@seams/wallet-server 0.6.2 → 0.7.3

package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationExecutionRecord.js

@@ -1,268 +1,84 @@
-import { parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationExecuteRequestV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
-import { encodeRouterAbEd25519YaoRegistrationAdmissionFingerprintV1 } from "./routerAbEd25519YaoRegistration.js";
+import { parseRouterAbEd25519YaoRegistrationActivationExecuteRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { InMemoryRouterAbEd25519YaoRegistrationService, InMemoryRouterAbEd25519YaoRegistrationStateV1, encodeRouterAbEd25519YaoRegistrationAdmissionFingerprintV1 } from "./routerAbEd25519YaoRegistration.js";
 import { routerAbEd25519YaoCredentialDigestHexV1 } from "./routerAbEd25519YaoRegistrationIntentAuthorization.js";
 //#region src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationExecutionRecord.ts
-const ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTION_RECORD_KIND_V1 = "router_ab_ed25519_yao_registration_execution_record_v1";
-const EXECUTION_AUTHORITY_FIELDS = [
-	"recordKind",
-	"lifecycleId",
-	"admissionRequest",
-	"admissionReceipt",
-	"admissionBindingJson",
-	"credentialDigestSha256Hex",
-	"expiresAtMs"
-];
-const READY_FIELDS = [...EXECUTION_AUTHORITY_FIELDS, "kind"];
-const CLAIMED_FIELDS = [
-	...EXECUTION_AUTHORITY_FIELDS,
-	"kind",
-	"requestDigestSha256Hex",
-	"request",
-	"claimedAtMs",
-	"reconcileAfterMs"
-];
-const COMPLETED_FIELDS = [
-	...CLAIMED_FIELDS,
-	"result",
-	"consumerBinding"
-];
-const FAILED_FIELDS = [...CLAIMED_FIELDS, "failure"];
-const FAILURE_FIELDS = [
-	"ok",
-	"status",
-	"code",
-	"message"
-];
-function buildRouterAbEd25519YaoRegistrationExecutionReadyRecordV1(input) {
-	const { lifecycleId, registration, authority } = input;
-	if (registration.admissionRequest.scope.lifecycle_id !== lifecycleId || registration.admissionReceipt.binding.lifecycle.lifecycle_id !== lifecycleId || authority.admissionRequest.scope.lifecycle_id !== lifecycleId || authority.admissionFingerprint !== encodeRouterAbEd25519YaoRegistrationAdmissionFingerprintV1(authority.admissionRequest) || authority.admissionFingerprint !== encodeRouterAbEd25519YaoRegistrationAdmissionFingerprintV1(registration.admissionRequest) || !Number.isSafeInteger(authority.expiresAtMs) || authority.expiresAtMs <= 0) return null;
+/**
+* The authority of one admitted registration, or `null` if it is
+* inconsistent. The pinned tenant root must be the one the admission names:
+* its signing root and version.
+*/
+function buildRouterAbEd25519YaoRegistrationExecutionAuthorityV1(input) {
+	const { lifecycleId, registration, authority, dispatchRoot } = input;
+	if (dispatchRoot === void 0 || dispatchRoot.identity.signingRootId !== registration.admissionRequest.application_binding.signing_root_id || dispatchRoot.identity.signingRootVersion !== registration.admissionRequest.scope.root_share_epoch || registration.admissionRequest.scope.lifecycle_id !== lifecycleId || registration.admissionReceipt.binding.lifecycle.lifecycle_id !== lifecycleId || authority.admissionRequest.scope.lifecycle_id !== lifecycleId || authority.admissionFingerprint !== encodeRouterAbEd25519YaoRegistrationAdmissionFingerprintV1(authority.admissionRequest) || authority.admissionFingerprint !== encodeRouterAbEd25519YaoRegistrationAdmissionFingerprintV1(registration.admissionRequest) || !Number.isSafeInteger(authority.expiresAtMs) || authority.expiresAtMs <= 0) return null;
 	return {
-		kind: "ready",
 		lifecycleId,
 		admissionRequest: registration.admissionRequest,
 		admissionReceipt: registration.admissionReceipt,
 		admissionBindingJson: routerAbEd25519YaoRegistrationAdmissionBindingJsonV1(registration.admissionReceipt),
 		credentialDigestSha256Hex: routerAbEd25519YaoCredentialDigestHexV1(authority.credentialDigestSha256),
-		expiresAtMs: authority.expiresAtMs
-	};
-}
-function routerAbEd25519YaoRegistrationExecutionRecordKeyV1(lifecycleId) {
-	return `registration-execution:${requireVisibleString(lifecycleId, "lifecycleId", 256)}`;
-}
-function encodeRouterAbEd25519YaoRegistrationExecutionRecordV1(record) {
-	return toJsonObject({
-		recordKind: ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTION_RECORD_KIND_V1,
-		...record
-	});
-}
-function parseRouterAbEd25519YaoRegistrationExecutionRecordV1(input) {
-	const record = readRouterAbEd25519YaoRegistrationExecutionRecordObjectV1(input);
-	if (record === null || record.recordKind !== "router_ab_ed25519_yao_registration_execution_record_v1") return null;
-	const kind = parseRouterAbEd25519YaoRegistrationExecutionRecordKindV1(record.kind);
-	switch (kind) {
-		case "ready": return parseRouterAbEd25519YaoRegistrationExecutionReadyRecordV1(record);
-		case "claimed": return parseRouterAbEd25519YaoRegistrationExecutionClaimedRecordV1(record);
-		case "completed": return parseRouterAbEd25519YaoRegistrationExecutionCompletedRecordV1(record);
-		case "failed": return parseRouterAbEd25519YaoRegistrationExecutionFailedRecordV1(record);
-		case null: return null;
-		default: return assertNever(kind);
-	}
-}
-function parseRouterAbEd25519YaoRegistrationExecutionReadyRecordV1(record) {
-	if (!hasExactRouterAbEd25519YaoRegistrationExecutionRecordKeys(record, READY_FIELDS)) return null;
-	const authority = parseRouterAbEd25519YaoRegistrationExecutionAuthorityV1(record);
-	if (authority === null) return null;
-	return {
-		kind: "ready",
-		lifecycleId: authority.lifecycleId,
-		admissionRequest: authority.admissionRequest,
-		admissionReceipt: authority.admissionReceipt,
-		admissionBindingJson: authority.admissionBindingJson,
-		credentialDigestSha256Hex: authority.credentialDigestSha256Hex,
-		expiresAtMs: authority.expiresAtMs
-	};
-}
-function parseRouterAbEd25519YaoRegistrationExecutionClaimedRecordV1(record) {
-	if (!hasExactRouterAbEd25519YaoRegistrationExecutionRecordKeys(record, CLAIMED_FIELDS)) return null;
-	const authority = parseRouterAbEd25519YaoRegistrationExecutionAuthorityV1(record);
-	if (authority === null) return null;
-	const progress = parseRouterAbEd25519YaoRegistrationExecutionProgressV1(record, authority.lifecycleId);
-	if (progress === null) return null;
-	return {
-		kind: "claimed",
-		lifecycleId: authority.lifecycleId,
-		admissionRequest: authority.admissionRequest,
-		admissionReceipt: authority.admissionReceipt,
-		admissionBindingJson: authority.admissionBindingJson,
-		credentialDigestSha256Hex: authority.credentialDigestSha256Hex,
 		expiresAtMs: authority.expiresAtMs,
-		requestDigestSha256Hex: progress.requestDigestSha256Hex,
-		request: progress.request,
-		claimedAtMs: progress.claimedAtMs,
-		reconcileAfterMs: progress.reconcileAfterMs
+		dispatchRoot
 	};
 }
-function parseRouterAbEd25519YaoRegistrationExecutionCompletedRecordV1(record) {
-	if (!hasExactRouterAbEd25519YaoRegistrationExecutionRecordKeys(record, COMPLETED_FIELDS)) return null;
-	const authority = parseRouterAbEd25519YaoRegistrationExecutionAuthorityV1(record);
-	if (authority === null) return null;
-	const progress = parseRouterAbEd25519YaoRegistrationExecutionProgressV1(record, authority.lifecycleId);
-	if (progress === null) return null;
-	const result = parseRouterAbEd25519YaoRegistrationActivationResultV1(record.result);
-	const consumerBinding = record.consumerBinding === null ? null : readVisibleString(record.consumerBinding, 512);
-	if (!result.ok || consumerBinding === null && record.consumerBinding !== null) return null;
-	return {
-		kind: "completed",
-		lifecycleId: authority.lifecycleId,
-		admissionRequest: authority.admissionRequest,
-		admissionReceipt: authority.admissionReceipt,
-		admissionBindingJson: authority.admissionBindingJson,
-		credentialDigestSha256Hex: authority.credentialDigestSha256Hex,
-		expiresAtMs: authority.expiresAtMs,
-		requestDigestSha256Hex: progress.requestDigestSha256Hex,
-		request: progress.request,
-		claimedAtMs: progress.claimedAtMs,
-		reconcileAfterMs: progress.reconcileAfterMs,
-		result: result.value,
-		consumerBinding
-	};
-}
-function parseRouterAbEd25519YaoRegistrationExecutionFailedRecordV1(record) {
-	if (!hasExactRouterAbEd25519YaoRegistrationExecutionRecordKeys(record, FAILED_FIELDS)) return null;
-	const authority = parseRouterAbEd25519YaoRegistrationExecutionAuthorityV1(record);
-	if (authority === null) return null;
-	const progress = parseRouterAbEd25519YaoRegistrationExecutionProgressV1(record, authority.lifecycleId);
-	if (progress === null) return null;
-	const failure = parseRouterAbEd25519YaoRegistrationExecutionFailureV1(record.failure);
-	if (failure === null) return null;
-	return {
-		kind: "failed",
-		lifecycleId: authority.lifecycleId,
-		admissionRequest: authority.admissionRequest,
-		admissionReceipt: authority.admissionReceipt,
-		admissionBindingJson: authority.admissionBindingJson,
-		credentialDigestSha256Hex: authority.credentialDigestSha256Hex,
-		expiresAtMs: authority.expiresAtMs,
-		requestDigestSha256Hex: progress.requestDigestSha256Hex,
-		request: progress.request,
-		claimedAtMs: progress.claimedAtMs,
-		reconcileAfterMs: progress.reconcileAfterMs,
-		failure
-	};
-}
-function routerAbEd25519YaoRegistrationExecutionRequestDigestV1(request) {
-	return sha256Hex(JSON.stringify(request));
+/**
+* Pins the tenant root an admitted registration dispatches to, resolved once
+* at admission. Every execute and consumption of the lifecycle sends this
+* root, so the Router's record of a known execution answers them without a
+* fresh active-root lookup.
+*/
+function pinRouterAbEd25519YaoRegistrationDispatchRootV1(registration, lifecycleId, dispatchRoot) {
+	registration.dispatchRoots.set(lifecycleId, dispatchRoot);
 }
 function routerAbEd25519YaoRegistrationAdmissionBindingJsonV1(receipt) {
 	return JSON.stringify(receipt.binding);
 }
-function parseRouterAbEd25519YaoRegistrationExecutionRecordKindV1(input) {
-	switch (input) {
-		case "ready":
-		case "claimed":
-		case "completed":
-		case "failed": return input;
-		default: return null;
-	}
-}
-function parseRouterAbEd25519YaoRegistrationExecutionAuthorityV1(input) {
-	const lifecycleId = readVisibleString(input.lifecycleId, 256);
-	const admissionRequest = parseRouterAbEd25519YaoRegistrationAdmissionRequestV1(input.admissionRequest);
-	const admissionReceipt = parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1(input.admissionReceipt);
-	const admissionBindingJson = readVisibleString(input.admissionBindingJson, 65536);
-	const credentialDigestSha256Hex = readSha256Hex(input.credentialDigestSha256Hex);
-	const expiresAtMs = readPositiveSafeInteger(input.expiresAtMs);
-	if (lifecycleId === null || !admissionRequest.ok || !admissionReceipt.ok || admissionBindingJson === null || credentialDigestSha256Hex === null || expiresAtMs === null || admissionRequest.value.scope.lifecycle_id !== lifecycleId || admissionReceipt.value.binding.lifecycle.lifecycle_id !== lifecycleId) return null;
-	return {
-		lifecycleId,
-		admissionRequest: admissionRequest.value,
-		admissionReceipt: admissionReceipt.value,
-		admissionBindingJson,
-		credentialDigestSha256Hex,
-		expiresAtMs
-	};
-}
-function parseRouterAbEd25519YaoRegistrationExecutionProgressV1(input, lifecycleId) {
-	const requestDigestSha256Hex = readSha256Hex(input.requestDigestSha256Hex);
-	const request = parseRouterAbEd25519YaoRegistrationActivationExecuteRequestV1(input.request);
-	const claimedAtMs = readPositiveSafeInteger(input.claimedAtMs);
-	const reconcileAfterMs = readPositiveSafeInteger(input.reconcileAfterMs);
-	if (requestDigestSha256Hex === null || !request.ok || claimedAtMs === null || reconcileAfterMs === null || reconcileAfterMs <= claimedAtMs || request.value.binding.lifecycle.lifecycle_id !== lifecycleId) return null;
-	return {
-		requestDigestSha256Hex,
-		request: request.value,
-		claimedAtMs,
-		reconcileAfterMs
-	};
-}
-async function sha256Hex(value) {
-	const bytes = new TextEncoder().encode(value);
-	try {
-		const digest = new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256", bytes));
-		let encoded = "";
-		for (const byte of digest) encoded += byte.toString(16).padStart(2, "0");
-		digest.fill(0);
-		return encoded;
-	} finally {
-		bytes.fill(0);
-	}
-}
-function parseRouterAbEd25519YaoRegistrationExecutionFailureV1(input) {
-	const failure = readRouterAbEd25519YaoRegistrationExecutionRecordObjectV1(input);
-	if (failure === null || !hasExactRouterAbEd25519YaoRegistrationExecutionRecordKeys(failure, FAILURE_FIELDS) || failure.ok !== false || !Number.isSafeInteger(failure.status) || typeof failure.code !== "string" || typeof failure.message !== "string") return null;
-	if (failure.status !== 400 && failure.status !== 401 && failure.status !== 403 && failure.status !== 404 && failure.status !== 408 && failure.status !== 409 && failure.status !== 429 && failure.status !== 500 && failure.status !== 502 && failure.status !== 503) return null;
-	if (!isFailureCode(failure.code)) return null;
-	return {
-		ok: false,
-		status: failure.status,
-		code: failure.code,
-		message: failure.message
-	};
-}
-function isFailureCode(input) {
-	return input === "invalid_backend_response" || input === "admission_failed" || input === "admission_in_progress" || input === "admission_uncertain" || input === "unknown_registration" || input === "binding_mismatch" || input === "execution_in_progress" || input === "execution_failed" || input === "ceremony_expired";
-}
-function readSha256Hex(input) {
-	return typeof input === "string" && /^[0-9a-f]{64}$/u.test(input) ? input : null;
-}
-function readPositiveSafeInteger(input) {
-	return typeof input === "number" && Number.isSafeInteger(input) && input > 0 ? input : null;
-}
-function requireVisibleString(input, field, maxLength) {
-	const value = readVisibleString(input, maxLength);
-	if (value === null) throw new Error(`Yao registration execution ${field} is invalid`);
-	return value;
-}
-function readVisibleString(input, maxLength) {
-	return typeof input === "string" && input.length > 0 && input.length <= maxLength && /^[\x20-\x7e]+$/u.test(input) ? input : null;
-}
-function toJsonObject(input) {
-	const value = JSON.parse(JSON.stringify(input));
-	if (!isJsonObject(value)) throw new Error("Yao registration execution record is not canonical JSON");
-	return value;
-}
-function isJsonObject(input) {
-	return isRouterAbEd25519YaoRegistrationExecutionRecordObjectV1(input) && Object.values(input).every(isJsonValue);
-}
-function isJsonValue(input) {
-	if (input === null || typeof input === "string" || typeof input === "boolean" || typeof input === "number") return typeof input !== "number" || Number.isFinite(input);
-	if (Array.isArray(input)) return input.every(isJsonValue);
-	return isJsonObject(input);
-}
-function readRouterAbEd25519YaoRegistrationExecutionRecordObjectV1(input) {
-	return isRouterAbEd25519YaoRegistrationExecutionRecordObjectV1(input) ? input : null;
-}
-function isRouterAbEd25519YaoRegistrationExecutionRecordObjectV1(input) {
-	return typeof input === "object" && input !== null && !Array.isArray(input);
+/**
+* The registration result the Router's answer gives for one admitted
+* execution, verified as the in-memory service verifies a fresh one. The
+* Gateway derives it from the Router's answer each time: at execution, and
+* when finalization consumes the answer the Router recorded.
+*/
+function routerAbEd25519YaoRegistrationResultFromRouterAnswerV1(input) {
+	const state = new InMemoryRouterAbEd25519YaoRegistrationStateV1();
+	const sessionKey = bytesToHex(input.authority.admissionReceipt.binding.session_id);
+	state.states.set(sessionKey, {
+		kind: "admitted",
+		admissionRequest: input.authority.admissionRequest,
+		admissionReceipt: input.authority.admissionReceipt
+	});
+	state.lifecycleSessions.set(input.authority.lifecycleId, sessionKey);
+	const service = new InMemoryRouterAbEd25519YaoRegistrationService(input.backend, state);
+	const prepared = service.prepareExecute(input.request);
+	if (prepared.kind !== "claimed") throw new Error("Yao registration execution could not be reconstructed from its admission");
+	return service.commitExecute({
+		request: input.request,
+		claim: prepared.claim,
+		outcome: {
+			kind: "backend_response",
+			result: input.answer
+		}
+	});
 }
-function hasExactRouterAbEd25519YaoRegistrationExecutionRecordKeys(record, expectedKeys) {
-	const actualKeys = Object.keys(record);
-	return actualKeys.length === expectedKeys.length && actualKeys.every((key) => expectedKeys.some((expectedKey) => expectedKey === key));
+/** The Gateway's execute request inside the Router request the Router recorded. */
+function routerAbEd25519YaoRegistrationExecuteRequestFromRouterRequestJsonV1(requestJson) {
+	const routerRequest = JSON.parse(requestJson);
+	const target = typeof routerRequest === "object" && routerRequest !== null && "target" in routerRequest ? routerRequest.target : null;
+	if (typeof target !== "object" || target === null) throw new Error("Router registration request has no target");
+	const { binding, deriver_a_input, deriver_b_input } = target;
+	const parsed = parseRouterAbEd25519YaoRegistrationActivationExecuteRequestV1({
+		binding,
+		deriver_a_input,
+		deriver_b_input
+	});
+	if (!parsed.ok) throw new Error("Router registration request target is invalid");
+	return parsed.value;
 }
-function assertNever(value) {
-	throw new Error(`Unhandled Yao registration execution record kind: ${String(value)}`);
+function bytesToHex(bytes) {
+	let encoded = "";
+	for (const byte of bytes) encoded += byte.toString(16).padStart(2, "0");
+	return encoded;
 }
 //#endregion
-export { ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTION_RECORD_KIND_V1, buildRouterAbEd25519YaoRegistrationExecutionReadyRecordV1, encodeRouterAbEd25519YaoRegistrationExecutionRecordV1, parseRouterAbEd25519YaoRegistrationExecutionRecordV1, routerAbEd25519YaoRegistrationAdmissionBindingJsonV1, routerAbEd25519YaoRegistrationExecutionRecordKeyV1, routerAbEd25519YaoRegistrationExecutionRequestDigestV1 };
+export { buildRouterAbEd25519YaoRegistrationExecutionAuthorityV1, pinRouterAbEd25519YaoRegistrationDispatchRootV1, routerAbEd25519YaoRegistrationExecuteRequestFromRouterRequestJsonV1, routerAbEd25519YaoRegistrationResultFromRouterAnswerV1 };
 
 //# sourceMappingURL=routerAbEd25519YaoRegistrationExecutionRecord.js.map

package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationIntentAuthorization.js

@@ -1,7 +1,9 @@
-import { computeAddSignerNearEd25519SigningKeyId, findRegistrationSignerPlanNearEd25519Branch, registrationNearEd25519BranchKey, registrationSignerPlanFromSelection } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { deriveRouterAbEd25519YaoStableContextBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { deriveRouterAbEd25519YaoStableContextBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519YaoDigests.js";
 import { deriveSigningRootId } from "../../../../shared-ts/src/threshold/signingRootScope.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
+import { computeAddSignerNearEd25519SigningKeyId } from "../../../../shared-ts/src/utils/registrationIds.js";
+import { findRegistrationSignerPlanNearEd25519Branch, registrationNearEd25519BranchKey, registrationSignerPlanFromSelection } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
 //#region src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationIntentAuthorization.ts
 const SHA256_BYTES = 32;
 const STRICT_BEARER_VALUE = /^Bearer ([A-Za-z0-9._~-]{1,8192})$/;
@@ -216,21 +218,9 @@ var InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter = class {
 	}
 	async bindVerifiedIntent(verified) {
 		const credential = activationIntentCredential(verified);
-		if (!VERIFIED_INTENT_CREDENTIAL.test(credential)) return {
-			ok: false,
-			code: "invalid_registration_intent",
-			message: "registration intent grant is not a canonical Bearer credential"
-		};
-		if (!Number.isSafeInteger(verified.expiresAtMs) || verified.expiresAtMs <= Date.now()) return {
-			ok: false,
-			code: "invalid_registration_intent",
-			message: "registration intent authority is expired"
-		};
-		if (!await activationIntentMatchesAdmission(verified)) return {
-			ok: false,
-			code: "invalid_registration_intent",
-			message: "registration intent does not match the Ed25519 Yao admission subject"
-		};
+		if (!VERIFIED_INTENT_CREDENTIAL.test(credential)) return failure("invalid_registration_intent", "registration intent grant is not a canonical Bearer credential");
+		if (!Number.isSafeInteger(verified.expiresAtMs) || verified.expiresAtMs <= Date.now()) return failure("invalid_registration_intent", "registration intent authority is expired");
+		if (!await activationIntentMatchesAdmission(verified)) return failure("invalid_registration_intent", "registration intent does not match the Ed25519 Yao admission subject");
 		const credentialDigest = await credentialDigestSha256(credential);
 		const purpose = activationIntentPurpose(verified);
 		const copiedAdmissionRequest = copyAdmissionRequest(verified.admissionRequest);
@@ -244,11 +234,7 @@ var InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter = class {
 			return exactRetry ? {
 				ok: true,
 				admissionRequest: copyAdmissionRequest(existing.admissionRequest)
-			} : {
-				ok: false,
-				code: "registration_intent_conflict",
-				message: "registration intent credential or lifecycle is already bound"
-			};
+			} : failure("registration_intent_conflict", "registration intent credential or lifecycle is already bound");
 		}
 		this.authorities.push({
 			kind: "available",
@@ -265,11 +251,7 @@ var InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter = class {
 	}
 	async bindVerifiedContinuation(verified) {
 		const existing = findAuthorityByLifecycleId(this.authorities, verified.admissionRequest.scope.lifecycle_id);
-		if (!existing || existing.authority.purpose !== "wallet_registration" || existing.authority.admissionFingerprint !== canonicalAdmissionRequest(verified.admissionRequest) || !Number.isSafeInteger(verified.expiresAtMs) || verified.expiresAtMs <= Date.now() || !verified.credential.startsWith("wst_") || !VERIFIED_INTENT_CREDENTIAL.test(verified.credential)) return {
-			ok: false,
-			code: "registration_intent_conflict",
-			message: "NEAR continuation does not match its original authorization"
-		};
+		if (!existing || existing.authority.purpose !== "wallet_registration" || existing.authority.admissionFingerprint !== canonicalAdmissionRequest(verified.admissionRequest) || !Number.isSafeInteger(verified.expiresAtMs) || verified.expiresAtMs <= Date.now() || !verified.credential.startsWith("wst_") || !VERIFIED_INTENT_CREDENTIAL.test(verified.credential)) return failure("registration_intent_conflict", "NEAR continuation does not match its original authorization");
 		this.authorities[existing.index] = {
 			kind: existing.authority.kind,
 			purpose: existing.authority.purpose,