@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/core/EmailOtpStores.js

@@ -1,859 +0,0 @@
-import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
-import { isPlainObject } from "../shared-ts/src/utils/validation.js";
-import { d1ChangedRows, resolveD1DatabaseFromConfig } from "../storage/d1Sql.js";
-import { D1TenantTable, d1TenantScopeFromConfig, resolveStorePrefix } from "./d1TenantStore.js";
-import { parseCurrentEmailOtpAuthStateRecord, parseCurrentEmailOtpAuthStateRow, parseCurrentEmailOtpChallengeRecord, parseCurrentEmailOtpChallengeRow, parseCurrentEmailOtpGrantRecord, parseCurrentEmailOtpGrantRow, parseCurrentEmailOtpUnlockChallengeRecord, parseCurrentEmailOtpUnlockChallengeRow, parseCurrentEmailOtpWalletEnrollmentRecord, parseCurrentEmailOtpWalletEnrollmentRow, parseCurrentGoogleEmailOtpRegistrationAttemptRecord, parseCurrentGoogleEmailOtpRegistrationAttemptRow, parseJsonRecord, registrationAttemptMatchesReplacementScope, registrationAttemptMatchesStartedScope } from "./EmailOtpRecords.js";
-import { emailOtpAuthStateRows, emailOtpChallengeRows, emailOtpGrantRows, emailOtpRegistrationAttemptRows, emailOtpUnlockChallengeRows, emailOtpWalletEnrollmentRows } from "./emailOtpD1Statements.js";
-//#region src/core/EmailOtpStores.ts
-/** Names the Email OTP stores in D1 scope errors. */
-const EMAIL_OTP_D1_STORE = "Email OTP store";
-const EMAIL_OTP_STORE_D1_SCHEMA_SQL = Object.freeze([
-	`
-    CREATE TABLE IF NOT EXISTS email_otp_challenges (
-      namespace TEXT NOT NULL,
-      org_id TEXT NOT NULL,
-      project_id TEXT NOT NULL,
-      env_id TEXT NOT NULL,
-      challenge_id TEXT NOT NULL,
-      challenge_subject_id TEXT NOT NULL,
-      wallet_id TEXT NOT NULL,
-      record_org_id TEXT NOT NULL,
-      otp_channel TEXT NOT NULL,
-      owner_proof_binding_digest TEXT NOT NULL,
-      action TEXT NOT NULL,
-      operation TEXT NOT NULL,
-      otp_code TEXT NOT NULL,
-      record_json TEXT NOT NULL,
-      created_at_ms INTEGER NOT NULL,
-      expires_at_ms INTEGER NOT NULL,
-      PRIMARY KEY (namespace, org_id, project_id, env_id, challenge_id),
-      CHECK (length(challenge_id) > 0),
-      CHECK (length(challenge_subject_id) > 0),
-      CHECK (length(wallet_id) > 0),
-      CHECK (otp_channel = 'email_otp'),
-      CHECK (length(owner_proof_binding_digest) > 0),
-      CHECK (length(action) > 0),
-      CHECK (length(operation) > 0),
-      CHECK (length(otp_code) > 0),
-      CHECK (json_valid(record_json)),
-      CHECK (created_at_ms > 0),
-      CHECK (expires_at_ms > created_at_ms)
-    )
-  `,
-	`
-    CREATE INDEX IF NOT EXISTS email_otp_challenges_context_idx
-      ON email_otp_challenges (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        challenge_subject_id,
-        wallet_id,
-        record_org_id,
-        otp_channel,
-        owner_proof_binding_digest,
-        action,
-        operation,
-        expires_at_ms
-      )
-  `,
-	`
-    CREATE INDEX IF NOT EXISTS email_otp_challenges_expires_idx
-      ON email_otp_challenges (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        expires_at_ms
-      )
-  `,
-	`
-    CREATE TABLE IF NOT EXISTS email_otp_grants (
-      namespace TEXT NOT NULL,
-      org_id TEXT NOT NULL,
-      project_id TEXT NOT NULL,
-      env_id TEXT NOT NULL,
-      grant_token TEXT NOT NULL,
-      user_id TEXT NOT NULL,
-      wallet_id TEXT NOT NULL,
-      record_org_id TEXT NOT NULL,
-      challenge_id TEXT NOT NULL,
-      action TEXT NOT NULL,
-      record_json TEXT NOT NULL,
-      issued_at_ms INTEGER NOT NULL,
-      expires_at_ms INTEGER NOT NULL,
-      PRIMARY KEY (namespace, org_id, project_id, env_id, grant_token),
-      CHECK (length(grant_token) > 0),
-      CHECK (length(user_id) > 0),
-      CHECK (length(wallet_id) > 0),
-      CHECK (length(challenge_id) > 0),
-      CHECK (length(action) > 0),
-      CHECK (json_valid(record_json)),
-      CHECK (issued_at_ms > 0),
-      CHECK (expires_at_ms > issued_at_ms)
-    )
-  `,
-	`
-    CREATE INDEX IF NOT EXISTS email_otp_grants_expires_idx
-      ON email_otp_grants (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        expires_at_ms
-      )
-  `,
-	`
-    CREATE TABLE IF NOT EXISTS email_otp_wallet_enrollments (
-      namespace TEXT NOT NULL,
-      org_id TEXT NOT NULL,
-      project_id TEXT NOT NULL,
-      env_id TEXT NOT NULL,
-      wallet_id TEXT NOT NULL,
-      provider_user_id TEXT NOT NULL,
-      record_org_id TEXT NOT NULL,
-      verified_email TEXT NOT NULL,
-      record_json TEXT NOT NULL,
-      created_at_ms INTEGER NOT NULL,
-      updated_at_ms INTEGER NOT NULL,
-      PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_id),
-      CHECK (length(wallet_id) > 0),
-      CHECK (length(provider_user_id) > 0),
-      CHECK (length(record_org_id) > 0),
-      CHECK (length(verified_email) > 0),
-      CHECK (json_valid(record_json)),
-      CHECK (created_at_ms > 0),
-      CHECK (updated_at_ms > 0)
-    )
-  `,
-	`
-    CREATE INDEX IF NOT EXISTS email_otp_wallet_enrollments_provider_idx
-      ON email_otp_wallet_enrollments (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        record_org_id,
-        provider_user_id,
-        updated_at_ms
-      )
-  `,
-	`
-    CREATE TABLE IF NOT EXISTS email_otp_auth_states (
-      namespace TEXT NOT NULL,
-      org_id TEXT NOT NULL,
-      project_id TEXT NOT NULL,
-      env_id TEXT NOT NULL,
-      wallet_id TEXT NOT NULL,
-      provider_user_id TEXT NOT NULL,
-      record_org_id TEXT NOT NULL,
-      record_json TEXT NOT NULL,
-      created_at_ms INTEGER NOT NULL,
-      updated_at_ms INTEGER NOT NULL,
-      PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_id),
-      CHECK (length(wallet_id) > 0),
-      CHECK (length(provider_user_id) > 0),
-      CHECK (length(record_org_id) > 0),
-      CHECK (json_valid(record_json)),
-      CHECK (created_at_ms > 0),
-      CHECK (updated_at_ms > 0)
-    )
-  `,
-	`
-    CREATE TABLE IF NOT EXISTS email_otp_unlock_challenges (
-      namespace TEXT NOT NULL,
-      org_id TEXT NOT NULL,
-      project_id TEXT NOT NULL,
-      env_id TEXT NOT NULL,
-      challenge_id TEXT NOT NULL,
-      wallet_id TEXT NOT NULL,
-      user_id TEXT NOT NULL,
-      record_org_id TEXT NOT NULL,
-      record_json TEXT NOT NULL,
-      created_at_ms INTEGER NOT NULL,
-      expires_at_ms INTEGER NOT NULL,
-      PRIMARY KEY (namespace, org_id, project_id, env_id, challenge_id),
-      CHECK (length(challenge_id) > 0),
-      CHECK (length(wallet_id) > 0),
-      CHECK (length(user_id) > 0),
-      CHECK (json_valid(record_json)),
-      CHECK (created_at_ms > 0),
-      CHECK (expires_at_ms > created_at_ms)
-    )
-  `,
-	`
-    CREATE INDEX IF NOT EXISTS email_otp_unlock_challenges_expires_idx
-      ON email_otp_unlock_challenges (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        expires_at_ms
-      )
-  `,
-	`
-    CREATE TABLE IF NOT EXISTS email_otp_registration_attempts (
-      namespace TEXT NOT NULL,
-      org_id TEXT NOT NULL,
-      project_id TEXT NOT NULL,
-      env_id TEXT NOT NULL,
-      attempt_id TEXT NOT NULL,
-      provider_subject TEXT NOT NULL,
-      email TEXT NOT NULL,
-      wallet_id TEXT NOT NULL,
-      state TEXT NOT NULL,
-      owner_proof_binding_digest TEXT NOT NULL,
-      runtime_org_id TEXT NOT NULL,
-      runtime_policy_key TEXT NOT NULL,
-      offer_wallet_ids_json TEXT NOT NULL,
-      record_json TEXT NOT NULL,
-      created_at_ms INTEGER NOT NULL,
-      updated_at_ms INTEGER NOT NULL,
-      expires_at_ms INTEGER NOT NULL,
-      PRIMARY KEY (namespace, org_id, project_id, env_id, attempt_id),
-      CHECK (length(attempt_id) > 0),
-      CHECK (length(provider_subject) > 0),
-      CHECK (length(email) > 0),
-      CHECK (length(wallet_id) > 0),
-      CHECK (state IN ('started', 'key_finalized', 'active', 'abandoned', 'failed', 'expired')),
-      CHECK (length(owner_proof_binding_digest) > 0),
-      CHECK (json_valid(offer_wallet_ids_json)),
-      CHECK (json_valid(record_json)),
-      CHECK (created_at_ms > 0),
-      CHECK (updated_at_ms > 0),
-      CHECK (expires_at_ms > 0)
-    )
-  `,
-	`
-    CREATE INDEX IF NOT EXISTS email_otp_registration_attempts_subject_idx
-      ON email_otp_registration_attempts (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        provider_subject,
-        email,
-        state,
-        expires_at_ms,
-        owner_proof_binding_digest,
-        runtime_org_id,
-        runtime_policy_key,
-        updated_at_ms
-      )
-  `,
-	`
-    CREATE INDEX IF NOT EXISTS email_otp_registration_attempts_wallet_idx
-      ON email_otp_registration_attempts (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        wallet_id,
-        state,
-        expires_at_ms
-      )
-  `
-]);
-/**
-* Selects a store's backend: D1 when the config's `kind` is `d1`, else in memory; any other
-* `kind` is an error. `label` names the store in log lines and errors; the unknown-kind error
-* uses `kindLabel`, which the wallet enrollment store shortens to `enrollment`. The store type
-* `S` comes from the caller's return type.
-*/
-function createEmailOtpStore(input, label, build, kindLabel = label) {
-	const config = isPlainObject(input?.config) ? input.config : {};
-	const kind = normalizeOptionalTrimmedString(config.kind);
-	if (kind === "d1") {
-		const database = resolveD1DatabaseFromConfig(config);
-		if (!database) throw new Error(`[email-otp] D1 ${label} store selected but no D1 database was provided`);
-		const scope = d1TenantScopeFromConfig(config, resolveStorePrefix(config, ["EMAIL_OTP_PREFIX", "EMAIL_OTP_STORE_PREFIX"], "email-otp:"), EMAIL_OTP_D1_STORE);
-		input?.logger?.info(`[email-otp] Using D1 ${label} store`);
-		return build.d1(database, scope);
-	}
-	if (kind && kind !== "in-memory") throw new Error(`[email-otp] Unknown ${kindLabel} store kind: ${kind}`);
-	input?.logger?.info(`[email-otp] Using in-memory ${label} store (non-persistent)`);
-	return build.inMemory();
-}
-const CHALLENGE_RECORD = {
-	label: "Email OTP challenge",
-	parse: parseCurrentEmailOtpChallengeRecord,
-	id: (record) => record.challengeId,
-	orgId: (record) => record.orgId
-};
-const GRANT_RECORD = {
-	label: "Email OTP grant",
-	parse: parseCurrentEmailOtpGrantRecord,
-	id: (record) => record.grantToken,
-	orgId: (record) => record.orgId
-};
-const WALLET_ENROLLMENT_RECORD = {
-	label: "Email OTP wallet enrollment",
-	parse: parseCurrentEmailOtpWalletEnrollmentRecord,
-	id: (record) => record.walletId,
-	orgId: (record) => record.orgId
-};
-const AUTH_STATE_RECORD = {
-	label: "Email OTP auth state",
-	parse: parseCurrentEmailOtpAuthStateRecord,
-	id: (record) => record.walletId,
-	orgId: (record) => record.orgId
-};
-const UNLOCK_CHALLENGE_RECORD = {
-	label: "Email OTP unlock challenge",
-	parse: parseCurrentEmailOtpUnlockChallengeRecord,
-	id: (record) => record.challengeId,
-	orgId: (record) => record.orgId
-};
-const REGISTRATION_ATTEMPT_RECORD = {
-	label: "Google Email OTP registration attempt",
-	parse: parseCurrentGoogleEmailOtpRegistrationAttemptRecord,
-	id: (record) => record.attemptId,
-	orgId: (record) => record.runtimePolicyScope?.orgId
-};
-function parseEmailOtpRecord(spec, record) {
-	const parsed = spec.parse(record);
-	if (!parsed) throw new Error(`Invalid ${spec.label} record`);
-	return parsed;
-}
-function cloneRecord(value) {
-	return JSON.parse(JSON.stringify(value));
-}
-function challengeContextMatches(record, input) {
-	return record.expiresAtMs > input.nowMs && record.challengeSubjectId === input.challengeSubjectId && record.walletId === input.walletId && String(record.orgId || "") === String(input.orgId || "") && record.otpChannel === input.otpChannel && record.ownerProofBindingDigest === input.ownerProofBindingDigest && record.action === input.action && record.operation === input.operation;
-}
-/** Keeps copies of parsed records by id, so no caller shares a stored object. */
-var InMemoryEmailOtpStore = class {
-	constructor(spec) {
-		this.spec = spec;
-		this.map = /* @__PURE__ */ new Map();
-	}
-	async put(record) {
-		this.set(parseEmailOtpRecord(this.spec, record));
-	}
-	set(record) {
-		this.map.set(this.spec.id(record), cloneRecord(record));
-	}
-	async get(id) {
-		const key = normalizeOptionalTrimmedString(id);
-		if (!key) return null;
-		const record = this.map.get(key);
-		return record ? cloneRecord(record) : null;
-	}
-	/** Reads and deletes, so a one-time record is used at most once. */
-	async consume(id) {
-		const key = normalizeOptionalTrimmedString(id);
-		if (!key) return null;
-		const record = this.map.get(key);
-		this.map.delete(key);
-		return record ? cloneRecord(record) : null;
-	}
-	async del(id) {
-		const key = normalizeOptionalTrimmedString(id);
-		if (!key) return;
-		this.map.delete(key);
-	}
-};
-var InMemoryEmailOtpChallengeStore = class extends InMemoryEmailOtpStore {
-	constructor() {
-		super(CHALLENGE_RECORD);
-	}
-	async deleteExpired(nowMs) {
-		const deleted = [];
-		for (const [challengeId, record] of this.map.entries()) {
-			if (record.expiresAtMs > nowMs) continue;
-			this.map.delete(challengeId);
-			deleted.push(cloneRecord(record));
-		}
-		return deleted;
-	}
-	async countActiveByContext(input) {
-		let count = 0;
-		for (const record of this.map.values()) {
-			if (!challengeContextMatches(record, input)) continue;
-			count += 1;
-		}
-		return count;
-	}
-	async findLatestActiveByContext(input) {
-		let latest = null;
-		for (const record of this.map.values()) {
-			if (!challengeContextMatches(record, input)) continue;
-			if (!latest || record.expiresAtMs > latest.expiresAtMs) latest = record;
-		}
-		return latest ? cloneRecord(latest) : null;
-	}
-	async deleteOldestActiveByContext(input) {
-		let oldest = null;
-		for (const record of this.map.values()) {
-			if (!challengeContextMatches(record, input)) continue;
-			if (!oldest || record.createdAtMs < oldest.createdAtMs) oldest = record;
-		}
-		if (!oldest) return null;
-		this.map.delete(oldest.challengeId);
-		return cloneRecord(oldest);
-	}
-	async findActiveByContext(input) {
-		for (const record of this.map.values()) {
-			if (!challengeContextMatches(record, input)) continue;
-			if (record.otpCode !== input.otpCode) continue;
-			return cloneRecord(record);
-		}
-		return null;
-	}
-};
-var InMemoryEmailOtpWalletEnrollmentStore = class extends InMemoryEmailOtpStore {
-	constructor() {
-		super(WALLET_ENROLLMENT_RECORD);
-	}
-	async getByProviderUserId(input) {
-		const providerUserId = normalizeOptionalTrimmedString(input.providerUserId);
-		const orgId = normalizeOptionalTrimmedString(input.orgId);
-		if (!providerUserId || !orgId) return null;
-		const record = Array.from(this.map.values()).find((candidate) => candidate.providerUserId === providerUserId && candidate.orgId === orgId) || null;
-		return record ? cloneRecord(record) : null;
-	}
-	async put(record) {
-		const parsed = parseEmailOtpRecord(this.spec, record);
-		if (Array.from(this.map.values()).find((existing) => existing.walletId !== parsed.walletId && existing.orgId === parsed.orgId && existing.providerUserId === parsed.providerUserId)) throw new Error("Email OTP wallet enrollment already exists for this provider user in org");
-		this.set(parsed);
-	}
-};
-var InMemoryEmailOtpRegistrationAttemptStore = class extends InMemoryEmailOtpStore {
-	constructor() {
-		super(REGISTRATION_ATTEMPT_RECORD);
-	}
-	async findStartedBySubjectEmail(input) {
-		for (const record of this.map.values()) if (registrationAttemptMatchesStartedScope(record, input)) return cloneRecord(record);
-		return null;
-	}
-	async abandonStartedBySubjectEmailExceptBinding(input) {
-		let abandoned = 0;
-		for (const record of this.map.values()) {
-			if (!registrationAttemptMatchesReplacementScope(record, input)) continue;
-			this.map.set(record.attemptId, {
-				...cloneRecord(record),
-				state: "abandoned",
-				failureCode: input.failureCode,
-				updatedAtMs: input.nowMs
-			});
-			abandoned += 1;
-		}
-		return abandoned;
-	}
-	async hasLiveStartedWalletAttempt(input) {
-		for (const record of this.map.values()) if ((record.state === "started" || record.state === "key_finalized") && record.expiresAtMs > input.nowMs && (record.walletId === input.walletId || record.offerCandidates.some((candidate) => candidate.walletId === input.walletId))) return true;
-		return false;
-	}
-	async deleteExpired(nowMs) {
-		let deleted = 0;
-		for (const [attemptId, record] of this.map.entries()) if (record.expiresAtMs <= nowMs || record.state === "expired") {
-			this.map.delete(attemptId);
-			deleted += 1;
-		}
-		return deleted;
-	}
-};
-function challengeFromRow(row) {
-	return parseCurrentEmailOtpChallengeRow({
-		recordJson: parseJsonRecord(row?.record_json),
-		expiresAtMs: row?.expires_at_ms
-	});
-}
-function grantFromRow(row) {
-	return parseCurrentEmailOtpGrantRow({
-		recordJson: parseJsonRecord(row?.record_json),
-		expiresAtMs: row?.expires_at_ms
-	});
-}
-function walletEnrollmentFromRow(row) {
-	return parseCurrentEmailOtpWalletEnrollmentRow({
-		recordJson: parseJsonRecord(row?.record_json),
-		updatedAtMs: row?.updated_at_ms
-	});
-}
-function authStateFromRow(row) {
-	return parseCurrentEmailOtpAuthStateRow({
-		recordJson: parseJsonRecord(row?.record_json),
-		updatedAtMs: row?.updated_at_ms
-	});
-}
-function unlockChallengeFromRow(row) {
-	return parseCurrentEmailOtpUnlockChallengeRow({
-		recordJson: parseJsonRecord(row?.record_json),
-		expiresAtMs: row?.expires_at_ms
-	});
-}
-function registrationAttemptFromRow(row) {
-	return parseCurrentGoogleEmailOtpRegistrationAttemptRow({
-		recordJson: parseJsonRecord(row?.record_json),
-		expiresAtMs: row?.expires_at_ms,
-		updatedAtMs: row?.updated_at_ms
-	});
-}
-/**
-* A record's store in one D1 tenant scope. The core schema is created on first use, and a row
-* that no longer parses is deleted when it is read.
-*/
-var D1EmailOtpStore = class {
-	constructor(database, scope, spec, rows) {
-		this.spec = spec;
-		this.rows = rows;
-		this.adapterKind = "d1";
-		this.prepare = (sql, values) => this.table.prepare(sql, values);
-		this.table = new D1TenantTable({
-			database,
-			...scope
-		}, EMAIL_OTP_D1_STORE, EMAIL_OTP_STORE_D1_SCHEMA_SQL);
-	}
-	ensureSchema() {
-		return this.table.ensureSchema();
-	}
-	async put(record) {
-		await this.ensureSchema();
-		const parsed = parseEmailOtpRecord(this.spec, record);
-		const recordOrgId = this.spec.orgId(parsed);
-		if (recordOrgId && recordOrgId !== this.table.scope.orgId) throw new Error(`${this.spec.label} orgId must match D1 Email OTP store orgId`);
-		await this.rows.upsert(this.prepare, parsed).run();
-	}
-	async getById(id, select) {
-		await this.ensureSchema();
-		const key = normalizeOptionalTrimmedString(id);
-		if (!key) return null;
-		const row = await select(this.prepare, key).first();
-		return row ? this.recordOrDiscard(row, key) : null;
-	}
-	/** Reads and deletes, so a one-time record is used at most once. */
-	async consumeById(id, consume) {
-		await this.ensureSchema();
-		const key = normalizeOptionalTrimmedString(id);
-		if (!key) return null;
-		const row = await consume(this.prepare, key).first();
-		const parsed = this.rows.fromRow(row);
-		return parsed ? cloneRecord(parsed) : null;
-	}
-	async deleteById(id, remove) {
-		await this.ensureSchema();
-		const key = normalizeOptionalTrimmedString(id);
-		if (!key) return;
-		await remove(this.prepare, key).run();
-	}
-	/** The row's record; a row that does not parse is deleted by `malformedId` and reads as null. */
-	async recordOrDiscard(row, malformedId) {
-		const parsed = this.rows.fromRow(row);
-		if (parsed) return cloneRecord(parsed);
-		const id = normalizeOptionalTrimmedString(malformedId);
-		if (id) await this.del(id);
-		return null;
-	}
-};
-const ACTIVE_CHALLENGE_CONTEXT_SQL = `WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND expires_at_ms > ?
-          AND challenge_subject_id = ?
-          AND wallet_id = ?
-          AND record_org_id = ?
-          AND otp_channel = ?
-          AND owner_proof_binding_digest = ?
-          AND action = ?
-          AND operation = ?`;
-function challengeContextValues(input) {
-	return [
-		input.nowMs,
-		input.challengeSubjectId,
-		input.walletId,
-		String(input.orgId || ""),
-		input.otpChannel,
-		input.ownerProofBindingDigest,
-		input.action,
-		input.operation
-	];
-}
-var D1EmailOtpChallengeStore = class extends D1EmailOtpStore {
-	constructor(database, scope) {
-		super(database, scope, CHALLENGE_RECORD, {
-			fromRow: challengeFromRow,
-			upsert: emailOtpChallengeRows.upsert
-		});
-	}
-	async get(challengeId) {
-		await this.ensureSchema();
-		const id = normalizeOptionalTrimmedString(challengeId);
-		if (!id) return null;
-		const row = await this.prepare(`SELECT record_json, expires_at_ms, challenge_id
-         FROM email_otp_challenges
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND challenge_id = ?
-        LIMIT 1`, [id]).first();
-		return row ? this.recordOrDiscard(row, id) : null;
-	}
-	async deleteExpired(nowMs) {
-		await this.ensureSchema();
-		return ((await this.prepare(`DELETE FROM email_otp_challenges
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND expires_at_ms <= ?
-        RETURNING record_json, expires_at_ms`, [nowMs]).all()).results || []).map((row) => challengeFromRow(row)).filter((record) => Boolean(record)).map((record) => cloneRecord(record));
-	}
-	async countActiveByContext(input) {
-		await this.ensureSchema();
-		const row = await this.prepare(`SELECT COUNT(*) AS count
-         FROM email_otp_challenges
-        ${ACTIVE_CHALLENGE_CONTEXT_SQL}`, challengeContextValues(input)).first();
-		return Number(row?.count || 0);
-	}
-	async findLatestActiveByContext(input) {
-		await this.ensureSchema();
-		const row = await this.prepare(`SELECT record_json, expires_at_ms, challenge_id
-         FROM email_otp_challenges
-        ${ACTIVE_CHALLENGE_CONTEXT_SQL}
-        ORDER BY expires_at_ms DESC, created_at_ms DESC
-        LIMIT 1`, challengeContextValues(input)).first();
-		return this.recordOrDiscard(row, row?.challenge_id);
-	}
-	async deleteOldestActiveByContext(input) {
-		await this.ensureSchema();
-		const row = await this.prepare(`WITH oldest AS (
-        SELECT challenge_id
-          FROM email_otp_challenges
-         WHERE namespace = ?
-           AND org_id = ?
-           AND project_id = ?
-           AND env_id = ?
-           AND expires_at_ms > ?
-           AND challenge_subject_id = ?
-           AND wallet_id = ?
-           AND record_org_id = ?
-           AND otp_channel = ?
-           AND owner_proof_binding_digest = ?
-           AND action = ?
-           AND operation = ?
-         ORDER BY created_at_ms ASC, expires_at_ms ASC
-         LIMIT 1
-      )
-      DELETE FROM email_otp_challenges
-       WHERE namespace = ?
-         AND org_id = ?
-         AND project_id = ?
-         AND env_id = ?
-         AND challenge_id IN (SELECT challenge_id FROM oldest)
-      RETURNING record_json, expires_at_ms, challenge_id`, [
-			...challengeContextValues(input),
-			this.table.scope.namespace,
-			this.table.scope.orgId,
-			this.table.scope.projectId,
-			this.table.scope.envId
-		]).first();
-		return this.recordOrDiscard(row, row?.challenge_id);
-	}
-	async findActiveByContext(input) {
-		await this.ensureSchema();
-		const row = await this.prepare(`SELECT record_json, expires_at_ms, challenge_id
-         FROM email_otp_challenges
-        ${ACTIVE_CHALLENGE_CONTEXT_SQL}
-          AND otp_code = ?
-        ORDER BY expires_at_ms DESC
-        LIMIT 1`, [...challengeContextValues(input), input.otpCode]).first();
-		return this.recordOrDiscard(row, row?.challenge_id);
-	}
-	del(challengeId) {
-		return this.deleteById(challengeId, emailOtpChallengeRows.delete);
-	}
-};
-var D1EmailOtpGrantStore = class extends D1EmailOtpStore {
-	constructor(database, scope) {
-		super(database, scope, GRANT_RECORD, {
-			fromRow: grantFromRow,
-			upsert: emailOtpGrantRows.upsert
-		});
-	}
-	get(grantToken) {
-		return this.getById(grantToken, emailOtpGrantRows.select);
-	}
-	consume(grantToken) {
-		return this.consumeById(grantToken, emailOtpGrantRows.consume);
-	}
-	del(grantToken) {
-		return this.deleteById(grantToken, emailOtpGrantRows.delete);
-	}
-};
-var D1EmailOtpWalletEnrollmentStore = class extends D1EmailOtpStore {
-	constructor(database, scope) {
-		super(database, scope, WALLET_ENROLLMENT_RECORD, {
-			fromRow: walletEnrollmentFromRow,
-			upsert: emailOtpWalletEnrollmentRows.upsert
-		});
-	}
-	async get(walletId) {
-		await this.ensureSchema();
-		const key = normalizeOptionalTrimmedString(walletId);
-		if (!key) return null;
-		const row = await this.prepare(`SELECT record_json, updated_at_ms, wallet_id
-         FROM email_otp_wallet_enrollments
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND wallet_id = ?
-        LIMIT 1`, [key]).first();
-		return row ? this.recordOrDiscard(row, key) : null;
-	}
-	async getByProviderUserId(input) {
-		await this.ensureSchema();
-		const providerUserId = normalizeOptionalTrimmedString(input.providerUserId);
-		const orgId = normalizeOptionalTrimmedString(input.orgId);
-		if (!providerUserId || !orgId) return null;
-		const row = await this.prepare(`SELECT record_json, updated_at_ms, wallet_id
-         FROM email_otp_wallet_enrollments
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND record_org_id = ?
-          AND provider_user_id = ?
-        ORDER BY updated_at_ms DESC
-        LIMIT 1`, [orgId, providerUserId]).first();
-		return this.recordOrDiscard(row, row?.wallet_id);
-	}
-	del(walletId) {
-		return this.deleteById(walletId, emailOtpWalletEnrollmentRows.delete);
-	}
-};
-var D1EmailOtpAuthStateStore = class extends D1EmailOtpStore {
-	constructor(database, scope) {
-		super(database, scope, AUTH_STATE_RECORD, {
-			fromRow: authStateFromRow,
-			upsert: emailOtpAuthStateRows.upsert
-		});
-	}
-	get(walletId) {
-		return this.getById(walletId, emailOtpAuthStateRows.select);
-	}
-	async del(walletId) {
-		await this.ensureSchema();
-		const key = normalizeOptionalTrimmedString(walletId);
-		if (!key) return;
-		await this.prepare(`DELETE FROM email_otp_auth_states
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND wallet_id = ?`, [key]).run();
-	}
-};
-var D1EmailOtpUnlockChallengeStore = class extends D1EmailOtpStore {
-	constructor(database, scope) {
-		super(database, scope, UNLOCK_CHALLENGE_RECORD, {
-			fromRow: unlockChallengeFromRow,
-			upsert: emailOtpUnlockChallengeRows.upsert
-		});
-	}
-	consume(challengeId) {
-		return this.consumeById(challengeId, emailOtpUnlockChallengeRows.consume);
-	}
-	async del(challengeId) {
-		await this.ensureSchema();
-		const id = normalizeOptionalTrimmedString(challengeId);
-		if (!id) return;
-		await this.prepare(`DELETE FROM email_otp_unlock_challenges
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND challenge_id = ?`, [id]).run();
-	}
-};
-var D1EmailOtpRegistrationAttemptStore = class extends D1EmailOtpStore {
-	constructor(database, scope) {
-		super(database, scope, REGISTRATION_ATTEMPT_RECORD, {
-			fromRow: registrationAttemptFromRow,
-			upsert: emailOtpRegistrationAttemptRows.upsert
-		});
-	}
-	get(attemptId) {
-		return this.getById(attemptId, emailOtpRegistrationAttemptRows.select);
-	}
-	async findStartedBySubjectEmail(input) {
-		await this.ensureSchema();
-		const row = await emailOtpRegistrationAttemptRows.selectStarted(this.prepare, input).first();
-		const record = await this.recordOrDiscard(row, row?.attempt_id);
-		return record && registrationAttemptMatchesStartedScope(record, input) ? record : null;
-	}
-	async abandonStartedBySubjectEmailExceptBinding(input) {
-		await this.ensureSchema();
-		const result = await emailOtpRegistrationAttemptRows.selectPending(this.prepare, input).all();
-		let abandoned = 0;
-		for (const row of result.results || []) {
-			const record = await this.recordOrDiscard(row, row.attempt_id);
-			if (!record || !registrationAttemptMatchesReplacementScope(record, input)) continue;
-			await this.put({
-				...record,
-				state: "abandoned",
-				failureCode: input.failureCode,
-				updatedAtMs: input.nowMs
-			});
-			abandoned += 1;
-		}
-		return abandoned;
-	}
-	async hasLiveStartedWalletAttempt(input) {
-		await this.ensureSchema();
-		const walletId = normalizeOptionalTrimmedString(input.walletId);
-		if (!walletId) return false;
-		const row = await emailOtpRegistrationAttemptRows.selectLiveForWallet(this.prepare, walletId, input.nowMs).first();
-		return Boolean(row);
-	}
-	async deleteExpired(nowMs) {
-		await this.ensureSchema();
-		return d1ChangedRows(await emailOtpRegistrationAttemptRows.deleteExpired(this.prepare, nowMs).run());
-	}
-	del(attemptId) {
-		return this.deleteById(attemptId, emailOtpRegistrationAttemptRows.delete);
-	}
-};
-function createEmailOtpChallengeStore(input) {
-	return createEmailOtpStore(input, "challenge", {
-		d1: (database, scope) => new D1EmailOtpChallengeStore(database, scope),
-		inMemory: () => new InMemoryEmailOtpChallengeStore()
-	});
-}
-function createEmailOtpGrantStore(input) {
-	return createEmailOtpStore(input, "grant", {
-		d1: (database, scope) => new D1EmailOtpGrantStore(database, scope),
-		inMemory: () => new InMemoryEmailOtpStore(GRANT_RECORD)
-	});
-}
-function createEmailOtpWalletEnrollmentStore(input) {
-	return createEmailOtpStore(input, "wallet enrollment", {
-		d1: (database, scope) => new D1EmailOtpWalletEnrollmentStore(database, scope),
-		inMemory: () => new InMemoryEmailOtpWalletEnrollmentStore()
-	}, "enrollment");
-}
-function createEmailOtpAuthStateStore(input) {
-	return createEmailOtpStore(input, "auth state", {
-		d1: (database, scope) => new D1EmailOtpAuthStateStore(database, scope),
-		inMemory: () => new InMemoryEmailOtpStore(AUTH_STATE_RECORD)
-	});
-}
-function createEmailOtpUnlockChallengeStore(input) {
-	return createEmailOtpStore(input, "unlock challenge", {
-		d1: (database, scope) => new D1EmailOtpUnlockChallengeStore(database, scope),
-		inMemory: () => new InMemoryEmailOtpStore(UNLOCK_CHALLENGE_RECORD)
-	});
-}
-function createEmailOtpRegistrationAttemptStore(input) {
-	return createEmailOtpStore(input, "registration attempt", {
-		d1: (database, scope) => new D1EmailOtpRegistrationAttemptStore(database, scope),
-		inMemory: () => new InMemoryEmailOtpRegistrationAttemptStore()
-	});
-}
-//#endregion
-export { createEmailOtpAuthStateStore, createEmailOtpChallengeStore, createEmailOtpGrantStore, createEmailOtpRegistrationAttemptStore, createEmailOtpUnlockChallengeStore, createEmailOtpWalletEnrollmentStore };
-
-//# sourceMappingURL=EmailOtpStores.js.map