@seams/wallet-server 0.6.2 → 0.7.3

package/dist/esm/router/domains/walletUnlock/walletUnlockRouteHandlers.js

@@ -1,15 +1,14 @@
 import { parseEmailOtpChallengeId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../shared-ts/src/utils/domainIds.js";
 import { parseAuthFactorId, parsePrincipalId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
-import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { alphabetizeStringify, sha256BytesUtf8 } from "../../../shared-ts/src/utils/digests.js";
-import "../../../shared-ts/src/utils/encoders.js";
+import { alphabetizeStringify } from "../../../shared-ts/src/utils/digests.js";
+import { sha256Utf8DigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1 } from "../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { walletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseSessionOrigin, parseVerifiedOwnerProofId, projectActiveWalletSession } from "../../../authorization/domain.js";
 import { buildVerifiedWalletSessionEmailOtpFactorResult, buildVerifiedWalletSessionPasskeyFactorResult } from "../../../authorization/factorEvidence.js";
-import { EMAIL_OTP_CHANNEL } from "../../../shared-ts/src/utils/emailOtpDomain.js";
+import { failure } from "../../../shared-ts/src/utils/failure.js";
 import { emailOtpFailureWebhookEventDescriptors, emailOtpLoggedInWebhookEventDescriptor } from "../emailOtp/emailOtpSessionRouteHelpers.js";
+import { EMAIL_OTP_CHANNEL } from "../../../shared-ts/src/utils/emailOtpDomain.js";
 import { thresholdEd25519StatusCode } from "../../../threshold/statusCodes.js";
 import { parseWalletUnlockBackend } from "../emailOtp/emailOtpRequestValidation.js";
 //#region src/router/domains/walletUnlock/walletUnlockRouteHandlers.ts
@@ -60,11 +59,7 @@ async function refreshEmailOtpWalletUnlockSessionState(input) {
 			ok: false,
 			response: {
 				status: 500,
-				body: {
-					ok: false,
-					code: "internal",
-					message: error instanceof Error ? error.message : "Email OTP authority refresh resolution failed"
-				}
+				body: failure("internal", error instanceof Error ? error.message : "Email OTP authority refresh resolution failed")
 			}
 		};
 	}
@@ -72,11 +67,7 @@ async function refreshEmailOtpWalletUnlockSessionState(input) {
 		ok: false,
 		response: {
 			status: authorityResolution.code === "internal" ? 500 : 403,
-			body: {
-				ok: false,
-				code: authorityResolution.code,
-				message: authorityResolution.message
-			}
+			body: failure(authorityResolution.code, authorityResolution.message)
 		}
 	};
 	try {
@@ -93,30 +84,23 @@ async function refreshEmailOtpWalletUnlockSessionState(input) {
 			ok: false,
 			response: {
 				status: 500,
-				body: {
-					ok: false,
-					code: "internal",
-					message: error instanceof Error ? error.message : "Email OTP Wallet Session authority projection refresh failed"
-				}
+				body: failure("internal", error instanceof Error ? error.message : "Email OTP Wallet Session authority projection refresh failed")
 			}
 		};
 	}
 }
-function emailOtpCustodyFailureResponse(lookup) {
+/** A factor's custody lookup that found no active envelope: 503, 404 or 409 by what it found. */
+function walletUnlockCustodyUnavailableResponse(lookup, factor) {
 	return {
 		ok: false,
 		response: {
 			status: lookup.kind === "manifest_unavailable" ? 503 : lookup.kind === "conflict" ? 409 : lookup.kind === "missing" ? 404 : 409,
-			body: {
-				ok: false,
-				code: lookup.kind === "manifest_unavailable" ? "custody_manifest_unavailable" : "custody_envelope_unavailable",
-				message: "Email OTP wallet custody is unavailable"
-			}
+			body: failure(lookup.kind === "manifest_unavailable" ? "custody_manifest_unavailable" : "custody_envelope_unavailable", `${factor} wallet custody is unavailable`)
 		}
 	};
 }
 function projectEmailOtpCustody(verifiedUnlock, lookup) {
-	if (lookup.kind !== "active") return emailOtpCustodyFailureResponse(lookup);
+	if (lookup.kind !== "active") return walletUnlockCustodyUnavailableResponse(lookup, "Email OTP");
 	const envelope = lookup.envelope;
 	const manifest = lookup.keyManifest;
 	const factor = envelope.factor;
@@ -126,11 +110,7 @@ function projectEmailOtpCustody(verifiedUnlock, lookup) {
 		ok: false,
 		response: {
 			status: 500,
-			body: {
-				ok: false,
-				code: "custody_binding_mismatch",
-				message: "Email OTP wallet custody binding is invalid"
-			}
+			body: failure("custody_binding_mismatch", "Email OTP wallet custody binding is invalid")
 		}
 	};
 	return {
@@ -152,17 +132,7 @@ function projectEmailOtpCustody(verifiedUnlock, lookup) {
 }
 function projectPasskeyCustody(verifiedUnlock, resolution) {
 	const lookup = resolution.custody;
-	if (lookup.kind !== "active") return {
-		ok: false,
-		response: {
-			status: lookup.kind === "manifest_unavailable" ? 503 : lookup.kind === "conflict" ? 409 : lookup.kind === "missing" ? 404 : 409,
-			body: {
-				ok: false,
-				code: lookup.kind === "manifest_unavailable" ? "custody_manifest_unavailable" : "custody_envelope_unavailable",
-				message: "Passkey wallet custody is unavailable"
-			}
-		}
-	};
+	if (lookup.kind !== "active") return walletUnlockCustodyUnavailableResponse(lookup, "Passkey");
 	const envelope = lookup.envelope;
 	const factor = envelope.factor;
 	const manifest = lookup.keyManifest;
@@ -170,11 +140,7 @@ function projectPasskeyCustody(verifiedUnlock, resolution) {
 		ok: false,
 		response: {
 			status: 500,
-			body: {
-				ok: false,
-				code: "custody_binding_mismatch",
-				message: "Passkey wallet custody binding is invalid"
-			}
+			body: failure("custody_binding_mismatch", "Passkey wallet custody binding is invalid")
 		}
 	};
 	let ed25519 = { kind: "absent" };
@@ -186,11 +152,7 @@ function projectPasskeyCustody(verifiedUnlock, resolution) {
 			ok: false,
 			response: {
 				status: 500,
-				body: {
-					ok: false,
-					code: "custody_binding_mismatch",
-					message: "Passkey Ed25519 custody binding is invalid"
-				}
+				body: failure("custody_binding_mismatch", "Passkey Ed25519 custody binding is invalid")
 			}
 		};
 		ed25519 = {
@@ -221,11 +183,7 @@ async function provisionFirstEcdsaWalletSession(input) {
 				ok: false,
 				response: {
 					status: 403,
-					body: {
-						ok: false,
-						code: "scope_mismatch",
-						message: "Wallet unlock proof does not match the requested ECDSA wallet"
-					}
+					body: failure("scope_mismatch", "Wallet unlock proof does not match the requested ECDSA wallet")
 				}
 			};
 			const provisioned = await input.context.provisionWalletSession(input.authorization);
@@ -233,11 +191,7 @@ async function provisionFirstEcdsaWalletSession(input) {
 				ok: false,
 				response: {
 					status: provisioned.status,
-					body: {
-						ok: false,
-						code: provisioned.code,
-						message: provisioned.message
-					}
+					body: failure(provisioned.code, provisioned.message)
 				}
 			};
 			return {
@@ -249,16 +203,23 @@ async function provisionFirstEcdsaWalletSession(input) {
 		}
 	}
 }
+/** The Ed25519 session joins the unlock's Wallet Session when there is one, else starts its own. */
+function walletUnlockEd25519SessionIdentity(linkedWalletSession) {
+	return linkedWalletSession ? {
+		kind: "reuse_wallet_session_v2",
+		authorizationId: linkedWalletSession.session.authorizationId,
+		walletSessionId: linkedWalletSession.session.walletSessionId,
+		quotaId: linkedWalletSession.session.quotaId,
+		expiresAtMs: linkedWalletSession.session.expiresAtMs,
+		remainingUses: linkedWalletSession.quota.remainingUses
+	} : { kind: "new_wallet_session" };
+}
 function walletUnlockScopeMismatchResponse() {
 	return {
 		ok: false,
 		response: {
 			status: 403,
-			body: {
-				ok: false,
-				code: "scope_mismatch",
-				message: "Email OTP unlock proof does not match the requested Ed25519 wallet"
-			}
+			body: failure("scope_mismatch", "Email OTP unlock proof does not match the requested Ed25519 wallet")
 		}
 	};
 }
@@ -287,14 +248,7 @@ async function provisionEmailOtpEd25519YaoCapability(input) {
 		remainingUses: capabilities.remainingUses,
 		verifiedChallengeId: request.challengeId,
 		authority: input.authorization.authority,
-		walletSessionIdentity: input.linkedWalletSession ? {
-			kind: "reuse_wallet_session_v2",
-			authorizationId: input.linkedWalletSession.session.authorizationId,
-			walletSessionId: input.linkedWalletSession.session.walletSessionId,
-			quotaId: input.linkedWalletSession.session.quotaId,
-			expiresAtMs: input.linkedWalletSession.session.expiresAtMs,
-			remainingUses: input.linkedWalletSession.quota.remainingUses
-		} : { kind: "new_wallet_session" }
+		walletSessionIdentity: walletUnlockEd25519SessionIdentity(input.linkedWalletSession)
 	}, input.authorization.proof);
 	if (!provisioned.ok) return {
 		ok: false,
@@ -329,11 +283,7 @@ function planWalletUnlockAuthorityEcdsaSession(input) {
 function walletUnlockDeviceLinkEcdsaSessionRejection() {
 	return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "ecdsaSessionPolicy is not supported for device-linked wallet unlock"
-		}
+		body: failure("invalid_body", "ecdsaSessionPolicy is not supported for device-linked wallet unlock")
 	};
 }
 function planWalletUnlockPasskeySession(input) {
@@ -376,11 +326,7 @@ async function provisionPasskeyEd25519YaoSession(input) {
 		ok: false,
 		response: {
 			status: 409,
-			body: {
-				ok: false,
-				code: "capability_unavailable",
-				message: "Requested Ed25519 Wallet Session is unavailable"
-			}
+			body: failure("capability_unavailable", "Requested Ed25519 Wallet Session is unavailable")
 		}
 	};
 	const provisioned = await input.context.provisionWalletSession({
@@ -390,14 +336,7 @@ async function provisionPasskeyEd25519YaoSession(input) {
 		verifiedChallengeId: input.challengeId,
 		authority: input.authorization.authority,
 		proof: input.authorization.proof,
-		walletSessionIdentity: input.linkedWalletSession ? {
-			kind: "reuse_wallet_session_v2",
-			authorizationId: input.linkedWalletSession.session.authorizationId,
-			walletSessionId: input.linkedWalletSession.session.walletSessionId,
-			quotaId: input.linkedWalletSession.session.quotaId,
-			expiresAtMs: input.linkedWalletSession.session.expiresAtMs,
-			remainingUses: input.linkedWalletSession.quota.remainingUses
-		} : { kind: "new_wallet_session" }
+		walletSessionIdentity: walletUnlockEd25519SessionIdentity(input.linkedWalletSession)
 	});
 	if (!provisioned.ok) return {
 		ok: false,
@@ -441,11 +380,22 @@ function walletUnlockEcdsaOperationCredential(input) {
 function walletUnlockEcdsaCredentialUnavailableResponse() {
 	return {
 		status: 409,
-		body: {
-			ok: false,
-			code: "capability_unavailable",
-			message: "ECDSA activation requires the exact Wallet Session operation credential"
-		}
+		body: failure("capability_unavailable", "ECDSA activation requires the exact Wallet Session operation credential")
+	};
+}
+/** The unlock response's Wallet Session, when the unlock holds one. */
+function walletUnlockSessionFields(state) {
+	return state.kind === "active" ? {
+		walletSession: projectActiveWalletSession(state.authorization),
+		operationCredential: state.operationCredential
+	} : {};
+}
+/** The unlock response's first ECDSA session, its receipt and its custody, when provisioned. */
+function walletUnlockEcdsaSessionFields(ecdsaSession) {
+	return {
+		...ecdsaSession.activation ? { ecdsaSession: ecdsaSession.activation } : {},
+		...ecdsaSession.activationReceipt ? { ecdsaActivationReceipt: ecdsaSession.activationReceipt } : {},
+		...ecdsaSession.continuity ? { ecdsaCustody: ecdsaSession.continuity } : {}
 	};
 }
 function walletUnlockAlreadyCommittedRouteResponse(input) {
@@ -461,34 +411,38 @@ function walletUnlockAlreadyCommittedRouteResponse(input) {
 		}
 	};
 }
-async function handleWalletUnlockChallengeRoute(input) {
-	if (!input.body || typeof input.body !== "object" || Array.isArray(input.body)) return {
-		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "Request body is required"
+function parseWalletUnlockRouteBody(body) {
+	if (!body || typeof body !== "object" || Array.isArray(body)) return {
+		ok: false,
+		response: {
+			status: 400,
+			body: failure("invalid_body", "Request body is required")
 		}
 	};
-	const body = input.body;
-	const unlockBackend = parseWalletUnlockBackend(body.unlockBackend);
+	const record = body;
+	const unlockBackend = parseWalletUnlockBackend(record.unlockBackend);
 	if (!unlockBackend) return {
-		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "unlockBackend is required"
+		ok: false,
+		response: {
+			status: 400,
+			body: failure("invalid_body", "unlockBackend is required")
 		}
 	};
+	return {
+		ok: true,
+		body: record,
+		unlockBackend
+	};
+}
+async function handleWalletUnlockChallengeRoute(input) {
+	const parsed = parseWalletUnlockRouteBody(input.body);
+	if (!parsed.ok) return parsed.response;
+	const { body, unlockBackend } = parsed;
 	if (unlockBackend === "email_otp") {
 		const walletAuthMethodId = parseRequiredWalletAuthMethodId(body.walletAuthMethodId);
 		if (!walletAuthMethodId.ok) return {
 			status: 400,
-			body: {
-				ok: false,
-				code: "invalid_body",
-				message: walletAuthMethodId.message
-			}
+			body: failure("invalid_body", walletAuthMethodId.message)
 		};
 	}
 	const result = unlockBackend === "passkey" ? await input.service.createWebAuthnLoginOptions({
@@ -574,7 +528,7 @@ function parseRequiredWalletAuthMethodId(value) {
 	};
 }
 async function digestWalletUnlockValue(value) {
-	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(value))));
+	return sha256Utf8DigestB64u(alphabetizeStringify(value));
 }
 function passkeyWalletAuthAuthorityForMethod(input) {
 	return {
@@ -665,41 +619,18 @@ async function walletUnlockProofForEmailOtp(input) {
 	};
 }
 async function handleWalletUnlockVerifyRoute(input) {
-	if (!input.body || typeof input.body !== "object" || Array.isArray(input.body)) return {
-		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "Request body is required"
-		}
-	};
-	const body = input.body;
-	const unlockBackend = parseWalletUnlockBackend(body.unlockBackend);
-	if (!unlockBackend) return {
-		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "unlockBackend is required"
-		}
-	};
+	const parsed = parseWalletUnlockRouteBody(input.body);
+	if (!parsed.ok) return parsed.response;
+	const { body, unlockBackend } = parsed;
 	const challengeId = String(body.challengeId || "").trim();
 	if (!challengeId) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "challengeId is required"
-		}
+		body: failure("invalid_body", "challengeId is required")
 	};
 	if (unlockBackend === "passkey") {
 		if (input.capabilityContext.kind !== "passkey_unlock") return {
 			status: 400,
-			body: {
-				ok: false,
-				code: "invalid_body",
-				message: "Passkey unlock context is invalid"
-			}
+			body: failure("invalid_body", "Passkey unlock context is invalid")
 		};
 		let ed25519SessionRequest;
 		try {
@@ -707,11 +638,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 		} catch (error) {
 			return {
 				status: 400,
-				body: {
-					ok: false,
-					code: "invalid_body",
-					message: error instanceof Error ? error.message : "Ed25519 session request is invalid"
-				}
+				body: failure("invalid_body", error instanceof Error ? error.message : "Ed25519 session request is invalid")
 			};
 		}
 		const result = await verifyPasskeyWalletUnlock({
@@ -730,11 +657,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 		const userId = String(result.userId || "").trim();
 		if (!userId) return {
 			status: 500,
-			body: {
-				ok: false,
-				code: "internal",
-				message: "Verified passkey user is missing"
-			}
+			body: failure("internal", "Verified passkey user is missing")
 		};
 		const walletId = parseWalletId(userId);
 		const walletAuthMethodId = parseWalletAuthMethodId(result.walletAuthMethodId);
@@ -743,11 +666,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 		const credentialIdB64u = parseWebAuthnCredentialIdB64u(result.credentialIdB64u);
 		if (!walletId.ok || !walletAuthMethodId.ok || !walletAuthorityId.ok || !rpId.ok || !credentialIdB64u.ok) return {
 			status: 500,
-			body: {
-				ok: false,
-				code: "internal",
-				message: "Verified passkey identity is invalid"
-			}
+			body: failure("internal", "Verified passkey identity is invalid")
 		};
 		let authorization;
 		try {
@@ -765,32 +684,25 @@ async function handleWalletUnlockVerifyRoute(input) {
 		} catch (error) {
 			return {
 				status: 403,
-				body: {
-					ok: false,
-					code: "owner_proof_rejected",
-					message: error instanceof Error ? error.message : "Passkey owner proof is invalid"
-				}
+				body: failure("owner_proof_rejected", error instanceof Error ? error.message : "Passkey owner proof is invalid")
 			};
 		}
+		const resolvePasskeyAuthority = () => input.service.resolveActivePasskeyAuthorityForUnlock({
+			walletId: walletId.value,
+			walletAuthMethodId: walletAuthMethodId.value,
+			walletAuthorityId: walletAuthorityId.value,
+			rpId: rpId.value,
+			credentialIdB64u: credentialIdB64u.value
+		});
 		let walletSessionState = { kind: "absent" };
 		let passkeyCustodyRequired = false;
 		let authorityResolution;
 		try {
-			authorityResolution = await input.service.resolveActivePasskeyAuthorityForUnlock({
-				walletId: walletId.value,
-				walletAuthMethodId: walletAuthMethodId.value,
-				walletAuthorityId: walletAuthorityId.value,
-				rpId: rpId.value,
-				credentialIdB64u: credentialIdB64u.value
-			});
+			authorityResolution = await resolvePasskeyAuthority();
 		} catch (error) {
 			return {
 				status: 500,
-				body: {
-					ok: false,
-					code: "internal",
-					message: error instanceof Error ? error.message : "Passkey authority resolution failed"
-				}
+				body: failure("internal", error instanceof Error ? error.message : "Passkey authority resolution failed")
 			};
 		}
 		if (authorityResolution.kind === "active_authority") {
@@ -807,11 +719,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 		switch (sessionPlan.kind) {
 			case "rejected": return {
 				status: walletUnlockIssuanceRejectionStatus(sessionPlan.authorityResolution),
-				body: {
-					ok: false,
-					code: sessionPlan.authorityResolution.code,
-					message: sessionPlan.authorityResolution.message
-				}
+				body: failure(sessionPlan.authorityResolution.code, sessionPlan.authorityResolution.message)
 			};
 			case "wallet_registration":
 				passkeyCustodyRequired = true;
@@ -833,11 +741,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 				} catch (error) {
 					return {
 						status: 500,
-						body: {
-							ok: false,
-							code: "internal",
-							message: error instanceof Error ? error.message : "Passkey Wallet Session issuance failed"
-						}
+						body: failure("internal", error instanceof Error ? error.message : "Passkey Wallet Session issuance failed")
 					};
 				}
 				switch (sessionResolution.kind) {
@@ -858,11 +762,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 						break;
 					case "rejected": return {
 						status: walletUnlockIssuanceRejectionStatus(sessionResolution),
-						body: {
-							ok: false,
-							code: sessionResolution.code,
-							message: sessionResolution.message
-						}
+						body: failure(sessionResolution.code, sessionResolution.message)
 					};
 				}
 				break;
@@ -881,11 +781,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 		} catch (error) {
 			return {
 				status: 503,
-				body: {
-					ok: false,
-					code: "custody_unavailable",
-					message: error instanceof Error ? error.message : "Passkey wallet custody is unavailable"
-				}
+				body: failure("custody_unavailable", error instanceof Error ? error.message : "Passkey wallet custody is unavailable")
 			};
 		}
 		const ed25519Session = await provisionPasskeyEd25519YaoSession({
@@ -923,30 +819,16 @@ async function handleWalletUnlockVerifyRoute(input) {
 		if (walletSessionState.kind === "active") {
 			let refreshedAuthority;
 			try {
-				refreshedAuthority = await input.service.resolveActivePasskeyAuthorityForUnlock({
-					walletId: walletId.value,
-					walletAuthMethodId: walletAuthMethodId.value,
-					walletAuthorityId: walletAuthorityId.value,
-					rpId: rpId.value,
-					credentialIdB64u: credentialIdB64u.value
-				});
+				refreshedAuthority = await resolvePasskeyAuthority();
 			} catch (error) {
 				return {
 					status: 500,
-					body: {
-						ok: false,
-						code: "internal",
-						message: error instanceof Error ? error.message : "Passkey authority refresh resolution failed"
-					}
+					body: failure("internal", error instanceof Error ? error.message : "Passkey authority refresh resolution failed")
 				};
 			}
 			if (refreshedAuthority.kind === "rejected") return {
 				status: walletUnlockIssuanceRejectionStatus(refreshedAuthority),
-				body: {
-					ok: false,
-					code: refreshedAuthority.code,
-					message: refreshedAuthority.message
-				}
+				body: failure(refreshedAuthority.code, refreshedAuthority.message)
 			};
 			try {
 				walletSessionState = await refreshWalletUnlockSessionState({
@@ -957,11 +839,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 			} catch (error) {
 				return {
 					status: 500,
-					body: {
-						ok: false,
-						code: "internal",
-						message: error instanceof Error ? error.message : "Passkey Wallet Session authority projection refresh failed"
-					}
+					body: failure("internal", error instanceof Error ? error.message : "Passkey Wallet Session authority projection refresh failed")
 				};
 			}
 		}
@@ -982,33 +860,20 @@ async function handleWalletUnlockVerifyRoute(input) {
 				unlockBackend,
 				userId,
 				...passkeyCustody ? { walletCustody: passkeyCustody } : {},
-				...walletSessionState.kind === "active" ? {
-					walletSession: projectActiveWalletSession(walletSessionState.authorization),
-					operationCredential: walletSessionState.operationCredential
-				} : {},
+				...walletUnlockSessionFields(walletSessionState),
 				ed25519Session: projectPasskeyEd25519WalletSession(ed25519Session.session),
-				...ecdsaSession.activation ? { ecdsaSession: ecdsaSession.activation } : {},
-				...ecdsaSession.activationReceipt ? { ecdsaActivationReceipt: ecdsaSession.activationReceipt } : {},
-				...ecdsaSession.continuity ? { ecdsaCustody: ecdsaSession.continuity } : {}
+				...walletUnlockEcdsaSessionFields(ecdsaSession)
 			}
 		};
 	}
 	if (input.capabilityContext.kind === "passkey_unlock") return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "Email OTP unlock context is invalid"
-		}
+		body: failure("invalid_body", "Email OTP unlock context is invalid")
 	};
 	const requestedWalletAuthMethodId = parseRequiredWalletAuthMethodId(body.walletAuthMethodId);
 	if (!requestedWalletAuthMethodId.ok) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: requestedWalletAuthMethodId.message
-		}
+		body: failure("invalid_body", requestedWalletAuthMethodId.message)
 	};
 	const result = await input.service.verifyEmailOtpUnlockProof({
 		walletId: body.walletId,
@@ -1035,11 +900,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 	const walletId = parseWalletId(result.walletId);
 	if (!walletId.ok) return {
 		status: 500,
-		body: {
-			ok: false,
-			code: "internal",
-			message: "Verified Email OTP wallet identity is invalid"
-		}
+		body: failure("internal", "Verified Email OTP wallet identity is invalid")
 	};
 	let authorityResolution;
 	try {
@@ -1052,20 +913,12 @@ async function handleWalletUnlockVerifyRoute(input) {
 	} catch (error) {
 		return {
 			status: 500,
-			body: {
-				ok: false,
-				code: "internal",
-				message: error instanceof Error ? error.message : "Email OTP authority resolution failed"
-			}
+			body: failure("internal", error instanceof Error ? error.message : "Email OTP authority resolution failed")
 		};
 	}
 	if (authorityResolution.kind === "rejected") return {
 		status: authorityResolution.code === "internal" ? 500 : 403,
-		body: {
-			ok: false,
-			code: authorityResolution.code,
-			message: authorityResolution.message
-		}
+		body: failure(authorityResolution.code, authorityResolution.message)
 	};
 	const exactEmailOtpAuthority = authorityResolution;
 	if (planWalletUnlockAuthorityEcdsaSession({
@@ -1099,11 +952,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 	} catch (error) {
 		return {
 			status: 403,
-			body: {
-				ok: false,
-				code: "owner_proof_rejected",
-				message: error instanceof Error ? error.message : "Email OTP owner proof is invalid"
-			}
+			body: failure("owner_proof_rejected", error instanceof Error ? error.message : "Email OTP owner proof is invalid")
 		};
 	}
 	let walletSessionState = { kind: "absent" };
@@ -1111,11 +960,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 		const walletId = parseWalletId(result.walletId);
 		if (!walletId.ok) return {
 			status: 500,
-			body: {
-				ok: false,
-				code: "internal",
-				message: "Verified Email OTP wallet identity is invalid"
-			}
+			body: failure("internal", "Verified Email OTP wallet identity is invalid")
 		};
 		let sessionResolution;
 		try {
@@ -1130,11 +975,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 		} catch (error) {
 			return {
 				status: 500,
-				body: {
-					ok: false,
-					code: "internal",
-					message: error instanceof Error ? error.message : "Email OTP Wallet Session issuance failed"
-				}
+				body: failure("internal", error instanceof Error ? error.message : "Email OTP Wallet Session issuance failed")
 			};
 		}
 		switch (sessionResolution.kind) {
@@ -1152,22 +993,15 @@ async function handleWalletUnlockVerifyRoute(input) {
 			case "wallet_registration": break;
 			case "rejected": return {
 				status: walletUnlockIssuanceRejectionStatus(sessionResolution),
-				body: {
-					ok: false,
-					code: sessionResolution.code,
-					message: sessionResolution.message
-				}
+				body: failure(sessionResolution.code, sessionResolution.message)
 			};
 		}
 	}
-	if (input.capabilityContext.kind === "email_otp" && (requestedCapabilities.kind === "none" || requestedCapabilities.kind === "wallet_session")) {
+	const completeEmailOtpUnlock = async (ecdsaAuthorization, ed25519YaoCapability) => {
 		const ecdsaSession = await provisionFirstEcdsaWalletSession({
 			context: input.ecdsaSession,
 			verifiedWalletId: result.walletId,
-			authorization: {
-				kind: "verified_wallet_unlock",
-				proof: authorization.proof
-			}
+			authorization: ecdsaAuthorization
 		});
 		if (!ecdsaSession.ok) return ecdsaSession.response;
 		const refreshedSession = await refreshEmailOtpWalletUnlockSessionState({
@@ -1197,23 +1031,19 @@ async function handleWalletUnlockVerifyRoute(input) {
 				userId: result.userId,
 				...verifiedAuthorityProjection ? { verifiedAuthorityProjection } : {},
 				...emailOtpCustody ? { walletCustody: emailOtpCustody.projection } : {},
-				...walletSessionState.kind === "active" ? {
-					walletSession: projectActiveWalletSession(walletSessionState.authorization),
-					operationCredential: walletSessionState.operationCredential
-				} : {},
-				...ecdsaSession.activation ? { ecdsaSession: ecdsaSession.activation } : {},
-				...ecdsaSession.activationReceipt ? { ecdsaActivationReceipt: ecdsaSession.activationReceipt } : {},
-				...ecdsaSession.continuity ? { ecdsaCustody: ecdsaSession.continuity } : {}
+				...ed25519YaoCapability ? { ed25519YaoCapability } : {},
+				...walletUnlockSessionFields(walletSessionState),
+				...walletUnlockEcdsaSessionFields(ecdsaSession)
 			}
 		};
-	}
+	};
+	if (input.capabilityContext.kind === "email_otp" && (requestedCapabilities.kind === "none" || requestedCapabilities.kind === "wallet_session")) return completeEmailOtpUnlock({
+		kind: "verified_wallet_unlock",
+		proof: authorization.proof
+	});
 	if (!isWalletUnlockEd25519YaoRequestedContext(input.capabilityContext)) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "Email OTP capability context is invalid"
-		}
+		body: failure("invalid_body", "Email OTP capability context is invalid")
 	};
 	const capabilityResult = await provisionEmailOtpEd25519YaoCapability({
 		context: input.capabilityContext,
@@ -1227,53 +1057,11 @@ async function handleWalletUnlockVerifyRoute(input) {
 		activeOperationCredential: walletUnlockSessionOperationCredential(walletSessionState)
 	});
 	if (!ed25519OperationCredential) return walletUnlockEcdsaCredentialUnavailableResponse();
-	const ecdsaSession = await provisionFirstEcdsaWalletSession({
-		context: input.ecdsaSession,
-		verifiedWalletId: result.walletId,
-		authorization: {
-			kind: "wallet_session_operation_credential_v1",
-			operationCredential: ed25519OperationCredential,
-			proof: authorization.proof
-		}
-	});
-	if (!ecdsaSession.ok) return ecdsaSession.response;
-	const refreshedSession = await refreshEmailOtpWalletUnlockSessionState({
-		service: input.service,
-		state: walletSessionState,
-		walletId: walletId.value,
-		orgId: result.orgId,
-		walletAuthMethodId: requestedWalletAuthMethodId.value,
-		providerUserId: result.providerUserId
-	});
-	if (!refreshedSession.ok) return refreshedSession.response;
-	walletSessionState = refreshedSession.state;
-	await emitSuccessfulWalletUnlock({
-		unlockBackend,
-		challengeId,
-		userId: result.userId,
-		walletId: result.walletId,
-		emitRouterApiWebhook: input.emitRouterApiWebhook,
-		emitEmailOtpWebhook: input.emitEmailOtpWebhook
-	});
-	return {
-		status: 200,
-		body: {
-			ok: true,
-			unlocked: true,
-			unlockBackend,
-			userId: result.userId,
-			...verifiedAuthorityProjection ? { verifiedAuthorityProjection } : {},
-			...emailOtpCustody ? { walletCustody: emailOtpCustody.projection } : {},
-			ed25519YaoCapability: capabilityResult.value,
-			...walletSessionState.kind === "active" ? {
-				walletSession: projectActiveWalletSession(walletSessionState.authorization),
-				operationCredential: walletSessionState.operationCredential
-			} : {},
-			...ecdsaSession.activation ? { ecdsaSession: ecdsaSession.activation } : {},
-			...ecdsaSession.activationReceipt ? { ecdsaActivationReceipt: ecdsaSession.activationReceipt } : {},
-			...ecdsaSession.continuity ? { ecdsaCustody: ecdsaSession.continuity } : {}
-		}
-	};
+	return completeEmailOtpUnlock({
+		kind: "wallet_session_operation_credential_v1",
+		operationCredential: ed25519OperationCredential,
+		proof: authorization.proof
+	}, capabilityResult.value);
 }
 function walletUnlockIssuanceRejectionStatus(rejection) {
 	switch (rejection.code) {
@@ -1287,6 +1075,6 @@ function walletUnlockIssuanceRejectionStatus(rejection) {
 	}
 }
 //#endregion
-export { handleWalletUnlockChallengeRoute, handleWalletUnlockVerifyRoute, walletUnlockAlreadyCommittedRouteResponse };
+export { handleWalletUnlockChallengeRoute, handleWalletUnlockVerifyRoute };
 
 //# sourceMappingURL=walletUnlockRouteHandlers.js.map