@seams/wallet-server 0.6.2 → 0.7.3

package/dist/esm/core/WebAuthnSyncChallengeStore.js

@@ -1,55 +1,9 @@
 import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
-import { isObject as isObject$1 } from "../shared-ts/src/utils/validation.js";
-import { formatD1ExecStatement, parseD1JsonColumn, resolveD1DatabaseFromConfig } from "../storage/d1Sql.js";
-import "./defaultConfigsServer.js";
-import { RedisTcpClient, UpstashRedisRestClient, redisDel, redisGetdelJson, redisSetJson } from "./ThresholdService/kv.js";
+import { isObject } from "../shared-ts/src/utils/validation.js";
+import { D1WebAuthnChallengeStore, WEBAUTHN_CHALLENGE_STORE_D1_SCHEMA_SQL, createWebAuthnChallengeStore, ensureWebAuthnChallengeStoreD1Schema } from "./webAuthnStoreBackends.js";
 //#region src/core/WebAuthnSyncChallengeStore.ts
-const WEBAUTHN_SYNC_CHALLENGE_KIND = "sync";
-const WEBAUTHN_SYNC_CHALLENGE_STORE_D1_SCHEMA_SQL = Object.freeze([`
-    CREATE TABLE IF NOT EXISTS webauthn_challenges (
-      namespace TEXT NOT NULL,
-      org_id TEXT NOT NULL,
-      project_id TEXT NOT NULL,
-      env_id TEXT NOT NULL,
-      challenge_id TEXT NOT NULL,
-      challenge_kind TEXT NOT NULL,
-      record_json TEXT NOT NULL,
-      created_at_ms INTEGER NOT NULL,
-      expires_at_ms INTEGER NOT NULL,
-      PRIMARY KEY (namespace, org_id, project_id, env_id, challenge_id),
-      CHECK (length(challenge_id) > 0),
-      CHECK (challenge_kind IN ('login', 'sync', 'recovery_registration')),
-      CHECK (json_valid(record_json)),
-      CHECK (created_at_ms > 0),
-      CHECK (expires_at_ms > created_at_ms)
-    )
-  `, `
-    CREATE INDEX IF NOT EXISTS webauthn_challenges_expiry_idx
-      ON webauthn_challenges (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        challenge_kind,
-        expires_at_ms
-      )
-  `]);
-async function ensureWebAuthnSyncChallengeStoreD1Schema(options) {
-	for (const statement of WEBAUTHN_SYNC_CHALLENGE_STORE_D1_SCHEMA_SQL) await options.database.exec(formatD1ExecStatement(statement));
-}
-function isObject(v) {
-	return isObject$1(v);
-}
-function toPrefixWithColon(prefix, defaultPrefix) {
-	const p = normalizeOptionalTrimmedString(prefix);
-	if (!p) return defaultPrefix;
-	return p.endsWith(":") ? p : `${p}:`;
-}
-function toWebAuthnSyncChallengePrefix(config) {
-	const explicit = normalizeOptionalTrimmedString(config.WEBAUTHN_SYNC_CHALLENGE_PREFIX);
-	if (explicit) return toPrefixWithColon(explicit, "");
-	return `${toPrefixWithColon(normalizeOptionalTrimmedString(config.THRESHOLD_PREFIX) || "w3a", `w3a:`)}webauthn:sync_challenge:`;
-}
+const WEBAUTHN_SYNC_CHALLENGE_STORE_D1_SCHEMA_SQL = WEBAUTHN_CHALLENGE_STORE_D1_SCHEMA_SQL;
+const ensureWebAuthnSyncChallengeStoreD1Schema = ensureWebAuthnChallengeStoreD1Schema;
 function parseWebAuthnSyncChallengeRecord(raw) {
 	if (!isObject(raw)) return null;
 	const version = normalizeOptionalTrimmedString(raw.version);
@@ -75,358 +29,24 @@ function parseWebAuthnSyncChallengeRecord(raw) {
 		expiresAtMs: Math.floor(expiresAtMs)
 	};
 }
-function defaultNow() {
-	return /* @__PURE__ */ new Date();
-}
-function requireD1ScopeString(input, field) {
-	const normalized = normalizeOptionalTrimmedString(input);
-	if (!normalized) throw new Error(`${field} is required for D1 WebAuthn sync challenge store`);
-	return normalized;
-}
-function normalizeD1WebAuthnSyncChallengeStoreOptions(input) {
-	return {
-		database: input.database,
-		namespace: requireD1ScopeString(input.namespace, "namespace"),
-		orgId: requireD1ScopeString(input.orgId, "orgId"),
-		projectId: requireD1ScopeString(input.projectId, "projectId"),
-		envId: requireD1ScopeString(input.envId, "envId"),
-		ensureSchema: input.ensureSchema !== false,
-		now: input.now || defaultNow
-	};
-}
-function d1ScopeFromConfig(input) {
-	return {
-		namespace: requireD1ScopeString(input.namespace, "namespace"),
-		orgId: requireD1ScopeString(input.config.orgId || input.config.ORG_ID, "orgId"),
-		projectId: requireD1ScopeString(input.config.projectId || input.config.PROJECT_ID, "projectId"),
-		envId: requireD1ScopeString(input.config.envId || input.config.ENV_ID, "envId")
-	};
-}
-var InMemoryWebAuthnSyncChallengeStore = class {
-	constructor(prefix) {
-		this.map = /* @__PURE__ */ new Map();
-		this.prefix = prefix;
-	}
-	key(challengeId) {
-		return `${this.prefix}${challengeId}`;
-	}
-	async put(record) {
-		const parsed = parseWebAuthnSyncChallengeRecord(record);
-		if (!parsed) throw new Error("Invalid sync challenge record");
-		this.map.set(this.key(parsed.challengeId), parsed);
-	}
-	async consume(challengeId) {
-		const id = normalizeOptionalTrimmedString(challengeId);
-		if (!id) return null;
-		const key = this.key(id);
-		const rec = this.map.get(key) || null;
-		this.map.delete(key);
-		if (!rec) return null;
-		if (Date.now() > rec.expiresAtMs) return null;
-		return rec;
-	}
-	async del(challengeId) {
-		const id = normalizeOptionalTrimmedString(challengeId);
-		if (!id) return;
-		this.map.delete(this.key(id));
-	}
-};
-var D1WebAuthnSyncChallengeStore = class {
-	constructor(input) {
-		this.adapterKind = "d1";
-		this.schemaReady = false;
-		const normalized = normalizeD1WebAuthnSyncChallengeStoreOptions(input);
-		this.database = normalized.database;
-		this.scope = {
-			namespace: normalized.namespace,
-			orgId: normalized.orgId,
-			projectId: normalized.projectId,
-			envId: normalized.envId
-		};
-		this.ensureSchemaOnUse = normalized.ensureSchema;
-		this.now = normalized.now;
-	}
-	async ensureSchema() {
-		if (!this.ensureSchemaOnUse || this.schemaReady) return;
-		await ensureWebAuthnSyncChallengeStoreD1Schema({ database: this.database });
-		this.schemaReady = true;
-	}
-	async put(record) {
-		await this.ensureSchema();
-		const parsed = parseWebAuthnSyncChallengeRecord(record);
-		if (!parsed) throw new Error("Invalid sync challenge record");
-		await this.database.prepare(`INSERT INTO webauthn_challenges (
-          namespace,
-          org_id,
-          project_id,
-          env_id,
-          challenge_id,
-          challenge_kind,
-          record_json,
-          created_at_ms,
-          expires_at_ms
-        )
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-        ON CONFLICT (namespace, org_id, project_id, env_id, challenge_id)
-        DO UPDATE SET
-          challenge_kind = EXCLUDED.challenge_kind,
-          record_json = EXCLUDED.record_json,
-          created_at_ms = EXCLUDED.created_at_ms,
-          expires_at_ms = EXCLUDED.expires_at_ms`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, parsed.challengeId, WEBAUTHN_SYNC_CHALLENGE_KIND, JSON.stringify(parsed), parsed.createdAtMs, parsed.expiresAtMs).run();
-	}
-	async consume(challengeId) {
-		await this.ensureSchema();
-		const id = normalizeOptionalTrimmedString(challengeId);
-		if (!id) return null;
-		return parseWebAuthnSyncChallengeRecord(parseD1JsonColumn((await this.database.prepare(`DELETE FROM webauthn_challenges
-          WHERE namespace = ?
-            AND org_id = ?
-            AND project_id = ?
-            AND env_id = ?
-            AND challenge_id = ?
-            AND challenge_kind = ?
-            AND expires_at_ms > ?
-          RETURNING record_json`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, id, WEBAUTHN_SYNC_CHALLENGE_KIND, this.now().getTime()).first())?.record_json));
-	}
-	async del(challengeId) {
-		await this.ensureSchema();
-		const id = normalizeOptionalTrimmedString(challengeId);
-		if (!id) return;
-		await this.database.prepare(`DELETE FROM webauthn_challenges
-          WHERE namespace = ?
-            AND org_id = ?
-            AND project_id = ?
-            AND env_id = ?
-            AND challenge_id = ?
-            AND challenge_kind = ?`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, id, WEBAUTHN_SYNC_CHALLENGE_KIND).run();
-	}
-};
-var UpstashRedisRestWebAuthnSyncChallengeStore = class {
-	constructor(input) {
-		this.client = new UpstashRedisRestClient({
-			url: input.url,
-			token: input.token
-		});
-		this.prefix = input.prefix;
-	}
-	key(challengeId) {
-		return `${this.prefix}${challengeId}`;
-	}
-	async put(record) {
-		const parsed = parseWebAuthnSyncChallengeRecord(record);
-		if (!parsed) throw new Error("Invalid sync challenge record");
-		const ttlMs = Math.max(1, parsed.expiresAtMs - Date.now());
-		await this.client.setJson(this.key(parsed.challengeId), parsed, ttlMs);
-	}
-	async consume(challengeId) {
-		const id = normalizeOptionalTrimmedString(challengeId);
-		if (!id) return null;
-		const parsed = parseWebAuthnSyncChallengeRecord(await this.client.getdelJson(this.key(id)));
-		if (!parsed) return null;
-		if (Date.now() > parsed.expiresAtMs) return null;
-		return parsed;
-	}
-	async del(challengeId) {
-		const id = normalizeOptionalTrimmedString(challengeId);
-		if (!id) return;
-		await this.client.del(this.key(id));
-	}
-};
-var RedisTcpWebAuthnSyncChallengeStore = class {
-	constructor(input) {
-		this.client = new RedisTcpClient(input.redisUrl);
-		this.prefix = input.prefix;
-	}
-	key(challengeId) {
-		return `${this.prefix}${challengeId}`;
-	}
-	async put(record) {
-		const parsed = parseWebAuthnSyncChallengeRecord(record);
-		if (!parsed) throw new Error("Invalid sync challenge record");
-		const ttlMs = Math.max(1, parsed.expiresAtMs - Date.now());
-		await redisSetJson(this.client, this.key(parsed.challengeId), parsed, ttlMs);
-	}
-	async consume(challengeId) {
-		const id = normalizeOptionalTrimmedString(challengeId);
-		if (!id) return null;
-		const parsed = parseWebAuthnSyncChallengeRecord(await redisGetdelJson(this.client, this.key(id)));
-		if (!parsed) return null;
-		if (Date.now() > parsed.expiresAtMs) return null;
-		return parsed;
-	}
-	async del(challengeId) {
-		const id = normalizeOptionalTrimmedString(challengeId);
-		if (!id) return;
-		await redisDel(this.client, this.key(id));
-	}
+const SYNC_CHALLENGE_STORE = {
+	label: "sync challenge",
+	prefixConfigKey: "WEBAUTHN_SYNC_CHALLENGE_PREFIX",
+	prefixName: "sync_challenge",
+	challengeKind: "sync",
+	parse: parseWebAuthnSyncChallengeRecord,
+	durableObjectLogSubject: "sync challenges",
+	connectionErrorSubject: "webauthn store",
+	unconfiguredNote: "no persistence configured",
+	d1ScopeLabel: "sync challenge"
 };
-function isDurableObjectNamespaceLike(v) {
-	return Boolean(v) && typeof v === "object" && !Array.isArray(v) && typeof v.idFromName === "function" && typeof v.get === "function";
-}
-function resolveDoNamespaceFromConfig(config) {
-	const direct = config.namespace;
-	if (isDurableObjectNamespaceLike(direct)) return direct;
-	const alt = config.durableObjectNamespace;
-	if (isDurableObjectNamespaceLike(alt)) return alt;
-	const envStyle = config.THRESHOLD_DO_NAMESPACE;
-	if (isDurableObjectNamespaceLike(envStyle)) return envStyle;
-	return null;
-}
-function resolveDoStub(input) {
-	const id = input.namespace.idFromName(input.objectName);
-	return input.namespace.get(id);
-}
-async function callDo(stub, req) {
-	const resp = await stub.fetch("https://threshold-store.invalid/", {
-		method: "POST",
-		headers: { "content-type": "application/json" },
-		body: JSON.stringify(req)
-	});
-	const text = await resp.text();
-	if (!resp.ok) throw new Error(`WebAuthn DO store HTTP ${resp.status}: ${text}`);
-	let json;
-	try {
-		json = text ? JSON.parse(text) : null;
-	} catch {
-		throw new Error(`WebAuthn DO store returned non-JSON response: ${text.slice(0, 200)}`);
-	}
-	if (!isObject(json)) throw new Error("WebAuthn DO store returned invalid JSON shape");
-	if (json.ok === true) return json;
-	const code = normalizeOptionalTrimmedString(json.code);
-	const message = normalizeOptionalTrimmedString(json.message);
-	return {
-		ok: false,
-		code: code || "internal",
-		message: message || "WebAuthn DO store error"
-	};
-}
-var CloudflareDurableObjectWebAuthnSyncChallengeStore = class {
+var D1WebAuthnSyncChallengeStore = class extends D1WebAuthnChallengeStore {
 	constructor(input) {
-		this.stub = resolveDoStub({
-			namespace: input.namespace,
-			objectName: input.objectName
-		});
-		this.prefix = input.prefix;
-	}
-	key(challengeId) {
-		return `${this.prefix}${challengeId}`;
-	}
-	async put(record) {
-		const parsed = parseWebAuthnSyncChallengeRecord(record);
-		if (!parsed) throw new Error("Invalid sync challenge record");
-		const ttlMs = Math.max(1, parsed.expiresAtMs - Date.now());
-		const resp = await callDo(this.stub, {
-			op: "set",
-			key: this.key(parsed.challengeId),
-			value: parsed,
-			ttlMs
-		});
-		if (!resp.ok) throw new Error(resp.message);
-	}
-	async consume(challengeId) {
-		const id = normalizeOptionalTrimmedString(challengeId);
-		if (!id) return null;
-		const resp = await callDo(this.stub, {
-			op: "getdel",
-			key: this.key(id)
-		});
-		if (!resp.ok) return null;
-		const parsed = parseWebAuthnSyncChallengeRecord(resp.value);
-		if (!parsed) return null;
-		if (Date.now() > parsed.expiresAtMs) return null;
-		return parsed;
-	}
-	async del(challengeId) {
-		const id = normalizeOptionalTrimmedString(challengeId);
-		if (!id) return;
-		const resp = await callDo(this.stub, {
-			op: "del",
-			key: this.key(id)
-		});
-		if (!resp.ok) throw new Error(resp.message);
+		super(input, SYNC_CHALLENGE_STORE);
 	}
 };
 function createWebAuthnSyncChallengeStore(input) {
-	const config = isObject(input.config) ? input.config : {};
-	const prefix = toWebAuthnSyncChallengePrefix(config);
-	const kind = normalizeOptionalTrimmedString(config.kind);
-	if (kind === "d1") {
-		const database = resolveD1DatabaseFromConfig(config);
-		if (!database) throw new Error("[webauthn] D1 sync challenge store selected but no D1 database was provided");
-		input.logger.info("[webauthn] Using D1 sync challenge store");
-		return new D1WebAuthnSyncChallengeStore({
-			database,
-			...d1ScopeFromConfig({
-				config,
-				namespace: prefix
-			})
-		});
-	}
-	if (kind === "cloudflare-do") {
-		const namespace = resolveDoNamespaceFromConfig(config);
-		if (!namespace) throw new Error("cloudflare-do webauthn store selected but no Durable Object namespace was provided (expected config.namespace)");
-		const objectName = normalizeOptionalTrimmedString(config.objectName) || normalizeOptionalTrimmedString(config.name) || "threshold-store";
-		input.logger.info("[webauthn] Using Cloudflare Durable Object store for sync challenges");
-		return new CloudflareDurableObjectWebAuthnSyncChallengeStore({
-			namespace,
-			objectName,
-			prefix
-		});
-	}
-	if (kind === "in-memory") {
-		input.logger.info("[webauthn] Using in-memory sync challenge store (non-persistent)");
-		return new InMemoryWebAuthnSyncChallengeStore(prefix);
-	}
-	if (kind === "upstash-redis-rest") {
-		const url = normalizeOptionalTrimmedString(config.url) || normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_URL);
-		const token = normalizeOptionalTrimmedString(config.token) || normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_TOKEN);
-		if (!url || !token) throw new Error("Upstash webauthn store enabled but url/token are not both set");
-		input.logger.info("[webauthn] Using Upstash REST sync challenge store");
-		return new UpstashRedisRestWebAuthnSyncChallengeStore({
-			url,
-			token,
-			prefix
-		});
-	}
-	if (kind === "redis-tcp") {
-		if (!input.isNode) {
-			input.logger.warn("[webauthn] redis-tcp sync challenge store is not supported in this runtime; falling back to in-memory");
-			return new InMemoryWebAuthnSyncChallengeStore(prefix);
-		}
-		const redisUrl = normalizeOptionalTrimmedString(config.redisUrl) || normalizeOptionalTrimmedString(config.REDIS_URL);
-		if (!redisUrl) throw new Error("redis-tcp webauthn store enabled but redisUrl is not set");
-		input.logger.info("[webauthn] Using redis-tcp sync challenge store");
-		return new RedisTcpWebAuthnSyncChallengeStore({
-			redisUrl,
-			prefix
-		});
-	}
-	if (kind) throw new Error(`[webauthn] Unknown sync challenge store kind: ${kind}`);
-	const upstashUrl = normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_URL);
-	const upstashToken = normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_TOKEN);
-	if (upstashUrl || upstashToken) {
-		if (!upstashUrl || !upstashToken) throw new Error("Upstash webauthn store enabled but UPSTASH_REDIS_REST_URL / UPSTASH_REDIS_REST_TOKEN are not both set");
-		input.logger.info("[webauthn] Using Upstash REST sync challenge store");
-		return new UpstashRedisRestWebAuthnSyncChallengeStore({
-			url: upstashUrl,
-			token: upstashToken,
-			prefix
-		});
-	}
-	const redisUrl = normalizeOptionalTrimmedString(config.REDIS_URL);
-	if (redisUrl) {
-		if (!input.isNode) {
-			input.logger.warn("[webauthn] REDIS_URL is set but TCP Redis is not supported in this runtime; falling back to in-memory");
-			return new InMemoryWebAuthnSyncChallengeStore(prefix);
-		}
-		input.logger.info("[webauthn] Using redis-tcp sync challenge store");
-		return new RedisTcpWebAuthnSyncChallengeStore({
-			redisUrl,
-			prefix
-		});
-	}
-	input.logger.info("[webauthn] Using in-memory sync challenge store (no persistence configured)");
-	return new InMemoryWebAuthnSyncChallengeStore(prefix);
+	return createWebAuthnChallengeStore(input, SYNC_CHALLENGE_STORE, (options) => new D1WebAuthnSyncChallengeStore(options));
 }
 //#endregion
 export { D1WebAuthnSyncChallengeStore, WEBAUTHN_SYNC_CHALLENGE_STORE_D1_SCHEMA_SQL, createWebAuthnSyncChallengeStore, ensureWebAuthnSyncChallengeStoreD1Schema };

package/dist/esm/core/authService/AuthService.js

@@ -4,16 +4,15 @@ import { resolveEmailOtpConfig, resolveEmailOtpRateLimitPolicies } from "./email
 import { MinimalNearClient } from "../rpcClients/near/NearClient.js";
 import { isNodeEnvironment } from "./wasm.js";
 import { githubOAuthPublicConfig, verifyGithubOAuthCodeWithIdentityStore } from "./githubOAuth.js";
-import { createWebAuthnLoginOptionsWithStore, createWebAuthnSyncAccountOptionsWithStores, listWebAuthnAuthenticatorsForUserWithStores, verifyWebAuthnAuthenticationLiteWithStore, verifyWebAuthnLoginWithStores, verifyWebAuthnRegistrationCredentialForIntent, verifyWebAuthnSyncAccountWithStores } from "./webauthn.js";
+import { createWebAuthnLoginOptionsWithStore, createWebAuthnSyncAccountOptionsWithStores, listWebAuthnAuthenticatorsForUserWithStores, verifyWebAuthnAuthenticationLiteWithStore, verifyWebAuthnLoginWithStores, verifyWebAuthnSyncAccountWithStores } from "./webauthn.js";
 import { createAuthServiceConfig } from "../config.js";
 import { formatGasToTGas, formatYoctoToNear } from "../utils.js";
 import { createRouterAbSigningRuntimes } from "../routerAbSigning/createRouterAbSigningRuntimes.js";
 import { deliverEmailOtpCode, readEmailOtpOutboxEntry } from "./emailOtpDelivery.js";
-import { createEmailOtpChallengeWithAction, pruneExpiredEmailOtpChallengesWithStore } from "./emailOtpChallenges.js";
+import { createEmailOtpChallengeWithAction } from "./emailOtpChallenges.js";
 import { createEmailOtpChallenge, createEmailOtpEnrollmentChallenge, verifyEmailOtpChallenge } from "./emailOtpChallengeOperations.js";
 import { verifyEmailOtpChallengeCode } from "./emailOtpChallengeVerification.js";
 import { isEmailOtpStrongAuthRequiredWithStores, markEmailOtpStrongAuthSatisfiedWithStores, putEmailOtpAuthStateForEnrollmentWithStore, readActiveEmailOtpEnrollmentWithStore, readEmailOtpAuthStateForEnrollmentWithStore, readEmailOtpEnrollmentWithStore } from "./emailOtpEnrollment.js";
-import { cleanupGoogleEmailOtpRegistrationAttemptsWithStore } from "./googleEmailOtpRegistration.js";
 import { verifyEmailOtpEnrollment } from "./emailOtpRegistrationEnrollment.js";
 import { createEmailOtpUnlockChallenge, verifyEmailOtpUnlockProof } from "./emailOtpUnlock.js";
 import { createEmailOtpShamirCipherFromConfig, runEmailOtpServerSealOperation } from "./emailOtpSeal.js";
@@ -114,12 +113,6 @@ var AuthService = class {
 			request: input
 		});
 	}
-	async cleanupGoogleEmailOtpRegistrationAttempts(nowMs = Date.now()) {
-		await cleanupGoogleEmailOtpRegistrationAttemptsWithStore({
-			registrationAttemptStore: this.stores.getEmailOtpRegistrationAttemptStore(),
-			nowMs
-		});
-	}
 	async consumeGoogleEmailOtpRegistrationAttemptRateLimit(input) {
 		return await consumeGoogleEmailOtpRegistrationAttemptRateLimitForAuthService({
 			deps: this.googleEmailOtpOperationsInput(),
@@ -335,9 +328,6 @@ var AuthService = class {
 	async fundImplicitNearAccount(request) {
 		return await this.nearAccounts.fundImplicitNearAccount(request);
 	}
-	async verifyRegistrationCredentialForIntent(input) {
-		return await verifyWebAuthnRegistrationCredentialForIntent(input);
-	}
 	/**
 	* Standard WebAuthn assertion verification for lite flows.
 	*
@@ -414,13 +404,6 @@ var AuthService = class {
 			putAuthStateForEnrollment: this.putEmailOtpAuthStateForEnrollment.bind(this)
 		});
 	}
-	async pruneExpiredEmailOtpChallenges(challengeStore, nowMs) {
-		await pruneExpiredEmailOtpChallengesWithStore({
-			challengeStore,
-			memoryOutbox: this.emailOtpMemoryOutbox,
-			nowMs
-		});
-	}
 	async readEmailOtpAuthStateForEnrollment(enrollmentRecord) {
 		return await readEmailOtpAuthStateForEnrollmentWithStore({
 			authStateStore: this.stores.getEmailOtpAuthStateStore(),

package/dist/esm/core/authService/bytes.js

@@ -6,9 +6,6 @@ function randomBase64Url(bytes) {
 	crypto.getRandomValues(data);
 	return base64UrlEncode(data);
 }
-function randomOpaqueId(byteLength = 16) {
-	return randomBase64Url(byteLength);
-}
 function randomNumericCode(length) {
 	const bytes = new Uint8Array(length);
 	crypto.getRandomValues(bytes);
@@ -17,6 +14,6 @@ function randomNumericCode(length) {
 	return code;
 }
 //#endregion
-export { randomBase64Url, randomNumericCode, randomOpaqueId };
+export { randomBase64Url, randomNumericCode };
 
 //# sourceMappingURL=bytes.js.map

package/dist/esm/core/authService/emailOtpChallengeOperations.js

@@ -1,5 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import "../../shared-ts/src/utils/validation.js";
+import { failure } from "../../shared-ts/src/utils/failure.js";
 import { WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../shared-ts/src/utils/emailOtpDomain.js";
 import { randomBase64Url } from "./bytes.js";
 //#region src/core/authService/emailOtpChallengeOperations.ts
@@ -11,11 +12,7 @@ function createGrantToken() {
 	return typeof crypto === "undefined" || typeof crypto.getRandomValues !== "function" ? null : randomBase64Url(24);
 }
 function unsupportedCryptoResult() {
-	return {
-		ok: false,
-		code: "unsupported",
-		message: "crypto.getRandomValues is unavailable in this runtime"
-	};
+	return failure("unsupported", "crypto.getRandomValues is unavailable in this runtime");
 }
 async function createEmailOtpChallenge(input, request) {
 	const result = await input.createChallengeWithAction({

package/dist/esm/core/authService/emailOtpChallengeProof.js

@@ -1,6 +1,7 @@
 import { parseChallengeSubjectId, parseEmailOtpChallengeId, parseEmailOtpRegistrationAttemptId, parseOrgId, parseProviderSubject, parseWalletId } from "../../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import "../../shared-ts/src/utils/validation.js";
+import { failure } from "../../shared-ts/src/utils/failure.js";
 import { WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../shared-ts/src/utils/emailOtpDomain.js";
 //#region src/core/authService/emailOtpChallengeProof.ts
 function assertNever(value) {
@@ -134,41 +135,17 @@ function buildVerifiedEmailOtpRegistrationChallengeProof(input) {
 }
 function parseRawEmailOtpRegistrationChallengeProofInput(request) {
 	const providerSubject = parseProviderSubject(request.providerSubject);
-	if (!providerSubject.ok) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Email OTP registration requires providerSubject"
-	};
+	if (!providerSubject.ok) return failure("invalid_body", "Email OTP registration requires providerSubject");
 	const challengeSubjectId = parseChallengeSubjectId(request.providerSubject);
-	if (!challengeSubjectId.ok) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Email OTP registration requires challengeSubjectId"
-	};
+	if (!challengeSubjectId.ok) return failure("invalid_body", "Email OTP registration requires challengeSubjectId");
 	const challengeId = parseEmailOtpChallengeId(request.challengeId);
-	if (!challengeId.ok) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Email OTP registration requires challengeId"
-	};
+	if (!challengeId.ok) return failure("invalid_body", "Email OTP registration requires challengeId");
 	const finalWalletId = parseWalletId(request.walletId);
-	if (!finalWalletId.ok) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Email OTP registration requires walletId"
-	};
+	if (!finalWalletId.ok) return failure("invalid_body", "Email OTP registration requires walletId");
 	const orgId = parseOrgId(request.orgId);
-	if (!orgId.ok) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Email OTP registration requires orgId"
-	};
+	if (!orgId.ok) return failure("invalid_body", "Email OTP registration requires orgId");
 	const ownerProofBindingDigest = normalizeOptionalTrimmedString(request.ownerProofBindingDigest);
-	if (!ownerProofBindingDigest) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Email OTP registration requires ownerProofBindingDigest"
-	};
+	if (!ownerProofBindingDigest) return failure("invalid_body", "Email OTP registration requires ownerProofBindingDigest");
 	const registrationAttemptId = parseEmailOtpRegistrationAttemptId(request.googleEmailOtpRegistrationAttemptId);
 	if (registrationAttemptId.ok) return {
 		ok: true,
@@ -183,17 +160,9 @@ function parseRawEmailOtpRegistrationChallengeProofInput(request) {
 			challengeId: challengeId.value
 		}
 	};
-	if (registrationAttemptId.error.code === "invalid") return {
-		ok: false,
-		code: "invalid_body",
-		message: "googleEmailOtpRegistrationAttemptId must be a string"
-	};
+	if (registrationAttemptId.error.code === "invalid") return failure("invalid_body", "googleEmailOtpRegistrationAttemptId must be a string");
 	const proofEmail = normalizeOptionalTrimmedString(request.proofEmail)?.toLowerCase();
-	if (!proofEmail) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Email OTP registration requires proofEmail"
-	};
+	if (!proofEmail) return failure("invalid_body", "Email OTP registration requires proofEmail");
 	return {
 		ok: true,
 		input: {
@@ -209,6 +178,6 @@ function parseRawEmailOtpRegistrationChallengeProofInput(request) {
 	};
 }
 //#endregion
-export { buildVerifiedEmailOtpRegistrationChallengeProof, emailOtpChallengeVerificationIntentFromRequest, emailOtpRegistrationChallengePurposeForRecord, emailOtpStoredChallengePurposeMatches, expectedEmailOtpStoredChallengePurpose, parseRawEmailOtpRegistrationChallengeProofInput, readEmailOtpStoredChallengePurpose };
+export { buildVerifiedEmailOtpRegistrationChallengeProof, emailOtpChallengeVerificationIntentFromRequest, emailOtpStoredChallengePurposeMatches, expectedEmailOtpStoredChallengePurpose, parseRawEmailOtpRegistrationChallengeProofInput, readEmailOtpStoredChallengePurpose };
 
 //# sourceMappingURL=emailOtpChallengeProof.js.map