@seams/wallet-server 0.7.1 → 0.8.0

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecoveryService.js

@@ -1,6 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
+import { failedVerification, failure } from "../../../../shared-ts/src/utils/failure.js";
 import { validateSecp256k1PublicKey33, verifySecp256k1RecoverableSignatureAgainstPublicKey33 } from "../../../../core/ThresholdService/evmCryptoWasm.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { parseD1BoundaryWalletIdResult } from "../auth/d1RouterApiAuthBoundary.js";
@@ -61,32 +61,16 @@ function normalizeEmailOtpStrongAuthInput(input) {
 	};
 }
 function invalidEmailOtpEnrollmentReadBody(message) {
-	return {
-		ok: false,
-		code: "invalid_body",
-		message
-	};
+	return failure("invalid_body", message);
 }
 function invalidActiveEmailOtpEnrollmentReadBody(message) {
-	return {
-		ok: false,
-		code: "invalid_body",
-		message
-	};
+	return failure("invalid_body", message);
 }
 function invalidEmailOtpStrongAuthBody(message) {
-	return {
-		ok: false,
-		code: "invalid_body",
-		message
-	};
+	return failure("invalid_body", message);
 }
 function emailOtpEnrollmentTenantMismatch() {
-	return {
-		ok: false,
-		code: "tenant_scope_mismatch",
-		message: "Email OTP enrollment does not match the requested orgId"
-	};
+	return failure("tenant_scope_mismatch", "Email OTP enrollment does not match the requested orgId");
 }
 var CloudflareD1EmailOtpRecoveryService = class {
 	constructor(input) {
@@ -99,11 +83,7 @@ var CloudflareD1EmailOtpRecoveryService = class {
 		const parsed = normalizeEmailOtpEnrollmentReadInput(input);
 		if (!parsed.ok) return parsed.result;
 		const enrollment = await this.emailOtpEnrollments.readEnrollment(parsed.value.walletId);
-		if (!enrollment) return {
-			ok: false,
-			code: "not_found",
-			message: "Email OTP enrollment not found"
-		};
+		if (!enrollment) return failure("not_found", "Email OTP enrollment not found");
 		if (enrollment.orgId !== parsed.value.orgId) return emailOtpEnrollmentTenantMismatch();
 		return {
 			ok: true,
@@ -118,11 +98,7 @@ var CloudflareD1EmailOtpRecoveryService = class {
 			orgId: parsed.value.orgId
 		});
 		if (!enrollment.ok) return enrollment;
-		if (parsed.value.providerUserId && enrollment.enrollment.providerUserId !== parsed.value.providerUserId) return {
-			ok: false,
-			code: "provider_identity_mismatch",
-			message: "Email OTP enrollment does not match the requested provider user"
-		};
+		if (parsed.value.providerUserId && enrollment.enrollment.providerUserId !== parsed.value.providerUserId) return failure("provider_identity_mismatch", "Email OTP enrollment does not match the requested provider user");
 		return enrollment;
 	}
 	async isEmailOtpStrongAuthRequired(input) {
@@ -198,11 +174,7 @@ var CloudflareD1EmailOtpRecoveryService = class {
 				unlockKeyVersion: enrollment.enrollment.unlockKeyVersion
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: errorMessage(error) || "Failed to create Email OTP unlock challenge"
-			};
+			return failure("internal", errorMessage(error) || "Failed to create Email OTP unlock challenge");
 		}
 	}
 	async verifyEmailOtpUnlockProof(input) {
@@ -210,31 +182,31 @@ var CloudflareD1EmailOtpRecoveryService = class {
 			const parsed = normalizeUnlockProofInput(input);
 			if (!parsed.ok) return parsed.result;
 			const challenge = await this.emailOtpChallenges.consumeUnlock(parsed.value.challengeId);
-			if (!challenge || Date.now() > challenge.expiresAtMs) return emailOtpUnlockProofRejected("challenge_expired_or_invalid", "Email OTP unlock challenge expired or invalid");
-			if (challenge.walletId !== parsed.value.walletId) return emailOtpUnlockProofRejected("challenge_binding_mismatch", "Email OTP unlock challenge is not valid for this walletId");
+			if (!challenge || Date.now() > challenge.expiresAtMs) return failedVerification("challenge_expired_or_invalid", "Email OTP unlock challenge expired or invalid");
+			if (challenge.walletId !== parsed.value.walletId) return failedVerification("challenge_binding_mismatch", "Email OTP unlock challenge is not valid for this walletId");
 			const enrollment = await this.readActiveEmailOtpEnrollment({
 				walletId: parsed.value.walletId,
 				orgId: parsed.value.orgId
 			});
-			if (!enrollment.ok) return emailOtpUnlockProofRejected(enrollment.code, enrollment.message);
-			if (challenge.userId !== enrollment.enrollment.providerUserId || challenge.orgId !== enrollment.enrollment.orgId) return emailOtpUnlockProofRejected("challenge_binding_mismatch", "Email OTP unlock challenge is not valid for this enrollment");
+			if (!enrollment.ok) return failedVerification(enrollment.code, enrollment.message);
+			if (challenge.userId !== enrollment.enrollment.providerUserId || challenge.orgId !== enrollment.enrollment.orgId) return failedVerification("challenge_binding_mismatch", "Email OTP unlock challenge is not valid for this enrollment");
 			const publicKey = decodeFixedBase64Url(parsed.value.publicKeyB64u, 33);
-			if (!publicKey) return emailOtpUnlockProofRejected("invalid_body", "unlockProof.publicKey must decode to 33 bytes");
+			if (!publicKey) return failedVerification("invalid_body", "unlockProof.publicKey must decode to 33 bytes");
 			try {
 				await validateSecp256k1PublicKey33(publicKey);
 			} catch {
-				return emailOtpUnlockProofRejected("invalid_body", "unlockProof.publicKey is not a valid secp256k1 public key");
+				return failedVerification("invalid_body", "unlockProof.publicKey is not a valid secp256k1 public key");
 			}
 			const signature = decodeFixedBase64Url(parsed.value.signatureB64u, 65);
-			if (!signature) return emailOtpUnlockProofRejected("invalid_body", "unlockProof.signature must decode to 65 bytes");
+			if (!signature) return failedVerification("invalid_body", "unlockProof.signature must decode to 65 bytes");
 			const enrolledPublicKey = decodeFixedBase64Url(enrollment.enrollment.clientUnlockPublicKeyB64u, 33);
-			if (!enrolledPublicKey || !bytesEqual(enrolledPublicKey, publicKey)) return emailOtpUnlockProofRejected("invalid_unlock_proof", "unlockProof.publicKey does not match the enrolled clientUnlockPublicKeyB64u");
+			if (!enrolledPublicKey || !bytesEqual(enrolledPublicKey, publicKey)) return failedVerification("invalid_unlock_proof", "unlockProof.publicKey does not match the enrolled clientUnlockPublicKeyB64u");
 			const challengeDigest = decodeFixedBase64Url(challenge.challengeB64u, 32);
-			if (!challengeDigest) return emailOtpUnlockProofRejected("internal", "Stored unlock challenge digest must decode to 32 bytes");
+			if (!challengeDigest) return failedVerification("internal", "Stored unlock challenge digest must decode to 32 bytes");
 			try {
 				await verifySecp256k1RecoverableSignatureAgainstPublicKey33(challengeDigest, signature, publicKey);
 			} catch {
-				return emailOtpUnlockProofRejected("invalid_unlock_proof", "unlockProof.signature did not verify against unlockProof.publicKey");
+				return failedVerification("invalid_unlock_proof", "unlockProof.signature did not verify against unlockProof.publicKey");
 			}
 			await this.emailOtpEnrollments.putAuthStateForEnrollment(enrollment.enrollment, { lastEmailOtpLoginAtMs: Date.now() });
 			return {
@@ -249,12 +221,7 @@ var CloudflareD1EmailOtpRecoveryService = class {
 				unlockKeyVersion: enrollment.enrollment.unlockKeyVersion
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				verified: false,
-				code: "internal",
-				message: errorMessage(error) || "Failed to verify Email OTP unlock proof"
-			};
+			return failedVerification("internal", errorMessage(error) || "Failed to verify Email OTP unlock proof");
 		}
 	}
 	async consumeEmailOtpGrant(input) {
@@ -279,11 +246,7 @@ var CloudflareD1EmailOtpRecoveryService = class {
 				otpChannel: EMAIL_OTP_CHANNEL
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: errorMessage(error) || "Failed to consume Email OTP grant"
-			};
+			return failure("internal", errorMessage(error) || "Failed to consume Email OTP grant");
 		}
 	}
 };
@@ -353,48 +316,23 @@ function emailOtpGrantBindingMismatch(record, input) {
 function invalidUnlockChallengeBody(message) {
 	return {
 		ok: false,
-		result: {
-			ok: false,
-			code: "invalid_body",
-			message
-		}
+		result: failure("invalid_body", message)
 	};
 }
 function invalidUnlockProofBody(message) {
 	return {
 		ok: false,
-		result: {
-			ok: false,
-			verified: false,
-			code: "invalid_body",
-			message
-		}
+		result: failedVerification("invalid_body", message)
 	};
 }
 function invalidGrantConsumptionBody(message) {
 	return {
 		ok: false,
-		result: {
-			ok: false,
-			code: "invalid_body",
-			message
-		}
+		result: failure("invalid_body", message)
 	};
 }
 function emailOtpGrantInvalidOrExpired() {
-	return {
-		ok: false,
-		code: "grant_invalid_or_expired",
-		message: "Email OTP grant is invalid or expired"
-	};
-}
-function emailOtpUnlockProofRejected(code, message) {
-	return {
-		ok: false,
-		verified: false,
-		code,
-		message
-	};
+	return failure("grant_invalid_or_expired", "Email OTP grant is invalid or expired");
 }
 //#endregion
 export { CloudflareD1EmailOtpRecoveryService };

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer.js

@@ -1,5 +1,5 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { validateSecp256k1PublicKey33 } from "../../../../core/ThresholdService/evmCryptoWasm.js";
 import { emailOtpDeviceEnrollmentId } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { validateEmailOtpEnrollmentMaterial } from "./d1EmailOtpRecords.js";
@@ -20,27 +20,11 @@ var CloudflareD1EmailOtpRegistrationEnrollmentFinalizer = class {
 		this.googleEmailOtpSessions = input.googleEmailOtpSessions;
 	}
 	async prepareRegistrationFinalize(input) {
-		if (input.authority.kind !== "email_otp") return input.request.emailOtpEnrollment ? {
-			ok: false,
-			code: "invalid_body",
-			message: "Email OTP enrollment material is only valid for Email OTP registration"
-		} : { ok: true };
-		if (!input.request.emailOtpEnrollment) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Email OTP registration finalize requires emailOtpEnrollment"
-		};
-		if (input.authority.walletId !== input.walletId || input.authority.finalWalletId !== input.walletId || input.authority.orgId !== input.orgId) return {
-			ok: false,
-			code: "authority_binding_mismatch",
-			message: "Email OTP registration authority does not match finalize scope"
-		};
+		if (input.authority.kind !== "email_otp") return input.request.emailOtpEnrollment ? failure("invalid_body", "Email OTP enrollment material is only valid for Email OTP registration") : { ok: true };
+		if (!input.request.emailOtpEnrollment) return failure("invalid_body", "Email OTP registration finalize requires emailOtpEnrollment");
+		if (input.authority.walletId !== input.walletId || input.authority.finalWalletId !== input.walletId || input.authority.orgId !== input.orgId) return failure("authority_binding_mismatch", "Email OTP registration authority does not match finalize scope");
 		const material = parseEmailOtpEnrollmentMaterialBoundaryInput(input.request.emailOtpEnrollment);
-		if (!material) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Email OTP enrollment material must be an object with the expected fields"
-		};
+		if (!material) return failure("invalid_body", "Email OTP enrollment material must be an object with the expected fields");
 		return await this.buildPersistence({
 			walletId: input.walletId,
 			orgId: input.orgId,
@@ -74,8 +58,9 @@ var CloudflareD1EmailOtpRegistrationEnrollmentFinalizer = class {
 			case "passkey": return { ok: true };
 			case "email_otp": switch (input.authority.proofKind) {
 				case "otp_challenge": return { ok: true };
-				case "google_sso_registration": return await this.googleEmailOtpSessions.completeRegistrationAttempt({
+				case "google_sso_registration": return await this.googleEmailOtpSessions.completeCommittedRegistrationAttempt({
 					registrationAttemptId: input.authority.googleEmailOtpRegistrationAttemptId,
+					intentDigest: input.authority.registrationIntentDigestB64u,
 					walletId: input.walletId
 				});
 			}
@@ -131,11 +116,7 @@ var CloudflareD1EmailOtpRegistrationEnrollmentFinalizer = class {
 	* batch instead of silently replacing material that another operation owns.
 	*/
 	async prepareLinkedDeviceEnrollment(input) {
-		if (!await this.emailOtpEnrollments.signerWalletExists(input.walletId)) return {
-			ok: false,
-			code: "wallet_registration_incomplete",
-			message: "Email OTP enrollment requires a canonical wallet"
-		};
+		if (!await this.emailOtpEnrollments.signerWalletExists(input.walletId)) return failure("wallet_registration_incomplete", "Email OTP enrollment requires a canonical wallet");
 		if (await this.emailOtpEnrollments.readEnrollment(input.walletId)) return {
 			ok: false,
 			code: "enrollment_conflict",
@@ -164,11 +145,7 @@ var CloudflareD1EmailOtpRegistrationEnrollmentFinalizer = class {
 		const walletId = normalizeOptionalTrimmedString(input.walletId) || "";
 		const authSubjectId = normalizeOptionalTrimmedString(input.authSubjectId) || "";
 		const verifiedEmail = normalizeOptionalTrimmedString(input.verifiedEmail)?.toLowerCase() || "";
-		if (!orgId || !walletId || !authSubjectId || !verifiedEmail) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Email OTP registration enrollment requires wallet, org, and email identity"
-		};
+		if (!orgId || !walletId || !authSubjectId || !verifiedEmail) return failure("invalid_body", "Email OTP registration enrollment requires wallet, org, and email identity");
 		const existing = await this.emailOtpEnrollments.readEnrollment(walletId);
 		const existingAuthState = await this.emailOtpEnrollments.readAuthState(walletId);
 		return {

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpServerSealRuntime.js

@@ -1,5 +1,5 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { createSigningSessionSealShamir3PassCipherAdapter } from "../../../../threshold/session/signingSessionSeal/crypto/cipher.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpServerSealRuntime.ts
 const applyEmailOtpServerSealOperation = {
@@ -26,11 +26,7 @@ var CloudflareD1EmailOtpServerSealRuntime = class {
 	async runServerSealOperation(input, operation) {
 		try {
 			const wrappedCiphertext = normalizeOptionalTrimmedString(input.wrappedCiphertext);
-			if (!wrappedCiphertext) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Missing wrappedCiphertext"
-			};
+			if (!wrappedCiphertext) return failure("invalid_body", "Missing wrappedCiphertext");
 			const shamir = this.cipherResult;
 			if (!shamir.ok) return shamir;
 			const result = await shamir.cipher.run({
@@ -47,19 +43,11 @@ var CloudflareD1EmailOtpServerSealRuntime = class {
 				enrollmentSealKeyVersion: result.keyVersion || shamir.keyVersion
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: serverSealErrorMessage(error) || operation.failureMessage
-			};
+			return failure("internal", serverSealErrorMessage(error) || operation.failureMessage);
 		}
 	}
 	createCipher() {
-		if (!this.config.configured) return {
-			ok: false,
-			code: "not_configured",
-			message: this.config.message
-		};
+		if (!this.config.configured) return failure("not_configured", this.config.message);
 		try {
 			return {
 				ok: true,
@@ -67,11 +55,7 @@ var CloudflareD1EmailOtpServerSealRuntime = class {
 				cipher: createSigningSessionSealShamir3PassCipherAdapter({ config: this.config.rootConfig })
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "not_configured",
-				message: serverSealErrorMessage(error) || "Email OTP Shamir configuration is invalid"
-			};
+			return failure("not_configured", serverSealErrorMessage(error) || "Email OTP Shamir configuration is invalid");
 		}
 	}
 };

package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.js

@@ -1,15 +1,31 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { d1MutationChanges } from "../auth/d1RouterApiAuthBoundary.js";
 import { registrationAttemptMatchesReplacementScope, registrationAttemptMatchesStartedScope } from "../../../../core/EmailOtpRecords.js";
+import { completeGoogleRegistration } from "./d1GoogleRegistrationCompletion.js";
 import { emailOtpRegistrationAttemptRows } from "../../../../core/emailOtpD1Statements.js";
-import { abandonedGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationAttemptRow, pendingGoogleEmailOtpRegistrationAttemptWithUpdatedAt } from "./d1GoogleEmailOtpRegistrationRecords.js";
+import { abandonedGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationAttemptRow } from "./d1GoogleEmailOtpRegistrationRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationAttemptStore.ts
 var CloudflareD1GoogleEmailOtpRegistrationAttemptStore = class {
 	constructor(input) {
 		this.prepare = input.prepare;
 		this.orgId = input.orgId;
+		this.batch = input.batch;
+	}
+	complete(input) {
+		return completeGoogleRegistration(this.prepare, this.batch, {
+			kind: "live_offer",
+			attemptId: input.attemptId,
+			walletId: input.walletId
+		});
+	}
+	completeCommitted(input) {
+		return completeGoogleRegistration(this.prepare, this.batch, {
+			kind: "committed_wallet",
+			attemptId: input.attemptId,
+			walletId: input.walletId,
+			intentDigest: input.intentDigest
+		});
 	}
 	async cleanupExpired(nowMs) {
 		return d1MutationChanges(await emailOtpRegistrationAttemptRows.deleteExpired(this.prepare, nowMs).run());
@@ -37,8 +53,16 @@ var CloudflareD1GoogleEmailOtpRegistrationAttemptStore = class {
 			expiresAtMs: nowMs + 30 * 6e4,
 			runtimePolicyScope: input.runtimePolicyScope
 		};
-		await this.put(attempt);
-		return attempt;
+		await emailOtpRegistrationAttemptRows.insertPendingIfAbsent(this.prepare, attempt).run();
+		const winner = await this.findStarted({
+			providerSubject: input.providerSubject,
+			email: input.email,
+			orgId: this.orgId,
+			ownerProofBindingDigest: input.ownerProofBindingDigest,
+			runtimePolicyScope: input.runtimePolicyScope
+		});
+		if (!winner) throw new Error("Registration offer changed during creation; retry the request");
+		return winner;
 	}
 	async findStarted(input) {
 		const nowMs = Date.now();
@@ -51,13 +75,11 @@ var CloudflareD1GoogleEmailOtpRegistrationAttemptStore = class {
 		const parsed = parseGoogleEmailOtpRegistrationAttemptRow(row);
 		if (!parsed) {
 			const malformedAttemptId = normalizeOptionalTrimmedString(row?.attempt_id);
-			if (malformedAttemptId) await this.delete(malformedAttemptId);
+			if (malformedAttemptId) await this.deleteMalformedUnclaimed(malformedAttemptId);
 			return null;
 		}
 		if (!registrationAttemptMatchesStartedScope(parsed, scope)) return null;
-		const refreshed = pendingGoogleEmailOtpRegistrationAttemptWithUpdatedAt(parsed, nowMs);
-		await this.put(refreshed);
-		return refreshed;
+		return parsed;
 	}
 	async abandonStartedExceptBinding(input) {
 		const result = await emailOtpRegistrationAttemptRows.selectPending(this.prepare, input).all();
@@ -65,7 +87,7 @@ var CloudflareD1GoogleEmailOtpRegistrationAttemptStore = class {
 			const parsed = parseGoogleEmailOtpRegistrationAttemptRow(row);
 			if (!parsed) {
 				const malformedAttemptId = normalizeOptionalTrimmedString(row.attempt_id);
-				if (malformedAttemptId) await this.delete(malformedAttemptId);
+				if (malformedAttemptId) await this.deleteMalformedUnclaimed(malformedAttemptId);
 				continue;
 			}
 			if (!registrationAttemptMatchesReplacementScope(parsed, input)) continue;
@@ -80,16 +102,26 @@ var CloudflareD1GoogleEmailOtpRegistrationAttemptStore = class {
 		const row = await emailOtpRegistrationAttemptRows.selectLiveForWallet(this.prepare, input.walletId, input.nowMs).first();
 		return Boolean(row);
 	}
+	async claimCandidate(input) {
+		return d1MutationChanges(await emailOtpRegistrationAttemptRows.claimCandidate(this.prepare, {
+			...input,
+			nowMs: Date.now()
+		}).run()) === 1 ? { ok: true } : {
+			ok: false,
+			code: "registration_candidate_unavailable",
+			message: "Registration offer is unavailable or already claimed by another candidate or intent"
+		};
+	}
 	async read(attemptId) {
 		const record = parseGoogleEmailOtpRegistrationAttemptRow(await emailOtpRegistrationAttemptRows.select(this.prepare, attemptId).first());
 		return record?.runtimePolicyScope?.orgId === this.orgId ? record : null;
 	}
 	async put(record) {
 		if (record.runtimePolicyScope?.orgId !== this.orgId) throw new Error("Google Email OTP registration attempt org scope mismatch");
-		await emailOtpRegistrationAttemptRows.upsert(this.prepare, record).run();
+		if (d1MutationChanges(await emailOtpRegistrationAttemptRows.updatePending(this.prepare, record).run()) !== 1) throw new Error("Registration offer is no longer pending or has changed");
 	}
-	async delete(attemptId) {
-		await emailOtpRegistrationAttemptRows.delete(this.prepare, attemptId).run();
+	async deleteMalformedUnclaimed(attemptId) {
+		await emailOtpRegistrationAttemptRows.deleteUnclaimed(this.prepare, attemptId).run();
 	}
 };
 //#endregion

package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationRecords.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { isB64uString, nonNegativeSafeInteger, parseJsonObject, positiveSafeInteger } from "../auth/d1RouterApiAuthBoundary.js";
 //#region src/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationRecords.ts
 const GOOGLE_EMAIL_OTP_AUTH_PROVIDER = "google";
@@ -8,18 +7,6 @@ function requireRuntimePolicyScope(input) {
 	if (scope) return scope;
 	throw new Error("runtimePolicyScope.orgId, runtimePolicyScope.projectId, runtimePolicyScope.envId, and runtimePolicyScope.signingRootVersion are required for Google Email OTP registration");
 }
-function activeGoogleEmailOtpRegistrationAttemptRecord(input) {
-	const terminal = terminalGoogleEmailOtpRegistrationAttemptRecord({
-		fields: {
-			...input.record,
-			updatedAtMs: input.updatedAtMs
-		},
-		state: "active",
-		...input.record.state === "key_finalized" ? { finalizedPublicKey: input.record.finalizedPublicKey } : {}
-	});
-	if (!terminal) throw new Error("Failed to build active Google Email OTP registration attempt");
-	return terminal;
-}
 function expiredGoogleEmailOtpRegistrationAttemptRecord(input) {
 	const terminal = terminalGoogleEmailOtpRegistrationAttemptRecord({
 		fields: {
@@ -33,19 +20,6 @@ function expiredGoogleEmailOtpRegistrationAttemptRecord(input) {
 	if (!terminal) throw new Error("Failed to build expired Google Email OTP registration attempt");
 	return terminal;
 }
-function failedGoogleEmailOtpRegistrationAttemptWithCode(input) {
-	const terminal = terminalGoogleEmailOtpRegistrationAttemptRecord({
-		fields: {
-			...input.record,
-			updatedAtMs: input.updatedAtMs
-		},
-		state: "failed",
-		failureCode: input.failureCode,
-		...input.record.state === "key_finalized" ? { finalizedPublicKey: input.record.finalizedPublicKey } : {}
-	});
-	if (!terminal) throw new Error("Failed to build failed Google Email OTP registration attempt");
-	return terminal;
-}
 function parseGoogleEmailOtpRegistrationAttemptRecord(input) {
 	const record = parseJsonObject(input);
 	if (!record) return null;
@@ -137,21 +111,6 @@ function googleEmailOtpRegistrationOfferForResponse(input) {
 		candidates: [candidates[0], ...candidates.slice(1)]
 	};
 }
-function pendingGoogleEmailOtpRegistrationAttemptWithUpdatedAt(record, updatedAtMs) {
-	return pendingRegistrationAttemptRecord({
-		...record,
-		updatedAtMs
-	}, record);
-}
-function pendingGoogleEmailOtpRegistrationAttemptWithSelectedCandidate(input) {
-	return pendingRegistrationAttemptRecord({
-		...input.record,
-		walletId: input.candidate.walletId,
-		selectedCandidateId: input.candidate.candidateId,
-		collisionCounter: input.candidate.collisionCounter,
-		updatedAtMs: input.updatedAtMs
-	}, input.record);
-}
 function abandonedGoogleEmailOtpRegistrationAttemptRecord(input) {
 	return registrationAttemptRecord({
 		...input.record,
@@ -244,13 +203,6 @@ function registrationAttemptRecord(fields, state) {
 		...fields.runtimePolicyScope ? { runtimePolicyScope: fields.runtimePolicyScope } : {}
 	};
 }
-/** Rebuilds a pending attempt from changed fields, keeping its state. */
-function pendingRegistrationAttemptRecord(fields, record) {
-	return record.state === "started" ? registrationAttemptRecord(fields, { state: "started" }) : registrationAttemptRecord(fields, {
-		state: "key_finalized",
-		finalizedPublicKey: record.finalizedPublicKey
-	});
-}
 function terminalGoogleEmailOtpRegistrationAttemptRecord(input) {
 	const finalized = input.finalizedPublicKey ? { finalizedPublicKey: input.finalizedPublicKey } : {};
 	switch (input.state) {
@@ -274,6 +226,6 @@ function terminalGoogleEmailOtpRegistrationAttemptRecord(input) {
 	}
 }
 //#endregion
-export { abandonedGoogleEmailOtpRegistrationAttemptRecord, activeGoogleEmailOtpRegistrationAttemptRecord, expiredGoogleEmailOtpRegistrationAttemptRecord, failedGoogleEmailOtpRegistrationAttemptWithCode, googleEmailOtpRegistrationOfferForResponse, parseGoogleEmailOtpRegistrationAttemptRow, pendingGoogleEmailOtpRegistrationAttemptWithSelectedCandidate, pendingGoogleEmailOtpRegistrationAttemptWithUpdatedAt, requireRuntimePolicyScope };
+export { abandonedGoogleEmailOtpRegistrationAttemptRecord, expiredGoogleEmailOtpRegistrationAttemptRecord, googleEmailOtpRegistrationOfferForResponse, parseGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationAttemptRow, parseGoogleEmailOtpRegistrationOfferCandidates, requireRuntimePolicyScope };
 
 //# sourceMappingURL=d1GoogleEmailOtpRegistrationRecords.js.map