@seams/wallet-server 0.6.2 → 0.7.3

package/dist/esm/core/authService/emailOtpChallengeVerification.js

@@ -1,6 +1,7 @@
 import { parseChallengeSubjectId, parseEmailOtpChallengeId, parseOrgId, parseWalletId } from "../../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import "../../shared-ts/src/utils/validation.js";
+import { failure } from "../../shared-ts/src/utils/failure.js";
 import { errorMessage } from "../../shared-ts/src/utils/errors.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS } from "../../shared-ts/src/utils/emailOtpDomain.js";
 import { pruneExpiredEmailOtpChallengesWithStore } from "./emailOtpChallenges.js";
@@ -19,11 +20,7 @@ async function verifyEmailOtpChallengeCode(input) {
 		const clientIp = normalizeOptionalTrimmedString(request.clientIp) || void 0;
 		const expectedAction = request.expectedAction;
 		const expectedOperation = request.expectedOperation;
-		if (expectedAction === WALLET_EMAIL_OTP_ACTIONS.registration && !request.registrationChallengeProof) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Email OTP registration verification requires registration challenge proof"
-		};
+		if (expectedAction === WALLET_EMAIL_OTP_ACTIONS.registration && !request.registrationChallengeProof) return failure("invalid_body", "Email OTP registration verification requires registration challenge proof");
 		const verificationIntent = emailOtpChallengeVerificationIntentFromRequest({
 			expectedAction,
 			...expectedOperation ? { expectedOperation } : {},
@@ -31,56 +28,16 @@ async function verifyEmailOtpChallengeCode(input) {
 			...request.allowRegistrationChallengeReroll ? { allowRegistrationChallengeReroll: true } : {}
 		});
 		const expectedPurpose = expectedEmailOtpStoredChallengePurpose(verificationIntent);
-		if (!challengeSubjectId.ok) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing challengeSubjectId"
-		};
-		if (!walletId.ok) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing walletId"
-		};
-		if (!orgId.ok) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing orgId"
-		};
-		if (!challengeId.ok) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing challengeId"
-		};
-		if (request.registrationChallengeProof && request.registrationChallengeProof.challengeId !== challengeId.value) return {
-			ok: false,
-			code: "challenge_id_mismatch",
-			message: "Email OTP registration proof does not match challengeId"
-		};
-		if (request.registrationChallengeProof && request.registrationChallengeProof.finalWalletId !== walletId.value) return {
-			ok: false,
-			code: "challenge_wallet_mismatch",
-			message: "Email OTP registration proof does not match walletId"
-		};
-		if (request.registrationChallengeProof && request.registrationChallengeProof.orgId !== orgId.value) return {
-			ok: false,
-			code: "challenge_org_mismatch",
-			message: "Email OTP registration proof does not match orgId"
-		};
-		if (!otpCode) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing otpCode"
-		};
-		if (otpChannel !== "email_otp") return {
-			ok: false,
-			code: "invalid_body",
-			message: "otpChannel must be email_otp"
-		};
-		if (!ownerProofBindingDigest) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing ownerProofBindingDigest"
-		};
+		if (!challengeSubjectId.ok) return failure("invalid_body", "Missing challengeSubjectId");
+		if (!walletId.ok) return failure("invalid_body", "Missing walletId");
+		if (!orgId.ok) return failure("invalid_body", "Missing orgId");
+		if (!challengeId.ok) return failure("invalid_body", "Missing challengeId");
+		if (request.registrationChallengeProof && request.registrationChallengeProof.challengeId !== challengeId.value) return failure("challenge_id_mismatch", "Email OTP registration proof does not match challengeId");
+		if (request.registrationChallengeProof && request.registrationChallengeProof.finalWalletId !== walletId.value) return failure("challenge_wallet_mismatch", "Email OTP registration proof does not match walletId");
+		if (request.registrationChallengeProof && request.registrationChallengeProof.orgId !== orgId.value) return failure("challenge_org_mismatch", "Email OTP registration proof does not match orgId");
+		if (!otpCode) return failure("invalid_body", "Missing otpCode");
+		if (otpChannel !== "email_otp") return failure("invalid_body", "otpChannel must be email_otp");
+		if (!ownerProofBindingDigest) return failure("invalid_body", "Missing ownerProofBindingDigest");
 		const rateLimit = await input.consumeRateLimit({
 			scope: "verify",
 			action: expectedAction,
@@ -96,11 +53,7 @@ async function verifyEmailOtpChallengeCode(input) {
 		}) : null;
 		if (activeEnrollment && !activeEnrollment.ok) return activeEnrollment;
 		const enrollment = activeEnrollment?.ok ? activeEnrollment.enrollment : await input.walletEnrollmentStore.get(walletId.value);
-		if (enrollment && enrollment.orgId !== orgId.value) return {
-			ok: false,
-			code: "tenant_scope_mismatch",
-			message: "Email OTP enrollment does not match the requested orgId"
-		};
+		if (enrollment && enrollment.orgId !== orgId.value) return failure("tenant_scope_mismatch", "Email OTP enrollment does not match the requested orgId");
 		const authStateResult = enrollment ? await input.readEnrollmentAuthState(enrollment) : {
 			ok: true,
 			state: null
@@ -142,21 +95,13 @@ async function verifyEmailOtpChallengeCode(input) {
 					otpChannel: EMAIL_OTP_CHANNEL,
 					action: expectedAction
 				});
-				return {
-					ok: false,
-					code: "challenge_expired_or_invalid",
-					message: "Email OTP challenge expired or invalid"
-				};
+				return failure("challenge_expired_or_invalid", "Email OTP challenge expired or invalid");
 			}
 		}
 		if (nowMs > record.expiresAtMs) {
 			await challengeStore.del(record.challengeId);
 			input.memoryOutbox.delete(record.challengeId);
-			return {
-				ok: false,
-				code: "challenge_expired_or_invalid",
-				message: "Email OTP challenge expired or invalid"
-			};
+			return failure("challenge_expired_or_invalid", "Email OTP challenge expired or invalid");
 		}
 		const storedPurpose = readEmailOtpStoredChallengePurpose(record);
 		const purposeMatches = emailOtpStoredChallengePurposeMatches({
@@ -205,11 +150,7 @@ async function verifyEmailOtpChallengeCode(input) {
 				expectedPurpose,
 				storedPurpose
 			});
-			return {
-				ok: false,
-				code: mismatchCode,
-				message: "Email OTP challenge is not valid for the current owner proof binding"
-			};
+			return failure(mismatchCode, "Email OTP challenge is not valid for the current owner proof binding");
 		}
 		if (registrationChallengeCanFollowReroll) input.logger.info("[email-otp] registration reroll challenge validation", {
 			challengeId: record.challengeId,
@@ -283,11 +224,7 @@ async function verifyEmailOtpChallengeCode(input) {
 			});
 		}
 		const verifiedChallengeId = parseEmailOtpChallengeId(record.challengeId);
-		if (!verifiedChallengeId.ok) return {
-			ok: false,
-			code: "internal",
-			message: "Email OTP challenge record has an invalid challenge id"
-		};
+		if (!verifiedChallengeId.ok) return failure("internal", "Email OTP challenge record has an invalid challenge id");
 		const successBase = {
 			challengeId: verifiedChallengeId.value,
 			challengeSubjectId: challengeSubjectId.value,
@@ -304,11 +241,7 @@ async function verifyEmailOtpChallengeCode(input) {
 				storedPurpose: readEmailOtpStoredChallengePurpose(record),
 				allowWalletReroll: verificationIntent.allowWalletReroll
 			});
-			if (!finalRegistrationChallengeProof) return {
-				ok: false,
-				code: "challenge_purpose_mismatch",
-				message: "Email OTP challenge is not valid for registration"
-			};
+			if (!finalRegistrationChallengeProof) return failure("challenge_purpose_mismatch", "Email OTP challenge is not valid for registration");
 			return {
 				ok: true,
 				...successBase,
@@ -322,11 +255,7 @@ async function verifyEmailOtpChallengeCode(input) {
 			intent: verificationIntent.kind
 		};
 	} catch (e) {
-		return {
-			ok: false,
-			code: "internal",
-			message: errorMessage(e) || "Failed to verify Email OTP challenge"
-		};
+		return failure("internal", errorMessage(e) || "Failed to verify Email OTP challenge");
 	}
 }
 //#endregion

package/dist/esm/core/authService/emailOtpChallenges.js

@@ -2,6 +2,7 @@ import { base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
 import "../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import "../../shared-ts/src/utils/validation.js";
+import { failure } from "../../shared-ts/src/utils/failure.js";
 import { errorMessage } from "../../shared-ts/src/utils/errors.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION, isWalletEmailOtpLoginOperation } from "../../shared-ts/src/utils/emailOtpDomain.js";
 import { randomNumericCode } from "./bytes.js";
@@ -70,31 +71,11 @@ async function createEmailOtpChallengeWithAction(input) {
 			action,
 			operationRaw: normalizeOptionalTrimmedString(request.operation)
 		});
-		if (!challengeSubjectId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing challengeSubjectId"
-		};
-		if (!walletId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing walletId"
-		};
-		if (!orgId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing orgId"
-		};
-		if (otpChannel !== "email_otp") return {
-			ok: false,
-			code: "invalid_body",
-			message: "otpChannel must be email_otp"
-		};
-		if (!ownerProofBindingDigest) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing ownerProofBindingDigest"
-		};
+		if (!challengeSubjectId) return failure("invalid_body", "Missing challengeSubjectId");
+		if (!walletId) return failure("invalid_body", "Missing walletId");
+		if (!orgId) return failure("invalid_body", "Missing orgId");
+		if (otpChannel !== "email_otp") return failure("invalid_body", "otpChannel must be email_otp");
+		if (!ownerProofBindingDigest) return failure("invalid_body", "Missing ownerProofBindingDigest");
 		const activeEnrollment = action !== WALLET_EMAIL_OTP_ACTIONS.registration ? await input.readActiveEnrollment({
 			walletId,
 			orgId
@@ -108,11 +89,7 @@ async function createEmailOtpChallengeWithAction(input) {
 		if (!existingAuthStateResult.ok) return existingAuthStateResult;
 		const existingAuthState = existingAuthStateResult.state;
 		const challengeEmail = action === WALLET_EMAIL_OTP_ACTIONS.registration ? email : existingEnrollment?.verifiedEmail || "";
-		if (!challengeEmail) return {
-			ok: false,
-			code: "recovery_email_missing",
-			message: "Authenticated identity does not include a recovery email"
-		};
+		if (!challengeEmail) return failure("recovery_email_missing", "Authenticated identity does not include a recovery email");
 		if (existingAuthState?.otpLockedUntilMs && existingAuthState.otpLockedUntilMs > Date.now()) return {
 			ok: false,
 			code: "otp_locked_out",
@@ -163,11 +140,7 @@ async function createEmailOtpChallengeWithAction(input) {
 			clientIp
 		});
 		if (!rateLimit.ok) return rateLimit;
-		if (typeof crypto === "undefined" || typeof crypto.getRandomValues !== "function") return {
-			ok: false,
-			code: "unsupported",
-			message: "crypto.getRandomValues is unavailable in this runtime"
-		};
+		if (typeof crypto === "undefined" || typeof crypto.getRandomValues !== "function") return failure("unsupported", "crypto.getRandomValues is unavailable in this runtime");
 		const otpConfig = input.resolveConfig();
 		const expiresAtMs = issuedAtMs + otpConfig.challengeTtlMs;
 		const challengeId = base64UrlEncode(crypto.getRandomValues(new Uint8Array(16)));
@@ -205,11 +178,7 @@ async function createEmailOtpChallengeWithAction(input) {
 			maxAttempts: otpConfig.maxAttempts
 		};
 		await input.challengeStore.put(challengeRecord);
-		if (!await input.challengeStore.get(challengeId)) return {
-			ok: false,
-			code: "internal",
-			message: "Email OTP challenge could not be persisted"
-		};
+		if (!await input.challengeStore.get(challengeId)) return failure("internal", "Email OTP challenge could not be persisted");
 		const delivery = await input.deliverCode({
 			challengeId,
 			walletId,
@@ -247,14 +216,10 @@ async function createEmailOtpChallengeWithAction(input) {
 			}
 		};
 	} catch (e) {
-		return {
-			ok: false,
-			code: "internal",
-			message: errorMessage(e) || "Failed to create Email OTP challenge"
-		};
+		return failure("internal", errorMessage(e) || "Failed to create Email OTP challenge");
 	}
 }
 //#endregion
-export { createEmailOtpChallengeWithAction, enforceEmailOtpActiveChallengeLimitWithStore, pruneExpiredEmailOtpChallengesWithStore };
+export { createEmailOtpChallengeWithAction, pruneExpiredEmailOtpChallengesWithStore };
 
 //# sourceMappingURL=emailOtpChallenges.js.map

package/dist/esm/core/authService/emailOtpConfig.js

@@ -43,37 +43,6 @@ function isTruthyBooleanFlag(raw) {
 		"on"
 	].includes(raw.toLowerCase());
 }
-function resolveRegistrationPrepareRateLimitPolicy(input) {
-	const defaults = input.production ? {
-		limit: 1,
-		windowMs: 5e3
-	} : {
-		limit: 100,
-		windowMs: 6e4
-	};
-	return {
-		limit: parseConfiguredInteger({
-			name: "REGISTRATION_PREPARE_RATE_LIMIT_MAX",
-			raw: readAuthServiceConfigValue({
-				thresholdStore: input.thresholdStore,
-				name: "REGISTRATION_PREPARE_RATE_LIMIT_MAX"
-			}),
-			defaultValue: defaults.limit,
-			min: 1,
-			max: 1e4
-		}),
-		windowMs: parseConfiguredInteger({
-			name: "REGISTRATION_PREPARE_RATE_LIMIT_WINDOW_MS",
-			raw: readAuthServiceConfigValue({
-				thresholdStore: input.thresholdStore,
-				name: "REGISTRATION_PREPARE_RATE_LIMIT_WINDOW_MS"
-			}),
-			defaultValue: defaults.windowMs,
-			min: 1e3,
-			max: 1440 * 6e4
-		})
-	};
-}
 function resolveEmailOtpRateLimitPolicies(input) {
 	const challengeDefault = input.production ? {
 		limit: 30,
@@ -226,6 +195,6 @@ function parseEmailOtpCodeLength(raw) {
 	return 6;
 }
 //#endregion
-export { EMAIL_OTP_CODE_LENGTH, parseConfiguredInteger, resolveEmailOtpConfig, resolveEmailOtpRateLimitPolicies, resolveRegistrationPrepareRateLimitPolicy };
+export { EMAIL_OTP_CODE_LENGTH, resolveEmailOtpConfig, resolveEmailOtpRateLimitPolicies };
 
 //# sourceMappingURL=emailOtpConfig.js.map

package/dist/esm/core/authService/emailOtpDelivery.js

@@ -1,5 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import "../../shared-ts/src/utils/validation.js";
+import { failure } from "../../shared-ts/src/utils/failure.js";
 //#region src/core/authService/emailOtpDelivery.ts
 function logDevelopmentOtpCode(input) {
 	input.logger.warn("[email-otp] development OTP code", {
@@ -42,17 +43,9 @@ function logDevelopmentOtpDelivery(input) {
 	});
 }
 async function deliverEmailOtpCode(input) {
-	if (input.production && input.config.deliveryMode !== "email_provider") return {
-		ok: false,
-		code: "email_otp_delivery_not_allowed",
-		message: `Email OTP delivery mode ${input.config.deliveryMode} is disabled in production`
-	};
+	if (input.production && input.config.deliveryMode !== "email_provider") return failure("email_otp_delivery_not_allowed", `Email OTP delivery mode ${input.config.deliveryMode} is disabled in production`);
 	const emailHint = input.email;
-	if (input.config.deliveryMode === "email_provider") return {
-		ok: false,
-		code: "not_implemented",
-		message: "Email OTP email_provider delivery is not implemented yet"
-	};
+	if (input.config.deliveryMode === "email_provider") return failure("not_implemented", "Email OTP email_provider delivery is not implemented yet");
 	if (input.config.deliveryMode === "memory") {
 		storeMemoryOtp({
 			memoryOutbox: input.memoryOutbox,
@@ -110,47 +103,19 @@ async function deliverEmailOtpCode(input) {
 	};
 }
 function readEmailOtpOutboxEntry(input) {
-	if (!input.config.devOutboxEnabled) return {
-		ok: false,
-		code: "not_found",
-		message: "Email OTP dev outbox is not enabled"
-	};
+	if (!input.config.devOutboxEnabled) return failure("not_found", "Email OTP dev outbox is not enabled");
 	const challengeId = normalizeOptionalTrimmedString(input.request.challengeId);
 	const userId = normalizeOptionalTrimmedString(input.request.userId);
 	const walletId = normalizeOptionalTrimmedString(input.request.walletId);
-	if (!challengeId) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Missing challengeId"
-	};
-	if (!userId) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Missing userId"
-	};
-	if (!walletId) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Missing walletId"
-	};
+	if (!challengeId) return failure("invalid_body", "Missing challengeId");
+	if (!userId) return failure("invalid_body", "Missing userId");
+	if (!walletId) return failure("invalid_body", "Missing walletId");
 	const entry = input.memoryOutbox.get(challengeId);
-	if (!entry) return {
-		ok: false,
-		code: "not_found",
-		message: "Email OTP outbox entry was not found"
-	};
-	if (entry.userId !== userId || entry.walletId !== walletId) return {
-		ok: false,
-		code: "not_found",
-		message: "Email OTP outbox entry was not found"
-	};
+	if (!entry) return failure("not_found", "Email OTP outbox entry was not found");
+	if (entry.userId !== userId || entry.walletId !== walletId) return failure("not_found", "Email OTP outbox entry was not found");
 	if (input.nowMs > entry.expiresAtMs) {
 		input.memoryOutbox.delete(challengeId);
-		return {
-			ok: false,
-			code: "not_found",
-			message: "Email OTP outbox entry expired"
-		};
+		return failure("not_found", "Email OTP outbox entry expired");
 	}
 	return {
 		ok: true,

package/dist/esm/core/authService/emailOtpEnrollment.js

@@ -1,30 +1,15 @@
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import "../../shared-ts/src/utils/validation.js";
+import { failure } from "../../shared-ts/src/utils/failure.js";
 //#region src/core/authService/emailOtpEnrollment.ts
 async function readEmailOtpEnrollmentWithStore(input) {
 	const walletId = normalizeOptionalTrimmedString(input.request.walletId);
 	const orgId = normalizeOptionalTrimmedString(input.request.orgId);
-	if (!walletId) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Missing walletId"
-	};
-	if (!orgId) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Missing orgId"
-	};
+	if (!walletId) return failure("invalid_body", "Missing walletId");
+	if (!orgId) return failure("invalid_body", "Missing orgId");
 	const enrollment = await input.walletEnrollmentStore.get(walletId);
-	if (!enrollment) return {
-		ok: false,
-		code: "not_found",
-		message: "Email OTP enrollment not found"
-	};
-	if (enrollment.orgId !== orgId) return {
-		ok: false,
-		code: "tenant_scope_mismatch",
-		message: "Email OTP enrollment does not match the requested orgId"
-	};
+	if (!enrollment) return failure("not_found", "Email OTP enrollment not found");
+	if (enrollment.orgId !== orgId) return failure("tenant_scope_mismatch", "Email OTP enrollment does not match the requested orgId");
 	return {
 		ok: true,
 		enrollment
@@ -34,11 +19,7 @@ async function readActiveEmailOtpEnrollmentWithStore(input) {
 	const result = await readEmailOtpEnrollmentWithStore(input);
 	if (!result.ok) return result;
 	const providerUserId = normalizeOptionalTrimmedString(input.request.providerUserId);
-	if (providerUserId && result.enrollment.providerUserId !== providerUserId) return {
-		ok: false,
-		code: "provider_identity_mismatch",
-		message: "Email OTP enrollment does not match the requested provider user"
-	};
+	if (providerUserId && result.enrollment.providerUserId !== providerUserId) return failure("provider_identity_mismatch", "Email OTP enrollment does not match the requested provider user");
 	return result;
 }
 async function readEmailOtpAuthStateForEnrollmentWithStore(input) {
@@ -47,11 +28,7 @@ async function readEmailOtpAuthStateForEnrollmentWithStore(input) {
 		ok: true,
 		state: null
 	};
-	if (state.orgId !== input.enrollment.orgId || state.providerUserId !== input.enrollment.providerUserId) return {
-		ok: false,
-		code: "auth_state_enrollment_mismatch",
-		message: "Email OTP auth state does not match the active enrollment"
-	};
+	if (state.orgId !== input.enrollment.orgId || state.providerUserId !== input.enrollment.providerUserId) return failure("auth_state_enrollment_mismatch", "Email OTP auth state does not match the active enrollment");
 	return {
 		ok: true,
 		state
@@ -79,11 +56,7 @@ async function putEmailOtpAuthStateForEnrollmentWithStore(input) {
 }
 async function isEmailOtpStrongAuthRequiredWithStores(input) {
 	const walletId = normalizeOptionalTrimmedString(input.request.walletId);
-	if (!walletId) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Missing walletId"
-	};
+	if (!walletId) return failure("invalid_body", "Missing walletId");
 	const enrollment = await input.walletEnrollmentStore.get(walletId);
 	if (!enrollment) return {
 		ok: true,
@@ -113,11 +86,7 @@ async function isEmailOtpStrongAuthRequiredWithStores(input) {
 }
 async function markEmailOtpStrongAuthSatisfiedWithStores(input) {
 	const walletId = normalizeOptionalTrimmedString(input.request.walletId);
-	if (!walletId) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Missing walletId"
-	};
+	if (!walletId) return failure("invalid_body", "Missing walletId");
 	const enrollment = await input.walletEnrollmentStore.get(walletId);
 	if (!enrollment) return {
 		ok: true,

package/dist/esm/core/authService/emailOtpGrant.js

@@ -1,5 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import "../../shared-ts/src/utils/validation.js";
+import { failure } from "../../shared-ts/src/utils/failure.js";
 import { errorMessage } from "../../shared-ts/src/utils/errors.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS } from "../../shared-ts/src/utils/emailOtpDomain.js";
 //#region src/core/authService/emailOtpGrant.ts
@@ -11,31 +12,11 @@ async function consumeEmailOtpGrantWithStore(input) {
 		const orgId = normalizeOptionalTrimmedString(input.request.orgId) || "";
 		const otpChannel = normalizeOptionalTrimmedString(input.request.otpChannel);
 		const clientIp = normalizeOptionalTrimmedString(input.request.clientIp) || void 0;
-		if (!loginGrant) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing loginGrant"
-		};
-		if (!userId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing userId"
-		};
-		if (!walletId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing walletId"
-		};
-		if (!orgId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing orgId"
-		};
-		if (otpChannel !== "email_otp") return {
-			ok: false,
-			code: "invalid_body",
-			message: "otpChannel must be email_otp"
-		};
+		if (!loginGrant) return failure("invalid_body", "Missing loginGrant");
+		if (!userId) return failure("invalid_body", "Missing userId");
+		if (!walletId) return failure("invalid_body", "Missing walletId");
+		if (!orgId) return failure("invalid_body", "Missing orgId");
+		if (otpChannel !== "email_otp") return failure("invalid_body", "otpChannel must be email_otp");
 		const rateLimit = await input.consumeRateLimit({
 			scope: "grant",
 			userId,
@@ -45,27 +26,15 @@ async function consumeEmailOtpGrantWithStore(input) {
 		});
 		if (!rateLimit.ok) return rateLimit;
 		const record = await input.grantStore.consume(loginGrant);
-		if (!record || input.nowMs > record.expiresAtMs || record.action !== WALLET_EMAIL_OTP_ACTIONS.unseal) return {
-			ok: false,
-			code: "login_grant_invalid_or_expired",
-			message: "Login grant is invalid or expired"
-		};
-		if (record.userId !== userId || record.walletId !== walletId || record.otpChannel !== "email_otp" || record.orgId !== orgId) return {
-			ok: false,
-			code: "recovery_grant_binding_mismatch",
-			message: "Recovery grant is not valid for the current Email OTP authority"
-		};
+		if (!record || input.nowMs > record.expiresAtMs || record.action !== WALLET_EMAIL_OTP_ACTIONS.unseal) return failure("login_grant_invalid_or_expired", "Login grant is invalid or expired");
+		if (record.userId !== userId || record.walletId !== walletId || record.otpChannel !== "email_otp" || record.orgId !== orgId) return failure("recovery_grant_binding_mismatch", "Recovery grant is not valid for the current Email OTP authority");
 		return {
 			ok: true,
 			challengeId: record.challengeId,
 			otpChannel: EMAIL_OTP_CHANNEL
 		};
 	} catch (error) {
-		return {
-			ok: false,
-			code: "internal",
-			message: errorMessage(error) || "Failed to consume Email OTP grant"
-		};
+		return failure("internal", errorMessage(error) || "Failed to consume Email OTP grant");
 	}
 }
 //#endregion