@seams/wallet-server 0.7.1 → 0.7.3

package/dist/esm/core/authService/oidcVerification.js

@@ -2,6 +2,7 @@ import { base64UrlDecode } from "../../shared-ts/src/utils/base64.js";
 import "../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../../shared-ts/src/utils/validation.js";
+import { failedVerification } from "../../shared-ts/src/utils/failure.js";
 import { errorMessage } from "../../shared-ts/src/utils/errors.js";
 import { parseCacheControlMaxAgeSec, parseJwtAud, parseJwtSegmentJson } from "./webauthnOidcHelpers.js";
 import { toArrayBufferCopy } from "./portableCrypto.js";
@@ -12,25 +13,17 @@ function createGoogleJwksState() {
 		fetchPromise: null
 	};
 }
-function jwtError(code, message) {
-	return {
-		ok: false,
-		verified: false,
-		code,
-		message
-	};
-}
 function requireWebCrypto() {
 	return typeof crypto !== "undefined" && Boolean(crypto.subtle);
 }
 function parseJwtParts(input) {
 	const parts = input.token.split(".");
-	if (parts.length !== 3) return jwtError("invalid_body", `${input.tokenName} must be a JWT (3 segments)`);
+	if (parts.length !== 3) return failedVerification("invalid_body", `${input.tokenName} must be a JWT (3 segments)`);
 	const [headerB64u, payloadB64u, signatureB64u] = parts;
 	const header = parseJwtSegmentJson(headerB64u);
-	if (!header) return jwtError("invalid_body", `Invalid ${input.tokenName} header encoding`);
+	if (!header) return failedVerification("invalid_body", `Invalid ${input.tokenName} header encoding`);
 	const payload = parseJwtSegmentJson(payloadB64u);
-	if (!payload) return jwtError("invalid_body", `Invalid ${input.tokenName} payload encoding`);
+	if (!payload) return failedVerification("invalid_body", `Invalid ${input.tokenName} payload encoding`);
 	return {
 		ok: true,
 		value: {
@@ -106,26 +99,26 @@ async function verifyJwtSignature(input) {
 	try {
 		signatureBytes = base64UrlDecode(input.parts.signatureB64u);
 	} catch {
-		return jwtError("invalid_body", `Invalid ${input.tokenName} signature encoding`);
+		return failedVerification("invalid_body", `Invalid ${input.tokenName} signature encoding`);
 	}
 	const dataBytes = new TextEncoder().encode(`${input.parts.headerB64u}.${input.parts.payloadB64u}`);
 	const key = await crypto.subtle.importKey("jwk", input.jwk, {
 		name: "RSASSA-PKCS1-v1_5",
 		hash: "SHA-256"
 	}, false, ["verify"]);
-	if (!await crypto.subtle.verify({ name: "RSASSA-PKCS1-v1_5" }, key, toArrayBufferCopy(signatureBytes), toArrayBufferCopy(dataBytes))) return jwtError("invalid_signature", `Invalid ${input.tokenName} signature`);
+	if (!await crypto.subtle.verify({ name: "RSASSA-PKCS1-v1_5" }, key, toArrayBufferCopy(signatureBytes), toArrayBufferCopy(dataBytes))) return failedVerification("invalid_signature", `Invalid ${input.tokenName} signature`);
 	return { ok: true };
 }
 function verifyGoogleTimeClaims(payload) {
 	const nowSec = Math.floor(Date.now() / 1e3);
 	const exp = Number(payload.exp);
-	if (!Number.isFinite(exp) || exp <= 0) return jwtError("invalid_claims", "Invalid Google id_token exp");
-	if (nowSec >= exp) return jwtError("expired", "Google id_token is expired");
+	if (!Number.isFinite(exp) || exp <= 0) return failedVerification("invalid_claims", "Invalid Google id_token exp");
+	if (nowSec >= exp) return failedVerification("expired", "Google id_token is expired");
 	const nbfRaw = payload.nbf;
 	if (nbfRaw !== void 0) {
 		const nbf = Number(nbfRaw);
-		if (!Number.isFinite(nbf)) return jwtError("invalid_claims", "Invalid Google id_token nbf");
-		if (nowSec < nbf) return jwtError("not_yet_valid", "Google id_token is not yet valid");
+		if (!Number.isFinite(nbf)) return failedVerification("invalid_claims", "Invalid Google id_token nbf");
+		if (nowSec < nbf) return failedVerification("not_yet_valid", "Google id_token is not yet valid");
 	}
 	return { ok: true };
 }
@@ -179,10 +172,10 @@ function buildGoogleLoginFacadeSuccess(input) {
 	return result;
 }
 async function verifyGoogleIdToken(input) {
-	if (!input.config?.clientIds?.length) return jwtError("not_configured", "Google OIDC is not configured on this server");
+	if (!input.config?.clientIds?.length) return failedVerification("not_configured", "Google OIDC is not configured on this server");
 	const idToken = normalizeOptionalTrimmedString(input.request.idToken ?? input.request.id_token);
-	if (!idToken) return jwtError("invalid_body", "id_token is required");
-	if (!requireWebCrypto()) return jwtError("unsupported", "WebCrypto (crypto.subtle) is unavailable in this runtime");
+	if (!idToken) return failedVerification("invalid_body", "id_token is required");
+	if (!requireWebCrypto()) return failedVerification("unsupported", "WebCrypto (crypto.subtle) is unavailable in this runtime");
 	const parts = parseJwtParts({
 		token: idToken,
 		tokenName: "id_token"
@@ -190,10 +183,10 @@ async function verifyGoogleIdToken(input) {
 	if (!parts.ok) return parts;
 	const kid = normalizeOptionalTrimmedString(parts.value.header.kid);
 	const alg = normalizeOptionalTrimmedString(parts.value.header.alg);
-	if (!kid) return jwtError("invalid_body", "id_token header.kid is required");
-	if (alg !== "RS256") return jwtError("invalid_body", "id_token header.alg must be RS256");
+	if (!kid) return failedVerification("invalid_body", "id_token header.kid is required");
+	if (alg !== "RS256") return failedVerification("invalid_body", "id_token header.alg must be RS256");
 	const jwk = (await getGoogleJwks(input.jwksState)).keysByKid.get(kid);
-	if (!jwk) return jwtError("unknown_kid", "Unknown Google key id (kid)");
+	if (!jwk) return failedVerification("unknown_kid", "Unknown Google key id (kid)");
 	const signature = await verifyJwtSignature({
 		jwk,
 		parts: parts.value,
@@ -201,19 +194,19 @@ async function verifyGoogleIdToken(input) {
 	});
 	if (!signature.ok) return signature;
 	const iss = normalizeOptionalTrimmedString(parts.value.payload.iss);
-	if (iss !== "https://accounts.google.com" && iss !== "accounts.google.com") return jwtError("invalid_issuer", "Invalid Google id_token issuer");
+	if (iss !== "https://accounts.google.com" && iss !== "accounts.google.com") return failedVerification("invalid_issuer", "Invalid Google id_token issuer");
 	const time = verifyGoogleTimeClaims(parts.value.payload);
 	if (!time.ok) return time;
 	const aud = parseJwtAud(parts.value.payload.aud);
-	if (!aud.length) return jwtError("invalid_claims", "Missing Google id_token aud");
+	if (!aud.length) return failedVerification("invalid_claims", "Missing Google id_token aud");
 	const allowedAudSet = new Set(input.config.clientIds);
-	if (!aud.some((value) => allowedAudSet.has(value))) return jwtError("invalid_audience", "Google id_token audience mismatch");
+	if (!aud.some((value) => allowedAudSet.has(value))) return failedVerification("invalid_audience", "Google id_token audience mismatch");
 	const sub = normalizeOptionalTrimmedString(parts.value.payload.sub);
-	if (!sub) return jwtError("invalid_claims", "Missing Google id_token sub");
+	if (!sub) return failedVerification("invalid_claims", "Missing Google id_token sub");
 	const hostedDomain = normalizeOptionalTrimmedString(parts.value.payload.hd);
 	if (input.config.hostedDomains?.length) {
 		const allowHd = new Set(input.config.hostedDomains.map((d) => d.toLowerCase()));
-		if (!hostedDomain || !allowHd.has(hostedDomain.toLowerCase())) return jwtError("invalid_hosted_domain", "Google hosted domain is not allowed");
+		if (!hostedDomain || !allowHd.has(hostedDomain.toLowerCase())) return failedVerification("invalid_hosted_domain", "Google hosted domain is not allowed");
 	}
 	const email = normalizeOptionalTrimmedString(parts.value.payload.email);
 	const name = normalizeOptionalTrimmedString(parts.value.payload.name);
@@ -247,12 +240,7 @@ async function verifyGoogleLoginWithIdentityStore(input) {
 			})
 		});
 	} catch (e) {
-		return {
-			ok: false,
-			verified: false,
-			code: "internal",
-			message: errorMessage(e) || "Google OIDC verification failed"
-		};
+		return failedVerification("internal", errorMessage(e) || "Google OIDC verification failed");
 	}
 }
 //#endregion

package/dist/esm/core/authService/rateLimits.js

@@ -1,5 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import "../../shared-ts/src/utils/validation.js";
+import { failure } from "../../shared-ts/src/utils/failure.js";
 import { readAuthServiceConfigValue } from "./configValues.js";
 import { resolveSigningSessionSealRateLimitFromEnv } from "../../threshold/session/signingSessionSeal/guards/backends.js";
 import "../../threshold/session/signingSessionSeal/index.js";
@@ -51,11 +52,7 @@ function createEmailOtpRateLimiter(input) {
 	}).limiter;
 }
 function consumedRateLimitError(message, consumed) {
-	const result = {
-		ok: false,
-		code: "rate_limited",
-		message
-	};
+	const result = failure("rate_limited", message);
 	if (typeof consumed.retryAfterMs === "number") result.retryAfterMs = consumed.retryAfterMs;
 	if (typeof consumed.resetAtMs === "number") result.resetAtMs = consumed.resetAtMs;
 	return result;

package/dist/esm/core/authService/thresholdEcdsaKeyInventory.js

@@ -1,6 +1,7 @@
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../../shared-ts/src/utils/validation.js";
-import { thresholdEcdsaChainTargetFromValue, thresholdEcdsaChainTargetKey } from "../thresholdEcdsaChainTarget.js";
+import { thresholdEcdsaChainTargetKey } from "../../shared-ts/src/utils/thresholdEcdsaChainTarget.js";
+import { thresholdEcdsaChainTargetFromValue } from "../thresholdEcdsaChainTarget.js";
 import { walletIdFromString } from "../../shared-ts/src/utils/registrationIds.js";
 //#region src/core/authService/thresholdEcdsaKeyInventory.ts
 function incrementCount(bucket, reason) {

package/dist/esm/core/authService/webauthn.js

@@ -4,6 +4,7 @@ import "../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import "../../shared-ts/src/utils/validation.js";
 import { unknownWebAuthnAuthenticatorDeviceInfo } from "../../shared-ts/src/utils/webauthnDeviceInfo.js";
+import { failedVerification, failure } from "../../shared-ts/src/utils/failure.js";
 import { walletIdFromString } from "../../shared-ts/src/utils/registrationIds.js";
 import { errorMessage } from "../../shared-ts/src/utils/errors.js";
 import { decodeBase64UrlOrBase64, isHostWithinRpId, loadSimpleWebAuthnServer, originHostnameOrEmpty, parseClientDataJsonBase64url } from "./webauthnOidcHelpers.js";
@@ -28,11 +29,7 @@ function normalizeWebAuthnTtlMs(raw) {
 }
 function ensureCryptoRandomValues() {
 	if (typeof crypto !== "undefined" && typeof crypto.getRandomValues === "function") return true;
-	return {
-		ok: false,
-		code: "unsupported",
-		message: "crypto.getRandomValues is unavailable in this runtime"
-	};
+	return failure("unsupported", "crypto.getRandomValues is unavailable in this runtime");
 }
 function randomWebAuthnB64u(byteLength) {
 	return base64UrlEncode(crypto.getRandomValues(new Uint8Array(byteLength)));
@@ -40,22 +37,14 @@ function randomWebAuthnB64u(byteLength) {
 function credentialRawIdB64u(credential) {
 	const credentialId = credential.id.trim();
 	const chosen = credential.rawId.trim() || credentialId;
-	if (!chosen) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Missing webauthn_authentication.id/rawId"
-	};
+	if (!chosen) return failure("invalid_body", "Missing webauthn_authentication.id/rawId");
 	try {
 		return {
 			ok: true,
 			credentialIdB64u: base64UrlEncode(decodeBase64UrlOrBase64(chosen, "webauthn_authentication.rawId"))
 		};
 	} catch (e) {
-		return {
-			ok: false,
-			code: "invalid_body",
-			message: errorMessage(e) || "Invalid credential rawId"
-		};
+		return failure("invalid_body", errorMessage(e) || "Invalid credential rawId");
 	}
 }
 function credentialPublicKeyBytes(record) {
@@ -65,11 +54,7 @@ function credentialPublicKeyBytes(record) {
 			bytes: decodeBase64UrlOrBase64(record.credentialPublicKeyB64u, "authenticator.credentialPublicKeyB64u")
 		};
 	} catch (e) {
-		return {
-			ok: false,
-			code: "internal",
-			message: `Stored credential public key is invalid: ${errorMessage(e) || "decode failed"}`
-		};
+		return failure("internal", `Stored credential public key is invalid: ${errorMessage(e) || "decode failed"}`);
 	}
 }
 function credentialVerificationInput(input) {
@@ -105,32 +90,16 @@ async function persistAuthenticatorCounter(input) {
 		}));
 		return { ok: true };
 	} catch (e) {
-		return {
-			ok: false,
-			code: "internal",
-			message: `Failed to persist authenticator counter: ${errorMessage(e) || "store error"}`
-		};
+		return failure("internal", `Failed to persist authenticator counter: ${errorMessage(e) || "store error"}`);
 	}
 }
 function parseWebAuthnClientDataForRegistration(input) {
 	const response = readNestedRecord(input.credential, "response");
 	const clientData = parseClientDataJsonBase64url(response ? readStringField(response, "clientDataJSON") : "");
-	if (clientData.type !== "webauthn.create") return {
-		ok: false,
-		code: "invalid_body",
-		message: "Invalid webauthn_registration.clientDataJSON.type (expected webauthn.create)"
-	};
-	if (clientData.challenge !== input.expectedChallenge) return {
-		ok: false,
-		code: "challenge_mismatch",
-		message: "Registration challenge mismatch"
-	};
+	if (clientData.type !== "webauthn.create") return failure("invalid_body", "Invalid webauthn_registration.clientDataJSON.type (expected webauthn.create)");
+	if (clientData.challenge !== input.expectedChallenge) return failure("challenge_mismatch", "Registration challenge mismatch");
 	const originHost = originHostnameOrEmpty(clientData.origin);
-	if (!isHostWithinRpId(originHost, input.rpId)) return {
-		ok: false,
-		code: "invalid_origin",
-		message: "WebAuthn origin is not within rpId"
-	};
+	if (!isHostWithinRpId(originHost, input.rpId)) return failure("invalid_origin", "WebAuthn origin is not within rpId");
 	return {
 		ok: true,
 		originHost
@@ -176,11 +145,7 @@ async function linkNearSubjectForWebAuthnLogin(input) {
 }
 async function verifyWebAuthnRegistrationCredentialForIntent(input) {
 	const credential = readRecord(input.webauthnRegistration);
-	if (!credential) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Missing webauthn_registration"
-	};
+	if (!credential) return failure("invalid_body", "Missing webauthn_registration");
 	const parsedClientData = parseWebAuthnClientDataForRegistration({
 		credential,
 		expectedChallenge: input.expectedChallenge,
@@ -188,17 +153,9 @@ async function verifyWebAuthnRegistrationCredentialForIntent(input) {
 	});
 	if (!parsedClientData.ok) return parsedClientData;
 	const expectedOrigin = normalizeOptionalTrimmedString(input.expectedOrigin);
-	if (!expectedOrigin) return {
-		ok: false,
-		code: "invalid_body",
-		message: "expected_origin is required for WebAuthn registration verification"
-	};
+	if (!expectedOrigin) return failure("invalid_body", "expected_origin is required for WebAuthn registration verification");
 	const verifyRegistrationResponse = (await loadSimpleWebAuthnServer()).verifyRegistrationResponse;
-	if (typeof verifyRegistrationResponse !== "function") return {
-		ok: false,
-		code: "unsupported",
-		message: "WebAuthn registration verifier is unavailable in this runtime"
-	};
+	if (typeof verifyRegistrationResponse !== "function") return failure("unsupported", "WebAuthn registration verifier is unavailable in this runtime");
 	const registration = await verifyRegistrationResponse({
 		response: credential,
 		expectedChallenge: input.expectedChallenge,
@@ -206,19 +163,11 @@ async function verifyWebAuthnRegistrationCredentialForIntent(input) {
 		expectedRPID: input.rpId,
 		requireUserVerification: false
 	});
-	if (!registration.verified) return {
-		ok: false,
-		code: "not_verified",
-		message: "Registration verification failed"
-	};
+	if (!registration.verified) return failure("not_verified", "Registration verification failed");
 	const verifiedCredential = registration.registrationInfo?.credential;
 	const credentialIdB64u = String(verifiedCredential?.id || "").trim();
 	const credentialPublicKey = verifiedCredential?.publicKey;
-	if (!credentialIdB64u || !credentialPublicKey) return {
-		ok: false,
-		code: "internal",
-		message: "Registration verification did not return credential public key material"
-	};
+	if (!credentialIdB64u || !credentialPublicKey) return failure("internal", "Registration verification did not return credential public key material");
 	return {
 		ok: true,
 		credential: {
@@ -364,16 +313,8 @@ async function listWebAuthnAuthenticatorsForUserWithStores(input) {
 	try {
 		const userId = String(input.userId || "").trim();
 		const rpId = String(input.rpId || "").trim();
-		if (!userId) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing userId"
-		};
-		if (!input.authenticatorStore.list) return {
-			ok: false,
-			code: "not_supported",
-			message: "Authenticator listing is not supported by this store"
-		};
+		if (!userId) return failure("invalid_args", "Missing userId");
+		if (!input.authenticatorStore.list) return failure("not_supported", "Authenticator listing is not supported by this store");
 		const bindingList = await listCredentialBindingsForUser({
 			bindingStore: input.credentialBindingStore,
 			userId,
@@ -400,33 +341,17 @@ async function listWebAuthnAuthenticatorsForUserWithStores(input) {
 			authenticators: merged
 		};
 	} catch (e) {
-		return {
-			ok: false,
-			code: "internal",
-			message: errorMessage(e) || "Failed to list authenticators"
-		};
+		return failure("internal", errorMessage(e) || "Failed to list authenticators");
 	}
 }
 async function createWebAuthnLoginOptionsWithStore(input) {
 	try {
 		const userIdRaw = String(input.request.userId ?? input.request.user_id ?? "").trim();
 		const rpId = String(input.request.rpId ?? input.request.rp_id ?? "").trim();
-		if (!userIdRaw) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing userId"
-		};
+		if (!userIdRaw) return failure("invalid_body", "Missing userId");
 		const userId = parseBoundaryWalletId(userIdRaw);
-		if (!userId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Invalid userId"
-		};
-		if (!rpId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing rpId"
-		};
+		if (!userId) return failure("invalid_body", "Invalid userId");
+		if (!rpId) return failure("invalid_body", "Missing rpId");
 		const randomAvailable = ensureCryptoRandomValues();
 		if (randomAvailable !== true) return randomAvailable;
 		const ttlMsClamped = normalizeWebAuthnTtlMs(input.request.ttlMs ?? input.request.ttl_ms);
@@ -450,28 +375,16 @@ async function createWebAuthnLoginOptionsWithStore(input) {
 			expiresAtMs
 		};
 	} catch (e) {
-		return {
-			ok: false,
-			code: "internal",
-			message: errorMessage(e) || "Failed to create login options"
-		};
+		return failure("internal", errorMessage(e) || "Failed to create login options");
 	}
 }
 async function createWebAuthnSyncAccountOptionsWithStores(input) {
 	try {
 		const rpId = String(input.request.rp_id || "").trim();
-		if (!rpId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing rp_id"
-		};
+		if (!rpId) return failure("invalid_body", "Missing rp_id");
 		const expectedUserIdRaw = normalizeOptionalTrimmedString(input.request.account_id);
 		const expectedUserId = expectedUserIdRaw ? parseBoundaryWalletId(expectedUserIdRaw) : null;
-		if (expectedUserIdRaw && !expectedUserId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Invalid wallet account_id"
-		};
+		if (expectedUserIdRaw && !expectedUserId) return failure("invalid_body", "Invalid wallet account_id");
 		const randomAvailable = ensureCryptoRandomValues();
 		if (randomAvailable !== true) return randomAvailable;
 		const ttlMsClamped = normalizeWebAuthnTtlMs(input.request.ttlMs ?? input.request.ttl_ms);
@@ -528,47 +441,24 @@ async function createWebAuthnSyncAccountOptionsWithStores(input) {
 		if (walletBinding) result.walletBinding = walletBinding;
 		return result;
 	} catch (e) {
-		return {
-			ok: false,
-			code: "internal",
-			message: errorMessage(e) || "Failed to create sync account options"
-		};
+		return failure("internal", errorMessage(e) || "Failed to create sync account options");
 	}
 }
 async function verifyWebAuthnSyncAccountWithStores(input) {
 	try {
 		const request = input.request;
 		const challengeId = String(request.challengeId ?? request.challenge_id ?? "").trim();
-		if (!challengeId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing challengeId"
-		};
+		if (!challengeId) return failure("invalid_body", "Missing challengeId");
 		const challenge = await input.syncChallengeStore.consume(challengeId);
-		if (!challenge) return {
-			ok: false,
-			verified: false,
-			code: "challenge_expired_or_invalid",
-			message: "Sync challenge expired or invalid"
-		};
+		if (!challenge) return failedVerification("challenge_expired_or_invalid", "Sync challenge expired or invalid");
 		const credential = request.webauthn_authentication;
 		const credentialId = credentialRawIdB64u(credential);
-		if (!credentialId.ok) return {
-			ok: false,
-			verified: false,
-			code: credentialId.code,
-			message: credentialId.message
-		};
+		if (!credentialId.ok) return failedVerification(credentialId.code, credentialId.message);
 		const syncBinding = webAuthnSyncCredentialBinding(await input.credentialBindingStore.get(challenge.rpId, credentialId.credentialIdB64u), challenge);
 		if (!syncBinding.ok) return syncBinding;
 		const binding = syncBinding.binding;
 		const expectedOrigin = normalizeOptionalTrimmedString(request.expected_origin);
-		if (!expectedOrigin) return {
-			ok: false,
-			verified: false,
-			code: "invalid_body",
-			message: "expected_origin is required for WebAuthn authentication verification"
-		};
+		if (!expectedOrigin) return failedVerification("invalid_body", "expected_origin is required for WebAuthn authentication verification");
 		const verificationFailure = webAuthnAuthenticationFailure(await verifyWebAuthnAuthenticationLiteWithStore({
 			userId: binding.userId,
 			rpId: requireWebAuthnRpId(binding.rpId, "sync credential binding rpId"),
@@ -580,30 +470,15 @@ async function verifyWebAuthnSyncAccountWithStores(input) {
 		}));
 		if (verificationFailure) return verificationFailure;
 		const auth = await input.authenticatorStore.get(binding.userId, credentialId.credentialIdB64u);
-		if (!auth) return {
-			ok: false,
-			verified: false,
-			code: "unknown_credential",
-			message: "Credential is not registered for user"
-		};
+		if (!auth) return failedVerification("unknown_credential", "Credential is not registered for user");
 		const walletBinding = resolvedEd25519WalletBindingFromCredentialBinding({ binding });
 		const bindingPublicKey = binding.publicKey;
-		if (!walletBinding || !bindingPublicKey) return {
-			ok: false,
-			verified: false,
-			code: "ed25519_not_provisioned",
-			message: "Wallet has no Ed25519 signer yet; NEAR provisioning has not completed"
-		};
+		if (!walletBinding || !bindingPublicKey) return failedVerification("ed25519_not_provisioned", "Wallet has no Ed25519 signer yet; NEAR provisioning has not completed");
 		const ed25519Signer = await input.walletStore.getEd25519SignerBySlot({
 			walletId: walletIdFromString(walletBinding.walletId),
 			signerSlot: walletBinding.signerSlot
 		});
-		if (!ed25519Signer) return {
-			ok: false,
-			verified: false,
-			code: "ed25519_not_provisioned",
-			message: "Wallet has no Ed25519 signer yet; NEAR provisioning has not completed"
-		};
+		if (!ed25519Signer) return failedVerification("ed25519_not_provisioned", "Wallet has no Ed25519 signer yet; NEAR provisioning has not completed");
 		const walletBindingAuthorityScope = passkeyThresholdEd25519AuthorityScope(requireWebAuthnRpId(walletBinding.rpId, "sync credential binding rpId"));
 		const thresholdEd25519 = binding.relayerKeyId ? {
 			relayerKeyId: binding.relayerKeyId,
@@ -633,43 +508,19 @@ async function verifyWebAuthnSyncAccountWithStores(input) {
 			...thresholdEd25519 ? { thresholdEd25519 } : {}
 		};
 	} catch (e) {
-		return {
-			ok: false,
-			verified: false,
-			code: "internal",
-			message: errorMessage(e) || "Sync verification failed"
-		};
+		return failedVerification("internal", errorMessage(e) || "Sync verification failed");
 	}
 }
 async function verifyWebAuthnLoginWithStores(input) {
 	try {
 		const challengeId = String(input.request.challengeId ?? input.request.challenge_id ?? "").trim();
-		if (!challengeId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing challengeId"
-		};
+		if (!challengeId) return failure("invalid_body", "Missing challengeId");
 		const record = await input.loginChallengeStore.consume(challengeId);
-		if (!record) return {
-			ok: false,
-			verified: false,
-			code: "challenge_expired_or_invalid",
-			message: "Login challenge expired or invalid"
-		};
+		if (!record) return failedVerification("challenge_expired_or_invalid", "Login challenge expired or invalid");
 		const expectedOrigin = normalizeOptionalTrimmedString(input.request.expected_origin);
-		if (!expectedOrigin) return {
-			ok: false,
-			verified: false,
-			code: "invalid_body",
-			message: "expected_origin is required for WebAuthn authentication verification"
-		};
+		if (!expectedOrigin) return failedVerification("invalid_body", "expected_origin is required for WebAuthn authentication verification");
 		const credential = parseWebAuthnAuthenticationCredential(input.request.webauthn_authentication);
-		if (!credential) return {
-			ok: false,
-			verified: false,
-			code: "invalid_body",
-			message: "Missing webauthn_authentication"
-		};
+		if (!credential) return failedVerification("invalid_body", "Missing webauthn_authentication");
 		const verificationFailure = webAuthnAuthenticationFailure(await verifyWebAuthnAuthenticationLiteWithStore({
 			userId: record.userId,
 			rpId: requireWebAuthnRpId(record.rpId, "login challenge rpId"),
@@ -697,12 +548,7 @@ async function verifyWebAuthnLoginWithStores(input) {
 			ed25519: loginSigner.ed25519
 		};
 	} catch (e) {
-		return {
-			ok: false,
-			verified: false,
-			code: "internal",
-			message: errorMessage(e) || "Login verification failed"
-		};
+		return failedVerification("internal", errorMessage(e) || "Login verification failed");
 	}
 }
 //#endregion

package/dist/esm/core/authService/webauthnVerificationOutcomes.js

@@ -1,12 +1,8 @@
+import { failedVerification } from "../../shared-ts/src/utils/failure.js";
 //#region src/core/authService/webauthnVerificationOutcomes.ts
 /** The failure a login or sync returns when its assertion did not verify; null when it did. */
 function webAuthnAuthenticationFailure(verification) {
-	if (!verification.success || !verification.verified) return {
-		ok: false,
-		verified: false,
-		code: verification.code || "not_verified",
-		message: verification.message || "Authentication verification failed"
-	};
+	if (!verification.success || !verification.verified) return failedVerification(verification.code || "not_verified", verification.message || "Authentication verification failed");
 	return null;
 }
 /**
@@ -16,12 +12,7 @@ function webAuthnAuthenticationFailure(verification) {
 function webAuthnLoginEd25519(binding, walletBinding) {
 	const firstParticipantId = binding?.participantIds?.[0];
 	const secondParticipantId = binding?.participantIds?.[1];
-	if (!binding) return {
-		ok: false,
-		verified: false,
-		code: "unknown_credential",
-		message: "Credential has no wallet binding"
-	};
+	if (!binding) return failedVerification("unknown_credential", "Credential has no wallet binding");
 	return {
 		ok: true,
 		ed25519: walletBinding && binding.publicKey && binding.relayerKeyId && firstParticipantId !== void 0 && secondParticipantId !== void 0 ? {
@@ -37,18 +28,8 @@ function webAuthnLoginEd25519(binding, walletBinding) {
 }
 /** The sync credential's binding, if it exists and belongs to the account the challenge expects. */
 function webAuthnSyncCredentialBinding(binding, challenge) {
-	if (!binding) return {
-		ok: false,
-		verified: false,
-		code: "unknown_credential",
-		message: "Credential is not registered on this relay"
-	};
-	if (challenge.expectedUserId && binding.userId !== challenge.expectedUserId) return {
-		ok: false,
-		verified: false,
-		code: "unknown_credential",
-		message: `Credential is not registered for account ${challenge.expectedUserId}`
-	};
+	if (!binding) return failedVerification("unknown_credential", "Credential is not registered on this relay");
+	if (challenge.expectedUserId && binding.userId !== challenge.expectedUserId) return failedVerification("unknown_credential", `Credential is not registered for account ${challenge.expectedUserId}`);
 	return {
 		ok: true,
 		binding