@seams/wallet-server 0.7.1 → 0.8.0

package/dist/esm/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoCapabilityPersistence.js

@@ -13,6 +13,7 @@ const CAPABILITY_REPLACEMENT_SCHEMA_SQL = `
     org_id TEXT NOT NULL,
     project_id TEXT NOT NULL,
     env_id TEXT NOT NULL,
+    wallet_id TEXT NOT NULL CHECK (length(wallet_id) > 0),
     operation_id TEXT NOT NULL,
     operation_fingerprint TEXT NOT NULL,
     previous_capability_binding_json TEXT NOT NULL,
@@ -76,6 +77,10 @@ var CloudflareD1RouterAbEd25519YaoCapabilityPersistence = class {
 	async prepareActiveCapabilityReplacement(input) {
 		const operation = validateReplacementOperation(input.operation);
 		if (!operation.ok) return operation.failure;
+		const application = activeCapabilityApplication(input.next);
+		const walletId = parseWalletId(application.wallet_id);
+		if (!walletId.ok) return persistenceFailure("invalid_wallet", "promoted Yao capability wallet ID is invalid");
+		if (activeCapabilityApplication(input.previous).wallet_id !== walletId.value) return persistenceFailure("identity_mismatch", "capability replacement crosses wallet ownership");
 		await this.ensureSchema();
 		const receiptMatch = matchReceipt(await this.readReceipt(operation.value.operationId), operation.value, input);
 		if (receiptMatch === "match") return {
@@ -83,9 +88,6 @@ var CloudflareD1RouterAbEd25519YaoCapabilityPersistence = class {
 			disposition: "exact_retry"
 		};
 		if (receiptMatch === "conflict") return persistenceFailure("operation_conflict", "capability replacement operation belongs to a different activation");
-		const application = activeCapabilityApplication(input.next);
-		const walletId = parseWalletId(application.wallet_id);
-		if (!walletId.ok) return persistenceFailure("invalid_wallet", "promoted Yao capability wallet ID is invalid");
 		const signer = await this.walletStore.getEd25519SignerBySlot({
 			walletId: walletId.value,
 			signerSlot: application.key_creation_signer_slot
@@ -127,13 +129,14 @@ var CloudflareD1RouterAbEd25519YaoCapabilityPersistence = class {
             org_id,
             project_id,
             env_id,
+            wallet_id,
             operation_id,
             operation_fingerprint,
             previous_capability_binding_json,
             next_capability_binding_json,
             created_at_ms
           )
-          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, operation.value.operationId, operation.value.operationFingerprint, previousBindingJson, nextBindingJson, now));
+          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, walletId.value, operation.value.operationId, operation.value.operationFingerprint, previousBindingJson, nextBindingJson, now));
 		for (const authorityReplacement of authorityReplacements) {
 			statements.push(this.prepareAuthorityReplacementStatement(authorityReplacement));
 			statements.push(this.database.prepare(D1_BATCH_CAS_GUARD_SQL));
@@ -243,7 +246,7 @@ var CloudflareD1RouterAbEd25519YaoCapabilityPersistence = class {
             AND retired_at_ms IS NULL`).bind(String(next.authorityDigestB64u), JSON.stringify(next.capabilitySubjects), JSON.stringify(next), this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, String(next.authorizationId), String(next.authorityId), String(input.previous.authorityDigestB64u), input.previous.authorityRevocationEpoch);
 	}
 	async readReceipt(operationId) {
-		return await this.database.prepare(`SELECT operation_fingerprint,
+		return await this.database.prepare(`SELECT wallet_id, operation_fingerprint,
                 previous_capability_binding_json,
                 next_capability_binding_json
            FROM ${ROUTER_AB_ED25519_YAO_CAPABILITY_REPLACEMENT_TABLE_V1}
@@ -274,7 +277,7 @@ function validateReplacementOperation(operation) {
 }
 function matchReceipt(receipt, operation, input) {
 	if (!receipt) return "missing";
-	return receipt.operation_fingerprint === operation.operationFingerprint && receipt.previous_capability_binding_json === JSON.stringify(input.previous.activeCapabilityBinding) && receipt.next_capability_binding_json === JSON.stringify(input.next.activeCapabilityBinding) ? "match" : "conflict";
+	return receipt.wallet_id === activeCapabilityApplication(input.next).wallet_id && receipt.operation_fingerprint === operation.operationFingerprint && receipt.previous_capability_binding_json === JSON.stringify(input.previous.activeCapabilityBinding) && receipt.next_capability_binding_json === JSON.stringify(input.next.activeCapabilityBinding) ? "match" : "conflict";
 }
 //#endregion
 export { CloudflareD1RouterAbEd25519YaoCapabilityPersistence, ROUTER_AB_ED25519_YAO_CAPABILITY_REPLACEMENT_TABLE_V1 };

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeIssuer.js

@@ -1,6 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { emailOtpChallengePurposeIsValid, emailOtpChallengeRecord, generateNumericOtp } from "./d1EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeIssuer.ts
@@ -8,18 +8,10 @@ function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error || "");
 }
 function emailOtpEnrollmentTenantMismatch() {
-	return {
-		ok: false,
-		code: "tenant_scope_mismatch",
-		message: "Email OTP enrollment does not match the requested orgId"
-	};
+	return failure("tenant_scope_mismatch", "Email OTP enrollment does not match the requested orgId");
 }
 function emailOtpProviderIdentityMismatch() {
-	return {
-		ok: false,
-		code: "provider_identity_mismatch",
-		message: "Email OTP enrollment does not match the requested provider user"
-	};
+	return failure("provider_identity_mismatch", "Email OTP enrollment does not match the requested provider user");
 }
 var CloudflareD1EmailOtpChallengeIssuer = class {
 	constructor(input) {
@@ -40,39 +32,15 @@ var CloudflareD1EmailOtpChallengeIssuer = class {
 			const clientIp = normalizeOptionalTrimmedString(input.clientIp);
 			const action = input.action;
 			const operation = input.operation;
-			if (!userId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Missing userId"
-			};
-			if (!walletId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Missing walletId"
-			};
-			if (!orgId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Missing orgId"
-			};
-			if (otpChannel !== "email_otp") return {
-				ok: false,
-				code: "invalid_body",
-				message: "otpChannel must be email_otp"
-			};
-			if (!ownerProofBindingDigest) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Missing ownerProofBindingDigest"
-			};
+			if (!userId) return failure("invalid_body", "Missing userId");
+			if (!walletId) return failure("invalid_body", "Missing walletId");
+			if (!orgId) return failure("invalid_body", "Missing orgId");
+			if (otpChannel !== "email_otp") return failure("invalid_body", "otpChannel must be email_otp");
+			if (!ownerProofBindingDigest) return failure("invalid_body", "Missing ownerProofBindingDigest");
 			if (!emailOtpChallengePurposeIsValid({
 				action,
 				operation
-			})) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Email OTP challenge action does not match operation"
-			};
+			})) return failure("invalid_body", "Email OTP challenge action does not match operation");
 			let challengeEmail = email;
 			if (action !== WALLET_EMAIL_OTP_ACTIONS.registration && action !== WALLET_EMAIL_OTP_ACTIONS.recoveryBootstrap) {
 				const enrollment = await this.readActiveEnrollment({
@@ -91,11 +59,7 @@ var CloudflareD1EmailOtpChallengeIssuer = class {
 				};
 				challengeEmail = enrollment.enrollment.verifiedEmail;
 			}
-			if (!challengeEmail) return {
-				ok: false,
-				code: "recovery_email_missing",
-				message: "Authenticated identity does not include a recovery email"
-			};
+			if (!challengeEmail) return failure("recovery_email_missing", "Authenticated identity does not include a recovery email");
 			const nowMs = Date.now();
 			await this.emailOtpChallenges.pruneExpired(nowMs);
 			if (input.reuseActiveChallenge === true) {
@@ -188,20 +152,12 @@ var CloudflareD1EmailOtpChallengeIssuer = class {
 				delivery: delivery.delivery
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: errorMessage(error) || "Failed to create Email OTP challenge"
-			};
+			return failure("internal", errorMessage(error) || "Failed to create Email OTP challenge");
 		}
 	}
 	async readActiveEnrollment(input) {
 		const enrollment = await this.emailOtpEnrollments.readEnrollment(input.walletId);
-		if (!enrollment) return {
-			ok: false,
-			code: "not_found",
-			message: "Email OTP enrollment not found"
-		};
+		if (!enrollment) return failure("not_found", "Email OTP enrollment not found");
 		if (enrollment.orgId !== input.orgId) return emailOtpEnrollmentTenantMismatch();
 		if (enrollment.providerUserId !== input.providerUserId) return emailOtpProviderIdentityMismatch();
 		return {

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeService.js

@@ -1,6 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { emailOtpGrantRecord, maskEmail, parseEmailOtpLoginOperation } from "./d1EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeService.ts
@@ -89,26 +89,10 @@ var CloudflareD1EmailOtpChallengeService = class {
 			const orgId = normalizeOptionalTrimmedString(input.orgId);
 			const challengeId = normalizeOptionalTrimmedString(input.challengeId);
 			const registrationAttemptId = normalizeOptionalTrimmedString(input.googleEmailOtpRegistrationAttemptId);
-			if (!providerSubject) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Email OTP registration requires providerSubject"
-			};
-			if (!walletId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Email OTP registration requires walletId"
-			};
-			if (!orgId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Email OTP registration requires orgId"
-			};
-			if (!challengeId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Email OTP registration requires challengeId"
-			};
+			if (!providerSubject) return failure("invalid_body", "Email OTP registration requires providerSubject");
+			if (!walletId) return failure("invalid_body", "Email OTP registration requires walletId");
+			if (!orgId) return failure("invalid_body", "Email OTP registration requires orgId");
+			if (!challengeId) return failure("invalid_body", "Email OTP registration requires challengeId");
 			const proofEmail = await this.resolveRegistrationProofEmail({
 				explicitProofEmail: input.proofEmail,
 				providerSubject,
@@ -129,11 +113,7 @@ var CloudflareD1EmailOtpChallengeService = class {
 			});
 			if (!verified.ok) return verified;
 			const verifiedEmail = normalizeOptionalTrimmedString(verified.email)?.toLowerCase() || "";
-			if (!verifiedEmail) return {
-				ok: false,
-				code: "internal",
-				message: "Email OTP enrollment verification did not include a verified email"
-			};
+			if (!verifiedEmail) return failure("internal", "Email OTP enrollment verification did not include a verified email");
 			const persisted = await this.finalizer.persistVerifiedEnrollment({
 				walletId: verified.walletId,
 				orgId: verified.orgId,
@@ -151,11 +131,7 @@ var CloudflareD1EmailOtpChallengeService = class {
 				enrollment: persisted.enrollment
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: errorMessage(error) || "Failed to verify Email OTP enrollment"
-			};
+			return failure("internal", errorMessage(error) || "Failed to verify Email OTP enrollment");
 		}
 	}
 	async verifyEmailOtpChallenge(input) {
@@ -232,41 +208,21 @@ var CloudflareD1EmailOtpChallengeService = class {
 		};
 	}
 	async readEmailOtpOutboxEntry(input) {
-		if (!this.devOutboxEnabled) return {
-			ok: false,
-			code: "not_found",
-			message: "Email OTP dev outbox is not enabled"
-		};
+		if (!this.devOutboxEnabled) return failure("not_found", "Email OTP dev outbox is not enabled");
 		const challengeId = normalizeOptionalTrimmedString(input.challengeId);
 		const userId = normalizeOptionalTrimmedString(input.userId);
 		const walletId = normalizeOptionalTrimmedString(input.walletId);
-		if (!userId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing userId"
-		};
-		if (!walletId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing walletId"
-		};
+		if (!userId) return failure("invalid_body", "Missing userId");
+		if (!walletId) return failure("invalid_body", "Missing walletId");
 		const record = challengeId ? await this.challenges.read(challengeId) : await this.challenges.readLatestActiveForSubjectWallet({
 			challengeSubjectId: userId,
 			walletId,
 			nowMs: Date.now()
 		});
-		if (!record || record.challengeSubjectId !== userId || record.walletId !== walletId) return {
-			ok: false,
-			code: "not_found",
-			message: "Email OTP outbox entry was not found"
-		};
+		if (!record || record.challengeSubjectId !== userId || record.walletId !== walletId) return failure("not_found", "Email OTP outbox entry was not found");
 		if (Date.now() > record.expiresAtMs) {
 			await this.challenges.delete(challengeId);
-			return {
-				ok: false,
-				code: "not_found",
-				message: "Email OTP outbox entry expired"
-			};
+			return failure("not_found", "Email OTP outbox entry expired");
 		}
 		return {
 			ok: true,
@@ -286,33 +242,13 @@ var CloudflareD1EmailOtpChallengeService = class {
 				ok: true,
 				email: proofEmail
 			};
-			return {
-				ok: false,
-				code: "invalid_body",
-				message: "Email OTP registration requires proofEmail"
-			};
+			return failure("invalid_body", "Email OTP registration requires proofEmail");
 		}
 		const attempt = await this.registrationAttempts.read(input.registrationAttemptId);
-		if (!attempt) return {
-			ok: false,
-			code: "registration_attempt_missing",
-			message: "Google Email OTP registration attempt expired or was not found"
-		};
-		if (attempt.providerSubject !== input.providerSubject) return {
-			ok: false,
-			code: "challenge_subject_mismatch",
-			message: "Email OTP registration attempt does not match the provider subject"
-		};
-		if (attempt.expiresAtMs <= Date.now()) return {
-			ok: false,
-			code: "registration_attempt_expired",
-			message: "Google Email OTP registration attempt expired"
-		};
-		if (attempt.walletId !== input.walletId) return {
-			ok: false,
-			code: "wallet_identity_mismatch",
-			message: "registrationAttemptId does not match walletId"
-		};
+		if (!attempt) return failure("registration_attempt_missing", "Google Email OTP registration attempt expired or was not found");
+		if (attempt.providerSubject !== input.providerSubject) return failure("challenge_subject_mismatch", "Email OTP registration attempt does not match the provider subject");
+		if (attempt.expiresAtMs <= Date.now()) return failure("registration_attempt_expired", "Google Email OTP registration attempt expired");
+		if (attempt.walletId !== input.walletId) return failure("wallet_identity_mismatch", "registrationAttemptId does not match walletId");
 		proofEmail = attempt.email.toLowerCase();
 		return {
 			ok: true,

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeStore.js

@@ -1,7 +1,7 @@
 import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
 import { parseD1NonNegativeCount } from "../auth/d1RouterApiAuthBoundary.js";
-import { emailOtpChallengeRows, emailOtpUnlockChallengeRows } from "../../../../core/emailOtpD1Statements.js";
 import { emailOtpChallengeContextValues, emailOtpChallengeWithAttemptCount, parseEmailOtpChallengeRow, parseEmailOtpRegistrationVerificationReceiptV1, parseEmailOtpUnlockChallengeRow } from "./d1EmailOtpRecords.js";
+import { emailOtpChallengeRows, emailOtpUnlockChallengeRows } from "../../../../core/emailOtpD1Statements.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeStore.ts
 const REGISTRATION_VERIFICATION_RECEIPT_SCOPE = "email-otp-registration-verification-v1";
 const REGISTRATION_CEREMONY_CAS_GUARD_SQL = `INSERT INTO registration_ceremony_cas_guard (guard_id)

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeVerifier.js

@@ -2,7 +2,6 @@ import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import "../../../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_REGISTRATION_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { emailOtpChallengeBindingMismatchCode, emailOtpChallengeInvalidOrExpired, emailOtpRegistrationChallengeBindingMismatchCode } from "./d1EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeVerifier.ts

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpDeliveryRuntime.js

@@ -1,3 +1,4 @@
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { EMAIL_OTP_CHANNEL } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { maskEmail } from "./d1EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpDeliveryRuntime.ts
@@ -24,11 +25,7 @@ var CloudflareD1EmailOtpDeliveryRuntime = class {
 		return this.resolveDelivery(record, requestOrigin, "reused");
 	}
 	async deliverEmailOtpCode(record, requestOrigin) {
-		if (this.config.production && this.config.deliveryMode !== "email_provider" && this.config.deliveryMode !== "provider_and_demo_code" && this.config.deliveryMode !== "demo_code_response") return {
-			ok: false,
-			code: "email_otp_delivery_not_allowed",
-			message: `Email OTP delivery mode ${this.config.deliveryMode} is disabled in production`
-		};
+		if (this.config.production && this.config.deliveryMode !== "email_provider" && this.config.deliveryMode !== "provider_and_demo_code" && this.config.deliveryMode !== "demo_code_response") return failure("email_otp_delivery_not_allowed", `Email OTP delivery mode ${this.config.deliveryMode} is disabled in production`);
 		const emailHint = maskEmail(record.email);
 		switch (this.config.deliveryMode) {
 			case "provider_and_demo_code": {
@@ -58,11 +55,7 @@ var CloudflareD1EmailOtpDeliveryRuntime = class {
 	}
 	async dispatchProviderEmail(record, emailHint) {
 		const provider = this.config.deliveryProvider;
-		if (!provider) return {
-			ok: false,
-			code: "email_otp_delivery_not_configured",
-			message: "Email OTP email_provider delivery is not configured"
-		};
+		if (!provider) return failure("email_otp_delivery_not_configured", "Email OTP email_provider delivery is not configured");
 		const result = await provider.deliver({
 			challengeId: record.challengeId,
 			walletId: record.walletId,
@@ -86,11 +79,7 @@ var CloudflareD1EmailOtpDeliveryRuntime = class {
 		const emailHint = maskEmail(record.email);
 		switch (this.config.deliveryMode) {
 			case "email_provider":
-				if (!this.config.deliveryProvider) return {
-					ok: false,
-					code: "email_otp_delivery_not_configured",
-					message: "Email OTP email_provider delivery is not configured"
-				};
+				if (!this.config.deliveryProvider) return failure("email_otp_delivery_not_configured", "Email OTP email_provider delivery is not configured");
 				return {
 					ok: true,
 					delivery: {
@@ -101,11 +90,7 @@ var CloudflareD1EmailOtpDeliveryRuntime = class {
 					}
 				};
 			case "provider_and_demo_code":
-				if (!this.config.deliveryProvider) return {
-					ok: false,
-					code: "email_otp_delivery_not_configured",
-					message: "Email OTP email_provider delivery is not configured"
-				};
+				if (!this.config.deliveryProvider) return failure("email_otp_delivery_not_configured", "Email OTP email_provider delivery is not configured");
 				return this.resolveDemoCodeDelivery(record, requestOrigin, status, emailHint);
 			case "log":
 			case "dev_d1_outbox":
@@ -124,11 +109,7 @@ var CloudflareD1EmailOtpDeliveryRuntime = class {
 	}
 	resolveDemoCodeDelivery(record, requestOrigin, status, emailHint) {
 		const origin = typeof requestOrigin === "string" ? requestOrigin.trim() : "";
-		if (!this.config.demoAllowedOrigins.includes(origin)) return {
-			ok: false,
-			code: "email_otp_demo_origin_not_allowed",
-			message: "Email OTP demo code delivery is not allowed for this origin"
-		};
+		if (!this.config.demoAllowedOrigins.includes(origin)) return failure("email_otp_demo_origin_not_allowed", "Email OTP demo code delivery is not allowed for this origin");
 		if (this.config.deliveryMode === "provider_and_demo_code") return {
 			ok: true,
 			delivery: {

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpEnrollmentStore.js

@@ -1,5 +1,5 @@
-import { emailOtpAuthStateRows, emailOtpWalletEnrollmentRows } from "../../../../core/emailOtpD1Statements.js";
 import { emailOtpAuthStateRecord, parseEmailOtpAuthStateRow, parseEmailOtpWalletEnrollmentRow } from "./d1EmailOtpRecords.js";
+import { emailOtpAuthStateRows, emailOtpWalletEnrollmentRows } from "../../../../core/emailOtpD1Statements.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpEnrollmentStore.ts
 var CloudflareD1EmailOtpEnrollmentStore = class {
 	constructor(input) {

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpGrantStore.js

@@ -1,5 +1,5 @@
-import { emailOtpGrantRows } from "../../../../core/emailOtpD1Statements.js";
 import { parseEmailOtpGrantRow } from "./d1EmailOtpRecords.js";
+import { emailOtpGrantRows } from "../../../../core/emailOtpD1Statements.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpGrantStore.ts
 var CloudflareD1EmailOtpGrantStore = class {
 	constructor(input) {
@@ -11,12 +11,6 @@ var CloudflareD1EmailOtpGrantStore = class {
 	async consume(grantToken) {
 		return parseEmailOtpGrantRow(await emailOtpGrantRows.consume(this.prepare, grantToken).first());
 	}
-	async read(grantToken) {
-		return parseEmailOtpGrantRow(await emailOtpGrantRows.select(this.prepare, grantToken).first());
-	}
-	async delete(grantToken) {
-		await emailOtpGrantRows.delete(this.prepare, grantToken).run();
-	}
 };
 //#endregion
 export { CloudflareD1EmailOtpGrantStore };

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRateLimitStore.js

@@ -2,8 +2,8 @@ import { emailOtpRateLimitExceeded, emailOtpRateLimitKeys } from "./d1EmailOtpRe
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpRateLimitStore.ts
 var CloudflareD1EmailOtpRateLimitStore = class {
 	constructor(input) {
-		this.prepare = input.prepare;
 		this.rateLimits = input.rateLimits;
+		this.counter = input.counter ?? new D1EmailOtpRateLimitCounter(input.prepare);
 	}
 	async consume(input) {
 		const policy = this.rateLimits[input.scope];
@@ -12,17 +12,23 @@ var CloudflareD1EmailOtpRateLimitStore = class {
 			policy
 		});
 		for (const key of keys) {
-			const consumed = await this.consumeKey({
+			const consumed = await this.counter.consume({
 				key,
-				policy,
-				nowMs: Date.now()
+				limit: policy.limit,
+				windowMs: policy.windowMs
 			});
 			if (!consumed.ok) return consumed;
 		}
 		return { ok: true };
 	}
-	async consumeKey(input) {
-		const resetAtMs = input.nowMs + input.policy.windowMs;
+};
+var D1EmailOtpRateLimitCounter = class {
+	constructor(prepare) {
+		this.prepare = prepare;
+	}
+	async consume(input) {
+		const nowMs = Date.now();
+		const resetAtMs = nowMs + input.windowMs;
 		if (await this.prepare(`INSERT INTO email_otp_rate_limits (
         namespace,
         org_id,
@@ -52,13 +58,13 @@ var CloudflareD1EmailOtpRateLimitStore = class {
       RETURNING consumed_count, reset_at_ms`, [
 			input.key,
 			resetAtMs,
-			input.nowMs,
-			input.nowMs,
-			input.nowMs,
+			nowMs,
+			nowMs,
+			nowMs,
 			resetAtMs,
-			input.nowMs,
-			input.nowMs,
-			input.policy.limit
+			nowMs,
+			nowMs,
+			input.limit
 		]).first()) return { ok: true };
 		return emailOtpRateLimitExceeded(await this.prepare(`SELECT consumed_count, reset_at_ms
          FROM email_otp_rate_limits
@@ -71,6 +77,6 @@ var CloudflareD1EmailOtpRateLimitStore = class {
 	}
 };
 //#endregion
-export { CloudflareD1EmailOtpRateLimitStore };
+export { CloudflareD1EmailOtpRateLimitStore, D1EmailOtpRateLimitCounter };
 
 //# sourceMappingURL=d1EmailOtpRateLimitStore.js.map

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.js

@@ -1,7 +1,8 @@
 import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
 import "../../../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
+import { hasExactKeys } from "../../../../shared-ts/src/utils/exactKeys.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION, isWalletEmailOtpLoginOperation } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { isB64uString, nonNegativeSafeInteger, parseJsonObject, positiveSafeInteger } from "../auth/d1RouterApiAuthBoundary.js";
 import { parseCurrentEmailOtpChallengeRow, parseCurrentEmailOtpGrantRow, parseCurrentEmailOtpUnlockChallengeRow } from "../../../../core/EmailOtpRecords.js";
@@ -165,7 +166,7 @@ function parseEmailOtpChallengeRow(row) {
 }
 function parseEmailOtpRegistrationVerificationReceiptV1(input) {
 	const record = parseJsonObject(input);
-	if (!record || !hasExactRecordFields(record, [
+	if (!record || !hasExactKeys(record, [
 		"version",
 		"requestFingerprint",
 		"verified",
@@ -176,7 +177,7 @@ function parseEmailOtpRegistrationVerificationReceiptV1(input) {
 	const verified = parseJsonObject(record.verified);
 	const verifiedAtMs = positiveSafeInteger(record.verifiedAtMs);
 	const expiresAtMs = positiveSafeInteger(record.expiresAtMs);
-	if (!requestFingerprint || !isB64uString(requestFingerprint) || !verified || !hasExactRecordFields(verified, [
+	if (!requestFingerprint || !isB64uString(requestFingerprint) || !verified || !hasExactKeys(verified, [
 		"challengeId",
 		"challengeSubjectId",
 		"walletId",
@@ -284,11 +285,7 @@ function emailOtpRegistrationChallengeBindingMismatchCode(input) {
 	return null;
 }
 function emailOtpChallengeInvalidOrExpired() {
-	return {
-		ok: false,
-		code: "challenge_expired_or_invalid",
-		message: "Email OTP challenge expired or invalid"
-	};
+	return failure("challenge_expired_or_invalid", "Email OTP challenge expired or invalid");
 }
 function emailOtpGrantRecord(input) {
 	return {
@@ -330,49 +327,21 @@ async function validateEmailOtpEnrollmentMaterial(input) {
 	const clientUnlockPublicKeyB64u = normalizeOptionalTrimmedString(input.material.clientUnlockPublicKeyB64u);
 	const unlockKeyVersion = normalizeOptionalTrimmedString(input.material.unlockKeyVersion);
 	const serverSealedFactorCiphertextB64u = normalizeOptionalTrimmedString(input.material.serverSealedFactorCiphertextB64u);
-	if (!enrollmentSealKeyVersion) return {
-		ok: false,
-		code: "invalid_body",
-		message: "enrollmentSealKeyVersion is required"
-	};
-	if (!clientUnlockPublicKeyB64u) return {
-		ok: false,
-		code: "invalid_body",
-		message: "clientUnlockPublicKeyB64u is required"
-	};
-	if (!unlockKeyVersion) return {
-		ok: false,
-		code: "invalid_body",
-		message: "unlockKeyVersion is required"
-	};
-	if (!serverSealedFactorCiphertextB64u) return {
-		ok: false,
-		code: "invalid_body",
-		message: "serverSealedFactorCiphertextB64u is required"
-	};
+	if (!enrollmentSealKeyVersion) return failure("invalid_body", "enrollmentSealKeyVersion is required");
+	if (!clientUnlockPublicKeyB64u) return failure("invalid_body", "clientUnlockPublicKeyB64u is required");
+	if (!unlockKeyVersion) return failure("invalid_body", "unlockKeyVersion is required");
+	if (!serverSealedFactorCiphertextB64u) return failure("invalid_body", "serverSealedFactorCiphertextB64u is required");
 	let unlockPublicKeyBytes;
 	try {
 		unlockPublicKeyBytes = base64UrlDecode(clientUnlockPublicKeyB64u);
 	} catch {
-		return {
-			ok: false,
-			code: "invalid_body",
-			message: "clientUnlockPublicKeyB64u must be valid base64url"
-		};
+		return failure("invalid_body", "clientUnlockPublicKeyB64u must be valid base64url");
 	}
-	if (unlockPublicKeyBytes.length !== 33) return {
-		ok: false,
-		code: "invalid_body",
-		message: "clientUnlockPublicKeyB64u must decode to 33 bytes (compressed secp256k1 pubkey)"
-	};
+	if (unlockPublicKeyBytes.length !== 33) return failure("invalid_body", "clientUnlockPublicKeyB64u must decode to 33 bytes (compressed secp256k1 pubkey)");
 	try {
 		await input.validateSecp256k1PublicKey33(unlockPublicKeyBytes);
 	} catch {
-		return {
-			ok: false,
-			code: "invalid_body",
-			message: "clientUnlockPublicKeyB64u is not a valid secp256k1 public key"
-		};
+		return failure("invalid_body", "clientUnlockPublicKeyB64u is not a valid secp256k1 public key");
 	}
 	return {
 		ok: true,
@@ -421,11 +390,6 @@ function optionalNonNegativeSafeIntegerField(record, field) {
 function hasRecordField(record, field) {
 	return Object.prototype.hasOwnProperty.call(record, field);
 }
-function hasExactRecordFields(record, expectedFields) {
-	const actualFields = Object.keys(record).sort();
-	const expected = [...expectedFields].sort();
-	return actualFields.length === expected.length && actualFields.every((field, index) => field === expected[index]);
-}
 function patchedPositiveAuthStateValue(current, patch) {
 	if (patch === null) return void 0;
 	if (patch === void 0) return current;