@seams/wallet-server 0.7.1 → 0.7.3

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer.js

@@ -1,5 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { validateSecp256k1PublicKey33 } from "../../../../core/ThresholdService/evmCryptoWasm.js";
 import { emailOtpDeviceEnrollmentId } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { validateEmailOtpEnrollmentMaterial } from "./d1EmailOtpRecords.js";
@@ -20,27 +21,11 @@ var CloudflareD1EmailOtpRegistrationEnrollmentFinalizer = class {
 		this.googleEmailOtpSessions = input.googleEmailOtpSessions;
 	}
 	async prepareRegistrationFinalize(input) {
-		if (input.authority.kind !== "email_otp") return input.request.emailOtpEnrollment ? {
-			ok: false,
-			code: "invalid_body",
-			message: "Email OTP enrollment material is only valid for Email OTP registration"
-		} : { ok: true };
-		if (!input.request.emailOtpEnrollment) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Email OTP registration finalize requires emailOtpEnrollment"
-		};
-		if (input.authority.walletId !== input.walletId || input.authority.finalWalletId !== input.walletId || input.authority.orgId !== input.orgId) return {
-			ok: false,
-			code: "authority_binding_mismatch",
-			message: "Email OTP registration authority does not match finalize scope"
-		};
+		if (input.authority.kind !== "email_otp") return input.request.emailOtpEnrollment ? failure("invalid_body", "Email OTP enrollment material is only valid for Email OTP registration") : { ok: true };
+		if (!input.request.emailOtpEnrollment) return failure("invalid_body", "Email OTP registration finalize requires emailOtpEnrollment");
+		if (input.authority.walletId !== input.walletId || input.authority.finalWalletId !== input.walletId || input.authority.orgId !== input.orgId) return failure("authority_binding_mismatch", "Email OTP registration authority does not match finalize scope");
 		const material = parseEmailOtpEnrollmentMaterialBoundaryInput(input.request.emailOtpEnrollment);
-		if (!material) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Email OTP enrollment material must be an object with the expected fields"
-		};
+		if (!material) return failure("invalid_body", "Email OTP enrollment material must be an object with the expected fields");
 		return await this.buildPersistence({
 			walletId: input.walletId,
 			orgId: input.orgId,
@@ -131,11 +116,7 @@ var CloudflareD1EmailOtpRegistrationEnrollmentFinalizer = class {
 	* batch instead of silently replacing material that another operation owns.
 	*/
 	async prepareLinkedDeviceEnrollment(input) {
-		if (!await this.emailOtpEnrollments.signerWalletExists(input.walletId)) return {
-			ok: false,
-			code: "wallet_registration_incomplete",
-			message: "Email OTP enrollment requires a canonical wallet"
-		};
+		if (!await this.emailOtpEnrollments.signerWalletExists(input.walletId)) return failure("wallet_registration_incomplete", "Email OTP enrollment requires a canonical wallet");
 		if (await this.emailOtpEnrollments.readEnrollment(input.walletId)) return {
 			ok: false,
 			code: "enrollment_conflict",
@@ -164,11 +145,7 @@ var CloudflareD1EmailOtpRegistrationEnrollmentFinalizer = class {
 		const walletId = normalizeOptionalTrimmedString(input.walletId) || "";
 		const authSubjectId = normalizeOptionalTrimmedString(input.authSubjectId) || "";
 		const verifiedEmail = normalizeOptionalTrimmedString(input.verifiedEmail)?.toLowerCase() || "";
-		if (!orgId || !walletId || !authSubjectId || !verifiedEmail) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Email OTP registration enrollment requires wallet, org, and email identity"
-		};
+		if (!orgId || !walletId || !authSubjectId || !verifiedEmail) return failure("invalid_body", "Email OTP registration enrollment requires wallet, org, and email identity");
 		const existing = await this.emailOtpEnrollments.readEnrollment(walletId);
 		const existingAuthState = await this.emailOtpEnrollments.readAuthState(walletId);
 		return {

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpServerSealRuntime.js

@@ -1,5 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { createSigningSessionSealShamir3PassCipherAdapter } from "../../../../threshold/session/signingSessionSeal/crypto/cipher.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpServerSealRuntime.ts
 const applyEmailOtpServerSealOperation = {
@@ -26,11 +27,7 @@ var CloudflareD1EmailOtpServerSealRuntime = class {
 	async runServerSealOperation(input, operation) {
 		try {
 			const wrappedCiphertext = normalizeOptionalTrimmedString(input.wrappedCiphertext);
-			if (!wrappedCiphertext) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Missing wrappedCiphertext"
-			};
+			if (!wrappedCiphertext) return failure("invalid_body", "Missing wrappedCiphertext");
 			const shamir = this.cipherResult;
 			if (!shamir.ok) return shamir;
 			const result = await shamir.cipher.run({
@@ -47,19 +44,11 @@ var CloudflareD1EmailOtpServerSealRuntime = class {
 				enrollmentSealKeyVersion: result.keyVersion || shamir.keyVersion
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: serverSealErrorMessage(error) || operation.failureMessage
-			};
+			return failure("internal", serverSealErrorMessage(error) || operation.failureMessage);
 		}
 	}
 	createCipher() {
-		if (!this.config.configured) return {
-			ok: false,
-			code: "not_configured",
-			message: this.config.message
-		};
+		if (!this.config.configured) return failure("not_configured", this.config.message);
 		try {
 			return {
 				ok: true,
@@ -67,11 +56,7 @@ var CloudflareD1EmailOtpServerSealRuntime = class {
 				cipher: createSigningSessionSealShamir3PassCipherAdapter({ config: this.config.rootConfig })
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "not_configured",
-				message: serverSealErrorMessage(error) || "Email OTP Shamir configuration is invalid"
-			};
+			return failure("not_configured", serverSealErrorMessage(error) || "Email OTP Shamir configuration is invalid");
 		}
 	}
 };

package/dist/esm/router/cloudflare/d1/emailOtp/d1GoogleEmailOtpSessionResolver.js

@@ -2,6 +2,7 @@ import { parseGoogleProviderSubject, parseOrgId, parseVerifiedGoogleEmail } from
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { createServerAllocatedWalletId } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
 import { parseD1BoundaryWalletId, parseD1BoundaryWalletIdResult } from "../auth/d1RouterApiAuthBoundary.js";
@@ -61,17 +62,9 @@ var CloudflareD1GoogleEmailOtpSessionResolver = class {
 		});
 	}
 	async cleanupDevRegistrationState(input) {
-		if (this.production) return {
-			ok: false,
-			code: "not_found",
-			message: "Google Email OTP dev cleanup is not available"
-		};
+		if (this.production) return failure("not_found", "Google Email OTP dev cleanup is not available");
 		const providerSubject = normalizeOptionalTrimmedString(input.providerSubject);
-		if (!providerSubject || !providerSubject.startsWith("google:")) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing Google provider subject"
-		};
+		if (!providerSubject || !providerSubject.startsWith("google:")) return failure("invalid_body", "Missing Google provider subject");
 		const requestedWalletId = parseD1BoundaryWalletId(input.walletId);
 		const requestedOrgId = normalizeOptionalTrimmedString(input.orgId);
 		const nowMs = cleanupNowMs(input.nowMs);
@@ -122,23 +115,11 @@ var CloudflareD1GoogleEmailOtpSessionResolver = class {
 	async consumeRegistrationAttemptRateLimit(input) {
 		if (normalizeOptionalTrimmedString(input.accountMode)?.toLowerCase() !== "register") return { ok: true };
 		const providerSubject = parseGoogleProviderSubject(input.providerSubject);
-		if (!providerSubject.ok) return {
-			ok: false,
-			code: "invalid_body",
-			message: providerSubject.error.message
-		};
+		if (!providerSubject.ok) return failure("invalid_body", providerSubject.error.message);
 		const email = parseVerifiedGoogleEmail(input.email);
-		if (!email.ok) return {
-			ok: false,
-			code: "invalid_body",
-			message: email.error.message
-		};
+		if (!email.ok) return failure("invalid_body", email.error.message);
 		const orgId = parseOrgId(input.runtimePolicyScope?.orgId);
-		if (!orgId.ok) return {
-			ok: false,
-			code: "invalid_body",
-			message: orgId.error.message
-		};
+		if (!orgId.ok) return failure("invalid_body", orgId.error.message);
 		const restartOffer = isTrueFlag(input.restartRegistrationOffer);
 		return await this.emailOtpRateLimits.consume({
 			scope: "googleRegistrationAttempt",
@@ -153,39 +134,19 @@ var CloudflareD1GoogleEmailOtpSessionResolver = class {
 		const registrationAttemptId = normalizeOptionalTrimmedString(input.registrationAttemptId);
 		if (!registrationAttemptId) return { ok: true };
 		const walletId = parseD1BoundaryWalletIdResult(input.walletId);
-		if (!walletId.ok) return {
-			ok: false,
-			code: "invalid_body",
-			message: walletId.code === "missing" ? "Missing walletId" : "Invalid walletId"
-		};
+		if (!walletId.ok) return failure("invalid_body", walletId.code === "missing" ? "Missing walletId" : "Invalid walletId");
 		const attempt = await this.registrationAttempts.read(registrationAttemptId);
-		if (!attempt) return {
-			ok: false,
-			code: "registration_incomplete",
-			message: "Google Email OTP registration attempt expired or was not found"
-		};
+		if (!attempt) return failure("registration_incomplete", "Google Email OTP registration attempt expired or was not found");
 		if (attempt.expiresAtMs <= Date.now()) {
 			await this.registrationAttempts.put(expiredGoogleEmailOtpRegistrationAttemptRecord({
 				record: attempt,
 				updatedAtMs: Date.now()
 			}));
-			return {
-				ok: false,
-				code: "registration_incomplete",
-				message: "Google Email OTP registration attempt expired"
-			};
+			return failure("registration_incomplete", "Google Email OTP registration attempt expired");
 		}
-		if (walletId.value !== attempt.walletId) return {
-			ok: false,
-			code: "wallet_identity_mismatch",
-			message: "registrationAttemptId does not match walletId"
-		};
+		if (walletId.value !== attempt.walletId) return failure("wallet_identity_mismatch", "registrationAttemptId does not match walletId");
 		if (attempt.state === "active") return { ok: true };
-		if (attempt.state !== "started" && attempt.state !== "key_finalized") return {
-			ok: false,
-			code: "registration_incomplete",
-			message: "Google Email OTP registration attempt is no longer active"
-		};
+		if (attempt.state !== "started" && attempt.state !== "key_finalized") return failure("registration_incomplete", "Google Email OTP registration attempt is no longer active");
 		const linked = await this.linkIdentity({
 			userId: attempt.walletId,
 			subject: `wallet:${attempt.providerSubject}`,
@@ -197,11 +158,7 @@ var CloudflareD1GoogleEmailOtpSessionResolver = class {
 				failureCode: linked.code,
 				updatedAtMs: Date.now()
 			}));
-			return {
-				ok: false,
-				code: linked.code,
-				message: linked.message
-			};
+			return failure(linked.code, linked.message);
 		}
 		await this.registrationAttempts.put(activeGoogleEmailOtpRegistrationAttemptRecord({
 			record: attempt,
@@ -214,48 +171,20 @@ var CloudflareD1GoogleEmailOtpSessionResolver = class {
 		const walletId = parseD1BoundaryWalletIdResult(input.walletId);
 		const providerSubject = parseGoogleProviderSubject(input.providerSubject);
 		const ownerProofBindingDigest = normalizeOptionalTrimmedString(input.ownerProofBindingDigest);
-		if (!registrationAttemptId || !walletId.ok || !providerSubject.ok || !ownerProofBindingDigest) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Google Email OTP registration candidate validation requires signed session scope"
-		};
+		if (!registrationAttemptId || !walletId.ok || !providerSubject.ok || !ownerProofBindingDigest) return failure("invalid_body", "Google Email OTP registration candidate validation requires signed session scope");
 		const attempt = await this.registrationAttempts.read(registrationAttemptId);
-		if (!attempt) return {
-			ok: false,
-			code: "registration_attempt_missing",
-			message: "Google Email OTP registration attempt expired or was not found"
-		};
+		if (!attempt) return failure("registration_attempt_missing", "Google Email OTP registration attempt expired or was not found");
 		if (attempt.expiresAtMs <= Date.now()) {
 			await this.registrationAttempts.put(expiredGoogleEmailOtpRegistrationAttemptRecord({
 				record: attempt,
 				updatedAtMs: Date.now()
 			}));
-			return {
-				ok: false,
-				code: "registration_attempt_expired",
-				message: "Google Email OTP registration attempt expired"
-			};
+			return failure("registration_attempt_expired", "Google Email OTP registration attempt expired");
 		}
-		if (attempt.providerSubject !== providerSubject.value) return {
-			ok: false,
-			code: "challenge_subject_mismatch",
-			message: "Email OTP registration attempt does not match the provider subject"
-		};
-		if (attempt.ownerProofBindingDigest !== ownerProofBindingDigest) return {
-			ok: false,
-			code: "owner_proof_binding_mismatch",
-			message: "Google Email OTP registration attempt does not match the owner proof binding"
-		};
-		if (attempt.state !== "started" && attempt.state !== "key_finalized") return {
-			ok: false,
-			code: "registration_incomplete",
-			message: "Google Email OTP registration attempt is no longer active"
-		};
-		if (!attempt.offerCandidates.find((offerCandidate) => offerCandidate.walletId === walletId.value)) return {
-			ok: false,
-			code: "wallet_identity_mismatch",
-			message: "walletId is not an active Google Email OTP registration candidate"
-		};
+		if (attempt.providerSubject !== providerSubject.value) return failure("challenge_subject_mismatch", "Email OTP registration attempt does not match the provider subject");
+		if (attempt.ownerProofBindingDigest !== ownerProofBindingDigest) return failure("owner_proof_binding_mismatch", "Google Email OTP registration attempt does not match the owner proof binding");
+		if (attempt.state !== "started" && attempt.state !== "key_finalized") return failure("registration_incomplete", "Google Email OTP registration attempt is no longer active");
+		if (!attempt.offerCandidates.find((offerCandidate) => offerCandidate.walletId === walletId.value)) return failure("wallet_identity_mismatch", "walletId is not an active Google Email OTP registration candidate");
 		return { ok: true };
 	}
 	async resolveLoginSession(input) {
@@ -460,21 +389,9 @@ var CloudflareD1GoogleEmailOtpSessionResolver = class {
 	}
 	async readActiveEnrollment(input) {
 		const enrollment = await this.emailOtpEnrollments.readEnrollment(input.walletId);
-		if (!enrollment) return {
-			ok: false,
-			code: "not_found",
-			message: "Email OTP enrollment not found"
-		};
-		if (enrollment.orgId !== input.orgId) return {
-			ok: false,
-			code: "tenant_scope_mismatch",
-			message: "Email OTP enrollment does not match the requested orgId"
-		};
-		if (enrollment.providerUserId !== input.providerUserId) return {
-			ok: false,
-			code: "provider_identity_mismatch",
-			message: "Email OTP enrollment does not belong to the requested provider identity"
-		};
+		if (!enrollment) return failure("not_found", "Email OTP enrollment not found");
+		if (enrollment.orgId !== input.orgId) return failure("tenant_scope_mismatch", "Email OTP enrollment does not match the requested orgId");
+		if (enrollment.providerUserId !== input.providerUserId) return failure("provider_identity_mismatch", "Email OTP enrollment does not belong to the requested provider identity");
 		return {
 			ok: true,
 			enrollment
@@ -497,11 +414,7 @@ function codedError(code, message) {
 	return error;
 }
 function devCleanupIdentityDeleteFailure(input) {
-	return {
-		ok: false,
-		code: input.code,
-		message: input.message
-	};
+	return failure(input.code, input.message);
 }
 //#endregion
 export { CloudflareD1GoogleEmailOtpSessionResolver };

package/dist/esm/router/cloudflare/d1/identity/d1IdentityService.js

@@ -1,5 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { parseD1BoundaryWalletId } from "../auth/d1RouterApiAuthBoundary.js";
 import { requireD1RouterApiAuthScopeString } from "../auth/d1RouterApiAuthConfig.js";
 import { deriveHostedNearAccountId } from "../../../../core/hostedAccountIds.js";
@@ -36,74 +37,42 @@ var CloudflareD1IdentityService = class {
 	async listIdentities(input) {
 		try {
 			const userId = normalizeOptionalTrimmedString(input.userId);
-			if (!userId) return {
-				ok: false,
-				code: "invalid_args",
-				message: "Missing userId"
-			};
+			if (!userId) return failure("invalid_args", "Missing userId");
 			return {
 				ok: true,
 				subjects: await this.identityStore.listSubjectsByUserId(userId)
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: errorMessage(error) || "Failed to list identities"
-			};
+			return failure("internal", errorMessage(error) || "Failed to list identities");
 		}
 	}
 	async linkIdentity(input) {
 		try {
 			const userId = normalizeOptionalTrimmedString(input.userId);
 			const subject = normalizeOptionalTrimmedString(input.subject);
-			if (!userId) return {
-				ok: false,
-				code: "invalid_args",
-				message: "Missing userId"
-			};
-			if (!subject) return {
-				ok: false,
-				code: "invalid_args",
-				message: "Missing subject"
-			};
+			if (!userId) return failure("invalid_args", "Missing userId");
+			if (!subject) return failure("invalid_args", "Missing subject");
 			return await this.identityStore.linkSubjectToUserId({
 				userId,
 				subject,
 				allowMoveIfSoleIdentity: Boolean(input.allowMoveIfSoleIdentity)
 			});
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: errorMessage(error) || "Failed to link identity"
-			};
+			return failure("internal", errorMessage(error) || "Failed to link identity");
 		}
 	}
 	async unlinkIdentity(input) {
 		try {
 			const userId = normalizeOptionalTrimmedString(input.userId);
 			const subject = normalizeOptionalTrimmedString(input.subject);
-			if (!userId) return {
-				ok: false,
-				code: "invalid_args",
-				message: "Missing userId"
-			};
-			if (!subject) return {
-				ok: false,
-				code: "invalid_args",
-				message: "Missing subject"
-			};
+			if (!userId) return failure("invalid_args", "Missing userId");
+			if (!subject) return failure("invalid_args", "Missing subject");
 			return await this.identityStore.unlinkSubjectFromUserId({
 				userId,
 				subject
 			});
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: errorMessage(error) || "Failed to unlink identity"
-			};
+			return failure("internal", errorMessage(error) || "Failed to unlink identity");
 		}
 	}
 	async resolveOidcWalletId(input) {

package/dist/esm/router/cloudflare/d1/near/d1NearPublicKeyStore.js

@@ -1,5 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { parseNearPublicKey } from "../webauthn/d1WebAuthnRecords.js";
 import { NEAR_PUBLIC_KEYS_BY_USER_SQL } from "../../../../core/NearPublicKeyStore.js";
 //#region src/router/cloudflare/d1/near/d1NearPublicKeyStore.ts
@@ -10,21 +11,13 @@ var CloudflareD1NearPublicKeyStore = class {
 	async listForRelayUser(input) {
 		try {
 			const userId = normalizeOptionalTrimmedString(input.userId);
-			if (!userId) return {
-				ok: false,
-				code: "invalid_args",
-				message: "Missing userId"
-			};
+			if (!userId) return failure("invalid_args", "Missing userId");
 			return {
 				ok: true,
 				keys: (await this.listForUser(userId)).map(nearPublicKeyForRelayResponse)
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: nearPublicKeyErrorMessage(error) || "Failed to list keys"
-			};
+			return failure("internal", nearPublicKeyErrorMessage(error) || "Failed to list keys");
 		}
 	}
 	async listForUser(userId) {

package/dist/esm/router/cloudflare/d1/oidc/d1OidcBoundary.js

@@ -2,7 +2,9 @@ import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
 import "../../../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
-import { toArrayBufferCopy, toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
+import { failedVerification } from "../../../../shared-ts/src/utils/failure.js";
+import { toArrayBufferCopy } from "../../../../core/authService/portableCrypto.js";
+import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
 //#region src/router/cloudflare/d1/oidc/d1OidcBoundary.ts
 function parseJwtAud(input) {
 	const values = [];
@@ -75,43 +77,18 @@ var CloudflareD1OidcJwksCache = class {
 };
 function parseRs256JwtForVerification(input) {
 	const parts = input.token.split(".");
-	if (parts.length !== 3) return {
-		ok: false,
-		verified: false,
-		code: "invalid_body",
-		message: `${input.tokenLabel} must be a JWT (3 segments)`
-	};
+	if (parts.length !== 3) return failedVerification("invalid_body", `${input.tokenLabel} must be a JWT (3 segments)`);
 	const headerB64u = parts[0] || "";
 	const payloadB64u = parts[1] || "";
 	const signatureB64u = parts[2] || "";
 	const header = parseJwtSegmentJson(headerB64u);
-	if (!header) return {
-		ok: false,
-		verified: false,
-		code: "invalid_body",
-		message: `Invalid ${input.tokenLabel} header encoding`
-	};
+	if (!header) return failedVerification("invalid_body", `Invalid ${input.tokenLabel} header encoding`);
 	const payload = parseJwtSegmentJson(payloadB64u);
-	if (!payload) return {
-		ok: false,
-		verified: false,
-		code: "invalid_body",
-		message: `Invalid ${input.tokenLabel} payload encoding`
-	};
+	if (!payload) return failedVerification("invalid_body", `Invalid ${input.tokenLabel} payload encoding`);
 	const kid = normalizeOptionalTrimmedString(header.kid);
 	const alg = normalizeOptionalTrimmedString(header.alg);
-	if (!kid) return {
-		ok: false,
-		verified: false,
-		code: "invalid_body",
-		message: `${input.tokenLabel} header.kid is required`
-	};
-	if (alg !== "RS256") return {
-		ok: false,
-		verified: false,
-		code: "invalid_body",
-		message: `${input.tokenLabel} header.alg must be RS256`
-	};
+	if (!kid) return failedVerification("invalid_body", `${input.tokenLabel} header.kid is required`);
+	if (alg !== "RS256") return failedVerification("invalid_body", `${input.tokenLabel} header.alg must be RS256`);
 	return {
 		ok: true,
 		jwt: {
@@ -128,24 +105,14 @@ async function verifyRs256JwtSignature(input) {
 	try {
 		signatureBytes = base64UrlDecode(input.jwt.signatureB64u);
 	} catch {
-		return {
-			ok: false,
-			verified: false,
-			code: "invalid_body",
-			message: `Invalid ${input.tokenLabel} signature encoding`
-		};
+		return failedVerification("invalid_body", `Invalid ${input.tokenLabel} signature encoding`);
 	}
 	const dataBytes = new TextEncoder().encode(`${input.jwt.headerB64u}.${input.jwt.payloadB64u}`);
 	const key = await input.subtle.importKey("jwk", input.jwk, {
 		name: "RSASSA-PKCS1-v1_5",
 		hash: "SHA-256"
 	}, false, ["verify"]);
-	if (!await input.subtle.verify({ name: "RSASSA-PKCS1-v1_5" }, key, toArrayBufferCopy(signatureBytes), toArrayBufferCopy(dataBytes))) return {
-		ok: false,
-		verified: false,
-		code: "invalid_signature",
-		message: input.invalidSignatureMessage
-	};
+	if (!await input.subtle.verify({ name: "RSASSA-PKCS1-v1_5" }, key, toArrayBufferCopy(signatureBytes), toArrayBufferCopy(dataBytes))) return failedVerification("invalid_signature", input.invalidSignatureMessage);
 	return { ok: true };
 }
 function parseBooleanJwtClaim(input) {
@@ -157,61 +124,21 @@ function parseBooleanJwtClaim(input) {
 function validateGoogleIdTokenClaims(input) {
 	const payload = input.payload;
 	const iss = normalizeOptionalTrimmedString(payload.iss);
-	if (iss !== "https://accounts.google.com" && iss !== "accounts.google.com") return {
-		ok: false,
-		verified: false,
-		code: "invalid_issuer",
-		message: "Invalid Google id_token issuer"
-	};
+	if (iss !== "https://accounts.google.com" && iss !== "accounts.google.com") return failedVerification("invalid_issuer", "Invalid Google id_token issuer");
 	const nowSec = Math.floor(Date.now() / 1e3);
 	const exp = Number(payload.exp);
-	if (!Number.isFinite(exp) || exp <= 0) return {
-		ok: false,
-		verified: false,
-		code: "invalid_claims",
-		message: "Invalid Google id_token exp"
-	};
-	if (nowSec >= exp) return {
-		ok: false,
-		verified: false,
-		code: "expired",
-		message: "Google id_token is expired"
-	};
+	if (!Number.isFinite(exp) || exp <= 0) return failedVerification("invalid_claims", "Invalid Google id_token exp");
+	if (nowSec >= exp) return failedVerification("expired", "Google id_token is expired");
 	if (payload.nbf !== void 0) {
 		const nbf = Number(payload.nbf);
-		if (!Number.isFinite(nbf)) return {
-			ok: false,
-			verified: false,
-			code: "invalid_claims",
-			message: "Invalid Google id_token nbf"
-		};
-		if (nowSec < nbf) return {
-			ok: false,
-			verified: false,
-			code: "not_yet_valid",
-			message: "Google id_token is not yet valid"
-		};
+		if (!Number.isFinite(nbf)) return failedVerification("invalid_claims", "Invalid Google id_token nbf");
+		if (nowSec < nbf) return failedVerification("not_yet_valid", "Google id_token is not yet valid");
 	}
 	const aud = parseJwtAud(payload.aud);
-	if (aud.length === 0) return {
-		ok: false,
-		verified: false,
-		code: "invalid_claims",
-		message: "Missing Google id_token aud"
-	};
-	if (!aud.includes(input.clientId)) return {
-		ok: false,
-		verified: false,
-		code: "invalid_audience",
-		message: "Google id_token audience mismatch"
-	};
+	if (aud.length === 0) return failedVerification("invalid_claims", "Missing Google id_token aud");
+	if (!aud.includes(input.clientId)) return failedVerification("invalid_audience", "Google id_token audience mismatch");
 	const sub = normalizeOptionalTrimmedString(payload.sub);
-	if (!sub) return {
-		ok: false,
-		verified: false,
-		code: "invalid_claims",
-		message: "Missing Google id_token sub"
-	};
+	if (!sub) return failedVerification("invalid_claims", "Missing Google id_token sub");
 	const email = normalizeOptionalTrimmedString(payload.email);
 	const name = normalizeOptionalTrimmedString(payload.name);
 	const givenName = normalizeOptionalTrimmedString(payload.given_name);

package/dist/esm/router/cloudflare/d1/oidc/d1OidcVerificationService.js

@@ -1,5 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
+import { failedVerification } from "../../../../shared-ts/src/utils/failure.js";
 import { CloudflareD1OidcJwksCache, parseRs256JwtForVerification, validateGoogleIdTokenClaims, verifyRs256JwtSignature } from "./d1OidcBoundary.js";
 import { githubOAuthPublicConfig, verifyGithubOAuthCodeWithIdentityStore } from "../../../../core/authService/githubOAuth.js";
 //#region src/router/cloudflare/d1/oidc/d1OidcVerificationService.ts
@@ -45,26 +46,11 @@ var CloudflareD1OidcVerificationService = class {
 	async verifyGoogleIdToken(input, linkIdentity) {
 		try {
 			const clientId = normalizeOptionalTrimmedString(this.googleOidcClientId);
-			if (!clientId) return {
-				ok: false,
-				verified: false,
-				code: "not_configured",
-				message: "Google OIDC is not configured on this Worker"
-			};
+			if (!clientId) return failedVerification("not_configured", "Google OIDC is not configured on this Worker");
 			const idToken = normalizeOptionalTrimmedString(input.idToken ?? input.id_token);
-			if (!idToken) return {
-				ok: false,
-				verified: false,
-				code: "invalid_body",
-				message: "id_token is required"
-			};
+			if (!idToken) return failedVerification("invalid_body", "id_token is required");
 			const subtle = globalThis.crypto?.subtle;
-			if (!subtle) return {
-				ok: false,
-				verified: false,
-				code: "unsupported",
-				message: "WebCrypto (crypto.subtle) is unavailable in this runtime"
-			};
+			if (!subtle) return failedVerification("unsupported", "WebCrypto (crypto.subtle) is unavailable in this runtime");
 			const parsed = parseRs256JwtForVerification({
 				token: idToken,
 				tokenLabel: "id_token"
@@ -72,12 +58,7 @@ var CloudflareD1OidcVerificationService = class {
 			if (!parsed.ok) return parsed;
 			const jwt = parsed.jwt;
 			const jwk = (await this.oidcJwksCache.getGoogleJwks()).keysByKid.get(jwt.kid);
-			if (!jwk) return {
-				ok: false,
-				verified: false,
-				code: "unknown_kid",
-				message: "Unknown Google key id (kid)"
-			};
+			if (!jwk) return failedVerification("unknown_kid", "Unknown Google key id (kid)");
 			const signature = await verifyRs256JwtSignature({
 				subtle,
 				jwt,
@@ -106,12 +87,7 @@ var CloudflareD1OidcVerificationService = class {
 				...claims.hostedDomain ? { hostedDomain: claims.hostedDomain } : {}
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				verified: false,
-				code: "internal",
-				message: errorMessage(error) || "Google OIDC verification failed"
-			};
+			return failedVerification("internal", errorMessage(error) || "Google OIDC verification failed");
 		}
 	}
 	async linkGoogleIdentity(providerSubject) {