@seams/wallet-server 0.6.2 → 0.7.3

package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpRegistrationRecords.js

@@ -8,14 +8,10 @@ function requireRuntimePolicyScope(input) {
 	if (scope) return scope;
 	throw new Error("runtimePolicyScope.orgId, runtimePolicyScope.projectId, runtimePolicyScope.envId, and runtimePolicyScope.signingRootVersion are required for Google Email OTP registration");
 }
-function runtimePolicyScopeKey(scope) {
-	if (!scope) return "";
-	return `${scope.orgId}\n${scope.projectId}\n${scope.envId}\n${scope.signingRootVersion}`;
-}
 function activeGoogleEmailOtpRegistrationAttemptRecord(input) {
 	const terminal = terminalGoogleEmailOtpRegistrationAttemptRecord({
 		fields: {
-			...googleEmailOtpRegistrationAttemptFields(input.record),
+			...input.record,
 			updatedAtMs: input.updatedAtMs
 		},
 		state: "active",
@@ -27,7 +23,7 @@ function activeGoogleEmailOtpRegistrationAttemptRecord(input) {
 function expiredGoogleEmailOtpRegistrationAttemptRecord(input) {
 	const terminal = terminalGoogleEmailOtpRegistrationAttemptRecord({
 		fields: {
-			...googleEmailOtpRegistrationAttemptFields(input.record),
+			...input.record,
 			updatedAtMs: input.updatedAtMs
 		},
 		state: "expired",
@@ -40,7 +36,7 @@ function expiredGoogleEmailOtpRegistrationAttemptRecord(input) {
 function failedGoogleEmailOtpRegistrationAttemptWithCode(input) {
 	const terminal = terminalGoogleEmailOtpRegistrationAttemptRecord({
 		fields: {
-			...googleEmailOtpRegistrationAttemptFields(input.record),
+			...input.record,
 			updatedAtMs: input.updatedAtMs
 		},
 		state: "failed",
@@ -97,9 +93,9 @@ function parseGoogleEmailOtpRegistrationAttemptRecord(input) {
 		...runtimePolicyScope ? { runtimePolicyScope } : {}
 	};
 	switch (state) {
-		case "started": return startedGoogleEmailOtpRegistrationAttemptRecord(fields);
-		case "key_finalized": return keyFinalizedGoogleEmailOtpRegistrationAttemptRecord({
-			...fields,
+		case "started": return registrationAttemptRecord(fields, { state });
+		case "key_finalized": return registrationAttemptRecord(fields, {
+			state,
 			finalizedPublicKey: finalizedPublicKey || ""
 		});
 		case "active":
@@ -121,17 +117,6 @@ function parseGoogleEmailOtpRegistrationAttemptRow(row) {
 	if (record.expiresAtMs !== expiresAtMs || record.updatedAtMs !== updatedAtMs) return null;
 	return record;
 }
-function registrationAttemptMatchesStartedScope(record, input) {
-	return record.providerSubject === input.providerSubject && record.email === input.email && record.ownerProofBindingDigest === input.ownerProofBindingDigest && record.runtimePolicyScope?.orgId === input.orgId && runtimePolicyScopeKey(record.runtimePolicyScope) === runtimePolicyScopeKey(input.runtimePolicyScope) && (record.state === "started" || record.state === "key_finalized") && record.expiresAtMs > input.nowMs;
-}
-function registrationAttemptMatchesReplacementScope(record, input) {
-	return record.providerSubject === input.providerSubject && record.email === input.email && record.ownerProofBindingDigest !== input.ownerProofBindingDigest && record.runtimePolicyScope?.orgId === input.orgId && runtimePolicyScopeKey(record.runtimePolicyScope) === runtimePolicyScopeKey(input.runtimePolicyScope) && (record.state === "started" || record.state === "key_finalized") && record.expiresAtMs > input.nowMs;
-}
-function googleEmailOtpRegistrationOfferWalletIdsJson(candidates) {
-	const walletIds = [];
-	for (const candidate of candidates) walletIds.push(candidate.walletId);
-	return JSON.stringify(walletIds);
-}
 function googleEmailOtpRegistrationOfferForResponse(input) {
 	const first = input.offerCandidates[0];
 	const candidates = [{
@@ -153,114 +138,29 @@ function googleEmailOtpRegistrationOfferForResponse(input) {
 	};
 }
 function pendingGoogleEmailOtpRegistrationAttemptWithUpdatedAt(record, updatedAtMs) {
-	if (record.state === "started") return {
-		version: "google_email_otp_registration_attempt_v1",
-		attemptId: record.attemptId,
-		providerSubject: record.providerSubject,
-		email: record.email,
-		walletId: record.walletId,
-		offerId: record.offerId,
-		offerCandidates: record.offerCandidates,
-		selectedCandidateId: record.selectedCandidateId,
-		ownerProofBindingDigest: record.ownerProofBindingDigest,
-		authProvider: record.authProvider,
-		accountIdSlugVersion: "hmac_readable_v1",
-		walletIdDerivationNonce: record.walletIdDerivationNonce,
-		collisionCounter: record.collisionCounter,
-		state: "started",
-		createdAtMs: record.createdAtMs,
-		updatedAtMs,
-		expiresAtMs: record.expiresAtMs,
-		...record.runtimePolicyScope ? { runtimePolicyScope: record.runtimePolicyScope } : {}
-	};
-	return {
-		version: "google_email_otp_registration_attempt_v1",
-		attemptId: record.attemptId,
-		providerSubject: record.providerSubject,
-		email: record.email,
-		walletId: record.walletId,
-		offerId: record.offerId,
-		offerCandidates: record.offerCandidates,
-		selectedCandidateId: record.selectedCandidateId,
-		ownerProofBindingDigest: record.ownerProofBindingDigest,
-		authProvider: record.authProvider,
-		accountIdSlugVersion: "hmac_readable_v1",
-		walletIdDerivationNonce: record.walletIdDerivationNonce,
-		collisionCounter: record.collisionCounter,
-		state: "key_finalized",
-		finalizedPublicKey: record.finalizedPublicKey,
-		createdAtMs: record.createdAtMs,
-		updatedAtMs,
-		expiresAtMs: record.expiresAtMs,
-		...record.runtimePolicyScope ? { runtimePolicyScope: record.runtimePolicyScope } : {}
-	};
+	return pendingRegistrationAttemptRecord({
+		...record,
+		updatedAtMs
+	}, record);
 }
 function pendingGoogleEmailOtpRegistrationAttemptWithSelectedCandidate(input) {
-	if (input.record.state === "started") return {
-		version: "google_email_otp_registration_attempt_v1",
-		attemptId: input.record.attemptId,
-		providerSubject: input.record.providerSubject,
-		email: input.record.email,
-		walletId: input.candidate.walletId,
-		offerId: input.record.offerId,
-		offerCandidates: input.record.offerCandidates,
-		selectedCandidateId: input.candidate.candidateId,
-		ownerProofBindingDigest: input.record.ownerProofBindingDigest,
-		authProvider: input.record.authProvider,
-		accountIdSlugVersion: "hmac_readable_v1",
-		walletIdDerivationNonce: input.record.walletIdDerivationNonce,
-		collisionCounter: input.candidate.collisionCounter,
-		state: "started",
-		createdAtMs: input.record.createdAtMs,
-		updatedAtMs: input.updatedAtMs,
-		expiresAtMs: input.record.expiresAtMs,
-		...input.record.runtimePolicyScope ? { runtimePolicyScope: input.record.runtimePolicyScope } : {}
-	};
-	return {
-		version: "google_email_otp_registration_attempt_v1",
-		attemptId: input.record.attemptId,
-		providerSubject: input.record.providerSubject,
-		email: input.record.email,
+	return pendingRegistrationAttemptRecord({
+		...input.record,
 		walletId: input.candidate.walletId,
-		offerId: input.record.offerId,
-		offerCandidates: input.record.offerCandidates,
 		selectedCandidateId: input.candidate.candidateId,
-		ownerProofBindingDigest: input.record.ownerProofBindingDigest,
-		authProvider: input.record.authProvider,
-		accountIdSlugVersion: "hmac_readable_v1",
-		walletIdDerivationNonce: input.record.walletIdDerivationNonce,
 		collisionCounter: input.candidate.collisionCounter,
-		state: "key_finalized",
-		finalizedPublicKey: input.record.finalizedPublicKey,
-		createdAtMs: input.record.createdAtMs,
-		updatedAtMs: input.updatedAtMs,
-		expiresAtMs: input.record.expiresAtMs,
-		...input.record.runtimePolicyScope ? { runtimePolicyScope: input.record.runtimePolicyScope } : {}
-	};
+		updatedAtMs: input.updatedAtMs
+	}, input.record);
 }
 function abandonedGoogleEmailOtpRegistrationAttemptRecord(input) {
-	return {
-		version: "google_email_otp_registration_attempt_v1",
-		attemptId: input.record.attemptId,
-		providerSubject: input.record.providerSubject,
-		email: input.record.email,
-		walletId: input.record.walletId,
-		offerId: input.record.offerId,
-		offerCandidates: input.record.offerCandidates,
-		selectedCandidateId: input.record.selectedCandidateId,
-		ownerProofBindingDigest: input.record.ownerProofBindingDigest,
-		authProvider: input.record.authProvider,
-		accountIdSlugVersion: "hmac_readable_v1",
-		walletIdDerivationNonce: input.record.walletIdDerivationNonce,
-		collisionCounter: input.record.collisionCounter,
+	return registrationAttemptRecord({
+		...input.record,
+		updatedAtMs: input.updatedAtMs
+	}, {
 		state: "abandoned",
 		...input.record.state === "key_finalized" ? { finalizedPublicKey: input.record.finalizedPublicKey } : {},
-		failureCode: input.failureCode,
-		createdAtMs: input.record.createdAtMs,
-		updatedAtMs: input.updatedAtMs,
-		expiresAtMs: input.record.expiresAtMs,
-		...input.record.runtimePolicyScope ? { runtimePolicyScope: input.record.runtimePolicyScope } : {}
-	};
+		failureCode: input.failureCode
+	});
 }
 function parseRuntimePolicyScope(input) {
 	const record = parseJsonObject(input);
@@ -318,168 +218,62 @@ function googleEmailOtpRegistrationAttemptState(input) {
 		default: return null;
 	}
 }
-function startedGoogleEmailOtpRegistrationAttemptRecord(input) {
+/**
+* Builds an attempt from its fields, with `state` carrying the state and the fields stored beside
+* it. The key order is the stored JSON's: terminal states append their own fields after these.
+*/
+function registrationAttemptRecord(fields, state) {
 	return {
 		version: "google_email_otp_registration_attempt_v1",
-		attemptId: input.attemptId,
-		providerSubject: input.providerSubject,
-		email: input.email,
-		walletId: input.walletId,
-		offerId: input.offerId,
-		offerCandidates: input.offerCandidates,
-		selectedCandidateId: input.selectedCandidateId,
-		ownerProofBindingDigest: input.ownerProofBindingDigest,
-		authProvider: input.authProvider,
+		attemptId: fields.attemptId,
+		providerSubject: fields.providerSubject,
+		email: fields.email,
+		walletId: fields.walletId,
+		offerId: fields.offerId,
+		offerCandidates: fields.offerCandidates,
+		selectedCandidateId: fields.selectedCandidateId,
+		ownerProofBindingDigest: fields.ownerProofBindingDigest,
+		authProvider: fields.authProvider,
 		accountIdSlugVersion: "hmac_readable_v1",
-		walletIdDerivationNonce: input.walletIdDerivationNonce,
-		collisionCounter: input.collisionCounter,
-		state: "started",
-		createdAtMs: input.createdAtMs,
-		updatedAtMs: input.updatedAtMs,
-		expiresAtMs: input.expiresAtMs,
-		...input.runtimePolicyScope ? { runtimePolicyScope: input.runtimePolicyScope } : {}
+		walletIdDerivationNonce: fields.walletIdDerivationNonce,
+		collisionCounter: fields.collisionCounter,
+		...state,
+		createdAtMs: fields.createdAtMs,
+		updatedAtMs: fields.updatedAtMs,
+		expiresAtMs: fields.expiresAtMs,
+		...fields.runtimePolicyScope ? { runtimePolicyScope: fields.runtimePolicyScope } : {}
 	};
 }
-function keyFinalizedGoogleEmailOtpRegistrationAttemptRecord(input) {
-	return {
-		version: "google_email_otp_registration_attempt_v1",
-		attemptId: input.attemptId,
-		providerSubject: input.providerSubject,
-		email: input.email,
-		walletId: input.walletId,
-		offerId: input.offerId,
-		offerCandidates: input.offerCandidates,
-		selectedCandidateId: input.selectedCandidateId,
-		ownerProofBindingDigest: input.ownerProofBindingDigest,
-		authProvider: input.authProvider,
-		accountIdSlugVersion: "hmac_readable_v1",
-		walletIdDerivationNonce: input.walletIdDerivationNonce,
-		collisionCounter: input.collisionCounter,
+/** Rebuilds a pending attempt from changed fields, keeping its state. */
+function pendingRegistrationAttemptRecord(fields, record) {
+	return record.state === "started" ? registrationAttemptRecord(fields, { state: "started" }) : registrationAttemptRecord(fields, {
 		state: "key_finalized",
-		finalizedPublicKey: input.finalizedPublicKey,
-		createdAtMs: input.createdAtMs,
-		updatedAtMs: input.updatedAtMs,
-		expiresAtMs: input.expiresAtMs,
-		...input.runtimePolicyScope ? { runtimePolicyScope: input.runtimePolicyScope } : {}
-	};
+		finalizedPublicKey: record.finalizedPublicKey
+	});
 }
 function terminalGoogleEmailOtpRegistrationAttemptRecord(input) {
-	const fields = input.fields;
+	const finalized = input.finalizedPublicKey ? { finalizedPublicKey: input.finalizedPublicKey } : {};
 	switch (input.state) {
 		case "active": return {
-			version: "google_email_otp_registration_attempt_v1",
-			attemptId: fields.attemptId,
-			providerSubject: fields.providerSubject,
-			email: fields.email,
-			walletId: fields.walletId,
-			offerId: fields.offerId,
-			offerCandidates: fields.offerCandidates,
-			selectedCandidateId: fields.selectedCandidateId,
-			ownerProofBindingDigest: fields.ownerProofBindingDigest,
-			authProvider: fields.authProvider,
-			accountIdSlugVersion: "hmac_readable_v1",
-			walletIdDerivationNonce: fields.walletIdDerivationNonce,
-			collisionCounter: fields.collisionCounter,
-			state: "active",
-			createdAtMs: fields.createdAtMs,
-			updatedAtMs: fields.updatedAtMs,
-			expiresAtMs: fields.expiresAtMs,
-			...fields.runtimePolicyScope ? { runtimePolicyScope: fields.runtimePolicyScope } : {},
-			...input.finalizedPublicKey ? { finalizedPublicKey: input.finalizedPublicKey } : {}
+			...registrationAttemptRecord(input.fields, { state: "active" }),
+			...finalized
 		};
 		case "abandoned":
-			if (!input.failureCode) return null;
-			return {
-				version: "google_email_otp_registration_attempt_v1",
-				attemptId: fields.attemptId,
-				providerSubject: fields.providerSubject,
-				email: fields.email,
-				walletId: fields.walletId,
-				offerId: fields.offerId,
-				offerCandidates: fields.offerCandidates,
-				selectedCandidateId: fields.selectedCandidateId,
-				ownerProofBindingDigest: fields.ownerProofBindingDigest,
-				authProvider: fields.authProvider,
-				accountIdSlugVersion: "hmac_readable_v1",
-				walletIdDerivationNonce: fields.walletIdDerivationNonce,
-				collisionCounter: fields.collisionCounter,
-				state: "abandoned",
-				createdAtMs: fields.createdAtMs,
-				updatedAtMs: fields.updatedAtMs,
-				expiresAtMs: fields.expiresAtMs,
-				...fields.runtimePolicyScope ? { runtimePolicyScope: fields.runtimePolicyScope } : {},
-				...input.finalizedPublicKey ? { finalizedPublicKey: input.finalizedPublicKey } : {},
-				failureCode: input.failureCode
-			};
 		case "failed":
 			if (!input.failureCode) return null;
 			return {
-				version: "google_email_otp_registration_attempt_v1",
-				attemptId: fields.attemptId,
-				providerSubject: fields.providerSubject,
-				email: fields.email,
-				walletId: fields.walletId,
-				offerId: fields.offerId,
-				offerCandidates: fields.offerCandidates,
-				selectedCandidateId: fields.selectedCandidateId,
-				ownerProofBindingDigest: fields.ownerProofBindingDigest,
-				authProvider: fields.authProvider,
-				accountIdSlugVersion: "hmac_readable_v1",
-				walletIdDerivationNonce: fields.walletIdDerivationNonce,
-				collisionCounter: fields.collisionCounter,
-				state: "failed",
-				createdAtMs: fields.createdAtMs,
-				updatedAtMs: fields.updatedAtMs,
-				expiresAtMs: fields.expiresAtMs,
-				...fields.runtimePolicyScope ? { runtimePolicyScope: fields.runtimePolicyScope } : {},
-				...input.finalizedPublicKey ? { finalizedPublicKey: input.finalizedPublicKey } : {},
+				...registrationAttemptRecord(input.fields, { state: input.state }),
+				...finalized,
 				failureCode: input.failureCode
 			};
 		case "expired": return {
-			version: "google_email_otp_registration_attempt_v1",
-			attemptId: fields.attemptId,
-			providerSubject: fields.providerSubject,
-			email: fields.email,
-			walletId: fields.walletId,
-			offerId: fields.offerId,
-			offerCandidates: fields.offerCandidates,
-			selectedCandidateId: fields.selectedCandidateId,
-			ownerProofBindingDigest: fields.ownerProofBindingDigest,
-			authProvider: fields.authProvider,
-			accountIdSlugVersion: "hmac_readable_v1",
-			walletIdDerivationNonce: fields.walletIdDerivationNonce,
-			collisionCounter: fields.collisionCounter,
-			state: "expired",
-			createdAtMs: fields.createdAtMs,
-			updatedAtMs: fields.updatedAtMs,
-			expiresAtMs: fields.expiresAtMs,
-			...fields.runtimePolicyScope ? { runtimePolicyScope: fields.runtimePolicyScope } : {},
-			...input.finalizedPublicKey ? { finalizedPublicKey: input.finalizedPublicKey } : {},
+			...registrationAttemptRecord(input.fields, { state: "expired" }),
+			...finalized,
 			...input.failureCode ? { failureCode: input.failureCode } : {}
 		};
 	}
 }
-function googleEmailOtpRegistrationAttemptFields(record) {
-	return {
-		attemptId: record.attemptId,
-		providerSubject: record.providerSubject,
-		email: record.email,
-		walletId: record.walletId,
-		offerId: record.offerId,
-		offerCandidates: record.offerCandidates,
-		selectedCandidateId: record.selectedCandidateId,
-		ownerProofBindingDigest: record.ownerProofBindingDigest,
-		authProvider: record.authProvider,
-		accountIdSlugVersion: "hmac_readable_v1",
-		walletIdDerivationNonce: record.walletIdDerivationNonce,
-		collisionCounter: record.collisionCounter,
-		createdAtMs: record.createdAtMs,
-		updatedAtMs: record.updatedAtMs,
-		expiresAtMs: record.expiresAtMs,
-		...record.runtimePolicyScope ? { runtimePolicyScope: record.runtimePolicyScope } : {}
-	};
-}
 //#endregion
-export { abandonedGoogleEmailOtpRegistrationAttemptRecord, activeGoogleEmailOtpRegistrationAttemptRecord, expiredGoogleEmailOtpRegistrationAttemptRecord, failedGoogleEmailOtpRegistrationAttemptWithCode, googleEmailOtpRegistrationOfferForResponse, googleEmailOtpRegistrationOfferWalletIdsJson, parseGoogleEmailOtpRegistrationAttemptRecord, parseGoogleEmailOtpRegistrationAttemptRow, pendingGoogleEmailOtpRegistrationAttemptWithSelectedCandidate, pendingGoogleEmailOtpRegistrationAttemptWithUpdatedAt, registrationAttemptMatchesReplacementScope, registrationAttemptMatchesStartedScope, requireRuntimePolicyScope, runtimePolicyScopeKey };
+export { abandonedGoogleEmailOtpRegistrationAttemptRecord, activeGoogleEmailOtpRegistrationAttemptRecord, expiredGoogleEmailOtpRegistrationAttemptRecord, failedGoogleEmailOtpRegistrationAttemptWithCode, googleEmailOtpRegistrationOfferForResponse, parseGoogleEmailOtpRegistrationAttemptRow, pendingGoogleEmailOtpRegistrationAttemptWithSelectedCandidate, pendingGoogleEmailOtpRegistrationAttemptWithUpdatedAt, requireRuntimePolicyScope };
 
 //# sourceMappingURL=d1GoogleEmailOtpRegistrationRecords.js.map

package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpSessionResolver.js

@@ -1,8 +1,9 @@
 import { parseGoogleProviderSubject, parseOrgId, parseVerifiedGoogleEmail } from "../../../../shared-ts/src/utils/domainIds.js";
-import { createServerAllocatedWalletId } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
+import { createServerAllocatedWalletId } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
 import { parseD1BoundaryWalletId, parseD1BoundaryWalletIdResult } from "../auth/d1RouterApiAuthBoundary.js";
 import { abandonedGoogleEmailOtpRegistrationAttemptRecord, activeGoogleEmailOtpRegistrationAttemptRecord, expiredGoogleEmailOtpRegistrationAttemptRecord, failedGoogleEmailOtpRegistrationAttemptWithCode, googleEmailOtpRegistrationOfferForResponse, requireRuntimePolicyScope } from "./d1GoogleEmailOtpRegistrationRecords.js";
@@ -61,17 +62,9 @@ var CloudflareD1GoogleEmailOtpSessionResolver = class {
 		});
 	}
 	async cleanupDevRegistrationState(input) {
-		if (this.production) return {
-			ok: false,
-			code: "not_found",
-			message: "Google Email OTP dev cleanup is not available"
-		};
+		if (this.production) return failure("not_found", "Google Email OTP dev cleanup is not available");
 		const providerSubject = normalizeOptionalTrimmedString(input.providerSubject);
-		if (!providerSubject || !providerSubject.startsWith("google:")) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing Google provider subject"
-		};
+		if (!providerSubject || !providerSubject.startsWith("google:")) return failure("invalid_body", "Missing Google provider subject");
 		const requestedWalletId = parseD1BoundaryWalletId(input.walletId);
 		const requestedOrgId = normalizeOptionalTrimmedString(input.orgId);
 		const nowMs = cleanupNowMs(input.nowMs);
@@ -122,23 +115,11 @@ var CloudflareD1GoogleEmailOtpSessionResolver = class {
 	async consumeRegistrationAttemptRateLimit(input) {
 		if (normalizeOptionalTrimmedString(input.accountMode)?.toLowerCase() !== "register") return { ok: true };
 		const providerSubject = parseGoogleProviderSubject(input.providerSubject);
-		if (!providerSubject.ok) return {
-			ok: false,
-			code: "invalid_body",
-			message: providerSubject.error.message
-		};
+		if (!providerSubject.ok) return failure("invalid_body", providerSubject.error.message);
 		const email = parseVerifiedGoogleEmail(input.email);
-		if (!email.ok) return {
-			ok: false,
-			code: "invalid_body",
-			message: email.error.message
-		};
+		if (!email.ok) return failure("invalid_body", email.error.message);
 		const orgId = parseOrgId(input.runtimePolicyScope?.orgId);
-		if (!orgId.ok) return {
-			ok: false,
-			code: "invalid_body",
-			message: orgId.error.message
-		};
+		if (!orgId.ok) return failure("invalid_body", orgId.error.message);
 		const restartOffer = isTrueFlag(input.restartRegistrationOffer);
 		return await this.emailOtpRateLimits.consume({
 			scope: "googleRegistrationAttempt",
@@ -153,39 +134,19 @@ var CloudflareD1GoogleEmailOtpSessionResolver = class {
 		const registrationAttemptId = normalizeOptionalTrimmedString(input.registrationAttemptId);
 		if (!registrationAttemptId) return { ok: true };
 		const walletId = parseD1BoundaryWalletIdResult(input.walletId);
-		if (!walletId.ok) return {
-			ok: false,
-			code: "invalid_body",
-			message: walletId.code === "missing" ? "Missing walletId" : "Invalid walletId"
-		};
+		if (!walletId.ok) return failure("invalid_body", walletId.code === "missing" ? "Missing walletId" : "Invalid walletId");
 		const attempt = await this.registrationAttempts.read(registrationAttemptId);
-		if (!attempt) return {
-			ok: false,
-			code: "registration_incomplete",
-			message: "Google Email OTP registration attempt expired or was not found"
-		};
+		if (!attempt) return failure("registration_incomplete", "Google Email OTP registration attempt expired or was not found");
 		if (attempt.expiresAtMs <= Date.now()) {
 			await this.registrationAttempts.put(expiredGoogleEmailOtpRegistrationAttemptRecord({
 				record: attempt,
 				updatedAtMs: Date.now()
 			}));
-			return {
-				ok: false,
-				code: "registration_incomplete",
-				message: "Google Email OTP registration attempt expired"
-			};
+			return failure("registration_incomplete", "Google Email OTP registration attempt expired");
 		}
-		if (walletId.value !== attempt.walletId) return {
-			ok: false,
-			code: "wallet_identity_mismatch",
-			message: "registrationAttemptId does not match walletId"
-		};
+		if (walletId.value !== attempt.walletId) return failure("wallet_identity_mismatch", "registrationAttemptId does not match walletId");
 		if (attempt.state === "active") return { ok: true };
-		if (attempt.state !== "started" && attempt.state !== "key_finalized") return {
-			ok: false,
-			code: "registration_incomplete",
-			message: "Google Email OTP registration attempt is no longer active"
-		};
+		if (attempt.state !== "started" && attempt.state !== "key_finalized") return failure("registration_incomplete", "Google Email OTP registration attempt is no longer active");
 		const linked = await this.linkIdentity({
 			userId: attempt.walletId,
 			subject: `wallet:${attempt.providerSubject}`,
@@ -197,11 +158,7 @@ var CloudflareD1GoogleEmailOtpSessionResolver = class {
 				failureCode: linked.code,
 				updatedAtMs: Date.now()
 			}));
-			return {
-				ok: false,
-				code: linked.code,
-				message: linked.message
-			};
+			return failure(linked.code, linked.message);
 		}
 		await this.registrationAttempts.put(activeGoogleEmailOtpRegistrationAttemptRecord({
 			record: attempt,
@@ -214,48 +171,20 @@ var CloudflareD1GoogleEmailOtpSessionResolver = class {
 		const walletId = parseD1BoundaryWalletIdResult(input.walletId);
 		const providerSubject = parseGoogleProviderSubject(input.providerSubject);
 		const ownerProofBindingDigest = normalizeOptionalTrimmedString(input.ownerProofBindingDigest);
-		if (!registrationAttemptId || !walletId.ok || !providerSubject.ok || !ownerProofBindingDigest) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Google Email OTP registration candidate validation requires signed session scope"
-		};
+		if (!registrationAttemptId || !walletId.ok || !providerSubject.ok || !ownerProofBindingDigest) return failure("invalid_body", "Google Email OTP registration candidate validation requires signed session scope");
 		const attempt = await this.registrationAttempts.read(registrationAttemptId);
-		if (!attempt) return {
-			ok: false,
-			code: "registration_attempt_missing",
-			message: "Google Email OTP registration attempt expired or was not found"
-		};
+		if (!attempt) return failure("registration_attempt_missing", "Google Email OTP registration attempt expired or was not found");
 		if (attempt.expiresAtMs <= Date.now()) {
 			await this.registrationAttempts.put(expiredGoogleEmailOtpRegistrationAttemptRecord({
 				record: attempt,
 				updatedAtMs: Date.now()
 			}));
-			return {
-				ok: false,
-				code: "registration_attempt_expired",
-				message: "Google Email OTP registration attempt expired"
-			};
+			return failure("registration_attempt_expired", "Google Email OTP registration attempt expired");
 		}
-		if (attempt.providerSubject !== providerSubject.value) return {
-			ok: false,
-			code: "challenge_subject_mismatch",
-			message: "Email OTP registration attempt does not match the provider subject"
-		};
-		if (attempt.ownerProofBindingDigest !== ownerProofBindingDigest) return {
-			ok: false,
-			code: "owner_proof_binding_mismatch",
-			message: "Google Email OTP registration attempt does not match the owner proof binding"
-		};
-		if (attempt.state !== "started" && attempt.state !== "key_finalized") return {
-			ok: false,
-			code: "registration_incomplete",
-			message: "Google Email OTP registration attempt is no longer active"
-		};
-		if (!attempt.offerCandidates.find((offerCandidate) => offerCandidate.walletId === walletId.value)) return {
-			ok: false,
-			code: "wallet_identity_mismatch",
-			message: "walletId is not an active Google Email OTP registration candidate"
-		};
+		if (attempt.providerSubject !== providerSubject.value) return failure("challenge_subject_mismatch", "Email OTP registration attempt does not match the provider subject");
+		if (attempt.ownerProofBindingDigest !== ownerProofBindingDigest) return failure("owner_proof_binding_mismatch", "Google Email OTP registration attempt does not match the owner proof binding");
+		if (attempt.state !== "started" && attempt.state !== "key_finalized") return failure("registration_incomplete", "Google Email OTP registration attempt is no longer active");
+		if (!attempt.offerCandidates.find((offerCandidate) => offerCandidate.walletId === walletId.value)) return failure("wallet_identity_mismatch", "walletId is not an active Google Email OTP registration candidate");
 		return { ok: true };
 	}
 	async resolveLoginSession(input) {
@@ -460,21 +389,9 @@ var CloudflareD1GoogleEmailOtpSessionResolver = class {
 	}
 	async readActiveEnrollment(input) {
 		const enrollment = await this.emailOtpEnrollments.readEnrollment(input.walletId);
-		if (!enrollment) return {
-			ok: false,
-			code: "not_found",
-			message: "Email OTP enrollment not found"
-		};
-		if (enrollment.orgId !== input.orgId) return {
-			ok: false,
-			code: "tenant_scope_mismatch",
-			message: "Email OTP enrollment does not match the requested orgId"
-		};
-		if (enrollment.providerUserId !== input.providerUserId) return {
-			ok: false,
-			code: "provider_identity_mismatch",
-			message: "Email OTP enrollment does not belong to the requested provider identity"
-		};
+		if (!enrollment) return failure("not_found", "Email OTP enrollment not found");
+		if (enrollment.orgId !== input.orgId) return failure("tenant_scope_mismatch", "Email OTP enrollment does not match the requested orgId");
+		if (enrollment.providerUserId !== input.providerUserId) return failure("provider_identity_mismatch", "Email OTP enrollment does not belong to the requested provider identity");
 		return {
 			ok: true,
 			enrollment
@@ -497,11 +414,7 @@ function codedError(code, message) {
 	return error;
 }
 function devCleanupIdentityDeleteFailure(input) {
-	return {
-		ok: false,
-		code: input.code,
-		message: input.message
-	};
+	return failure(input.code, input.message);
 }
 //#endregion
 export { CloudflareD1GoogleEmailOtpSessionResolver };

package/dist/esm/router/cloudflare/d1/identity/d1IdentityRecords.js

@@ -1,6 +1,5 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
-import { positiveInteger } from "../auth/d1RouterApiAuthBoundary.js";
 import { GOOGLE_EMAIL_OTP_STALE_IDENTITY_MESSAGE } from "../../../../core/authService/googleEmailOtpErrors.js";
 //#region src/router/cloudflare/d1/identity/d1IdentityRecords.ts
 function hasDifferentWalletIdentitySubject(input) {
@@ -19,33 +18,7 @@ function googleEmailOtpStaleIdentityMapping(input) {
 		message: GOOGLE_EMAIL_OTP_STALE_IDENTITY_MESSAGE
 	};
 }
-function parseIdentityCreatedAt(input, fallback) {
-	return positiveInteger(input) ?? fallback;
-}
-function identitySubjectRecord(input) {
-	return {
-		version: "identity_subject_v1",
-		subject: input.subject,
-		userId: input.userId,
-		createdAtMs: input.createdAtMs,
-		updatedAtMs: input.updatedAtMs
-	};
-}
-function identityAlreadyLinked() {
-	return {
-		ok: false,
-		code: "already_linked",
-		message: "Subject is already linked to a different user"
-	};
-}
-function identityMoveDisallowed() {
-	return {
-		ok: false,
-		code: "already_linked",
-		message: "Subject is linked to a different user with other identities; merge is not allowed"
-	};
-}
 //#endregion
-export { googleEmailOtpStaleIdentityMapping, hasDifferentWalletIdentitySubject, identityAlreadyLinked, identityMoveDisallowed, identitySubjectRecord, parseIdentityCreatedAt };
+export { googleEmailOtpStaleIdentityMapping, hasDifferentWalletIdentitySubject };
 
 //# sourceMappingURL=d1IdentityRecords.js.map