@seams/wallet-server 0.6.2 → 0.7.3

package/dist/esm/threshold/session/signingSessionSeal/crypto/cipher.js

@@ -1,33 +1,18 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
 import { SIGNING_SESSION_SEAL_ALG, SIGNING_SESSION_SEAL_GROUP_ID, encodeSigningSessionHkdfTuple } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
-import { parseSigningSessionSealKeyVersion } from "../../../../core/keyMaterialBrands.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
+import { parseSigningSessionSealKeyVersion } from "../../../../shared-ts/src/threshold/keyMaterialBrands.js";
 import { addSigningSessionSealLock, deriveSigningSessionSealLockKeyHandle, destroySigningSessionSealLockKeyHandle, removeSigningSessionSealLock } from "./shamir3PassWasm.js";
 //#region src/threshold/session/signingSessionSeal/crypto/cipher.ts
 function toErrorResult(error) {
-	if (error && typeof error === "object" && !Array.isArray(error) && error.code) return {
-		ok: false,
-		code: String(error.code || "").trim() || "internal",
-		message: String(error.message || "").trim() || "Signing-session seal cipher failed"
-	};
-	return {
-		ok: false,
-		code: "internal",
-		message: error instanceof Error ? error.message : String(error || "Signing-session seal cipher failed")
-	};
+	if (error && typeof error === "object" && !Array.isArray(error) && error.code) return failure(String(error.code || "").trim() || "internal", String(error.message || "").trim() || "Signing-session seal cipher failed");
+	return failure("internal", error instanceof Error ? error.message : String(error || "Signing-session seal cipher failed"));
 }
 function normalizeResult(result) {
-	if (!result.ok) return {
-		ok: false,
-		code: String(result.code || "internal").trim() || "internal",
-		message: String(result.message || "Signing-session seal cipher failed").trim() || "Signing-session seal cipher failed"
-	};
+	if (!result.ok) return failure(String(result.code || "internal").trim() || "internal", String(result.message || "Signing-session seal cipher failed").trim() || "Signing-session seal cipher failed");
 	const ciphertext = normalizeOptionalTrimmedString(result.ciphertext);
-	if (!ciphertext) return {
-		ok: false,
-		code: "invalid_ciphertext",
-		message: "Signing-session seal cipher returned empty ciphertext"
-	};
+	if (!ciphertext) return failure("invalid_ciphertext", "Signing-session seal cipher returned empty ciphertext");
 	return {
 		ok: true,
 		ciphertext,
@@ -141,19 +126,12 @@ var SigningSessionSealKeyHandles = class {
 		return this.initialization;
 	}
 };
-function cipherFailure(code, message) {
-	return {
-		ok: false,
-		code,
-		message
-	};
-}
 function mapCipherError(error, defaultMessage) {
 	const message = normalizeOptionalTrimmedString(error instanceof Error ? error.message : error) || defaultMessage;
 	const lowered = message.toLowerCase();
-	if (lowered.includes("keyversion")) return cipherFailure("invalid_key_version", message);
-	if (lowered.includes("ciphertext") || lowered.includes("base64url") || lowered.includes("group")) return cipherFailure("invalid_ciphertext", message);
-	return cipherFailure("internal", message);
+	if (lowered.includes("keyversion")) return failure("invalid_key_version", message);
+	if (lowered.includes("ciphertext") || lowered.includes("base64url") || lowered.includes("group")) return failure("invalid_ciphertext", message);
+	return failure("internal", message);
 }
 function createSigningSessionSealShamir3PassCipherAdapter(options) {
 	const config = normalizeConfig(options.config);
@@ -163,7 +141,7 @@ function createSigningSessionSealShamir3PassCipherAdapter(options) {
 	return createSigningSessionSealCipherAdapter({
 		applyServerSeal: async (input) => {
 			const requestedKeyVersion = normalizeOptionalTrimmedString(input.keyVersion);
-			if (requestedKeyVersion && requestedKeyVersion !== config.currentKeyVersion) return cipherFailure("invalid_key_version", `Requested keyVersion "${requestedKeyVersion}" does not match active keyVersion "${config.currentKeyVersion}"`);
+			if (requestedKeyVersion && requestedKeyVersion !== config.currentKeyVersion) return failure("invalid_key_version", `Requested keyVersion "${requestedKeyVersion}" does not match active keyVersion "${config.currentKeyVersion}"`);
 			try {
 				const handle = (await handles.get()).get(config.currentKeyVersion);
 				if (handle === void 0) throw new Error("currentKeyVersion handle is unavailable");
@@ -183,7 +161,7 @@ function createSigningSessionSealShamir3PassCipherAdapter(options) {
 			const keyVersion = normalizeKeyVersion(input.keyVersion, "keyVersion");
 			try {
 				const handle = (await handles.get()).get(keyVersion);
-				if (handle === void 0) return cipherFailure("invalid_key_version", `Unknown keyVersion "${keyVersion}"`);
+				if (handle === void 0) return failure("invalid_key_version", `Unknown keyVersion "${keyVersion}"`);
 				return {
 					ok: true,
 					ciphertext: await runtime.removeLock({

package/dist/esm/threshold/session/signingSessionSeal/crypto/shamir3PassWasm.js

@@ -82,6 +82,6 @@ function destroySigningSessionSealLockKeyHandle(handle) {
 	return shamir3pass_destroy_lock_key_handle(handle);
 }
 //#endregion
-export { addSigningSessionSealLock, deriveSigningSessionSealLockKeyHandle, destroySigningSessionSealLockKeyHandle, ensureSigningSessionSealShamir3PassWasm, removeSigningSessionSealLock };
+export { addSigningSessionSealLock, deriveSigningSessionSealLockKeyHandle, destroySigningSessionSealLockKeyHandle, removeSigningSessionSealLock };
 
 //# sourceMappingURL=shamir3PassWasm.js.map

package/dist/esm/threshold/session/signingSessionSeal/idempotencyBackends.js

@@ -2,7 +2,7 @@ import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/nor
 import "../../../shared-ts/src/utils/validation.js";
 import { RedisTcpClient, UpstashRedisRestClient, redisDel, redisGetJson, redisSetJson } from "../../../core/ThresholdService/kv.js";
 import { createInMemorySigningSessionSealIdempotencyStore } from "./idempotency.js";
-import { parseCurrentSigningSessionSealIdempotencyRouteResult, parseCurrentSigningSessionSealIdempotencyStoredEntry } from "./idempotencyRecords.js";
+import { parseCurrentSigningSessionSealIdempotencyResultRecord, parseCurrentSigningSessionSealIdempotencyStoredEntry } from "./idempotencyRecords.js";
 //#region src/threshold/session/signingSessionSeal/idempotencyBackends.ts
 const DEFAULT_KEY_PREFIX = "threshold:signing-session-seal:idempotency:";
 function toPositiveInt(value) {
@@ -46,7 +46,7 @@ var UpstashSigningSessionSealIdempotencyStore = class {
 		if (!key) return;
 		const expiresAtMs = toPositiveInt(input.expiresAtMs);
 		if (expiresAtMs === void 0) return;
-		const normalizedResult = parseCurrentSigningSessionSealIdempotencyRouteResult(input.result);
+		const normalizedResult = parseCurrentSigningSessionSealIdempotencyResultRecord(input.result);
 		if (!normalizedResult) return;
 		const ttlMs = ttlMsUntilExpiry(expiresAtMs, this.nowMs());
 		if (ttlMs <= 0) return;
@@ -80,7 +80,7 @@ var RedisTcpSigningSessionSealIdempotencyStore = class {
 		if (!key) return;
 		const expiresAtMs = toPositiveInt(input.expiresAtMs);
 		if (expiresAtMs === void 0) return;
-		const normalizedResult = parseCurrentSigningSessionSealIdempotencyRouteResult(input.result);
+		const normalizedResult = parseCurrentSigningSessionSealIdempotencyResultRecord(input.result);
 		if (!normalizedResult) return;
 		const ttlMs = ttlMsUntilExpiry(expiresAtMs, this.nowMs());
 		if (ttlMs <= 0) return;

package/dist/esm/threshold/session/signingSessionSeal/idempotencyRecords.js

@@ -1,12 +1,12 @@
 import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
 import "../../../shared-ts/src/utils/validation.js";
+import { failure } from "../../../shared-ts/src/utils/failure.js";
 //#region src/threshold/session/signingSessionSeal/idempotencyRecords.ts
 function toPositiveInt(value) {
 	const parsed = Number(value);
 	if (!Number.isFinite(parsed) || parsed <= 0) return null;
 	return Math.floor(parsed);
 }
-const parseCurrentSigningSessionSealIdempotencyRecord = parseCurrentSigningSessionSealIdempotencyResultRecord;
 function parseCurrentSigningSessionSealIdempotencyResultRecord(raw) {
 	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
 	const obj = raw;
@@ -27,11 +27,7 @@ function parseCurrentSigningSessionSealIdempotencyResultRecord(raw) {
 		const code = normalizeOptionalTrimmedString(obj.code);
 		const message = normalizeOptionalTrimmedString(obj.message);
 		if (!code || !message) return null;
-		return {
-			ok: false,
-			code,
-			message
-		};
+		return failure(code, message);
 	}
 	return null;
 }
@@ -46,10 +42,7 @@ function parseCurrentSigningSessionSealIdempotencyStoredEntry(raw) {
 		expiresAtMs
 	};
 }
-function parseCurrentSigningSessionSealIdempotencyRouteResult(raw) {
-	return parseCurrentSigningSessionSealIdempotencyResultRecord(raw);
-}
 //#endregion
-export { parseCurrentSigningSessionSealIdempotencyRecord, parseCurrentSigningSessionSealIdempotencyResultRecord, parseCurrentSigningSessionSealIdempotencyRouteResult, parseCurrentSigningSessionSealIdempotencyStoredEntry };
+export { parseCurrentSigningSessionSealIdempotencyResultRecord, parseCurrentSigningSessionSealIdempotencyStoredEntry };
 
 //# sourceMappingURL=idempotencyRecords.js.map

package/dist/esm/threshold/session/signingSessionSeal/options.js

@@ -3,7 +3,7 @@ import "../../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
 import "../../../shared-ts/src/utils/validation.js";
 import { SIGNING_SESSION_SEAL_ALG, SIGNING_SESSION_SEAL_GROUP_ID } from "../../../shared-ts/src/utils/signingSessionSeal.js";
-import { parseSigningSessionSealKeyVersion } from "../../../core/keyMaterialBrands.js";
+import { parseSigningSessionSealKeyVersion } from "../../../shared-ts/src/threshold/keyMaterialBrands.js";
 import { createSigningSessionSealShamir3PassCipherAdapter } from "./crypto/cipher.js";
 import { createSigningSessionSealRoutesOptions } from "./routesOptions.js";
 //#region src/threshold/session/signingSessionSeal/options.ts

package/dist/esm/threshold/session/signingSessionSeal/service.js

@@ -1,6 +1,7 @@
 import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { sha256BytesUtf8 } from "../../../shared-ts/src/utils/digests.js";
 import "../../../shared-ts/src/utils/encoders.js";
+import { failure } from "../../../shared-ts/src/utils/failure.js";
 //#region src/threshold/session/signingSessionSeal/service.ts
 const SIGNING_SESSION_SEAL_LOG_LABEL = "[threshold-signing-session-seal]";
 const SIGNING_SESSION_SEAL_IDEMPOTENCY_TTL_MS_DEFAULT = 9e4;
@@ -120,11 +121,7 @@ function shouldPersistIdempotentResult(result) {
 async function runSealOperation(input) {
 	const nowMs = input.options.nowMs || Date.now;
 	const startedAtMs = nowMs();
-	let result = {
-		ok: false,
-		code: "internal",
-		message: "Internal error"
-	};
+	let result = failure("internal", "Internal error");
 	try {
 		emitOperationRequestLog({
 			options: input.options,
@@ -136,27 +133,15 @@ async function runSealOperation(input) {
 		});
 		const session = input.auth.session;
 		if (signingSessionSealAuthorizationId(session) !== input.request.thresholdSessionId) {
-			result = {
-				ok: false,
-				code: "forbidden",
-				message: "Wallet Session does not match requested thresholdSessionId"
-			};
+			result = failure("forbidden", "Wallet Session does not match requested thresholdSessionId");
 			return result;
 		}
 		if (session.userId !== input.auth.userId) {
-			result = {
-				ok: false,
-				code: "forbidden",
-				message: "thresholdSessionId does not belong to authenticated user"
-			};
+			result = failure("forbidden", "thresholdSessionId does not belong to authenticated user");
 			return result;
 		}
 		if (isExpired(session, nowMs())) {
-			result = {
-				ok: false,
-				code: "expired",
-				message: "threshold session expired"
-			};
+			result = failure("expired", "threshold session expired");
 			return result;
 		}
 		if (input.options.guard) {
@@ -166,11 +151,7 @@ async function runSealOperation(input) {
 				auth: input.auth
 			});
 			if (!guard.ok) {
-				result = {
-					ok: false,
-					code: toCode(guard.code, "forbidden"),
-					message: toMessage(guard.message, "Request rejected")
-				};
+				result = failure(toCode(guard.code, "forbidden"), toMessage(guard.message, "Request rejected"));
 				return result;
 			}
 		}
@@ -183,11 +164,7 @@ async function runSealOperation(input) {
 			auth: { userId: input.auth.userId }
 		});
 		if (!sealed.ok) {
-			result = {
-				ok: false,
-				code: toCode(sealed.code, "internal"),
-				message: toMessage(sealed.message, "Signing-session seal operation failed")
-			};
+			result = failure(toCode(sealed.code, "internal"), toMessage(sealed.message, "Signing-session seal operation failed"));
 			return result;
 		}
 		result = {
@@ -198,11 +175,7 @@ async function runSealOperation(input) {
 		};
 		return result;
 	} catch (error) {
-		result = {
-			ok: false,
-			code: "internal",
-			message: toMessage(error instanceof Error ? error.message : error, "Internal error")
-		};
+		result = failure("internal", toMessage(error instanceof Error ? error.message : error, "Internal error"));
 		return result;
 	} finally {
 		const durationMs = Math.max(0, nowMs() - startedAtMs);

package/dist/esm/threshold/session/signingSessionSeal/transport/express.js

@@ -1,3 +1,4 @@
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { authorizeSigningSessionSealRequest, buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, parseSigningSessionSealApplyBody, parseSigningSessionSealRemoveBody, resolveSigningSessionSealBasePath, signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode } from "./shared.js";
 //#region src/threshold/session/signingSessionSeal/transport/express.ts
 function errMessage(error) {
@@ -10,94 +11,23 @@ function registerSigningSessionSealRoutes(router, ctx) {
 	const basePath = resolveSigningSessionSealBasePath(options.basePath);
 	const applyPath = buildSigningSessionSealApplyPath(basePath);
 	const removePath = buildSigningSessionSealRemovePath(basePath);
-	router.post(applyPath, async (req, res) => {
+	const handleSealRoute = (route, operation) => async (req, res) => {
 		const startedAtMs = Date.now();
 		try {
 			ctx.logger.info("[threshold-signing-session-seal] request", {
-				route: applyPath,
-				operation: "apply-server-seal"
+				route,
+				operation
 			});
-			const parsed = parseSigningSessionSealApplyBody(req.body || {});
+			const parsed = operation === "apply-server-seal" ? parseSigningSessionSealApplyBody(req.body || {}) : parseSigningSessionSealRemoveBody(req.body || {});
 			if (!parsed.ok) {
 				ctx.logger.warn("[threshold-signing-session-seal] invalid_body", {
-					route: applyPath,
-					operation: "apply-server-seal",
+					route,
+					operation,
 					code: parsed.code,
 					message: parsed.message,
 					durationMs: Math.max(0, Date.now() - startedAtMs)
 				});
-				res.status(400).json({
-					ok: false,
-					code: parsed.code,
-					message: parsed.message
-				});
-				return;
-			}
-			const authorized = await authorizeSigningSessionSealRequest({
-				options,
-				headers: req.headers || {},
-				thresholdSessionId: parsed.value.thresholdSessionId
-			});
-			if (!authorized.ok) {
-				ctx.logger.warn("[threshold-signing-session-seal] unauthorized", {
-					route: applyPath,
-					operation: "apply-server-seal",
-					code: authorized.code || "unauthorized",
-					message: authorized.message || "Unauthorized",
-					durationMs: Math.max(0, Date.now() - startedAtMs)
-				});
-				res.status(signingSessionSealAuthorizeStatusCode(authorized)).json({
-					ok: false,
-					code: authorized.code || "unauthorized",
-					message: authorized.message || "Unauthorized"
-				});
-				return;
-			}
-			const result = await options.service.applyServerSeal(parsed.value, authorized.auth);
-			const status = signingSessionSealStatusCode(result);
-			res.status(status).json(result);
-			ctx.logger.info("[threshold-signing-session-seal] response", {
-				route: applyPath,
-				status,
-				ok: result.ok,
-				durationMs: Math.max(0, Date.now() - startedAtMs),
-				userId: authorized.auth.userId
-			});
-		} catch (error) {
-			const message = errMessage(error);
-			ctx.logger.error("[threshold-signing-session-seal] error", {
-				route: applyPath,
-				message,
-				durationMs: Math.max(0, Date.now() - startedAtMs)
-			});
-			res.status(500).json({
-				ok: false,
-				code: "internal",
-				message
-			});
-		}
-	});
-	router.post(removePath, async (req, res) => {
-		const startedAtMs = Date.now();
-		try {
-			ctx.logger.info("[threshold-signing-session-seal] request", {
-				route: removePath,
-				operation: "remove-server-seal"
-			});
-			const parsed = parseSigningSessionSealRemoveBody(req.body || {});
-			if (!parsed.ok) {
-				ctx.logger.warn("[threshold-signing-session-seal] invalid_body", {
-					route: removePath,
-					operation: "remove-server-seal",
-					code: parsed.code,
-					message: parsed.message,
-					durationMs: Math.max(0, Date.now() - startedAtMs)
-				});
-				res.status(400).json({
-					ok: false,
-					code: parsed.code,
-					message: parsed.message
-				});
+				res.status(400).json(failure(parsed.code, parsed.message));
 				return;
 			}
 			const authorized = await authorizeSigningSessionSealRequest({
@@ -107,24 +37,20 @@ function registerSigningSessionSealRoutes(router, ctx) {
 			});
 			if (!authorized.ok) {
 				ctx.logger.warn("[threshold-signing-session-seal] unauthorized", {
-					route: removePath,
-					operation: "remove-server-seal",
+					route,
+					operation,
 					code: authorized.code || "unauthorized",
 					message: authorized.message || "Unauthorized",
 					durationMs: Math.max(0, Date.now() - startedAtMs)
 				});
-				res.status(signingSessionSealAuthorizeStatusCode(authorized)).json({
-					ok: false,
-					code: authorized.code || "unauthorized",
-					message: authorized.message || "Unauthorized"
-				});
+				res.status(signingSessionSealAuthorizeStatusCode(authorized)).json(failure(authorized.code || "unauthorized", authorized.message || "Unauthorized"));
 				return;
 			}
-			const result = await options.service.removeServerSeal(parsed.value, authorized.auth);
+			const result = operation === "apply-server-seal" ? await options.service.applyServerSeal(parsed.value, authorized.auth) : await options.service.removeServerSeal(parsed.value, authorized.auth);
 			const status = signingSessionSealStatusCode(result);
 			res.status(status).json(result);
 			ctx.logger.info("[threshold-signing-session-seal] response", {
-				route: removePath,
+				route,
 				status,
 				ok: result.ok,
 				durationMs: Math.max(0, Date.now() - startedAtMs),
@@ -133,17 +59,15 @@ function registerSigningSessionSealRoutes(router, ctx) {
 		} catch (error) {
 			const message = errMessage(error);
 			ctx.logger.error("[threshold-signing-session-seal] error", {
-				route: removePath,
+				route,
 				message,
 				durationMs: Math.max(0, Date.now() - startedAtMs)
 			});
-			res.status(500).json({
-				ok: false,
-				code: "internal",
-				message
-			});
+			res.status(500).json(failure("internal", message));
 		}
-	});
+	};
+	router.post(applyPath, handleSealRoute(applyPath, "apply-server-seal"));
+	router.post(removePath, handleSealRoute(removePath, "remove-server-seal"));
 }
 //#endregion
 export { registerSigningSessionSealRoutes };

package/dist/esm/threshold/session/signingSessionSeal/transport/fetch.js

@@ -1,4 +1,6 @@
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { authorizeSigningSessionSealRequest, buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, parseSigningSessionSealApplyBody, parseSigningSessionSealRemoveBody, resolveSigningSessionSealBasePath, signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode } from "./shared.js";
+import { headersToRecord, readJson } from "../../../../router/framework/http.js";
 //#region src/threshold/session/signingSessionSeal/transport/fetch.ts
 function json(body, status = 200) {
 	return new Response(JSON.stringify(body), {
@@ -6,20 +8,6 @@ function json(body, status = 200) {
 		headers: { "Content-Type": "application/json; charset=utf-8" }
 	});
 }
-async function readJsonSafe(request) {
-	try {
-		return await request.json();
-	} catch {
-		return null;
-	}
-}
-function headersToRecord(headers) {
-	const out = {};
-	headers.forEach((value, key) => {
-		out[key] = value;
-	});
-	return out;
-}
 function errMessage(error) {
 	return error instanceof Error ? error.message : String(error || "Internal error");
 }
@@ -39,7 +27,7 @@ async function handleSigningSessionSealRoutes(ctx) {
 			route: isApply ? applyPath : removePath,
 			operation
 		});
-		const body = await readJsonSafe(ctx.request);
+		const body = await readJson(ctx.request);
 		const parsed = isApply ? parseSigningSessionSealApplyBody(body) : parseSigningSessionSealRemoveBody(body);
 		if (!parsed.ok) {
 			ctx.logger.warn("[threshold-signing-session-seal] invalid_body", {
@@ -49,11 +37,7 @@ async function handleSigningSessionSealRoutes(ctx) {
 				message: parsed.message,
 				durationMs: Math.max(0, Date.now() - startedAtMs)
 			});
-			return json({
-				ok: false,
-				code: parsed.code,
-				message: parsed.message
-			}, 400);
+			return json(failure(parsed.code, parsed.message), 400);
 		}
 		const authorized = await authorizeSigningSessionSealRequest({
 			options,
@@ -69,11 +53,7 @@ async function handleSigningSessionSealRoutes(ctx) {
 				message: authorized.message || "Unauthorized",
 				durationMs: Math.max(0, Date.now() - startedAtMs)
 			});
-			return json({
-				ok: false,
-				code: authorized.code || "unauthorized",
-				message: authorized.message || "Unauthorized"
-			}, signingSessionSealAuthorizeStatusCode(authorized));
+			return json(failure(authorized.code || "unauthorized", authorized.message || "Unauthorized"), signingSessionSealAuthorizeStatusCode(authorized));
 		}
 		const result = isApply ? await options.service.applyServerSeal(parsed.value, authorized.auth) : await options.service.removeServerSeal(parsed.value, authorized.auth);
 		const status = signingSessionSealStatusCode(result);
@@ -93,11 +73,7 @@ async function handleSigningSessionSealRoutes(ctx) {
 			message,
 			durationMs: Math.max(0, Date.now() - startedAtMs)
 		});
-		return json({
-			ok: false,
-			code: "internal",
-			message
-		}, 500);
+		return json(failure("internal", message), 500);
 	}
 }
 //#endregion

package/dist/esm/threshold/session/signingSessionSeal/transport/shared.js

@@ -1,13 +1,10 @@
 import { parseThresholdSessionId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { ensureLeadingSlash } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
+import { asRecord } from "../../../../shared-ts/src/utils/validation.js";
 import { WALLET_SESSION_SEAL_BASE_PATH } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 //#region src/threshold/session/signingSessionSeal/transport/shared.ts
 const DEFAULT_BASE_PATH = WALLET_SESSION_SEAL_BASE_PATH;
-function asRecord(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return null;
-	return value;
-}
 function readRequiredString(obj, key) {
 	return typeof obj[key] === "string" ? String(obj[key] || "").trim() : "";
 }
@@ -28,24 +25,12 @@ function buildSigningSessionSealRemovePath(basePath) {
 }
 function parseSigningSessionSealApplyBody(body) {
 	const obj = asRecord(body);
-	if (!obj) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Request body must be a JSON object"
-	};
+	if (!obj) return failure("invalid_body", "Request body must be a JSON object");
 	const thresholdSessionId = readRequiredString(obj, "thresholdSessionId");
 	const ciphertext = readRequiredString(obj, "ciphertext");
-	if (!thresholdSessionId || !ciphertext) return {
-		ok: false,
-		code: "invalid_body",
-		message: "thresholdSessionId and ciphertext are required"
-	};
+	if (!thresholdSessionId || !ciphertext) return failure("invalid_body", "thresholdSessionId and ciphertext are required");
 	const parsedThresholdSessionId = parseThresholdSessionId(thresholdSessionId);
-	if (!parsedThresholdSessionId.ok) return {
-		ok: false,
-		code: "invalid_body",
-		message: "thresholdSessionId is invalid"
-	};
+	if (!parsedThresholdSessionId.ok) return failure("invalid_body", "thresholdSessionId is invalid");
 	return {
 		ok: true,
 		value: {
@@ -56,35 +41,9 @@ function parseSigningSessionSealApplyBody(body) {
 		}
 	};
 }
+/** Removal takes the same body as apply. */
 function parseSigningSessionSealRemoveBody(body) {
-	const obj = asRecord(body);
-	if (!obj) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Request body must be a JSON object"
-	};
-	const thresholdSessionId = readRequiredString(obj, "thresholdSessionId");
-	const ciphertext = readRequiredString(obj, "ciphertext");
-	if (!thresholdSessionId || !ciphertext) return {
-		ok: false,
-		code: "invalid_body",
-		message: "thresholdSessionId and ciphertext are required"
-	};
-	const parsedThresholdSessionId = parseThresholdSessionId(thresholdSessionId);
-	if (!parsedThresholdSessionId.ok) return {
-		ok: false,
-		code: "invalid_body",
-		message: "thresholdSessionId is invalid"
-	};
-	return {
-		ok: true,
-		value: {
-			thresholdSessionId: parsedThresholdSessionId.value,
-			ciphertext,
-			keyVersion: readOptionalString(obj, "keyVersion"),
-			metadata: readOptionalMetadata(obj.metadata)
-		}
-	};
+	return parseSigningSessionSealApplyBody(body);
 }
 async function authorizeSigningSessionSealRequest(args) {
 	const authorize = args.authorize ?? args.options.authorize;
@@ -94,11 +53,7 @@ async function authorizeSigningSessionSealRequest(args) {
 			thresholdSessionId: args.thresholdSessionId
 		});
 	} catch (error) {
-		return {
-			ok: false,
-			code: "internal",
-			message: error instanceof Error ? error.message : String(error || "Authorization failed")
-		};
+		return failure("internal", error instanceof Error ? error.message : String(error || "Authorization failed"));
 	}
 	return {
 		ok: false,
@@ -107,9 +62,9 @@ async function authorizeSigningSessionSealRequest(args) {
 		status: 501
 	};
 }
-function signingSessionSealStatusCode(result) {
-	if (result.ok) return 200;
-	switch (result.code) {
+/** The statuses route and authorization failures share, or null for a code only one of them has. */
+function sharedFailureStatusCode(code) {
+	switch (code) {
 		case "unauthorized":
 		case "wallet_session_missing":
 		case "wallet_session_signature_invalid":
@@ -120,38 +75,31 @@ function signingSessionSealStatusCode(result) {
 		case "wallet_session_scope_mismatch": return 403;
 		case "wallet_budget_exhausted": return 409;
 		case "wallet_session_unavailable": return 503;
-		case "not_found": return 404;
 		case "rate_limited": return 429;
+		case "sessions_disabled": return 501;
+		case "internal": return 500;
+		default: return null;
+	}
+}
+function signingSessionSealStatusCode(result) {
+	if (result.ok) return 200;
+	const shared = sharedFailureStatusCode(result.code);
+	if (shared !== null) return shared;
+	switch (result.code) {
+		case "not_found": return 404;
 		case "expired":
 		case "exhausted":
 		case "stale_session_state":
 		case "conflict": return 409;
 		case "not_configured": return 503;
-		case "sessions_disabled":
 		case "not_implemented": return 501;
-		case "internal": return 500;
 		default: return 400;
 	}
 }
 function signingSessionSealAuthorizeStatusCode(result) {
 	if (result.ok) return 200;
 	if (Number.isFinite(Number(result.status))) return Math.max(100, Math.floor(Number(result.status)));
-	switch (result.code) {
-		case "unauthorized":
-		case "wallet_session_missing":
-		case "wallet_session_signature_invalid":
-		case "wallet_session_claims_invalid":
-		case "wallet_session_invalid":
-		case "wallet_session_expired": return 401;
-		case "forbidden":
-		case "wallet_session_scope_mismatch": return 403;
-		case "wallet_budget_exhausted": return 409;
-		case "wallet_session_unavailable": return 503;
-		case "rate_limited": return 429;
-		case "sessions_disabled": return 501;
-		case "internal": return 500;
-		default: return 400;
-	}
+	return sharedFailureStatusCode(result.code) ?? 400;
 }
 //#endregion
 export { authorizeSigningSessionSealRequest, buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, parseSigningSessionSealApplyBody, parseSigningSessionSealRemoveBody, resolveSigningSessionSealBasePath, signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode };

package/dist/esm/threshold/statusCodes.js

@@ -34,6 +34,6 @@ function thresholdEcdsaStatusCode(result) {
 	return thresholdStatusCode(result);
 }
 //#endregion
-export { thresholdEcdsaStatusCode, thresholdEd25519StatusCode, thresholdStatusCode };
+export { thresholdEcdsaStatusCode, thresholdEd25519StatusCode };
 
 //# sourceMappingURL=statusCodes.js.map