@seams/wallet-server 0.7.1 → 0.7.3

package/dist/esm/core/authService/emailOtpUnlock.js

@@ -2,6 +2,7 @@ import { base64UrlDecode, base64UrlEncode } from "../../shared-ts/src/utils/base
 import "../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import "../../shared-ts/src/utils/validation.js";
+import { failedVerification, failure } from "../../shared-ts/src/utils/failure.js";
 import { validateSecp256k1PublicKey33, verifySecp256k1RecoverableSignatureAgainstPublicKey33 } from "../ThresholdService/evmCryptoWasm.js";
 import { errorMessage } from "../../shared-ts/src/utils/errors.js";
 import { parseBoundaryWalletId } from "./webauthnWalletBinding.js";
@@ -60,27 +61,15 @@ async function createEmailOtpUnlockChallenge(input) {
 	try {
 		const walletId = parsedUnlockWalletId(input.request.walletId);
 		const orgId = normalizeOptionalTrimmedString(input.request.orgId) || void 0;
-		if (!normalizeOptionalTrimmedString(input.request.walletId)) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing walletId"
-		};
-		if (!walletId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Invalid walletId"
-		};
+		if (!normalizeOptionalTrimmedString(input.request.walletId)) return failure("invalid_body", "Missing walletId");
+		if (!walletId) return failure("invalid_body", "Invalid walletId");
 		const activeEnrollment = await input.readActiveEnrollment({
 			walletId,
 			orgId
 		});
 		if (!activeEnrollment.ok) return activeEnrollment;
 		const enrollment = activeEnrollment.enrollment;
-		if (typeof crypto === "undefined" || typeof crypto.getRandomValues !== "function") return {
-			ok: false,
-			code: "unsupported",
-			message: "crypto.getRandomValues is unavailable in this runtime"
-		};
+		if (typeof crypto === "undefined" || typeof crypto.getRandomValues !== "function") return failure("unsupported", "crypto.getRandomValues is unavailable in this runtime");
 		const createdAtMs = Date.now();
 		const expiresAtMs = createdAtMs + clampedUnlockTtlMs(input.request.ttlMs ?? input.request.ttl_ms);
 		const challengeId = base64UrlEncode(crypto.getRandomValues(new Uint8Array(16)));
@@ -104,11 +93,7 @@ async function createEmailOtpUnlockChallenge(input) {
 			unlockKeyVersion: enrollment.unlockKeyVersion
 		};
 	} catch (e) {
-		return {
-			ok: false,
-			code: "internal",
-			message: errorMessage(e) || "Failed to create Email OTP unlock challenge"
-		};
+		return failure("internal", errorMessage(e) || "Failed to create Email OTP unlock challenge");
 	}
 }
 async function verifyEmailOtpUnlockProof(input) {
@@ -116,61 +101,21 @@ async function verifyEmailOtpUnlockProof(input) {
 		const walletId = parsedUnlockWalletId(input.request.walletId);
 		const orgId = normalizeOptionalTrimmedString(input.request.orgId) || void 0;
 		const challengeId = normalizeOptionalTrimmedString(input.request.challengeId);
-		if (!normalizeOptionalTrimmedString(input.request.walletId)) return {
-			ok: false,
-			verified: false,
-			code: "invalid_body",
-			message: "Missing walletId"
-		};
-		if (!walletId) return {
-			ok: false,
-			verified: false,
-			code: "invalid_body",
-			message: "Invalid walletId"
-		};
-		if (!challengeId) return {
-			ok: false,
-			verified: false,
-			code: "invalid_body",
-			message: "Missing challengeId"
-		};
+		if (!normalizeOptionalTrimmedString(input.request.walletId)) return failedVerification("invalid_body", "Missing walletId");
+		if (!walletId) return failedVerification("invalid_body", "Invalid walletId");
+		if (!challengeId) return failedVerification("invalid_body", "Missing challengeId");
 		const unlockProof = parseUnlockProof(input.request.unlockProof);
-		if (!unlockProof) return {
-			ok: false,
-			verified: false,
-			code: "invalid_body",
-			message: "unlockProof is required"
-		};
+		if (!unlockProof) return failedVerification("invalid_body", "unlockProof is required");
 		const challengeRecord = await input.unlockChallengeStore.consume(challengeId);
-		if (!challengeRecord || Date.now() > challengeRecord.expiresAtMs) return {
-			ok: false,
-			verified: false,
-			code: "challenge_expired_or_invalid",
-			message: "Email OTP unlock challenge expired or invalid"
-		};
-		if (challengeRecord.walletId !== walletId) return {
-			ok: false,
-			verified: false,
-			code: "challenge_binding_mismatch",
-			message: "Email OTP unlock challenge is not valid for this walletId"
-		};
+		if (!challengeRecord || Date.now() > challengeRecord.expiresAtMs) return failedVerification("challenge_expired_or_invalid", "Email OTP unlock challenge expired or invalid");
+		if (challengeRecord.walletId !== walletId) return failedVerification("challenge_binding_mismatch", "Email OTP unlock challenge is not valid for this walletId");
 		const activeEnrollment = await input.readActiveEnrollment({
 			walletId,
 			orgId
 		});
-		if (!activeEnrollment.ok) return {
-			ok: false,
-			verified: false,
-			code: activeEnrollment.code,
-			message: activeEnrollment.message
-		};
+		if (!activeEnrollment.ok) return failedVerification(activeEnrollment.code, activeEnrollment.message);
 		const enrollment = activeEnrollment.enrollment;
-		if (challengeRecord.userId !== enrollment.providerUserId || challengeRecord.orgId !== enrollment.orgId) return {
-			ok: false,
-			verified: false,
-			code: "challenge_binding_mismatch",
-			message: "Email OTP unlock challenge is not valid for this enrollment"
-		};
+		if (challengeRecord.userId !== enrollment.providerUserId || challengeRecord.orgId !== enrollment.orgId) return failedVerification("challenge_binding_mismatch", "Email OTP unlock challenge is not valid for this enrollment");
 		const publicKeyDecode = decodeBase64UrlField({
 			value: unlockProof.publicKey,
 			missingMessage: "unlockProof.publicKey is required",
@@ -178,21 +123,11 @@ async function verifyEmailOtpUnlockProof(input) {
 			expectedLength: 33,
 			expectedLengthMessage: "unlockProof.publicKey must decode to 33 bytes"
 		});
-		if (!publicKeyDecode.ok) return {
-			ok: false,
-			verified: false,
-			code: "invalid_body",
-			message: publicKeyDecode.message
-		};
+		if (!publicKeyDecode.ok) return failedVerification("invalid_body", publicKeyDecode.message);
 		try {
 			await validateSecp256k1PublicKey33(publicKeyDecode.bytes);
 		} catch {
-			return {
-				ok: false,
-				verified: false,
-				code: "invalid_body",
-				message: "unlockProof.publicKey is not a valid secp256k1 public key"
-			};
+			return failedVerification("invalid_body", "unlockProof.publicKey is not a valid secp256k1 public key");
 		}
 		const signatureDecode = decodeBase64UrlField({
 			value: unlockProof.signatureB64u,
@@ -201,18 +136,8 @@ async function verifyEmailOtpUnlockProof(input) {
 			expectedLength: 65,
 			expectedLengthMessage: "unlockProof.signature must decode to 65 bytes"
 		});
-		if (!signatureDecode.ok) return {
-			ok: false,
-			verified: false,
-			code: "invalid_body",
-			message: signatureDecode.message
-		};
-		if (!byteArraysEqual(base64UrlDecode(enrollment.clientUnlockPublicKeyB64u), publicKeyDecode.bytes)) return {
-			ok: false,
-			verified: false,
-			code: "invalid_unlock_proof",
-			message: "unlockProof.publicKey does not match the enrolled clientUnlockPublicKeyB64u"
-		};
+		if (!signatureDecode.ok) return failedVerification("invalid_body", signatureDecode.message);
+		if (!byteArraysEqual(base64UrlDecode(enrollment.clientUnlockPublicKeyB64u), publicKeyDecode.bytes)) return failedVerification("invalid_unlock_proof", "unlockProof.publicKey does not match the enrolled clientUnlockPublicKeyB64u");
 		const challengeDigestDecode = decodeBase64UrlField({
 			value: challengeRecord.challengeB64u,
 			missingMessage: "Stored unlock challenge digest was invalid",
@@ -220,21 +145,11 @@ async function verifyEmailOtpUnlockProof(input) {
 			expectedLength: 32,
 			expectedLengthMessage: "Stored unlock challenge digest must decode to 32 bytes"
 		});
-		if (!challengeDigestDecode.ok) return {
-			ok: false,
-			verified: false,
-			code: "internal",
-			message: challengeDigestDecode.message
-		};
+		if (!challengeDigestDecode.ok) return failedVerification("internal", challengeDigestDecode.message);
 		try {
 			await verifySecp256k1RecoverableSignatureAgainstPublicKey33(challengeDigestDecode.bytes, signatureDecode.bytes, publicKeyDecode.bytes);
 		} catch {
-			return {
-				ok: false,
-				verified: false,
-				code: "invalid_unlock_proof",
-				message: "unlockProof.signature did not verify against unlockProof.publicKey"
-			};
+			return failedVerification("invalid_unlock_proof", "unlockProof.signature did not verify against unlockProof.publicKey");
 		}
 		const nowMs = Date.now();
 		await input.putAuthStateForEnrollment(enrollment, { lastEmailOtpLoginAtMs: nowMs });
@@ -250,12 +165,7 @@ async function verifyEmailOtpUnlockProof(input) {
 			unlockKeyVersion: enrollment.unlockKeyVersion
 		};
 	} catch (e) {
-		return {
-			ok: false,
-			verified: false,
-			code: "internal",
-			message: errorMessage(e) || "Failed to verify Email OTP unlock proof"
-		};
+		return failedVerification("internal", errorMessage(e) || "Failed to verify Email OTP unlock proof");
 	}
 }
 //#endregion

package/dist/esm/core/authService/googleEmailOtpRegistration.js

@@ -1,8 +1,9 @@
 import { parseGoogleProviderSubject, parseOrgId, parseVerifiedGoogleEmail } from "../../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import "../../shared-ts/src/utils/validation.js";
+import { failure } from "../../shared-ts/src/utils/failure.js";
 import { GOOGLE_EMAIL_OTP_STALE_IDENTITY_MESSAGE } from "./googleEmailOtpErrors.js";
-import { randomOpaqueId } from "./bytes.js";
+import { randomBase64Url } from "./bytes.js";
 import { readActiveEmailOtpEnrollmentWithStore } from "./emailOtpEnrollment.js";
 //#region src/core/authService/googleEmailOtpRegistration.ts
 async function cleanupGoogleEmailOtpRegistrationAttemptsWithStore(input) {
@@ -11,23 +12,11 @@ async function cleanupGoogleEmailOtpRegistrationAttemptsWithStore(input) {
 async function consumeGoogleEmailOtpRegistrationAttemptRateLimitWithDeps(input) {
 	if (normalizeOptionalTrimmedString(input.request.accountMode)?.toLowerCase() !== "register") return { ok: true };
 	const providerSubject = parseGoogleProviderSubject(input.request.providerSubject);
-	if (!providerSubject.ok) return {
-		ok: false,
-		code: "invalid_body",
-		message: providerSubject.error.message
-	};
+	if (!providerSubject.ok) return failure("invalid_body", providerSubject.error.message);
 	const email = parseVerifiedGoogleEmail(input.request.email);
-	if (!email.ok) return {
-		ok: false,
-		code: "invalid_body",
-		message: email.error.message
-	};
+	if (!email.ok) return failure("invalid_body", email.error.message);
 	const orgId = parseOrgId(input.request.runtimePolicyScope?.orgId);
-	if (!orgId.ok) return {
-		ok: false,
-		code: "invalid_body",
-		message: orgId.error.message
-	};
+	if (!orgId.ok) return failure("invalid_body", orgId.error.message);
 	const restartOffer = isTruthyBoundaryFlag(input.request.restartRegistrationOffer);
 	return await input.consumeRateLimit({
 		scope: "googleRegistrationAttempt",
@@ -79,34 +68,18 @@ async function completeGoogleEmailOtpRegistrationAttemptWithStore(input) {
 	if (!registrationAttemptId) return { ok: true };
 	const walletId = normalizeOptionalTrimmedString(input.walletId);
 	const attempt = await input.registrationAttemptStore.get(registrationAttemptId);
-	if (!attempt) return {
-		ok: false,
-		code: "registration_incomplete",
-		message: "Google Email OTP registration attempt expired or was not found"
-	};
+	if (!attempt) return failure("registration_incomplete", "Google Email OTP registration attempt expired or was not found");
 	if (attempt.expiresAtMs <= input.nowMs) {
 		await input.registrationAttemptStore.put({
 			...attempt,
 			state: "expired",
 			updatedAtMs: input.nowMs
 		});
-		return {
-			ok: false,
-			code: "registration_incomplete",
-			message: "Google Email OTP registration attempt expired"
-		};
+		return failure("registration_incomplete", "Google Email OTP registration attempt expired");
 	}
-	if (walletId !== attempt.walletId) return {
-		ok: false,
-		code: "wallet_identity_mismatch",
-		message: "registrationAttemptId does not match walletId"
-	};
+	if (walletId !== attempt.walletId) return failure("wallet_identity_mismatch", "registrationAttemptId does not match walletId");
 	if (attempt.state === "active") return { ok: true };
-	if (attempt.state !== "started" && attempt.state !== "key_finalized") return {
-		ok: false,
-		code: "registration_incomplete",
-		message: "Google Email OTP registration attempt is no longer active"
-	};
+	if (attempt.state !== "started" && attempt.state !== "key_finalized") return failure("registration_incomplete", "Google Email OTP registration attempt is no longer active");
 	const linked = await input.identityStore.linkSubjectToUserId({
 		userId: attempt.walletId,
 		subject: `wallet:${attempt.providerSubject}`,
@@ -119,11 +92,7 @@ async function completeGoogleEmailOtpRegistrationAttemptWithStore(input) {
 			failureCode: linked.code,
 			updatedAtMs: input.nowMs
 		});
-		return {
-			ok: false,
-			code: linked.code,
-			message: linked.message
-		};
+		return failure(linked.code, linked.message);
 	}
 	await input.registrationAttemptStore.put({
 		...attempt,
@@ -137,52 +106,24 @@ async function validateGoogleEmailOtpRegistrationCandidateWalletWithStore(input)
 	const walletId = normalizeOptionalTrimmedString(input.walletId);
 	const ownerProofBindingDigest = normalizeOptionalTrimmedString(input.ownerProofBindingDigest);
 	const providerSubject = normalizeOptionalTrimmedString(input.providerSubject);
-	if (!registrationAttemptId || !walletId || !ownerProofBindingDigest || !providerSubject) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Google Email OTP registration candidate validation requires signed session scope"
-	};
+	if (!registrationAttemptId || !walletId || !ownerProofBindingDigest || !providerSubject) return failure("invalid_body", "Google Email OTP registration candidate validation requires signed session scope");
 	const attempt = await input.registrationAttemptStore.get(registrationAttemptId);
-	if (!attempt) return {
-		ok: false,
-		code: "registration_attempt_missing",
-		message: "Google Email OTP registration attempt expired or was not found"
-	};
+	if (!attempt) return failure("registration_attempt_missing", "Google Email OTP registration attempt expired or was not found");
 	if (attempt.expiresAtMs <= input.nowMs) {
 		await input.registrationAttemptStore.put({
 			...attempt,
 			state: "expired",
 			updatedAtMs: input.nowMs
 		});
-		return {
-			ok: false,
-			code: "registration_attempt_expired",
-			message: "Google Email OTP registration attempt expired"
-		};
+		return failure("registration_attempt_expired", "Google Email OTP registration attempt expired");
 	}
-	if (attempt.providerSubject !== providerSubject) return {
-		ok: false,
-		code: "challenge_subject_mismatch",
-		message: "Email OTP registration attempt does not match the provider subject"
-	};
-	if (attempt.ownerProofBindingDigest !== ownerProofBindingDigest) return {
-		ok: false,
-		code: "owner_proof_binding_mismatch",
-		message: "Google Email OTP registration attempt does not match the owner proof binding"
-	};
-	if (attempt.state !== "started" && attempt.state !== "key_finalized") return {
-		ok: false,
-		code: "registration_incomplete",
-		message: "Google Email OTP registration attempt is no longer active"
-	};
+	if (attempt.providerSubject !== providerSubject) return failure("challenge_subject_mismatch", "Email OTP registration attempt does not match the provider subject");
+	if (attempt.ownerProofBindingDigest !== ownerProofBindingDigest) return failure("owner_proof_binding_mismatch", "Google Email OTP registration attempt does not match the owner proof binding");
+	if (attempt.state !== "started" && attempt.state !== "key_finalized") return failure("registration_incomplete", "Google Email OTP registration attempt is no longer active");
 	if (!findGoogleEmailOtpOfferCandidateByWalletId({
 		candidates: attempt.offerCandidates,
 		walletId
-	})) return {
-		ok: false,
-		code: "wallet_identity_mismatch",
-		message: "walletId is not an active Google Email OTP registration candidate"
-	};
+	})) return failure("wallet_identity_mismatch", "walletId is not an active Google Email OTP registration candidate");
 	return { ok: true };
 }
 async function recordGoogleEmailOtpRegistrationAttemptPublicKeyWithStore(input) {
@@ -191,33 +132,17 @@ async function recordGoogleEmailOtpRegistrationAttemptPublicKeyWithStore(input)
 	const walletId = normalizeOptionalTrimmedString(input.walletId);
 	const finalizedPublicKey = normalizeOptionalTrimmedString(input.finalizedPublicKey);
 	const attempt = await input.registrationAttemptStore.get(registrationAttemptId);
-	if (!attempt) return {
-		ok: false,
-		code: "registration_incomplete",
-		message: "Google Email OTP registration attempt expired or was not found"
-	};
+	if (!attempt) return failure("registration_incomplete", "Google Email OTP registration attempt expired or was not found");
 	if (attempt.expiresAtMs <= input.nowMs) {
 		await input.registrationAttemptStore.put({
 			...attempt,
 			state: "expired",
 			updatedAtMs: input.nowMs
 		});
-		return {
-			ok: false,
-			code: "registration_incomplete",
-			message: "Google Email OTP registration attempt expired"
-		};
+		return failure("registration_incomplete", "Google Email OTP registration attempt expired");
 	}
-	if (walletId !== attempt.walletId) return {
-		ok: false,
-		code: "wallet_identity_mismatch",
-		message: "registrationAttemptId does not match walletId"
-	};
-	if (attempt.state !== "started" && attempt.state !== "key_finalized" && attempt.state !== "active") return {
-		ok: false,
-		code: "registration_incomplete",
-		message: "Google Email OTP registration attempt is no longer active"
-	};
+	if (walletId !== attempt.walletId) return failure("wallet_identity_mismatch", "registrationAttemptId does not match walletId");
+	if (attempt.state !== "started" && attempt.state !== "key_finalized" && attempt.state !== "active") return failure("registration_incomplete", "Google Email OTP registration attempt is no longer active");
 	if (attempt.state === "started") {
 		if (!finalizedPublicKey) await input.registrationAttemptStore.put({
 			...attempt,
@@ -253,17 +178,9 @@ async function failGoogleEmailOtpRegistrationAttemptWithStore(input) {
 	});
 }
 async function cleanupGoogleEmailOtpDevRegistrationStateWithStores(input) {
-	if (input.isProductionEnvironment) return {
-		ok: false,
-		code: "not_found",
-		message: "Google Email OTP dev cleanup is not available"
-	};
+	if (input.isProductionEnvironment) return failure("not_found", "Google Email OTP dev cleanup is not available");
 	const providerSubject = normalizeOptionalTrimmedString(input.providerSubject);
-	if (!providerSubject || !providerSubject.startsWith("google:")) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Missing Google provider subject"
-	};
+	if (!providerSubject || !providerSubject.startsWith("google:")) return failure("invalid_body", "Missing Google provider subject");
 	const requestedWalletId = normalizeOptionalTrimmedString(input.walletId);
 	const requestedOrgId = normalizeOptionalTrimmedString(input.orgId);
 	const nowMsRaw = typeof input.nowMs === "number" ? input.nowMs : Number(input.nowMs);
@@ -473,7 +390,7 @@ async function resolveRegistrationForExistingEnrollment(input) {
 async function createGoogleEmailOtpRegistrationOffer(input) {
 	const nowMs = Date.now();
 	const authProvider = "google_oidc";
-	const walletIdDerivationNonce = randomOpaqueId(18);
+	const walletIdDerivationNonce = randomBase64Url(18);
 	const offerCandidates = [];
 	for (let attempt = 0; attempt < 30 && offerCandidates.length < 5; attempt += 1) {
 		const candidate = await input.deriveHostedWalletId({
@@ -491,7 +408,7 @@ async function createGoogleEmailOtpRegistrationOffer(input) {
 		if (await input.walletEnrollmentStore.get(candidate) || inUseByLiveAttempt) continue;
 		if (hasDifferentWalletIdentityLink(await input.identityStore.listSubjectsByUserId(candidate), `wallet:${input.request.providerSubject}`)) continue;
 		offerCandidates.push({
-			candidateId: randomOpaqueId(18),
+			candidateId: randomBase64Url(18),
 			walletId: candidate,
 			collisionCounter: attempt
 		});
@@ -507,7 +424,7 @@ async function createGoogleEmailOtpRegistrationOffer(input) {
 	};
 	const nonEmptyOfferCandidates = [selectedCandidate, ...remainingOfferCandidates];
 	const walletId = selectedCandidate.walletId;
-	const offerId = randomOpaqueId(18);
+	const offerId = randomBase64Url(18);
 	return registrationAttemptStartedResponse({
 		attempt: await createGoogleEmailOtpRegistrationAttempt({
 			registrationAttemptStore: input.registrationAttemptStore,
@@ -535,7 +452,7 @@ async function createGoogleEmailOtpRegistrationAttempt(input) {
 	});
 	const attempt = {
 		version: "google_email_otp_registration_attempt_v1",
-		attemptId: randomOpaqueId(18),
+		attemptId: randomBase64Url(18),
 		providerSubject: input.providerSubject,
 		email: input.email,
 		walletId: input.walletId,
@@ -604,11 +521,7 @@ async function repairGoogleEmailOtpWalletLink(input) {
 		subject: `wallet:${input.providerSubject}`,
 		allowMoveIfSoleIdentity: true
 	});
-	if (!linked.ok) return {
-		ok: false,
-		code: linked.code,
-		message: linked.message
-	};
+	if (!linked.ok) return failure(linked.code, linked.message);
 	return { ok: true };
 }
 function isGoogleEmailOtpEnrollmentLookupMiss(code) {

package/dist/esm/core/authService/identity.js

@@ -1,25 +1,18 @@
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import "../../shared-ts/src/utils/validation.js";
+import { failure } from "../../shared-ts/src/utils/failure.js";
 import { errorMessage } from "../../shared-ts/src/utils/errors.js";
 //#region src/core/authService/identity.ts
 async function listIdentitiesWithStore(input) {
 	try {
 		const userId = normalizeOptionalTrimmedString(input.userId);
-		if (!userId) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing userId"
-		};
+		if (!userId) return failure("invalid_args", "Missing userId");
 		return {
 			ok: true,
 			subjects: await input.store.listSubjectsByUserId(userId)
 		};
 	} catch (e) {
-		return {
-			ok: false,
-			code: "internal",
-			message: errorMessage(e) || "Failed to list identities"
-		};
+		return failure("internal", errorMessage(e) || "Failed to list identities");
 	}
 }
 async function linkIdentityWithStore(input) {
@@ -30,11 +23,7 @@ async function linkIdentityWithStore(input) {
 			allowMoveIfSoleIdentity: input.allowMoveIfSoleIdentity
 		});
 	} catch (e) {
-		return {
-			ok: false,
-			code: "internal",
-			message: errorMessage(e) || "Failed to link identity"
-		};
+		return failure("internal", errorMessage(e) || "Failed to link identity");
 	}
 }
 async function unlinkIdentityWithStore(input) {
@@ -44,11 +33,7 @@ async function unlinkIdentityWithStore(input) {
 			subject: input.subject
 		});
 	} catch (e) {
-		return {
-			ok: false,
-			code: "internal",
-			message: errorMessage(e) || "Failed to unlink identity"
-		};
+		return failure("internal", errorMessage(e) || "Failed to unlink identity");
 	}
 }
 //#endregion

package/dist/esm/core/authService/nearPublicKeyMetadata.js

@@ -1,6 +1,7 @@
 import { parseWebAuthnRpId } from "../../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import "../../shared-ts/src/utils/validation.js";
+import { failure } from "../../shared-ts/src/utils/failure.js";
 import { errorMessage } from "../../shared-ts/src/utils/errors.js";
 //#region src/core/authService/nearPublicKeyMetadata.ts
 function optionalPositiveInteger(input) {
@@ -60,20 +61,12 @@ function nearPublicKeyListEntry(record) {
 async function recordNearPublicKeyMetadataWithStore(input) {
 	const userId = normalizeOptionalTrimmedString(input.userId);
 	const publicKey = normalizeOptionalTrimmedString(input.publicKey);
-	if (!userId || !publicKey) return {
-		ok: false,
-		code: "invalid_args",
-		message: "userId and publicKey are required"
-	};
+	if (!userId || !publicKey) return failure("invalid_args", "userId and publicKey are required");
 	const authBinding = nearPublicKeyAuthBinding({
 		credentialIdB64u: normalizeOptionalTrimmedString(input.credentialIdB64u),
 		rpIdRaw: normalizeOptionalTrimmedString(input.rpId)
 	});
-	if (!authBinding.ok) return {
-		ok: false,
-		code: "invalid_args",
-		message: authBinding.message
-	};
+	if (!authBinding.ok) return failure("invalid_args", authBinding.message);
 	const record = nearPublicKeyRecord({
 		userId,
 		publicKey,
@@ -91,21 +84,13 @@ async function recordNearPublicKeyMetadataWithStore(input) {
 		const source = normalizeOptionalTrimmedString(input.source) || "near-public-key-metadata";
 		const message = errorMessage(error) || "Failed to persist NEAR public key metadata";
 		input.logger.warn(`[AuthService] ${source} failed for ${userId}`, error);
-		return {
-			ok: false,
-			code: "internal",
-			message
-		};
+		return failure("internal", message);
 	}
 }
 async function listNearPublicKeysForUserWithStore(input) {
 	try {
 		const userId = String(input.userId || "").trim();
-		if (!userId) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing userId"
-		};
+		if (!userId) return failure("invalid_args", "Missing userId");
 		const records = await input.store.listByUserId(userId);
 		const keys = [];
 		for (const record of records || []) keys.push(nearPublicKeyListEntry(record));
@@ -114,11 +99,7 @@ async function listNearPublicKeysForUserWithStore(input) {
 			keys
 		};
 	} catch (e) {
-		return {
-			ok: false,
-			code: "internal",
-			message: errorMessage(e) || "Failed to list keys"
-		};
+		return failure("internal", errorMessage(e) || "Failed to list keys");
 	}
 }
 //#endregion