@seams/wallet-server 0.6.2 → 0.7.1

package/dist/esm/router/domains/tenantRoot/tenantRootIdentityResolution.js

@@ -106,6 +106,6 @@ function resolveTenantRootIdentityV1(input) {
 	};
 }
 //#endregion
-export { findForbiddenTenantRootSelectorFieldV1, resolveTenantRootIdentityV1 };
+export { resolveTenantRootIdentityV1 };
 
 //# sourceMappingURL=tenantRootIdentityResolution.js.map

package/dist/esm/router/domains/walletRegistration/walletRegistrationRoutes.js

@@ -5,14 +5,15 @@ import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitive
 import { base58Encode } from "../../../shared-ts/src/utils/base58.js";
 import "../../../shared-ts/src/utils/encoders.js";
 import { deriveImplicitNearAccountIdFromEd25519PublicKey, parseImplicitNearAccountId } from "../../../shared-ts/src/utils/near.js";
-import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, computeAddAuthMethodIntentDigestB64u, computeAddSignerIntentDigestB64u, normalizeAddAuthMethodInput, normalizeAddAuthMethodIntentCaller, normalizeEmailOtpRegistrationProof, normalizeRegistrationAuthMethodInput, normalizeRegistrationSignerPlan, registrationSignerSetSelectionFromPlan, walletIdFromString } from "../../../shared-ts/src/utils/registrationIntent.js";
-import { ecdsaClientRootPublicKey33B64uFromString } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
+import { ecdsaClientRootPublicKey33B64uFromString } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
 import { parseRouterAbEcdsaRegistrationActivationRequestV1, parseRouterAbEcdsaRegistrationRequestV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { normalizeAddAuthMethodInput, normalizeEmailOtpRegistrationProof, normalizeRegistrationAuthMethodInput } from "../../../shared-ts/src/utils/registrationAuthMethodInput.js";
 import { parseHostedWalletSessionOperationCredentialToken, parsePrimaryWalletSessionOperationCredentialToken, parseSessionOrigin } from "../../../authorization/domain.js";
 import { normalizeCorsOrigin } from "../../../core/SessionService.js";
 import { thresholdEcdsaChainTargetFromValue } from "../../../core/thresholdEcdsaChainTarget.js";
+import { walletIdFromString } from "../../../shared-ts/src/utils/registrationIds.js";
 import { parseRouterAbTraceContextV1 } from "../../../shared-ts/src/utils/routerAbTraceContext.js";
 import { extractBearerCredential, extractRouterApiEnvironmentId } from "../../auth/routerApiKeyAuth.js";
 import { resolvePublishableKeyApiCredentialAuth } from "../../auth/routerApiCredentialAuth.js";
@@ -23,6 +24,8 @@ import { parsePasskeyCustodyEnvelopeRecord } from "../../../shared-ts/src/passke
 import "../../../shared-ts/src/passkey-custody/index.js";
 import { verifyWalletRegistrationSetupClaims } from "./walletRegistrationSetupPayload.js";
 import { computeWalletEcdsaKeyFactsInventoryChallengeDigestB64u } from "../../../shared-ts/src/utils/ecdsaKeyFactsInventory.js";
+import { normalizeRegistrationSignerPlan, registrationSignerSetSelectionFromPlan } from "../../../shared-ts/src/utils/registrationSignerPlan.js";
+import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, computeAddAuthMethodIntentDigestB64u, computeAddSignerIntentDigestB64u, normalizeAddAuthMethodIntentCaller } from "../../../shared-ts/src/utils/registrationIntent.js";
 //#region src/router/domains/walletRegistration/walletRegistrationRoutes.ts
 function parseRegistrationTraceContext(headers) {
 	const parsed = parseRouterAbTraceContextV1(headers["x-seams-trace-id"] ?? headers["X-Seams-Trace-Id"]);
@@ -1554,8 +1557,8 @@ async function handleRouterApiWalletAddSignerIntent(input) {
 	return routeJson(result.ok ? 200 : 400, result);
 }
 /**
-* Refactor 94C. `POST /wallets/register/setup` — the single admitted entry
-* point that replaces the bootstrap grant, the intent, and start.
+* `POST /wallets/register/setup` — the single admitted entry point that
+* replaces the bootstrap grant, the intent, and start.
 *
 * Authentication is the same API-credential plane the intent route used, so
 * origin and environment binding are unchanged; what is gone is the stored
@@ -1617,7 +1620,7 @@ async function handleRouterApiWalletRegistrationSetup(input) {
 	return routeJson(result.ok ? 200 : 400, result);
 }
 /**
-* Refactor 94C. `POST /wallets/register/respond` — the authenticated leg.
+* `POST /wallets/register/respond` — the authenticated leg.
 *
 * Bearing the proof, so it is a public-plane route authorized by the signed
 * setup payload plus the WebAuthn or Email OTP proof, exactly as the
@@ -1804,8 +1807,8 @@ async function projectActivatedWallet(input) {
 	}
 }
 /**
-* Refactor 94C. `POST /wallets/register/activate` — activation and
-* finalization behind one Gateway operation row.
+* `POST /wallets/register/activate` — activation and finalization behind
+* one Gateway operation row.
 */
 async function handleRouterApiWalletRegistrationActivate(input) {
 	const traceContext = parseRegistrationTraceContext(input.headers);
@@ -1872,9 +1875,9 @@ async function handleRouterApiWalletRegistrationActivate(input) {
 	return routeJson(200, result, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
 }
 /**
-* Refactor 94C. `POST /wallets/register/near-provisioning` — the non-blocking
-* completion the client calls after activate, once its already-running Yao
-* computation produces an activation.
+* `POST /wallets/register/near-provisioning` — the non-blocking completion
+* the client calls after activate, once its already-running Yao computation
+* produces an activation.
 */
 async function handleRouterApiWalletRegistrationNearProvisioning(input) {
 	if (!isPlainObject(input.body)) return routeError(400, "invalid_body", "JSON body required");
@@ -2246,25 +2249,18 @@ async function handleRouterApiWalletRevokeAuthMethod(input) {
 	if (parsedPathWalletAuthMethodId.value !== parsedBody.value.walletAuthMethodId) return routeError(400, "invalid_body", "walletAuthMethodId path and body values must agree");
 	const origin = requireWebAuthnExpectedOrigin(input);
 	if (!origin.ok) return origin.response;
-	const verified = await input.services.walletRegistration.verifyWalletAuthMethodRevokeProof({
-		walletId: parsedBody.value.walletId,
-		targetWalletAuthMethodId: parsedBody.value.walletAuthMethodId,
+	const revoked = await input.services.walletRegistration.revokeWalletAuthMethodWithFreshProof({
+		walletAuthMethodId: parsedBody.value.walletAuthMethodId,
 		requestedAtMs: parsedBody.value.requestedAtMs,
 		sourceProof: parsedBody.value.sourceProof,
-		expectedOrigin: origin.expectedOrigin
-	});
-	if (verified.kind === "denied") return routeError(401, "unauthorized", verified.message);
-	const result = await input.services.walletRegistration.revokeWalletAuthMethod({
-		...parsedBody.value,
 		subject: {
 			kind: "wallet_auth_method_management",
 			walletId: walletIdFromString(walletId)
 		},
-		verifiedSource: {
-			walletAuthMethodId: verified.walletAuthMethodId,
-			verifiedAtMs: verified.verifiedAtMs
-		}
+		expectedOrigin: origin.expectedOrigin
 	});
+	if (revoked.kind === "denied") return routeError(401, "unauthorized", revoked.message);
+	const result = revoked.response;
 	return routeJson(result.ok ? 200 : 400, result, { usage: result.ok ? { walletId: result.walletId } : void 0 });
 }
 async function handleRouterApiWalletEcdsaKeyFactsInventory(input) {

package/dist/esm/router/domains/walletRegistration/walletRegistrationSetupPayload.js

@@ -6,8 +6,7 @@ import "../../../shared-ts/src/utils/validation.js";
 import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
 //#region src/router/domains/walletRegistration/walletRegistrationSetupPayload.ts
 /**
-* Refactor 94C. The opaque payload `/wallets/register/setup` mints and routes
-* 2 and 3 verify.
+* The opaque payload `/wallets/register/setup` mints and routes 2 and 3 verify.
 *
 * Setup admits the application, allocates the wallet, and runs the Router
 * preparation in one request. Routes 2 and 3 then need to know that the
@@ -111,7 +110,7 @@ async function verifySignedWalletRegistrationSetup(signer, token, expected) {
 function parseWalletRegistrationSetupClaims(value) {
 	if (typeof value !== "object" || value === null) return null;
 	const record = value;
-	if (record.kind !== "wallet_registration_setup_v1") return null;
+	if (record.kind !== WALLET_REGISTRATION_SETUP_CLAIM_KIND) return null;
 	const registrationCeremonyId = normalizeOptionalTrimmedString(record.registrationCeremonyId);
 	const walletId = normalizeOptionalTrimmedString(record.walletId);
 	const orgId = normalizeOptionalTrimmedString(record.orgId);
@@ -150,6 +149,6 @@ function parseWalletRegistrationSetupPolicy(value) {
 	}
 }
 //#endregion
-export { WALLET_REGISTRATION_SETUP_CLAIM_KIND, computeWalletRegistrationSetupDigestB64u, mintSignedWalletRegistrationSetup, parseWalletRegistrationSetupClaims, verifySignedWalletRegistrationSetup, verifyWalletRegistrationSetupClaims };
+export { computeWalletRegistrationSetupDigestB64u, mintSignedWalletRegistrationSetup, parseWalletRegistrationSetupClaims, verifySignedWalletRegistrationSetup, verifyWalletRegistrationSetupClaims };
 
 //# sourceMappingURL=walletRegistrationSetupPayload.js.map

package/dist/esm/router/domains/walletUnlock/walletUnlockRequestedCapabilitiesValidation.js

@@ -67,7 +67,7 @@ function parseWalletUnlockRequestedCapabilitiesRequest(raw) {
 	if (!challengeId) return invalidWalletUnlockRequestedCapabilitiesRequest("challengeId is required");
 	const requestedCapabilities = parseWalletUnlockEmailOtpRequestedCapabilities(raw.requestedCapabilities);
 	if ("ok" in requestedCapabilities) return requestedCapabilities;
-	if (requestedCapabilities.kind === "wallet_session" && raw.ecdsaSessionPolicy !== void 0) return invalidWalletUnlockRequestedCapabilitiesRequest("requestedCapabilities.wallet_session cannot include ecdsaSessionPolicy");
+	if (requestedCapabilities.kind === EMAIL_OTP_WALLET_SESSION_REQUESTED_CAPABILITIES_KIND && raw.ecdsaSessionPolicy !== void 0) return invalidWalletUnlockRequestedCapabilitiesRequest("requestedCapabilities.wallet_session cannot include ecdsaSessionPolicy");
 	return {
 		ok: true,
 		request: {
@@ -79,6 +79,6 @@ function parseWalletUnlockRequestedCapabilitiesRequest(raw) {
 	};
 }
 //#endregion
-export { EMAIL_OTP_ED25519_YAO_REQUESTED_CAPABILITIES_KIND, EMAIL_OTP_NO_REQUESTED_CAPABILITIES_KIND, EMAIL_OTP_WALLET_SESSION_REQUESTED_CAPABILITIES_KIND, parseWalletUnlockRequestedCapabilitiesRequest };
+export { parseWalletUnlockRequestedCapabilitiesRequest };
 
 //# sourceMappingURL=walletUnlockRequestedCapabilitiesValidation.js.map

package/dist/esm/router/domains/walletUnlock/walletUnlockRouteHandlers.js

@@ -1,15 +1,13 @@
 import { parseEmailOtpChallengeId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../shared-ts/src/utils/domainIds.js";
 import { parseAuthFactorId, parsePrincipalId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
-import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { alphabetizeStringify, sha256BytesUtf8 } from "../../../shared-ts/src/utils/digests.js";
-import "../../../shared-ts/src/utils/encoders.js";
+import { alphabetizeStringify } from "../../../shared-ts/src/utils/digests.js";
+import { sha256Utf8DigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1 } from "../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { walletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseSessionOrigin, parseVerifiedOwnerProofId, projectActiveWalletSession } from "../../../authorization/domain.js";
 import { buildVerifiedWalletSessionEmailOtpFactorResult, buildVerifiedWalletSessionPasskeyFactorResult } from "../../../authorization/factorEvidence.js";
-import { EMAIL_OTP_CHANNEL } from "../../../shared-ts/src/utils/emailOtpDomain.js";
 import { emailOtpFailureWebhookEventDescriptors, emailOtpLoggedInWebhookEventDescriptor } from "../emailOtp/emailOtpSessionRouteHelpers.js";
+import { EMAIL_OTP_CHANNEL } from "../../../shared-ts/src/utils/emailOtpDomain.js";
 import { thresholdEd25519StatusCode } from "../../../threshold/statusCodes.js";
 import { parseWalletUnlockBackend } from "../emailOtp/emailOtpRequestValidation.js";
 //#region src/router/domains/walletUnlock/walletUnlockRouteHandlers.ts
@@ -102,7 +100,8 @@ async function refreshEmailOtpWalletUnlockSessionState(input) {
 		};
 	}
 }
-function emailOtpCustodyFailureResponse(lookup) {
+/** A factor's custody lookup that found no active envelope: 503, 404 or 409 by what it found. */
+function walletUnlockCustodyUnavailableResponse(lookup, factor) {
 	return {
 		ok: false,
 		response: {
@@ -110,13 +109,13 @@ function emailOtpCustodyFailureResponse(lookup) {
 			body: {
 				ok: false,
 				code: lookup.kind === "manifest_unavailable" ? "custody_manifest_unavailable" : "custody_envelope_unavailable",
-				message: "Email OTP wallet custody is unavailable"
+				message: `${factor} wallet custody is unavailable`
 			}
 		}
 	};
 }
 function projectEmailOtpCustody(verifiedUnlock, lookup) {
-	if (lookup.kind !== "active") return emailOtpCustodyFailureResponse(lookup);
+	if (lookup.kind !== "active") return walletUnlockCustodyUnavailableResponse(lookup, "Email OTP");
 	const envelope = lookup.envelope;
 	const manifest = lookup.keyManifest;
 	const factor = envelope.factor;
@@ -152,17 +151,7 @@ function projectEmailOtpCustody(verifiedUnlock, lookup) {
 }
 function projectPasskeyCustody(verifiedUnlock, resolution) {
 	const lookup = resolution.custody;
-	if (lookup.kind !== "active") return {
-		ok: false,
-		response: {
-			status: lookup.kind === "manifest_unavailable" ? 503 : lookup.kind === "conflict" ? 409 : lookup.kind === "missing" ? 404 : 409,
-			body: {
-				ok: false,
-				code: lookup.kind === "manifest_unavailable" ? "custody_manifest_unavailable" : "custody_envelope_unavailable",
-				message: "Passkey wallet custody is unavailable"
-			}
-		}
-	};
+	if (lookup.kind !== "active") return walletUnlockCustodyUnavailableResponse(lookup, "Passkey");
 	const envelope = lookup.envelope;
 	const factor = envelope.factor;
 	const manifest = lookup.keyManifest;
@@ -249,6 +238,17 @@ async function provisionFirstEcdsaWalletSession(input) {
 		}
 	}
 }
+/** The Ed25519 session joins the unlock's Wallet Session when there is one, else starts its own. */
+function walletUnlockEd25519SessionIdentity(linkedWalletSession) {
+	return linkedWalletSession ? {
+		kind: "reuse_wallet_session_v2",
+		authorizationId: linkedWalletSession.session.authorizationId,
+		walletSessionId: linkedWalletSession.session.walletSessionId,
+		quotaId: linkedWalletSession.session.quotaId,
+		expiresAtMs: linkedWalletSession.session.expiresAtMs,
+		remainingUses: linkedWalletSession.quota.remainingUses
+	} : { kind: "new_wallet_session" };
+}
 function walletUnlockScopeMismatchResponse() {
 	return {
 		ok: false,
@@ -287,14 +287,7 @@ async function provisionEmailOtpEd25519YaoCapability(input) {
 		remainingUses: capabilities.remainingUses,
 		verifiedChallengeId: request.challengeId,
 		authority: input.authorization.authority,
-		walletSessionIdentity: input.linkedWalletSession ? {
-			kind: "reuse_wallet_session_v2",
-			authorizationId: input.linkedWalletSession.session.authorizationId,
-			walletSessionId: input.linkedWalletSession.session.walletSessionId,
-			quotaId: input.linkedWalletSession.session.quotaId,
-			expiresAtMs: input.linkedWalletSession.session.expiresAtMs,
-			remainingUses: input.linkedWalletSession.quota.remainingUses
-		} : { kind: "new_wallet_session" }
+		walletSessionIdentity: walletUnlockEd25519SessionIdentity(input.linkedWalletSession)
 	}, input.authorization.proof);
 	if (!provisioned.ok) return {
 		ok: false,
@@ -390,14 +383,7 @@ async function provisionPasskeyEd25519YaoSession(input) {
 		verifiedChallengeId: input.challengeId,
 		authority: input.authorization.authority,
 		proof: input.authorization.proof,
-		walletSessionIdentity: input.linkedWalletSession ? {
-			kind: "reuse_wallet_session_v2",
-			authorizationId: input.linkedWalletSession.session.authorizationId,
-			walletSessionId: input.linkedWalletSession.session.walletSessionId,
-			quotaId: input.linkedWalletSession.session.quotaId,
-			expiresAtMs: input.linkedWalletSession.session.expiresAtMs,
-			remainingUses: input.linkedWalletSession.quota.remainingUses
-		} : { kind: "new_wallet_session" }
+		walletSessionIdentity: walletUnlockEd25519SessionIdentity(input.linkedWalletSession)
 	});
 	if (!provisioned.ok) return {
 		ok: false,
@@ -448,6 +434,21 @@ function walletUnlockEcdsaCredentialUnavailableResponse() {
 		}
 	};
 }
+/** The unlock response's Wallet Session, when the unlock holds one. */
+function walletUnlockSessionFields(state) {
+	return state.kind === "active" ? {
+		walletSession: projectActiveWalletSession(state.authorization),
+		operationCredential: state.operationCredential
+	} : {};
+}
+/** The unlock response's first ECDSA session, its receipt and its custody, when provisioned. */
+function walletUnlockEcdsaSessionFields(ecdsaSession) {
+	return {
+		...ecdsaSession.activation ? { ecdsaSession: ecdsaSession.activation } : {},
+		...ecdsaSession.activationReceipt ? { ecdsaActivationReceipt: ecdsaSession.activationReceipt } : {},
+		...ecdsaSession.continuity ? { ecdsaCustody: ecdsaSession.continuity } : {}
+	};
+}
 function walletUnlockAlreadyCommittedRouteResponse(input) {
 	return {
 		status: 409,
@@ -461,25 +462,41 @@ function walletUnlockAlreadyCommittedRouteResponse(input) {
 		}
 	};
 }
-async function handleWalletUnlockChallengeRoute(input) {
-	if (!input.body || typeof input.body !== "object" || Array.isArray(input.body)) return {
-		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "Request body is required"
+function parseWalletUnlockRouteBody(body) {
+	if (!body || typeof body !== "object" || Array.isArray(body)) return {
+		ok: false,
+		response: {
+			status: 400,
+			body: {
+				ok: false,
+				code: "invalid_body",
+				message: "Request body is required"
+			}
 		}
 	};
-	const body = input.body;
-	const unlockBackend = parseWalletUnlockBackend(body.unlockBackend);
+	const record = body;
+	const unlockBackend = parseWalletUnlockBackend(record.unlockBackend);
 	if (!unlockBackend) return {
-		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "unlockBackend is required"
+		ok: false,
+		response: {
+			status: 400,
+			body: {
+				ok: false,
+				code: "invalid_body",
+				message: "unlockBackend is required"
+			}
 		}
 	};
+	return {
+		ok: true,
+		body: record,
+		unlockBackend
+	};
+}
+async function handleWalletUnlockChallengeRoute(input) {
+	const parsed = parseWalletUnlockRouteBody(input.body);
+	if (!parsed.ok) return parsed.response;
+	const { body, unlockBackend } = parsed;
 	if (unlockBackend === "email_otp") {
 		const walletAuthMethodId = parseRequiredWalletAuthMethodId(body.walletAuthMethodId);
 		if (!walletAuthMethodId.ok) return {
@@ -574,7 +591,7 @@ function parseRequiredWalletAuthMethodId(value) {
 	};
 }
 async function digestWalletUnlockValue(value) {
-	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(value))));
+	return sha256Utf8DigestB64u(alphabetizeStringify(value));
 }
 function passkeyWalletAuthAuthorityForMethod(input) {
 	return {
@@ -665,24 +682,9 @@ async function walletUnlockProofForEmailOtp(input) {
 	};
 }
 async function handleWalletUnlockVerifyRoute(input) {
-	if (!input.body || typeof input.body !== "object" || Array.isArray(input.body)) return {
-		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "Request body is required"
-		}
-	};
-	const body = input.body;
-	const unlockBackend = parseWalletUnlockBackend(body.unlockBackend);
-	if (!unlockBackend) return {
-		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "unlockBackend is required"
-		}
-	};
+	const parsed = parseWalletUnlockRouteBody(input.body);
+	if (!parsed.ok) return parsed.response;
+	const { body, unlockBackend } = parsed;
 	const challengeId = String(body.challengeId || "").trim();
 	if (!challengeId) return {
 		status: 400,
@@ -772,17 +774,18 @@ async function handleWalletUnlockVerifyRoute(input) {
 				}
 			};
 		}
+		const resolvePasskeyAuthority = () => input.service.resolveActivePasskeyAuthorityForUnlock({
+			walletId: walletId.value,
+			walletAuthMethodId: walletAuthMethodId.value,
+			walletAuthorityId: walletAuthorityId.value,
+			rpId: rpId.value,
+			credentialIdB64u: credentialIdB64u.value
+		});
 		let walletSessionState = { kind: "absent" };
 		let passkeyCustodyRequired = false;
 		let authorityResolution;
 		try {
-			authorityResolution = await input.service.resolveActivePasskeyAuthorityForUnlock({
-				walletId: walletId.value,
-				walletAuthMethodId: walletAuthMethodId.value,
-				walletAuthorityId: walletAuthorityId.value,
-				rpId: rpId.value,
-				credentialIdB64u: credentialIdB64u.value
-			});
+			authorityResolution = await resolvePasskeyAuthority();
 		} catch (error) {
 			return {
 				status: 500,
@@ -923,13 +926,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 		if (walletSessionState.kind === "active") {
 			let refreshedAuthority;
 			try {
-				refreshedAuthority = await input.service.resolveActivePasskeyAuthorityForUnlock({
-					walletId: walletId.value,
-					walletAuthMethodId: walletAuthMethodId.value,
-					walletAuthorityId: walletAuthorityId.value,
-					rpId: rpId.value,
-					credentialIdB64u: credentialIdB64u.value
-				});
+				refreshedAuthority = await resolvePasskeyAuthority();
 			} catch (error) {
 				return {
 					status: 500,
@@ -982,14 +979,9 @@ async function handleWalletUnlockVerifyRoute(input) {
 				unlockBackend,
 				userId,
 				...passkeyCustody ? { walletCustody: passkeyCustody } : {},
-				...walletSessionState.kind === "active" ? {
-					walletSession: projectActiveWalletSession(walletSessionState.authorization),
-					operationCredential: walletSessionState.operationCredential
-				} : {},
+				...walletUnlockSessionFields(walletSessionState),
 				ed25519Session: projectPasskeyEd25519WalletSession(ed25519Session.session),
-				...ecdsaSession.activation ? { ecdsaSession: ecdsaSession.activation } : {},
-				...ecdsaSession.activationReceipt ? { ecdsaActivationReceipt: ecdsaSession.activationReceipt } : {},
-				...ecdsaSession.continuity ? { ecdsaCustody: ecdsaSession.continuity } : {}
+				...walletUnlockEcdsaSessionFields(ecdsaSession)
 			}
 		};
 	}
@@ -1160,14 +1152,11 @@ async function handleWalletUnlockVerifyRoute(input) {
 			};
 		}
 	}
-	if (input.capabilityContext.kind === "email_otp" && (requestedCapabilities.kind === "none" || requestedCapabilities.kind === "wallet_session")) {
+	const completeEmailOtpUnlock = async (ecdsaAuthorization, ed25519YaoCapability) => {
 		const ecdsaSession = await provisionFirstEcdsaWalletSession({
 			context: input.ecdsaSession,
 			verifiedWalletId: result.walletId,
-			authorization: {
-				kind: "verified_wallet_unlock",
-				proof: authorization.proof
-			}
+			authorization: ecdsaAuthorization
 		});
 		if (!ecdsaSession.ok) return ecdsaSession.response;
 		const refreshedSession = await refreshEmailOtpWalletUnlockSessionState({
@@ -1197,16 +1186,16 @@ async function handleWalletUnlockVerifyRoute(input) {
 				userId: result.userId,
 				...verifiedAuthorityProjection ? { verifiedAuthorityProjection } : {},
 				...emailOtpCustody ? { walletCustody: emailOtpCustody.projection } : {},
-				...walletSessionState.kind === "active" ? {
-					walletSession: projectActiveWalletSession(walletSessionState.authorization),
-					operationCredential: walletSessionState.operationCredential
-				} : {},
-				...ecdsaSession.activation ? { ecdsaSession: ecdsaSession.activation } : {},
-				...ecdsaSession.activationReceipt ? { ecdsaActivationReceipt: ecdsaSession.activationReceipt } : {},
-				...ecdsaSession.continuity ? { ecdsaCustody: ecdsaSession.continuity } : {}
+				...ed25519YaoCapability ? { ed25519YaoCapability } : {},
+				...walletUnlockSessionFields(walletSessionState),
+				...walletUnlockEcdsaSessionFields(ecdsaSession)
 			}
 		};
-	}
+	};
+	if (input.capabilityContext.kind === "email_otp" && (requestedCapabilities.kind === "none" || requestedCapabilities.kind === "wallet_session")) return completeEmailOtpUnlock({
+		kind: "verified_wallet_unlock",
+		proof: authorization.proof
+	});
 	if (!isWalletUnlockEd25519YaoRequestedContext(input.capabilityContext)) return {
 		status: 400,
 		body: {
@@ -1227,53 +1216,11 @@ async function handleWalletUnlockVerifyRoute(input) {
 		activeOperationCredential: walletUnlockSessionOperationCredential(walletSessionState)
 	});
 	if (!ed25519OperationCredential) return walletUnlockEcdsaCredentialUnavailableResponse();
-	const ecdsaSession = await provisionFirstEcdsaWalletSession({
-		context: input.ecdsaSession,
-		verifiedWalletId: result.walletId,
-		authorization: {
-			kind: "wallet_session_operation_credential_v1",
-			operationCredential: ed25519OperationCredential,
-			proof: authorization.proof
-		}
-	});
-	if (!ecdsaSession.ok) return ecdsaSession.response;
-	const refreshedSession = await refreshEmailOtpWalletUnlockSessionState({
-		service: input.service,
-		state: walletSessionState,
-		walletId: walletId.value,
-		orgId: result.orgId,
-		walletAuthMethodId: requestedWalletAuthMethodId.value,
-		providerUserId: result.providerUserId
-	});
-	if (!refreshedSession.ok) return refreshedSession.response;
-	walletSessionState = refreshedSession.state;
-	await emitSuccessfulWalletUnlock({
-		unlockBackend,
-		challengeId,
-		userId: result.userId,
-		walletId: result.walletId,
-		emitRouterApiWebhook: input.emitRouterApiWebhook,
-		emitEmailOtpWebhook: input.emitEmailOtpWebhook
-	});
-	return {
-		status: 200,
-		body: {
-			ok: true,
-			unlocked: true,
-			unlockBackend,
-			userId: result.userId,
-			...verifiedAuthorityProjection ? { verifiedAuthorityProjection } : {},
-			...emailOtpCustody ? { walletCustody: emailOtpCustody.projection } : {},
-			ed25519YaoCapability: capabilityResult.value,
-			...walletSessionState.kind === "active" ? {
-				walletSession: projectActiveWalletSession(walletSessionState.authorization),
-				operationCredential: walletSessionState.operationCredential
-			} : {},
-			...ecdsaSession.activation ? { ecdsaSession: ecdsaSession.activation } : {},
-			...ecdsaSession.activationReceipt ? { ecdsaActivationReceipt: ecdsaSession.activationReceipt } : {},
-			...ecdsaSession.continuity ? { ecdsaCustody: ecdsaSession.continuity } : {}
-		}
-	};
+	return completeEmailOtpUnlock({
+		kind: "wallet_session_operation_credential_v1",
+		operationCredential: ed25519OperationCredential,
+		proof: authorization.proof
+	}, capabilityResult.value);
 }
 function walletUnlockIssuanceRejectionStatus(rejection) {
 	switch (rejection.code) {
@@ -1287,6 +1234,6 @@ function walletUnlockIssuanceRejectionStatus(rejection) {
 	}
 }
 //#endregion
-export { handleWalletUnlockChallengeRoute, handleWalletUnlockVerifyRoute, walletUnlockAlreadyCommittedRouteResponse };
+export { handleWalletUnlockChallengeRoute, handleWalletUnlockVerifyRoute };
 
 //# sourceMappingURL=walletUnlockRouteHandlers.js.map