npm - @seams/wallet-server - Versions diffs - 0.7.1 → 0.7.3 - Mend

@seams/wallet-server 0.7.1 → 0.7.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (259) hide show

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeIssuer.js CHANGED Viewed

@@ -1,6 +1,7 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { emailOtpChallengePurposeIsValid, emailOtpChallengeRecord, generateNumericOtp } from "./d1EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeIssuer.ts
@@ -8,18 +9,10 @@ function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error || "");
 }
 function emailOtpEnrollmentTenantMismatch() {
-	return {
-		ok: false,
-		code: "tenant_scope_mismatch",
-		message: "Email OTP enrollment does not match the requested orgId"
-	};
+	return failure("tenant_scope_mismatch", "Email OTP enrollment does not match the requested orgId");
 }
 function emailOtpProviderIdentityMismatch() {
-	return {
-		ok: false,
-		code: "provider_identity_mismatch",
-		message: "Email OTP enrollment does not match the requested provider user"
-	};
+	return failure("provider_identity_mismatch", "Email OTP enrollment does not match the requested provider user");
 }
 var CloudflareD1EmailOtpChallengeIssuer = class {
 	constructor(input) {
@@ -40,39 +33,15 @@ var CloudflareD1EmailOtpChallengeIssuer = class {
 			const clientIp = normalizeOptionalTrimmedString(input.clientIp);
 			const action = input.action;
 			const operation = input.operation;
-			if (!userId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Missing userId"
-			};
-			if (!walletId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Missing walletId"
-			};
-			if (!orgId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Missing orgId"
-			};
-			if (otpChannel !== "email_otp") return {
-				ok: false,
-				code: "invalid_body",
-				message: "otpChannel must be email_otp"
-			};
-			if (!ownerProofBindingDigest) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Missing ownerProofBindingDigest"
-			};
+			if (!userId) return failure("invalid_body", "Missing userId");
+			if (!walletId) return failure("invalid_body", "Missing walletId");
+			if (!orgId) return failure("invalid_body", "Missing orgId");
+			if (otpChannel !== "email_otp") return failure("invalid_body", "otpChannel must be email_otp");
+			if (!ownerProofBindingDigest) return failure("invalid_body", "Missing ownerProofBindingDigest");
 			if (!emailOtpChallengePurposeIsValid({
 				action,
 				operation
-			})) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Email OTP challenge action does not match operation"
-			};
+			})) return failure("invalid_body", "Email OTP challenge action does not match operation");
 			let challengeEmail = email;
 			if (action !== WALLET_EMAIL_OTP_ACTIONS.registration && action !== WALLET_EMAIL_OTP_ACTIONS.recoveryBootstrap) {
 				const enrollment = await this.readActiveEnrollment({
@@ -91,11 +60,7 @@ var CloudflareD1EmailOtpChallengeIssuer = class {
 				};
 				challengeEmail = enrollment.enrollment.verifiedEmail;
 			}
-			if (!challengeEmail) return {
-				ok: false,
-				code: "recovery_email_missing",
-				message: "Authenticated identity does not include a recovery email"
-			};
+			if (!challengeEmail) return failure("recovery_email_missing", "Authenticated identity does not include a recovery email");
 			const nowMs = Date.now();
 			await this.emailOtpChallenges.pruneExpired(nowMs);
 			if (input.reuseActiveChallenge === true) {
@@ -188,20 +153,12 @@ var CloudflareD1EmailOtpChallengeIssuer = class {
 				delivery: delivery.delivery
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: errorMessage(error) || "Failed to create Email OTP challenge"
-			};
+			return failure("internal", errorMessage(error) || "Failed to create Email OTP challenge");
 		}
 	}
 	async readActiveEnrollment(input) {
 		const enrollment = await this.emailOtpEnrollments.readEnrollment(input.walletId);
-		if (!enrollment) return {
-			ok: false,
-			code: "not_found",
-			message: "Email OTP enrollment not found"
-		};
+		if (!enrollment) return failure("not_found", "Email OTP enrollment not found");
 		if (enrollment.orgId !== input.orgId) return emailOtpEnrollmentTenantMismatch();
 		if (enrollment.providerUserId !== input.providerUserId) return emailOtpProviderIdentityMismatch();
 		return {

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeService.js CHANGED Viewed

@@ -1,6 +1,7 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { emailOtpGrantRecord, maskEmail, parseEmailOtpLoginOperation } from "./d1EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpChallengeService.ts
@@ -89,26 +90,10 @@ var CloudflareD1EmailOtpChallengeService = class {
 			const orgId = normalizeOptionalTrimmedString(input.orgId);
 			const challengeId = normalizeOptionalTrimmedString(input.challengeId);
 			const registrationAttemptId = normalizeOptionalTrimmedString(input.googleEmailOtpRegistrationAttemptId);
-			if (!providerSubject) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Email OTP registration requires providerSubject"
-			};
-			if (!walletId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Email OTP registration requires walletId"
-			};
-			if (!orgId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Email OTP registration requires orgId"
-			};
-			if (!challengeId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Email OTP registration requires challengeId"
-			};
+			if (!providerSubject) return failure("invalid_body", "Email OTP registration requires providerSubject");
+			if (!walletId) return failure("invalid_body", "Email OTP registration requires walletId");
+			if (!orgId) return failure("invalid_body", "Email OTP registration requires orgId");
+			if (!challengeId) return failure("invalid_body", "Email OTP registration requires challengeId");
 			const proofEmail = await this.resolveRegistrationProofEmail({
 				explicitProofEmail: input.proofEmail,
 				providerSubject,
@@ -129,11 +114,7 @@ var CloudflareD1EmailOtpChallengeService = class {
 			});
 			if (!verified.ok) return verified;
 			const verifiedEmail = normalizeOptionalTrimmedString(verified.email)?.toLowerCase() || "";
-			if (!verifiedEmail) return {
-				ok: false,
-				code: "internal",
-				message: "Email OTP enrollment verification did not include a verified email"
-			};
+			if (!verifiedEmail) return failure("internal", "Email OTP enrollment verification did not include a verified email");
 			const persisted = await this.finalizer.persistVerifiedEnrollment({
 				walletId: verified.walletId,
 				orgId: verified.orgId,
@@ -151,11 +132,7 @@ var CloudflareD1EmailOtpChallengeService = class {
 				enrollment: persisted.enrollment
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: errorMessage(error) || "Failed to verify Email OTP enrollment"
-			};
+			return failure("internal", errorMessage(error) || "Failed to verify Email OTP enrollment");
 		}
 	}
 	async verifyEmailOtpChallenge(input) {
@@ -232,41 +209,21 @@ var CloudflareD1EmailOtpChallengeService = class {
 		};
 	}
 	async readEmailOtpOutboxEntry(input) {
-		if (!this.devOutboxEnabled) return {
-			ok: false,
-			code: "not_found",
-			message: "Email OTP dev outbox is not enabled"
-		};
+		if (!this.devOutboxEnabled) return failure("not_found", "Email OTP dev outbox is not enabled");
 		const challengeId = normalizeOptionalTrimmedString(input.challengeId);
 		const userId = normalizeOptionalTrimmedString(input.userId);
 		const walletId = normalizeOptionalTrimmedString(input.walletId);
-		if (!userId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing userId"
-		};
-		if (!walletId) return {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing walletId"
-		};
+		if (!userId) return failure("invalid_body", "Missing userId");
+		if (!walletId) return failure("invalid_body", "Missing walletId");
 		const record = challengeId ? await this.challenges.read(challengeId) : await this.challenges.readLatestActiveForSubjectWallet({
 			challengeSubjectId: userId,
 			walletId,
 			nowMs: Date.now()
 		});
-		if (!record || record.challengeSubjectId !== userId || record.walletId !== walletId) return {
-			ok: false,
-			code: "not_found",
-			message: "Email OTP outbox entry was not found"
-		};
+		if (!record || record.challengeSubjectId !== userId || record.walletId !== walletId) return failure("not_found", "Email OTP outbox entry was not found");
 		if (Date.now() > record.expiresAtMs) {
 			await this.challenges.delete(challengeId);
-			return {
-				ok: false,
-				code: "not_found",
-				message: "Email OTP outbox entry expired"
-			};
+			return failure("not_found", "Email OTP outbox entry expired");
 		}
 		return {
 			ok: true,
@@ -286,33 +243,13 @@ var CloudflareD1EmailOtpChallengeService = class {
 				ok: true,
 				email: proofEmail
 			};
-			return {
-				ok: false,
-				code: "invalid_body",
-				message: "Email OTP registration requires proofEmail"
-			};
+			return failure("invalid_body", "Email OTP registration requires proofEmail");
 		}
 		const attempt = await this.registrationAttempts.read(input.registrationAttemptId);
-		if (!attempt) return {
-			ok: false,
-			code: "registration_attempt_missing",
-			message: "Google Email OTP registration attempt expired or was not found"
-		};
-		if (attempt.providerSubject !== input.providerSubject) return {
-			ok: false,
-			code: "challenge_subject_mismatch",
-			message: "Email OTP registration attempt does not match the provider subject"
-		};
-		if (attempt.expiresAtMs <= Date.now()) return {
-			ok: false,
-			code: "registration_attempt_expired",
-			message: "Google Email OTP registration attempt expired"
-		};
-		if (attempt.walletId !== input.walletId) return {
-			ok: false,
-			code: "wallet_identity_mismatch",
-			message: "registrationAttemptId does not match walletId"
-		};
+		if (!attempt) return failure("registration_attempt_missing", "Google Email OTP registration attempt expired or was not found");
+		if (attempt.providerSubject !== input.providerSubject) return failure("challenge_subject_mismatch", "Email OTP registration attempt does not match the provider subject");
+		if (attempt.expiresAtMs <= Date.now()) return failure("registration_attempt_expired", "Google Email OTP registration attempt expired");
+		if (attempt.walletId !== input.walletId) return failure("wallet_identity_mismatch", "registrationAttemptId does not match walletId");
 		proofEmail = attempt.email.toLowerCase();
 		return {
 			ok: true,

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpDeliveryRuntime.js CHANGED Viewed

@@ -1,3 +1,4 @@
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { EMAIL_OTP_CHANNEL } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { maskEmail } from "./d1EmailOtpRecords.js";
 //#region src/router/cloudflare/d1/emailOtp/d1EmailOtpDeliveryRuntime.ts
@@ -24,11 +25,7 @@ var CloudflareD1EmailOtpDeliveryRuntime = class {
 		return this.resolveDelivery(record, requestOrigin, "reused");
 	}
 	async deliverEmailOtpCode(record, requestOrigin) {
-		if (this.config.production && this.config.deliveryMode !== "email_provider" && this.config.deliveryMode !== "provider_and_demo_code" && this.config.deliveryMode !== "demo_code_response") return {
-			ok: false,
-			code: "email_otp_delivery_not_allowed",
-			message: `Email OTP delivery mode ${this.config.deliveryMode} is disabled in production`
-		};
+		if (this.config.production && this.config.deliveryMode !== "email_provider" && this.config.deliveryMode !== "provider_and_demo_code" && this.config.deliveryMode !== "demo_code_response") return failure("email_otp_delivery_not_allowed", `Email OTP delivery mode ${this.config.deliveryMode} is disabled in production`);
 		const emailHint = maskEmail(record.email);
 		switch (this.config.deliveryMode) {
 			case "provider_and_demo_code": {
@@ -58,11 +55,7 @@ var CloudflareD1EmailOtpDeliveryRuntime = class {
 	}
 	async dispatchProviderEmail(record, emailHint) {
 		const provider = this.config.deliveryProvider;
-		if (!provider) return {
-			ok: false,
-			code: "email_otp_delivery_not_configured",
-			message: "Email OTP email_provider delivery is not configured"
-		};
+		if (!provider) return failure("email_otp_delivery_not_configured", "Email OTP email_provider delivery is not configured");
 		const result = await provider.deliver({
 			challengeId: record.challengeId,
 			walletId: record.walletId,
@@ -86,11 +79,7 @@ var CloudflareD1EmailOtpDeliveryRuntime = class {
 		const emailHint = maskEmail(record.email);
 		switch (this.config.deliveryMode) {
 			case "email_provider":
-				if (!this.config.deliveryProvider) return {
-					ok: false,
-					code: "email_otp_delivery_not_configured",
-					message: "Email OTP email_provider delivery is not configured"
-				};
+				if (!this.config.deliveryProvider) return failure("email_otp_delivery_not_configured", "Email OTP email_provider delivery is not configured");
 				return {
 					ok: true,
 					delivery: {
@@ -101,11 +90,7 @@ var CloudflareD1EmailOtpDeliveryRuntime = class {
 					}
 				};
 			case "provider_and_demo_code":
-				if (!this.config.deliveryProvider) return {
-					ok: false,
-					code: "email_otp_delivery_not_configured",
-					message: "Email OTP email_provider delivery is not configured"
-				};
+				if (!this.config.deliveryProvider) return failure("email_otp_delivery_not_configured", "Email OTP email_provider delivery is not configured");
 				return this.resolveDemoCodeDelivery(record, requestOrigin, status, emailHint);
 			case "log":
 			case "dev_d1_outbox":
@@ -124,11 +109,7 @@ var CloudflareD1EmailOtpDeliveryRuntime = class {
 	}
 	resolveDemoCodeDelivery(record, requestOrigin, status, emailHint) {
 		const origin = typeof requestOrigin === "string" ? requestOrigin.trim() : "";
-		if (!this.config.demoAllowedOrigins.includes(origin)) return {
-			ok: false,
-			code: "email_otp_demo_origin_not_allowed",
-			message: "Email OTP demo code delivery is not allowed for this origin"
-		};
+		if (!this.config.demoAllowedOrigins.includes(origin)) return failure("email_otp_demo_origin_not_allowed", "Email OTP demo code delivery is not allowed for this origin");
 		if (this.config.deliveryMode === "provider_and_demo_code") return {
 			ok: true,
 			delivery: {

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecords.js CHANGED Viewed

@@ -2,6 +2,8 @@ import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
 import "../../../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
+import { hasExactKeys } from "../../../../shared-ts/src/utils/exactKeys.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, WALLET_EMAIL_OTP_REGISTRATION_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION, isWalletEmailOtpLoginOperation } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { isB64uString, nonNegativeSafeInteger, parseJsonObject, positiveSafeInteger } from "../auth/d1RouterApiAuthBoundary.js";
 import { parseCurrentEmailOtpChallengeRow, parseCurrentEmailOtpGrantRow, parseCurrentEmailOtpUnlockChallengeRow } from "../../../../core/EmailOtpRecords.js";
@@ -165,7 +167,7 @@ function parseEmailOtpChallengeRow(row) {
 }
 function parseEmailOtpRegistrationVerificationReceiptV1(input) {
 	const record = parseJsonObject(input);
-	if (!record || !hasExactRecordFields(record, [
+	if (!record || !hasExactKeys(record, [
 		"version",
 		"requestFingerprint",
 		"verified",
@@ -176,7 +178,7 @@ function parseEmailOtpRegistrationVerificationReceiptV1(input) {
 	const verified = parseJsonObject(record.verified);
 	const verifiedAtMs = positiveSafeInteger(record.verifiedAtMs);
 	const expiresAtMs = positiveSafeInteger(record.expiresAtMs);
-	if (!requestFingerprint || !isB64uString(requestFingerprint) || !verified || !hasExactRecordFields(verified, [
+	if (!requestFingerprint || !isB64uString(requestFingerprint) || !verified || !hasExactKeys(verified, [
 		"challengeId",
 		"challengeSubjectId",
 		"walletId",
@@ -284,11 +286,7 @@ function emailOtpRegistrationChallengeBindingMismatchCode(input) {
 	return null;
 }
 function emailOtpChallengeInvalidOrExpired() {
-	return {
-		ok: false,
-		code: "challenge_expired_or_invalid",
-		message: "Email OTP challenge expired or invalid"
-	};
+	return failure("challenge_expired_or_invalid", "Email OTP challenge expired or invalid");
 }
 function emailOtpGrantRecord(input) {
 	return {
@@ -330,49 +328,21 @@ async function validateEmailOtpEnrollmentMaterial(input) {
 	const clientUnlockPublicKeyB64u = normalizeOptionalTrimmedString(input.material.clientUnlockPublicKeyB64u);
 	const unlockKeyVersion = normalizeOptionalTrimmedString(input.material.unlockKeyVersion);
 	const serverSealedFactorCiphertextB64u = normalizeOptionalTrimmedString(input.material.serverSealedFactorCiphertextB64u);
-	if (!enrollmentSealKeyVersion) return {
-		ok: false,
-		code: "invalid_body",
-		message: "enrollmentSealKeyVersion is required"
-	};
-	if (!clientUnlockPublicKeyB64u) return {
-		ok: false,
-		code: "invalid_body",
-		message: "clientUnlockPublicKeyB64u is required"
-	};
-	if (!unlockKeyVersion) return {
-		ok: false,
-		code: "invalid_body",
-		message: "unlockKeyVersion is required"
-	};
-	if (!serverSealedFactorCiphertextB64u) return {
-		ok: false,
-		code: "invalid_body",
-		message: "serverSealedFactorCiphertextB64u is required"
-	};
+	if (!enrollmentSealKeyVersion) return failure("invalid_body", "enrollmentSealKeyVersion is required");
+	if (!clientUnlockPublicKeyB64u) return failure("invalid_body", "clientUnlockPublicKeyB64u is required");
+	if (!unlockKeyVersion) return failure("invalid_body", "unlockKeyVersion is required");
+	if (!serverSealedFactorCiphertextB64u) return failure("invalid_body", "serverSealedFactorCiphertextB64u is required");
 	let unlockPublicKeyBytes;
 	try {
 		unlockPublicKeyBytes = base64UrlDecode(clientUnlockPublicKeyB64u);
 	} catch {
-		return {
-			ok: false,
-			code: "invalid_body",
-			message: "clientUnlockPublicKeyB64u must be valid base64url"
-		};
+		return failure("invalid_body", "clientUnlockPublicKeyB64u must be valid base64url");
 	}
-	if (unlockPublicKeyBytes.length !== 33) return {
-		ok: false,
-		code: "invalid_body",
-		message: "clientUnlockPublicKeyB64u must decode to 33 bytes (compressed secp256k1 pubkey)"
-	};
+	if (unlockPublicKeyBytes.length !== 33) return failure("invalid_body", "clientUnlockPublicKeyB64u must decode to 33 bytes (compressed secp256k1 pubkey)");
 	try {
 		await input.validateSecp256k1PublicKey33(unlockPublicKeyBytes);
 	} catch {
-		return {
-			ok: false,
-			code: "invalid_body",
-			message: "clientUnlockPublicKeyB64u is not a valid secp256k1 public key"
-		};
+		return failure("invalid_body", "clientUnlockPublicKeyB64u is not a valid secp256k1 public key");
 	}
 	return {
 		ok: true,
@@ -421,11 +391,6 @@ function optionalNonNegativeSafeIntegerField(record, field) {
 function hasRecordField(record, field) {
 	return Object.prototype.hasOwnProperty.call(record, field);
 }
-function hasExactRecordFields(record, expectedFields) {
-	const actualFields = Object.keys(record).sort();
-	const expected = [...expectedFields].sort();
-	return actualFields.length === expected.length && actualFields.every((field, index) => field === expected[index]);
-}
 function patchedPositiveAuthStateValue(current, patch) {
 	if (patch === null) return void 0;
 	if (patch === void 0) return current;

package/dist/esm/router/cloudflare/d1/emailOtp/d1EmailOtpRecoveryService.js CHANGED Viewed

@@ -1,6 +1,7 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
+import { failedVerification, failure } from "../../../../shared-ts/src/utils/failure.js";
 import { validateSecp256k1PublicKey33, verifySecp256k1RecoverableSignatureAgainstPublicKey33 } from "../../../../core/ThresholdService/evmCryptoWasm.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { parseD1BoundaryWalletIdResult } from "../auth/d1RouterApiAuthBoundary.js";
@@ -61,32 +62,16 @@ function normalizeEmailOtpStrongAuthInput(input) {
 	};
 }
 function invalidEmailOtpEnrollmentReadBody(message) {
-	return {
-		ok: false,
-		code: "invalid_body",
-		message
-	};
+	return failure("invalid_body", message);
 }
 function invalidActiveEmailOtpEnrollmentReadBody(message) {
-	return {
-		ok: false,
-		code: "invalid_body",
-		message
-	};
+	return failure("invalid_body", message);
 }
 function invalidEmailOtpStrongAuthBody(message) {
-	return {
-		ok: false,
-		code: "invalid_body",
-		message
-	};
+	return failure("invalid_body", message);
 }
 function emailOtpEnrollmentTenantMismatch() {
-	return {
-		ok: false,
-		code: "tenant_scope_mismatch",
-		message: "Email OTP enrollment does not match the requested orgId"
-	};
+	return failure("tenant_scope_mismatch", "Email OTP enrollment does not match the requested orgId");
 }
 var CloudflareD1EmailOtpRecoveryService = class {
 	constructor(input) {
@@ -99,11 +84,7 @@ var CloudflareD1EmailOtpRecoveryService = class {
 		const parsed = normalizeEmailOtpEnrollmentReadInput(input);
 		if (!parsed.ok) return parsed.result;
 		const enrollment = await this.emailOtpEnrollments.readEnrollment(parsed.value.walletId);
-		if (!enrollment) return {
-			ok: false,
-			code: "not_found",
-			message: "Email OTP enrollment not found"
-		};
+		if (!enrollment) return failure("not_found", "Email OTP enrollment not found");
 		if (enrollment.orgId !== parsed.value.orgId) return emailOtpEnrollmentTenantMismatch();
 		return {
 			ok: true,
@@ -118,11 +99,7 @@ var CloudflareD1EmailOtpRecoveryService = class {
 			orgId: parsed.value.orgId
 		});
 		if (!enrollment.ok) return enrollment;
-		if (parsed.value.providerUserId && enrollment.enrollment.providerUserId !== parsed.value.providerUserId) return {
-			ok: false,
-			code: "provider_identity_mismatch",
-			message: "Email OTP enrollment does not match the requested provider user"
-		};
+		if (parsed.value.providerUserId && enrollment.enrollment.providerUserId !== parsed.value.providerUserId) return failure("provider_identity_mismatch", "Email OTP enrollment does not match the requested provider user");
 		return enrollment;
 	}
 	async isEmailOtpStrongAuthRequired(input) {
@@ -198,11 +175,7 @@ var CloudflareD1EmailOtpRecoveryService = class {
 				unlockKeyVersion: enrollment.enrollment.unlockKeyVersion
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: errorMessage(error) || "Failed to create Email OTP unlock challenge"
-			};
+			return failure("internal", errorMessage(error) || "Failed to create Email OTP unlock challenge");
 		}
 	}
 	async verifyEmailOtpUnlockProof(input) {
@@ -210,31 +183,31 @@ var CloudflareD1EmailOtpRecoveryService = class {
 			const parsed = normalizeUnlockProofInput(input);
 			if (!parsed.ok) return parsed.result;
 			const challenge = await this.emailOtpChallenges.consumeUnlock(parsed.value.challengeId);
-			if (!challenge || Date.now() > challenge.expiresAtMs) return emailOtpUnlockProofRejected("challenge_expired_or_invalid", "Email OTP unlock challenge expired or invalid");
-			if (challenge.walletId !== parsed.value.walletId) return emailOtpUnlockProofRejected("challenge_binding_mismatch", "Email OTP unlock challenge is not valid for this walletId");
+			if (!challenge || Date.now() > challenge.expiresAtMs) return failedVerification("challenge_expired_or_invalid", "Email OTP unlock challenge expired or invalid");
+			if (challenge.walletId !== parsed.value.walletId) return failedVerification("challenge_binding_mismatch", "Email OTP unlock challenge is not valid for this walletId");
 			const enrollment = await this.readActiveEmailOtpEnrollment({
 				walletId: parsed.value.walletId,
 				orgId: parsed.value.orgId
 			});
-			if (!enrollment.ok) return emailOtpUnlockProofRejected(enrollment.code, enrollment.message);
-			if (challenge.userId !== enrollment.enrollment.providerUserId || challenge.orgId !== enrollment.enrollment.orgId) return emailOtpUnlockProofRejected("challenge_binding_mismatch", "Email OTP unlock challenge is not valid for this enrollment");
+			if (!enrollment.ok) return failedVerification(enrollment.code, enrollment.message);
+			if (challenge.userId !== enrollment.enrollment.providerUserId || challenge.orgId !== enrollment.enrollment.orgId) return failedVerification("challenge_binding_mismatch", "Email OTP unlock challenge is not valid for this enrollment");
 			const publicKey = decodeFixedBase64Url(parsed.value.publicKeyB64u, 33);
-			if (!publicKey) return emailOtpUnlockProofRejected("invalid_body", "unlockProof.publicKey must decode to 33 bytes");
+			if (!publicKey) return failedVerification("invalid_body", "unlockProof.publicKey must decode to 33 bytes");
 			try {
 				await validateSecp256k1PublicKey33(publicKey);
 			} catch {
-				return emailOtpUnlockProofRejected("invalid_body", "unlockProof.publicKey is not a valid secp256k1 public key");
+				return failedVerification("invalid_body", "unlockProof.publicKey is not a valid secp256k1 public key");
 			}
 			const signature = decodeFixedBase64Url(parsed.value.signatureB64u, 65);
-			if (!signature) return emailOtpUnlockProofRejected("invalid_body", "unlockProof.signature must decode to 65 bytes");
+			if (!signature) return failedVerification("invalid_body", "unlockProof.signature must decode to 65 bytes");
 			const enrolledPublicKey = decodeFixedBase64Url(enrollment.enrollment.clientUnlockPublicKeyB64u, 33);
-			if (!enrolledPublicKey || !bytesEqual(enrolledPublicKey, publicKey)) return emailOtpUnlockProofRejected("invalid_unlock_proof", "unlockProof.publicKey does not match the enrolled clientUnlockPublicKeyB64u");
+			if (!enrolledPublicKey || !bytesEqual(enrolledPublicKey, publicKey)) return failedVerification("invalid_unlock_proof", "unlockProof.publicKey does not match the enrolled clientUnlockPublicKeyB64u");
 			const challengeDigest = decodeFixedBase64Url(challenge.challengeB64u, 32);
-			if (!challengeDigest) return emailOtpUnlockProofRejected("internal", "Stored unlock challenge digest must decode to 32 bytes");
+			if (!challengeDigest) return failedVerification("internal", "Stored unlock challenge digest must decode to 32 bytes");
 			try {
 				await verifySecp256k1RecoverableSignatureAgainstPublicKey33(challengeDigest, signature, publicKey);
 			} catch {
-				return emailOtpUnlockProofRejected("invalid_unlock_proof", "unlockProof.signature did not verify against unlockProof.publicKey");
+				return failedVerification("invalid_unlock_proof", "unlockProof.signature did not verify against unlockProof.publicKey");
 			}
 			await this.emailOtpEnrollments.putAuthStateForEnrollment(enrollment.enrollment, { lastEmailOtpLoginAtMs: Date.now() });
 			return {
@@ -249,12 +222,7 @@ var CloudflareD1EmailOtpRecoveryService = class {
 				unlockKeyVersion: enrollment.enrollment.unlockKeyVersion
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				verified: false,
-				code: "internal",
-				message: errorMessage(error) || "Failed to verify Email OTP unlock proof"
-			};
+			return failedVerification("internal", errorMessage(error) || "Failed to verify Email OTP unlock proof");
 		}
 	}
 	async consumeEmailOtpGrant(input) {
@@ -279,11 +247,7 @@ var CloudflareD1EmailOtpRecoveryService = class {
 				otpChannel: EMAIL_OTP_CHANNEL
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: errorMessage(error) || "Failed to consume Email OTP grant"
-			};
+			return failure("internal", errorMessage(error) || "Failed to consume Email OTP grant");
 		}
 	}
 };
@@ -353,48 +317,23 @@ function emailOtpGrantBindingMismatch(record, input) {
 function invalidUnlockChallengeBody(message) {
 	return {
 		ok: false,
-		result: {
-			ok: false,
-			code: "invalid_body",
-			message
-		}
+		result: failure("invalid_body", message)
 	};
 }
 function invalidUnlockProofBody(message) {
 	return {
 		ok: false,
-		result: {
-			ok: false,
-			verified: false,
-			code: "invalid_body",
-			message
-		}
+		result: failedVerification("invalid_body", message)
 	};
 }
 function invalidGrantConsumptionBody(message) {
 	return {
 		ok: false,
-		result: {
-			ok: false,
-			code: "invalid_body",
-			message
-		}
+		result: failure("invalid_body", message)
 	};
 }
 function emailOtpGrantInvalidOrExpired() {
-	return {
-		ok: false,
-		code: "grant_invalid_or_expired",
-		message: "Email OTP grant is invalid or expired"
-	};
-}
-function emailOtpUnlockProofRejected(code, message) {
-	return {
-		ok: false,
-		verified: false,
-		code,
-		message
-	};
+	return failure("grant_invalid_or_expired", "Email OTP grant is invalid or expired");
 }
 //#endregion
 export { CloudflareD1EmailOtpRecoveryService };