@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/core/authService/emailOtpChallengeOperations.js

@@ -1,123 +0,0 @@
-import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
-import { failure } from "../../shared-ts/src/utils/failure.js";
-import { WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../shared-ts/src/utils/emailOtpDomain.js";
-import { randomBase64Url } from "./bytes.js";
-//#region src/core/authService/emailOtpChallengeOperations.ts
-function loginOperationFromRequest(request) {
-	const operationRaw = normalizeOptionalTrimmedString(request.operation);
-	return operationRaw === "transaction_sign" || operationRaw === "export_key" ? operationRaw : WALLET_EMAIL_OTP_UNLOCK_OPERATION;
-}
-function createGrantToken() {
-	return typeof crypto === "undefined" || typeof crypto.getRandomValues !== "function" ? null : randomBase64Url(24);
-}
-function unsupportedCryptoResult() {
-	return failure("unsupported", "crypto.getRandomValues is unavailable in this runtime");
-}
-async function createEmailOtpChallenge(input, request) {
-	const result = await input.createChallengeWithAction({
-		challengeSubjectId: request.userId,
-		walletId: request.walletId,
-		orgId: request.orgId,
-		email: request.email,
-		otpChannel: request.otpChannel,
-		ownerProofBindingDigest: request.ownerProofBindingDigest,
-		clientIp: request.clientIp,
-		operation: request.operation,
-		reuseActiveChallenge: request.reuseActiveChallenge,
-		action: WALLET_EMAIL_OTP_ACTIONS.login
-	});
-	if (!result.ok) return result;
-	const operation = result.challenge.operation === "transaction_sign" || result.challenge.operation === "export_key" ? result.challenge.operation : WALLET_EMAIL_OTP_UNLOCK_OPERATION;
-	return {
-		ok: true,
-		challenge: {
-			challengeId: result.challenge.challengeId,
-			issuedAtMs: result.challenge.issuedAtMs,
-			expiresAtMs: result.challenge.expiresAtMs,
-			userId: result.challenge.challengeSubjectId,
-			walletId: result.challenge.walletId,
-			orgId: result.challenge.orgId,
-			otpChannel: result.challenge.otpChannel,
-			ownerProofBindingDigest: result.challenge.ownerProofBindingDigest,
-			action: WALLET_EMAIL_OTP_ACTIONS.login,
-			operation
-		},
-		delivery: result.delivery
-	};
-}
-async function createEmailOtpEnrollmentChallenge(input, request) {
-	const result = await input.createChallengeWithAction({
-		challengeSubjectId: request.userId,
-		walletId: request.walletId,
-		orgId: request.orgId,
-		email: request.email,
-		otpChannel: request.otpChannel,
-		ownerProofBindingDigest: request.ownerProofBindingDigest,
-		clientIp: request.clientIp,
-		operation: request.operation,
-		action: WALLET_EMAIL_OTP_ACTIONS.registration
-	});
-	if (!result.ok) return result;
-	return {
-		ok: true,
-		challenge: {
-			challengeId: result.challenge.challengeId,
-			issuedAtMs: result.challenge.issuedAtMs,
-			expiresAtMs: result.challenge.expiresAtMs,
-			userId: result.challenge.challengeSubjectId,
-			walletId: result.challenge.walletId,
-			orgId: result.challenge.orgId,
-			otpChannel: result.challenge.otpChannel,
-			ownerProofBindingDigest: result.challenge.ownerProofBindingDigest,
-			action: WALLET_EMAIL_OTP_ACTIONS.registration,
-			operation: WALLET_EMAIL_OTP_REGISTRATION_OPERATION
-		},
-		delivery: result.delivery
-	};
-}
-async function verifyEmailOtpChallenge(input, request) {
-	const expectedOperation = loginOperationFromRequest(request);
-	const verified = await input.verifyChallengeCode({
-		challengeSubjectId: request.userId,
-		walletId: request.walletId,
-		orgId: request.orgId,
-		challengeId: request.challengeId,
-		otpCode: request.otpCode,
-		otpChannel: request.otpChannel,
-		ownerProofBindingDigest: request.ownerProofBindingDigest,
-		clientIp: request.clientIp,
-		expectedAction: WALLET_EMAIL_OTP_ACTIONS.login,
-		expectedOperation
-	});
-	if (!verified.ok) return verified;
-	const grantToken = createGrantToken();
-	if (!grantToken) return unsupportedCryptoResult();
-	const otpConfig = input.resolveConfig();
-	const issuedAtMs = Date.now();
-	const grantExpiresAtMs = issuedAtMs + otpConfig.grantTtlMs;
-	await input.grantStore.put({
-		version: "email_otp_grant_v1",
-		grantToken,
-		userId: verified.challengeSubjectId,
-		walletId: verified.walletId,
-		orgId: verified.orgId,
-		challengeId: verified.challengeId,
-		otpChannel: verified.otpChannel,
-		ownerProofBindingDigest: String(request.ownerProofBindingDigest || "").trim(),
-		action: WALLET_EMAIL_OTP_ACTIONS.unseal,
-		issuedAtMs,
-		expiresAtMs: grantExpiresAtMs
-	});
-	return {
-		ok: true,
-		challengeId: verified.challengeId,
-		loginGrant: grantToken,
-		grantExpiresAtMs,
-		otpChannel: verified.otpChannel
-	};
-}
-//#endregion
-export { createEmailOtpChallenge, createEmailOtpEnrollmentChallenge, verifyEmailOtpChallenge };
-
-//# sourceMappingURL=emailOtpChallengeOperations.js.map

package/dist/esm/core/authService/emailOtpChallengeProof.js

@@ -1,183 +0,0 @@
-import { parseChallengeSubjectId, parseEmailOtpChallengeId, parseEmailOtpRegistrationAttemptId, parseOrgId, parseProviderSubject, parseWalletId } from "../../shared-ts/src/utils/domainIds.js";
-import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
-import { failure } from "../../shared-ts/src/utils/failure.js";
-import { WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../shared-ts/src/utils/emailOtpDomain.js";
-//#region src/core/authService/emailOtpChallengeProof.ts
-function assertNever(value) {
-	throw new Error(`Unexpected value: ${String(value)}`);
-}
-function emailOtpChallengeVerificationIntentFromRequest(input) {
-	if (input.expectedAction === WALLET_EMAIL_OTP_ACTIONS.registration) {
-		if (!input.registrationChallengeProof) throw new Error("Email OTP registration verification requires registration challenge proof");
-		return {
-			kind: "registration",
-			binding: input.registrationChallengeProof,
-			allowWalletReroll: input.allowRegistrationChallengeReroll === true
-		};
-	}
-	const operation = input.expectedOperation || "wallet_unlock";
-	if (operation === "transaction_sign") return { kind: "transaction_sign" };
-	if (operation === "export_key") return { kind: "export_key" };
-	return { kind: "wallet_unlock" };
-}
-function expectedEmailOtpStoredChallengePurpose(intent) {
-	switch (intent.kind) {
-		case "registration": return {
-			kind: "registration",
-			action: WALLET_EMAIL_OTP_ACTIONS.registration,
-			operation: WALLET_EMAIL_OTP_REGISTRATION_OPERATION
-		};
-		case "wallet_unlock": return {
-			kind: "wallet_unlock",
-			action: WALLET_EMAIL_OTP_ACTIONS.login,
-			operation: WALLET_EMAIL_OTP_UNLOCK_OPERATION
-		};
-		case "transaction_sign": return {
-			kind: "transaction_sign",
-			action: WALLET_EMAIL_OTP_ACTIONS.login,
-			operation: WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION
-		};
-		case "export_key": return {
-			kind: "export_key",
-			action: WALLET_EMAIL_OTP_ACTIONS.login,
-			operation: WALLET_EMAIL_OTP_EXPORT_OPERATION
-		};
-	}
-	return assertNever(intent);
-}
-function readEmailOtpStoredChallengePurpose(record) {
-	if (record.action === WALLET_EMAIL_OTP_ACTIONS.registration && record.operation === "registration") return {
-		kind: "registration",
-		action: WALLET_EMAIL_OTP_ACTIONS.registration,
-		operation: WALLET_EMAIL_OTP_REGISTRATION_OPERATION
-	};
-	if (record.action === WALLET_EMAIL_OTP_ACTIONS.login) {
-		if (record.operation === "transaction_sign") return {
-			kind: "transaction_sign",
-			action: WALLET_EMAIL_OTP_ACTIONS.login,
-			operation: WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION
-		};
-		if (record.operation === "export_key") return {
-			kind: "export_key",
-			action: WALLET_EMAIL_OTP_ACTIONS.login,
-			operation: WALLET_EMAIL_OTP_EXPORT_OPERATION
-		};
-		if (record.operation === "wallet_unlock") return {
-			kind: "wallet_unlock",
-			action: WALLET_EMAIL_OTP_ACTIONS.login,
-			operation: WALLET_EMAIL_OTP_UNLOCK_OPERATION
-		};
-	}
-	return null;
-}
-function emailOtpStoredChallengePurposeMatches(input) {
-	if (!input.actual) return false;
-	return input.actual.kind === input.expected.kind && input.actual.action === input.expected.action && input.actual.operation === input.expected.operation;
-}
-function emailOtpRegistrationChallengePurposeForRecord(input) {
-	if (input.storedPurpose?.kind === "registration") return {
-		kind: "registration",
-		action: WALLET_EMAIL_OTP_ACTIONS.registration,
-		operation: WALLET_EMAIL_OTP_REGISTRATION_OPERATION
-	};
-	if (input.allowWalletReroll && input.storedPurpose?.kind === "wallet_unlock") return {
-		kind: "registration_reroll",
-		action: WALLET_EMAIL_OTP_ACTIONS.login,
-		operation: WALLET_EMAIL_OTP_UNLOCK_OPERATION
-	};
-	return null;
-}
-function buildVerifiedEmailOtpRegistrationChallengeProof(input) {
-	if (input.record.challengeSubjectId !== input.challengeSubjectId) return null;
-	if (input.proof.challengeSubjectId !== input.challengeSubjectId) return null;
-	if (String(input.proof.providerSubject) !== String(input.proof.challengeSubjectId)) return null;
-	if (input.record.otpChannel !== "email_otp") return null;
-	if (String(input.record.orgId || "") !== input.proof.orgId) return null;
-	const purpose = emailOtpRegistrationChallengePurposeForRecord({
-		storedPurpose: input.storedPurpose,
-		allowWalletReroll: input.allowWalletReroll
-	});
-	if (!purpose) return null;
-	const proofEmail = normalizeOptionalTrimmedString(input.proof.proofEmail)?.toLowerCase();
-	const challengeEmail = normalizeOptionalTrimmedString(input.record.email)?.toLowerCase();
-	if (!proofEmail || !challengeEmail || proofEmail !== challengeEmail) return null;
-	const originalWalletId = parseWalletId(input.record.walletId);
-	if (!originalWalletId.ok) return null;
-	switch (input.proof.kind) {
-		case "registration_attempt": return {
-			kind: "registration_attempt",
-			providerSubject: input.proof.providerSubject,
-			challengeSubjectId: input.proof.challengeSubjectId,
-			challengeEmail,
-			challengeId: input.proof.challengeId,
-			originalWalletId: originalWalletId.value,
-			finalWalletId: input.proof.finalWalletId,
-			orgId: input.proof.orgId,
-			ownerProofBindingDigest: input.proof.ownerProofBindingDigest,
-			purpose,
-			registrationAttemptId: input.proof.registrationAttemptId
-		};
-		case "direct_proof_email": return {
-			kind: "direct_proof_email",
-			providerSubject: input.proof.providerSubject,
-			challengeSubjectId: input.proof.challengeSubjectId,
-			challengeEmail,
-			challengeId: input.proof.challengeId,
-			originalWalletId: originalWalletId.value,
-			finalWalletId: input.proof.finalWalletId,
-			orgId: input.proof.orgId,
-			ownerProofBindingDigest: input.proof.ownerProofBindingDigest,
-			purpose
-		};
-	}
-	return assertNever(input.proof);
-}
-function parseRawEmailOtpRegistrationChallengeProofInput(request) {
-	const providerSubject = parseProviderSubject(request.providerSubject);
-	if (!providerSubject.ok) return failure("invalid_body", "Email OTP registration requires providerSubject");
-	const challengeSubjectId = parseChallengeSubjectId(request.providerSubject);
-	if (!challengeSubjectId.ok) return failure("invalid_body", "Email OTP registration requires challengeSubjectId");
-	const challengeId = parseEmailOtpChallengeId(request.challengeId);
-	if (!challengeId.ok) return failure("invalid_body", "Email OTP registration requires challengeId");
-	const finalWalletId = parseWalletId(request.walletId);
-	if (!finalWalletId.ok) return failure("invalid_body", "Email OTP registration requires walletId");
-	const orgId = parseOrgId(request.orgId);
-	if (!orgId.ok) return failure("invalid_body", "Email OTP registration requires orgId");
-	const ownerProofBindingDigest = normalizeOptionalTrimmedString(request.ownerProofBindingDigest);
-	if (!ownerProofBindingDigest) return failure("invalid_body", "Email OTP registration requires ownerProofBindingDigest");
-	const registrationAttemptId = parseEmailOtpRegistrationAttemptId(request.googleEmailOtpRegistrationAttemptId);
-	if (registrationAttemptId.ok) return {
-		ok: true,
-		input: {
-			kind: "google_registration_attempt",
-			providerSubject: providerSubject.value,
-			challengeSubjectId: challengeSubjectId.value,
-			walletId: finalWalletId.value,
-			orgId: orgId.value,
-			ownerProofBindingDigest,
-			registrationAttemptId: registrationAttemptId.value,
-			challengeId: challengeId.value
-		}
-	};
-	if (registrationAttemptId.error.code === "invalid") return failure("invalid_body", "googleEmailOtpRegistrationAttemptId must be a string");
-	const proofEmail = normalizeOptionalTrimmedString(request.proofEmail)?.toLowerCase();
-	if (!proofEmail) return failure("invalid_body", "Email OTP registration requires proofEmail");
-	return {
-		ok: true,
-		input: {
-			kind: "direct_proof_email",
-			providerSubject: providerSubject.value,
-			challengeSubjectId: challengeSubjectId.value,
-			finalWalletId: finalWalletId.value,
-			orgId: orgId.value,
-			ownerProofBindingDigest,
-			proofEmail,
-			challengeId: challengeId.value
-		}
-	};
-}
-//#endregion
-export { buildVerifiedEmailOtpRegistrationChallengeProof, emailOtpChallengeVerificationIntentFromRequest, emailOtpStoredChallengePurposeMatches, expectedEmailOtpStoredChallengePurpose, parseRawEmailOtpRegistrationChallengeProofInput, readEmailOtpStoredChallengePurpose };
-
-//# sourceMappingURL=emailOtpChallengeProof.js.map

package/dist/esm/core/authService/emailOtpChallengeVerification.js

@@ -1,264 +0,0 @@
-import { parseChallengeSubjectId, parseEmailOtpChallengeId, parseOrgId, parseWalletId } from "../../shared-ts/src/utils/domainIds.js";
-import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
-import { failure } from "../../shared-ts/src/utils/failure.js";
-import { errorMessage } from "../../shared-ts/src/utils/errors.js";
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS } from "../../shared-ts/src/utils/emailOtpDomain.js";
-import { pruneExpiredEmailOtpChallengesWithStore } from "./emailOtpChallenges.js";
-import { buildVerifiedEmailOtpRegistrationChallengeProof, emailOtpChallengeVerificationIntentFromRequest, emailOtpStoredChallengePurposeMatches, expectedEmailOtpStoredChallengePurpose, readEmailOtpStoredChallengePurpose } from "./emailOtpChallengeProof.js";
-//#region src/core/authService/emailOtpChallengeVerification.ts
-async function verifyEmailOtpChallengeCode(input) {
-	const request = input.request;
-	try {
-		const challengeSubjectId = parseChallengeSubjectId(request.challengeSubjectId);
-		const walletId = parseWalletId(request.walletId);
-		const orgId = parseOrgId(request.orgId);
-		const challengeId = parseEmailOtpChallengeId(request.challengeId);
-		const otpCode = normalizeOptionalTrimmedString(request.otpCode);
-		const otpChannel = normalizeOptionalTrimmedString(request.otpChannel);
-		const ownerProofBindingDigest = normalizeOptionalTrimmedString(request.ownerProofBindingDigest);
-		const clientIp = normalizeOptionalTrimmedString(request.clientIp) || void 0;
-		const expectedAction = request.expectedAction;
-		const expectedOperation = request.expectedOperation;
-		if (expectedAction === WALLET_EMAIL_OTP_ACTIONS.registration && !request.registrationChallengeProof) return failure("invalid_body", "Email OTP registration verification requires registration challenge proof");
-		const verificationIntent = emailOtpChallengeVerificationIntentFromRequest({
-			expectedAction,
-			...expectedOperation ? { expectedOperation } : {},
-			...request.registrationChallengeProof ? { registrationChallengeProof: request.registrationChallengeProof } : {},
-			...request.allowRegistrationChallengeReroll ? { allowRegistrationChallengeReroll: true } : {}
-		});
-		const expectedPurpose = expectedEmailOtpStoredChallengePurpose(verificationIntent);
-		if (!challengeSubjectId.ok) return failure("invalid_body", "Missing challengeSubjectId");
-		if (!walletId.ok) return failure("invalid_body", "Missing walletId");
-		if (!orgId.ok) return failure("invalid_body", "Missing orgId");
-		if (!challengeId.ok) return failure("invalid_body", "Missing challengeId");
-		if (request.registrationChallengeProof && request.registrationChallengeProof.challengeId !== challengeId.value) return failure("challenge_id_mismatch", "Email OTP registration proof does not match challengeId");
-		if (request.registrationChallengeProof && request.registrationChallengeProof.finalWalletId !== walletId.value) return failure("challenge_wallet_mismatch", "Email OTP registration proof does not match walletId");
-		if (request.registrationChallengeProof && request.registrationChallengeProof.orgId !== orgId.value) return failure("challenge_org_mismatch", "Email OTP registration proof does not match orgId");
-		if (!otpCode) return failure("invalid_body", "Missing otpCode");
-		if (otpChannel !== "email_otp") return failure("invalid_body", "otpChannel must be email_otp");
-		if (!ownerProofBindingDigest) return failure("invalid_body", "Missing ownerProofBindingDigest");
-		const rateLimit = await input.consumeRateLimit({
-			scope: "verify",
-			action: expectedAction,
-			userId: challengeSubjectId.value,
-			walletId: walletId.value,
-			orgId: orgId.value,
-			clientIp
-		});
-		if (!rateLimit.ok) return rateLimit;
-		const activeEnrollment = expectedAction !== WALLET_EMAIL_OTP_ACTIONS.registration ? await input.readActiveEnrollment({
-			walletId: walletId.value,
-			orgId: orgId.value
-		}) : null;
-		if (activeEnrollment && !activeEnrollment.ok) return activeEnrollment;
-		const enrollment = activeEnrollment?.ok ? activeEnrollment.enrollment : await input.walletEnrollmentStore.get(walletId.value);
-		if (enrollment && enrollment.orgId !== orgId.value) return failure("tenant_scope_mismatch", "Email OTP enrollment does not match the requested orgId");
-		const authStateResult = enrollment ? await input.readEnrollmentAuthState(enrollment) : {
-			ok: true,
-			state: null
-		};
-		if (!authStateResult.ok) return authStateResult;
-		const authState = authStateResult.state;
-		const activeLockoutUntilMs = authState?.otpLockedUntilMs && authState.otpLockedUntilMs > Date.now() ? authState.otpLockedUntilMs : void 0;
-		if (activeLockoutUntilMs) return {
-			ok: false,
-			code: "otp_locked_out",
-			message: "Email OTP is temporarily locked for this wallet",
-			lockedUntilMs: activeLockoutUntilMs
-		};
-		const challengeStore = input.challengeStore;
-		const nowMs = Date.now();
-		await pruneExpiredEmailOtpChallengesWithStore({
-			challengeStore,
-			memoryOutbox: input.memoryOutbox,
-			nowMs
-		});
-		let record = await challengeStore.get(challengeId.value);
-		if (!record) {
-			record = await challengeStore.findActiveByContext({
-				challengeSubjectId: challengeSubjectId.value,
-				walletId: walletId.value,
-				orgId: orgId.value,
-				otpChannel: EMAIL_OTP_CHANNEL,
-				ownerProofBindingDigest,
-				action: expectedAction,
-				operation: expectedPurpose.operation,
-				otpCode,
-				nowMs
-			});
-			if (!record) {
-				input.logger.warn("[email-otp] challenge record not found during verification", {
-					challengeId: challengeId.value,
-					walletId: walletId.value,
-					challengeSubjectId: challengeSubjectId.value,
-					otpChannel: EMAIL_OTP_CHANNEL,
-					action: expectedAction
-				});
-				return failure("challenge_expired_or_invalid", "Email OTP challenge expired or invalid");
-			}
-		}
-		if (nowMs > record.expiresAtMs) {
-			await challengeStore.del(record.challengeId);
-			input.memoryOutbox.delete(record.challengeId);
-			return failure("challenge_expired_or_invalid", "Email OTP challenge expired or invalid");
-		}
-		const storedPurpose = readEmailOtpStoredChallengePurpose(record);
-		const purposeMatches = emailOtpStoredChallengePurposeMatches({
-			expected: expectedPurpose,
-			actual: storedPurpose
-		});
-		const verifiedRegistrationChallengeProof = verificationIntent.kind === "registration" ? buildVerifiedEmailOtpRegistrationChallengeProof({
-			record,
-			challengeSubjectId: challengeSubjectId.value,
-			proof: verificationIntent.binding,
-			storedPurpose,
-			allowWalletReroll: verificationIntent.allowWalletReroll
-		}) : null;
-		const registrationChallengeCanFollowReroll = verifiedRegistrationChallengeProof != null;
-		const registrationChallengeEmailMatches = verificationIntent.kind === "registration" && normalizeOptionalTrimmedString(record.email)?.toLowerCase() === normalizeOptionalTrimmedString(verificationIntent.binding.proofEmail)?.toLowerCase();
-		const registrationRerollDisallowed = verificationIntent.kind === "registration" && storedPurpose?.kind === "wallet_unlock" && !verificationIntent.allowWalletReroll;
-		const subjectMismatch = registrationChallengeCanFollowReroll ? false : record.challengeSubjectId !== challengeSubjectId.value;
-		const walletMismatch = registrationChallengeCanFollowReroll ? false : record.walletId !== walletId.value;
-		const actionMismatch = registrationChallengeCanFollowReroll ? false : !purposeMatches;
-		const operationMismatch = registrationChallengeCanFollowReroll ? false : !purposeMatches;
-		const ownerProofBindingMismatch = registrationChallengeCanFollowReroll ? false : record.ownerProofBindingDigest !== ownerProofBindingDigest;
-		if (subjectMismatch || walletMismatch || record.otpChannel !== "email_otp" || actionMismatch || operationMismatch || ownerProofBindingMismatch || String(record.orgId || "") !== String(orgId.value || "")) {
-			const mismatchCode = record.otpChannel !== "email_otp" ? "challenge_channel_mismatch" : subjectMismatch ? "challenge_subject_mismatch" : verificationIntent.kind === "registration" && !registrationChallengeEmailMatches ? "challenge_email_mismatch" : String(record.orgId || "") !== String(orgId.value || "") ? "challenge_org_mismatch" : registrationRerollDisallowed ? "registration_reroll_disallowed" : actionMismatch || operationMismatch ? "challenge_purpose_mismatch" : walletMismatch ? "challenge_wallet_mismatch" : ownerProofBindingMismatch ? "challenge_session_mismatch" : "challenge_org_mismatch";
-			input.logger.warn("[email-otp] challenge binding mismatch during verification", {
-				challengeId: record.challengeId,
-				expectedChallengeId: challengeId.value,
-				expectedAction,
-				expectedOperation: expectedOperation || null,
-				recordAction: record.action,
-				recordOperation: record.operation,
-				hasRegistrationChallengeProof: request.registrationChallengeProof != null,
-				registrationChallengeCanFollowReroll,
-				registrationRerollDisallowed,
-				registrationChallengeEmailMatches,
-				registrationChallengePurpose: verifiedRegistrationChallengeProof?.purpose.kind || null,
-				subjectMatches: !subjectMismatch,
-				walletMatches: !walletMismatch,
-				otpChannelMatches: record.otpChannel === EMAIL_OTP_CHANNEL,
-				actionMatches: !actionMismatch,
-				operationMatches: !operationMismatch,
-				ownerProofBindingMatches: !ownerProofBindingMismatch,
-				orgMatches: String(record.orgId || "") === String(orgId.value || ""),
-				recordWalletId: record.walletId,
-				requestWalletId: walletId.value,
-				mismatchCode,
-				expectedPurpose,
-				storedPurpose
-			});
-			return failure(mismatchCode, "Email OTP challenge is not valid for the current owner proof binding");
-		}
-		if (registrationChallengeCanFollowReroll) input.logger.info("[email-otp] registration reroll challenge validation", {
-			challengeId: record.challengeId,
-			registrationAttemptId: verifiedRegistrationChallengeProof.kind === "registration_attempt" ? verifiedRegistrationChallengeProof.registrationAttemptId : null,
-			originalWalletId: verifiedRegistrationChallengeProof.originalWalletId,
-			finalWalletId: verifiedRegistrationChallengeProof.finalWalletId,
-			providerSubject: verifiedRegistrationChallengeProof.providerSubject,
-			providerSubjectMatches: record.challengeSubjectId === verifiedRegistrationChallengeProof.challengeSubjectId,
-			proofEmailMatches: registrationChallengeEmailMatches,
-			orgMatches: String(record.orgId || "") === String(verifiedRegistrationChallengeProof.orgId),
-			purpose: verifiedRegistrationChallengeProof.purpose,
-			expectedPurpose,
-			storedPurpose
-		});
-		if (record.otpCode !== otpCode) {
-			const matchingRecord = await challengeStore.findActiveByContext({
-				challengeSubjectId: challengeSubjectId.value,
-				walletId: walletId.value,
-				orgId: orgId.value,
-				otpChannel: EMAIL_OTP_CHANNEL,
-				ownerProofBindingDigest,
-				action: expectedAction,
-				operation: expectedOperation || record.operation,
-				otpCode,
-				nowMs
-			});
-			if (matchingRecord) record = matchingRecord;
-		}
-		if (record.otpCode !== otpCode) {
-			const nextAttemptCount = record.attemptCount + 1;
-			const otpConfig = input.resolveConfig();
-			const nextLockedUntilMs = nextAttemptCount >= record.maxAttempts ? Date.now() + otpConfig.lockoutTtlMs : void 0;
-			if (enrollment) {
-				const nowMsForFailure = Date.now();
-				const nextFailureCount = Number(authState?.otpFailureCount || 0) + 1;
-				await input.putEnrollmentAuthState(enrollment, {
-					otpFailureCount: nextFailureCount,
-					lastOtpFailureAtMs: nowMsForFailure,
-					...nextLockedUntilMs ? { otpLockedUntilMs: nextLockedUntilMs } : {}
-				});
-			}
-			if (nextAttemptCount >= record.maxAttempts) {
-				await challengeStore.del(record.challengeId);
-				input.memoryOutbox.delete(record.challengeId);
-				return {
-					ok: false,
-					code: "otp_attempts_exhausted",
-					message: "Email OTP challenge exceeded the maximum number of attempts",
-					attemptsRemaining: 0,
-					...nextLockedUntilMs ? { lockedUntilMs: nextLockedUntilMs } : {}
-				};
-			}
-			await challengeStore.put({
-				...record,
-				attemptCount: nextAttemptCount
-			});
-			return {
-				ok: false,
-				code: "invalid_otp",
-				message: "OTP code is invalid",
-				attemptsRemaining: record.maxAttempts - nextAttemptCount
-			};
-		}
-		await challengeStore.del(record.challengeId);
-		input.memoryOutbox.delete(record.challengeId);
-		if (enrollment) {
-			if (Number(authState?.otpFailureCount || 0) > 0 || authState?.lastOtpFailureAtMs != null || authState?.otpLockedUntilMs != null) await input.putEnrollmentAuthState(enrollment, {
-				otpFailureCount: 0,
-				lastOtpFailureAtMs: void 0,
-				otpLockedUntilMs: void 0
-			});
-		}
-		const verifiedChallengeId = parseEmailOtpChallengeId(record.challengeId);
-		if (!verifiedChallengeId.ok) return failure("internal", "Email OTP challenge record has an invalid challenge id");
-		const successBase = {
-			challengeId: verifiedChallengeId.value,
-			challengeSubjectId: challengeSubjectId.value,
-			walletId: walletId.value,
-			orgId: orgId.value,
-			otpChannel: EMAIL_OTP_CHANNEL
-		};
-		if (record.email) successBase.email = record.email;
-		if (verificationIntent.kind === "registration") {
-			const finalRegistrationChallengeProof = buildVerifiedEmailOtpRegistrationChallengeProof({
-				record,
-				challengeSubjectId: challengeSubjectId.value,
-				proof: verificationIntent.binding,
-				storedPurpose: readEmailOtpStoredChallengePurpose(record),
-				allowWalletReroll: verificationIntent.allowWalletReroll
-			});
-			if (!finalRegistrationChallengeProof) return failure("challenge_purpose_mismatch", "Email OTP challenge is not valid for registration");
-			return {
-				ok: true,
-				...successBase,
-				intent: "registration",
-				registrationChallengeProof: finalRegistrationChallengeProof
-			};
-		}
-		return {
-			ok: true,
-			...successBase,
-			intent: verificationIntent.kind
-		};
-	} catch (e) {
-		return failure("internal", errorMessage(e) || "Failed to verify Email OTP challenge");
-	}
-}
-//#endregion
-export { verifyEmailOtpChallengeCode };
-
-//# sourceMappingURL=emailOtpChallengeVerification.js.map