@seams/wallet-server 0.7.1 → 0.7.3

package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPersistence.js

@@ -1,4 +1,5 @@
 import { ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { hasExactKeys } from "../../../../shared-ts/src/utils/exactKeys.js";
 import { parseRouterAbEd25519YaoProductRegistrationStateV1 } from "./routerAbEd25519YaoProductRegistration.js";
 //#region src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPersistence.ts
 /** Bind the generic JSON adapter to the validated opaque ceremony key. */
@@ -194,7 +195,7 @@ function decodeRouterAbEd25519YaoProductRegistrationStateValueV1(value) {
 	};
 }
 function decodeRouterAbEd25519YaoProductRegistrationBytesV1(value) {
-	if (!hasExactRouterAbEd25519YaoProductRegistrationJsonKeys(value, ["__seamsType", "values"]) || value.__seamsType !== BYTES_KIND || !Array.isArray(value.values)) return { ok: false };
+	if (!hasExactKeys(value, ["__seamsType", "values"]) || value.__seamsType !== BYTES_KIND || !Array.isArray(value.values)) return { ok: false };
 	const bytes = [];
 	for (const entry of value.values) {
 		if (typeof entry !== "number" || !Number.isSafeInteger(entry) || entry < 0 || entry > 255) return { ok: false };
@@ -206,7 +207,7 @@ function decodeRouterAbEd25519YaoProductRegistrationBytesV1(value) {
 	};
 }
 function decodeRouterAbEd25519YaoProductRegistrationMapV1(value) {
-	if (!hasExactRouterAbEd25519YaoProductRegistrationJsonKeys(value, ["__seamsType", "entries"]) || value.__seamsType !== MAP_KIND || !Array.isArray(value.entries)) return { ok: false };
+	if (!hasExactKeys(value, ["__seamsType", "entries"]) || value.__seamsType !== MAP_KIND || !Array.isArray(value.entries)) return { ok: false };
 	const map = /* @__PURE__ */ new Map();
 	const keys = /* @__PURE__ */ new Set();
 	for (const entry of value.entries) {
@@ -223,7 +224,7 @@ function decodeRouterAbEd25519YaoProductRegistrationMapV1(value) {
 	};
 }
 function decodeRouterAbEd25519YaoProductRegistrationSetV1(value) {
-	if (!hasExactRouterAbEd25519YaoProductRegistrationJsonKeys(value, ["__seamsType", "values"]) || value.__seamsType !== SET_KIND || !Array.isArray(value.values)) return { ok: false };
+	if (!hasExactKeys(value, ["__seamsType", "values"]) || value.__seamsType !== SET_KIND || !Array.isArray(value.values)) return { ok: false };
 	const set = /* @__PURE__ */ new Set();
 	const encodedEntries = /* @__PURE__ */ new Set();
 	for (const entry of value.values) {
@@ -255,11 +256,7 @@ function readRouterAbEd25519YaoCeremonyKeyObjectV1(input) {
 }
 function exactRouterAbEd25519YaoProductRegistrationStateEnvelopeV1(input) {
 	if (!isRouterAbEd25519YaoProductRegistrationJsonObjectV1(input)) return null;
-	return hasExactRouterAbEd25519YaoProductRegistrationJsonKeys(input, ["kind", "state"]) ? input : null;
-}
-function hasExactRouterAbEd25519YaoProductRegistrationJsonKeys(input, fields) {
-	const actual = Object.keys(input);
-	return actual.length === fields.length && actual.every((field) => fields.some((expectedField) => expectedField === field));
+	return hasExactKeys(input, ["kind", "state"]) ? input : null;
 }
 function assertNever(value) {
 	throw new Error(`Unsupported Ed25519 Yao ceremony field: ${String(value)}`);

package/dist/esm/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryWalletSessionAuthorization.js

@@ -1,7 +1,7 @@
 import { NEAR_ED25519_MPC_OPERATION_KINDS } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { sameRouterAbEd25519YaoByteSequence } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
 import { walletSessionFailureMessage } from "../../../auth/walletSessionFailure.js";
 import { resolveWalletSessionAuthorizationV2Admission } from "../../signingOperations/walletExecutionAdmission.js";
@@ -16,9 +16,6 @@ function authorizationFailure(input) {
 		message: input.message
 	};
 }
-function sameRouterAbEd25519YaoByteSequenceV1(left, right) {
-	return left.length === right.length && left.every((value, index) => value === right[index]);
-}
 function sameRouterAbEd25519YaoApplicationBindingV1(left, right) {
 	return left.wallet_id === right.wallet_id && left.near_ed25519_signing_key_id === right.near_ed25519_signing_key_id && left.signing_root_id === right.signing_root_id && left.key_creation_signer_slot === right.key_creation_signer_slot;
 }
@@ -28,7 +25,7 @@ async function entryMatchesAdmission(input) {
 		keySetId: input.entry.keySetId
 	});
 	const basis = input.entry.recoveryBasis;
-	return String(input.prepared.walletId) === input.request.scope.account_id && String(input.prepared.walletId) === input.request.application_binding.wallet_id && input.request.scope.lifecycle_id === expectedLifecycleId && input.request.scope.threshold_session_id === `${expectedLifecycleId}:threshold-session` && input.request.scope.root_share_epoch === basis.scope.root_share_epoch && input.request.scope.account_id === basis.scope.account_id && input.request.scope.signer_set_id === basis.scope.signer_set_id && input.request.scope.signing_worker_id === basis.scope.signing_worker_id && sameRouterAbMpcMaterialActivationRef(input.request.active_material_activation, basis.activeMaterialActivation) && sameRouterAbEd25519YaoApplicationBindingV1(input.request.application_binding, basis.applicationBinding) && input.request.participant_ids[0] === basis.participantIds[0] && input.request.participant_ids[1] === basis.participantIds[1] && sameRouterAbEd25519YaoByteSequenceV1(input.request.active_capability_binding, basis.activeCapabilityBinding) && sameRouterAbEd25519YaoByteSequenceV1(input.request.registered_public_key, basis.registeredPublicKey);
+	return String(input.prepared.walletId) === input.request.scope.account_id && String(input.prepared.walletId) === input.request.application_binding.wallet_id && input.request.scope.lifecycle_id === expectedLifecycleId && input.request.scope.threshold_session_id === `${expectedLifecycleId}:threshold-session` && input.request.scope.root_share_epoch === basis.scope.root_share_epoch && input.request.scope.account_id === basis.scope.account_id && input.request.scope.signer_set_id === basis.scope.signer_set_id && input.request.scope.signing_worker_id === basis.scope.signing_worker_id && sameRouterAbMpcMaterialActivationRef(input.request.active_material_activation, basis.activeMaterialActivation) && sameRouterAbEd25519YaoApplicationBindingV1(input.request.application_binding, basis.applicationBinding) && input.request.participant_ids[0] === basis.participantIds[0] && input.request.participant_ids[1] === basis.participantIds[1] && sameRouterAbEd25519YaoByteSequence(input.request.active_capability_binding, basis.activeCapabilityBinding) && sameRouterAbEd25519YaoByteSequence(input.request.registered_public_key, basis.registeredPublicKey);
 }
 async function authorizePreparedRecovery(input) {
 	const challengeId = String(input.request.request.headers.get("x-seams-wallet-recovery-challenge-id") || "").trim();
@@ -249,7 +246,7 @@ function exactRecoveryAdmissionMatches(input) {
 	const identity = input.activeMaterial.exportIdentity;
 	const walletId = String(input.admission.context.authorization.session.walletId);
 	const registeredPublicKeyB64u = base64UrlEncode(Uint8Array.from(identity.registered_public_key));
-	return String(input.admission.admission.signer.walletId) === walletId && registeredPublicKeyB64u === input.admission.admission.signer.registeredPublicKeyB64u && request.scope.account_id === walletId && request.application_binding.wallet_id === walletId && sameRouterAbMpcMaterialActivationRef(request.active_material_activation, input.materialActivation) && sameRouterAbMpcMaterialActivationRef(input.activeMaterial.materialActivation, input.materialActivation) && sameRouterAbMpcMaterialActivationRef(identity.scope.material_activation, input.materialActivation) && request.scope.root_share_epoch === identity.scope.root_share_epoch && request.scope.account_id === identity.scope.account_id && request.scope.threshold_session_id === identity.scope.threshold_session_id && request.scope.signer_set_id === identity.scope.signer_set_id && request.scope.signing_worker_id === identity.scope.signing_worker_id && input.activeMaterial.runtimePolicyScope.signingRootVersion === request.scope.root_share_epoch && input.activeMaterial.nearAccountId.length > 0 && input.activeMaterial.signerSlot === request.application_binding.key_creation_signer_slot && input.activeMaterial.signingWorkerId === request.scope.signing_worker_id && sameRouterAbEd25519YaoApplicationBindingV1(request.application_binding, identity.application_binding) && request.participant_ids[0] === input.activeMaterial.participantIds[0] && request.participant_ids[1] === input.activeMaterial.participantIds[1] && request.participant_ids[0] === identity.participant_ids[0] && request.participant_ids[1] === identity.participant_ids[1] && sameRouterAbEd25519YaoByteSequenceV1(request.registered_public_key, identity.registered_public_key);
+	return String(input.admission.admission.signer.walletId) === walletId && registeredPublicKeyB64u === input.admission.admission.signer.registeredPublicKeyB64u && request.scope.account_id === walletId && request.application_binding.wallet_id === walletId && sameRouterAbMpcMaterialActivationRef(request.active_material_activation, input.materialActivation) && sameRouterAbMpcMaterialActivationRef(input.activeMaterial.materialActivation, input.materialActivation) && sameRouterAbMpcMaterialActivationRef(identity.scope.material_activation, input.materialActivation) && request.scope.root_share_epoch === identity.scope.root_share_epoch && request.scope.account_id === identity.scope.account_id && request.scope.threshold_session_id === identity.scope.threshold_session_id && request.scope.signer_set_id === identity.scope.signer_set_id && request.scope.signing_worker_id === identity.scope.signing_worker_id && input.activeMaterial.runtimePolicyScope.signingRootVersion === request.scope.root_share_epoch && input.activeMaterial.nearAccountId.length > 0 && input.activeMaterial.signerSlot === request.application_binding.key_creation_signer_slot && input.activeMaterial.signingWorkerId === request.scope.signing_worker_id && sameRouterAbEd25519YaoApplicationBindingV1(request.application_binding, identity.application_binding) && request.participant_ids[0] === input.activeMaterial.participantIds[0] && request.participant_ids[1] === input.activeMaterial.participantIds[1] && request.participant_ids[0] === identity.participant_ids[0] && request.participant_ids[1] === identity.participant_ids[1] && sameRouterAbEd25519YaoByteSequence(request.registered_public_key, identity.registered_public_key);
 }
 async function authorizeV2RecoveryAdmission(input) {
 	const resolved = await resolveExactEd25519OperationCredentialMaterial({

package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationIntentAuthorization.js

@@ -1,6 +1,7 @@
 import { sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { deriveRouterAbEd25519YaoStableContextBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519YaoDigests.js";
 import { deriveSigningRootId } from "../../../../shared-ts/src/threshold/signingRootScope.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { computeAddSignerNearEd25519SigningKeyId } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { findRegistrationSignerPlanNearEd25519Branch, registrationNearEd25519BranchKey, registrationSignerPlanFromSelection } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
 //#region src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationIntentAuthorization.ts
@@ -217,21 +218,9 @@ var InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter = class {
 	}
 	async bindVerifiedIntent(verified) {
 		const credential = activationIntentCredential(verified);
-		if (!VERIFIED_INTENT_CREDENTIAL.test(credential)) return {
-			ok: false,
-			code: "invalid_registration_intent",
-			message: "registration intent grant is not a canonical Bearer credential"
-		};
-		if (!Number.isSafeInteger(verified.expiresAtMs) || verified.expiresAtMs <= Date.now()) return {
-			ok: false,
-			code: "invalid_registration_intent",
-			message: "registration intent authority is expired"
-		};
-		if (!await activationIntentMatchesAdmission(verified)) return {
-			ok: false,
-			code: "invalid_registration_intent",
-			message: "registration intent does not match the Ed25519 Yao admission subject"
-		};
+		if (!VERIFIED_INTENT_CREDENTIAL.test(credential)) return failure("invalid_registration_intent", "registration intent grant is not a canonical Bearer credential");
+		if (!Number.isSafeInteger(verified.expiresAtMs) || verified.expiresAtMs <= Date.now()) return failure("invalid_registration_intent", "registration intent authority is expired");
+		if (!await activationIntentMatchesAdmission(verified)) return failure("invalid_registration_intent", "registration intent does not match the Ed25519 Yao admission subject");
 		const credentialDigest = await credentialDigestSha256(credential);
 		const purpose = activationIntentPurpose(verified);
 		const copiedAdmissionRequest = copyAdmissionRequest(verified.admissionRequest);
@@ -245,11 +234,7 @@ var InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter = class {
 			return exactRetry ? {
 				ok: true,
 				admissionRequest: copyAdmissionRequest(existing.admissionRequest)
-			} : {
-				ok: false,
-				code: "registration_intent_conflict",
-				message: "registration intent credential or lifecycle is already bound"
-			};
+			} : failure("registration_intent_conflict", "registration intent credential or lifecycle is already bound");
 		}
 		this.authorities.push({
 			kind: "available",
@@ -266,11 +251,7 @@ var InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter = class {
 	}
 	async bindVerifiedContinuation(verified) {
 		const existing = findAuthorityByLifecycleId(this.authorities, verified.admissionRequest.scope.lifecycle_id);
-		if (!existing || existing.authority.purpose !== "wallet_registration" || existing.authority.admissionFingerprint !== canonicalAdmissionRequest(verified.admissionRequest) || !Number.isSafeInteger(verified.expiresAtMs) || verified.expiresAtMs <= Date.now() || !verified.credential.startsWith("wst_") || !VERIFIED_INTENT_CREDENTIAL.test(verified.credential)) return {
-			ok: false,
-			code: "registration_intent_conflict",
-			message: "NEAR continuation does not match its original authorization"
-		};
+		if (!existing || existing.authority.purpose !== "wallet_registration" || existing.authority.admissionFingerprint !== canonicalAdmissionRequest(verified.admissionRequest) || !Number.isSafeInteger(verified.expiresAtMs) || verified.expiresAtMs <= Date.now() || !verified.credential.startsWith("wst_") || !VERIFIED_INTENT_CREDENTIAL.test(verified.credential)) return failure("registration_intent_conflict", "NEAR continuation does not match its original authorization");
 		this.authorities[existing.index] = {
 			kind: existing.authority.kind,
 			purpose: existing.authority.purpose,

package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js

@@ -1,3 +1,4 @@
+import { hasExactKeys } from "../../../../shared-ts/src/utils/exactKeys.js";
 //#region src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.ts
 const SIDE_EFFECT_CLAIM_FIELDS = [
 	"kind",
@@ -34,79 +35,66 @@ function throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1(failure) {
 function parseRouterAbEd25519YaoRegistrationSideEffectRecordV2(raw, input) {
 	const record = readRouterAbEd25519YaoRegistrationSideEffectRecordObjectV1(raw);
 	if (record === null || record.operation !== input.operation) return null;
-	if (record.kind === "router_ab_ed25519_yao_registration_side_effect_claim_v1") {
-		if (!hasExactRouterAbEd25519YaoRegistrationSideEffectRecordKeys(record, SIDE_EFFECT_CLAIM_FIELDS)) return null;
-		const requestFingerprint = parseFingerprint(record.requestFingerprint);
-		const preparedArtifactFingerprint = parsePreparedFingerprint(record.preparedArtifactFingerprint);
-		const claimedAtMs = parseTimestamp(record.claimedAtMs);
-		const prepared = input.parsePrepared(record.prepared);
-		if (requestFingerprint === null || preparedArtifactFingerprint === null || claimedAtMs === null || prepared === null) return null;
-		return {
-			kind: "router_ab_ed25519_yao_registration_side_effect_claim_v1",
-			operation: input.operation,
-			requestFingerprint,
-			preparedArtifactFingerprint,
-			claimedAtMs,
-			prepared
-		};
-	}
-	if (record.kind !== "router_ab_ed25519_yao_registration_side_effect_completion_v2" || !hasExactRouterAbEd25519YaoRegistrationSideEffectRecordKeys(record, SIDE_EFFECT_COMPLETION_V2_FIELDS)) return null;
-	const requestFingerprint = parseFingerprint(record.requestFingerprint);
-	const preparedArtifactFingerprint = parsePreparedFingerprint(record.preparedArtifactFingerprint);
-	const claimedAtMs = parseTimestamp(record.claimedAtMs);
-	const prepared = input.parsePrepared(record.prepared);
-	if (requestFingerprint === null || preparedArtifactFingerprint === null || claimedAtMs === null || prepared === null) return null;
+	if (record.kind === "router_ab_ed25519_yao_registration_side_effect_claim_v1") return parseRouterAbEd25519YaoRegistrationSideEffectClaimV1(record, input);
+	if (record.kind !== "router_ab_ed25519_yao_registration_side_effect_completion_v2" || !hasExactKeys(record, SIDE_EFFECT_COMPLETION_V2_FIELDS)) return null;
+	const claim = parseRouterAbEd25519YaoRegistrationSideEffectClaimFields(record, input.parsePrepared);
+	if (claim === null) return null;
 	const completedAtMs = parseTimestamp(record.completedAtMs);
 	const receipt = input.parseReceipt(record.receipt);
 	if (completedAtMs === null || receipt === null) return null;
 	return {
 		kind: "router_ab_ed25519_yao_registration_side_effect_completion_v2",
 		operation: input.operation,
-		requestFingerprint,
-		preparedArtifactFingerprint,
-		claimedAtMs,
+		requestFingerprint: claim.requestFingerprint,
+		preparedArtifactFingerprint: claim.preparedArtifactFingerprint,
+		claimedAtMs: claim.claimedAtMs,
 		completedAtMs,
-		prepared,
+		prepared: claim.prepared,
 		receipt
 	};
 }
 function parseRouterAbEd25519YaoRegistrationSideEffectRecordV1(raw, input) {
 	const record = readRouterAbEd25519YaoRegistrationSideEffectRecordObjectV1(raw);
 	if (record === null || record.operation !== input.operation) return null;
-	if (record.kind === "router_ab_ed25519_yao_registration_side_effect_claim_v1") {
-		if (!hasExactRouterAbEd25519YaoRegistrationSideEffectRecordKeys(record, SIDE_EFFECT_CLAIM_FIELDS)) return null;
-		const requestFingerprint = parseFingerprint(record.requestFingerprint);
-		const preparedArtifactFingerprint = parsePreparedFingerprint(record.preparedArtifactFingerprint);
-		const claimedAtMs = parseTimestamp(record.claimedAtMs);
-		const prepared = input.parsePrepared(record.prepared);
-		if (requestFingerprint === null || preparedArtifactFingerprint === null || claimedAtMs === null || prepared === null) return null;
-		return {
-			kind: "router_ab_ed25519_yao_registration_side_effect_claim_v1",
-			operation: input.operation,
-			requestFingerprint,
-			preparedArtifactFingerprint,
-			claimedAtMs,
-			prepared
-		};
-	}
-	if (record.kind !== "router_ab_ed25519_yao_registration_side_effect_completion_v1" || !hasExactRouterAbEd25519YaoRegistrationSideEffectRecordKeys(record, SIDE_EFFECT_COMPLETION_V1_FIELDS)) return null;
-	const requestFingerprint = parseFingerprint(record.requestFingerprint);
-	const preparedArtifactFingerprint = parsePreparedFingerprint(record.preparedArtifactFingerprint);
-	const claimedAtMs = parseTimestamp(record.claimedAtMs);
-	const prepared = input.parsePrepared(record.prepared);
-	if (requestFingerprint === null || preparedArtifactFingerprint === null || claimedAtMs === null || prepared === null) return null;
+	if (record.kind === "router_ab_ed25519_yao_registration_side_effect_claim_v1") return parseRouterAbEd25519YaoRegistrationSideEffectClaimV1(record, input);
+	if (record.kind !== "router_ab_ed25519_yao_registration_side_effect_completion_v1" || !hasExactKeys(record, SIDE_EFFECT_COMPLETION_V1_FIELDS)) return null;
+	const claim = parseRouterAbEd25519YaoRegistrationSideEffectClaimFields(record, input.parsePrepared);
+	if (claim === null) return null;
 	const completedAtMs = parseTimestamp(record.completedAtMs);
 	const response = input.parseResponse(record.response);
 	if (completedAtMs === null || response === null) return null;
 	return {
 		kind: "router_ab_ed25519_yao_registration_side_effect_completion_v1",
 		operation: input.operation,
+		requestFingerprint: claim.requestFingerprint,
+		preparedArtifactFingerprint: claim.preparedArtifactFingerprint,
+		claimedAtMs: claim.claimedAtMs,
+		completedAtMs,
+		prepared: claim.prepared,
+		response
+	};
+}
+function parseRouterAbEd25519YaoRegistrationSideEffectClaimV1(record, input) {
+	if (!hasExactKeys(record, SIDE_EFFECT_CLAIM_FIELDS)) return null;
+	const claim = parseRouterAbEd25519YaoRegistrationSideEffectClaimFields(record, input.parsePrepared);
+	if (claim === null) return null;
+	return {
+		kind: "router_ab_ed25519_yao_registration_side_effect_claim_v1",
+		operation: input.operation,
+		...claim
+	};
+}
+function parseRouterAbEd25519YaoRegistrationSideEffectClaimFields(record, parsePrepared) {
+	const requestFingerprint = parseFingerprint(record.requestFingerprint);
+	const preparedArtifactFingerprint = parsePreparedFingerprint(record.preparedArtifactFingerprint);
+	const claimedAtMs = parseTimestamp(record.claimedAtMs);
+	const prepared = parsePrepared(record.prepared);
+	if (requestFingerprint === null || preparedArtifactFingerprint === null || claimedAtMs === null || prepared === null) return null;
+	return {
 		requestFingerprint,
 		preparedArtifactFingerprint,
 		claimedAtMs,
-		completedAtMs,
-		prepared,
-		response
+		prepared
 	};
 }
 /**
@@ -403,10 +391,6 @@ function readRouterAbEd25519YaoRegistrationSideEffectRecordObjectV1(value) {
 function isRouterAbEd25519YaoRegistrationSideEffectRecordObjectV1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function hasExactRouterAbEd25519YaoRegistrationSideEffectRecordKeys(record, expectedKeys) {
-	const actualKeys = Object.keys(record);
-	return actualKeys.length === expectedKeys.length && actualKeys.every((key) => expectedKeys.some((expectedKey) => expectedKey === key));
-}
 function parseFingerprint(value) {
 	return typeof value === "string" && /^[a-zA-Z0-9_-]{32,128}$/u.test(value) ? value : null;
 }

package/dist/esm/router/domains/emailOtp/emailOtpRouteHandlers.js

@@ -2,9 +2,10 @@ import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/b
 import "../../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
+import { failure } from "../../../shared-ts/src/utils/failure.js";
 import { emailOtpStatusCode } from "./emailOtpSessionRouteHelpers.js";
+import { EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN_V1 } from "../../../shared-ts/src/utils/emailOtpDomain.js";
 //#region src/router/domains/emailOtp/emailOtpRouteHandlers.ts
-const EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN = "seams/email-otp/factor-release/v1";
 function decodeEmailOtpFactorSecret32(value) {
 	const magnitude = base64UrlDecode(value);
 	if (magnitude.length === 0 || magnitude.length > 32) {
@@ -18,7 +19,7 @@ function decodeEmailOtpFactorSecret32(value) {
 }
 function emailOtpFactorReleaseAad(input) {
 	return new TextEncoder().encode([
-		EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN,
+		EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN_V1,
 		input.walletId,
 		input.enrollmentId,
 		input.enrollmentSealKeyVersion,
@@ -32,19 +33,11 @@ async function sealEmailOtpFactorSecretForWorker(input) {
 		factorSecret32 = decodeEmailOtpFactorSecret32(input.factorSecret32B64u);
 		workerPublicKey65 = base64UrlDecode(input.workerEphemeralPublicKey65B64u);
 	} catch {
-		return {
-			ok: false,
-			code: "invalid_body",
-			message: "Email OTP factor release key is invalid"
-		};
+		return failure("invalid_body", "Email OTP factor release key is invalid");
 	}
 	if (workerPublicKey65.length !== 65 || workerPublicKey65[0] !== 4) {
 		factorSecret32.fill(0);
-		return {
-			ok: false,
-			code: "invalid_body",
-			message: "Email OTP factor release key is invalid"
-		};
+		return failure("invalid_body", "Email OTP factor release key is invalid");
 	}
 	try {
 		const workerPublicKey = await crypto.subtle.importKey("raw", workerPublicKey65, {
@@ -76,11 +69,7 @@ async function sealEmailOtpFactorSecretForWorker(input) {
 			ciphertextB64u: base64UrlEncode(ciphertext)
 		};
 	} catch {
-		return {
-			ok: false,
-			code: "factor_release_failed",
-			message: "Email OTP factor release encryption failed"
-		};
+		return failure("factor_release_failed", "Email OTP factor release encryption failed");
 	} finally {
 		factorSecret32.fill(0);
 	}
@@ -92,11 +81,7 @@ async function handleEmailOtpDevCleanupGoogleRegistrationRoute(input) {
 		const code = verified.code || "not_verified";
 		return {
 			status: code === "internal" ? 500 : code === "not_configured" || code === "unsupported" ? 501 : code === "invalid_body" ? 400 : 401,
-			body: {
-				ok: false,
-				code,
-				message: verified.message || "Google login failed"
-			}
+			body: failure(code, verified.message || "Google login failed")
 		};
 	}
 	const runtimePolicyScope = isPlainObject(body.runtimePolicyScope) ? body.runtimePolicyScope : null;
@@ -113,30 +98,18 @@ async function handleEmailOtpDevCleanupGoogleRegistrationRoute(input) {
 async function handleEmailOtpRegistrationSealRoute(input) {
 	if (!isPlainObject(input.body)) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "Invalid body"
-		}
+		body: failure("invalid_body", "Invalid body")
 	};
 	const allowedFields = new Set(["walletId", "wrappedCiphertext"]);
 	for (const field of Object.keys(input.body)) if (!allowedFields.has(field)) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: `Unsupported field: ${field}`
-		}
+		body: failure("invalid_body", `Unsupported field: ${field}`)
 	};
 	const walletId = normalizeOptionalTrimmedString(input.body.walletId);
 	const wrappedCiphertext = normalizeOptionalTrimmedString(input.body.wrappedCiphertext);
 	if (!walletId || !wrappedCiphertext) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing walletId or wrappedCiphertext"
-		}
+		body: failure("invalid_body", "Missing walletId or wrappedCiphertext")
 	};
 	const result = await input.service.applyEmailOtpServerSeal({ wrappedCiphertext });
 	return {
@@ -150,11 +123,7 @@ async function handleEmailOtpRegistrationSealRoute(input) {
 async function handleEmailOtpDevOutboxRoute(input) {
 	if (!isPlainObject(input.body)) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "Invalid body"
-		}
+		body: failure("invalid_body", "Invalid body")
 	};
 	const allowedFields = new Set([
 		"idToken",
@@ -164,11 +133,7 @@ async function handleEmailOtpDevOutboxRoute(input) {
 	]);
 	for (const field of Object.keys(input.body)) if (!allowedFields.has(field)) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: `Unsupported field: ${field}`
-		}
+		body: failure("invalid_body", `Unsupported field: ${field}`)
 	};
 	const idToken = normalizeOptionalTrimmedString(input.body.idToken);
 	const walletId = normalizeOptionalTrimmedString(input.body.walletId);
@@ -176,30 +141,18 @@ async function handleEmailOtpDevOutboxRoute(input) {
 	const challengeSubjectId = normalizeOptionalTrimmedString(input.body.challengeSubjectId);
 	if (!idToken || !walletId) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing idToken or walletId"
-		}
+		body: failure("invalid_body", "Missing idToken or walletId")
 	};
 	if (challengeSubjectId && !challengeId) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "challengeSubjectId requires the exact challengeId it belongs to"
-		}
+		body: failure("invalid_body", "challengeSubjectId requires the exact challengeId it belongs to")
 	};
 	const verified = await input.service.verifyGoogleLogin({ idToken });
 	if (!verified.ok || !verified.verified || !verified.userId) {
 		const code = verified.code || "not_verified";
 		return {
 			status: code === "internal" ? 500 : code === "not_configured" ? 501 : 401,
-			body: {
-				ok: false,
-				code,
-				message: verified.message || "Google login failed"
-			}
+			body: failure(code, verified.message || "Google login failed")
 		};
 	}
 	const result = await input.service.readEmailOtpOutboxEntry({