@seams/wallet-server 0.6.2 → 0.7.3

package/dist/esm/core/authService/googleEmailOtpRegistration.js

@@ -1,8 +1,9 @@
 import { parseGoogleProviderSubject, parseOrgId, parseVerifiedGoogleEmail } from "../../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import "../../shared-ts/src/utils/validation.js";
+import { failure } from "../../shared-ts/src/utils/failure.js";
 import { GOOGLE_EMAIL_OTP_STALE_IDENTITY_MESSAGE } from "./googleEmailOtpErrors.js";
-import { randomOpaqueId } from "./bytes.js";
+import { randomBase64Url } from "./bytes.js";
 import { readActiveEmailOtpEnrollmentWithStore } from "./emailOtpEnrollment.js";
 //#region src/core/authService/googleEmailOtpRegistration.ts
 async function cleanupGoogleEmailOtpRegistrationAttemptsWithStore(input) {
@@ -11,23 +12,11 @@ async function cleanupGoogleEmailOtpRegistrationAttemptsWithStore(input) {
 async function consumeGoogleEmailOtpRegistrationAttemptRateLimitWithDeps(input) {
 	if (normalizeOptionalTrimmedString(input.request.accountMode)?.toLowerCase() !== "register") return { ok: true };
 	const providerSubject = parseGoogleProviderSubject(input.request.providerSubject);
-	if (!providerSubject.ok) return {
-		ok: false,
-		code: "invalid_body",
-		message: providerSubject.error.message
-	};
+	if (!providerSubject.ok) return failure("invalid_body", providerSubject.error.message);
 	const email = parseVerifiedGoogleEmail(input.request.email);
-	if (!email.ok) return {
-		ok: false,
-		code: "invalid_body",
-		message: email.error.message
-	};
+	if (!email.ok) return failure("invalid_body", email.error.message);
 	const orgId = parseOrgId(input.request.runtimePolicyScope?.orgId);
-	if (!orgId.ok) return {
-		ok: false,
-		code: "invalid_body",
-		message: orgId.error.message
-	};
+	if (!orgId.ok) return failure("invalid_body", orgId.error.message);
 	const restartOffer = isTruthyBoundaryFlag(input.request.restartRegistrationOffer);
 	return await input.consumeRateLimit({
 		scope: "googleRegistrationAttempt",
@@ -79,34 +68,18 @@ async function completeGoogleEmailOtpRegistrationAttemptWithStore(input) {
 	if (!registrationAttemptId) return { ok: true };
 	const walletId = normalizeOptionalTrimmedString(input.walletId);
 	const attempt = await input.registrationAttemptStore.get(registrationAttemptId);
-	if (!attempt) return {
-		ok: false,
-		code: "registration_incomplete",
-		message: "Google Email OTP registration attempt expired or was not found"
-	};
+	if (!attempt) return failure("registration_incomplete", "Google Email OTP registration attempt expired or was not found");
 	if (attempt.expiresAtMs <= input.nowMs) {
 		await input.registrationAttemptStore.put({
 			...attempt,
 			state: "expired",
 			updatedAtMs: input.nowMs
 		});
-		return {
-			ok: false,
-			code: "registration_incomplete",
-			message: "Google Email OTP registration attempt expired"
-		};
+		return failure("registration_incomplete", "Google Email OTP registration attempt expired");
 	}
-	if (walletId !== attempt.walletId) return {
-		ok: false,
-		code: "wallet_identity_mismatch",
-		message: "registrationAttemptId does not match walletId"
-	};
+	if (walletId !== attempt.walletId) return failure("wallet_identity_mismatch", "registrationAttemptId does not match walletId");
 	if (attempt.state === "active") return { ok: true };
-	if (attempt.state !== "started" && attempt.state !== "key_finalized") return {
-		ok: false,
-		code: "registration_incomplete",
-		message: "Google Email OTP registration attempt is no longer active"
-	};
+	if (attempt.state !== "started" && attempt.state !== "key_finalized") return failure("registration_incomplete", "Google Email OTP registration attempt is no longer active");
 	const linked = await input.identityStore.linkSubjectToUserId({
 		userId: attempt.walletId,
 		subject: `wallet:${attempt.providerSubject}`,
@@ -119,11 +92,7 @@ async function completeGoogleEmailOtpRegistrationAttemptWithStore(input) {
 			failureCode: linked.code,
 			updatedAtMs: input.nowMs
 		});
-		return {
-			ok: false,
-			code: linked.code,
-			message: linked.message
-		};
+		return failure(linked.code, linked.message);
 	}
 	await input.registrationAttemptStore.put({
 		...attempt,
@@ -137,52 +106,24 @@ async function validateGoogleEmailOtpRegistrationCandidateWalletWithStore(input)
 	const walletId = normalizeOptionalTrimmedString(input.walletId);
 	const ownerProofBindingDigest = normalizeOptionalTrimmedString(input.ownerProofBindingDigest);
 	const providerSubject = normalizeOptionalTrimmedString(input.providerSubject);
-	if (!registrationAttemptId || !walletId || !ownerProofBindingDigest || !providerSubject) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Google Email OTP registration candidate validation requires signed session scope"
-	};
+	if (!registrationAttemptId || !walletId || !ownerProofBindingDigest || !providerSubject) return failure("invalid_body", "Google Email OTP registration candidate validation requires signed session scope");
 	const attempt = await input.registrationAttemptStore.get(registrationAttemptId);
-	if (!attempt) return {
-		ok: false,
-		code: "registration_attempt_missing",
-		message: "Google Email OTP registration attempt expired or was not found"
-	};
+	if (!attempt) return failure("registration_attempt_missing", "Google Email OTP registration attempt expired or was not found");
 	if (attempt.expiresAtMs <= input.nowMs) {
 		await input.registrationAttemptStore.put({
 			...attempt,
 			state: "expired",
 			updatedAtMs: input.nowMs
 		});
-		return {
-			ok: false,
-			code: "registration_attempt_expired",
-			message: "Google Email OTP registration attempt expired"
-		};
+		return failure("registration_attempt_expired", "Google Email OTP registration attempt expired");
 	}
-	if (attempt.providerSubject !== providerSubject) return {
-		ok: false,
-		code: "challenge_subject_mismatch",
-		message: "Email OTP registration attempt does not match the provider subject"
-	};
-	if (attempt.ownerProofBindingDigest !== ownerProofBindingDigest) return {
-		ok: false,
-		code: "owner_proof_binding_mismatch",
-		message: "Google Email OTP registration attempt does not match the owner proof binding"
-	};
-	if (attempt.state !== "started" && attempt.state !== "key_finalized") return {
-		ok: false,
-		code: "registration_incomplete",
-		message: "Google Email OTP registration attempt is no longer active"
-	};
+	if (attempt.providerSubject !== providerSubject) return failure("challenge_subject_mismatch", "Email OTP registration attempt does not match the provider subject");
+	if (attempt.ownerProofBindingDigest !== ownerProofBindingDigest) return failure("owner_proof_binding_mismatch", "Google Email OTP registration attempt does not match the owner proof binding");
+	if (attempt.state !== "started" && attempt.state !== "key_finalized") return failure("registration_incomplete", "Google Email OTP registration attempt is no longer active");
 	if (!findGoogleEmailOtpOfferCandidateByWalletId({
 		candidates: attempt.offerCandidates,
 		walletId
-	})) return {
-		ok: false,
-		code: "wallet_identity_mismatch",
-		message: "walletId is not an active Google Email OTP registration candidate"
-	};
+	})) return failure("wallet_identity_mismatch", "walletId is not an active Google Email OTP registration candidate");
 	return { ok: true };
 }
 async function recordGoogleEmailOtpRegistrationAttemptPublicKeyWithStore(input) {
@@ -191,33 +132,17 @@ async function recordGoogleEmailOtpRegistrationAttemptPublicKeyWithStore(input)
 	const walletId = normalizeOptionalTrimmedString(input.walletId);
 	const finalizedPublicKey = normalizeOptionalTrimmedString(input.finalizedPublicKey);
 	const attempt = await input.registrationAttemptStore.get(registrationAttemptId);
-	if (!attempt) return {
-		ok: false,
-		code: "registration_incomplete",
-		message: "Google Email OTP registration attempt expired or was not found"
-	};
+	if (!attempt) return failure("registration_incomplete", "Google Email OTP registration attempt expired or was not found");
 	if (attempt.expiresAtMs <= input.nowMs) {
 		await input.registrationAttemptStore.put({
 			...attempt,
 			state: "expired",
 			updatedAtMs: input.nowMs
 		});
-		return {
-			ok: false,
-			code: "registration_incomplete",
-			message: "Google Email OTP registration attempt expired"
-		};
+		return failure("registration_incomplete", "Google Email OTP registration attempt expired");
 	}
-	if (walletId !== attempt.walletId) return {
-		ok: false,
-		code: "wallet_identity_mismatch",
-		message: "registrationAttemptId does not match walletId"
-	};
-	if (attempt.state !== "started" && attempt.state !== "key_finalized" && attempt.state !== "active") return {
-		ok: false,
-		code: "registration_incomplete",
-		message: "Google Email OTP registration attempt is no longer active"
-	};
+	if (walletId !== attempt.walletId) return failure("wallet_identity_mismatch", "registrationAttemptId does not match walletId");
+	if (attempt.state !== "started" && attempt.state !== "key_finalized" && attempt.state !== "active") return failure("registration_incomplete", "Google Email OTP registration attempt is no longer active");
 	if (attempt.state === "started") {
 		if (!finalizedPublicKey) await input.registrationAttemptStore.put({
 			...attempt,
@@ -253,17 +178,9 @@ async function failGoogleEmailOtpRegistrationAttemptWithStore(input) {
 	});
 }
 async function cleanupGoogleEmailOtpDevRegistrationStateWithStores(input) {
-	if (input.isProductionEnvironment) return {
-		ok: false,
-		code: "not_found",
-		message: "Google Email OTP dev cleanup is not available"
-	};
+	if (input.isProductionEnvironment) return failure("not_found", "Google Email OTP dev cleanup is not available");
 	const providerSubject = normalizeOptionalTrimmedString(input.providerSubject);
-	if (!providerSubject || !providerSubject.startsWith("google:")) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Missing Google provider subject"
-	};
+	if (!providerSubject || !providerSubject.startsWith("google:")) return failure("invalid_body", "Missing Google provider subject");
 	const requestedWalletId = normalizeOptionalTrimmedString(input.walletId);
 	const requestedOrgId = normalizeOptionalTrimmedString(input.orgId);
 	const nowMsRaw = typeof input.nowMs === "number" ? input.nowMs : Number(input.nowMs);
@@ -473,7 +390,7 @@ async function resolveRegistrationForExistingEnrollment(input) {
 async function createGoogleEmailOtpRegistrationOffer(input) {
 	const nowMs = Date.now();
 	const authProvider = "google_oidc";
-	const walletIdDerivationNonce = randomOpaqueId(18);
+	const walletIdDerivationNonce = randomBase64Url(18);
 	const offerCandidates = [];
 	for (let attempt = 0; attempt < 30 && offerCandidates.length < 5; attempt += 1) {
 		const candidate = await input.deriveHostedWalletId({
@@ -491,7 +408,7 @@ async function createGoogleEmailOtpRegistrationOffer(input) {
 		if (await input.walletEnrollmentStore.get(candidate) || inUseByLiveAttempt) continue;
 		if (hasDifferentWalletIdentityLink(await input.identityStore.listSubjectsByUserId(candidate), `wallet:${input.request.providerSubject}`)) continue;
 		offerCandidates.push({
-			candidateId: randomOpaqueId(18),
+			candidateId: randomBase64Url(18),
 			walletId: candidate,
 			collisionCounter: attempt
 		});
@@ -507,7 +424,7 @@ async function createGoogleEmailOtpRegistrationOffer(input) {
 	};
 	const nonEmptyOfferCandidates = [selectedCandidate, ...remainingOfferCandidates];
 	const walletId = selectedCandidate.walletId;
-	const offerId = randomOpaqueId(18);
+	const offerId = randomBase64Url(18);
 	return registrationAttemptStartedResponse({
 		attempt: await createGoogleEmailOtpRegistrationAttempt({
 			registrationAttemptStore: input.registrationAttemptStore,
@@ -535,7 +452,7 @@ async function createGoogleEmailOtpRegistrationAttempt(input) {
 	});
 	const attempt = {
 		version: "google_email_otp_registration_attempt_v1",
-		attemptId: randomOpaqueId(18),
+		attemptId: randomBase64Url(18),
 		providerSubject: input.providerSubject,
 		email: input.email,
 		walletId: input.walletId,
@@ -604,11 +521,7 @@ async function repairGoogleEmailOtpWalletLink(input) {
 		subject: `wallet:${input.providerSubject}`,
 		allowMoveIfSoleIdentity: true
 	});
-	if (!linked.ok) return {
-		ok: false,
-		code: linked.code,
-		message: linked.message
-	};
+	if (!linked.ok) return failure(linked.code, linked.message);
 	return { ok: true };
 }
 function isGoogleEmailOtpEnrollmentLookupMiss(code) {
@@ -669,6 +582,6 @@ function isTruthyBoundaryFlag(value) {
 	return value === true || String(value || "").trim().toLowerCase() === "true";
 }
 //#endregion
-export { cleanupGoogleEmailOtpDevRegistrationStateWithStores, cleanupGoogleEmailOtpRegistrationAttemptsWithStore, completeGoogleEmailOtpRegistrationAttemptWithStore, consumeGoogleEmailOtpRegistrationAttemptRateLimitWithDeps, failGoogleEmailOtpRegistrationAttemptWithStore, recordGoogleEmailOtpRegistrationAttemptPublicKeyWithStore, resolveGoogleEmailOtpSessionWithDeps, validateGoogleEmailOtpRegistrationCandidateWalletWithStore };
+export { cleanupGoogleEmailOtpDevRegistrationStateWithStores, completeGoogleEmailOtpRegistrationAttemptWithStore, consumeGoogleEmailOtpRegistrationAttemptRateLimitWithDeps, failGoogleEmailOtpRegistrationAttemptWithStore, recordGoogleEmailOtpRegistrationAttemptPublicKeyWithStore, resolveGoogleEmailOtpSessionWithDeps, validateGoogleEmailOtpRegistrationCandidateWalletWithStore };
 
 //# sourceMappingURL=googleEmailOtpRegistration.js.map

package/dist/esm/core/authService/identity.js

@@ -1,25 +1,18 @@
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import "../../shared-ts/src/utils/validation.js";
+import { failure } from "../../shared-ts/src/utils/failure.js";
 import { errorMessage } from "../../shared-ts/src/utils/errors.js";
 //#region src/core/authService/identity.ts
 async function listIdentitiesWithStore(input) {
 	try {
 		const userId = normalizeOptionalTrimmedString(input.userId);
-		if (!userId) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing userId"
-		};
+		if (!userId) return failure("invalid_args", "Missing userId");
 		return {
 			ok: true,
 			subjects: await input.store.listSubjectsByUserId(userId)
 		};
 	} catch (e) {
-		return {
-			ok: false,
-			code: "internal",
-			message: errorMessage(e) || "Failed to list identities"
-		};
+		return failure("internal", errorMessage(e) || "Failed to list identities");
 	}
 }
 async function linkIdentityWithStore(input) {
@@ -30,11 +23,7 @@ async function linkIdentityWithStore(input) {
 			allowMoveIfSoleIdentity: input.allowMoveIfSoleIdentity
 		});
 	} catch (e) {
-		return {
-			ok: false,
-			code: "internal",
-			message: errorMessage(e) || "Failed to link identity"
-		};
+		return failure("internal", errorMessage(e) || "Failed to link identity");
 	}
 }
 async function unlinkIdentityWithStore(input) {
@@ -44,11 +33,7 @@ async function unlinkIdentityWithStore(input) {
 			subject: input.subject
 		});
 	} catch (e) {
-		return {
-			ok: false,
-			code: "internal",
-			message: errorMessage(e) || "Failed to unlink identity"
-		};
+		return failure("internal", errorMessage(e) || "Failed to unlink identity");
 	}
 }
 //#endregion

package/dist/esm/core/authService/nearPrivateKeySigning.js

@@ -1,5 +1,6 @@
 import { base64UrlDecode, base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
 import "../../shared-ts/src/utils/encoders.js";
+import { coerceNonEmptyString, requireRecordOrArray } from "../../shared-ts/src/utils/validation.js";
 import { decodeNearSecretKey, toPublicKeyStringFromSecretKey } from "../nearKeys.js";
 //#region src/core/authService/nearPrivateKeySigning.ts
 const ED25519_PKCS8_SEED_PREFIX = Uint8Array.from([
@@ -20,28 +21,19 @@ const ED25519_PKCS8_SEED_PREFIX = Uint8Array.from([
 	4,
 	32
 ]);
-function requireRecord(value, label) {
-	if (!value || typeof value !== "object") throw new Error(`${label} must be an object`);
-	return value;
-}
-function requireNonEmptyString(value, label) {
-	const text = String(value || "").trim();
-	if (!text) throw new Error(`${label} is required`);
-	return text;
-}
 function requireSingleUnsignedNearTxBorshOutput(value) {
 	if (!Array.isArray(value) || value.length !== 1) throw new Error("Expected exactly one unsigned NEAR transaction from signer WASM");
-	const record = requireRecord(value[0], "unsigned NEAR transaction output");
+	const record = requireRecordOrArray(value[0], "unsigned NEAR transaction output");
 	return {
-		unsignedTransactionBorshB64u: requireNonEmptyString(record.unsignedTransactionBorshB64u, "unsignedTransactionBorshB64u"),
-		signingDigestB64u: requireNonEmptyString(record.signingDigestB64u, "signingDigestB64u")
+		unsignedTransactionBorshB64u: coerceNonEmptyString(record.unsignedTransactionBorshB64u, "unsignedTransactionBorshB64u"),
+		signingDigestB64u: coerceNonEmptyString(record.signingDigestB64u, "signingDigestB64u")
 	};
 }
 function requireFinalizeNearTxFromSignatureOutput(value) {
-	const record = requireRecord(value, "finalized NEAR transaction output");
+	const record = requireRecordOrArray(value, "finalized NEAR transaction output");
 	return {
-		signedTransactionBorshB64u: requireNonEmptyString(record.signedTransactionBorshB64u, "signedTransactionBorshB64u"),
-		transactionHash: requireNonEmptyString(record.transactionHash, "transactionHash")
+		signedTransactionBorshB64u: coerceNonEmptyString(record.signedTransactionBorshB64u, "signedTransactionBorshB64u"),
+		transactionHash: coerceNonEmptyString(record.transactionHash, "transactionHash")
 	};
 }
 function createEd25519Pkcs8FromSeed(seed32) {

package/dist/esm/core/authService/nearPublicKeyMetadata.js

@@ -1,6 +1,7 @@
 import { parseWebAuthnRpId } from "../../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import "../../shared-ts/src/utils/validation.js";
+import { failure } from "../../shared-ts/src/utils/failure.js";
 import { errorMessage } from "../../shared-ts/src/utils/errors.js";
 //#region src/core/authService/nearPublicKeyMetadata.ts
 function optionalPositiveInteger(input) {
@@ -60,20 +61,12 @@ function nearPublicKeyListEntry(record) {
 async function recordNearPublicKeyMetadataWithStore(input) {
 	const userId = normalizeOptionalTrimmedString(input.userId);
 	const publicKey = normalizeOptionalTrimmedString(input.publicKey);
-	if (!userId || !publicKey) return {
-		ok: false,
-		code: "invalid_args",
-		message: "userId and publicKey are required"
-	};
+	if (!userId || !publicKey) return failure("invalid_args", "userId and publicKey are required");
 	const authBinding = nearPublicKeyAuthBinding({
 		credentialIdB64u: normalizeOptionalTrimmedString(input.credentialIdB64u),
 		rpIdRaw: normalizeOptionalTrimmedString(input.rpId)
 	});
-	if (!authBinding.ok) return {
-		ok: false,
-		code: "invalid_args",
-		message: authBinding.message
-	};
+	if (!authBinding.ok) return failure("invalid_args", authBinding.message);
 	const record = nearPublicKeyRecord({
 		userId,
 		publicKey,
@@ -91,21 +84,13 @@ async function recordNearPublicKeyMetadataWithStore(input) {
 		const source = normalizeOptionalTrimmedString(input.source) || "near-public-key-metadata";
 		const message = errorMessage(error) || "Failed to persist NEAR public key metadata";
 		input.logger.warn(`[AuthService] ${source} failed for ${userId}`, error);
-		return {
-			ok: false,
-			code: "internal",
-			message
-		};
+		return failure("internal", message);
 	}
 }
 async function listNearPublicKeysForUserWithStore(input) {
 	try {
 		const userId = String(input.userId || "").trim();
-		if (!userId) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing userId"
-		};
+		if (!userId) return failure("invalid_args", "Missing userId");
 		const records = await input.store.listByUserId(userId);
 		const keys = [];
 		for (const record of records || []) keys.push(nearPublicKeyListEntry(record));
@@ -114,11 +99,7 @@ async function listNearPublicKeysForUserWithStore(input) {
 			keys
 		};
 	} catch (e) {
-		return {
-			ok: false,
-			code: "internal",
-			message: errorMessage(e) || "Failed to list keys"
-		};
+		return failure("internal", errorMessage(e) || "Failed to list keys");
 	}
 }
 //#endregion

package/dist/esm/core/authService/nearTransactions.js

@@ -4,7 +4,8 @@ import { ensureEd25519Prefix } from "../../shared-ts/src/utils/near.js";
 import "../../shared-ts/src/utils/validation.js";
 import { toError } from "../../shared-ts/src/utils/errors.js";
 import { toPublicKeyStringFromSecretKey } from "../nearKeys.js";
-import { SignedTransaction } from "../rpcClients/near/NearClient.js";
+import { SignedTransaction } from "../../shared-ts/src/near/nearClient.js";
+import "../rpcClients/near/NearClient.js";
 import { requireFinalizeNearTxFromSignatureOutput, requireSingleUnsignedNearTxBorshOutput, signNearDigestWithSecretKey } from "./nearPrivateKeySigning.js";
 import { threshold_ed25519_build_near_tx_unsigned_borsh, threshold_ed25519_finalize_near_tx_from_signature } from "../../wasm/near_signer/pkg/wasm_signer_worker.js";
 //#region src/core/authService/nearTransactions.ts

package/dist/esm/core/authService/oidcVerification.js

@@ -1,10 +1,10 @@
 import { base64UrlDecode } from "../../shared-ts/src/utils/base64.js";
 import "../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
+import { isPlainObject } from "../../shared-ts/src/utils/validation.js";
+import { failedVerification } from "../../shared-ts/src/utils/failure.js";
 import { errorMessage } from "../../shared-ts/src/utils/errors.js";
 import { parseCacheControlMaxAgeSec, parseJwtAud, parseJwtSegmentJson } from "./webauthnOidcHelpers.js";
-import { isObject } from "./record.js";
 import { toArrayBufferCopy } from "./portableCrypto.js";
 //#region src/core/authService/oidcVerification.ts
 function createGoogleJwksState() {
@@ -13,25 +13,17 @@ function createGoogleJwksState() {
 		fetchPromise: null
 	};
 }
-function jwtError(code, message) {
-	return {
-		ok: false,
-		verified: false,
-		code,
-		message
-	};
-}
 function requireWebCrypto() {
 	return typeof crypto !== "undefined" && Boolean(crypto.subtle);
 }
 function parseJwtParts(input) {
 	const parts = input.token.split(".");
-	if (parts.length !== 3) return jwtError("invalid_body", `${input.tokenName} must be a JWT (3 segments)`);
+	if (parts.length !== 3) return failedVerification("invalid_body", `${input.tokenName} must be a JWT (3 segments)`);
 	const [headerB64u, payloadB64u, signatureB64u] = parts;
 	const header = parseJwtSegmentJson(headerB64u);
-	if (!header) return jwtError("invalid_body", `Invalid ${input.tokenName} header encoding`);
+	if (!header) return failedVerification("invalid_body", `Invalid ${input.tokenName} header encoding`);
 	const payload = parseJwtSegmentJson(payloadB64u);
-	if (!payload) return jwtError("invalid_body", `Invalid ${input.tokenName} payload encoding`);
+	if (!payload) return failedVerification("invalid_body", `Invalid ${input.tokenName} payload encoding`);
 	return {
 		ok: true,
 		value: {
@@ -44,7 +36,7 @@ function parseJwtParts(input) {
 	};
 }
 function jwkFromRaw(rawKey) {
-	if (!isObject(rawKey)) return null;
+	if (!isPlainObject(rawKey)) return null;
 	const kid = normalizeOptionalTrimmedString(rawKey.kid);
 	const kty = normalizeOptionalTrimmedString(rawKey.kty);
 	const use = normalizeOptionalTrimmedString(rawKey.use);
@@ -69,7 +61,7 @@ async function fetchJwks(input) {
 	} catch {
 		throw new Error(input.invalidJsonLabel);
 	}
-	if (!isObject(json)) throw new Error(input.invalidShapeLabel);
+	if (!isPlainObject(json)) throw new Error(input.invalidShapeLabel);
 	const keysRaw = json.keys;
 	if (!Array.isArray(keysRaw)) throw new Error(input.missingKeysLabel);
 	const keysByKid = /* @__PURE__ */ new Map();
@@ -107,26 +99,26 @@ async function verifyJwtSignature(input) {
 	try {
 		signatureBytes = base64UrlDecode(input.parts.signatureB64u);
 	} catch {
-		return jwtError("invalid_body", `Invalid ${input.tokenName} signature encoding`);
+		return failedVerification("invalid_body", `Invalid ${input.tokenName} signature encoding`);
 	}
 	const dataBytes = new TextEncoder().encode(`${input.parts.headerB64u}.${input.parts.payloadB64u}`);
 	const key = await crypto.subtle.importKey("jwk", input.jwk, {
 		name: "RSASSA-PKCS1-v1_5",
 		hash: "SHA-256"
 	}, false, ["verify"]);
-	if (!await crypto.subtle.verify({ name: "RSASSA-PKCS1-v1_5" }, key, toArrayBufferCopy(signatureBytes), toArrayBufferCopy(dataBytes))) return jwtError("invalid_signature", `Invalid ${input.tokenName} signature`);
+	if (!await crypto.subtle.verify({ name: "RSASSA-PKCS1-v1_5" }, key, toArrayBufferCopy(signatureBytes), toArrayBufferCopy(dataBytes))) return failedVerification("invalid_signature", `Invalid ${input.tokenName} signature`);
 	return { ok: true };
 }
 function verifyGoogleTimeClaims(payload) {
 	const nowSec = Math.floor(Date.now() / 1e3);
 	const exp = Number(payload.exp);
-	if (!Number.isFinite(exp) || exp <= 0) return jwtError("invalid_claims", "Invalid Google id_token exp");
-	if (nowSec >= exp) return jwtError("expired", "Google id_token is expired");
+	if (!Number.isFinite(exp) || exp <= 0) return failedVerification("invalid_claims", "Invalid Google id_token exp");
+	if (nowSec >= exp) return failedVerification("expired", "Google id_token is expired");
 	const nbfRaw = payload.nbf;
 	if (nbfRaw !== void 0) {
 		const nbf = Number(nbfRaw);
-		if (!Number.isFinite(nbf)) return jwtError("invalid_claims", "Invalid Google id_token nbf");
-		if (nowSec < nbf) return jwtError("not_yet_valid", "Google id_token is not yet valid");
+		if (!Number.isFinite(nbf)) return failedVerification("invalid_claims", "Invalid Google id_token nbf");
+		if (nowSec < nbf) return failedVerification("not_yet_valid", "Google id_token is not yet valid");
 	}
 	return { ok: true };
 }
@@ -180,10 +172,10 @@ function buildGoogleLoginFacadeSuccess(input) {
 	return result;
 }
 async function verifyGoogleIdToken(input) {
-	if (!input.config?.clientIds?.length) return jwtError("not_configured", "Google OIDC is not configured on this server");
+	if (!input.config?.clientIds?.length) return failedVerification("not_configured", "Google OIDC is not configured on this server");
 	const idToken = normalizeOptionalTrimmedString(input.request.idToken ?? input.request.id_token);
-	if (!idToken) return jwtError("invalid_body", "id_token is required");
-	if (!requireWebCrypto()) return jwtError("unsupported", "WebCrypto (crypto.subtle) is unavailable in this runtime");
+	if (!idToken) return failedVerification("invalid_body", "id_token is required");
+	if (!requireWebCrypto()) return failedVerification("unsupported", "WebCrypto (crypto.subtle) is unavailable in this runtime");
 	const parts = parseJwtParts({
 		token: idToken,
 		tokenName: "id_token"
@@ -191,10 +183,10 @@ async function verifyGoogleIdToken(input) {
 	if (!parts.ok) return parts;
 	const kid = normalizeOptionalTrimmedString(parts.value.header.kid);
 	const alg = normalizeOptionalTrimmedString(parts.value.header.alg);
-	if (!kid) return jwtError("invalid_body", "id_token header.kid is required");
-	if (alg !== "RS256") return jwtError("invalid_body", "id_token header.alg must be RS256");
+	if (!kid) return failedVerification("invalid_body", "id_token header.kid is required");
+	if (alg !== "RS256") return failedVerification("invalid_body", "id_token header.alg must be RS256");
 	const jwk = (await getGoogleJwks(input.jwksState)).keysByKid.get(kid);
-	if (!jwk) return jwtError("unknown_kid", "Unknown Google key id (kid)");
+	if (!jwk) return failedVerification("unknown_kid", "Unknown Google key id (kid)");
 	const signature = await verifyJwtSignature({
 		jwk,
 		parts: parts.value,
@@ -202,19 +194,19 @@ async function verifyGoogleIdToken(input) {
 	});
 	if (!signature.ok) return signature;
 	const iss = normalizeOptionalTrimmedString(parts.value.payload.iss);
-	if (iss !== "https://accounts.google.com" && iss !== "accounts.google.com") return jwtError("invalid_issuer", "Invalid Google id_token issuer");
+	if (iss !== "https://accounts.google.com" && iss !== "accounts.google.com") return failedVerification("invalid_issuer", "Invalid Google id_token issuer");
 	const time = verifyGoogleTimeClaims(parts.value.payload);
 	if (!time.ok) return time;
 	const aud = parseJwtAud(parts.value.payload.aud);
-	if (!aud.length) return jwtError("invalid_claims", "Missing Google id_token aud");
+	if (!aud.length) return failedVerification("invalid_claims", "Missing Google id_token aud");
 	const allowedAudSet = new Set(input.config.clientIds);
-	if (!aud.some((value) => allowedAudSet.has(value))) return jwtError("invalid_audience", "Google id_token audience mismatch");
+	if (!aud.some((value) => allowedAudSet.has(value))) return failedVerification("invalid_audience", "Google id_token audience mismatch");
 	const sub = normalizeOptionalTrimmedString(parts.value.payload.sub);
-	if (!sub) return jwtError("invalid_claims", "Missing Google id_token sub");
+	if (!sub) return failedVerification("invalid_claims", "Missing Google id_token sub");
 	const hostedDomain = normalizeOptionalTrimmedString(parts.value.payload.hd);
 	if (input.config.hostedDomains?.length) {
 		const allowHd = new Set(input.config.hostedDomains.map((d) => d.toLowerCase()));
-		if (!hostedDomain || !allowHd.has(hostedDomain.toLowerCase())) return jwtError("invalid_hosted_domain", "Google hosted domain is not allowed");
+		if (!hostedDomain || !allowHd.has(hostedDomain.toLowerCase())) return failedVerification("invalid_hosted_domain", "Google hosted domain is not allowed");
 	}
 	const email = normalizeOptionalTrimmedString(parts.value.payload.email);
 	const name = normalizeOptionalTrimmedString(parts.value.payload.name);
@@ -248,12 +240,7 @@ async function verifyGoogleLoginWithIdentityStore(input) {
 			})
 		});
 	} catch (e) {
-		return {
-			ok: false,
-			verified: false,
-			code: "internal",
-			message: errorMessage(e) || "Google OIDC verification failed"
-		};
+		return failedVerification("internal", errorMessage(e) || "Google OIDC verification failed");
 	}
 }
 //#endregion

package/dist/esm/core/authService/rateLimits.js

@@ -1,5 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import "../../shared-ts/src/utils/validation.js";
+import { failure } from "../../shared-ts/src/utils/failure.js";
 import { readAuthServiceConfigValue } from "./configValues.js";
 import { resolveSigningSessionSealRateLimitFromEnv } from "../../threshold/session/signingSessionSeal/guards/backends.js";
 import "../../threshold/session/signingSessionSeal/index.js";
@@ -20,36 +21,6 @@ function parseRateLimiterKind(input) {
 	}
 	throw new Error(`${input.name} must be one of in-memory, upstash-redis-rest, or redis-tcp`);
 }
-function createRegistrationPrepareRateLimiter(input) {
-	const thresholdStore = input.thresholdStore;
-	return resolveSigningSessionSealRateLimitFromEnv({
-		limiterKind: parseRateLimiterKind({
-			raw: readRateLimitConfigValue({
-				thresholdStore,
-				name: "REGISTRATION_PREPARE_RATE_LIMITER_KIND"
-			}),
-			name: "REGISTRATION_PREPARE_RATE_LIMITER_KIND"
-		}),
-		upstashUrl: readRateLimitConfigValue({
-			thresholdStore,
-			name: "REGISTRATION_PREPARE_RATE_LIMIT_UPSTASH_URL"
-		}) || null,
-		upstashToken: readRateLimitConfigValue({
-			thresholdStore,
-			name: "REGISTRATION_PREPARE_RATE_LIMIT_UPSTASH_TOKEN"
-		}) || null,
-		redisUrl: readRateLimitConfigValue({
-			thresholdStore,
-			name: "REGISTRATION_PREPARE_RATE_LIMIT_REDIS_URL"
-		}) || null,
-		keyPrefix: readRateLimitConfigValue({
-			thresholdStore,
-			name: "REGISTRATION_PREPARE_RATE_LIMIT_KEY_PREFIX"
-		}) || "registration-prepare:v1:",
-		limit: 1,
-		windowMs: 1
-	}).limiter;
-}
 function createEmailOtpRateLimiter(input) {
 	const thresholdStore = input.thresholdStore;
 	return resolveSigningSessionSealRateLimitFromEnv({
@@ -81,11 +52,7 @@ function createEmailOtpRateLimiter(input) {
 	}).limiter;
 }
 function consumedRateLimitError(message, consumed) {
-	const result = {
-		ok: false,
-		code: "rate_limited",
-		message
-	};
+	const result = failure("rate_limited", message);
 	if (typeof consumed.retryAfterMs === "number") result.retryAfterMs = consumed.retryAfterMs;
 	if (typeof consumed.resetAtMs === "number") result.resetAtMs = consumed.resetAtMs;
 	return result;
@@ -112,6 +79,6 @@ async function consumeEmailOtpRateLimit(input) {
 	return { ok: true };
 }
 //#endregion
-export { consumeEmailOtpRateLimit, createEmailOtpRateLimiter, createRegistrationPrepareRateLimiter };
+export { consumeEmailOtpRateLimit, createEmailOtpRateLimiter };
 
 //# sourceMappingURL=rateLimits.js.map