@seams/wallet-server 0.20.0 → 0.21.0

package/dist/esm/router/cloudflare.js

@@ -1245,7 +1245,9 @@ function wireLabeled(parse) {
 		}
 	};
 }
-Object.freeze([
+//#endregion
+//#region ../shared-ts/src/authorization/delegatedAuthority.ts
+const FULL_OWNER_PERMISSIONS = Object.freeze([
 	"export_keys",
 	"link_devices",
 	"revoke_devices",
@@ -1308,6 +1310,19 @@ function parseDelegatedWalletAuthorityV1(raw) {
 		value: buildDelegatedWalletAuthorityV1({ permissions: permissions.value })
 	};
 }
+function buildFullOwnerPermissionsV1() {
+	return buildPresetPermissionSet(FULL_OWNER_PERMISSIONS);
+}
+function sameDelegatedWalletAuthorityV1(left, right) {
+	if (left.kind !== right.kind || left.permissions.length !== right.permissions.length) return false;
+	for (let index = 0; index < left.permissions.length; index += 1) if (left.permissions[index] !== right.permissions[index]) return false;
+	return true;
+}
+function buildPresetPermissionSet(permissions) {
+	const parsed = parseDelegatedWalletPermissionSetV1(permissions);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
 function compareDelegatedWalletPermissions(left, right) {
 	return left < right ? -1 : left > right ? 1 : 0;
 }
@@ -2791,6 +2806,7 @@ function parseRouterAbEcdsaOperationStepUpWebAuthnCredentialV1(value) {
 		"signature",
 		"userHandle"
 	]);
+	if (credential.clientExtensionResults !== null) throw new Error("webauthn_authentication.clientExtensionResults must be redacted");
 	const authenticatorAttachment = credential.authenticatorAttachment === null ? null : requireAsciiNonEmptyString(credential.authenticatorAttachment, "webauthn_authentication.authenticatorAttachment");
 	const userHandle = response.userHandle === null ? null : requireAsciiNonEmptyString(response.userHandle, "webauthn_authentication.response.userHandle");
 	return {
@@ -2804,7 +2820,7 @@ function parseRouterAbEcdsaOperationStepUpWebAuthnCredentialV1(value) {
 			signature: requireAsciiNonEmptyString(response.signature, "webauthn_authentication.response.signature"),
 			userHandle
 		},
-		clientExtensionResults: credential.clientExtensionResults
+		clientExtensionResults: null
 	};
 }
 function parseRouterAbEcdsaOperationStepUpAuthorizationRequestV1(value) {
@@ -5654,7 +5670,7 @@ function createRouterApiRouteDefinitions(options = {}) {
 	}, ROUTER_API_WALLET_REGISTRATION_SESSION_SERVICES, {
 		kind: "event",
 		action: "wallet_created"
-	}), publicRoute("wallet_recovery_status", "GET", "/wallets/:walletId/recovery/status", "Report how many recovery codes remain and whether the owner saved them", {
+	}), publicRoute("wallet_recovery_status", "POST", "/wallets/:walletId/recovery/status", "Report how many recovery codes remain and whether the owner saved them", {
 		plane: "public",
 		proof: "webauthn",
 		rationale: "Fresh operation-bound owner proof is required."
@@ -5668,7 +5684,8 @@ function createRouterApiRouteDefinitions(options = {}) {
 		rationale: "Fresh operation-bound owner proof is required."
 	}, ROUTER_API_PASSKEY_CUSTODY_SERVICES), publicRoute("wallet_recovery_backup_acknowledge", "POST", "/wallets/recovery/acknowledge-backup", "Record that the owner saved their recovery codes", {
 		plane: "public",
-		rationale: "Acknowledgement only clears backup-reminder state after the client displays its locally retained codes."
+		proof: "webauthn",
+		rationale: "Fresh operation-bound owner proof is required after the client displays its locally retained codes."
 	}, ["passkeyCustody"]), publicRoute("wallet_recovery_finalize", "POST", "/wallets/recovery/finalize", "Finalize an admitted wallet recovery and install its replacement credential", {
 		plane: "public",
 		proof: "recovery_proof",
@@ -14819,65 +14836,21 @@ function b64uField(prefix) {
 }
 b64uField("seed"), b64uField("canonicalSeed"), b64uField("xClientBase"), b64uField("clientOutputMask"), b64uField("clientRecoverableSecret"), b64uField("prfFirst"), b64uField("prfSecond"), b64uField("signingShare32"), b64uField("clientNonceHandle");
 //#endregion
-//#region src/core/authService/webauthnOidcHelpers.ts
-function originHostnameOrEmpty(origin) {
-	try {
-		return new URL(origin).hostname.toLowerCase();
-	} catch {
-		return "";
-	}
-}
-function isHostWithinRpId(host, rpId) {
-	const h = (host || "").toLowerCase();
-	const r = String(rpId).toLowerCase();
-	if (!h || !r) return false;
-	if ((process.env.NO_CADDY === "1" || process.env.VITE_NO_CADDY === "1") && (h === "localhost" || h === "127.0.0.1") && r.endsWith(".localhost")) return true;
-	return h === r || h.endsWith(`.${r}`);
-}
-//#endregion
-//#region ../shared-ts/src/wallet-recovery/recoveryCodeReservation.ts
-function parseRecoveryCodeReservationId(value) {
-	if (typeof value !== "string" || value.length === 0 || value.length > 512 || value.trim() !== value || hasWhitespaceOrControlCharacters(value)) throw new Error("recovery code reservation id must be a compact opaque identifier");
-	return value;
-}
-//#endregion
-//#region ../shared-ts/src/authorization/walletCustodyOperation.ts
-/** Public challenge digest for a single wallet-administration factor proof. */
-async function computeWalletCustodyAdminChallengeDigest(input) {
-	return sha256Utf8DigestB64u(`seams:wallet-custody:challenge:v1|${alphabetizeStringify({
-		walletId: input.walletId,
-		operation: input.operation,
-		payload: input.payload,
-		requestOrigin: input.requestOrigin
-	})}`);
+//#region src/router/auth/webAuthnCredentialCodecs.ts
+function containsWebAuthnExtensionOutput(value) {
+	if (value == null) return false;
+	if (!isPlainObject(value)) return true;
+	for (const nested of Object.values(value)) if (containsWebAuthnExtensionOutput(nested)) return true;
+	return false;
 }
-//#endregion
-//#region ../shared-ts/src/wallet-recovery/walletRecoveryTarget.ts
-function parseWalletRecoveryTargetV1(raw) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("wallet recovery target must be an object");
-	const record = raw;
-	const fields = Object.keys(record);
-	switch (record.kind) {
-		case "passkey": {
-			if (fields.length !== 2 || !fields.includes("rpId")) throw new Error("Passkey recovery target fields are invalid");
-			const rpId = parseWebAuthnRpId(record.rpId);
-			if (!rpId.ok) throw new Error("Passkey recovery target RP ID is invalid");
-			return {
-				kind: "passkey",
-				rpId: rpId.value
-			};
-		}
-		case "google_email_otp":
-			if (fields.length !== 2 || !fields.includes("googleProvider") || record.googleProvider !== "google") throw new Error("Google Email OTP recovery target fields are invalid");
-			return {
-				kind: "google_email_otp",
-				googleProvider: "google"
-			};
-		default: throw new Error("wallet recovery target kind is unsupported");
-	}
+function unredactedWebAuthnExtensionField(input) {
+	if (!isPlainObject(input)) return null;
+	if (containsWebAuthnExtensionOutput(input.clientExtensionResults)) return "clientExtensionResults";
+	const response = input.response;
+	if (!isPlainObject(response)) return null;
+	if (containsWebAuthnExtensionOutput(response.clientExtensionResults)) return "response.clientExtensionResults";
+	return null;
 }
-//#endregion
-//#region src/router/auth/webAuthnCredentialCodecs.ts
 function decodeWebAuthnBase64UrlOrBase64(input, fieldName) {
 	try {
 		return base64UrlDecode(input);
@@ -14964,6 +14937,137 @@ function parseWebAuthnAuthenticationCredential$1(input) {
 	};
 }
 //#endregion
+//#region src/router/transport/fetch/routes/walletCustodyRequestBoundary.ts
+function requireExactObjectFields(value, fields, label) {
+	const keys = Object.keys(value).sort();
+	const expected = [...fields].sort();
+	if (keys.length !== expected.length || keys.some((key, index) => key !== expected[index])) throw new Error(`${label} contains unsupported fields`);
+}
+function parseCustodyOwnerProof(value) {
+	if (!isPlainObject(value)) throw new Error("factorProof is required");
+	const kind = normalizeOptionalTrimmedString(value.kind);
+	if (kind === "passkey") {
+		requireExactObjectFields(value, [
+			"kind",
+			"walletId",
+			"rpId",
+			"credentialIdB64u",
+			"challenge_digest",
+			"webauthn_authentication"
+		], "factorProof");
+		const extensionField = unredactedWebAuthnExtensionField(value.webauthn_authentication);
+		if (extensionField) throw new Error(`factorProof.webauthn_authentication.${extensionField} must be redacted`);
+		const webauthnAuthentication = parseWebAuthnAuthenticationCredential$1(value.webauthn_authentication);
+		if (!webauthnAuthentication) throw new Error("factorProof.webauthn_authentication is invalid");
+		return {
+			kind,
+			walletId: requireTrimmedString(value.walletId, "factorProof.walletId"),
+			rpId: requireTrimmedString(value.rpId, "factorProof.rpId"),
+			credentialIdB64u: requireTrimmedString(value.credentialIdB64u, "factorProof.credentialIdB64u"),
+			challenge_digest: requireTrimmedString(value.challenge_digest, "factorProof.challenge_digest"),
+			webauthn_authentication: webauthnAuthentication
+		};
+	}
+	if (kind === "email_otp") {
+		requireExactObjectFields(value, [
+			"kind",
+			"provider_subject_id",
+			"challenge_id",
+			"otp_code",
+			"challenge_digest"
+		], "factorProof");
+		return {
+			kind,
+			provider_subject_id: requireTrimmedString(value.provider_subject_id, "factorProof.provider_subject_id"),
+			challenge_id: requireTrimmedString(value.challenge_id, "factorProof.challenge_id"),
+			otp_code: requireTrimmedString(value.otp_code, "factorProof.otp_code"),
+			challenge_digest: requireTrimmedString(value.challenge_digest, "factorProof.challenge_digest")
+		};
+	}
+	throw new Error("factorProof.kind must be passkey or email_otp");
+}
+function parseRecoveryBackupAcknowledgementRequest(body) {
+	if (!isPlainObject(body)) throw new Error("acknowledgement body is required");
+	requireExactObjectFields(body, [
+		"expectedIssuedAtMs",
+		"factorProof",
+		"requestId",
+		"walletId"
+	], "recovery backup acknowledgement");
+	return {
+		walletId: requireTrimmedString(body.walletId, "walletId"),
+		requestId: requireTrimmedString(body.requestId, "requestId"),
+		expectedIssuedAtMs: parseUnixMs$1(body.expectedIssuedAtMs, "expectedIssuedAtMs"),
+		factorProof: body.factorProof
+	};
+}
+function parseRecoveryStatusRequest(body) {
+	if (!isPlainObject(body)) throw new Error("status body is required");
+	requireExactObjectFields(body, ["factorProof", "requestId"], "recovery status");
+	return {
+		requestId: requireTrimmedString(body.requestId, "requestId"),
+		factorProof: body.factorProof
+	};
+}
+//#endregion
+//#region src/core/authService/webauthnOidcHelpers.ts
+function originHostnameOrEmpty(origin) {
+	try {
+		return new URL(origin).hostname.toLowerCase();
+	} catch {
+		return "";
+	}
+}
+function isHostWithinRpId(host, rpId) {
+	const h = (host || "").toLowerCase();
+	const r = String(rpId).toLowerCase();
+	if (!h || !r) return false;
+	if ((process.env.NO_CADDY === "1" || process.env.VITE_NO_CADDY === "1") && (h === "localhost" || h === "127.0.0.1") && r.endsWith(".localhost")) return true;
+	return h === r || h.endsWith(`.${r}`);
+}
+//#endregion
+//#region ../shared-ts/src/wallet-recovery/recoveryCodeReservation.ts
+function parseRecoveryCodeReservationId(value) {
+	if (typeof value !== "string" || value.length === 0 || value.length > 512 || value.trim() !== value || hasWhitespaceOrControlCharacters(value)) throw new Error("recovery code reservation id must be a compact opaque identifier");
+	return value;
+}
+//#endregion
+//#region ../shared-ts/src/authorization/walletCustodyOperation.ts
+/** Public challenge digest for a single wallet-administration factor proof. */
+async function computeWalletCustodyAdminChallengeDigest(input) {
+	return sha256Utf8DigestB64u(`seams:wallet-custody:challenge:v1|${alphabetizeStringify({
+		walletId: input.walletId,
+		operation: input.operation,
+		payload: input.payload,
+		requestOrigin: input.requestOrigin
+	})}`);
+}
+//#endregion
+//#region ../shared-ts/src/wallet-recovery/walletRecoveryTarget.ts
+function parseWalletRecoveryTargetV1(raw) {
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("wallet recovery target must be an object");
+	const record = raw;
+	const fields = Object.keys(record);
+	switch (record.kind) {
+		case "passkey": {
+			if (fields.length !== 2 || !fields.includes("rpId")) throw new Error("Passkey recovery target fields are invalid");
+			const rpId = parseWebAuthnRpId(record.rpId);
+			if (!rpId.ok) throw new Error("Passkey recovery target RP ID is invalid");
+			return {
+				kind: "passkey",
+				rpId: rpId.value
+			};
+		}
+		case "google_email_otp":
+			if (fields.length !== 2 || !fields.includes("googleProvider") || record.googleProvider !== "google") throw new Error("Google Email OTP recovery target fields are invalid");
+			return {
+				kind: "google_email_otp",
+				googleProvider: "google"
+			};
+		default: throw new Error("wallet recovery target kind is unsupported");
+	}
+}
+//#endregion
 //#region src/router/domains/emailOtp/emailOtpSessionRouteHelpers.ts
 function emailOtpStatusCode(code) {
 	if (code === "internal") return 500;
@@ -15256,51 +15360,8 @@ const EMAIL_OTP_CHALLENGE_ROUTE_ID = "wallet_custody_email_otp_challenge";
 const ENVELOPE_OWNERSHIP_UPGRADE_ROUTE_ID = "wallet_custody_envelope_ownership_upgrade";
 const CUSTODY_OPERATION_CAPABILITY_ID = "wallet-custody-admin";
 const CUSTODY_PROOF_TTL_MS = 6e4;
-function requireExactObjectFields(value, fields, label) {
-	const keys = Object.keys(value).sort();
-	const expected = [...fields].sort();
-	if (keys.length !== expected.length || keys.some((key, index) => key !== expected[index])) throw new Error(`${label} contains unsupported fields`);
-}
-function parseCustodyOwnerProof(value) {
-	if (!isPlainObject(value)) throw new Error("factorProof is required");
-	const kind = normalizeOptionalTrimmedString(value.kind);
-	if (kind === "passkey") {
-		requireExactObjectFields(value, [
-			"kind",
-			"walletId",
-			"rpId",
-			"credentialIdB64u",
-			"challenge_digest",
-			"webauthn_authentication"
-		], "factorProof");
-		const webauthnAuthentication = parseWebAuthnAuthenticationCredential$1(value.webauthn_authentication);
-		if (!webauthnAuthentication) throw new Error("factorProof.webauthn_authentication is invalid");
-		return {
-			kind,
-			walletId: requireTrimmedString(value.walletId, "factorProof.walletId"),
-			rpId: requireTrimmedString(value.rpId, "factorProof.rpId"),
-			credentialIdB64u: requireTrimmedString(value.credentialIdB64u, "factorProof.credentialIdB64u"),
-			challenge_digest: requireTrimmedString(value.challenge_digest, "factorProof.challenge_digest"),
-			webauthn_authentication: webauthnAuthentication
-		};
-	}
-	if (kind === "email_otp") {
-		requireExactObjectFields(value, [
-			"kind",
-			"provider_subject_id",
-			"challenge_id",
-			"otp_code",
-			"challenge_digest"
-		], "factorProof");
-		return {
-			kind,
-			provider_subject_id: requireTrimmedString(value.provider_subject_id, "factorProof.provider_subject_id"),
-			challenge_id: requireTrimmedString(value.challenge_id, "factorProof.challenge_id"),
-			otp_code: requireTrimmedString(value.otp_code, "factorProof.otp_code"),
-			challenge_digest: requireTrimmedString(value.challenge_digest, "factorProof.challenge_digest")
-		};
-	}
-	throw new Error("factorProof.kind must be passkey or email_otp");
+function hasFullOwnerAuthority$1(authority) {
+	return sameDelegatedWalletAuthorityV1(buildDelegatedWalletAuthorityV1({ permissions: authority.permissions }), buildDelegatedWalletAuthorityV1({ permissions: buildFullOwnerPermissionsV1() }));
 }
 function parseRequiredAuthorizationValue(parsed) {
 	if (!parsed.ok) throw new Error(parsed.error.message);
@@ -15393,8 +15454,13 @@ async function authorizeWalletCustodyOperation(input) {
 		} catch (error) {
 			return toCustodyAuthorizationFailure(400, "invalid_owner_proof", error instanceof Error ? error.message : "passkey authority is invalid");
 		}
-		const active = await input.ctx.service.walletAuthMethods.verifyActivePasskeyAuthority(authority);
+		const active = await input.ctx.service.walletAuthMethods.resolveActivePasskeyAuthorityForVerifiedCredential({
+			walletId,
+			rpId: authority.verifier.rpId,
+			credentialIdB64u: authority.factor.credentialIdB64u
+		});
 		if (!active.ok) return toCustodyAuthorizationFailure(403, active.code, active.message);
+		if (!hasFullOwnerAuthority$1(active.walletAuthority)) return toCustodyAuthorizationFailure(403, "forbidden", "Full owner authority is required");
 		const credential = parseWebAuthnAuthenticationCredential$1(proof.webauthn_authentication);
 		if (!credential) return toCustodyAuthorizationFailure(400, "invalid_owner_proof", "passkey assertion is invalid");
 		if (String(credential.rawId || credential.id).trim() !== authority.factor.credentialIdB64u) return toCustodyAuthorizationFailure(401, "unauthorized", "passkey credential changed");
@@ -15410,7 +15476,7 @@ async function authorizeWalletCustodyOperation(input) {
 			tenantId: operation.tenantId,
 			principalId: operation.principalId,
 			walletId,
-			authorityRef: await walletAuthAuthorityRef({ authority }),
+			authorityRef: await walletAuthAuthorityRef({ authority: active.authority }),
 			requestOrigin: origin,
 			audience: origin,
 			factorId: parseRequiredAuthorizationValue(parseAuthFactorId(`passkey:${authority.factor.credentialIdB64u}`)),
@@ -15559,7 +15625,10 @@ async function completeWalletCustodyOperation(ctx, operation, status, body, resu
 }
 async function handlePasskeyCustody(ctx) {
 	if (!matchRoute(ctx, ROUTE_ID)) return null;
-	const request = parseWireRequest(await readJsonObject(ctx.request), ctx.request.headers.get("origin"));
+	const body = await readJsonObject(ctx.request);
+	const extensionField = unredactedWebAuthnExtensionField(body?.webauthnAuthentication);
+	if (extensionField) return routeErrorResponse(400, "prf_disclosed", `webauthnAuthentication.${extensionField} must be redacted before retrieval`);
+	const request = parseWireRequest(body, ctx.request.headers.get("origin"));
 	if (!request) return routeErrorResponse(400, "invalid_request", "custody retrieval needs a locator, a challenge id, and an assertion");
 	return toFetchRouteResponse(await ctx.service.passkeyCustody.retrieveEnvelope(request));
 }
@@ -15584,7 +15653,7 @@ function parseWalletCustodyEmailOtpChallengeRequest(value, actualOrigin) {
 	const walletId = parseRequiredAuthorizationValue(parseWalletId(value.walletId));
 	const providerSubjectId = parseRequiredAuthorizationValue(parseProviderSubject(value.providerSubjectId));
 	const operation = value.operation;
-	if (operation !== "credentials_list" && operation !== "credential_label" && operation !== "recovery_rotate" && operation !== "recovery_read") throw new Error("Email OTP custody challenge operation is invalid");
+	if (operation !== "credentials_list" && operation !== "credential_label" && operation !== "recovery_rotate" && operation !== "recovery_read" && operation !== "recovery_status" && operation !== "recovery_backup_acknowledge") throw new Error("Email OTP custody challenge operation is invalid");
 	if (!isPlainObject(value.payload)) throw new Error("Email OTP custody challenge payload is invalid");
 	if (value.requestOrigin !== void 0 && value.requestOrigin !== actualOrigin) throw new Error("Email OTP custody challenge requestOrigin does not match Origin");
 	return {
@@ -16303,6 +16372,8 @@ function parseWalletRecoveryFinalizeBody(value) {
 		"ecdsaMaterialPossessionProofs"
 	], "wallet recovery finalization");
 	if (!isPlainObject(value.webauthnRegistration)) throw new Error("wallet recovery finalization registration is invalid");
+	const extensionField = unredactedWebAuthnExtensionField(value.webauthnRegistration);
+	if (extensionField) throw new Error(`wallet recovery finalization registration ${extensionField} must be redacted`);
 	return {
 		kind: "finalize",
 		...identity,
@@ -16336,23 +16407,41 @@ function authorizedOperationReplay(operation) {
 }
 async function handleWalletRecoveryBackupAcknowledge(ctx) {
 	if (!matchRoute(ctx, RECOVERY_ACK_ROUTE_ID)) return null;
-	const body = await readJsonObject(ctx.request);
-	let walletId = "";
+	let request;
 	try {
-		if (!body) throw new Error("acknowledgement body is required");
-		requireExactObjectFields(body, ["walletId"], "recovery backup acknowledgement");
-		walletId = requireTrimmedString(body.walletId, "walletId");
+		request = parseRecoveryBackupAcknowledgementRequest(await readJsonObject(ctx.request));
 	} catch {
-		return routeErrorResponse(400, "invalid_request", "an acknowledgement needs a wallet");
+		return routeErrorResponse(400, "invalid_request", "acknowledgement body is invalid");
 	}
-	const result = await ctx.service.passkeyCustody.acknowledgeRecoveryBackup({ walletId });
-	if (result.kind === "no_recovery_set") return routeErrorResponse(404, "no_recovery_set", "this wallet has no issued recovery codes to acknowledge");
-	return toFetchRouteResponse({
-		status: 200,
-		body: {
-			ok: true,
-			issuedAtMs: result.issuedAtMs
-		}
+	const authorized = await authorizeWalletCustodyOperation({
+		ctx,
+		walletId: request.walletId,
+		operation: "recovery_backup_acknowledge",
+		payload: {
+			walletId: request.walletId,
+			requestId: request.requestId,
+			expectedIssuedAtMs: request.expectedIssuedAtMs
+		},
+		factorProof: request.factorProof
+	});
+	if (!authorized.ok) return authorized.response;
+	const result = await ctx.service.passkeyCustody.acknowledgeRecoveryBackup({
+		walletId: request.walletId,
+		expectedIssuedAtMs: request.expectedIssuedAtMs
+	});
+	if (result.kind === "conflict") return await completeWalletCustodyOperation(ctx, authorized.operation, 409, {
+		ok: false,
+		code: "recovery_set_conflict",
+		message: "the recovery set changed"
+	}, "failed_before_side_effect");
+	if (result.kind === "no_recovery_set") return await completeWalletCustodyOperation(ctx, authorized.operation, 404, {
+		ok: false,
+		code: "no_recovery_set",
+		message: "this wallet has no issued recovery codes to acknowledge"
+	}, "failed_before_side_effect");
+	return await completeWalletCustodyOperation(ctx, authorized.operation, 200, {
+		ok: true,
+		issuedAtMs: result.issuedAtMs
 	});
 }
 /**
@@ -16456,39 +16545,42 @@ async function handleWalletRecoveryRead(ctx) {
 		storeVersion: result.storeVersion
 	});
 }
-/**
-* Reporting recovery status to the wallet's owner.
-*
-* The wallet comes from the path. Origin binding keeps this count endpoint
-* scoped to browser callers without exposing recovery identifiers.
-*
-* Counts only, never identifiers. Which codes remain is not something even
-* the owner's browser needs, and a list would be one leak away from being
-* useful to someone else.
-*/
+/** Reports current recovery-code counts after fresh owner proof. */
 async function handleWalletRecoveryStatus(ctx) {
 	const route = matchRoute(ctx, RECOVERY_STATUS_ROUTE_ID);
 	if (!route) return null;
 	const walletId = walletIdFromPath(route.path, ctx.pathname);
 	if (!walletId) return routeErrorResponse(400, "invalid_request", "status needs a wallet");
-	const origin = normalizeOptionalTrimmedString(ctx.request.headers.get("origin"));
+	let request;
 	try {
-		parseSessionOrigin(origin);
+		request = parseRecoveryStatusRequest(await readJsonObject(ctx.request));
 	} catch {
-		return routeErrorResponse(400, "invalid_origin", "request Origin is invalid");
+		return routeErrorResponse(400, "invalid_request", "status body is invalid");
 	}
+	const authorized = await authorizeWalletCustodyOperation({
+		ctx,
+		walletId,
+		operation: "recovery_status",
+		payload: {
+			walletId,
+			requestId: request.requestId
+		},
+		factorProof: request.factorProof
+	});
+	if (!authorized.ok) return authorized.response;
 	const result = await ctx.service.passkeyCustody.readRecoveryStatus({ walletId });
-	if (result.kind === "no_recovery_set") return routeErrorResponse(404, "no_recovery_set", "this wallet has no recovery codes");
-	return toFetchRouteResponse({
-		status: 200,
-		body: {
-			ok: true,
-			activeCodeCount: result.activeCodeCount,
-			totalCodeCount: result.totalCodeCount,
-			issuedAtMs: result.issuedAtMs,
-			storeVersion: result.storeVersion,
-			backupOutstanding: result.backupOutstanding
-		}
+	if (result.kind === "no_recovery_set") return await completeWalletCustodyOperation(ctx, authorized.operation, 404, {
+		ok: false,
+		code: "no_recovery_set",
+		message: "this wallet has no recovery codes"
+	}, "failed_before_side_effect");
+	return await completeWalletCustodyOperation(ctx, authorized.operation, 200, {
+		ok: true,
+		activeCodeCount: result.activeCodeCount,
+		totalCodeCount: result.totalCodeCount,
+		issuedAtMs: result.issuedAtMs,
+		storeVersion: result.storeVersion,
+		backupOutstanding: result.backupOutstanding
 	});
 }
 function walletIdFromPath(routePath, pathname) {
@@ -22688,7 +22780,10 @@ async function handleWalletEmailOtpFactorRelease(ctx) {
 		if (!consumed.ok) return json$3(consumed, { status: emailOtpStatusCode(consumed.code) });
 		factorReleaseChallengeId = consumed.challengeId;
 	}
-	const unsealed = await ctx.service.emailOtp.removeEmailOtpServerSeal({ wrappedCiphertext: enrollment.enrollment.serverSealedFactorCiphertextB64u });
+	const unsealed = await ctx.service.emailOtp.removeEmailOtpServerSeal({
+		wrappedCiphertext: enrollment.enrollment.serverSealedFactorCiphertextB64u,
+		enrollmentSealKeyVersion: enrollment.enrollment.enrollmentSealKeyVersion
+	});
 	if (!unsealed.ok) return json$3(unsealed, { status: emailOtpStatusCode(unsealed.code) });
 	if (unsealed.enrollmentSealKeyVersion !== enrollment.enrollment.enrollmentSealKeyVersion) return json$3({
 		ok: false,
@@ -24367,7 +24462,10 @@ function buildRouterAbEd25519AuthorizedOperationWire(input) {
 	});
 }
 async function releaseEmailOtpFactorForWorker(input) {
-	const unsealed = await input.emailOtp.removeEmailOtpServerSeal({ wrappedCiphertext: input.request.enrollment.serverSealedFactorCiphertextB64u });
+	const unsealed = await input.emailOtp.removeEmailOtpServerSeal({
+		wrappedCiphertext: input.request.enrollment.serverSealedFactorCiphertextB64u,
+		enrollmentSealKeyVersion: input.request.enrollment.enrollmentSealKeyVersion
+	});
 	if (!unsealed.ok) return unsealed;
 	if (unsealed.enrollmentSealKeyVersion !== input.request.enrollment.enrollmentSealKeyVersion) return {
 		ok: false,
@@ -25951,6 +26049,9 @@ function assertNeverAuthProviderAction(route) {
 function assertNeverAuthIdentityMutation(route) {
 	throw new Error(`Unsupported auth identity mutation: ${String(route)}`);
 }
+function hasFullOwnerAuthority(context) {
+	return sameDelegatedWalletAuthorityV1(buildDelegatedWalletAuthorityV1({ permissions: context.authority.permissions }), buildDelegatedWalletAuthorityV1({ permissions: buildFullOwnerPermissionsV1() }));
+}
 async function requireExactWalletSession(ctx) {
 	const token = extractBearerCredential(ctx.request.headers);
 	if (!token) return {
@@ -26016,6 +26117,7 @@ async function handleAuth(ctx) {
 		const command = parsed.request;
 		const sess = await requireExactWalletSession(ctx);
 		if (!sess.ok) return sess.response;
+		if (!hasFullOwnerAuthority(sess.context)) return jsonFailure(403, "forbidden", "Full owner authority is required to manage identities");
 		const walletId = String(sess.context.authorization.session.walletId);
 		const stepUpRequest = command.request.stepUp;
 		const stepUp = await requireExactPasskeyStepUp({

package/dist/esm/router/domains/ecdsa/routerAbEcdsaStrictRegistration.js

@@ -315,7 +315,7 @@ function canonicalPendingActivationJson(value) {
 	if (!exactObject(value, [
 		"registration",
 		"ownership_generation",
-		"tenant_root_custody_binding_digest",
+		"tenant_root_custody_binding",
 		"wallet_scope",
 		"environment_key",
 		"activation_context",

package/dist/esm/router/domains/passkeyCustody/passkeyCustodyEnvelopeRetrieval.js

@@ -1,26 +1,8 @@
-import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
 import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
+import { unredactedWebAuthnExtensionField } from "../../auth/webAuthnCredentialCodecs.js";
 import { decodeBase64UrlOrBase64 } from "../../../core/authService/webauthnOidcHelpers.js";
 import { verifyWebAuthnAuthenticationLiteWithStore } from "../../../core/authService/webauthn.js";
 //#region src/router/domains/passkeyCustody/passkeyCustodyEnvelopeRetrieval.ts
-/**
-* Detects any surviving WebAuthn extension output on an assertion.
-*
-* This checks for extension results generally rather than a `prf` key alone: a
-* caller that forwards raw extension outputs is not honouring the redaction
-* contract, and the next extension to carry secret material would otherwise
-* pass unnoticed.
-*/
-function disclosedExtensionOutputs(credential) {
-	const top = credential.clientExtensionResults;
-	if (isPlainObject(top) && Object.keys(top).length > 0) return "webauthn_authentication.clientExtensionResults must be redacted before retrieval";
-	const response = credential.response;
-	if (isPlainObject(response)) {
-		const nested = response.clientExtensionResults;
-		if (isPlainObject(nested) && Object.keys(nested).length > 0) return "webauthn_authentication.response.clientExtensionResults must be redacted before retrieval";
-	}
-	return null;
-}
 function assertionCredentialIdB64u(credential) {
 	const raw = credential.rawId;
 	const fallback = credential.id;
@@ -35,15 +17,15 @@ function assertionCredentialIdB64u(credential) {
 async function retrievePasskeyCustodyEnvelope(input) {
 	const { request } = input;
 	const verifyAssertion = input.verifyAssertion || verifyWebAuthnAuthenticationLiteWithStore;
-	const disclosed = disclosedExtensionOutputs(request.webauthnAuthentication);
-	if (disclosed !== null) {
+	const extensionField = unredactedWebAuthnExtensionField(request.webauthnAuthentication);
+	if (extensionField) {
 		input.logger.error("[passkey-custody] assertion carried unredacted extension output", {
 			walletId: String(request.locator.walletId),
 			rpId: String(request.rpId)
 		});
 		return {
 			kind: "prf_disclosed",
-			message: disclosed
+			message: `webauthn_authentication.${extensionField} must be redacted before retrieval`
 		};
 	}
 	if (request.locator.factor.kind !== "passkey") return {

package/dist/esm/router/domains/passkeyCustody/registrationCustodyOutcome.js

@@ -24,7 +24,10 @@ async function reserveRegistrationCustody(input) {
 		if (admitted.kind !== "reserved") return settled(toOutcome(admitted));
 		return {
 			kind: "prepared",
-			outcome: { status: "committed" },
+			outcome: {
+				status: "committed",
+				issuedAtMs: admitted.issuedAtMs
+			},
 			write: { statements: admitted.statements }
 		};
 	} catch (error) {
@@ -50,7 +53,10 @@ function toOutcome(admitted) {
 			keyManifestDigestB64u: admitted.keyManifestDigestB64u
 		};
 		case "custody_already_established": return { status: "custody_already_established" };
-		case "already_exists": return { status: "committed" };
+		case "already_exists": return {
+			status: "committed",
+			issuedAtMs: admitted.issuedAtMs
+		};
 		case "rejected": return {
 			status: "rejected",
 			reason: admitted.reason

package/dist/esm/router/framework/routeDefinitions.js

@@ -282,7 +282,7 @@ function createRouterApiRouteDefinitions(options = {}) {
 	}, ROUTER_API_WALLET_REGISTRATION_SESSION_SERVICES, {
 		kind: "event",
 		action: "wallet_created"
-	}), publicRoute("wallet_recovery_status", "GET", "/wallets/:walletId/recovery/status", "Report how many recovery codes remain and whether the owner saved them", {
+	}), publicRoute("wallet_recovery_status", "POST", "/wallets/:walletId/recovery/status", "Report how many recovery codes remain and whether the owner saved them", {
 		plane: "public",
 		proof: "webauthn",
 		rationale: "Fresh operation-bound owner proof is required."
@@ -296,7 +296,8 @@ function createRouterApiRouteDefinitions(options = {}) {
 		rationale: "Fresh operation-bound owner proof is required."
 	}, ROUTER_API_PASSKEY_CUSTODY_SERVICES), publicRoute("wallet_recovery_backup_acknowledge", "POST", "/wallets/recovery/acknowledge-backup", "Record that the owner saved their recovery codes", {
 		plane: "public",
-		rationale: "Acknowledgement only clears backup-reminder state after the client displays its locally retained codes."
+		proof: "webauthn",
+		rationale: "Fresh operation-bound owner proof is required after the client displays its locally retained codes."
 	}, ["passkeyCustody"]), publicRoute("wallet_recovery_finalize", "POST", "/wallets/recovery/finalize", "Finalize an admitted wallet recovery and install its replacement credential", {
 		plane: "public",
 		proof: "recovery_proof",