@seams/wallet-server 0.7.1 → 0.8.0

package/dist/esm/core/authService/googleEmailOtpRegistration.js

@@ -1,674 +0,0 @@
-import { parseGoogleProviderSubject, parseOrgId, parseVerifiedGoogleEmail } from "../../shared-ts/src/utils/domainIds.js";
-import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
-import { GOOGLE_EMAIL_OTP_STALE_IDENTITY_MESSAGE } from "./googleEmailOtpErrors.js";
-import { randomOpaqueId } from "./bytes.js";
-import { readActiveEmailOtpEnrollmentWithStore } from "./emailOtpEnrollment.js";
-//#region src/core/authService/googleEmailOtpRegistration.ts
-async function cleanupGoogleEmailOtpRegistrationAttemptsWithStore(input) {
-	await input.registrationAttemptStore.deleteExpired(input.nowMs);
-}
-async function consumeGoogleEmailOtpRegistrationAttemptRateLimitWithDeps(input) {
-	if (normalizeOptionalTrimmedString(input.request.accountMode)?.toLowerCase() !== "register") return { ok: true };
-	const providerSubject = parseGoogleProviderSubject(input.request.providerSubject);
-	if (!providerSubject.ok) return {
-		ok: false,
-		code: "invalid_body",
-		message: providerSubject.error.message
-	};
-	const email = parseVerifiedGoogleEmail(input.request.email);
-	if (!email.ok) return {
-		ok: false,
-		code: "invalid_body",
-		message: email.error.message
-	};
-	const orgId = parseOrgId(input.request.runtimePolicyScope?.orgId);
-	if (!orgId.ok) return {
-		ok: false,
-		code: "invalid_body",
-		message: orgId.error.message
-	};
-	const restartOffer = isTruthyBoundaryFlag(input.request.restartRegistrationOffer);
-	return await input.consumeRateLimit({
-		scope: "googleRegistrationAttempt",
-		action: restartOffer ? "google_email_otp_registration_offer_restart" : "google_email_otp_registration_create",
-		userId: normalizeOptionalTrimmedString(input.request.providerUserId),
-		providerSubject: providerSubject.value,
-		orgId: orgId.value,
-		clientIp: normalizeOptionalTrimmedString(input.request.clientIp)
-	});
-}
-async function resolveGoogleEmailOtpSessionWithDeps(input) {
-	const providerSubject = normalizeOptionalTrimmedString(input.request.providerSubject ?? input.request.sub);
-	if (!providerSubject || !providerSubject.startsWith("google:")) throw new Error("Cannot resolve Google Email OTP session without Google provider subject");
-	const accountMode = normalizeOptionalTrimmedString(input.request.accountMode)?.toLowerCase();
-	if (accountMode !== "register" && accountMode !== "login") throw new Error("Google Email OTP accountMode must be register or login");
-	const email = normalizeOptionalTrimmedString(input.request.email)?.toLowerCase() || "";
-	const orgId = normalizeOptionalTrimmedString(input.request.runtimePolicyScope?.orgId) || "";
-	if (!orgId) throw new Error("Google Email OTP requires orgId tenant scope");
-	const ownerProofBindingDigest = normalizeOptionalTrimmedString(input.request.ownerProofBindingDigest);
-	if (accountMode === "register" && !ownerProofBindingDigest) throw new Error("Google Email OTP registration requires ownerProofBindingDigest");
-	if (accountMode === "login") return await resolveGoogleEmailOtpLoginSession({
-		request: {
-			providerSubject,
-			email,
-			orgId
-		},
-		identityStore: input.identityStore,
-		walletEnrollmentStore: input.walletEnrollmentStore,
-		isHostedHmacReadableWalletId: input.isHostedHmacReadableWalletId
-	});
-	return await resolveGoogleEmailOtpRegistrationSession({
-		request: {
-			providerSubject,
-			email,
-			orgId,
-			ownerProofBindingDigest,
-			runtimePolicyScope: input.request.runtimePolicyScope,
-			restartRegistrationOffer: isTruthyBoundaryFlag(input.request.restartRegistrationOffer)
-		},
-		identityStore: input.identityStore,
-		registrationAttemptStore: input.registrationAttemptStore,
-		walletEnrollmentStore: input.walletEnrollmentStore,
-		deriveHostedWalletId: input.deriveHostedWalletId,
-		isHostedHmacReadableWalletId: input.isHostedHmacReadableWalletId
-	});
-}
-async function completeGoogleEmailOtpRegistrationAttemptWithStore(input) {
-	const registrationAttemptId = normalizeOptionalTrimmedString(input.registrationAttemptId);
-	if (!registrationAttemptId) return { ok: true };
-	const walletId = normalizeOptionalTrimmedString(input.walletId);
-	const attempt = await input.registrationAttemptStore.get(registrationAttemptId);
-	if (!attempt) return {
-		ok: false,
-		code: "registration_incomplete",
-		message: "Google Email OTP registration attempt expired or was not found"
-	};
-	if (attempt.expiresAtMs <= input.nowMs) {
-		await input.registrationAttemptStore.put({
-			...attempt,
-			state: "expired",
-			updatedAtMs: input.nowMs
-		});
-		return {
-			ok: false,
-			code: "registration_incomplete",
-			message: "Google Email OTP registration attempt expired"
-		};
-	}
-	if (walletId !== attempt.walletId) return {
-		ok: false,
-		code: "wallet_identity_mismatch",
-		message: "registrationAttemptId does not match walletId"
-	};
-	if (attempt.state === "active") return { ok: true };
-	if (attempt.state !== "started" && attempt.state !== "key_finalized") return {
-		ok: false,
-		code: "registration_incomplete",
-		message: "Google Email OTP registration attempt is no longer active"
-	};
-	const linked = await input.identityStore.linkSubjectToUserId({
-		userId: attempt.walletId,
-		subject: `wallet:${attempt.providerSubject}`,
-		allowMoveIfSoleIdentity: true
-	});
-	if (!linked.ok) {
-		await input.registrationAttemptStore.put({
-			...attempt,
-			state: "failed",
-			failureCode: linked.code,
-			updatedAtMs: input.nowMs
-		});
-		return {
-			ok: false,
-			code: linked.code,
-			message: linked.message
-		};
-	}
-	await input.registrationAttemptStore.put({
-		...attempt,
-		state: "active",
-		updatedAtMs: input.nowMs
-	});
-	return { ok: true };
-}
-async function validateGoogleEmailOtpRegistrationCandidateWalletWithStore(input) {
-	const registrationAttemptId = normalizeOptionalTrimmedString(input.registrationAttemptId);
-	const walletId = normalizeOptionalTrimmedString(input.walletId);
-	const ownerProofBindingDigest = normalizeOptionalTrimmedString(input.ownerProofBindingDigest);
-	const providerSubject = normalizeOptionalTrimmedString(input.providerSubject);
-	if (!registrationAttemptId || !walletId || !ownerProofBindingDigest || !providerSubject) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Google Email OTP registration candidate validation requires signed session scope"
-	};
-	const attempt = await input.registrationAttemptStore.get(registrationAttemptId);
-	if (!attempt) return {
-		ok: false,
-		code: "registration_attempt_missing",
-		message: "Google Email OTP registration attempt expired or was not found"
-	};
-	if (attempt.expiresAtMs <= input.nowMs) {
-		await input.registrationAttemptStore.put({
-			...attempt,
-			state: "expired",
-			updatedAtMs: input.nowMs
-		});
-		return {
-			ok: false,
-			code: "registration_attempt_expired",
-			message: "Google Email OTP registration attempt expired"
-		};
-	}
-	if (attempt.providerSubject !== providerSubject) return {
-		ok: false,
-		code: "challenge_subject_mismatch",
-		message: "Email OTP registration attempt does not match the provider subject"
-	};
-	if (attempt.ownerProofBindingDigest !== ownerProofBindingDigest) return {
-		ok: false,
-		code: "owner_proof_binding_mismatch",
-		message: "Google Email OTP registration attempt does not match the owner proof binding"
-	};
-	if (attempt.state !== "started" && attempt.state !== "key_finalized") return {
-		ok: false,
-		code: "registration_incomplete",
-		message: "Google Email OTP registration attempt is no longer active"
-	};
-	if (!findGoogleEmailOtpOfferCandidateByWalletId({
-		candidates: attempt.offerCandidates,
-		walletId
-	})) return {
-		ok: false,
-		code: "wallet_identity_mismatch",
-		message: "walletId is not an active Google Email OTP registration candidate"
-	};
-	return { ok: true };
-}
-async function recordGoogleEmailOtpRegistrationAttemptPublicKeyWithStore(input) {
-	const registrationAttemptId = normalizeOptionalTrimmedString(input.registrationAttemptId);
-	if (!registrationAttemptId) return { ok: true };
-	const walletId = normalizeOptionalTrimmedString(input.walletId);
-	const finalizedPublicKey = normalizeOptionalTrimmedString(input.finalizedPublicKey);
-	const attempt = await input.registrationAttemptStore.get(registrationAttemptId);
-	if (!attempt) return {
-		ok: false,
-		code: "registration_incomplete",
-		message: "Google Email OTP registration attempt expired or was not found"
-	};
-	if (attempt.expiresAtMs <= input.nowMs) {
-		await input.registrationAttemptStore.put({
-			...attempt,
-			state: "expired",
-			updatedAtMs: input.nowMs
-		});
-		return {
-			ok: false,
-			code: "registration_incomplete",
-			message: "Google Email OTP registration attempt expired"
-		};
-	}
-	if (walletId !== attempt.walletId) return {
-		ok: false,
-		code: "wallet_identity_mismatch",
-		message: "registrationAttemptId does not match walletId"
-	};
-	if (attempt.state !== "started" && attempt.state !== "key_finalized" && attempt.state !== "active") return {
-		ok: false,
-		code: "registration_incomplete",
-		message: "Google Email OTP registration attempt is no longer active"
-	};
-	if (attempt.state === "started") {
-		if (!finalizedPublicKey) await input.registrationAttemptStore.put({
-			...attempt,
-			updatedAtMs: input.nowMs
-		});
-		else await input.registrationAttemptStore.put({
-			...attempt,
-			state: "key_finalized",
-			finalizedPublicKey,
-			updatedAtMs: input.nowMs
-		});
-		return { ok: true };
-	}
-	await input.registrationAttemptStore.put({
-		...attempt,
-		...finalizedPublicKey ? { finalizedPublicKey } : {},
-		updatedAtMs: input.nowMs
-	});
-	return { ok: true };
-}
-async function failGoogleEmailOtpRegistrationAttemptWithStore(input) {
-	const registrationAttemptId = normalizeOptionalTrimmedString(input.registrationAttemptId);
-	if (!registrationAttemptId) return;
-	const attempt = await input.registrationAttemptStore.get(registrationAttemptId);
-	if (!attempt) return;
-	const walletId = normalizeOptionalTrimmedString(input.walletId);
-	if (walletId && walletId !== attempt.walletId) return;
-	await input.registrationAttemptStore.put({
-		...attempt,
-		state: "failed",
-		failureCode: normalizeOptionalTrimmedString(input.failureCode) || "failed",
-		updatedAtMs: input.nowMs
-	});
-}
-async function cleanupGoogleEmailOtpDevRegistrationStateWithStores(input) {
-	if (input.isProductionEnvironment) return {
-		ok: false,
-		code: "not_found",
-		message: "Google Email OTP dev cleanup is not available"
-	};
-	const providerSubject = normalizeOptionalTrimmedString(input.providerSubject);
-	if (!providerSubject || !providerSubject.startsWith("google:")) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Missing Google provider subject"
-	};
-	const requestedWalletId = normalizeOptionalTrimmedString(input.walletId);
-	const requestedOrgId = normalizeOptionalTrimmedString(input.orgId);
-	const nowMsRaw = typeof input.nowMs === "number" ? input.nowMs : Number(input.nowMs);
-	const nowMs = Number.isFinite(nowMsRaw) && nowMsRaw > 0 ? Math.floor(nowMsRaw) : Date.now();
-	const expiredRegistrationAttemptsDeleted = await input.registrationAttemptStore.deleteExpired(nowMs);
-	const subject = `wallet:${providerSubject}`;
-	const linkedWalletId = await input.identityStore.getUserIdBySubject(subject);
-	if (!linkedWalletId) return {
-		ok: true,
-		providerSubject,
-		expiredRegistrationAttemptsDeleted,
-		orphanedWalletMappingRemoved: false,
-		orphanedWalletMappingSkippedReason: "no_linked_wallet"
-	};
-	if (requestedWalletId && requestedWalletId !== linkedWalletId) return {
-		ok: true,
-		providerSubject,
-		expiredRegistrationAttemptsDeleted,
-		linkedWalletId,
-		orphanedWalletMappingRemoved: false,
-		orphanedWalletMappingSkippedReason: "wallet_id_mismatch"
-	};
-	if (!input.isHostedHmacReadableWalletId(linkedWalletId)) return {
-		ok: true,
-		providerSubject,
-		expiredRegistrationAttemptsDeleted,
-		linkedWalletId,
-		orphanedWalletMappingRemoved: false,
-		orphanedWalletMappingSkippedReason: "not_relayer_subaccount"
-	};
-	const activeEnrollment = await input.walletEnrollmentStore.get(linkedWalletId);
-	if (activeEnrollment) {
-		const enrollmentMatchesProvider = activeEnrollment.providerUserId === providerSubject;
-		const enrollmentMatchesOrg = !requestedOrgId || activeEnrollment.orgId === requestedOrgId;
-		if (enrollmentMatchesProvider && enrollmentMatchesOrg) return {
-			ok: true,
-			providerSubject,
-			expiredRegistrationAttemptsDeleted,
-			linkedWalletId,
-			orphanedWalletMappingRemoved: false,
-			orphanedWalletMappingSkippedReason: "active_email_otp_enrollment"
-		};
-	}
-	const deleted = await input.identityStore.deleteSubjectLinkForDevCleanup({
-		userId: linkedWalletId,
-		subject
-	});
-	if (!deleted.ok && deleted.code !== "not_found") return deleted;
-	return {
-		ok: true,
-		providerSubject,
-		expiredRegistrationAttemptsDeleted,
-		linkedWalletId,
-		orphanedWalletMappingRemoved: deleted.ok
-	};
-}
-async function resolveGoogleEmailOtpLoginSession(input) {
-	const wallet = `wallet:${input.request.providerSubject}`;
-	const linkedWalletId = await input.identityStore.getUserIdBySubject(wallet);
-	const hostedLinkedWalletId = linkedWalletId && input.isHostedHmacReadableWalletId(linkedWalletId) ? linkedWalletId : null;
-	if (hostedLinkedWalletId) {
-		const enrollment = await readActiveEmailOtpEnrollmentWithStore({
-			walletEnrollmentStore: input.walletEnrollmentStore,
-			request: {
-				walletId: hostedLinkedWalletId,
-				orgId: input.request.orgId,
-				providerUserId: input.request.providerSubject
-			}
-		});
-		if (enrollment.ok) return {
-			ok: true,
-			mode: "existing_wallet",
-			walletId: hostedLinkedWalletId,
-			providerSubject: input.request.providerSubject,
-			email: enrollment.enrollment.verifiedEmail,
-			hasEmailOtpEnrollment: true
-		};
-		if (!isGoogleEmailOtpEnrollmentLookupMiss(enrollment.code)) {
-			const error = new Error(enrollment.message);
-			error.code = enrollment.code;
-			throw error;
-		}
-	}
-	const discovered = await getGoogleEmailOtpEnrollmentBySubject({
-		walletEnrollmentStore: input.walletEnrollmentStore,
-		providerSubject: input.request.providerSubject,
-		orgId: input.request.orgId,
-		isHostedHmacReadableWalletId: input.isHostedHmacReadableWalletId
-	});
-	if (!discovered) {
-		if (linkedWalletId) {
-			const stale = googleEmailOtpStaleIdentityMapping({
-				providerSubject: input.request.providerSubject,
-				linkedWalletId,
-				...input.request.email ? { email: input.request.email } : {}
-			});
-			const error = new Error(stale.message);
-			error.code = stale.code;
-			throw error;
-		}
-		const error = /* @__PURE__ */ new Error("Email OTP enrollment not found");
-		error.code = "not_found";
-		throw error;
-	}
-	const repaired = await repairGoogleEmailOtpWalletLink({
-		identityStore: input.identityStore,
-		providerSubject: input.request.providerSubject,
-		walletId: discovered.walletId
-	});
-	if (!repaired.ok) {
-		const error = new Error(repaired.message);
-		error.code = repaired.code;
-		throw error;
-	}
-	return {
-		ok: true,
-		mode: "existing_wallet",
-		walletId: discovered.walletId,
-		providerSubject: input.request.providerSubject,
-		email: discovered.verifiedEmail,
-		hasEmailOtpEnrollment: true
-	};
-}
-async function resolveGoogleEmailOtpRegistrationSession(input) {
-	if (!input.request.email) throw new Error("Email is required to register a Google Email OTP wallet id");
-	const discoveredExistingEnrollment = await getGoogleEmailOtpEnrollmentBySubject({
-		walletEnrollmentStore: input.walletEnrollmentStore,
-		providerSubject: input.request.providerSubject,
-		orgId: input.request.orgId,
-		isHostedHmacReadableWalletId: input.isHostedHmacReadableWalletId
-	});
-	if (discoveredExistingEnrollment && !input.request.restartRegistrationOffer) return await resolveRegistrationForExistingEnrollment({
-		identityStore: input.identityStore,
-		providerSubject: input.request.providerSubject,
-		email: input.request.email,
-		enrollment: discoveredExistingEnrollment
-	});
-	const wallet = `wallet:${input.request.providerSubject}`;
-	const linkedWalletId = await input.identityStore.getUserIdBySubject(wallet);
-	if (linkedWalletId && !input.request.restartRegistrationOffer) return googleEmailOtpStaleIdentityMapping({
-		providerSubject: input.request.providerSubject,
-		linkedWalletId,
-		email: input.request.email
-	});
-	const now = Date.now();
-	await input.registrationAttemptStore.abandonStartedBySubjectEmailExceptBinding({
-		providerSubject: input.request.providerSubject,
-		email: input.request.email,
-		orgId: input.request.orgId,
-		ownerProofBindingDigest: input.request.ownerProofBindingDigest,
-		...input.request.runtimePolicyScope ? { runtimePolicyScope: input.request.runtimePolicyScope } : {},
-		nowMs: now,
-		failureCode: "owner_proof_binding_replaced"
-	});
-	const startedAttempt = await findStartedGoogleEmailOtpRegistrationAttempt({
-		registrationAttemptStore: input.registrationAttemptStore,
-		providerSubject: input.request.providerSubject,
-		email: input.request.email,
-		orgId: input.request.orgId,
-		ownerProofBindingDigest: input.request.ownerProofBindingDigest,
-		runtimePolicyScope: input.request.runtimePolicyScope,
-		isHostedHmacReadableWalletId: input.isHostedHmacReadableWalletId
-	});
-	if (startedAttempt) if (input.request.restartRegistrationOffer) await input.registrationAttemptStore.put({
-		...startedAttempt,
-		state: "abandoned",
-		failureCode: "offer_restarted_by_user",
-		updatedAtMs: Date.now()
-	});
-	else return registrationAttemptStartedResponse({
-		attempt: startedAttempt,
-		providerSubject: input.request.providerSubject,
-		email: input.request.email
-	});
-	return await createGoogleEmailOtpRegistrationOffer({
-		request: input.request,
-		identityStore: input.identityStore,
-		registrationAttemptStore: input.registrationAttemptStore,
-		walletEnrollmentStore: input.walletEnrollmentStore,
-		deriveHostedWalletId: input.deriveHostedWalletId
-	});
-}
-async function resolveRegistrationForExistingEnrollment(input) {
-	const repaired = await repairGoogleEmailOtpWalletLink({
-		identityStore: input.identityStore,
-		providerSubject: input.providerSubject,
-		walletId: input.enrollment.walletId
-	});
-	if (!repaired.ok) return {
-		ok: false,
-		mode: "registration_incomplete",
-		code: "registration_incomplete",
-		walletId: input.enrollment.walletId,
-		providerSubject: input.providerSubject,
-		email: input.email,
-		message: repaired.message
-	};
-	return {
-		ok: true,
-		mode: "existing_wallet",
-		walletId: input.enrollment.walletId,
-		providerSubject: input.providerSubject,
-		email: input.email,
-		hasEmailOtpEnrollment: true
-	};
-}
-async function createGoogleEmailOtpRegistrationOffer(input) {
-	const nowMs = Date.now();
-	const authProvider = "google_oidc";
-	const walletIdDerivationNonce = randomOpaqueId(18);
-	const offerCandidates = [];
-	for (let attempt = 0; attempt < 30 && offerCandidates.length < 5; attempt += 1) {
-		const candidate = await input.deriveHostedWalletId({
-			providerSubject: input.request.providerSubject,
-			email: input.request.email,
-			authProvider,
-			walletIdDerivationNonce,
-			...input.request.runtimePolicyScope ? { runtimePolicyScope: input.request.runtimePolicyScope } : {},
-			...attempt ? { collisionCounter: attempt } : {}
-		});
-		const inUseByLiveAttempt = await input.registrationAttemptStore.hasLiveStartedWalletAttempt({
-			walletId: candidate,
-			nowMs
-		});
-		if (await input.walletEnrollmentStore.get(candidate) || inUseByLiveAttempt) continue;
-		if (hasDifferentWalletIdentityLink(await input.identityStore.listSubjectsByUserId(candidate), `wallet:${input.request.providerSubject}`)) continue;
-		offerCandidates.push({
-			candidateId: randomOpaqueId(18),
-			walletId: candidate,
-			collisionCounter: attempt
-		});
-	}
-	const [selectedCandidate, ...remainingOfferCandidates] = offerCandidates;
-	if (!selectedCandidate) return {
-		ok: false,
-		mode: "registration_incomplete",
-		code: "registration_incomplete",
-		providerSubject: input.request.providerSubject,
-		email: input.request.email,
-		message: "Unable to allocate a fresh Google Email OTP registration attempt"
-	};
-	const nonEmptyOfferCandidates = [selectedCandidate, ...remainingOfferCandidates];
-	const walletId = selectedCandidate.walletId;
-	const offerId = randomOpaqueId(18);
-	return registrationAttemptStartedResponse({
-		attempt: await createGoogleEmailOtpRegistrationAttempt({
-			registrationAttemptStore: input.registrationAttemptStore,
-			providerSubject: input.request.providerSubject,
-			email: input.request.email,
-			walletId,
-			offerId,
-			offerCandidates: nonEmptyOfferCandidates,
-			selectedCandidateId: selectedCandidate.candidateId,
-			ownerProofBindingDigest: input.request.ownerProofBindingDigest,
-			authProvider,
-			walletIdDerivationNonce,
-			collisionCounter: selectedCandidate.collisionCounter,
-			runtimePolicyScope: input.request.runtimePolicyScope
-		}),
-		providerSubject: input.request.providerSubject,
-		email: input.request.email
-	});
-}
-async function createGoogleEmailOtpRegistrationAttempt(input) {
-	const now = Date.now();
-	await cleanupGoogleEmailOtpRegistrationAttemptsWithStore({
-		registrationAttemptStore: input.registrationAttemptStore,
-		nowMs: now
-	});
-	const attempt = {
-		version: "google_email_otp_registration_attempt_v1",
-		attemptId: randomOpaqueId(18),
-		providerSubject: input.providerSubject,
-		email: input.email,
-		walletId: input.walletId,
-		offerId: input.offerId,
-		offerCandidates: input.offerCandidates,
-		selectedCandidateId: input.selectedCandidateId,
-		ownerProofBindingDigest: input.ownerProofBindingDigest,
-		authProvider: input.authProvider,
-		accountIdSlugVersion: "hmac_readable_v1",
-		walletIdDerivationNonce: input.walletIdDerivationNonce,
-		collisionCounter: input.collisionCounter,
-		state: "started",
-		createdAtMs: now,
-		updatedAtMs: now,
-		expiresAtMs: now + 1800 * 1e3,
-		...input.runtimePolicyScope ? { runtimePolicyScope: input.runtimePolicyScope } : {}
-	};
-	await input.registrationAttemptStore.put(attempt);
-	return attempt;
-}
-async function findStartedGoogleEmailOtpRegistrationAttempt(input) {
-	const now = Date.now();
-	await cleanupGoogleEmailOtpRegistrationAttemptsWithStore({
-		registrationAttemptStore: input.registrationAttemptStore,
-		nowMs: now
-	});
-	const attempt = await input.registrationAttemptStore.findStartedBySubjectEmail({
-		providerSubject: input.providerSubject,
-		email: input.email,
-		orgId: input.orgId,
-		ownerProofBindingDigest: input.ownerProofBindingDigest,
-		...input.runtimePolicyScope ? { runtimePolicyScope: input.runtimePolicyScope } : {},
-		nowMs: now
-	});
-	if (!attempt) return null;
-	if (!input.isHostedHmacReadableWalletId(attempt.walletId)) {
-		await input.registrationAttemptStore.put({
-			...attempt,
-			state: "failed",
-			failureCode: "non_hmac_readable_wallet_id",
-			updatedAtMs: now
-		});
-		return null;
-	}
-	const refreshedAttempt = {
-		...attempt,
-		updatedAtMs: now
-	};
-	await input.registrationAttemptStore.put(refreshedAttempt);
-	return refreshedAttempt;
-}
-async function getGoogleEmailOtpEnrollmentBySubject(input) {
-	const providerSubject = normalizeOptionalTrimmedString(input.providerSubject);
-	const orgId = normalizeOptionalTrimmedString(input.orgId);
-	if (!providerSubject || !orgId) return null;
-	const enrollment = await input.walletEnrollmentStore.getByProviderUserId({
-		providerUserId: providerSubject,
-		orgId
-	});
-	if (!enrollment || enrollment.providerUserId !== providerSubject || enrollment.orgId !== orgId || !input.isHostedHmacReadableWalletId(enrollment.walletId)) return null;
-	return enrollment;
-}
-async function repairGoogleEmailOtpWalletLink(input) {
-	const linked = await input.identityStore.linkSubjectToUserId({
-		userId: input.walletId,
-		subject: `wallet:${input.providerSubject}`,
-		allowMoveIfSoleIdentity: true
-	});
-	if (!linked.ok) return {
-		ok: false,
-		code: linked.code,
-		message: linked.message
-	};
-	return { ok: true };
-}
-function isGoogleEmailOtpEnrollmentLookupMiss(code) {
-	return code === "not_found" || code === "provider_identity_mismatch" || code === "tenant_scope_mismatch";
-}
-function googleEmailOtpStaleIdentityMapping(input) {
-	return {
-		ok: false,
-		mode: "stale_identity_mapping",
-		code: "stale_identity_mapping",
-		walletId: input.linkedWalletId,
-		providerSubject: input.providerSubject,
-		...input.email ? { email: input.email } : {},
-		message: GOOGLE_EMAIL_OTP_STALE_IDENTITY_MESSAGE
-	};
-}
-function registrationAttemptStartedResponse(input) {
-	return {
-		ok: true,
-		mode: "register_started",
-		walletId: input.attempt.walletId,
-		providerSubject: input.providerSubject,
-		email: input.email,
-		registrationAttemptId: input.attempt.attemptId,
-		expiresAtMs: input.attempt.expiresAtMs,
-		offer: googleEmailOtpRegistrationOfferResponse(input.attempt)
-	};
-}
-function googleEmailOtpRegistrationOfferResponse(attempt) {
-	const [firstOfferCandidate, ...remainingOfferCandidates] = attempt.offerCandidates;
-	const remainingCandidates = googleEmailOtpRegistrationOfferCandidateResponses(remainingOfferCandidates);
-	return {
-		offerId: attempt.offerId,
-		selectedCandidateId: attempt.selectedCandidateId,
-		candidates: [googleEmailOtpRegistrationOfferCandidateResponse(firstOfferCandidate), ...remainingCandidates]
-	};
-}
-function googleEmailOtpRegistrationOfferCandidateResponses(candidates) {
-	const out = [];
-	for (const candidate of candidates) out.push(googleEmailOtpRegistrationOfferCandidateResponse(candidate));
-	return out;
-}
-function googleEmailOtpRegistrationOfferCandidateResponse(candidate) {
-	return {
-		candidateId: candidate.candidateId,
-		walletId: candidate.walletId
-	};
-}
-function findGoogleEmailOtpOfferCandidateByWalletId(input) {
-	for (const candidate of input.candidates) if (candidate.walletId === input.walletId) return candidate;
-	return null;
-}
-function hasDifferentWalletIdentityLink(subjects, expectedWalletSubject) {
-	for (const subject of subjects) if (subject.startsWith("wallet:") && subject !== expectedWalletSubject) return true;
-	return false;
-}
-function isTruthyBoundaryFlag(value) {
-	return value === true || String(value || "").trim().toLowerCase() === "true";
-}
-//#endregion
-export { cleanupGoogleEmailOtpDevRegistrationStateWithStores, completeGoogleEmailOtpRegistrationAttemptWithStore, consumeGoogleEmailOtpRegistrationAttemptRateLimitWithDeps, failGoogleEmailOtpRegistrationAttemptWithStore, recordGoogleEmailOtpRegistrationAttemptPublicKeyWithStore, resolveGoogleEmailOtpSessionWithDeps, validateGoogleEmailOtpRegistrationCandidateWalletWithStore };
-
-//# sourceMappingURL=googleEmailOtpRegistration.js.map