@seams/wallet-server 0.7.1 → 0.7.3

package/dist/esm/core/IdentityStore.js

@@ -1,5 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
 import { isObject } from "../shared-ts/src/utils/validation.js";
+import { failure } from "../shared-ts/src/utils/failure.js";
 import { resolveStorePrefix } from "./d1TenantStore.js";
 import { createKeyValueStore } from "./storeBackends.js";
 import { D1IdentityStore, IDENTITY_D1_STORE, IDENTITY_STORE_D1_SCHEMA_SQL, ensureIdentityStoreD1Schema } from "./d1IdentityStore.js";
@@ -77,32 +78,16 @@ var InMemoryIdentityStore = class {
 	async linkSubjectToUserId(input) {
 		const userId = normalizeOptionalTrimmedString(input.userId);
 		const subject = normalizeOptionalTrimmedString(input.subject);
-		if (!userId) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing userId"
-		};
-		if (!subject) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing subject"
-		};
+		if (!userId) return failure("invalid_args", "Missing userId");
+		if (!subject) return failure("invalid_args", "Missing subject");
 		const now = Date.now();
 		const existing = this.subjectToUser.get(this.subjectKey(subject)) || null;
 		if (existing && existing.userId !== userId) {
-			if (!input.allowMoveIfSoleIdentity) return {
-				ok: false,
-				code: "already_linked",
-				message: "Subject is already linked to a different user"
-			};
+			if (!input.allowMoveIfSoleIdentity) return failure("already_linked", "Subject is already linked to a different user");
 			const sourceUser = existing.userId;
 			const source = this.userToSubjects.get(this.userKey(sourceUser)) || null;
 			const sourceSubjects = source?.subjects || [];
-			if (sourceSubjects.length !== 1 || sourceSubjects[0] !== subject) return {
-				ok: false,
-				code: "already_linked",
-				message: "Subject is linked to a different user with other identities; merge is not allowed"
-			};
+			if (sourceSubjects.length !== 1 || sourceSubjects[0] !== subject) return failure("already_linked", "Subject is linked to a different user with other identities; merge is not allowed");
 			this.userToSubjects.set(this.userKey(sourceUser), {
 				version: "identity_user_v1",
 				userId: sourceUser,
@@ -158,29 +143,13 @@ var InMemoryIdentityStore = class {
 	async unlinkSubjectFromUserId(input) {
 		const userId = normalizeOptionalTrimmedString(input.userId);
 		const subject = normalizeOptionalTrimmedString(input.subject);
-		if (!userId) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing userId"
-		};
-		if (!subject) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing subject"
-		};
+		if (!userId) return failure("invalid_args", "Missing userId");
+		if (!subject) return failure("invalid_args", "Missing subject");
 		const existing = this.subjectToUser.get(this.subjectKey(subject)) || null;
-		if (!existing || existing.userId !== userId) return {
-			ok: false,
-			code: "not_found",
-			message: "Subject is not linked to this user"
-		};
+		if (!existing || existing.userId !== userId) return failure("not_found", "Subject is not linked to this user");
 		const userRec = this.userToSubjects.get(this.userKey(userId)) || null;
 		const subjects = userRec?.subjects || [];
-		if (subjects.length <= 1) return {
-			ok: false,
-			code: "cannot_unlink_last_identity",
-			message: "Refusing to remove the last remaining identity"
-		};
+		if (subjects.length <= 1) return failure("cannot_unlink_last_identity", "Refusing to remove the last remaining identity");
 		this.subjectToUser.delete(this.subjectKey(subject));
 		const now = Date.now();
 		const nextSubjects = subjects.filter((s) => s !== subject);
@@ -197,22 +166,10 @@ var InMemoryIdentityStore = class {
 	async deleteSubjectLinkForDevCleanup(input) {
 		const userId = normalizeOptionalTrimmedString(input.userId);
 		const subject = normalizeOptionalTrimmedString(input.subject);
-		if (!userId) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing userId"
-		};
-		if (!subject) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing subject"
-		};
+		if (!userId) return failure("invalid_args", "Missing userId");
+		if (!subject) return failure("invalid_args", "Missing subject");
 		const existing = this.subjectToUser.get(this.subjectKey(subject)) || null;
-		if (!existing || existing.userId !== userId) return {
-			ok: false,
-			code: "not_found",
-			message: "Subject is not linked to this user"
-		};
+		if (!existing || existing.userId !== userId) return failure("not_found", "Subject is not linked to this user");
 		this.subjectToUser.delete(this.subjectKey(subject));
 		const now = Date.now();
 		const userRec = this.userToSubjects.get(this.userKey(userId)) || null;
@@ -255,32 +212,16 @@ var KeyValueIdentityStore = class {
 	async linkSubjectToUserId(input) {
 		const userId = normalizeOptionalTrimmedString(input.userId);
 		const subject = normalizeOptionalTrimmedString(input.subject);
-		if (!userId) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing userId"
-		};
-		if (!subject) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing subject"
-		};
+		if (!userId) return failure("invalid_args", "Missing userId");
+		if (!subject) return failure("invalid_args", "Missing subject");
 		const now = Date.now();
 		const existingSubject = parseIdentitySubjectRecord(await this.records.get(this.subjectKey(subject)));
 		if (existingSubject && existingSubject.userId !== userId) {
-			if (!input.allowMoveIfSoleIdentity) return {
-				ok: false,
-				code: "already_linked",
-				message: "Subject is already linked to a different user"
-			};
+			if (!input.allowMoveIfSoleIdentity) return failure("already_linked", "Subject is already linked to a different user");
 			const sourceUser = existingSubject.userId;
 			const sourceUserRec = parseIdentityUserRecord(await this.records.get(this.userKey(sourceUser)));
 			const sourceSubjects = sourceUserRec?.subjects || [];
-			if (sourceSubjects.length !== 1 || sourceSubjects[0] !== subject) return {
-				ok: false,
-				code: "already_linked",
-				message: "Subject is linked to a different user with other identities; merge is not allowed"
-			};
+			if (sourceSubjects.length !== 1 || sourceSubjects[0] !== subject) return failure("already_linked", "Subject is linked to a different user with other identities; merge is not allowed");
 			const destUserRec = parseIdentityUserRecord(await this.records.get(this.userKey(userId)));
 			const destSubjects = Array.from(new Set([...destUserRec?.subjects || [], subject]));
 			destSubjects.sort();
@@ -332,29 +273,13 @@ var KeyValueIdentityStore = class {
 	async unlinkSubjectFromUserId(input) {
 		const userId = normalizeOptionalTrimmedString(input.userId);
 		const subject = normalizeOptionalTrimmedString(input.subject);
-		if (!userId) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing userId"
-		};
-		if (!subject) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing subject"
-		};
+		if (!userId) return failure("invalid_args", "Missing userId");
+		if (!subject) return failure("invalid_args", "Missing subject");
 		const subjectRec = parseIdentitySubjectRecord(await this.records.get(this.subjectKey(subject)));
-		if (!subjectRec || subjectRec.userId !== userId) return {
-			ok: false,
-			code: "not_found",
-			message: "Subject is not linked to this user"
-		};
+		if (!subjectRec || subjectRec.userId !== userId) return failure("not_found", "Subject is not linked to this user");
 		const userRec = parseIdentityUserRecord(await this.records.get(this.userKey(userId)));
 		const subjects = userRec?.subjects || [];
-		if (subjects.length <= 1) return {
-			ok: false,
-			code: "cannot_unlink_last_identity",
-			message: "Refusing to remove the last remaining identity"
-		};
+		if (subjects.length <= 1) return failure("cannot_unlink_last_identity", "Refusing to remove the last remaining identity");
 		const nextSubjects = subjects.filter((s) => s !== subject);
 		nextSubjects.sort();
 		await this.records.set(this.userKey(userId), {
@@ -370,22 +295,10 @@ var KeyValueIdentityStore = class {
 	async deleteSubjectLinkForDevCleanup(input) {
 		const userId = normalizeOptionalTrimmedString(input.userId);
 		const subject = normalizeOptionalTrimmedString(input.subject);
-		if (!userId) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing userId"
-		};
-		if (!subject) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing subject"
-		};
+		if (!userId) return failure("invalid_args", "Missing userId");
+		if (!subject) return failure("invalid_args", "Missing subject");
 		const subjectRec = parseIdentitySubjectRecord(await this.records.get(this.subjectKey(subject)));
-		if (!subjectRec || subjectRec.userId !== userId) return {
-			ok: false,
-			code: "not_found",
-			message: "Subject is not linked to this user"
-		};
+		if (!subjectRec || subjectRec.userId !== userId) return failure("not_found", "Subject is not linked to this user");
 		const userRec = parseIdentityUserRecord(await this.records.get(this.userKey(userId)));
 		const nextSubjects = (userRec?.subjects || []).filter((s) => s !== subject);
 		if (nextSubjects.length > 0) {

package/dist/esm/core/SessionService.js

@@ -1,3 +1,4 @@
+import { failure } from "../shared-ts/src/utils/failure.js";
 //#region src/core/SessionService.ts
 function normalizeParsedCorsOrigin(url) {
 	const host = url.hostname.toLowerCase();
@@ -153,36 +154,16 @@ var SessionService = class {
 	async refresh(headers) {
 		try {
 			const token = this.extractTokenFromHeaders(headers);
-			if (!token) return {
-				ok: false,
-				code: "unauthorized",
-				message: "No session token"
-			};
+			if (!token) return failure("unauthorized", "No session token");
 			const v = await this.verifyJwt(token);
 			if (!v.valid) {
-				if (v.reason === "expired") return {
-					ok: false,
-					code: "wallet_session_expired",
-					message: "Wallet Session expired"
-				};
-				return {
-					ok: false,
-					code: "unauthorized",
-					message: "Invalid token"
-				};
+				if (v.reason === "expired") return failure("wallet_session_expired", "Wallet Session expired");
+				return failure("unauthorized", "Invalid token");
 			}
 			const payload = v.payload || {};
-			if (!this.isWithinRefreshWindow(payload)) return {
-				ok: false,
-				code: "not_eligible",
-				message: "Not within refresh window"
-			};
+			if (!this.isWithinRefreshWindow(payload)) return failure("not_eligible", "Not within refresh window");
 			const sub = String(payload.sub || "");
-			if (!sub) return {
-				ok: false,
-				code: "invalid_claims",
-				message: "Missing sub claim"
-			};
+			if (!sub) return failure("invalid_claims", "Missing sub claim");
 			const extra = {};
 			for (const [k, v] of Object.entries(payload || {})) {
 				if (k === "sub" || k === "exp" || k === "iat" || k === "nbf" || k === "jti" || k === "iss" || k === "aud") continue;
@@ -193,11 +174,7 @@ var SessionService = class {
 				jwt: await this.signJwt(sub, extra)
 			};
 		} catch (e) {
-			return {
-				ok: false,
-				code: "internal",
-				message: e?.message || "Refresh failed"
-			};
+			return failure("internal", e?.message || "Refresh failed");
 		}
 	}
 	nowSeconds() {

package/dist/esm/core/ThresholdService/routerAbNormalSigningPolicy.js

@@ -1,5 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import "../../shared-ts/src/utils/validation.js";
+import { failure } from "../../shared-ts/src/utils/failure.js";
 //#region src/core/ThresholdService/routerAbNormalSigningPolicy.ts
 function parseRouterAbNormalSigningServerPolicy(config) {
 	const signingWorkerId = normalizeOptionalTrimmedString(config.ROUTER_AB_NORMAL_SIGNING_WORKER_ID);
@@ -10,16 +11,8 @@ function parseRouterAbNormalSigningServerPolicy(config) {
 	};
 }
 function validateRouterAbNormalSigningServerPolicy(args) {
-	if (!args.requested) return {
-		ok: false,
-		code: "unauthorized",
-		message: "sessionPolicy.routerAbNormalSigning is required for Router A/B normal signing"
-	};
-	if (args.requested.signingWorkerId !== args.policy.signingWorkerId) return {
-		ok: false,
-		code: "unauthorized",
-		message: "sessionPolicy.routerAbNormalSigning.signingWorkerId is not allowed for this threshold server"
-	};
+	if (!args.requested) return failure("unauthorized", "sessionPolicy.routerAbNormalSigning is required for Router A/B normal signing");
+	if (args.requested.signingWorkerId !== args.policy.signingWorkerId) return failure("unauthorized", "sessionPolicy.routerAbNormalSigning.signingWorkerId is not allowed for this threshold server");
 	return {
 		ok: true,
 		value: null

package/dist/esm/core/ThresholdService/stores/WalletSessionStore.js

@@ -1,12 +1,12 @@
 import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
+import { failure } from "../../../shared-ts/src/utils/failure.js";
 import { parseEcdsaWalletSessionRecord, parseEd25519WalletSessionRecord, toThresholdEcdsaPrefixFromBase, toThresholdEcdsaWalletSessionPrefix, toThresholdEd25519PrefixFromBase, toThresholdEd25519WalletSessionPrefix } from "../validation.js";
 import { RedisTcpClient, UpstashRedisRestClient, redisGetJson, redisSetJson } from "../kv.js";
+import { EXPORT_REPLAY_GUARD_CLOCK_SKEW_MS, EXPORT_REPLAY_GUARD_MIN_RETENTION_MS } from "./exportReplayGuard.js";
 import { createCloudflareDurableObjectThresholdEcdsaStores, createCloudflareDurableObjectThresholdEd25519Stores } from "./CloudflareDurableObjectStore.js";
 import { readNonDurableObjectThresholdStoreKind } from "./StoreConfig.js";
 //#region src/core/ThresholdService/stores/WalletSessionStore.ts
-const EXPORT_REPLAY_GUARD_CLOCK_SKEW_MS = 5 * 6e4;
-const EXPORT_REPLAY_GUARD_MIN_RETENTION_MS = 1440 * 6e4;
 /** A wallet session store's keys: record, use counter, consume-once markers, replay guards. */
 var WalletSessionKeys = class {
 	constructor(keyPrefix) {
@@ -35,18 +35,10 @@ var InMemoryWalletSessionStore = class {
 	liveEntry(id) {
 		const key = this.keys.meta(id);
 		const entry = this.map.get(key);
-		if (!entry) return {
-			ok: false,
-			code: "wallet_session_missing",
-			message: "Wallet Session is missing"
-		};
+		if (!entry) return failure("wallet_session_missing", "Wallet Session is missing");
 		if (entry.expiresAtMs <= Date.now()) {
 			this.map.delete(key);
-			return {
-				ok: false,
-				code: "wallet_session_expired",
-				message: "Wallet Session expired"
-			};
+			return failure("wallet_session_expired", "Wallet Session expired");
 		}
 		return entry;
 	}
@@ -97,11 +89,7 @@ var InMemoryWalletSessionStore = class {
 	async consumeUseCount(id) {
 		const entry = this.liveEntry(id);
 		if ("ok" in entry) return entry;
-		if (entry.remainingUses <= 0) return {
-			ok: false,
-			code: "wallet_budget_exhausted",
-			message: "Wallet Session exhausted"
-		};
+		if (entry.remainingUses <= 0) return failure("wallet_budget_exhausted", "Wallet Session exhausted");
 		entry.remainingUses -= 1;
 		return {
 			ok: true,
@@ -116,11 +104,7 @@ var InMemoryWalletSessionStore = class {
 			ok: true,
 			remainingUses: entry.remainingUses
 		};
-		if (entry.remainingUses <= 0) return {
-			ok: false,
-			code: "wallet_budget_exhausted",
-			message: "Wallet Session exhausted"
-		};
+		if (entry.remainingUses <= 0) return failure("wallet_budget_exhausted", "Wallet Session exhausted");
 		entry.remainingUses -= 1;
 		if (consumeKey) entry.consumedIdempotencyKeys.add(consumeKey);
 		return {
@@ -152,11 +136,7 @@ var InMemoryWalletSessionStore = class {
 };
 /** A backend failure as an `internal` result: the error's message, else `fallback`. */
 function walletSessionStoreFailure(error, fallback) {
-	return {
-		ok: false,
-		code: "internal",
-		message: String(error && typeof error === "object" && "message" in error ? error.message : error || fallback)
-	};
+	return failure("internal", String(error && typeof error === "object" && "message" in error ? error.message : error || fallback));
 }
 /**
 * A remote store's session status: the parsed record while it is live, with its remaining uses.
@@ -204,74 +184,38 @@ function replayGuardTtlMs(expiresAtMs, nowMs = Date.now()) {
 	return Math.max(EXPORT_REPLAY_GUARD_MIN_RETENTION_MS, Math.floor(retainUntilMs - nowMs));
 }
 function replayGuardInvalid() {
-	return {
-		ok: false,
-		code: "invalid_body",
-		message: "Invalid replay guard key"
-	};
+	return failure("invalid_body", "Invalid replay guard key");
 }
 function replayGuardExpired() {
-	return {
-		ok: false,
-		code: "export_authorization_expired",
-		message: "Export authorization expired"
-	};
+	return failure("export_authorization_expired", "Export authorization expired");
 }
 function replayGuardDuplicate() {
-	return {
-		ok: false,
-		code: "export_nonce_replay",
-		message: "Export authorization nonce already used"
-	};
+	return failure("export_nonce_replay", "Export authorization nonce already used");
 }
 function parseRedisReplayGuardResult(raw) {
 	const text = String(raw ?? "").trim();
 	if (text === "ok") return { ok: true };
 	if (text === "duplicate") return replayGuardDuplicate();
 	if (text === "expired") return replayGuardExpired();
-	return {
-		ok: false,
-		code: "internal",
-		message: "Redis replay guard returned invalid response"
-	};
+	return failure("internal", "Redis replay guard returned invalid response");
 }
 function parseRedisConsumeOnceResult(raw) {
 	const text = String(raw ?? "").trim();
 	if (text.startsWith("ok:")) {
 		const remainingUses = Number(text.slice(3));
-		if (!Number.isFinite(remainingUses)) return {
-			ok: false,
-			code: "internal",
-			message: "Redis consume-once returned invalid uses"
-		};
+		if (!Number.isFinite(remainingUses)) return failure("internal", "Redis consume-once returned invalid uses");
 		return {
 			ok: true,
 			remainingUses
 		};
 	}
-	if (text === "wallet_session_missing") return {
-		ok: false,
-		code: "wallet_session_missing",
-		message: "Wallet Session is missing"
-	};
-	if (text === "wallet_budget_exhausted") return {
-		ok: false,
-		code: "wallet_budget_exhausted",
-		message: "Wallet Session signing budget is exhausted"
-	};
-	return {
-		ok: false,
-		code: "internal",
-		message: "Redis consume-once returned invalid response"
-	};
+	if (text === "wallet_session_missing") return failure("wallet_session_missing", "Wallet Session is missing");
+	if (text === "wallet_budget_exhausted") return failure("wallet_budget_exhausted", "Wallet Session signing budget is exhausted");
+	return failure("internal", "Redis consume-once returned invalid response");
 }
 function parseRedisConsumedUseResult(raw) {
 	const value = typeof raw === "number" ? raw : Number(String(raw ?? "").trim());
-	if (!Number.isFinite(value)) return {
-		ok: false,
-		code: "internal",
-		message: "Redis consumed-use check returned invalid response"
-	};
+	if (!Number.isFinite(value)) return failure("internal", "Redis consumed-use check returned invalid response");
 	return {
 		ok: true,
 		consumed: value > 0
@@ -441,11 +385,7 @@ var RedisTcpWalletSessionStore = class {
 				"1",
 				this.keys.uses(id)
 			]);
-			if (resp.type === "error") return {
-				ok: false,
-				code: "internal",
-				message: `Redis EVAL error: ${resp.value}`
-			};
+			if (resp.type === "error") return failure("internal", `Redis EVAL error: ${resp.value}`);
 			return parseRedisConsumeOnceResult(redisRawValue(resp));
 		} catch (e) {
 			return walletSessionStoreFailure(e, "Failed to consume threshold session");
@@ -460,11 +400,7 @@ var RedisTcpWalletSessionStore = class {
 				this.keys.uses(id),
 				this.keys.consumeOnce(id, idempotencyKey)
 			]);
-			if (resp.type === "error") return {
-				ok: false,
-				code: "internal",
-				message: `Redis EVAL error: ${resp.value}`
-			};
+			if (resp.type === "error") return failure("internal", `Redis EVAL error: ${resp.value}`);
 			return parseRedisConsumeOnceResult(resp.type === "integer" ? String(resp.value) : resp.value);
 		} catch (e) {
 			return walletSessionStoreFailure(e, "Failed to consume threshold session");
@@ -478,11 +414,7 @@ var RedisTcpWalletSessionStore = class {
 		};
 		try {
 			const resp = await this.client.send(["EXISTS", this.keys.consumeOnce(id, consumeKey)]);
-			if (resp.type === "error") return {
-				ok: false,
-				code: "internal",
-				message: `Redis EXISTS error: ${resp.value}`
-			};
+			if (resp.type === "error") return failure("internal", `Redis EXISTS error: ${resp.value}`);
 			return parseRedisConsumedUseResult(resp.value);
 		} catch (e) {
 			return walletSessionStoreFailure(e, "Failed to check consumed threshold session operation");
@@ -500,18 +432,10 @@ var RedisTcpWalletSessionStore = class {
 				"EX",
 				String(Math.max(1, Math.ceil(ttlMs / 1e3)))
 			]);
-			if (resp.type === "error") return {
-				ok: false,
-				code: "internal",
-				message: `Redis SET error: ${resp.value}`
-			};
+			if (resp.type === "error") return failure("internal", `Redis SET error: ${resp.value}`);
 			if (resp.type === "bulk" && resp.value === null) return replayGuardDuplicate();
 			if (resp.type === "simple" && resp.value === "OK") return { ok: true };
-			return {
-				ok: false,
-				code: "internal",
-				message: "Redis replay guard returned invalid response"
-			};
+			return failure("internal", "Redis replay guard returned invalid response");
 		} catch (e) {
 			return walletSessionStoreFailure(e, "Failed to reserve replay guard");
 		}

package/dist/esm/core/ThresholdService/stores/exportReplayGuard.js

@@ -0,0 +1,7 @@
+//#region src/core/ThresholdService/stores/exportReplayGuard.ts
+const EXPORT_REPLAY_GUARD_CLOCK_SKEW_MS = 5 * 6e4;
+const EXPORT_REPLAY_GUARD_MIN_RETENTION_MS = 1440 * 6e4;
+//#endregion
+export { EXPORT_REPLAY_GUARD_CLOCK_SKEW_MS, EXPORT_REPLAY_GUARD_MIN_RETENTION_MS };
+
+//# sourceMappingURL=exportReplayGuard.js.map

package/dist/esm/core/WalletStore.js

@@ -4,10 +4,11 @@ import { isPlainObject } from "../shared-ts/src/utils/validation.js";
 import { sameRouterAbMpcMaterialActivationRef } from "../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { derivationClientSharePublicKey33B64uFromString, ecdsaClientRootPublicKey33B64uFromString, parseSdkEcdsaDerivationThresholdKeyId } from "../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { normalizeRuntimePolicyScope } from "../shared-ts/src/threshold/signingRootScope.js";
-import { parseRouterAbEcdsaDerivationActivationRefreshRequestV1, parseRouterAbEcdsaDerivationActivationRefreshResponseV1, parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaDerivationPublicIdentityV1, sameRouterAbServerIdentityV1 } from "../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { thresholdEcdsaChainTargetFromValue, thresholdEcdsaChainTargetKey } from "./thresholdEcdsaChainTarget.js";
+import { parseRouterAbEcdsaDerivationActivationRefreshRequestV1, parseRouterAbEcdsaDerivationActivationRefreshResponseV1, parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaRegistrationActivationReceiptV1, sameRegistrationSignerSet, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaDerivationPublicIdentityV1 } from "../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { resolveStorePrefix } from "./d1TenantStore.js";
 import { createDurableObjectStore, postDurableObjectRequest } from "./storeBackends.js";
+import { thresholdEcdsaChainTargetKey } from "../shared-ts/src/utils/thresholdEcdsaChainTarget.js";
+import { thresholdEcdsaChainTargetFromValue } from "./thresholdEcdsaChainTarget.js";
 import { D1WalletStore, WALLET_STORE_D1_SCHEMA_SQL, buildWalletEcdsaSignerRecord, ensureWalletStoreD1Schema, parseWalletEd25519SignerRecord } from "./d1WalletStore.js";
 //#region src/core/WalletStore.ts
 function parseWalletEcdsaPendingSessionActivationRecord(raw) {
@@ -47,11 +48,8 @@ function parseForwardedEcdsaRefreshResponse(raw) {
 function ecdsaPublicCapabilitiesEqual(left, right) {
 	return sameRouterAbEcdsaDerivationPublicCapabilityV1(left, right);
 }
-function sameWalletEcdsaSignerSetV1(left, right) {
-	return left.signer_set_id === right.signer_set_id && left.policy === right.policy && left.signer_a.role === right.signer_a.role && left.signer_a.signer_id === right.signer_a.signer_id && left.signer_a.key_epoch === right.signer_a.key_epoch && left.signer_b.role === right.signer_b.role && left.signer_b.signer_id === right.signer_b.signer_id && left.signer_b.key_epoch === right.signer_b.key_epoch && sameRouterAbServerIdentityV1(left.selected_server, right.selected_server);
-}
 function ecdsaPostRegistrationRequestMatchesCapability(input) {
-	return input.request.client_id === input.capability.client_id && input.request.router_id === input.capability.router_id && input.request.context.application_binding_digest_b64u === input.capability.context.application_binding_digest_b64u && sameRouterAbEcdsaDerivationPublicIdentityV1(input.request.public_identity, input.capability.public_identity) && sameWalletEcdsaSignerSetV1(input.request.signer_set, input.capability.signer_set);
+	return input.request.client_id === input.capability.client_id && input.request.router_id === input.capability.router_id && input.request.context.application_binding_digest_b64u === input.capability.context.application_binding_digest_b64u && sameRouterAbEcdsaDerivationPublicIdentityV1(input.request.public_identity, input.capability.public_identity) && sameRegistrationSignerSet(input.request.signer_set, input.capability.signer_set);
 }
 function resolveWalletStoreNamespace(config) {
 	return resolveStorePrefix(config, ["WALLET_PREFIX"], "wallet:");

package/dist/esm/core/authService/bytes.js

@@ -6,9 +6,6 @@ function randomBase64Url(bytes) {
 	crypto.getRandomValues(data);
 	return base64UrlEncode(data);
 }
-function randomOpaqueId(byteLength = 16) {
-	return randomBase64Url(byteLength);
-}
 function randomNumericCode(length) {
 	const bytes = new Uint8Array(length);
 	crypto.getRandomValues(bytes);
@@ -17,6 +14,6 @@ function randomNumericCode(length) {
 	return code;
 }
 //#endregion
-export { randomBase64Url, randomNumericCode, randomOpaqueId };
+export { randomBase64Url, randomNumericCode };
 
 //# sourceMappingURL=bytes.js.map

package/dist/esm/core/authService/emailOtpChallengeOperations.js

@@ -1,5 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import "../../shared-ts/src/utils/validation.js";
+import { failure } from "../../shared-ts/src/utils/failure.js";
 import { WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../shared-ts/src/utils/emailOtpDomain.js";
 import { randomBase64Url } from "./bytes.js";
 //#region src/core/authService/emailOtpChallengeOperations.ts
@@ -11,11 +12,7 @@ function createGrantToken() {
 	return typeof crypto === "undefined" || typeof crypto.getRandomValues !== "function" ? null : randomBase64Url(24);
 }
 function unsupportedCryptoResult() {
-	return {
-		ok: false,
-		code: "unsupported",
-		message: "crypto.getRandomValues is unavailable in this runtime"
-	};
+	return failure("unsupported", "crypto.getRandomValues is unavailable in this runtime");
 }
 async function createEmailOtpChallenge(input, request) {
 	const result = await input.createChallengeWithAction({

package/dist/esm/core/authService/emailOtpChallengeProof.js

@@ -1,6 +1,7 @@
 import { parseChallengeSubjectId, parseEmailOtpChallengeId, parseEmailOtpRegistrationAttemptId, parseOrgId, parseProviderSubject, parseWalletId } from "../../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import "../../shared-ts/src/utils/validation.js";
+import { failure } from "../../shared-ts/src/utils/failure.js";
 import { WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../shared-ts/src/utils/emailOtpDomain.js";
 //#region src/core/authService/emailOtpChallengeProof.ts
 function assertNever(value) {
@@ -134,41 +135,17 @@ function buildVerifiedEmailOtpRegistrationChallengeProof(input) {
 }
 function parseRawEmailOtpRegistrationChallengeProofInput(request) {
 	const providerSubject = parseProviderSubject(request.providerSubject);
-	if (!providerSubject.ok) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Email OTP registration requires providerSubject"
-	};
+	if (!providerSubject.ok) return failure("invalid_body", "Email OTP registration requires providerSubject");
 	const challengeSubjectId = parseChallengeSubjectId(request.providerSubject);
-	if (!challengeSubjectId.ok) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Email OTP registration requires challengeSubjectId"
-	};
+	if (!challengeSubjectId.ok) return failure("invalid_body", "Email OTP registration requires challengeSubjectId");
 	const challengeId = parseEmailOtpChallengeId(request.challengeId);
-	if (!challengeId.ok) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Email OTP registration requires challengeId"
-	};
+	if (!challengeId.ok) return failure("invalid_body", "Email OTP registration requires challengeId");
 	const finalWalletId = parseWalletId(request.walletId);
-	if (!finalWalletId.ok) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Email OTP registration requires walletId"
-	};
+	if (!finalWalletId.ok) return failure("invalid_body", "Email OTP registration requires walletId");
 	const orgId = parseOrgId(request.orgId);
-	if (!orgId.ok) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Email OTP registration requires orgId"
-	};
+	if (!orgId.ok) return failure("invalid_body", "Email OTP registration requires orgId");
 	const ownerProofBindingDigest = normalizeOptionalTrimmedString(request.ownerProofBindingDigest);
-	if (!ownerProofBindingDigest) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Email OTP registration requires ownerProofBindingDigest"
-	};
+	if (!ownerProofBindingDigest) return failure("invalid_body", "Email OTP registration requires ownerProofBindingDigest");
 	const registrationAttemptId = parseEmailOtpRegistrationAttemptId(request.googleEmailOtpRegistrationAttemptId);
 	if (registrationAttemptId.ok) return {
 		ok: true,
@@ -183,17 +160,9 @@ function parseRawEmailOtpRegistrationChallengeProofInput(request) {
 			challengeId: challengeId.value
 		}
 	};
-	if (registrationAttemptId.error.code === "invalid") return {
-		ok: false,
-		code: "invalid_body",
-		message: "googleEmailOtpRegistrationAttemptId must be a string"
-	};
+	if (registrationAttemptId.error.code === "invalid") return failure("invalid_body", "googleEmailOtpRegistrationAttemptId must be a string");
 	const proofEmail = normalizeOptionalTrimmedString(request.proofEmail)?.toLowerCase();
-	if (!proofEmail) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Email OTP registration requires proofEmail"
-	};
+	if (!proofEmail) return failure("invalid_body", "Email OTP registration requires proofEmail");
 	return {
 		ok: true,
 		input: {