));
+			const terminal = await input.store.commit(buildCommitInput(input.lifecycleId, terminalSnapshot, completion.state, completion.kind === "state_with_write" ? completion.write : null));
 			if (terminal.kind === "version_mismatch") return {
 				kind: "terminal_version_mismatch",
 				claim: prepared.claim,
@@ -45,11 +45,12 @@ async function runRouterAbEd25519YaoRegistrationTwoPhaseV1(input) {
 		}
 	}
 }
-function buildCommitInput(lifecycleId, loaded, state) {
+function buildCommitInput(lifecycleId, loaded, state, companionWrite) {
 	return {
 		lifecycleId,
 		state,
-		baseline: loaded.baseline
+		baseline: loaded.baseline,
+		companionWrite
 	};
 }
 //#endregion

package/dist/esm/router/domains/ed25519Yao/routerAbEd25519YaoGatewayEnvelope.js

@@ -0,0 +1,45 @@
+import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
+import { decodeTenantRootIdentityWireV1 } from "../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
+import { tenantRootIdentityDigestB64uV1 } from "../../cloudflare/runtime/tenantRootCreationGrant.js";
+//#region src/router/domains/ed25519Yao/routerAbEd25519YaoGatewayEnvelope.ts
+function parseRouterAbEd25519YaoTenantRootWireV1(input) {
+	if (typeof input !== "object" || input === null || Array.isArray(input)) return null;
+	const record = input;
+	if (Object.keys(record).length !== 2 || !Object.hasOwn(record, "identity") || !Object.hasOwn(record, "custody_lineage_b64u")) return null;
+	const identity = decodeTenantRootIdentityWireV1(record.identity);
+	const lineage = record.custody_lineage_b64u;
+	if (!identity.ok || typeof lineage !== "string" || !/^[A-Za-z0-9_-]+$/u.test(lineage)) return null;
+	try {
+		const bytes = base64UrlDecode(lineage);
+		if (bytes.length !== 16 || base64UrlEncode(bytes) !== lineage) return null;
+	} catch {
+		return null;
+	}
+	return {
+		identity: {
+			orgId: identity.value.orgId,
+			projectId: identity.value.projectId,
+			envId: identity.value.envId,
+			signingRootId: identity.value.signingRootId,
+			signingRootVersion: identity.value.signingRootVersion
+		},
+		custody_lineage_b64u: lineage
+	};
+}
+async function routerAbEd25519YaoTenantRootWireV1(root) {
+	if (await tenantRootIdentityDigestB64uV1(root.identity) !== root.identityDigestB64u) throw new Error("Resolved Yao tenant-root identity differs from its active lineage");
+	return {
+		identity: {
+			orgId: root.identity.orgId,
+			projectId: root.identity.projectId,
+			envId: root.identity.envId,
+			signingRootId: root.identity.signingRootId,
+			signingRootVersion: root.identity.signingRootVersion
+		},
+		custody_lineage_b64u: root.custodyLineageB64u
+	};
+}
+//#endregion
+export { parseRouterAbEd25519YaoTenantRootWireV1, routerAbEd25519YaoTenantRootWireV1 };
+
+//# sourceMappingURL=routerAbEd25519YaoGatewayEnvelope.js.map

package/dist/esm/router/domains/ed25519Yao/session/thresholdEd25519RequestValidation.js

@@ -270,6 +270,6 @@ function parseThresholdEd25519OperationStepUpGrantRequest(raw) {
 	}
 }
 //#endregion
-export { parseRouterAbEd25519YaoSessionPolicyV1, parseThresholdEd25519OperationStepUpGrantRequest, parseThresholdEd25519SessionRouteRequest };
+export { parseThresholdEd25519OperationStepUpGrantRequest, parseThresholdEd25519SessionRouteRequest };
 
 //# sourceMappingURL=thresholdEd25519RequestValidation.js.map

package/dist/esm/router/domains/emailOtp/emailOtpExportPolicy.js

@@ -23,48 +23,7 @@ async function authorizeEmailOtpExportPolicy(opts, input) {
 		policySource: "adapter"
 	};
 }
-function emailOtpExportPolicyAuditPayload(input) {
-	const decision = input.decision;
-	return {
-		source: input.source,
-		operation: WALLET_EMAIL_OTP_EXPORT_OPERATION,
-		policyDecision: decision.decision,
-		policySource: decision.policySource,
-		...decision.policyId ? { policyId: decision.policyId } : {},
-		...decision.approvalId ? { approvalId: decision.approvalId } : {},
-		...decision.reason ? { reason: decision.reason } : {},
-		...input.challengeId ? { challengeId: input.challengeId } : {},
-		...input.otpChannel ? { otpChannel: input.otpChannel } : {}
-	};
-}
-function emailOtpExportPolicyWebhookEventDescriptor(input) {
-	return {
-		eventType: input.eventType,
-		...input.challengeId ? { eventId: input.challengeId } : {},
-		payload: {
-			...emailOtpExportPolicyAuditPayload({
-				source: input.source,
-				decision: input.decision,
-				...input.challengeId ? { challengeId: input.challengeId } : {},
-				...input.otpChannel ? { otpChannel: input.otpChannel } : {}
-			}),
-			...input.code ? { code: input.code } : {},
-			...input.message ? { message: input.message } : {}
-		}
-	};
-}
-function emailOtpExportDeniedDecisionFromResult(input) {
-	return {
-		ok: false,
-		decision: "DENY",
-		code: input.code,
-		message: input.message,
-		policySource: input.policySource,
-		...input.policyId ? { policyId: input.policyId } : {},
-		...input.approvalId ? { approvalId: input.approvalId } : {}
-	};
-}
 //#endregion
-export { authorizeEmailOtpExportPolicy, emailOtpExportDeniedDecisionFromResult, emailOtpExportPolicyAuditPayload, emailOtpExportPolicyWebhookEventDescriptor };
+export { authorizeEmailOtpExportPolicy };
 
 //# sourceMappingURL=emailOtpExportPolicy.js.map

package/dist/esm/router/domains/emailOtp/emailOtpRequestValidation.js

@@ -7,11 +7,6 @@ function parseWalletUnlockBackend(raw) {
 	if (isWalletUnlockBackend(value)) return value;
 	return null;
 }
-function parseWalletEmailOtpChannel(raw) {
-	const value = normalizeOptionalTrimmedString(raw)?.toLowerCase() || "";
-	if (value === "email_otp") return value;
-	return null;
-}
 function parseWalletEmailOtpLoginOperation(raw) {
 	const value = normalizeOptionalTrimmedString(raw)?.toLowerCase() || "";
 	if (!value || value === "wallet_unlock") return {
@@ -29,6 +24,6 @@ function parseWalletEmailOtpLoginOperation(raw) {
 	};
 }
 //#endregion
-export { parseWalletEmailOtpChannel, parseWalletEmailOtpLoginOperation, parseWalletUnlockBackend };
+export { parseWalletEmailOtpLoginOperation, parseWalletUnlockBackend };
 
 //# sourceMappingURL=emailOtpRequestValidation.js.map

package/dist/esm/router/domains/emailOtp/emailOtpSessionRouteHelpers.js

@@ -1,23 +1,7 @@
-import { parseProviderSubject } from "../../../shared-ts/src/utils/domainIds.js";
 import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../shared-ts/src/utils/digests.js";
 import "../../../shared-ts/src/utils/encoders.js";
-import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
-import { isPlainObject, toOptionalRecordString } from "../../../shared-ts/src/utils/validation.js";
-import { EMAIL_OTP_CHANNEL } from "../../../shared-ts/src/utils/emailOtpDomain.js";
 //#region src/router/domains/emailOtp/emailOtpSessionRouteHelpers.ts
-const EMAIL_OTP_RESEND_RETRY_AFTER_MS = 1e4;
-function emailOtpRouteValidationError(status, code, message) {
-	return {
-		ok: false,
-		status,
-		body: {
-			ok: false,
-			code,
-			message
-		}
-	};
-}
 function emailOtpStatusCode(code) {
 	if (code === "internal") return 500;
 	if (code === "not_configured") return 503;
@@ -28,16 +12,6 @@ function emailOtpStatusCode(code) {
 	if (code === "challenge_id_mismatch" || code === "challenge_purpose_mismatch" || code === "challenge_subject_mismatch" || code === "challenge_email_mismatch" || code === "challenge_wallet_mismatch" || code === "challenge_session_mismatch" || code === "challenge_org_mismatch" || code === "challenge_channel_mismatch" || code === "registration_reroll_disallowed" || code === "challenge_expired_or_invalid" || code === "invalid_otp") return 401;
 	return 400;
 }
-function emailOtpResultStatus(result) {
-	return result.ok ? 200 : emailOtpStatusCode(result.code);
-}
-function emailOtpInternalErrorBody(error) {
-	return {
-		ok: false,
-		code: "internal",
-		message: error instanceof Error ? error.message || "Internal error" : "Internal error"
-	};
-}
 function emailOtpFailureAuditPayload(input) {
 	return {
 		source: input.source,
@@ -77,65 +51,6 @@ function emailOtpLoggedInWebhookEventDescriptor(input) {
 		}
 	};
 }
-function emailOtpEnrolledWebhookEventDescriptor(input) {
-	return {
-		eventType: "wallet.email_otp.enrolled",
-		eventId: input.challengeId,
-		payload: {
-			otpChannel: input.otpChannel,
-			enrollmentSealKeyVersion: input.enrollmentSealKeyVersion,
-			unlockKeyVersion: input.unlockKeyVersion
-		}
-	};
-}
-function validateEmailOtpJsonObjectBody(body) {
-	if (!body || typeof body !== "object" || Array.isArray(body)) return emailOtpRouteValidationError(400, "invalid_body", "Expected JSON object body");
-	return {
-		ok: true,
-		body
-	};
-}
-function validateEmailOtpWalletId(input) {
-	const walletId = normalizeOptionalTrimmedString(input.body.walletId) || "";
-	if (!walletId) return emailOtpRouteValidationError(400, "invalid_body", "walletId is required");
-	if (walletId !== getAuthenticatedWalletId(input.claims, input.userId)) return emailOtpRouteValidationError(403, "wallet_identity_mismatch", "walletId must match the authenticated wallet");
-	return {
-		ok: true,
-		walletId
-	};
-}
-function validateEmailOtpChannel(body) {
-	if ((normalizeOptionalTrimmedString(body.otpChannel)?.toLowerCase() || "") !== "email_otp") return emailOtpRouteValidationError(400, "invalid_body", "otpChannel must be email_otp");
-	return {
-		ok: true,
-		otpChannel: EMAIL_OTP_CHANNEL
-	};
-}
-function validateEmailOtpRequiredString(body, field) {
-	const value = normalizeOptionalTrimmedString(body[field]) || "";
-	if (!value) return emailOtpRouteValidationError(400, "invalid_body", `${field} is required`);
-	return {
-		ok: true,
-		value
-	};
-}
-function getAuthenticatedWalletId(claims, userId) {
-	return toOptionalRecordString(claims, "walletId") || normalizeOptionalTrimmedString(userId) || "";
-}
-function isGoogleOidcEmailOtpSession(claims) {
-	if (!isPlainObject(claims)) return false;
-	const authSource = claims.authSource;
-	if (!isPlainObject(authSource) || authSource.kind !== "oidc_provider") return false;
-	if (toOptionalRecordString(authSource, "providerId") !== "google_oidc" || toOptionalRecordString(claims, "provider") !== "oidc" || toOptionalRecordString(claims, "oidcProvider") !== "google") return false;
-	const providerSubject = toOptionalRecordString(claims, "providerSubject");
-	const authSourceProviderSubject = toOptionalRecordString(authSource, "providerSubject");
-	const parsedProviderSubject = parseProviderSubject(providerSubject);
-	return Boolean(parsedProviderSubject.ok && parsedProviderSubject.value.startsWith("google:") && authSourceProviderSubject === parsedProviderSubject.value);
-}
-function parseOidcAccountMode(raw) {
-	const value = normalizeOptionalTrimmedString(raw)?.toLowerCase() || "";
-	if (value === "register" || value === "login") return value;
-}
 async function hashEmailOtpOperationBinding(input) {
 	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
 		walletId: input.walletId,
@@ -148,63 +63,7 @@ async function hashEmailOtpOperationBinding(input) {
 		...input.operationFingerprintDigest ? { operationFingerprintDigest: input.operationFingerprintDigest } : {}
 	})));
 }
-function emailOtpChallengeResponseBody(result) {
-	if (!result.ok || !result.challenge) return result;
-	const challenge = result.challenge;
-	return {
-		ok: true,
-		challenge: {
-			challengeId: challenge.challengeId,
-			issuedAt: new Date(challenge.issuedAtMs).toISOString(),
-			issuedAtMs: challenge.issuedAtMs,
-			expiresAt: new Date(challenge.expiresAtMs).toISOString(),
-			expiresAtMs: challenge.expiresAtMs,
-			userId: challenge.userId,
-			walletId: challenge.walletId,
-			...challenge.orgId ? { orgId: challenge.orgId } : {},
-			ownerProofBindingDigest: challenge.ownerProofBindingDigest,
-			otpChannel: challenge.otpChannel,
-			action: challenge.action,
-			operation: challenge.operation
-		},
-		delivery: result.delivery,
-		retryAfterMs: typeof result.retryAfterMs === "number" ? result.retryAfterMs : EMAIL_OTP_RESEND_RETRY_AFTER_MS
-	};
-}
-function emailOtpServerSealResponseBody(result, walletId) {
-	if (!result.ok) return result;
-	return {
-		ok: true,
-		walletId,
-		ciphertext: result.ciphertext,
-		enrollmentSealKeyVersion: result.enrollmentSealKeyVersion
-	};
-}
-function emailOtpEnrollmentFinalizeResponseBody(result) {
-	if (!result.ok) return result;
-	return {
-		ok: true,
-		walletId: result.walletId,
-		otpChannel: result.otpChannel,
-		enrollment: {
-			createdAt: new Date(result.enrollment.createdAtMs).toISOString(),
-			updatedAt: new Date(result.enrollment.updatedAtMs).toISOString(),
-			enrollmentSealKeyVersion: result.enrollment.enrollmentSealKeyVersion,
-			unlockKeyVersion: result.enrollment.unlockKeyVersion
-		}
-	};
-}
-function emailOtpLoginVerifyResponseBody(args) {
-	return {
-		ok: true,
-		challengeId: args.result.challengeId,
-		loginGrant: args.result.loginGrant,
-		grantExpiresAt: new Date(args.result.grantExpiresAtMs).toISOString(),
-		otpChannel: args.result.otpChannel,
-		enrollmentSealKeyVersion: args.enrollment.enrollment.enrollmentSealKeyVersion
-	};
-}
 //#endregion
-export { emailOtpChallengeResponseBody, emailOtpEnrolledWebhookEventDescriptor, emailOtpEnrollmentFinalizeResponseBody, emailOtpFailureAuditPayload, emailOtpFailureWebhookEventDescriptors, emailOtpInternalErrorBody, emailOtpLoggedInWebhookEventDescriptor, emailOtpLoginVerifyResponseBody, emailOtpResultStatus, emailOtpServerSealResponseBody, emailOtpStatusCode, getAuthenticatedWalletId, hashEmailOtpOperationBinding, isGoogleOidcEmailOtpSession, parseOidcAccountMode, shouldEmitEmailOtpLockedWebhook, validateEmailOtpChannel, validateEmailOtpJsonObjectBody, validateEmailOtpRequiredString, validateEmailOtpWalletId };
+export { emailOtpFailureWebhookEventDescriptors, emailOtpLoggedInWebhookEventDescriptor, emailOtpStatusCode, hashEmailOtpOperationBinding };
 
 //# sourceMappingURL=emailOtpSessionRouteHelpers.js.map

package/dist/esm/router/domains/passkeyCustody/passkeyCustodyEnvelopeRetrievalRoute.js

@@ -40,6 +40,6 @@ function refusal(status, code, message) {
 	};
 }
 //#endregion
-export { handlePasskeyCustodyEnvelopeRetrieval, passkeyCustodyEnvelopeRetrievalRouteResponse };
+export { handlePasskeyCustodyEnvelopeRetrieval };
 
 //# sourceMappingURL=passkeyCustodyEnvelopeRetrievalRoute.js.map