@seams/wallet-server 0.6.2 → 0.7.3

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeVerifier.js

@@ -61,6 +61,20 @@ var CloudflareD1EmailOtpChallengeVerifier = class {
 		return this.emailOtpEnrollments.prepareDeleteEnrollmentIfUnreferencedStatement(walletId);
 	}
 	async verifyExisting(input) {
+		const verified = await this.verifyExistingChallenge(input, "now");
+		if (!verified.ok) return verified;
+		const { consumeInBatch: _consumed, ...result } = verified;
+		return result;
+	}
+	/**
+	* Verifies an existing challenge for an operation that commits its
+	* consumption with its own writes. Nothing is consumed here: a batch that
+	* never commits leaves the challenge usable for an exact retry.
+	*/
+	async verifyExistingForBatch(input) {
+		return await this.verifyExistingChallenge(input, "in_batch");
+	}
+	async verifyExistingChallenge(input, consumption) {
 		try {
 			const userId = normalizeOptionalTrimmedString(input.userId);
 			const walletId = normalizeOptionalTrimmedString(input.walletId);
@@ -157,15 +171,18 @@ var CloudflareD1EmailOtpChallengeVerifier = class {
 				authState: authState.state,
 				record
 			});
-			const consumed = await this.emailOtpChallenges.consume(record.challengeId);
-			if (!consumed) return emailOtpChallengeInvalidOrExpired();
+			let consumeInBatch = [];
+			if (consumption === "now") {
+				if (!await this.emailOtpChallenges.consume(record.challengeId)) return emailOtpChallengeInvalidOrExpired();
+			} else consumeInBatch = this.emailOtpChallenges.prepareConsumeInBatchStatements(record, nowMs);
 			await this.emailOtpEnrollments.resetFailureState({
 				enrollment: enrollment.enrollment,
 				authState: authState.state
 			});
 			return {
 				ok: true,
-				challengeId: consumed.challengeId,
+				consumeInBatch,
+				challengeId: record.challengeId,
 				userId,
 				walletId,
 				orgId,

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpDeliveryRuntime.js

@@ -1,3 +1,4 @@
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { EMAIL_OTP_CHANNEL } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { maskEmail } from "./d1EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpDeliveryRuntime.ts
@@ -24,11 +25,7 @@ var CloudflareD1EmailOtpDeliveryRuntime = class {
 		return this.resolveDelivery(record, requestOrigin, "reused");
 	}
 	async deliverEmailOtpCode(record, requestOrigin) {
-		if (this.config.production && this.config.deliveryMode !== "email_provider" && this.config.deliveryMode !== "provider_and_demo_code" && this.config.deliveryMode !== "demo_code_response") return {
-			ok: false,
-			code: "email_otp_delivery_not_allowed",
-			message: `Email OTP delivery mode ${this.config.deliveryMode} is disabled in production`
-		};
+		if (this.config.production && this.config.deliveryMode !== "email_provider" && this.config.deliveryMode !== "provider_and_demo_code" && this.config.deliveryMode !== "demo_code_response") return failure("email_otp_delivery_not_allowed", `Email OTP delivery mode ${this.config.deliveryMode} is disabled in production`);
 		const emailHint = maskEmail(record.email);
 		switch (this.config.deliveryMode) {
 			case "provider_and_demo_code": {
@@ -58,11 +55,7 @@ var CloudflareD1EmailOtpDeliveryRuntime = class {
 	}
 	async dispatchProviderEmail(record, emailHint) {
 		const provider = this.config.deliveryProvider;
-		if (!provider) return {
-			ok: false,
-			code: "email_otp_delivery_not_configured",
-			message: "Email OTP email_provider delivery is not configured"
-		};
+		if (!provider) return failure("email_otp_delivery_not_configured", "Email OTP email_provider delivery is not configured");
 		const result = await provider.deliver({
 			challengeId: record.challengeId,
 			walletId: record.walletId,
@@ -86,11 +79,7 @@ var CloudflareD1EmailOtpDeliveryRuntime = class {
 		const emailHint = maskEmail(record.email);
 		switch (this.config.deliveryMode) {
 			case "email_provider":
-				if (!this.config.deliveryProvider) return {
-					ok: false,
-					code: "email_otp_delivery_not_configured",
-					message: "Email OTP email_provider delivery is not configured"
-				};
+				if (!this.config.deliveryProvider) return failure("email_otp_delivery_not_configured", "Email OTP email_provider delivery is not configured");
 				return {
 					ok: true,
 					delivery: {
@@ -101,11 +90,7 @@ var CloudflareD1EmailOtpDeliveryRuntime = class {
 					}
 				};
 			case "provider_and_demo_code":
-				if (!this.config.deliveryProvider) return {
-					ok: false,
-					code: "email_otp_delivery_not_configured",
-					message: "Email OTP email_provider delivery is not configured"
-				};
+				if (!this.config.deliveryProvider) return failure("email_otp_delivery_not_configured", "Email OTP email_provider delivery is not configured");
 				return this.resolveDemoCodeDelivery(record, requestOrigin, status, emailHint);
 			case "log":
 			case "dev_d1_outbox":
@@ -124,11 +109,7 @@ var CloudflareD1EmailOtpDeliveryRuntime = class {
 	}
 	resolveDemoCodeDelivery(record, requestOrigin, status, emailHint) {
 		const origin = typeof requestOrigin === "string" ? requestOrigin.trim() : "";
-		if (!this.config.demoAllowedOrigins.includes(origin)) return {
-			ok: false,
-			code: "email_otp_demo_origin_not_allowed",
-			message: "Email OTP demo code delivery is not allowed for this origin"
-		};
+		if (!this.config.demoAllowedOrigins.includes(origin)) return failure("email_otp_demo_origin_not_allowed", "Email OTP demo code delivery is not allowed for this origin");
 		if (this.config.deliveryMode === "provider_and_demo_code") return {
 			ok: true,
 			delivery: {

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpEnrollmentStore.js

@@ -1,3 +1,4 @@
+import { emailOtpAuthStateRows, emailOtpWalletEnrollmentRows } from "../../../../core/emailOtpD1Statements.js";
 import { emailOtpAuthStateRecord, parseEmailOtpAuthStateRow, parseEmailOtpWalletEnrollmentRow } from "./d1EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpEnrollmentStore.ts
 var CloudflareD1EmailOtpEnrollmentStore = class {
@@ -44,7 +45,7 @@ var CloudflareD1EmailOtpEnrollmentStore = class {
 	* Deletes the shared provider enrollment only once nothing references it.
 	*
 	* The enrollment is deliberately shared: every Email method on a wallet
-	* unwraps through it, and R109D keeps active and pending methods pointing at
+	* unwraps through it, and both active and pending methods keep pointing at
 	* one row. So revoking a method must not remove it — only the disappearance
 	* of its last reference may.
 	*
@@ -73,82 +74,20 @@ var CloudflareD1EmailOtpEnrollmentStore = class {
           )`, [walletId]);
 	}
 	prepareDeleteEnrollmentStatement(walletId) {
-		return this.prepare(`DELETE FROM email_otp_wallet_enrollments
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND wallet_id = ?`, [walletId]);
+		return emailOtpWalletEnrollmentRows.delete(this.prepare, walletId);
 	}
 	async putEnrollment(record) {
 		await this.preparePutEnrollmentStatement(record).run();
 	}
 	preparePutEnrollmentStatement(record) {
-		return this.prepare(`INSERT INTO email_otp_wallet_enrollments (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        wallet_id,
-        provider_user_id,
-        record_org_id,
-        verified_email,
-        record_json,
-        created_at_ms,
-        updated_at_ms
-      )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT (namespace, org_id, project_id, env_id, wallet_id)
-      DO UPDATE SET
-        provider_user_id = EXCLUDED.provider_user_id,
-        record_org_id = EXCLUDED.record_org_id,
-        verified_email = EXCLUDED.verified_email,
-        record_json = EXCLUDED.record_json,
-        created_at_ms = EXCLUDED.created_at_ms,
-        updated_at_ms = EXCLUDED.updated_at_ms`, [
-			record.walletId,
-			record.providerUserId,
-			record.orgId,
-			record.verifiedEmail,
-			JSON.stringify(record),
-			record.createdAtMs,
-			record.updatedAtMs
-		]);
+		return emailOtpWalletEnrollmentRows.upsert(this.prepare, record);
 	}
 	/** Inserts the first enrollment without turning a concurrent winner into an update. */
 	prepareInsertEnrollmentStatement(record) {
-		return this.prepare(`INSERT INTO email_otp_wallet_enrollments (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        wallet_id,
-        provider_user_id,
-        record_org_id,
-        verified_email,
-        record_json,
-        created_at_ms,
-        updated_at_ms
-      )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
-			record.walletId,
-			record.providerUserId,
-			record.orgId,
-			record.verifiedEmail,
-			JSON.stringify(record),
-			record.createdAtMs,
-			record.updatedAtMs
-		]);
+		return emailOtpWalletEnrollmentRows.insert(this.prepare, record);
 	}
 	async readAuthState(walletId) {
-		return parseEmailOtpAuthStateRow(await this.prepare(`SELECT record_json, updated_at_ms
-         FROM email_otp_auth_states
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND wallet_id = ?
-        LIMIT 1`, [walletId]).first());
+		return parseEmailOtpAuthStateRow(await emailOtpAuthStateRows.select(this.prepare, walletId).first());
 	}
 	async readAuthStateForEnrollment(enrollment) {
 		const state = await this.readAuthState(enrollment.walletId);
@@ -213,33 +152,7 @@ var CloudflareD1EmailOtpEnrollmentStore = class {
 		await this.preparePutAuthStateStatement(record).run();
 	}
 	preparePutAuthStateStatement(record) {
-		return this.prepare(`INSERT INTO email_otp_auth_states (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        wallet_id,
-        provider_user_id,
-        record_org_id,
-        record_json,
-        created_at_ms,
-        updated_at_ms
-      )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT (namespace, org_id, project_id, env_id, wallet_id)
-      DO UPDATE SET
-        provider_user_id = EXCLUDED.provider_user_id,
-        record_org_id = EXCLUDED.record_org_id,
-        record_json = EXCLUDED.record_json,
-        created_at_ms = EXCLUDED.created_at_ms,
-        updated_at_ms = EXCLUDED.updated_at_ms`, [
-			record.walletId,
-			record.providerUserId,
-			record.orgId,
-			JSON.stringify(record),
-			record.createdAtMs,
-			record.updatedAtMs
-		]);
+		return emailOtpAuthStateRows.upsert(this.prepare, record);
 	}
 };
 //#endregion

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpGrantStore.js

@@ -1,3 +1,4 @@
+import { emailOtpGrantRows } from "../../../../core/emailOtpD1Statements.js";
 import { parseEmailOtpGrantRow } from "./d1EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpGrantStore.ts
 var CloudflareD1EmailOtpGrantStore = class {
@@ -5,59 +6,16 @@ var CloudflareD1EmailOtpGrantStore = class {
 		this.prepare = input.prepare;
 	}
 	async put(record) {
-		await this.prepare(`INSERT INTO email_otp_grants (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        grant_token,
-        user_id,
-        wallet_id,
-        record_org_id,
-        challenge_id,
-        action,
-        record_json,
-        issued_at_ms,
-        expires_at_ms
-      )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
-			record.grantToken,
-			record.userId,
-			record.walletId,
-			record.orgId || "",
-			record.challengeId,
-			record.action,
-			JSON.stringify(record),
-			record.issuedAtMs,
-			record.expiresAtMs
-		]).run();
+		await emailOtpGrantRows.insert(this.prepare, record).run();
 	}
 	async consume(grantToken) {
-		return parseEmailOtpGrantRow(await this.prepare(`DELETE FROM email_otp_grants
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND grant_token = ?
-      RETURNING record_json, expires_at_ms`, [grantToken]).first());
+		return parseEmailOtpGrantRow(await emailOtpGrantRows.consume(this.prepare, grantToken).first());
 	}
 	async read(grantToken) {
-		return parseEmailOtpGrantRow(await this.prepare(`SELECT record_json, expires_at_ms
-         FROM email_otp_grants
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND grant_token = ?
-        LIMIT 1`, [grantToken]).first());
+		return parseEmailOtpGrantRow(await emailOtpGrantRows.select(this.prepare, grantToken).first());
 	}
 	async delete(grantToken) {
-		await this.prepare(`DELETE FROM email_otp_grants
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND grant_token = ?`, [grantToken]).run();
+		await emailOtpGrantRows.delete(this.prepare, grantToken).run();
 	}
 };
 //#endregion

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.js

@@ -2,8 +2,11 @@ import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
 import "../../../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
+import { hasExactKeys } from "../../../../shared-ts/src/utils/exactKeys.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION, isWalletEmailOtpLoginOperation } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { isB64uString, nonNegativeSafeInteger, parseJsonObject, positiveSafeInteger } from "../auth/d1RouterApiAuthBoundary.js";
+import { parseCurrentEmailOtpChallengeRow, parseCurrentEmailOtpGrantRow, parseCurrentEmailOtpUnlockChallengeRow } from "../../../../core/EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.ts
 function maskEmail(email) {
 	const trimmed = email.trim().toLowerCase();
@@ -142,68 +145,29 @@ function parseEmailOtpAuthStateRow(row) {
 	if (!record || !updatedAtMs || record.updatedAtMs !== updatedAtMs) return null;
 	return record;
 }
-function parseEmailOtpChallengeOperation(input) {
-	const operation = normalizeOptionalTrimmedString(input);
-	if (!operation) return null;
-	if (isWalletEmailOtpLoginOperation(operation)) return operation;
-	if (operation === "registration") return operation;
-	if (operation === "device_link") return operation;
-	return null;
-}
 function parseEmailOtpLoginOperation(input) {
 	const operation = normalizeOptionalTrimmedString(input);
 	if (operation && isWalletEmailOtpLoginOperation(operation)) return operation;
 	return WALLET_EMAIL_OTP_UNLOCK_OPERATION;
 }
-function parseEmailOtpChallengeRecord(input) {
-	const record = parseJsonObject(input);
-	if (!record) return null;
-	const version = normalizeOptionalTrimmedString(record.version);
-	const challengeId = normalizeOptionalTrimmedString(record.challengeId);
-	const challengeSubjectId = normalizeOptionalTrimmedString(record.challengeSubjectId);
-	const walletId = normalizeOptionalTrimmedString(record.walletId);
-	const orgId = normalizeOptionalTrimmedString(record.orgId);
-	const otpChannel = normalizeOptionalTrimmedString(record.otpChannel);
-	const email = normalizeOptionalTrimmedString(record.email)?.toLowerCase() || "";
-	const otpCode = normalizeOptionalTrimmedString(record.otpCode);
-	const ownerProofBindingDigest = normalizeOptionalTrimmedString(record.ownerProofBindingDigest);
-	const action = parseEmailOtpChallengeAction(record.action);
-	const operation = parseEmailOtpChallengeOperation(record.operation);
-	const createdAtMs = positiveSafeInteger(record.createdAtMs);
-	const expiresAtMs = positiveSafeInteger(record.expiresAtMs);
-	const attemptCount = nonNegativeSafeInteger(record.attemptCount);
-	const maxAttempts = positiveSafeInteger(record.maxAttempts);
-	if (version !== "email_otp_challenge_v1" || !challengeId || !challengeSubjectId || !walletId || !email || !otpCode || !ownerProofBindingDigest || !action || !operation || !emailOtpChallengePurposeIsValid({
-		action,
-		operation
-	}) || otpChannel !== "email_otp" || !createdAtMs || !expiresAtMs || attemptCount === null || !maxAttempts || expiresAtMs <= createdAtMs) return null;
+/**
+* Reads a challenge row with the core parser and holds it to more: the operation must fit the
+* action and the challenge must expire after it was created. The email is lowercased.
+*/
+function parseEmailOtpChallengeRow(row) {
+	const record = parseCurrentEmailOtpChallengeRow({
+		recordJson: row?.record_json,
+		expiresAtMs: row?.expires_at_ms
+	});
+	if (!record || record.expiresAtMs <= record.createdAtMs || !emailOtpChallengePurposeIsValid(record)) return null;
 	return {
-		version: "email_otp_challenge_v1",
-		challengeId,
-		challengeSubjectId,
-		walletId,
-		...orgId ? { orgId } : {},
-		otpChannel: EMAIL_OTP_CHANNEL,
-		email,
-		otpCode,
-		ownerProofBindingDigest,
-		action,
-		operation,
-		createdAtMs,
-		expiresAtMs,
-		attemptCount,
-		maxAttempts
+		...record,
+		email: record.email.toLowerCase()
 	};
 }
-function parseEmailOtpChallengeRow(row) {
-	const record = parseEmailOtpChallengeRecord(row?.record_json);
-	const expiresAtMs = positiveSafeInteger(row?.expires_at_ms);
-	if (!record || !expiresAtMs || record.expiresAtMs !== expiresAtMs) return null;
-	return record;
-}
 function parseEmailOtpRegistrationVerificationReceiptV1(input) {
 	const record = parseJsonObject(input);
-	if (!record || !hasExactRecordFields(record, [
+	if (!record || !hasExactKeys(record, [
 		"version",
 		"requestFingerprint",
 		"verified",
@@ -214,7 +178,7 @@ function parseEmailOtpRegistrationVerificationReceiptV1(input) {
 	const verified = parseJsonObject(record.verified);
 	const verifiedAtMs = positiveSafeInteger(record.verifiedAtMs);
 	const expiresAtMs = positiveSafeInteger(record.expiresAtMs);
-	if (!requestFingerprint || !isB64uString(requestFingerprint) || !verified || !hasExactRecordFields(verified, [
+	if (!requestFingerprint || !isB64uString(requestFingerprint) || !verified || !hasExactKeys(verified, [
 		"challengeId",
 		"challengeSubjectId",
 		"walletId",
@@ -243,34 +207,13 @@ function parseEmailOtpRegistrationVerificationReceiptV1(input) {
 		expiresAtMs
 	};
 }
-function parseEmailOtpUnlockChallengeRecord(input) {
-	const record = parseJsonObject(input);
-	if (!record) return null;
-	const version = normalizeOptionalTrimmedString(record.version);
-	const challengeId = normalizeOptionalTrimmedString(record.challengeId);
-	const walletId = normalizeOptionalTrimmedString(record.walletId);
-	const userId = normalizeOptionalTrimmedString(record.userId);
-	const orgId = normalizeOptionalTrimmedString(record.orgId);
-	const challengeB64u = normalizeOptionalTrimmedString(record.challengeB64u);
-	const createdAtMs = positiveSafeInteger(record.createdAtMs);
-	const expiresAtMs = positiveSafeInteger(record.expiresAtMs);
-	if (version !== "email_otp_unlock_challenge_v1" || !challengeId || !walletId || !userId || !challengeB64u || !createdAtMs || !expiresAtMs || expiresAtMs <= createdAtMs) return null;
-	return {
-		version: "email_otp_unlock_challenge_v1",
-		challengeId,
-		walletId,
-		userId,
-		...orgId ? { orgId } : {},
-		challengeB64u,
-		createdAtMs,
-		expiresAtMs
-	};
-}
+/** An unlock challenge row as the core parser reads it, which must also expire after creation. */
 function parseEmailOtpUnlockChallengeRow(row) {
-	const record = parseEmailOtpUnlockChallengeRecord(row?.record_json);
-	const expiresAtMs = positiveSafeInteger(row?.expires_at_ms);
-	if (!record || !expiresAtMs || record.expiresAtMs !== expiresAtMs) return null;
-	return record;
+	const record = parseCurrentEmailOtpUnlockChallengeRow({
+		recordJson: row?.record_json,
+		expiresAtMs: row?.expires_at_ms
+	});
+	return record && record.expiresAtMs > record.createdAtMs ? record : null;
 }
 function emailOtpChallengeContextValues(input) {
 	return [
@@ -343,11 +286,7 @@ function emailOtpRegistrationChallengeBindingMismatchCode(input) {
 	return null;
 }
 function emailOtpChallengeInvalidOrExpired() {
-	return {
-		ok: false,
-		code: "challenge_expired_or_invalid",
-		message: "Email OTP challenge expired or invalid"
-	};
+	return failure("challenge_expired_or_invalid", "Email OTP challenge expired or invalid");
 }
 function emailOtpGrantRecord(input) {
 	return {
@@ -376,90 +315,34 @@ function emailOtpUnlockChallengeRecord(input) {
 		expiresAtMs: input.expiresAtMs
 	};
 }
-function parseEmailOtpGrantRecord(input) {
-	const record = parseJsonObject(input);
-	if (!record) return null;
-	const version = normalizeOptionalTrimmedString(record.version);
-	const grantToken = normalizeOptionalTrimmedString(record.grantToken);
-	const userId = normalizeOptionalTrimmedString(record.userId);
-	const walletId = normalizeOptionalTrimmedString(record.walletId);
-	const orgId = normalizeOptionalTrimmedString(record.orgId);
-	const challengeId = normalizeOptionalTrimmedString(record.challengeId);
-	const otpChannel = normalizeOptionalTrimmedString(record.otpChannel);
-	const ownerProofBindingDigest = normalizeOptionalTrimmedString(record.ownerProofBindingDigest);
-	const action = normalizeOptionalTrimmedString(record.action);
-	const issuedAtMs = positiveSafeInteger(record.issuedAtMs);
-	const expiresAtMs = positiveSafeInteger(record.expiresAtMs);
-	if (version !== "email_otp_grant_v1" || !grantToken || !userId || !walletId || !challengeId || otpChannel !== "email_otp" || !ownerProofBindingDigest || !action || !issuedAtMs || !expiresAtMs || expiresAtMs <= issuedAtMs) return null;
-	if (action !== WALLET_EMAIL_OTP_ACTIONS.unseal && action !== WALLET_EMAIL_OTP_ACTIONS.recoveryBootstrap) return null;
-	return {
-		version: "email_otp_grant_v1",
-		grantToken,
-		userId,
-		walletId,
-		...orgId ? { orgId } : {},
-		challengeId,
-		otpChannel: EMAIL_OTP_CHANNEL,
-		ownerProofBindingDigest,
-		action,
-		issuedAtMs,
-		expiresAtMs
-	};
-}
+/** A grant row as the core parser reads it, which must also expire after it was issued. */
 function parseEmailOtpGrantRow(row) {
-	const record = parseEmailOtpGrantRecord(row?.record_json);
-	const expiresAtMs = positiveSafeInteger(row?.expires_at_ms);
-	if (!record || !expiresAtMs || record.expiresAtMs !== expiresAtMs) return null;
-	return record;
+	const record = parseCurrentEmailOtpGrantRow({
+		recordJson: row?.record_json,
+		expiresAtMs: row?.expires_at_ms
+	});
+	return record && record.expiresAtMs > record.issuedAtMs ? record : null;
 }
 async function validateEmailOtpEnrollmentMaterial(input) {
 	const enrollmentSealKeyVersion = normalizeOptionalTrimmedString(input.material.enrollmentSealKeyVersion);
 	const clientUnlockPublicKeyB64u = normalizeOptionalTrimmedString(input.material.clientUnlockPublicKeyB64u);
 	const unlockKeyVersion = normalizeOptionalTrimmedString(input.material.unlockKeyVersion);
 	const serverSealedFactorCiphertextB64u = normalizeOptionalTrimmedString(input.material.serverSealedFactorCiphertextB64u);
-	if (!enrollmentSealKeyVersion) return {
-		ok: false,
-		code: "invalid_body",
-		message: "enrollmentSealKeyVersion is required"
-	};
-	if (!clientUnlockPublicKeyB64u) return {
-		ok: false,
-		code: "invalid_body",
-		message: "clientUnlockPublicKeyB64u is required"
-	};
-	if (!unlockKeyVersion) return {
-		ok: false,
-		code: "invalid_body",
-		message: "unlockKeyVersion is required"
-	};
-	if (!serverSealedFactorCiphertextB64u) return {
-		ok: false,
-		code: "invalid_body",
-		message: "serverSealedFactorCiphertextB64u is required"
-	};
+	if (!enrollmentSealKeyVersion) return failure("invalid_body", "enrollmentSealKeyVersion is required");
+	if (!clientUnlockPublicKeyB64u) return failure("invalid_body", "clientUnlockPublicKeyB64u is required");
+	if (!unlockKeyVersion) return failure("invalid_body", "unlockKeyVersion is required");
+	if (!serverSealedFactorCiphertextB64u) return failure("invalid_body", "serverSealedFactorCiphertextB64u is required");
 	let unlockPublicKeyBytes;
 	try {
 		unlockPublicKeyBytes = base64UrlDecode(clientUnlockPublicKeyB64u);
 	} catch {
-		return {
-			ok: false,
-			code: "invalid_body",
-			message: "clientUnlockPublicKeyB64u must be valid base64url"
-		};
+		return failure("invalid_body", "clientUnlockPublicKeyB64u must be valid base64url");
 	}
-	if (unlockPublicKeyBytes.length !== 33) return {
-		ok: false,
-		code: "invalid_body",
-		message: "clientUnlockPublicKeyB64u must decode to 33 bytes (compressed secp256k1 pubkey)"
-	};
+	if (unlockPublicKeyBytes.length !== 33) return failure("invalid_body", "clientUnlockPublicKeyB64u must decode to 33 bytes (compressed secp256k1 pubkey)");
 	try {
 		await input.validateSecp256k1PublicKey33(unlockPublicKeyBytes);
 	} catch {
-		return {
-			ok: false,
-			code: "invalid_body",
-			message: "clientUnlockPublicKeyB64u is not a valid secp256k1 public key"
-		};
+		return failure("invalid_body", "clientUnlockPublicKeyB64u is not a valid secp256k1 public key");
 	}
 	return {
 		ok: true,
@@ -489,16 +372,6 @@ function emailOtpAuthStateRecord(input) {
 		...lastStrongAuthAtMs != null ? { lastStrongAuthAtMs } : {}
 	};
 }
-function parseEmailOtpChallengeAction(input) {
-	const action = normalizeOptionalTrimmedString(input);
-	switch (action) {
-		case WALLET_EMAIL_OTP_ACTIONS.login:
-		case WALLET_EMAIL_OTP_ACTIONS.registration:
-		case WALLET_EMAIL_OTP_ACTIONS.recoveryBootstrap:
-		case WALLET_EMAIL_OTP_ACTIONS.deviceLink: return action;
-		default: return null;
-	}
-}
 function emailOtpChallengePurposeIsValid(input) {
 	switch (input.action) {
 		case WALLET_EMAIL_OTP_ACTIONS.login: return isWalletEmailOtpLoginOperation(input.operation);
@@ -518,11 +391,6 @@ function optionalNonNegativeSafeIntegerField(record, field) {
 function hasRecordField(record, field) {
 	return Object.prototype.hasOwnProperty.call(record, field);
 }
-function hasExactRecordFields(record, expectedFields) {
-	const actualFields = Object.keys(record).sort();
-	const expected = [...expectedFields].sort();
-	return actualFields.length === expected.length && actualFields.every((field, index) => field === expected[index]);
-}
 function patchedPositiveAuthStateValue(current, patch) {
 	if (patch === null) return void 0;
 	if (patch === void 0) return current;
@@ -534,6 +402,6 @@ function patchedNonNegativeAuthStateValue(current, patch) {
 	return patch >= 0 ? Math.floor(patch) : void 0;
 }
 //#endregion
-export { bytesEqual, clampedEmailOtpUnlockTtlMs, decodeFixedBase64Url, emailOtpAuthStateRecord, emailOtpChallengeBindingMismatchCode, emailOtpChallengeContextValues, emailOtpChallengeInvalidOrExpired, emailOtpChallengePurposeIsValid, emailOtpChallengeRecord, emailOtpChallengeWithAttemptCount, emailOtpGrantRecord, emailOtpRateLimitExceeded, emailOtpRateLimitKeys, emailOtpRegistrationChallengeBindingMismatchCode, emailOtpUnlockChallengeRecord, generateNumericOtp, maskEmail, parseEmailOtpAuthStateRecord, parseEmailOtpAuthStateRow, parseEmailOtpChallengeOperation, parseEmailOtpChallengeRecord, parseEmailOtpChallengeRow, parseEmailOtpGrantRecord, parseEmailOtpGrantRow, parseEmailOtpLoginOperation, parseEmailOtpRegistrationVerificationReceiptV1, parseEmailOtpUnlockChallengeRecord, parseEmailOtpUnlockChallengeRow, parseEmailOtpWalletEnrollmentRecord, parseEmailOtpWalletEnrollmentRow, validateEmailOtpEnrollmentMaterial };
+export { bytesEqual, clampedEmailOtpUnlockTtlMs, decodeFixedBase64Url, emailOtpAuthStateRecord, emailOtpChallengeBindingMismatchCode, emailOtpChallengeContextValues, emailOtpChallengeInvalidOrExpired, emailOtpChallengePurposeIsValid, emailOtpChallengeRecord, emailOtpChallengeWithAttemptCount, emailOtpGrantRecord, emailOtpRateLimitExceeded, emailOtpRateLimitKeys, emailOtpRegistrationChallengeBindingMismatchCode, emailOtpUnlockChallengeRecord, generateNumericOtp, maskEmail, parseEmailOtpAuthStateRow, parseEmailOtpChallengeRow, parseEmailOtpGrantRow, parseEmailOtpLoginOperation, parseEmailOtpRegistrationVerificationReceiptV1, parseEmailOtpUnlockChallengeRow, parseEmailOtpWalletEnrollmentRow, validateEmailOtpEnrollmentMaterial };
 
 //# sourceMappingURL=d1EmailOtpRecords.js.map