@seams/wallet-server 0.7.1 → 0.8.0

package/dist/esm/core/authService/emailOtpChallenges.js

@@ -1,260 +0,0 @@
-import { base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
-import "../../shared-ts/src/utils/encoders.js";
-import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
-import { errorMessage } from "../../shared-ts/src/utils/errors.js";
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION, isWalletEmailOtpLoginOperation } from "../../shared-ts/src/utils/emailOtpDomain.js";
-import { randomNumericCode } from "./bytes.js";
-//#region src/core/authService/emailOtpChallenges.ts
-function activeChallengeLimit(value) {
-	return Math.max(1, Math.floor(value));
-}
-function emailOtpChallengeOperationFromRequest(input) {
-	if (input.operationRaw && isWalletEmailOtpLoginOperation(input.operationRaw)) return input.operationRaw;
-	if (input.operationRaw === "registration") return WALLET_EMAIL_OTP_REGISTRATION_OPERATION;
-	return input.action === WALLET_EMAIL_OTP_ACTIONS.registration ? WALLET_EMAIL_OTP_REGISTRATION_OPERATION : WALLET_EMAIL_OTP_UNLOCK_OPERATION;
-}
-function createdEmailOtpChallengeFromRecord(input) {
-	return {
-		challengeId: input.record.challengeId,
-		issuedAtMs: input.record.createdAtMs,
-		expiresAtMs: input.record.expiresAtMs,
-		challengeSubjectId: input.challengeSubjectId,
-		walletId: input.walletId,
-		orgId: input.orgId,
-		otpChannel: EMAIL_OTP_CHANNEL,
-		ownerProofBindingDigest: input.ownerProofBindingDigest,
-		action: input.action,
-		operation: input.operation
-	};
-}
-function emailOtpChallengeContextInput(context) {
-	return {
-		challengeSubjectId: context.challengeSubjectId,
-		walletId: context.walletId,
-		orgId: context.orgId,
-		otpChannel: context.otpChannel,
-		ownerProofBindingDigest: context.ownerProofBindingDigest,
-		action: context.action,
-		operation: context.operation,
-		nowMs: context.nowMs
-	};
-}
-async function pruneExpiredEmailOtpChallengesWithStore(input) {
-	const deleted = await input.challengeStore.deleteExpired(input.nowMs);
-	for (const record of deleted) input.memoryOutbox.delete(record.challengeId);
-	return deleted;
-}
-async function enforceEmailOtpActiveChallengeLimitWithStore(input) {
-	const maxActive = activeChallengeLimit(input.maxActiveChallenges);
-	const context = emailOtpChallengeContextInput(input.context);
-	while (await input.challengeStore.countActiveByContext(context) >= maxActive) {
-		const deleted = await input.challengeStore.deleteOldestActiveByContext(context);
-		if (!deleted) break;
-		input.memoryOutbox.delete(deleted.challengeId);
-	}
-}
-async function createEmailOtpChallengeWithAction(input) {
-	try {
-		const request = input.request;
-		const challengeSubjectId = normalizeOptionalTrimmedString(request.challengeSubjectId);
-		const walletId = normalizeOptionalTrimmedString(request.walletId);
-		const orgId = normalizeOptionalTrimmedString(request.orgId) || "";
-		const email = normalizeOptionalTrimmedString(request.email)?.toLowerCase() || "";
-		const otpChannel = normalizeOptionalTrimmedString(request.otpChannel);
-		const ownerProofBindingDigest = normalizeOptionalTrimmedString(request.ownerProofBindingDigest);
-		const clientIp = normalizeOptionalTrimmedString(request.clientIp) || void 0;
-		const reuseActiveChallenge = request.reuseActiveChallenge === true;
-		const action = request.action;
-		const operation = emailOtpChallengeOperationFromRequest({
-			action,
-			operationRaw: normalizeOptionalTrimmedString(request.operation)
-		});
-		if (!challengeSubjectId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing challengeSubjectId"
-		};
-		if (!walletId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing walletId"
-		};
-		if (!orgId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing orgId"
-		};
-		if (otpChannel !== "email_otp") return {
-			ok: false,
-			code: "invalid_body",
-			message: "otpChannel must be email_otp"
-		};
-		if (!ownerProofBindingDigest) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing ownerProofBindingDigest"
-		};
-		const activeEnrollment = action !== WALLET_EMAIL_OTP_ACTIONS.registration ? await input.readActiveEnrollment({
-			walletId,
-			orgId
-		}) : null;
-		if (activeEnrollment && !activeEnrollment.ok) return activeEnrollment;
-		const existingEnrollment = activeEnrollment?.ok ? activeEnrollment.enrollment : null;
-		const existingAuthStateResult = existingEnrollment ? await input.readEnrollmentAuthState(existingEnrollment) : {
-			ok: true,
-			state: null
-		};
-		if (!existingAuthStateResult.ok) return existingAuthStateResult;
-		const existingAuthState = existingAuthStateResult.state;
-		const challengeEmail = action === WALLET_EMAIL_OTP_ACTIONS.registration ? email : existingEnrollment?.verifiedEmail || "";
-		if (!challengeEmail) return {
-			ok: false,
-			code: "recovery_email_missing",
-			message: "Authenticated identity does not include a recovery email"
-		};
-		if (existingAuthState?.otpLockedUntilMs && existingAuthState.otpLockedUntilMs > Date.now()) return {
-			ok: false,
-			code: "otp_locked_out",
-			message: "Email OTP is temporarily locked for this wallet",
-			lockedUntilMs: existingAuthState.otpLockedUntilMs
-		};
-		const issuedAtMs = Date.now();
-		await pruneExpiredEmailOtpChallengesWithStore({
-			challengeStore: input.challengeStore,
-			memoryOutbox: input.memoryOutbox,
-			nowMs: issuedAtMs
-		});
-		if (reuseActiveChallenge) {
-			const existingChallenge = await input.challengeStore.findLatestActiveByContext({
-				challengeSubjectId,
-				walletId,
-				orgId,
-				otpChannel: EMAIL_OTP_CHANNEL,
-				ownerProofBindingDigest,
-				action,
-				operation,
-				nowMs: issuedAtMs
-			});
-			if (existingChallenge) return {
-				ok: true,
-				challenge: createdEmailOtpChallengeFromRecord({
-					record: existingChallenge,
-					challengeSubjectId,
-					walletId,
-					orgId,
-					ownerProofBindingDigest,
-					action,
-					operation
-				}),
-				delivery: {
-					status: "reused",
-					mode: "memory",
-					emailHint: existingChallenge.email
-				}
-			};
-		}
-		const rateLimit = await input.consumeRateLimit({
-			scope: "challenge",
-			action,
-			userId: challengeSubjectId,
-			walletId,
-			orgId,
-			clientIp
-		});
-		if (!rateLimit.ok) return rateLimit;
-		if (typeof crypto === "undefined" || typeof crypto.getRandomValues !== "function") return {
-			ok: false,
-			code: "unsupported",
-			message: "crypto.getRandomValues is unavailable in this runtime"
-		};
-		const otpConfig = input.resolveConfig();
-		const expiresAtMs = issuedAtMs + otpConfig.challengeTtlMs;
-		const challengeId = base64UrlEncode(crypto.getRandomValues(new Uint8Array(16)));
-		const otpCode = randomNumericCode(otpConfig.codeLength);
-		await enforceEmailOtpActiveChallengeLimitWithStore({
-			challengeStore: input.challengeStore,
-			memoryOutbox: input.memoryOutbox,
-			context: {
-				challengeSubjectId,
-				walletId,
-				orgId,
-				otpChannel: EMAIL_OTP_CHANNEL,
-				ownerProofBindingDigest,
-				action,
-				operation,
-				nowMs: issuedAtMs
-			},
-			maxActiveChallenges: otpConfig.maxActiveChallengesPerContext
-		});
-		const challengeRecord = {
-			version: "email_otp_challenge_v1",
-			challengeId,
-			challengeSubjectId,
-			walletId,
-			orgId,
-			otpChannel: EMAIL_OTP_CHANNEL,
-			email: challengeEmail,
-			otpCode,
-			ownerProofBindingDigest,
-			action,
-			operation,
-			createdAtMs: issuedAtMs,
-			expiresAtMs,
-			attemptCount: 0,
-			maxAttempts: otpConfig.maxAttempts
-		};
-		await input.challengeStore.put(challengeRecord);
-		if (!await input.challengeStore.get(challengeId)) return {
-			ok: false,
-			code: "internal",
-			message: "Email OTP challenge could not be persisted"
-		};
-		const delivery = await input.deliverCode({
-			challengeId,
-			walletId,
-			userId: challengeSubjectId,
-			otpChannel: EMAIL_OTP_CHANNEL,
-			action,
-			operation,
-			email: challengeEmail,
-			otpCode,
-			expiresAtMs
-		});
-		if (!delivery.ok) {
-			await input.challengeStore.del(challengeId);
-			input.memoryOutbox.delete(challengeId);
-			return delivery;
-		}
-		return {
-			ok: true,
-			challenge: {
-				challengeId,
-				issuedAtMs,
-				expiresAtMs,
-				challengeSubjectId,
-				walletId,
-				orgId,
-				otpChannel: EMAIL_OTP_CHANNEL,
-				ownerProofBindingDigest,
-				action,
-				operation
-			},
-			delivery: {
-				status: "sent",
-				mode: delivery.deliveryMode,
-				emailHint: delivery.emailHint
-			}
-		};
-	} catch (e) {
-		return {
-			ok: false,
-			code: "internal",
-			message: errorMessage(e) || "Failed to create Email OTP challenge"
-		};
-	}
-}
-//#endregion
-export { createEmailOtpChallengeWithAction, pruneExpiredEmailOtpChallengesWithStore };
-
-//# sourceMappingURL=emailOtpChallenges.js.map

package/dist/esm/core/authService/emailOtpDelivery.js

@@ -1,169 +0,0 @@
-import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
-//#region src/core/authService/emailOtpDelivery.ts
-function logDevelopmentOtpCode(input) {
-	input.logger.warn("[email-otp] development OTP code", {
-		challengeId: input.challengeId,
-		walletId: input.walletId,
-		userId: input.userId,
-		otpChannel: input.otpChannel,
-		action: input.action,
-		operation: input.operation,
-		deliveryMode: input.deliveryMode,
-		emailHint: input.emailHint,
-		devOtpCode: input.otpCode,
-		expiresAtMs: input.expiresAtMs
-	});
-}
-function storeMemoryOtp(input) {
-	input.memoryOutbox.set(input.challengeId, {
-		walletId: input.walletId,
-		userId: input.userId,
-		otpChannel: input.otpChannel,
-		email: input.email,
-		emailHint: input.emailHint,
-		otpCode: input.otpCode,
-		expiresAtMs: input.expiresAtMs
-	});
-}
-function logDevelopmentOtpDelivery(input) {
-	logDevelopmentOtpCode({
-		logger: input.logger,
-		deliveryMode: input.config.deliveryMode,
-		challengeId: input.challengeId,
-		walletId: input.walletId,
-		userId: input.userId,
-		otpChannel: input.otpChannel,
-		action: input.action,
-		operation: input.operation,
-		emailHint: input.emailHint,
-		otpCode: input.otpCode,
-		expiresAtMs: input.expiresAtMs
-	});
-}
-async function deliverEmailOtpCode(input) {
-	if (input.production && input.config.deliveryMode !== "email_provider") return {
-		ok: false,
-		code: "email_otp_delivery_not_allowed",
-		message: `Email OTP delivery mode ${input.config.deliveryMode} is disabled in production`
-	};
-	const emailHint = input.email;
-	if (input.config.deliveryMode === "email_provider") return {
-		ok: false,
-		code: "not_implemented",
-		message: "Email OTP email_provider delivery is not implemented yet"
-	};
-	if (input.config.deliveryMode === "memory") {
-		storeMemoryOtp({
-			memoryOutbox: input.memoryOutbox,
-			challengeId: input.challengeId,
-			walletId: input.walletId,
-			userId: input.userId,
-			otpChannel: input.otpChannel,
-			email: input.email,
-			emailHint,
-			otpCode: input.otpCode,
-			expiresAtMs: input.expiresAtMs
-		});
-		logDevelopmentOtpDelivery({
-			config: input.config,
-			production: input.production,
-			logger: input.logger,
-			memoryOutbox: input.memoryOutbox,
-			challengeId: input.challengeId,
-			walletId: input.walletId,
-			userId: input.userId,
-			otpChannel: input.otpChannel,
-			action: input.action,
-			operation: input.operation,
-			email: input.email,
-			otpCode: input.otpCode,
-			expiresAtMs: input.expiresAtMs,
-			emailHint
-		});
-		return {
-			ok: true,
-			deliveryMode: "memory",
-			emailHint
-		};
-	}
-	logDevelopmentOtpDelivery({
-		config: input.config,
-		production: input.production,
-		logger: input.logger,
-		memoryOutbox: input.memoryOutbox,
-		challengeId: input.challengeId,
-		walletId: input.walletId,
-		userId: input.userId,
-		otpChannel: input.otpChannel,
-		action: input.action,
-		operation: input.operation,
-		email: input.email,
-		otpCode: input.otpCode,
-		expiresAtMs: input.expiresAtMs,
-		emailHint
-	});
-	return {
-		ok: true,
-		deliveryMode: "log",
-		emailHint
-	};
-}
-function readEmailOtpOutboxEntry(input) {
-	if (!input.config.devOutboxEnabled) return {
-		ok: false,
-		code: "not_found",
-		message: "Email OTP dev outbox is not enabled"
-	};
-	const challengeId = normalizeOptionalTrimmedString(input.request.challengeId);
-	const userId = normalizeOptionalTrimmedString(input.request.userId);
-	const walletId = normalizeOptionalTrimmedString(input.request.walletId);
-	if (!challengeId) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Missing challengeId"
-	};
-	if (!userId) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Missing userId"
-	};
-	if (!walletId) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Missing walletId"
-	};
-	const entry = input.memoryOutbox.get(challengeId);
-	if (!entry) return {
-		ok: false,
-		code: "not_found",
-		message: "Email OTP outbox entry was not found"
-	};
-	if (entry.userId !== userId || entry.walletId !== walletId) return {
-		ok: false,
-		code: "not_found",
-		message: "Email OTP outbox entry was not found"
-	};
-	if (input.nowMs > entry.expiresAtMs) {
-		input.memoryOutbox.delete(challengeId);
-		return {
-			ok: false,
-			code: "not_found",
-			message: "Email OTP outbox entry expired"
-		};
-	}
-	return {
-		ok: true,
-		challengeId,
-		walletId,
-		userId,
-		otpChannel: entry.otpChannel,
-		emailHint: entry.emailHint,
-		otpCode: entry.otpCode,
-		expiresAtMs: entry.expiresAtMs
-	};
-}
-//#endregion
-export { deliverEmailOtpCode, readEmailOtpOutboxEntry };
-
-//# sourceMappingURL=emailOtpDelivery.js.map

package/dist/esm/core/authService/emailOtpGrant.js

@@ -1,74 +0,0 @@
-import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
-import { errorMessage } from "../../shared-ts/src/utils/errors.js";
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS } from "../../shared-ts/src/utils/emailOtpDomain.js";
-//#region src/core/authService/emailOtpGrant.ts
-async function consumeEmailOtpGrantWithStore(input) {
-	try {
-		const loginGrant = normalizeOptionalTrimmedString(input.request.loginGrant);
-		const userId = normalizeOptionalTrimmedString(input.request.userId);
-		const walletId = normalizeOptionalTrimmedString(input.request.walletId);
-		const orgId = normalizeOptionalTrimmedString(input.request.orgId) || "";
-		const otpChannel = normalizeOptionalTrimmedString(input.request.otpChannel);
-		const clientIp = normalizeOptionalTrimmedString(input.request.clientIp) || void 0;
-		if (!loginGrant) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing loginGrant"
-		};
-		if (!userId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing userId"
-		};
-		if (!walletId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing walletId"
-		};
-		if (!orgId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing orgId"
-		};
-		if (otpChannel !== "email_otp") return {
-			ok: false,
-			code: "invalid_body",
-			message: "otpChannel must be email_otp"
-		};
-		const rateLimit = await input.consumeRateLimit({
-			scope: "grant",
-			userId,
-			walletId,
-			orgId,
-			clientIp
-		});
-		if (!rateLimit.ok) return rateLimit;
-		const record = await input.grantStore.consume(loginGrant);
-		if (!record || input.nowMs > record.expiresAtMs || record.action !== WALLET_EMAIL_OTP_ACTIONS.unseal) return {
-			ok: false,
-			code: "login_grant_invalid_or_expired",
-			message: "Login grant is invalid or expired"
-		};
-		if (record.userId !== userId || record.walletId !== walletId || record.otpChannel !== "email_otp" || record.orgId !== orgId) return {
-			ok: false,
-			code: "recovery_grant_binding_mismatch",
-			message: "Recovery grant is not valid for the current Email OTP authority"
-		};
-		return {
-			ok: true,
-			challengeId: record.challengeId,
-			otpChannel: EMAIL_OTP_CHANNEL
-		};
-	} catch (error) {
-		return {
-			ok: false,
-			code: "internal",
-			message: errorMessage(error) || "Failed to consume Email OTP grant"
-		};
-	}
-}
-//#endregion
-export { consumeEmailOtpGrantWithStore };
-
-//# sourceMappingURL=emailOtpGrant.js.map

package/dist/esm/core/authService/emailOtpRegistrationEnrollment.js

@@ -1,175 +0,0 @@
-import { parseWalletId } from "../../shared-ts/src/utils/domainIds.js";
-import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
-import { validateSecp256k1PublicKey33 } from "../ThresholdService/evmCryptoWasm.js";
-import { WALLET_EMAIL_OTP_ACTIONS, emailOtpDeviceEnrollmentId } from "../../shared-ts/src/utils/emailOtpDomain.js";
-import { validateEmailOtpEnrollmentMaterial } from "../../router/cloudflare/d1/emailOtp/d1EmailOtpRecords.js";
-import { parseRawEmailOtpRegistrationChallengeProofInput } from "./emailOtpChallengeProof.js";
-import { completeGoogleEmailOtpRegistrationAttemptWithStore } from "./googleEmailOtpRegistration.js";
-//#region src/core/authService/emailOtpRegistrationEnrollment.ts
-function assertNever(value) {
-	throw new Error(`Unexpected value: ${String(value)}`);
-}
-async function resolveEmailOtpRegistrationChallengeProof(input) {
-	const proofInput = input.proofInput;
-	switch (proofInput.kind) {
-		case "google_registration_attempt": {
-			const attempt = await input.registrationAttemptStore.get(proofInput.registrationAttemptId);
-			if (!attempt) return {
-				ok: false,
-				code: "registration_attempt_missing",
-				message: "Google Email OTP registration attempt expired or was not found"
-			};
-			if (attempt.providerSubject !== proofInput.providerSubject) return {
-				ok: false,
-				code: "challenge_subject_mismatch",
-				message: "Email OTP registration attempt does not match the provider subject"
-			};
-			if (attempt.expiresAtMs <= input.nowMs) return {
-				ok: false,
-				code: "registration_attempt_expired",
-				message: "Google Email OTP registration attempt expired"
-			};
-			if (attempt.walletId !== proofInput.walletId) return {
-				ok: false,
-				code: "wallet_identity_mismatch",
-				message: "registrationAttemptId does not match walletId"
-			};
-			return {
-				ok: true,
-				proof: {
-					kind: "registration_attempt",
-					providerSubject: proofInput.providerSubject,
-					challengeSubjectId: proofInput.challengeSubjectId,
-					proofEmail: attempt.email.toLowerCase(),
-					registrationAttemptId: proofInput.registrationAttemptId,
-					challengeId: proofInput.challengeId,
-					finalWalletId: proofInput.walletId,
-					orgId: proofInput.orgId,
-					ownerProofBindingDigest: proofInput.ownerProofBindingDigest
-				}
-			};
-		}
-		case "direct_proof_email": return {
-			ok: true,
-			proof: {
-				kind: "direct_proof_email",
-				providerSubject: proofInput.providerSubject,
-				challengeSubjectId: proofInput.challengeSubjectId,
-				proofEmail: proofInput.proofEmail,
-				challengeId: proofInput.challengeId,
-				finalWalletId: proofInput.finalWalletId,
-				orgId: proofInput.orgId,
-				ownerProofBindingDigest: proofInput.ownerProofBindingDigest
-			}
-		};
-	}
-	return assertNever(proofInput);
-}
-async function verifyEmailOtpEnrollment(input) {
-	const request = input.request;
-	const proofInput = parseRawEmailOtpRegistrationChallengeProofInput(request);
-	if (!proofInput.ok) return proofInput;
-	const proofResult = await resolveEmailOtpRegistrationChallengeProof({
-		proofInput: proofInput.input,
-		registrationAttemptStore: input.registrationAttemptStore,
-		nowMs: Date.now()
-	});
-	if (!proofResult.ok) return proofResult;
-	const verified = await input.verifyChallengeCode({
-		...request,
-		challengeSubjectId: proofResult.proof.challengeSubjectId,
-		registrationChallengeProof: proofResult.proof,
-		allowRegistrationChallengeReroll: true,
-		expectedAction: WALLET_EMAIL_OTP_ACTIONS.registration
-	});
-	if (!verified.ok) return verified;
-	const verifiedEmail = normalizeOptionalTrimmedString(verified.email)?.toLowerCase();
-	if (!verifiedEmail) return {
-		ok: false,
-		code: "internal",
-		message: "Email OTP enrollment verification did not include a verified email"
-	};
-	const enrollmentMaterial = await validateEmailOtpEnrollmentMaterial({
-		material: request,
-		validateSecp256k1PublicKey33
-	});
-	if (!enrollmentMaterial.ok) return enrollmentMaterial;
-	const orgId = normalizeOptionalTrimmedString(verified.orgId) || "";
-	if (!orgId) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Email OTP enrollment requires orgId tenant scope"
-	};
-	const verifiedWalletId = parseWalletId(verified.walletId);
-	if (!verifiedWalletId.ok) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Email OTP enrollment verification returned an invalid walletId"
-	};
-	if (!await input.walletStore.getWallet({ walletId: verifiedWalletId.value })) return {
-		ok: false,
-		code: "wallet_registration_incomplete",
-		message: "Email OTP enrollment requires a canonical wallet created by /wallets/register/activate."
-	};
-	const existing = await input.walletEnrollmentStore.get(verified.walletId);
-	const existingState = await input.authStateStore.get(verified.walletId);
-	const nowMs = Date.now();
-	const enrollmentRecord = {
-		version: "email_otp_wallet_enrollment_v1",
-		walletId: verified.walletId,
-		providerUserId: verified.challengeSubjectId,
-		orgId,
-		verifiedEmail,
-		enrollmentId: emailOtpDeviceEnrollmentId(verified.walletId, verified.challengeSubjectId),
-		enrollmentVersion: "1",
-		enrollmentSealKeyVersion: enrollmentMaterial.enrollmentSealKeyVersion,
-		serverSealedFactorCiphertextB64u: enrollmentMaterial.serverSealedFactorCiphertextB64u,
-		clientUnlockPublicKeyB64u: enrollmentMaterial.clientUnlockPublicKeyB64u,
-		unlockKeyVersion: enrollmentMaterial.unlockKeyVersion,
-		createdAtMs: existing?.createdAtMs ?? nowMs,
-		updatedAtMs: nowMs
-	};
-	const existingProviderEnrollment = await input.walletEnrollmentStore.getByProviderUserId({
-		providerUserId: enrollmentRecord.providerUserId,
-		orgId: enrollmentRecord.orgId
-	});
-	if (existingProviderEnrollment && existingProviderEnrollment.walletId !== enrollmentRecord.walletId) await input.walletEnrollmentStore.del(existingProviderEnrollment.walletId);
-	await input.walletEnrollmentStore.put(enrollmentRecord);
-	await input.authStateStore.put({
-		version: "email_otp_auth_state_v1",
-		walletId: enrollmentRecord.walletId,
-		providerUserId: enrollmentRecord.providerUserId,
-		orgId: enrollmentRecord.orgId,
-		createdAtMs: existingState && existingState.providerUserId === enrollmentRecord.providerUserId && existingState.orgId === enrollmentRecord.orgId ? existingState.createdAtMs : nowMs,
-		updatedAtMs: nowMs,
-		otpFailureCount: 0,
-		lastOtpFailureAtMs: void 0,
-		otpLockedUntilMs: void 0,
-		...existingState?.lastEmailOtpLoginAtMs && existingState.providerUserId === enrollmentRecord.providerUserId && existingState.orgId === enrollmentRecord.orgId ? { lastEmailOtpLoginAtMs: existingState.lastEmailOtpLoginAtMs } : {},
-		...existingState?.lastStrongAuthAtMs && existingState.providerUserId === enrollmentRecord.providerUserId && existingState.orgId === enrollmentRecord.orgId ? { lastStrongAuthAtMs: existingState.lastStrongAuthAtMs } : {}
-	});
-	const completedRegistration = await completeGoogleEmailOtpRegistrationAttemptWithStore({
-		registrationAttemptStore: input.registrationAttemptStore,
-		identityStore: input.identityStore,
-		nowMs: Date.now(),
-		registrationAttemptId: request.googleEmailOtpRegistrationAttemptId,
-		walletId: verified.walletId
-	});
-	if (!completedRegistration.ok) return completedRegistration;
-	return {
-		ok: true,
-		walletId: verified.walletId,
-		otpChannel: verified.otpChannel,
-		enrollment: {
-			createdAtMs: existing?.createdAtMs ?? nowMs,
-			updatedAtMs: nowMs,
-			enrollmentSealKeyVersion: enrollmentMaterial.enrollmentSealKeyVersion,
-			unlockKeyVersion: enrollmentMaterial.unlockKeyVersion
-		}
-	};
-}
-//#endregion
-export { verifyEmailOtpEnrollment };
-
-//# sourceMappingURL=emailOtpRegistrationEnrollment.js.map