@seams/wallet-server 0.6.2 → 0.7.3

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecoveryService.js

@@ -1,6 +1,7 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
+import { failedVerification, failure } from "../../../../shared-ts/src/utils/failure.js";
 import { validateSecp256k1PublicKey33, verifySecp256k1RecoverableSignatureAgainstPublicKey33 } from "../../../../core/ThresholdService/evmCryptoWasm.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { parseD1BoundaryWalletIdResult } from "../auth/d1RouterApiAuthBoundary.js";
@@ -61,51 +62,29 @@ function normalizeEmailOtpStrongAuthInput(input) {
 	};
 }
 function invalidEmailOtpEnrollmentReadBody(message) {
-	return {
-		ok: false,
-		code: "invalid_body",
-		message
-	};
+	return failure("invalid_body", message);
 }
 function invalidActiveEmailOtpEnrollmentReadBody(message) {
-	return {
-		ok: false,
-		code: "invalid_body",
-		message
-	};
+	return failure("invalid_body", message);
 }
 function invalidEmailOtpStrongAuthBody(message) {
-	return {
-		ok: false,
-		code: "invalid_body",
-		message
-	};
+	return failure("invalid_body", message);
 }
 function emailOtpEnrollmentTenantMismatch() {
-	return {
-		ok: false,
-		code: "tenant_scope_mismatch",
-		message: "Email OTP enrollment does not match the requested orgId"
-	};
+	return failure("tenant_scope_mismatch", "Email OTP enrollment does not match the requested orgId");
 }
 var CloudflareD1EmailOtpRecoveryService = class {
 	constructor(input) {
-		this.challengeVerifier = input.challengeVerifier;
 		this.emailOtpChallenges = input.emailOtpChallenges;
 		this.emailOtpEnrollments = input.emailOtpEnrollments;
 		this.emailOtpGrants = input.emailOtpGrants;
 		this.emailOtpRateLimits = input.emailOtpRateLimits;
-		this.grantTtlMs = input.grantTtlMs;
 	}
 	async readEmailOtpEnrollment(input) {
 		const parsed = normalizeEmailOtpEnrollmentReadInput(input);
 		if (!parsed.ok) return parsed.result;
 		const enrollment = await this.emailOtpEnrollments.readEnrollment(parsed.value.walletId);
-		if (!enrollment) return {
-			ok: false,
-			code: "not_found",
-			message: "Email OTP enrollment not found"
-		};
+		if (!enrollment) return failure("not_found", "Email OTP enrollment not found");
 		if (enrollment.orgId !== parsed.value.orgId) return emailOtpEnrollmentTenantMismatch();
 		return {
 			ok: true,
@@ -120,11 +99,7 @@ var CloudflareD1EmailOtpRecoveryService = class {
 			orgId: parsed.value.orgId
 		});
 		if (!enrollment.ok) return enrollment;
-		if (parsed.value.providerUserId && enrollment.enrollment.providerUserId !== parsed.value.providerUserId) return {
-			ok: false,
-			code: "provider_identity_mismatch",
-			message: "Email OTP enrollment does not match the requested provider user"
-		};
+		if (parsed.value.providerUserId && enrollment.enrollment.providerUserId !== parsed.value.providerUserId) return failure("provider_identity_mismatch", "Email OTP enrollment does not match the requested provider user");
 		return enrollment;
 	}
 	async isEmailOtpStrongAuthRequired(input) {
@@ -200,11 +175,7 @@ var CloudflareD1EmailOtpRecoveryService = class {
 				unlockKeyVersion: enrollment.enrollment.unlockKeyVersion
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: errorMessage(error) || "Failed to create Email OTP unlock challenge"
-			};
+			return failure("internal", errorMessage(error) || "Failed to create Email OTP unlock challenge");
 		}
 	}
 	async verifyEmailOtpUnlockProof(input) {
@@ -212,31 +183,31 @@ var CloudflareD1EmailOtpRecoveryService = class {
 			const parsed = normalizeUnlockProofInput(input);
 			if (!parsed.ok) return parsed.result;
 			const challenge = await this.emailOtpChallenges.consumeUnlock(parsed.value.challengeId);
-			if (!challenge || Date.now() > challenge.expiresAtMs) return emailOtpUnlockProofRejected("challenge_expired_or_invalid", "Email OTP unlock challenge expired or invalid");
-			if (challenge.walletId !== parsed.value.walletId) return emailOtpUnlockProofRejected("challenge_binding_mismatch", "Email OTP unlock challenge is not valid for this walletId");
+			if (!challenge || Date.now() > challenge.expiresAtMs) return failedVerification("challenge_expired_or_invalid", "Email OTP unlock challenge expired or invalid");
+			if (challenge.walletId !== parsed.value.walletId) return failedVerification("challenge_binding_mismatch", "Email OTP unlock challenge is not valid for this walletId");
 			const enrollment = await this.readActiveEmailOtpEnrollment({
 				walletId: parsed.value.walletId,
 				orgId: parsed.value.orgId
 			});
-			if (!enrollment.ok) return emailOtpUnlockProofRejected(enrollment.code, enrollment.message);
-			if (challenge.userId !== enrollment.enrollment.providerUserId || challenge.orgId !== enrollment.enrollment.orgId) return emailOtpUnlockProofRejected("challenge_binding_mismatch", "Email OTP unlock challenge is not valid for this enrollment");
+			if (!enrollment.ok) return failedVerification(enrollment.code, enrollment.message);
+			if (challenge.userId !== enrollment.enrollment.providerUserId || challenge.orgId !== enrollment.enrollment.orgId) return failedVerification("challenge_binding_mismatch", "Email OTP unlock challenge is not valid for this enrollment");
 			const publicKey = decodeFixedBase64Url(parsed.value.publicKeyB64u, 33);
-			if (!publicKey) return emailOtpUnlockProofRejected("invalid_body", "unlockProof.publicKey must decode to 33 bytes");
+			if (!publicKey) return failedVerification("invalid_body", "unlockProof.publicKey must decode to 33 bytes");
 			try {
 				await validateSecp256k1PublicKey33(publicKey);
 			} catch {
-				return emailOtpUnlockProofRejected("invalid_body", "unlockProof.publicKey is not a valid secp256k1 public key");
+				return failedVerification("invalid_body", "unlockProof.publicKey is not a valid secp256k1 public key");
 			}
 			const signature = decodeFixedBase64Url(parsed.value.signatureB64u, 65);
-			if (!signature) return emailOtpUnlockProofRejected("invalid_body", "unlockProof.signature must decode to 65 bytes");
+			if (!signature) return failedVerification("invalid_body", "unlockProof.signature must decode to 65 bytes");
 			const enrolledPublicKey = decodeFixedBase64Url(enrollment.enrollment.clientUnlockPublicKeyB64u, 33);
-			if (!enrolledPublicKey || !bytesEqual(enrolledPublicKey, publicKey)) return emailOtpUnlockProofRejected("invalid_unlock_proof", "unlockProof.publicKey does not match the enrolled clientUnlockPublicKeyB64u");
+			if (!enrolledPublicKey || !bytesEqual(enrolledPublicKey, publicKey)) return failedVerification("invalid_unlock_proof", "unlockProof.publicKey does not match the enrolled clientUnlockPublicKeyB64u");
 			const challengeDigest = decodeFixedBase64Url(challenge.challengeB64u, 32);
-			if (!challengeDigest) return emailOtpUnlockProofRejected("internal", "Stored unlock challenge digest must decode to 32 bytes");
+			if (!challengeDigest) return failedVerification("internal", "Stored unlock challenge digest must decode to 32 bytes");
 			try {
 				await verifySecp256k1RecoverableSignatureAgainstPublicKey33(challengeDigest, signature, publicKey);
 			} catch {
-				return emailOtpUnlockProofRejected("invalid_unlock_proof", "unlockProof.signature did not verify against unlockProof.publicKey");
+				return failedVerification("invalid_unlock_proof", "unlockProof.signature did not verify against unlockProof.publicKey");
 			}
 			await this.emailOtpEnrollments.putAuthStateForEnrollment(enrollment.enrollment, { lastEmailOtpLoginAtMs: Date.now() });
 			return {
@@ -251,12 +222,7 @@ var CloudflareD1EmailOtpRecoveryService = class {
 				unlockKeyVersion: enrollment.enrollment.unlockKeyVersion
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				verified: false,
-				code: "internal",
-				message: errorMessage(error) || "Failed to verify Email OTP unlock proof"
-			};
+			return failedVerification("internal", errorMessage(error) || "Failed to verify Email OTP unlock proof");
 		}
 	}
 	async consumeEmailOtpGrant(input) {
@@ -281,11 +247,7 @@ var CloudflareD1EmailOtpRecoveryService = class {
 				otpChannel: EMAIL_OTP_CHANNEL
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: errorMessage(error) || "Failed to consume Email OTP grant"
-			};
+			return failure("internal", errorMessage(error) || "Failed to consume Email OTP grant");
 		}
 	}
 };
@@ -355,48 +317,23 @@ function emailOtpGrantBindingMismatch(record, input) {
 function invalidUnlockChallengeBody(message) {
 	return {
 		ok: false,
-		result: {
-			ok: false,
-			code: "invalid_body",
-			message
-		}
+		result: failure("invalid_body", message)
 	};
 }
 function invalidUnlockProofBody(message) {
 	return {
 		ok: false,
-		result: {
-			ok: false,
-			verified: false,
-			code: "invalid_body",
-			message
-		}
+		result: failedVerification("invalid_body", message)
 	};
 }
 function invalidGrantConsumptionBody(message) {
 	return {
 		ok: false,
-		result: {
-			ok: false,
-			code: "invalid_body",
-			message
-		}
+		result: failure("invalid_body", message)
 	};
 }
 function emailOtpGrantInvalidOrExpired() {
-	return {
-		ok: false,
-		code: "grant_invalid_or_expired",
-		message: "Email OTP grant is invalid or expired"
-	};
-}
-function emailOtpUnlockProofRejected(code, message) {
-	return {
-		ok: false,
-		verified: false,
-		code,
-		message
-	};
+	return failure("grant_invalid_or_expired", "Email OTP grant is invalid or expired");
 }
 //#endregion
 export { CloudflareD1EmailOtpRecoveryService };

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer.js

@@ -1,5 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { validateSecp256k1PublicKey33 } from "../../../../core/ThresholdService/evmCryptoWasm.js";
 import { emailOtpDeviceEnrollmentId } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { validateEmailOtpEnrollmentMaterial } from "./d1EmailOtpRecords.js";
@@ -20,27 +21,11 @@ var CloudflareD1EmailOtpRegistrationEnrollmentFinalizer = class {
 		this.googleEmailOtpSessions = input.googleEmailOtpSessions;
 	}
 	async prepareRegistrationFinalize(input) {
-		if (input.authority.kind !== "email_otp") return input.request.emailOtpEnrollment ? {
-			ok: false,
-			code: "invalid_body",
-			message: "Email OTP enrollment material is only valid for Email OTP registration"
-		} : { ok: true };
-		if (!input.request.emailOtpEnrollment) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Email OTP registration finalize requires emailOtpEnrollment"
-		};
-		if (input.authority.walletId !== input.walletId || input.authority.finalWalletId !== input.walletId || input.authority.orgId !== input.orgId) return {
-			ok: false,
-			code: "authority_binding_mismatch",
-			message: "Email OTP registration authority does not match finalize scope"
-		};
+		if (input.authority.kind !== "email_otp") return input.request.emailOtpEnrollment ? failure("invalid_body", "Email OTP enrollment material is only valid for Email OTP registration") : { ok: true };
+		if (!input.request.emailOtpEnrollment) return failure("invalid_body", "Email OTP registration finalize requires emailOtpEnrollment");
+		if (input.authority.walletId !== input.walletId || input.authority.finalWalletId !== input.walletId || input.authority.orgId !== input.orgId) return failure("authority_binding_mismatch", "Email OTP registration authority does not match finalize scope");
 		const material = parseEmailOtpEnrollmentMaterialBoundaryInput(input.request.emailOtpEnrollment);
-		if (!material) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Email OTP enrollment material must be an object with the expected fields"
-		};
+		if (!material) return failure("invalid_body", "Email OTP enrollment material must be an object with the expected fields");
 		return await this.buildPersistence({
 			walletId: input.walletId,
 			orgId: input.orgId,
@@ -107,8 +92,8 @@ var CloudflareD1EmailOtpRegistrationEnrollmentFinalizer = class {
 		};
 	}
 	/**
-	* Refactor 109C: the enrollment statements for a wallet's first Email OTP
-	* method, to commit in the batch that inserts that method.
+	* The enrollment statements for a wallet's first Email OTP method, to commit
+	* in the batch that inserts that method.
 	*
 	* Same construction as registration's, deliberately — the shared enrollment
 	* is one record whichever operation creates it, and a second builder would
@@ -131,11 +116,7 @@ var CloudflareD1EmailOtpRegistrationEnrollmentFinalizer = class {
 	* batch instead of silently replacing material that another operation owns.
 	*/
 	async prepareLinkedDeviceEnrollment(input) {
-		if (!await this.emailOtpEnrollments.signerWalletExists(input.walletId)) return {
-			ok: false,
-			code: "wallet_registration_incomplete",
-			message: "Email OTP enrollment requires a canonical wallet"
-		};
+		if (!await this.emailOtpEnrollments.signerWalletExists(input.walletId)) return failure("wallet_registration_incomplete", "Email OTP enrollment requires a canonical wallet");
 		if (await this.emailOtpEnrollments.readEnrollment(input.walletId)) return {
 			ok: false,
 			code: "enrollment_conflict",
@@ -164,11 +145,7 @@ var CloudflareD1EmailOtpRegistrationEnrollmentFinalizer = class {
 		const walletId = normalizeOptionalTrimmedString(input.walletId) || "";
 		const authSubjectId = normalizeOptionalTrimmedString(input.authSubjectId) || "";
 		const verifiedEmail = normalizeOptionalTrimmedString(input.verifiedEmail)?.toLowerCase() || "";
-		if (!orgId || !walletId || !authSubjectId || !verifiedEmail) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Email OTP registration enrollment requires wallet, org, and email identity"
-		};
+		if (!orgId || !walletId || !authSubjectId || !verifiedEmail) return failure("invalid_body", "Email OTP registration enrollment requires wallet, org, and email identity");
 		const existing = await this.emailOtpEnrollments.readEnrollment(walletId);
 		const existingAuthState = await this.emailOtpEnrollments.readAuthState(walletId);
 		return {

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpServerSealRuntime.js

@@ -1,5 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { createSigningSessionSealShamir3PassCipherAdapter } from "../../../../threshold/session/signingSessionSeal/crypto/cipher.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpServerSealRuntime.ts
 const applyEmailOtpServerSealOperation = {
@@ -26,11 +27,7 @@ var CloudflareD1EmailOtpServerSealRuntime = class {
 	async runServerSealOperation(input, operation) {
 		try {
 			const wrappedCiphertext = normalizeOptionalTrimmedString(input.wrappedCiphertext);
-			if (!wrappedCiphertext) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Missing wrappedCiphertext"
-			};
+			if (!wrappedCiphertext) return failure("invalid_body", "Missing wrappedCiphertext");
 			const shamir = this.cipherResult;
 			if (!shamir.ok) return shamir;
 			const result = await shamir.cipher.run({
@@ -47,19 +44,11 @@ var CloudflareD1EmailOtpServerSealRuntime = class {
 				enrollmentSealKeyVersion: result.keyVersion || shamir.keyVersion
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: serverSealErrorMessage(error) || operation.failureMessage
-			};
+			return failure("internal", serverSealErrorMessage(error) || operation.failureMessage);
 		}
 	}
 	createCipher() {
-		if (!this.config.configured) return {
-			ok: false,
-			code: "not_configured",
-			message: this.config.message
-		};
+		if (!this.config.configured) return failure("not_configured", this.config.message);
 		try {
 			return {
 				ok: true,
@@ -67,11 +56,7 @@ var CloudflareD1EmailOtpServerSealRuntime = class {
 				cipher: createSigningSessionSealShamir3PassCipherAdapter({ config: this.config.rootConfig })
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "not_configured",
-				message: serverSealErrorMessage(error) || "Email OTP Shamir configuration is invalid"
-			};
+			return failure("not_configured", serverSealErrorMessage(error) || "Email OTP Shamir configuration is invalid");
 		}
 	}
 };

package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.js

@@ -2,7 +2,9 @@ import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/
 import "../../../../shared-ts/src/utils/validation.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { d1MutationChanges } from "../auth/d1RouterApiAuthBoundary.js";
-import { abandonedGoogleEmailOtpRegistrationAttemptRecord, googleEmailOtpRegistrationOfferWalletIdsJson, parseGoogleEmailOtpRegistrationAttemptRow, pendingGoogleEmailOtpRegistrationAttemptWithUpdatedAt, registrationAttemptMatchesReplacementScope, registrationAttemptMatchesStartedScope, runtimePolicyScopeKey } from "./d1GoogleEmailOtpRegistrationRecords.js";
+import { registrationAttemptMatchesReplacementScope, registrationAttemptMatchesStartedScope } from "../../../../core/EmailOtpRecords.js";
+import { emailOtpRegistrationAttemptRows } from "../../../../core/emailOtpD1Statements.js";
+import { abandonedGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationAttemptRow, pendingGoogleEmailOtpRegistrationAttemptWithUpdatedAt } from "./d1GoogleEmailOtpRegistrationRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.ts
 var CloudflareD1GoogleEmailOtpRegistrationAttemptStore = class {
 	constructor(input) {
@@ -10,12 +12,7 @@ var CloudflareD1GoogleEmailOtpRegistrationAttemptStore = class {
 		this.orgId = input.orgId;
 	}
 	async cleanupExpired(nowMs) {
-		return d1MutationChanges(await this.prepare(`DELETE FROM email_otp_registration_attempts
-          WHERE namespace = ?
-            AND org_id = ?
-            AND project_id = ?
-            AND env_id = ?
-            AND (expires_at_ms <= ? OR state = 'expired')`, [nowMs]).run());
+		return d1MutationChanges(await emailOtpRegistrationAttemptRows.deleteExpired(this.prepare, nowMs).run());
 	}
 	async create(input) {
 		const nowMs = Date.now();
@@ -46,61 +43,24 @@ var CloudflareD1GoogleEmailOtpRegistrationAttemptStore = class {
 	async findStarted(input) {
 		const nowMs = Date.now();
 		await this.cleanupExpired(nowMs);
-		const row = await this.prepare(`SELECT record_json, expires_at_ms, updated_at_ms, attempt_id
-         FROM email_otp_registration_attempts
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND provider_subject = ?
-          AND email = ?
-          AND state IN ('started', 'key_finalized')
-          AND expires_at_ms > ?
-          AND owner_proof_binding_digest = ?
-          AND runtime_org_id = ?
-          AND runtime_policy_key = ?
-        ORDER BY updated_at_ms DESC
-        LIMIT 1`, [
-			input.providerSubject,
-			input.email,
-			nowMs,
-			input.ownerProofBindingDigest,
-			input.orgId,
-			runtimePolicyScopeKey(input.runtimePolicyScope)
-		]).first();
+		const scope = {
+			...input,
+			nowMs
+		};
+		const row = await emailOtpRegistrationAttemptRows.selectStarted(this.prepare, scope).first();
 		const parsed = parseGoogleEmailOtpRegistrationAttemptRow(row);
 		if (!parsed) {
 			const malformedAttemptId = normalizeOptionalTrimmedString(row?.attempt_id);
 			if (malformedAttemptId) await this.delete(malformedAttemptId);
 			return null;
 		}
-		if (!registrationAttemptMatchesStartedScope(parsed, {
-			providerSubject: input.providerSubject,
-			email: input.email,
-			orgId: input.orgId,
-			ownerProofBindingDigest: input.ownerProofBindingDigest,
-			runtimePolicyScope: input.runtimePolicyScope,
-			nowMs
-		})) return null;
+		if (!registrationAttemptMatchesStartedScope(parsed, scope)) return null;
 		const refreshed = pendingGoogleEmailOtpRegistrationAttemptWithUpdatedAt(parsed, nowMs);
 		await this.put(refreshed);
 		return refreshed;
 	}
 	async abandonStartedExceptBinding(input) {
-		const result = await this.prepare(`SELECT record_json, expires_at_ms, updated_at_ms, attempt_id
-         FROM email_otp_registration_attempts
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND provider_subject = ?
-          AND email = ?
-          AND state IN ('started', 'key_finalized')
-          AND expires_at_ms > ?`, [
-			input.providerSubject,
-			input.email,
-			input.nowMs
-		]).all();
+		const result = await emailOtpRegistrationAttemptRows.selectPending(this.prepare, input).all();
 		for (const row of result.results || []) {
 			const parsed = parseGoogleEmailOtpRegistrationAttemptRow(row);
 			if (!parsed) {
@@ -117,98 +77,19 @@ var CloudflareD1GoogleEmailOtpRegistrationAttemptStore = class {
 		}
 	}
 	async hasLiveStartedWalletAttempt(input) {
-		const row = await this.prepare(`SELECT 1 AS found
-         FROM email_otp_registration_attempts
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND state IN ('started', 'key_finalized')
-          AND expires_at_ms > ?
-          AND (
-            wallet_id = ?
-            OR EXISTS (
-              SELECT 1
-                FROM json_each(offer_wallet_ids_json)
-               WHERE value = ?
-            )
-          )
-        LIMIT 1`, [
-			input.nowMs,
-			input.walletId,
-			input.walletId
-		]).first();
+		const row = await emailOtpRegistrationAttemptRows.selectLiveForWallet(this.prepare, input.walletId, input.nowMs).first();
 		return Boolean(row);
 	}
 	async read(attemptId) {
-		const record = parseGoogleEmailOtpRegistrationAttemptRow(await this.prepare(`SELECT record_json, expires_at_ms, updated_at_ms, attempt_id
-         FROM email_otp_registration_attempts
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND attempt_id = ?
-        LIMIT 1`, [attemptId]).first());
+		const record = parseGoogleEmailOtpRegistrationAttemptRow(await emailOtpRegistrationAttemptRows.select(this.prepare, attemptId).first());
 		return record?.runtimePolicyScope?.orgId === this.orgId ? record : null;
 	}
 	async put(record) {
 		if (record.runtimePolicyScope?.orgId !== this.orgId) throw new Error("Google Email OTP registration attempt org scope mismatch");
-		await this.prepare(`INSERT INTO email_otp_registration_attempts (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        attempt_id,
-        provider_subject,
-        email,
-        wallet_id,
-        state,
-        owner_proof_binding_digest,
-        runtime_org_id,
-        runtime_policy_key,
-        offer_wallet_ids_json,
-        record_json,
-        created_at_ms,
-        updated_at_ms,
-        expires_at_ms
-      )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT (namespace, org_id, project_id, env_id, attempt_id)
-      DO UPDATE SET
-        provider_subject = EXCLUDED.provider_subject,
-        email = EXCLUDED.email,
-        wallet_id = EXCLUDED.wallet_id,
-        state = EXCLUDED.state,
-        owner_proof_binding_digest = EXCLUDED.owner_proof_binding_digest,
-        runtime_org_id = EXCLUDED.runtime_org_id,
-        runtime_policy_key = EXCLUDED.runtime_policy_key,
-        offer_wallet_ids_json = EXCLUDED.offer_wallet_ids_json,
-        record_json = EXCLUDED.record_json,
-        created_at_ms = EXCLUDED.created_at_ms,
-        updated_at_ms = EXCLUDED.updated_at_ms,
-        expires_at_ms = EXCLUDED.expires_at_ms`, [
-			record.attemptId,
-			record.providerSubject,
-			record.email,
-			record.walletId,
-			record.state,
-			record.ownerProofBindingDigest,
-			record.runtimePolicyScope?.orgId || "",
-			runtimePolicyScopeKey(record.runtimePolicyScope),
-			googleEmailOtpRegistrationOfferWalletIdsJson(record.offerCandidates),
-			JSON.stringify(record),
-			record.createdAtMs,
-			record.updatedAtMs,
-			record.expiresAtMs
-		]).run();
+		await emailOtpRegistrationAttemptRows.upsert(this.prepare, record).run();
 	}
 	async delete(attemptId) {
-		await this.prepare(`DELETE FROM email_otp_registration_attempts
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND attempt_id = ?`, [attemptId]).run();
+		await emailOtpRegistrationAttemptRows.delete(this.prepare, attemptId).run();
 	}
 };
 //#endregion