@seams/wallet-server 0.6.2 → 0.7.3

package/dist/esm/core/authService/emailOtpRegistrationEnrollment.js

@@ -1,190 +1,25 @@
 import { parseWalletId } from "../../shared-ts/src/utils/domainIds.js";
-import { base64UrlDecode } from "../../shared-ts/src/utils/base64.js";
-import "../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import "../../shared-ts/src/utils/validation.js";
+import { failure } from "../../shared-ts/src/utils/failure.js";
 import { validateSecp256k1PublicKey33 } from "../ThresholdService/evmCryptoWasm.js";
 import { WALLET_EMAIL_OTP_ACTIONS, emailOtpDeviceEnrollmentId } from "../../shared-ts/src/utils/emailOtpDomain.js";
+import { validateEmailOtpEnrollmentMaterial } from "../../router/cloudflare/d1/emailOtp/d1EmailOtpRecords.js";
 import { parseRawEmailOtpRegistrationChallengeProofInput } from "./emailOtpChallengeProof.js";
 import { completeGoogleEmailOtpRegistrationAttemptWithStore } from "./googleEmailOtpRegistration.js";
 //#region src/core/authService/emailOtpRegistrationEnrollment.ts
 function assertNever(value) {
 	throw new Error(`Unexpected value: ${String(value)}`);
 }
-async function validateEmailOtpEnrollmentMaterial(request) {
-	const enrollmentSealKeyVersion = normalizeOptionalTrimmedString(request.enrollmentSealKeyVersion);
-	const clientUnlockPublicKeyB64u = normalizeOptionalTrimmedString(request.clientUnlockPublicKeyB64u);
-	const unlockKeyVersion = normalizeOptionalTrimmedString(request.unlockKeyVersion);
-	const serverSealedFactorCiphertextB64u = normalizeOptionalTrimmedString(request.serverSealedFactorCiphertextB64u);
-	if (!enrollmentSealKeyVersion) return {
-		ok: false,
-		code: "invalid_body",
-		message: "enrollmentSealKeyVersion is required"
-	};
-	if (!clientUnlockPublicKeyB64u) return {
-		ok: false,
-		code: "invalid_body",
-		message: "clientUnlockPublicKeyB64u is required"
-	};
-	if (!unlockKeyVersion) return {
-		ok: false,
-		code: "invalid_body",
-		message: "unlockKeyVersion is required"
-	};
-	if (!serverSealedFactorCiphertextB64u) return {
-		ok: false,
-		code: "invalid_body",
-		message: "serverSealedFactorCiphertextB64u is required"
-	};
-	let unlockPublicKeyBytes;
-	try {
-		unlockPublicKeyBytes = base64UrlDecode(clientUnlockPublicKeyB64u);
-	} catch {
-		return {
-			ok: false,
-			code: "invalid_body",
-			message: "clientUnlockPublicKeyB64u must be valid base64url"
-		};
-	}
-	if (unlockPublicKeyBytes.length !== 33) return {
-		ok: false,
-		code: "invalid_body",
-		message: "clientUnlockPublicKeyB64u must decode to 33 bytes (compressed secp256k1 pubkey)"
-	};
-	try {
-		await validateSecp256k1PublicKey33(unlockPublicKeyBytes);
-	} catch {
-		return {
-			ok: false,
-			code: "invalid_body",
-			message: "clientUnlockPublicKeyB64u is not a valid secp256k1 public key"
-		};
-	}
-	return {
-		ok: true,
-		enrollmentSealKeyVersion,
-		clientUnlockPublicKeyB64u,
-		unlockKeyVersion,
-		serverSealedFactorCiphertextB64u
-	};
-}
-async function buildEmailOtpRegistrationEnrollmentPersistence(input) {
-	const enrollmentMaterial = await validateEmailOtpEnrollmentMaterial(input.material);
-	if (!enrollmentMaterial.ok) return enrollmentMaterial;
-	const orgId = normalizeOptionalTrimmedString(input.orgId) || "";
-	const walletId = normalizeOptionalTrimmedString(input.walletId) || "";
-	const authSubjectId = normalizeOptionalTrimmedString(input.authSubjectId) || "";
-	const verifiedEmail = normalizeOptionalTrimmedString(input.verifiedEmail)?.toLowerCase() || "";
-	if (!orgId || !walletId || !authSubjectId || !verifiedEmail) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Email OTP registration enrollment requires wallet, org, and email identity"
-	};
-	const existing = await input.walletEnrollmentStore.get(walletId);
-	const existingState = await input.authStateStore.get(walletId);
-	const enrollment = {
-		version: "email_otp_wallet_enrollment_v1",
-		walletId,
-		providerUserId: authSubjectId,
-		orgId,
-		verifiedEmail,
-		enrollmentId: emailOtpDeviceEnrollmentId(walletId, authSubjectId),
-		enrollmentVersion: "1",
-		enrollmentSealKeyVersion: enrollmentMaterial.enrollmentSealKeyVersion,
-		serverSealedFactorCiphertextB64u: enrollmentMaterial.serverSealedFactorCiphertextB64u,
-		clientUnlockPublicKeyB64u: enrollmentMaterial.clientUnlockPublicKeyB64u,
-		unlockKeyVersion: enrollmentMaterial.unlockKeyVersion,
-		createdAtMs: existing?.createdAtMs ?? input.nowMs,
-		updatedAtMs: input.nowMs
-	};
-	const existingProviderEnrollment = await input.walletEnrollmentStore.getByProviderUserId({
-		providerUserId: enrollment.providerUserId,
-		orgId: enrollment.orgId
-	});
-	const authState = {
-		version: "email_otp_auth_state_v1",
-		walletId: enrollment.walletId,
-		providerUserId: enrollment.providerUserId,
-		orgId: enrollment.orgId,
-		createdAtMs: existingState && existingState.providerUserId === enrollment.providerUserId && existingState.orgId === enrollment.orgId ? existingState.createdAtMs : input.nowMs,
-		updatedAtMs: input.nowMs,
-		otpFailureCount: 0,
-		lastOtpFailureAtMs: void 0,
-		otpLockedUntilMs: void 0,
-		...existingState?.lastEmailOtpLoginAtMs && existingState.providerUserId === enrollment.providerUserId && existingState.orgId === enrollment.orgId ? { lastEmailOtpLoginAtMs: existingState.lastEmailOtpLoginAtMs } : {},
-		...existingState?.lastStrongAuthAtMs && existingState.providerUserId === enrollment.providerUserId && existingState.orgId === enrollment.orgId ? { lastStrongAuthAtMs: existingState.lastStrongAuthAtMs } : {}
-	};
-	return {
-		ok: true,
-		persistence: {
-			...existingProviderEnrollment && existingProviderEnrollment.walletId !== enrollment.walletId ? { previousProviderWalletId: existingProviderEnrollment.walletId } : {},
-			enrollment,
-			authState
-		}
-	};
-}
-async function emailOtpEnrollmentPersistenceForRegistrationFinalize(input) {
-	if (input.authority.kind !== "email_otp") {
-		if (input.request.emailOtpEnrollment) return {
-			ok: false,
-			code: "invalid_body",
-			message: "emailOtpEnrollment is only valid for Email OTP registration"
-		};
-		return { ok: true };
-	}
-	if (!input.request.emailOtpEnrollment) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Email OTP registration finalize requires emailOtpEnrollment"
-	};
-	if (input.authority.walletId !== input.walletId || input.authority.finalWalletId !== input.walletId || input.authority.orgId !== input.orgId) return {
-		ok: false,
-		code: "authority_binding_mismatch",
-		message: "Email OTP registration authority does not match finalize scope"
-	};
-	const authSubjectId = normalizeOptionalTrimmedString(input.authority.providerSubject) || "";
-	const verifiedEmail = normalizeOptionalTrimmedString(input.authority.email)?.toLowerCase() || "";
-	const enrollment = await buildEmailOtpRegistrationEnrollmentPersistence({
-		walletEnrollmentStore: input.walletEnrollmentStore,
-		authStateStore: input.authStateStore,
-		walletId: input.walletId,
-		orgId: input.orgId,
-		authSubjectId,
-		verifiedEmail,
-		material: input.request.emailOtpEnrollment,
-		nowMs: input.nowMs
-	});
-	if (!enrollment.ok) return enrollment;
-	return {
-		ok: true,
-		persistence: enrollment.persistence
-	};
-}
 async function resolveEmailOtpRegistrationChallengeProof(input) {
 	const proofInput = input.proofInput;
 	switch (proofInput.kind) {
 		case "google_registration_attempt": {
 			const attempt = await input.registrationAttemptStore.get(proofInput.registrationAttemptId);
-			if (!attempt) return {
-				ok: false,
-				code: "registration_attempt_missing",
-				message: "Google Email OTP registration attempt expired or was not found"
-			};
-			if (attempt.providerSubject !== proofInput.providerSubject) return {
-				ok: false,
-				code: "challenge_subject_mismatch",
-				message: "Email OTP registration attempt does not match the provider subject"
-			};
-			if (attempt.expiresAtMs <= input.nowMs) return {
-				ok: false,
-				code: "registration_attempt_expired",
-				message: "Google Email OTP registration attempt expired"
-			};
-			if (attempt.walletId !== proofInput.walletId) return {
-				ok: false,
-				code: "wallet_identity_mismatch",
-				message: "registrationAttemptId does not match walletId"
-			};
+			if (!attempt) return failure("registration_attempt_missing", "Google Email OTP registration attempt expired or was not found");
+			if (attempt.providerSubject !== proofInput.providerSubject) return failure("challenge_subject_mismatch", "Email OTP registration attempt does not match the provider subject");
+			if (attempt.expiresAtMs <= input.nowMs) return failure("registration_attempt_expired", "Google Email OTP registration attempt expired");
+			if (attempt.walletId !== proofInput.walletId) return failure("wallet_identity_mismatch", "registrationAttemptId does not match walletId");
 			return {
 				ok: true,
 				proof: {
@@ -235,30 +70,17 @@ async function verifyEmailOtpEnrollment(input) {
 	});
 	if (!verified.ok) return verified;
 	const verifiedEmail = normalizeOptionalTrimmedString(verified.email)?.toLowerCase();
-	if (!verifiedEmail) return {
-		ok: false,
-		code: "internal",
-		message: "Email OTP enrollment verification did not include a verified email"
-	};
-	const enrollmentMaterial = await validateEmailOtpEnrollmentMaterial(request);
+	if (!verifiedEmail) return failure("internal", "Email OTP enrollment verification did not include a verified email");
+	const enrollmentMaterial = await validateEmailOtpEnrollmentMaterial({
+		material: request,
+		validateSecp256k1PublicKey33
+	});
 	if (!enrollmentMaterial.ok) return enrollmentMaterial;
 	const orgId = normalizeOptionalTrimmedString(verified.orgId) || "";
-	if (!orgId) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Email OTP enrollment requires orgId tenant scope"
-	};
+	if (!orgId) return failure("invalid_body", "Email OTP enrollment requires orgId tenant scope");
 	const verifiedWalletId = parseWalletId(verified.walletId);
-	if (!verifiedWalletId.ok) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Email OTP enrollment verification returned an invalid walletId"
-	};
-	if (!await input.walletStore.getWallet({ walletId: verifiedWalletId.value })) return {
-		ok: false,
-		code: "wallet_registration_incomplete",
-		message: "Email OTP enrollment requires a canonical wallet created by /wallets/register/activate."
-	};
+	if (!verifiedWalletId.ok) return failure("invalid_body", "Email OTP enrollment verification returned an invalid walletId");
+	if (!await input.walletStore.getWallet({ walletId: verifiedWalletId.value })) return failure("wallet_registration_incomplete", "Email OTP enrollment requires a canonical wallet created by /wallets/register/activate.");
 	const existing = await input.walletEnrollmentStore.get(verified.walletId);
 	const existingState = await input.authStateStore.get(verified.walletId);
 	const nowMs = Date.now();
@@ -317,6 +139,6 @@ async function verifyEmailOtpEnrollment(input) {
 	};
 }
 //#endregion
-export { buildEmailOtpRegistrationEnrollmentPersistence, emailOtpEnrollmentPersistenceForRegistrationFinalize, resolveEmailOtpRegistrationChallengeProof, validateEmailOtpEnrollmentMaterial, verifyEmailOtpEnrollment };
+export { verifyEmailOtpEnrollment };
 
 //# sourceMappingURL=emailOtpRegistrationEnrollment.js.map

package/dist/esm/core/authService/emailOtpSeal.js

@@ -1,16 +1,13 @@
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import "../../shared-ts/src/utils/validation.js";
+import { failure } from "../../shared-ts/src/utils/failure.js";
 import { errorMessage } from "../../shared-ts/src/utils/errors.js";
 import { createSigningSessionSealShamir3PassCipherAdapter } from "../../threshold/session/signingSessionSeal/crypto/cipher.js";
 import { parseSigningSessionSealRootConfig } from "../../threshold/session/signingSessionSeal/options.js";
 import "../../threshold/session/signingSessionSeal/index.js";
 //#region src/core/authService/emailOtpSeal.ts
 function createEmailOtpShamirCipherFromConfig(input) {
-	if (!input.rootSecretB64u || !input.currentKeyVersion) return {
-		ok: false,
-		code: "not_configured",
-		message: "Email OTP unseal requires a signing-session seal root and current key version"
-	};
+	if (!input.rootSecretB64u || !input.currentKeyVersion) return failure("not_configured", "Email OTP unseal requires a signing-session seal root and current key version");
 	try {
 		const config = parseSigningSessionSealRootConfig({
 			rootSecretB64u: input.rootSecretB64u,
@@ -23,11 +20,7 @@ function createEmailOtpShamirCipherFromConfig(input) {
 			cipher: createSigningSessionSealShamir3PassCipherAdapter({ config })
 		};
 	} catch (error) {
-		return {
-			ok: false,
-			code: "not_configured",
-			message: errorMessage(error) || "Email OTP Shamir configuration is invalid"
-		};
+		return failure("not_configured", errorMessage(error) || "Email OTP Shamir configuration is invalid");
 	}
 }
 function emailOtpServerSealThresholdSessionId(operation) {
@@ -45,11 +38,7 @@ function emailOtpServerSealFailureMessage(operation) {
 async function runEmailOtpServerSealOperation(input) {
 	try {
 		const wrappedCiphertext = normalizeOptionalTrimmedString(input.request.wrappedCiphertext);
-		if (!wrappedCiphertext) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing wrappedCiphertext"
-		};
+		if (!wrappedCiphertext) return failure("invalid_body", "Missing wrappedCiphertext");
 		if (!input.shamir.ok) return input.shamir;
 		const result = await input.shamir.cipher.run({
 			operation: input.operation,
@@ -65,11 +54,7 @@ async function runEmailOtpServerSealOperation(input) {
 			enrollmentSealKeyVersion: result.keyVersion || input.shamir.keyVersion
 		};
 	} catch (error) {
-		return {
-			ok: false,
-			code: "internal",
-			message: errorMessage(error) || emailOtpServerSealFailureMessage(input.operation)
-		};
+		return failure("internal", errorMessage(error) || emailOtpServerSealFailureMessage(input.operation));
 	}
 }
 //#endregion

package/dist/esm/core/authService/emailOtpUnlock.js

@@ -2,6 +2,7 @@ import { base64UrlDecode, base64UrlEncode } from "../../shared-ts/src/utils/base
 import "../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import "../../shared-ts/src/utils/validation.js";
+import { failedVerification, failure } from "../../shared-ts/src/utils/failure.js";
 import { validateSecp256k1PublicKey33, verifySecp256k1RecoverableSignatureAgainstPublicKey33 } from "../ThresholdService/evmCryptoWasm.js";
 import { errorMessage } from "../../shared-ts/src/utils/errors.js";
 import { parseBoundaryWalletId } from "./webauthnWalletBinding.js";
@@ -60,27 +61,15 @@ async function createEmailOtpUnlockChallenge(input) {
 	try {
 		const walletId = parsedUnlockWalletId(input.request.walletId);
 		const orgId = normalizeOptionalTrimmedString(input.request.orgId) || void 0;
-		if (!normalizeOptionalTrimmedString(input.request.walletId)) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing walletId"
-		};
-		if (!walletId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Invalid walletId"
-		};
+		if (!normalizeOptionalTrimmedString(input.request.walletId)) return failure("invalid_body", "Missing walletId");
+		if (!walletId) return failure("invalid_body", "Invalid walletId");
 		const activeEnrollment = await input.readActiveEnrollment({
 			walletId,
 			orgId
 		});
 		if (!activeEnrollment.ok) return activeEnrollment;
 		const enrollment = activeEnrollment.enrollment;
-		if (typeof crypto === "undefined" || typeof crypto.getRandomValues !== "function") return {
-			ok: false,
-			code: "unsupported",
-			message: "crypto.getRandomValues is unavailable in this runtime"
-		};
+		if (typeof crypto === "undefined" || typeof crypto.getRandomValues !== "function") return failure("unsupported", "crypto.getRandomValues is unavailable in this runtime");
 		const createdAtMs = Date.now();
 		const expiresAtMs = createdAtMs + clampedUnlockTtlMs(input.request.ttlMs ?? input.request.ttl_ms);
 		const challengeId = base64UrlEncode(crypto.getRandomValues(new Uint8Array(16)));
@@ -104,11 +93,7 @@ async function createEmailOtpUnlockChallenge(input) {
 			unlockKeyVersion: enrollment.unlockKeyVersion
 		};
 	} catch (e) {
-		return {
-			ok: false,
-			code: "internal",
-			message: errorMessage(e) || "Failed to create Email OTP unlock challenge"
-		};
+		return failure("internal", errorMessage(e) || "Failed to create Email OTP unlock challenge");
 	}
 }
 async function verifyEmailOtpUnlockProof(input) {
@@ -116,61 +101,21 @@ async function verifyEmailOtpUnlockProof(input) {
 		const walletId = parsedUnlockWalletId(input.request.walletId);
 		const orgId = normalizeOptionalTrimmedString(input.request.orgId) || void 0;
 		const challengeId = normalizeOptionalTrimmedString(input.request.challengeId);
-		if (!normalizeOptionalTrimmedString(input.request.walletId)) return {
-			ok: false,
-			verified: false,
-			code: "invalid_body",
-			message: "Missing walletId"
-		};
-		if (!walletId) return {
-			ok: false,
-			verified: false,
-			code: "invalid_body",
-			message: "Invalid walletId"
-		};
-		if (!challengeId) return {
-			ok: false,
-			verified: false,
-			code: "invalid_body",
-			message: "Missing challengeId"
-		};
+		if (!normalizeOptionalTrimmedString(input.request.walletId)) return failedVerification("invalid_body", "Missing walletId");
+		if (!walletId) return failedVerification("invalid_body", "Invalid walletId");
+		if (!challengeId) return failedVerification("invalid_body", "Missing challengeId");
 		const unlockProof = parseUnlockProof(input.request.unlockProof);
-		if (!unlockProof) return {
-			ok: false,
-			verified: false,
-			code: "invalid_body",
-			message: "unlockProof is required"
-		};
+		if (!unlockProof) return failedVerification("invalid_body", "unlockProof is required");
 		const challengeRecord = await input.unlockChallengeStore.consume(challengeId);
-		if (!challengeRecord || Date.now() > challengeRecord.expiresAtMs) return {
-			ok: false,
-			verified: false,
-			code: "challenge_expired_or_invalid",
-			message: "Email OTP unlock challenge expired or invalid"
-		};
-		if (challengeRecord.walletId !== walletId) return {
-			ok: false,
-			verified: false,
-			code: "challenge_binding_mismatch",
-			message: "Email OTP unlock challenge is not valid for this walletId"
-		};
+		if (!challengeRecord || Date.now() > challengeRecord.expiresAtMs) return failedVerification("challenge_expired_or_invalid", "Email OTP unlock challenge expired or invalid");
+		if (challengeRecord.walletId !== walletId) return failedVerification("challenge_binding_mismatch", "Email OTP unlock challenge is not valid for this walletId");
 		const activeEnrollment = await input.readActiveEnrollment({
 			walletId,
 			orgId
 		});
-		if (!activeEnrollment.ok) return {
-			ok: false,
-			verified: false,
-			code: activeEnrollment.code,
-			message: activeEnrollment.message
-		};
+		if (!activeEnrollment.ok) return failedVerification(activeEnrollment.code, activeEnrollment.message);
 		const enrollment = activeEnrollment.enrollment;
-		if (challengeRecord.userId !== enrollment.providerUserId || challengeRecord.orgId !== enrollment.orgId) return {
-			ok: false,
-			verified: false,
-			code: "challenge_binding_mismatch",
-			message: "Email OTP unlock challenge is not valid for this enrollment"
-		};
+		if (challengeRecord.userId !== enrollment.providerUserId || challengeRecord.orgId !== enrollment.orgId) return failedVerification("challenge_binding_mismatch", "Email OTP unlock challenge is not valid for this enrollment");
 		const publicKeyDecode = decodeBase64UrlField({
 			value: unlockProof.publicKey,
 			missingMessage: "unlockProof.publicKey is required",
@@ -178,21 +123,11 @@ async function verifyEmailOtpUnlockProof(input) {
 			expectedLength: 33,
 			expectedLengthMessage: "unlockProof.publicKey must decode to 33 bytes"
 		});
-		if (!publicKeyDecode.ok) return {
-			ok: false,
-			verified: false,
-			code: "invalid_body",
-			message: publicKeyDecode.message
-		};
+		if (!publicKeyDecode.ok) return failedVerification("invalid_body", publicKeyDecode.message);
 		try {
 			await validateSecp256k1PublicKey33(publicKeyDecode.bytes);
 		} catch {
-			return {
-				ok: false,
-				verified: false,
-				code: "invalid_body",
-				message: "unlockProof.publicKey is not a valid secp256k1 public key"
-			};
+			return failedVerification("invalid_body", "unlockProof.publicKey is not a valid secp256k1 public key");
 		}
 		const signatureDecode = decodeBase64UrlField({
 			value: unlockProof.signatureB64u,
@@ -201,18 +136,8 @@ async function verifyEmailOtpUnlockProof(input) {
 			expectedLength: 65,
 			expectedLengthMessage: "unlockProof.signature must decode to 65 bytes"
 		});
-		if (!signatureDecode.ok) return {
-			ok: false,
-			verified: false,
-			code: "invalid_body",
-			message: signatureDecode.message
-		};
-		if (!byteArraysEqual(base64UrlDecode(enrollment.clientUnlockPublicKeyB64u), publicKeyDecode.bytes)) return {
-			ok: false,
-			verified: false,
-			code: "invalid_unlock_proof",
-			message: "unlockProof.publicKey does not match the enrolled clientUnlockPublicKeyB64u"
-		};
+		if (!signatureDecode.ok) return failedVerification("invalid_body", signatureDecode.message);
+		if (!byteArraysEqual(base64UrlDecode(enrollment.clientUnlockPublicKeyB64u), publicKeyDecode.bytes)) return failedVerification("invalid_unlock_proof", "unlockProof.publicKey does not match the enrolled clientUnlockPublicKeyB64u");
 		const challengeDigestDecode = decodeBase64UrlField({
 			value: challengeRecord.challengeB64u,
 			missingMessage: "Stored unlock challenge digest was invalid",
@@ -220,21 +145,11 @@ async function verifyEmailOtpUnlockProof(input) {
 			expectedLength: 32,
 			expectedLengthMessage: "Stored unlock challenge digest must decode to 32 bytes"
 		});
-		if (!challengeDigestDecode.ok) return {
-			ok: false,
-			verified: false,
-			code: "internal",
-			message: challengeDigestDecode.message
-		};
+		if (!challengeDigestDecode.ok) return failedVerification("internal", challengeDigestDecode.message);
 		try {
 			await verifySecp256k1RecoverableSignatureAgainstPublicKey33(challengeDigestDecode.bytes, signatureDecode.bytes, publicKeyDecode.bytes);
 		} catch {
-			return {
-				ok: false,
-				verified: false,
-				code: "invalid_unlock_proof",
-				message: "unlockProof.signature did not verify against unlockProof.publicKey"
-			};
+			return failedVerification("invalid_unlock_proof", "unlockProof.signature did not verify against unlockProof.publicKey");
 		}
 		const nowMs = Date.now();
 		await input.putAuthStateForEnrollment(enrollment, { lastEmailOtpLoginAtMs: nowMs });
@@ -250,12 +165,7 @@ async function verifyEmailOtpUnlockProof(input) {
 			unlockKeyVersion: enrollment.unlockKeyVersion
 		};
 	} catch (e) {
-		return {
-			ok: false,
-			verified: false,
-			code: "internal",
-			message: errorMessage(e) || "Failed to verify Email OTP unlock proof"
-		};
+		return failedVerification("internal", errorMessage(e) || "Failed to verify Email OTP unlock proof");
 	}
 }
 //#endregion