@seams/wallet-server 0.6.2 → 0.7.3

package/dist/esm/core/authService/registrationThresholdHelpers.js

@@ -1,16 +1,8 @@
-import { ensureEd25519Prefix } from "../../shared-ts/src/utils/near.js";
-import { parseEvmFamilySigningKeySlotId } from "../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
+import { ensureEd25519Prefix } from "../../shared-ts/src/utils/near.js";
 import "../../shared-ts/src/utils/validation.js";
 import { ActionType } from "../../shared-ts/src/near/actions.js";
-import "../../shared-ts/src/signing-lanes/index.js";
-import { normalizeThresholdRuntimePolicyScope, thresholdRuntimePolicyScopesEqual } from "./thresholdRuntimePolicy.js";
 //#region src/core/authService/registrationThresholdHelpers.ts
-function requireEvmFamilySigningKeySlotId(value) {
-	const parsed = parseEvmFamilySigningKeySlotId(value);
-	if (!parsed.ok) throw new Error(parsed.error.message);
-	return parsed.value;
-}
 function buildFullAccessAddKeyAction(publicKey) {
 	return {
 		action_type: ActionType.AddKey,
@@ -32,100 +24,7 @@ function normalizeBootstrapPublicKeys(args) {
 		expectedPublicKeys: recoveryPublicKey ? [publicKey, recoveryPublicKey] : [publicKey]
 	};
 }
-async function resolveBoundThresholdRuntimePolicyScope(args) {
-	if (typeof args.bindingStore.listByUserId !== "function") return void 0;
-	const bindings = await args.bindingStore.listByUserId({
-		userId: args.userId,
-		rpId: args.rpId
-	});
-	for (const binding of bindings) {
-		const scope = normalizeThresholdRuntimePolicyScope(binding.runtimePolicyScope);
-		if (scope) return scope;
-	}
-}
-function buildEcdsaWalletKeysFromBootstrap(args) {
-	const bootstrap = args.bootstrap;
-	const required = {
-		walletId: normalizeOptionalTrimmedString(bootstrap.walletId),
-		evmFamilySigningKeySlotId: normalizeOptionalTrimmedString(bootstrap.evmFamilySigningKeySlotId),
-		keyHandle: normalizeOptionalTrimmedString(bootstrap.keyHandle),
-		ecdsaThresholdKeyId: normalizeOptionalTrimmedString(bootstrap.ecdsaThresholdKeyId),
-		signingRootId: normalizeOptionalTrimmedString(bootstrap.signingRootId),
-		signingRootVersion: normalizeOptionalTrimmedString(bootstrap.signingRootVersion),
-		thresholdEcdsaPublicKeyB64u: normalizeOptionalTrimmedString(bootstrap.thresholdEcdsaPublicKeyB64u),
-		thresholdOwnerAddress: normalizeOptionalTrimmedString(bootstrap.ethereumAddress),
-		relayerKeyId: normalizeOptionalTrimmedString(bootstrap.relayerKeyId),
-		relayerVerifyingShareB64u: normalizeOptionalTrimmedString(bootstrap.relayerVerifyingShareB64u),
-		contextBinding32B64u: normalizeOptionalTrimmedString(bootstrap.contextBinding32B64u),
-		derivationClientSharePublicKey33B64u: normalizeOptionalTrimmedString(bootstrap.publicIdentity.derivationClientSharePublicKey33B64u)
-	};
-	const missingField = Object.entries(required).find(([, value]) => !value)?.[0];
-	if (missingField) return {
-		ok: false,
-		code: "incomplete_ecdsa_wallet_key",
-		message: `${args.errorContext} returned incomplete ECDSA wallet key material: ${missingField}`
-	};
-	const participantIds = Array.isArray(bootstrap.participantIds) ? bootstrap.participantIds.map((participantId) => Number(participantId)).filter((participantId) => Number.isSafeInteger(participantId) && participantId > 0) : [];
-	if (participantIds.length !== 2 || participantIds[0] !== 1 || participantIds[1] !== 2) return {
-		ok: false,
-		code: "incomplete_ecdsa_wallet_key",
-		message: `${args.errorContext} returned incomplete ECDSA wallet key material: participantIds`
-	};
-	if (!Array.isArray(args.chainTargets) || args.chainTargets.length === 0) return {
-		ok: false,
-		code: "incomplete_ecdsa_wallet_key",
-		message: `${args.errorContext} has no ECDSA chain targets`
-	};
-	return {
-		ok: true,
-		walletKeys: args.chainTargets.map((chainTarget) => ({
-			keyScope: "evm-family",
-			chainTarget,
-			walletId: required.walletId,
-			evmFamilySigningKeySlotId: required.evmFamilySigningKeySlotId,
-			keyHandle: required.keyHandle,
-			ecdsaThresholdKeyId: required.ecdsaThresholdKeyId,
-			signingRootId: required.signingRootId,
-			signingRootVersion: required.signingRootVersion,
-			thresholdEcdsaPublicKeyB64u: required.thresholdEcdsaPublicKeyB64u,
-			thresholdOwnerAddress: required.thresholdOwnerAddress,
-			relayerKeyId: required.relayerKeyId,
-			relayerVerifyingShareB64u: required.relayerVerifyingShareB64u,
-			contextBinding32B64u: required.contextBinding32B64u,
-			derivationClientSharePublicKey33B64u: bootstrap.publicIdentity.derivationClientSharePublicKey33B64u,
-			clientShareRetryCounter: bootstrap.clientShareRetryCounter,
-			relayerShareRetryCounter: bootstrap.relayerShareRetryCounter,
-			participantIds: [1, 2],
-			publicCapability: args.publicCapability
-		}))
-	};
-}
-function isMatchingEcdsaClientBootstrap(expected, actual) {
-	return actual.formatVersion === expected.formatVersion && actual.walletId === expected.walletId && actual.evmFamilySigningKeySlotId === expected.evmFamilySigningKeySlotId && actual.ecdsaThresholdKeyId === expected.ecdsaThresholdKeyId && actual.signingRootId === expected.signingRootId && actual.signingRootVersion === expected.signingRootVersion && actual.keyScope === expected.keyScope && actual.relayerKeyId === expected.relayerKeyId && actual.registrationPreparationId === expected.registrationPreparationId && actual.requestId === expected.requestId && actual.thresholdSessionId === expected.thresholdSessionId && actual.ttlMs === expected.ttlMs && actual.remainingUses === expected.remainingUses && actual.participantIds[0] === expected.participantIds[0] && actual.participantIds[1] === expected.participantIds[1] && thresholdRuntimePolicyScopesEqual(actual.runtimePolicyScope, expected.runtimePolicyScope);
-}
-function toEcdsaDerivationClientBootstrapRequest(clientBootstrap) {
-	return {
-		formatVersion: clientBootstrap.formatVersion,
-		walletId: clientBootstrap.walletId,
-		evmFamilySigningKeySlotId: requireEvmFamilySigningKeySlotId(clientBootstrap.evmFamilySigningKeySlotId),
-		ecdsaThresholdKeyId: clientBootstrap.ecdsaThresholdKeyId,
-		signingRootId: clientBootstrap.signingRootId,
-		signingRootVersion: clientBootstrap.signingRootVersion,
-		keyScope: clientBootstrap.keyScope,
-		relayerKeyId: clientBootstrap.relayerKeyId,
-		registrationPreparationId: clientBootstrap.registrationPreparationId,
-		derivationClientSharePublicKey33B64u: clientBootstrap.derivationClientSharePublicKey33B64u,
-		clientShareRetryCounter: clientBootstrap.clientShareRetryCounter,
-		contextBinding32B64u: clientBootstrap.contextBinding32B64u,
-		requestId: clientBootstrap.requestId,
-		sessionId: clientBootstrap.thresholdSessionId,
-		ttlMs: clientBootstrap.ttlMs,
-		remainingUses: clientBootstrap.remainingUses,
-		participantIds: [...clientBootstrap.participantIds],
-		runtimePolicyScope: clientBootstrap.runtimePolicyScope
-	};
-}
 //#endregion
-export { buildEcdsaWalletKeysFromBootstrap, buildFullAccessAddKeyAction, isMatchingEcdsaClientBootstrap, normalizeBootstrapPublicKeys, resolveBoundThresholdRuntimePolicyScope, toEcdsaDerivationClientBootstrapRequest };
+export { buildFullAccessAddKeyAction, normalizeBootstrapPublicKeys };
 
 //# sourceMappingURL=registrationThresholdHelpers.js.map

package/dist/esm/core/authService/storeRegistry.js

@@ -1,10 +1,9 @@
 import { createWalletStore } from "../WalletStore.js";
 import { createWebAuthnCredentialBindingStore } from "../WebAuthnCredentialBindingStore.js";
-import { createRegistrationCeremonyStore } from "../RegistrationCeremonyStore.js";
-import { createEmailOtpRateLimiter, createRegistrationPrepareRateLimiter } from "./rateLimits.js";
+import { createNearPublicKeyStore } from "../NearPublicKeyStore.js";
+import { createEmailOtpRateLimiter } from "./rateLimits.js";
 import { createEmailOtpAuthStateStore, createEmailOtpChallengeStore, createEmailOtpGrantStore, createEmailOtpRegistrationAttemptStore, createEmailOtpUnlockChallengeStore, createEmailOtpWalletEnrollmentStore } from "../EmailOtpStores.js";
 import { createIdentityStore } from "../IdentityStore.js";
-import { createNearPublicKeyStore } from "../NearPublicKeyStore.js";
 import { createWalletAuthMethodStore } from "../WalletAuthMethodStore.js";
 import { createWebAuthnAuthenticatorStore } from "../WebAuthnAuthenticatorStore.js";
 import { createWebAuthnLoginChallengeStore } from "../WebAuthnLoginChallengeStore.js";
@@ -31,10 +30,8 @@ var AuthServiceStoreRegistry = class {
 		this.emailOtpUnlockChallengeStore = null;
 		this.emailOtpRegistrationAttemptStore = null;
 		this.emailOtpRateLimiter = null;
-		this.registrationPrepareRateLimiter = null;
 		this.nearPublicKeyStore = null;
 		this.identityStore = null;
-		this.registrationCeremonyStore = null;
 		this.walletStore = null;
 		this.walletAuthMethodStore = null;
 	}
@@ -54,10 +51,6 @@ var AuthServiceStoreRegistry = class {
 		this.webAuthnSyncChallengeStore ??= createWebAuthnSyncChallengeStore(createStoreFactoryInput(this.input));
 		return this.webAuthnSyncChallengeStore;
 	}
-	getRegistrationCeremonyStore() {
-		this.registrationCeremonyStore ??= createRegistrationCeremonyStore(createStoreFactoryInput(this.input));
-		return this.registrationCeremonyStore;
-	}
 	getWalletStore() {
 		this.walletStore ??= createWalletStore(createStoreFactoryInput(this.input));
 		return this.walletStore;
@@ -90,10 +83,6 @@ var AuthServiceStoreRegistry = class {
 		this.emailOtpRegistrationAttemptStore ??= createEmailOtpRegistrationAttemptStore(createStoreFactoryInput(this.input));
 		return this.emailOtpRegistrationAttemptStore;
 	}
-	getRegistrationPrepareRateLimiter() {
-		this.registrationPrepareRateLimiter ??= createRegistrationPrepareRateLimiter({ thresholdStore: this.input.config.thresholdStore });
-		return this.registrationPrepareRateLimiter;
-	}
 	getEmailOtpRateLimiter() {
 		this.emailOtpRateLimiter ??= createEmailOtpRateLimiter({ thresholdStore: this.input.config.thresholdStore });
 		return this.emailOtpRateLimiter;

package/dist/esm/core/authService/thresholdEcdsaKeyInventory.js

@@ -1,8 +1,8 @@
-import { walletIdFromString } from "../../shared-ts/src/utils/registrationIntent.js";
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
-import { thresholdEcdsaChainTargetFromValue, thresholdEcdsaChainTargetKey } from "../thresholdEcdsaChainTarget.js";
-import { isObject } from "./record.js";
+import { isPlainObject } from "../../shared-ts/src/utils/validation.js";
+import { thresholdEcdsaChainTargetKey } from "../../shared-ts/src/utils/thresholdEcdsaChainTarget.js";
+import { thresholdEcdsaChainTargetFromValue } from "../thresholdEcdsaChainTarget.js";
+import { walletIdFromString } from "../../shared-ts/src/utils/registrationIds.js";
 //#region src/core/authService/thresholdEcdsaKeyInventory.ts
 function incrementCount(bucket, reason) {
 	bucket[reason] = (bucket[reason] || 0) + 1;
@@ -32,7 +32,7 @@ function thresholdEcdsaKeyInventorySelectorMatchesIdentity(selector, identity) {
 	return identity.keyHandle === selector.keyHandle;
 }
 function parseThresholdEcdsaKeyInventoryTarget(raw) {
-	if (!isObject(raw)) return {
+	if (!isPlainObject(raw)) return {
 		ok: false,
 		reason: "non_object"
 	};
@@ -141,6 +141,6 @@ async function listThresholdEcdsaKeyIdentityTargetsForUser(input) {
 	};
 }
 //#endregion
-export { incrementCount, listThresholdEcdsaKeyIdentityTargetsForUser, normalizeEvmAddress, parseThresholdEcdsaKeyInventoryTarget, thresholdEcdsaKeyInventorySelectorMatchesIdentity };
+export { listThresholdEcdsaKeyIdentityTargetsForUser };
 
 //# sourceMappingURL=thresholdEcdsaKeyInventory.js.map

package/dist/esm/core/authService/webauthn.js

@@ -1,13 +1,15 @@
 import { base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
 import { parseDigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
 import "../../shared-ts/src/utils/encoders.js";
-import { walletIdFromString } from "../../shared-ts/src/utils/registrationIntent.js";
-import { unknownWebAuthnAuthenticatorDeviceInfo } from "../../shared-ts/src/utils/webauthnDeviceInfo.js";
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import "../../shared-ts/src/utils/validation.js";
+import { unknownWebAuthnAuthenticatorDeviceInfo } from "../../shared-ts/src/utils/webauthnDeviceInfo.js";
+import { failedVerification, failure } from "../../shared-ts/src/utils/failure.js";
+import { walletIdFromString } from "../../shared-ts/src/utils/registrationIds.js";
 import { errorMessage } from "../../shared-ts/src/utils/errors.js";
 import { decodeBase64UrlOrBase64, isHostWithinRpId, loadSimpleWebAuthnServer, originHostnameOrEmpty, parseClientDataJsonBase64url } from "./webauthnOidcHelpers.js";
 import { parseWebAuthnAuthenticationCredential } from "../../router/auth/webAuthnCredentialCodecs.js";
+import { webAuthnAuthenticationFailure, webAuthnLoginEd25519, webAuthnSyncCredentialBinding } from "./webauthnVerificationOutcomes.js";
 import { parseBoundaryWalletId, resolvedEd25519WalletBindingFromCredentialBinding } from "./webauthnWalletBinding.js";
 import { passkeyThresholdEd25519AuthorityScope, requireWebAuthnRpId } from "./webauthnAuthority.js";
 //#region src/core/authService/webauthn.ts
@@ -27,11 +29,7 @@ function normalizeWebAuthnTtlMs(raw) {
 }
 function ensureCryptoRandomValues() {
 	if (typeof crypto !== "undefined" && typeof crypto.getRandomValues === "function") return true;
-	return {
-		ok: false,
-		code: "unsupported",
-		message: "crypto.getRandomValues is unavailable in this runtime"
-	};
+	return failure("unsupported", "crypto.getRandomValues is unavailable in this runtime");
 }
 function randomWebAuthnB64u(byteLength) {
 	return base64UrlEncode(crypto.getRandomValues(new Uint8Array(byteLength)));
@@ -39,22 +37,14 @@ function randomWebAuthnB64u(byteLength) {
 function credentialRawIdB64u(credential) {
 	const credentialId = credential.id.trim();
 	const chosen = credential.rawId.trim() || credentialId;
-	if (!chosen) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Missing webauthn_authentication.id/rawId"
-	};
+	if (!chosen) return failure("invalid_body", "Missing webauthn_authentication.id/rawId");
 	try {
 		return {
 			ok: true,
 			credentialIdB64u: base64UrlEncode(decodeBase64UrlOrBase64(chosen, "webauthn_authentication.rawId"))
 		};
 	} catch (e) {
-		return {
-			ok: false,
-			code: "invalid_body",
-			message: errorMessage(e) || "Invalid credential rawId"
-		};
+		return failure("invalid_body", errorMessage(e) || "Invalid credential rawId");
 	}
 }
 function credentialPublicKeyBytes(record) {
@@ -64,11 +54,7 @@ function credentialPublicKeyBytes(record) {
 			bytes: decodeBase64UrlOrBase64(record.credentialPublicKeyB64u, "authenticator.credentialPublicKeyB64u")
 		};
 	} catch (e) {
-		return {
-			ok: false,
-			code: "internal",
-			message: `Stored credential public key is invalid: ${errorMessage(e) || "decode failed"}`
-		};
+		return failure("internal", `Stored credential public key is invalid: ${errorMessage(e) || "decode failed"}`);
 	}
 }
 function credentialVerificationInput(input) {
@@ -104,32 +90,16 @@ async function persistAuthenticatorCounter(input) {
 		}));
 		return { ok: true };
 	} catch (e) {
-		return {
-			ok: false,
-			code: "internal",
-			message: `Failed to persist authenticator counter: ${errorMessage(e) || "store error"}`
-		};
+		return failure("internal", `Failed to persist authenticator counter: ${errorMessage(e) || "store error"}`);
 	}
 }
 function parseWebAuthnClientDataForRegistration(input) {
 	const response = readNestedRecord(input.credential, "response");
 	const clientData = parseClientDataJsonBase64url(response ? readStringField(response, "clientDataJSON") : "");
-	if (clientData.type !== "webauthn.create") return {
-		ok: false,
-		code: "invalid_body",
-		message: "Invalid webauthn_registration.clientDataJSON.type (expected webauthn.create)"
-	};
-	if (clientData.challenge !== input.expectedChallenge) return {
-		ok: false,
-		code: "challenge_mismatch",
-		message: "Registration challenge mismatch"
-	};
+	if (clientData.type !== "webauthn.create") return failure("invalid_body", "Invalid webauthn_registration.clientDataJSON.type (expected webauthn.create)");
+	if (clientData.challenge !== input.expectedChallenge) return failure("challenge_mismatch", "Registration challenge mismatch");
 	const originHost = originHostnameOrEmpty(clientData.origin);
-	if (!isHostWithinRpId(originHost, input.rpId)) return {
-		ok: false,
-		code: "invalid_origin",
-		message: "WebAuthn origin is not within rpId"
-	};
+	if (!isHostWithinRpId(originHost, input.rpId)) return failure("invalid_origin", "WebAuthn origin is not within rpId");
 	return {
 		ok: true,
 		originHost
@@ -175,11 +145,7 @@ async function linkNearSubjectForWebAuthnLogin(input) {
 }
 async function verifyWebAuthnRegistrationCredentialForIntent(input) {
 	const credential = readRecord(input.webauthnRegistration);
-	if (!credential) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Missing webauthn_registration"
-	};
+	if (!credential) return failure("invalid_body", "Missing webauthn_registration");
 	const parsedClientData = parseWebAuthnClientDataForRegistration({
 		credential,
 		expectedChallenge: input.expectedChallenge,
@@ -187,17 +153,9 @@ async function verifyWebAuthnRegistrationCredentialForIntent(input) {
 	});
 	if (!parsedClientData.ok) return parsedClientData;
 	const expectedOrigin = normalizeOptionalTrimmedString(input.expectedOrigin);
-	if (!expectedOrigin) return {
-		ok: false,
-		code: "invalid_body",
-		message: "expected_origin is required for WebAuthn registration verification"
-	};
+	if (!expectedOrigin) return failure("invalid_body", "expected_origin is required for WebAuthn registration verification");
 	const verifyRegistrationResponse = (await loadSimpleWebAuthnServer()).verifyRegistrationResponse;
-	if (typeof verifyRegistrationResponse !== "function") return {
-		ok: false,
-		code: "unsupported",
-		message: "WebAuthn registration verifier is unavailable in this runtime"
-	};
+	if (typeof verifyRegistrationResponse !== "function") return failure("unsupported", "WebAuthn registration verifier is unavailable in this runtime");
 	const registration = await verifyRegistrationResponse({
 		response: credential,
 		expectedChallenge: input.expectedChallenge,
@@ -205,19 +163,11 @@ async function verifyWebAuthnRegistrationCredentialForIntent(input) {
 		expectedRPID: input.rpId,
 		requireUserVerification: false
 	});
-	if (!registration.verified) return {
-		ok: false,
-		code: "not_verified",
-		message: "Registration verification failed"
-	};
+	if (!registration.verified) return failure("not_verified", "Registration verification failed");
 	const verifiedCredential = registration.registrationInfo?.credential;
 	const credentialIdB64u = String(verifiedCredential?.id || "").trim();
 	const credentialPublicKey = verifiedCredential?.publicKey;
-	if (!credentialIdB64u || !credentialPublicKey) return {
-		ok: false,
-		code: "internal",
-		message: "Registration verification did not return credential public key material"
-	};
+	if (!credentialIdB64u || !credentialPublicKey) return failure("internal", "Registration verification did not return credential public key material");
 	return {
 		ok: true,
 		credential: {
@@ -363,16 +313,8 @@ async function listWebAuthnAuthenticatorsForUserWithStores(input) {
 	try {
 		const userId = String(input.userId || "").trim();
 		const rpId = String(input.rpId || "").trim();
-		if (!userId) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing userId"
-		};
-		if (!input.authenticatorStore.list) return {
-			ok: false,
-			code: "not_supported",
-			message: "Authenticator listing is not supported by this store"
-		};
+		if (!userId) return failure("invalid_args", "Missing userId");
+		if (!input.authenticatorStore.list) return failure("not_supported", "Authenticator listing is not supported by this store");
 		const bindingList = await listCredentialBindingsForUser({
 			bindingStore: input.credentialBindingStore,
 			userId,
@@ -399,33 +341,17 @@ async function listWebAuthnAuthenticatorsForUserWithStores(input) {
 			authenticators: merged
 		};
 	} catch (e) {
-		return {
-			ok: false,
-			code: "internal",
-			message: errorMessage(e) || "Failed to list authenticators"
-		};
+		return failure("internal", errorMessage(e) || "Failed to list authenticators");
 	}
 }
 async function createWebAuthnLoginOptionsWithStore(input) {
 	try {
 		const userIdRaw = String(input.request.userId ?? input.request.user_id ?? "").trim();
 		const rpId = String(input.request.rpId ?? input.request.rp_id ?? "").trim();
-		if (!userIdRaw) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing userId"
-		};
+		if (!userIdRaw) return failure("invalid_body", "Missing userId");
 		const userId = parseBoundaryWalletId(userIdRaw);
-		if (!userId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Invalid userId"
-		};
-		if (!rpId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing rpId"
-		};
+		if (!userId) return failure("invalid_body", "Invalid userId");
+		if (!rpId) return failure("invalid_body", "Missing rpId");
 		const randomAvailable = ensureCryptoRandomValues();
 		if (randomAvailable !== true) return randomAvailable;
 		const ttlMsClamped = normalizeWebAuthnTtlMs(input.request.ttlMs ?? input.request.ttl_ms);
@@ -449,28 +375,16 @@ async function createWebAuthnLoginOptionsWithStore(input) {
 			expiresAtMs
 		};
 	} catch (e) {
-		return {
-			ok: false,
-			code: "internal",
-			message: errorMessage(e) || "Failed to create login options"
-		};
+		return failure("internal", errorMessage(e) || "Failed to create login options");
 	}
 }
 async function createWebAuthnSyncAccountOptionsWithStores(input) {
 	try {
 		const rpId = String(input.request.rp_id || "").trim();
-		if (!rpId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing rp_id"
-		};
+		if (!rpId) return failure("invalid_body", "Missing rp_id");
 		const expectedUserIdRaw = normalizeOptionalTrimmedString(input.request.account_id);
 		const expectedUserId = expectedUserIdRaw ? parseBoundaryWalletId(expectedUserIdRaw) : null;
-		if (expectedUserIdRaw && !expectedUserId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Invalid wallet account_id"
-		};
+		if (expectedUserIdRaw && !expectedUserId) return failure("invalid_body", "Invalid wallet account_id");
 		const randomAvailable = ensureCryptoRandomValues();
 		if (randomAvailable !== true) return randomAvailable;
 		const ttlMsClamped = normalizeWebAuthnTtlMs(input.request.ttlMs ?? input.request.ttl_ms);
@@ -527,58 +441,25 @@ async function createWebAuthnSyncAccountOptionsWithStores(input) {
 		if (walletBinding) result.walletBinding = walletBinding;
 		return result;
 	} catch (e) {
-		return {
-			ok: false,
-			code: "internal",
-			message: errorMessage(e) || "Failed to create sync account options"
-		};
+		return failure("internal", errorMessage(e) || "Failed to create sync account options");
 	}
 }
 async function verifyWebAuthnSyncAccountWithStores(input) {
 	try {
 		const request = input.request;
 		const challengeId = String(request.challengeId ?? request.challenge_id ?? "").trim();
-		if (!challengeId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing challengeId"
-		};
+		if (!challengeId) return failure("invalid_body", "Missing challengeId");
 		const challenge = await input.syncChallengeStore.consume(challengeId);
-		if (!challenge) return {
-			ok: false,
-			verified: false,
-			code: "challenge_expired_or_invalid",
-			message: "Sync challenge expired or invalid"
-		};
+		if (!challenge) return failedVerification("challenge_expired_or_invalid", "Sync challenge expired or invalid");
 		const credential = request.webauthn_authentication;
 		const credentialId = credentialRawIdB64u(credential);
-		if (!credentialId.ok) return {
-			ok: false,
-			verified: false,
-			code: credentialId.code,
-			message: credentialId.message
-		};
-		const binding = await input.credentialBindingStore.get(challenge.rpId, credentialId.credentialIdB64u);
-		if (!binding) return {
-			ok: false,
-			verified: false,
-			code: "unknown_credential",
-			message: "Credential is not registered on this relay"
-		};
-		if (challenge.expectedUserId && binding.userId !== challenge.expectedUserId) return {
-			ok: false,
-			verified: false,
-			code: "unknown_credential",
-			message: `Credential is not registered for account ${challenge.expectedUserId}`
-		};
+		if (!credentialId.ok) return failedVerification(credentialId.code, credentialId.message);
+		const syncBinding = webAuthnSyncCredentialBinding(await input.credentialBindingStore.get(challenge.rpId, credentialId.credentialIdB64u), challenge);
+		if (!syncBinding.ok) return syncBinding;
+		const binding = syncBinding.binding;
 		const expectedOrigin = normalizeOptionalTrimmedString(request.expected_origin);
-		if (!expectedOrigin) return {
-			ok: false,
-			verified: false,
-			code: "invalid_body",
-			message: "expected_origin is required for WebAuthn authentication verification"
-		};
-		const verification = await verifyWebAuthnAuthenticationLiteWithStore({
+		if (!expectedOrigin) return failedVerification("invalid_body", "expected_origin is required for WebAuthn authentication verification");
+		const verificationFailure = webAuthnAuthenticationFailure(await verifyWebAuthnAuthenticationLiteWithStore({
 			userId: binding.userId,
 			rpId: requireWebAuthnRpId(binding.rpId, "sync credential binding rpId"),
 			expectedChallenge: challenge.challengeB64u,
@@ -586,38 +467,18 @@ async function verifyWebAuthnSyncAccountWithStores(input) {
 			expectedOrigin,
 			authenticatorStore: input.authenticatorStore,
 			logger: input.logger
-		});
-		if (!verification.success || !verification.verified) return {
-			ok: false,
-			verified: false,
-			code: verification.code || "not_verified",
-			message: verification.message || "Authentication verification failed"
-		};
+		}));
+		if (verificationFailure) return verificationFailure;
 		const auth = await input.authenticatorStore.get(binding.userId, credentialId.credentialIdB64u);
-		if (!auth) return {
-			ok: false,
-			verified: false,
-			code: "unknown_credential",
-			message: "Credential is not registered for user"
-		};
+		if (!auth) return failedVerification("unknown_credential", "Credential is not registered for user");
 		const walletBinding = resolvedEd25519WalletBindingFromCredentialBinding({ binding });
 		const bindingPublicKey = binding.publicKey;
-		if (!walletBinding || !bindingPublicKey) return {
-			ok: false,
-			verified: false,
-			code: "ed25519_not_provisioned",
-			message: "Wallet has no Ed25519 signer yet; NEAR provisioning has not completed"
-		};
+		if (!walletBinding || !bindingPublicKey) return failedVerification("ed25519_not_provisioned", "Wallet has no Ed25519 signer yet; NEAR provisioning has not completed");
 		const ed25519Signer = await input.walletStore.getEd25519SignerBySlot({
 			walletId: walletIdFromString(walletBinding.walletId),
 			signerSlot: walletBinding.signerSlot
 		});
-		if (!ed25519Signer) return {
-			ok: false,
-			verified: false,
-			code: "ed25519_not_provisioned",
-			message: "Wallet has no Ed25519 signer yet; NEAR provisioning has not completed"
-		};
+		if (!ed25519Signer) return failedVerification("ed25519_not_provisioned", "Wallet has no Ed25519 signer yet; NEAR provisioning has not completed");
 		const walletBindingAuthorityScope = passkeyThresholdEd25519AuthorityScope(requireWebAuthnRpId(walletBinding.rpId, "sync credential binding rpId"));
 		const thresholdEd25519 = binding.relayerKeyId ? {
 			relayerKeyId: binding.relayerKeyId,
@@ -647,44 +508,20 @@ async function verifyWebAuthnSyncAccountWithStores(input) {
 			...thresholdEd25519 ? { thresholdEd25519 } : {}
 		};
 	} catch (e) {
-		return {
-			ok: false,
-			verified: false,
-			code: "internal",
-			message: errorMessage(e) || "Sync verification failed"
-		};
+		return failedVerification("internal", errorMessage(e) || "Sync verification failed");
 	}
 }
 async function verifyWebAuthnLoginWithStores(input) {
 	try {
 		const challengeId = String(input.request.challengeId ?? input.request.challenge_id ?? "").trim();
-		if (!challengeId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing challengeId"
-		};
+		if (!challengeId) return failure("invalid_body", "Missing challengeId");
 		const record = await input.loginChallengeStore.consume(challengeId);
-		if (!record) return {
-			ok: false,
-			verified: false,
-			code: "challenge_expired_or_invalid",
-			message: "Login challenge expired or invalid"
-		};
+		if (!record) return failedVerification("challenge_expired_or_invalid", "Login challenge expired or invalid");
 		const expectedOrigin = normalizeOptionalTrimmedString(input.request.expected_origin);
-		if (!expectedOrigin) return {
-			ok: false,
-			verified: false,
-			code: "invalid_body",
-			message: "expected_origin is required for WebAuthn authentication verification"
-		};
+		if (!expectedOrigin) return failedVerification("invalid_body", "expected_origin is required for WebAuthn authentication verification");
 		const credential = parseWebAuthnAuthenticationCredential(input.request.webauthn_authentication);
-		if (!credential) return {
-			ok: false,
-			verified: false,
-			code: "invalid_body",
-			message: "Missing webauthn_authentication"
-		};
-		const verification = await verifyWebAuthnAuthenticationLiteWithStore({
+		if (!credential) return failedVerification("invalid_body", "Missing webauthn_authentication");
+		const verificationFailure = webAuthnAuthenticationFailure(await verifyWebAuthnAuthenticationLiteWithStore({
 			userId: record.userId,
 			rpId: requireWebAuthnRpId(record.rpId, "login challenge rpId"),
 			expectedChallenge: record.challengeB64u,
@@ -692,33 +529,12 @@ async function verifyWebAuthnLoginWithStores(input) {
 			expectedOrigin,
 			authenticatorStore: input.authenticatorStore,
 			logger: input.logger
-		});
-		if (!verification.success || !verification.verified) return {
-			ok: false,
-			verified: false,
-			code: verification.code || "not_verified",
-			message: verification.message || "Authentication verification failed"
-		};
+		}));
+		if (verificationFailure) return verificationFailure;
 		const credentialIdB64u = String(credential.rawId || credential.id || "").trim();
 		const binding = credentialIdB64u ? await input.credentialBindingStore.get(record.rpId, credentialIdB64u) : null;
-		const walletBinding = binding ? resolvedEd25519WalletBindingFromCredentialBinding({ binding }) : null;
-		const firstParticipantId = binding?.participantIds?.[0];
-		const secondParticipantId = binding?.participantIds?.[1];
-		if (!binding) return {
-			ok: false,
-			verified: false,
-			code: "unknown_credential",
-			message: "Credential has no wallet binding"
-		};
-		const ed25519 = walletBinding && binding.publicKey && binding.relayerKeyId && firstParticipantId !== void 0 && secondParticipantId !== void 0 ? {
-			kind: "active",
-			nearAccountId: walletBinding.nearAccountId,
-			nearEd25519SigningKeyId: walletBinding.nearEd25519SigningKeyId,
-			signerSlot: walletBinding.signerSlot,
-			publicKey: binding.publicKey,
-			relayerKeyId: binding.relayerKeyId,
-			participantIds: [firstParticipantId, secondParticipantId]
-		} : { kind: "absent" };
+		const loginSigner = webAuthnLoginEd25519(binding, binding ? resolvedEd25519WalletBindingFromCredentialBinding({ binding }) : null);
+		if (!loginSigner.ok) return loginSigner;
 		await linkNearSubjectForWebAuthnLogin({
 			identityStore: input.identityStore,
 			userId: record.userId
@@ -729,15 +545,10 @@ async function verifyWebAuthnLoginWithStores(input) {
 			userId: record.userId,
 			rpId: record.rpId,
 			credentialIdB64u,
-			ed25519
+			ed25519: loginSigner.ed25519
 		};
 	} catch (e) {
-		return {
-			ok: false,
-			verified: false,
-			code: "internal",
-			message: errorMessage(e) || "Login verification failed"
-		};
+		return failedVerification("internal", errorMessage(e) || "Login verification failed");
 	}
 }
 //#endregion