@seams/wallet-server 0.6.2 → 0.7.3

package/dist/esm/localIntendedYaoExportFault.js

@@ -0,0 +1,117 @@
+import { isLocalIntendedYaoFaultTokenV1 } from "./localIntendedYaoFault.js";
+//#region src/localIntendedYaoExportFault.ts
+const LOCAL_INTENDED_YAO_EXPORT_FAULT_HEADER_V1 = "x-seams-intended-yao-export-fault-v1";
+const LOCAL_INTENDED_YAO_EXPORT_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-yao-export-fault-token-v1";
+const LOCAL_INTENDED_YAO_FAULT_PROOF_HEADER_V1 = "x-seams-intended-yao-fault-proof-v1";
+const AUTHORIZED_OPERATION_INSERT_PATTERN = /^\s*INSERT INTO authorized_operations\b/;
+const STATE_RECORD_WRITE_PATTERN = /^\s*(?:INSERT OR IGNORE INTO|UPDATE)\s+router_ab_yao_versioned_json_records\b/;
+function parseLocalIntendedYaoExportFaultModeV1(value) {
+	return value === "lose_storage_after_export_authorization_once" ? value : null;
+}
+function parseLocalIntendedYaoExportFaultTokenV1(value) {
+	return isLocalIntendedYaoFaultTokenV1(value) ? value : null;
+}
+/** The signer database, losing itself once after an export authorization commits. */
+var LocalIntendedYaoExportFaultDatabaseV1 = class {
+	constructor(base) {
+		this.base = base;
+		this.state = { kind: "armed" };
+	}
+	prepare(query) {
+		return new LocalIntendedYaoExportFaultStatementV1(this, statementRole(query), this.base.prepare(query));
+	}
+	async batch(statements) {
+		this.loseStorageIfAuthorized();
+		const roles = new Set(statements.map(roleOf));
+		const results = await this.base.batch(statements.map(unwrapStatement));
+		if (roles.has("authorized_operation") && roles.has("state_record") && this.state.kind === "armed") this.state = { kind: "authorized" };
+		return results;
+	}
+	async exec(query) {
+		this.loseStorageIfAuthorized();
+		return await this.base.exec(query);
+	}
+	loseStorageIfAuthorized() {
+		if (this.state.kind !== "authorized") return;
+		this.state = { kind: "lost" };
+		throw new Error("Local intended fault: the Gateway lost its storage after an Ed25519 Yao export authorization committed");
+	}
+	/** The fault's outcome, from whether each of the two identical requests was admitted. */
+	outcome(answers) {
+		switch (this.state.kind) {
+			case "armed": return {
+				kind: "violated",
+				violation: "export_authorization_not_committed"
+			};
+			case "authorized": return {
+				kind: "violated",
+				violation: "no_storage_call_after_authorization"
+			};
+			case "lost": break;
+		}
+		if (answers.interruptedOk) return {
+			kind: "violated",
+			violation: "interrupted_admission_answered"
+		};
+		if (!answers.retriedOk) return {
+			kind: "violated",
+			violation: "retried_admission_failed"
+		};
+		return {
+			kind: "proved",
+			proof: "export_authorization_committed_then_storage_lost"
+		};
+	}
+};
+var LocalIntendedYaoExportFaultStatementV1 = class LocalIntendedYaoExportFaultStatementV1 {
+	constructor(database, role, inner) {
+		this.database = database;
+		this.role = role;
+		this.inner = inner;
+	}
+	bind(...values) {
+		return new LocalIntendedYaoExportFaultStatementV1(this.database, this.role, this.inner.bind(...values));
+	}
+	async first(columnName) {
+		this.database.loseStorageIfAuthorized();
+		return await this.inner.first(columnName);
+	}
+	async all() {
+		this.database.loseStorageIfAuthorized();
+		return await this.inner.all();
+	}
+	async run() {
+		this.database.loseStorageIfAuthorized();
+		return await this.inner.run();
+	}
+};
+function statementRole(query) {
+	if (AUTHORIZED_OPERATION_INSERT_PATTERN.test(query)) return "authorized_operation";
+	if (STATE_RECORD_WRITE_PATTERN.test(query)) return "state_record";
+	return "other";
+}
+function roleOf(statement) {
+	return statement instanceof LocalIntendedYaoExportFaultStatementV1 ? statement.role : "other";
+}
+function unwrapStatement(statement) {
+	return statement instanceof LocalIntendedYaoExportFaultStatementV1 ? statement.inner : statement;
+}
+function requestWithoutLocalIntendedYaoExportFaultHeadersV1(request) {
+	const headers = new Headers(request.headers);
+	headers.delete(LOCAL_INTENDED_YAO_EXPORT_FAULT_HEADER_V1);
+	headers.delete(LOCAL_INTENDED_YAO_EXPORT_FAULT_TOKEN_HEADER_V1);
+	return new Request(request, { headers });
+}
+function responseWithLocalIntendedYaoExportFaultOutcomeV1(response, outcome, token) {
+	const headers = new Headers(response.headers);
+	headers.set(LOCAL_INTENDED_YAO_FAULT_PROOF_HEADER_V1, outcome.kind === "proved" ? `${token}:${outcome.proof}` : `${token}:violated:${outcome.violation}`);
+	return new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers
+	});
+}
+//#endregion
+export { LOCAL_INTENDED_YAO_EXPORT_FAULT_HEADER_V1, LOCAL_INTENDED_YAO_EXPORT_FAULT_TOKEN_HEADER_V1, LocalIntendedYaoExportFaultDatabaseV1, parseLocalIntendedYaoExportFaultModeV1, parseLocalIntendedYaoExportFaultTokenV1, requestWithoutLocalIntendedYaoExportFaultHeadersV1, responseWithLocalIntendedYaoExportFaultOutcomeV1 };
+
+//# sourceMappingURL=localIntendedYaoExportFault.js.map

package/dist/esm/localIntendedYaoFault.js

@@ -6,7 +6,7 @@ const LOCAL_INTENDED_YAO_FAULT_PROOF_HEADER_V1 = "x-seams-intended-yao-fault-pro
 const ROUTER_AB_YAO_REPLAY_HEADER_V1 = "x-seams-yao-replay";
 const ROUTER_AB_YAO_EXECUTE_PATH_V1 = "/router-ab/router/ed25519-yao/execute";
 const LOCAL_INTENDED_YAO_FAULT_TOKEN_PATTERN_V1 = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
-const LOCAL_INTENDED_BURNED_EXECUTION_ID_V1 = new Array(32).fill(93);
+const LOCAL_INTENDED_ROUTER_BURN_HEADER_V1 = "x-seams-local-intended-router-burn-v1";
 function equalRequestBytes(left, right) {
 	if (left.length !== right.length) return false;
 	for (let index = 0; index < left.length; index += 1) if (left[index] !== right[index]) return false;
@@ -26,16 +26,6 @@ function parseLocalIntendedYaoFaultTokenV1(value) {
 function isLocalIntendedYaoFaultTokenV1(value) {
 	return !!value && LOCAL_INTENDED_YAO_FAULT_TOKEN_PATTERN_V1.test(value);
 }
-function terminalBurnedRouterResponseV1() {
-	return new Response(JSON.stringify({
-		status: "burned",
-		execution_id: LOCAL_INTENDED_BURNED_EXECUTION_ID_V1,
-		reason: "protocol_failure"
-	}), {
-		status: 200,
-		headers: { "content-type": "application/json" }
-	});
-}
 var LocalIntendedYaoFaultControllerV1 = class {
 	constructor(baseFetch) {
 		this.baseFetch = baseFetch;
@@ -93,11 +83,18 @@ var LocalIntendedYaoFaultControllerV1 = class {
 	}
 	async handleArmedExecute(request, mode) {
 		if (mode === "return_terminal_burned_once") {
-			this.state = {
+			const headers = new Headers(request.headers);
+			headers.set(LOCAL_INTENDED_ROUTER_BURN_HEADER_V1, "burned");
+			const response = await this.baseFetch.call(globalThis, new Request(request, { headers }));
+			const answer = await response.clone().json().catch(() => null);
+			this.state = response.ok && answer?.status === "burned" ? {
 				kind: "proved",
 				proof: "terminal_failure_not_retried"
+			} : {
+				kind: "violated",
+				violation: "router_terminal_not_recorded"
 			};
-			return terminalBurnedRouterResponseV1();
+			return response;
 		}
 		const body = new Uint8Array(await request.clone().arrayBuffer());
 		const traceId = request.headers.get("x-seams-trace-id") ?? "";
@@ -133,12 +130,12 @@ var LocalIntendedYaoFaultControllerV1 = class {
 			};
 			throw new Error("Local intended Yao retry changed the Router trace ID");
 		}
-		if (request.headers.get(ROUTER_AB_YAO_REPLAY_HEADER_V1) !== "1") {
+		if (request.headers.has(ROUTER_AB_YAO_REPLAY_HEADER_V1)) {
 			this.state = {
 				kind: "violated",
-				violation: "router_retry_marker_missing"
+				violation: "router_retry_marked_as_replay"
 			};
-			throw new Error("Local intended Yao retry omitted the replay marker");
+			throw new Error("Local intended Yao retry carried the replay marker");
 		}
 		const response = await this.baseFetch.call(globalThis, request);
 		await response.clone().arrayBuffer();

package/dist/esm/localIntendedYaoFinalizeFault.js

@@ -0,0 +1,99 @@
+import { isLocalIntendedYaoFaultTokenV1 } from "./localIntendedYaoFault.js";
+//#region src/localIntendedYaoFinalizeFault.ts
+const LOCAL_INTENDED_YAO_FINALIZE_FAULT_HEADER_V1 = "x-seams-intended-yao-finalize-fault-v1";
+const LOCAL_INTENDED_YAO_FINALIZE_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-yao-finalize-fault-token-v1";
+const LOCAL_INTENDED_YAO_FAULT_PROOF_HEADER_V1 = "x-seams-intended-yao-fault-proof-v1";
+const WALLET_REGISTRATION_NEAR_PROVISIONING_PATH_V1 = "/wallets/register/near-provisioning";
+const DECISION_INSERT_PATTERN = /^\s*INSERT OR IGNORE INTO yao_lifecycle_decisions\b/;
+function parseLocalIntendedYaoFinalizeFaultModeV1(value) {
+	return value === "lose_storage_after_decision_once" ? value : null;
+}
+function parseLocalIntendedYaoFinalizeFaultTokenV1(value) {
+	return isLocalIntendedYaoFaultTokenV1(value) ? value : null;
+}
+/** The signer database, losing itself once after a Yao decision commits. */
+var LocalIntendedYaoFinalizeFaultDatabaseV1 = class {
+	constructor(base) {
+		this.base = base;
+		this.state = { kind: "armed" };
+	}
+	prepare(query) {
+		return new LocalIntendedYaoFinalizeFaultStatementV1(this, DECISION_INSERT_PATTERN.test(query), this.base.prepare(query));
+	}
+	async batch(statements) {
+		this.loseStorageIfDecided();
+		const decides = statements.some((statement) => statement instanceof LocalIntendedYaoFinalizeFaultStatementV1 && statement.decides);
+		const results = await this.base.batch(statements.map(unwrapStatement));
+		if (decides && this.state.kind === "armed") this.state = { kind: "decided" };
+		return results;
+	}
+	async exec(query) {
+		this.loseStorageIfDecided();
+		return await this.base.exec(query);
+	}
+	loseStorageIfDecided() {
+		if (this.state.kind !== "decided") return;
+		this.state = { kind: "proved" };
+		throw new Error("Local intended fault: the Gateway lost its storage after an Ed25519 Yao decision committed");
+	}
+	outcome() {
+		switch (this.state.kind) {
+			case "proved": return {
+				kind: "proved",
+				proof: "decision_committed_then_storage_lost"
+			};
+			case "decided": return {
+				kind: "violated",
+				violation: "no_storage_call_after_decision"
+			};
+			case "armed": return {
+				kind: "violated",
+				violation: "decision_not_committed"
+			};
+		}
+	}
+};
+var LocalIntendedYaoFinalizeFaultStatementV1 = class LocalIntendedYaoFinalizeFaultStatementV1 {
+	constructor(database, decides, inner) {
+		this.database = database;
+		this.decides = decides;
+		this.inner = inner;
+	}
+	bind(...values) {
+		return new LocalIntendedYaoFinalizeFaultStatementV1(this.database, this.decides, this.inner.bind(...values));
+	}
+	async first(columnName) {
+		this.database.loseStorageIfDecided();
+		return await this.inner.first(columnName);
+	}
+	async all() {
+		this.database.loseStorageIfDecided();
+		return await this.inner.all();
+	}
+	async run() {
+		this.database.loseStorageIfDecided();
+		return await this.inner.run();
+	}
+};
+function unwrapStatement(statement) {
+	return statement instanceof LocalIntendedYaoFinalizeFaultStatementV1 ? statement.inner : statement;
+}
+function requestWithoutLocalIntendedYaoFinalizeFaultHeadersV1(request) {
+	const headers = new Headers(request.headers);
+	headers.delete(LOCAL_INTENDED_YAO_FINALIZE_FAULT_HEADER_V1);
+	headers.delete(LOCAL_INTENDED_YAO_FINALIZE_FAULT_TOKEN_HEADER_V1);
+	return new Request(request, { headers });
+}
+function responseWithLocalIntendedYaoFinalizeFaultOutcomeV1(response, outcome, token) {
+	const headers = new Headers(response.headers);
+	headers.set(LOCAL_INTENDED_YAO_FAULT_PROOF_HEADER_V1, outcome.kind === "proved" ? `${token}:${outcome.proof}` : `${token}:violated:${outcome.violation}`);
+	return new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers
+	});
+}
+//#endregion
+export { LOCAL_INTENDED_YAO_FINALIZE_FAULT_HEADER_V1, LOCAL_INTENDED_YAO_FINALIZE_FAULT_TOKEN_HEADER_V1, LocalIntendedYaoFinalizeFaultDatabaseV1, WALLET_REGISTRATION_NEAR_PROVISIONING_PATH_V1, parseLocalIntendedYaoFinalizeFaultModeV1, parseLocalIntendedYaoFinalizeFaultTokenV1, requestWithoutLocalIntendedYaoFinalizeFaultHeadersV1, responseWithLocalIntendedYaoFinalizeFaultOutcomeV1 };
+
+//# sourceMappingURL=localIntendedYaoFinalizeFault.js.map

package/dist/esm/localIntendedYaoRecoveryFault.js

@@ -0,0 +1,102 @@
+import { isLocalIntendedYaoFaultTokenV1 } from "./localIntendedYaoFault.js";
+//#region src/localIntendedYaoRecoveryFault.ts
+const LOCAL_INTENDED_YAO_RECOVERY_FAULT_HEADER_V1 = "x-seams-intended-yao-recovery-fault-v1";
+const LOCAL_INTENDED_YAO_RECOVERY_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-yao-recovery-fault-token-v1";
+const LOCAL_INTENDED_YAO_FAULT_PROOF_HEADER_V1 = "x-seams-intended-yao-fault-proof-v1";
+const ROUTER_AB_YAO_EXECUTE_PATH_V1 = "/router-ab/router/ed25519-yao/execute";
+const keptRecoveryExecutes = /* @__PURE__ */ new Map();
+function parseLocalIntendedYaoRecoveryFaultModeV1(value) {
+	switch (value) {
+		case "lose_router_recovery_replies":
+		case "withhold_router_recovery_execute":
+		case "release_router_recovery_execute": return value;
+		default: return null;
+	}
+}
+function parseLocalIntendedYaoRecoveryFaultTokenV1(value) {
+	return isLocalIntendedYaoFaultTokenV1(value) ? value : null;
+}
+/** The Gateway's Router binding, faulting every call to a recovery execution. */
+var LocalIntendedYaoRecoveryFaultControllerV1 = class {
+	constructor(baseFetch, mode, token) {
+		this.baseFetch = baseFetch;
+		this.mode = mode;
+		this.token = token;
+		this.executed = false;
+		this.failed = false;
+		this.kept = false;
+	}
+	async fetch(input, init) {
+		const request = new Request(input, init);
+		if (request.method !== "POST" || new URL(request.url).pathname !== ROUTER_AB_YAO_EXECUTE_PATH_V1) return await this.baseFetch.call(globalThis, request);
+		if (this.mode === "withhold_router_recovery_execute") {
+			if (!keptRecoveryExecutes.has(this.token)) keptRecoveryExecutes.set(this.token, {
+				url: request.url,
+				headers: [...request.headers],
+				body: await request.clone().text()
+			});
+			this.kept = true;
+			throw new Error("Local intended Yao recovery fault withheld the Router execution");
+		}
+		const response = await this.baseFetch.call(globalThis, request);
+		const answer = await response.clone().json().catch(() => null);
+		if (response.ok && typeof answer === "object" && answer !== null && answer.status === "succeeded") this.executed = true;
+		else this.failed = true;
+		throw new Error("Local intended Yao recovery fault lost the Router reply");
+	}
+	outcome() {
+		if (this.mode === "withhold_router_recovery_execute") return this.kept ? {
+			kind: "proved",
+			proof: "recovery_execute_withheld"
+		} : {
+			kind: "violated",
+			violation: "router_recovery_execute_not_observed"
+		};
+		if (this.failed) return {
+			kind: "violated",
+			violation: "router_recovery_answer_failed"
+		};
+		if (!this.executed) return {
+			kind: "violated",
+			violation: "router_recovery_not_executed"
+		};
+		return {
+			kind: "proved",
+			proof: "recovery_replies_lost_after_router_executed"
+		};
+	}
+};
+/** Sends the execution kept under `token` to the Router, exactly. */
+async function releaseLocalIntendedYaoRecoveryExecuteV1(router, token) {
+	const kept = keptRecoveryExecutes.get(token);
+	if (!kept) return Response.json({ code: "intended_recovery_execute_missing" }, { status: 404 });
+	keptRecoveryExecutes.delete(token);
+	const reply = await router.fetch(new Request(kept.url, {
+		method: "POST",
+		headers: kept.headers.map(([name, value]) => [name, value]),
+		body: kept.body
+	}));
+	return Response.json({
+		status: reply.status,
+		body: await reply.text()
+	});
+}
+function requestWithoutLocalIntendedYaoRecoveryFaultHeadersV1(request) {
+	const headers = new Headers(request.headers);
+	headers.delete(LOCAL_INTENDED_YAO_RECOVERY_FAULT_HEADER_V1);
+	headers.delete(LOCAL_INTENDED_YAO_RECOVERY_FAULT_TOKEN_HEADER_V1);
+	return new Request(request, { headers });
+}
+function responseWithLocalIntendedYaoRecoveryFaultOutcomeV1(response, outcome, token) {
+	const headers = new Headers(response.headers);
+	headers.set(LOCAL_INTENDED_YAO_FAULT_PROOF_HEADER_V1, outcome.kind === "proved" ? `${token}:${outcome.proof}` : `${token}:violated:${outcome.violation}`);
+	return new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers
+	});
+}
+//#endregion
+export { LOCAL_INTENDED_YAO_RECOVERY_FAULT_HEADER_V1, LOCAL_INTENDED_YAO_RECOVERY_FAULT_TOKEN_HEADER_V1, LocalIntendedYaoRecoveryFaultControllerV1, parseLocalIntendedYaoRecoveryFaultModeV1, parseLocalIntendedYaoRecoveryFaultTokenV1, releaseLocalIntendedYaoRecoveryExecuteV1, requestWithoutLocalIntendedYaoRecoveryFaultHeadersV1, responseWithLocalIntendedYaoRecoveryFaultOutcomeV1 };
+
+//# sourceMappingURL=localIntendedYaoRecoveryFault.js.map

package/dist/esm/localIntendedYaoSigningFault.js

@@ -0,0 +1,127 @@
+import { isLocalIntendedYaoFaultTokenV1 } from "./localIntendedYaoFault.js";
+//#region src/localIntendedYaoSigningFault.ts
+const LOCAL_INTENDED_YAO_SIGNING_FAULT_HEADER_V1 = "x-seams-intended-yao-signing-fault-v1";
+const LOCAL_INTENDED_YAO_SIGNING_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-yao-signing-fault-token-v1";
+const LOCAL_INTENDED_YAO_FAULT_PROOF_HEADER_V1 = "x-seams-intended-yao-fault-proof-v1";
+const ROUTER_AB_ED25519_SIGNING_FINALIZE_PATH_V1 = "/router-ab/ed25519/sign";
+const SIGNING_WORKER_LOCAL_INTENDED_HOLD_URL_V1 = "https://signing-worker.router-ab.internal/router-ab/signing-worker/local-intended/hold";
+const ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1 = "x-router-ab-internal-service-auth";
+const keptFinalizes = /* @__PURE__ */ new Map();
+function parseLocalIntendedYaoSigningFaultModeV1(value) {
+	switch (value) {
+		case "capture_signing_finalize":
+		case "withhold_signing_finalize":
+		case "release_signing_finalize":
+		case "arm_signing_worker_hold":
+		case "read_signing_worker_hold": return value;
+		default: return null;
+	}
+}
+function parseLocalIntendedYaoSigningFaultTokenV1(value) {
+	return isLocalIntendedYaoFaultTokenV1(value) ? value : null;
+}
+/** The Gateway's Router binding, keeping the first NEAR finalize it carries. */
+var LocalIntendedYaoSigningFaultControllerV1 = class {
+	constructor(baseFetch, mode, token) {
+		this.baseFetch = baseFetch;
+		this.mode = mode;
+		this.token = token;
+		this.kept = false;
+	}
+	async fetch(input, init) {
+		const request = new Request(input, init);
+		if (request.method !== "POST" || new URL(request.url).pathname !== "/router-ab/ed25519/sign") return await this.baseFetch.call(globalThis, request);
+		const kept = {
+			url: request.url,
+			headers: [...request.headers],
+			body: await request.clone().text()
+		};
+		if (this.mode === "withhold_signing_finalize") {
+			this.keep({
+				request: kept,
+				original: null
+			});
+			return Response.json({
+				ok: false,
+				code: "intended_signing_finalize_withheld",
+				message: "Local intended fault withheld this NEAR finalize from the Router"
+			}, { status: 409 });
+		}
+		const response = await this.baseFetch.call(globalThis, request);
+		this.keep({
+			request: kept,
+			original: {
+				status: response.status,
+				body: await response.clone().text()
+			}
+		});
+		return response;
+	}
+	keep(finalize) {
+		this.kept = true;
+		if (!keptFinalizes.has(this.token)) keptFinalizes.set(this.token, finalize);
+	}
+	outcome() {
+		if (!this.kept) return `${this.token}:violated:signing_finalize_not_observed`;
+		return this.mode === "withhold_signing_finalize" ? `${this.token}:signing_finalize_withheld` : `${this.token}:signing_finalize_captured`;
+	}
+};
+/** Sends the finalize kept under `token` to the Router again, exactly. */
+async function releaseLocalIntendedYaoSigningFinalizeV1(router, token) {
+	const kept = keptFinalizes.get(token);
+	if (!kept) return Response.json({ code: "intended_signing_finalize_missing" }, { status: 404 });
+	keptFinalizes.delete(token);
+	const reply = await router.fetch(new Request(kept.request.url, {
+		method: "POST",
+		headers: kept.request.headers.map(([name, value]) => [name, value]),
+		body: kept.request.body
+	}));
+	return Response.json({
+		status: reply.status,
+		body: await reply.text(),
+		original: kept.original
+	});
+}
+/**
+* Arms or reads the SigningWorker's hold on one wallet's next NEAR finalize,
+* with the Gateway's own SigningWorker credential, and answers with the
+* SigningWorker's reply.
+*/
+async function commandLocalIntendedSigningWorkerHoldV1(signingWorker, credential, mode, body) {
+	const walletId = body?.wallet_id;
+	if (!credential || typeof walletId !== "string" || walletId === "") return Response.json({ code: "invalid_intended_signing_worker_hold" }, { status: 400 });
+	const reply = await signingWorker.fetch(new Request(SIGNING_WORKER_LOCAL_INTENDED_HOLD_URL_V1, {
+		method: "POST",
+		headers: {
+			"content-type": "application/json",
+			[ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1]: credential
+		},
+		body: JSON.stringify({
+			command: mode === "arm_signing_worker_hold" ? "arm" : "read",
+			wallet_id: walletId
+		})
+	}));
+	return Response.json({
+		status: reply.status,
+		body: await reply.text()
+	});
+}
+function requestWithoutLocalIntendedYaoSigningFaultHeadersV1(request) {
+	const headers = new Headers(request.headers);
+	headers.delete(LOCAL_INTENDED_YAO_SIGNING_FAULT_HEADER_V1);
+	headers.delete(LOCAL_INTENDED_YAO_SIGNING_FAULT_TOKEN_HEADER_V1);
+	return new Request(request, { headers });
+}
+function responseWithLocalIntendedYaoSigningFaultOutcomeV1(response, outcome) {
+	const headers = new Headers(response.headers);
+	headers.set(LOCAL_INTENDED_YAO_FAULT_PROOF_HEADER_V1, outcome);
+	return new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers
+	});
+}
+//#endregion
+export { LOCAL_INTENDED_YAO_SIGNING_FAULT_HEADER_V1, LOCAL_INTENDED_YAO_SIGNING_FAULT_TOKEN_HEADER_V1, LocalIntendedYaoSigningFaultControllerV1, ROUTER_AB_ED25519_SIGNING_FINALIZE_PATH_V1, commandLocalIntendedSigningWorkerHoldV1, parseLocalIntendedYaoSigningFaultModeV1, parseLocalIntendedYaoSigningFaultTokenV1, releaseLocalIntendedYaoSigningFinalizeV1, requestWithoutLocalIntendedYaoSigningFaultHeadersV1, responseWithLocalIntendedYaoSigningFaultOutcomeV1 };
+
+//# sourceMappingURL=localIntendedYaoSigningFault.js.map

package/dist/esm/router/auth/authRequestValidation.js

@@ -259,6 +259,6 @@ function parseAuthIdentityMutationRequest(input) {
 	}
 }
 //#endregion
-export { parseAuthIdentityMutationRequest, parseAuthLinkIdentityRequest, parseAuthProviderAction, parseAuthProviderActionPath, parseAuthUnlinkIdentityRequest, parseGoogleLoginVerifyRequest, parsePasskeyLoginOptionsRequest, parsePasskeyLoginVerifyRequest };
+export { parseAuthIdentityMutationRequest, parseAuthProviderActionPath, parseGoogleLoginVerifyRequest, parsePasskeyLoginOptionsRequest, parsePasskeyLoginVerifyRequest };
 
 //# sourceMappingURL=authRequestValidation.js.map

package/dist/esm/router/auth/commonRouterUtils.js

@@ -27,7 +27,14 @@ function resolveWalletSessionOperationCredentialAdmissionFromContext(input) {
 		retiredAtMs: context.retiredAtMs,
 		nowMs: input.nowMs
 	});
-	if (!admission.ok || admission.keyFamily !== input.operation.keyFamily) return { kind: "rejected" };
+	if (!admission.ok || admission.keyFamily !== input.operation.keyFamily) {
+		console.warn("[wallet-session] operation credential refused", {
+			keyFamily: input.operation.keyFamily,
+			operationKind: input.operation.operationKind,
+			error: admission.ok ? "key_family_mismatch" : admission.error
+		});
+		return { kind: "rejected" };
+	}
 	if (admission.keyFamily === "ed25519") return {
 		kind: "admitted",
 		admission: {
@@ -166,6 +173,7 @@ async function validateEcdsaPreprocessingSession(input) {
 			ok: true,
 			kind: "ecdsa_preprocessing_session",
 			session,
+			ownerWalletScope: context.ownerWalletScope,
 			signer: admission.signer,
 			materialActivation: admission.materialActivation
 		};
@@ -183,32 +191,46 @@ async function validateRouterAbEcdsaDerivationWalletSessionInputs(input) {
 	const token = extractBearerCredential(input.headers);
 	if (!token) return walletSessionFailure("wallet_session_missing");
 	const nowMs = input.nowMs || Date.now;
-	let resolution;
+	let candidate;
 	try {
-		resolution = await resolveWalletSessionOperationCredentialAdmission({
-			authorizationSessions,
+		candidate = await authorizationSessions.readWalletSessionSigningCandidateByOperationCredential({
+			tenantId: authorizationSessions.tenantId,
 			token,
 			nowMs: nowMs(),
-			operation: {
-				keyFamily: "ecdsa_secp256k1",
-				operationKind: input.operationKind
-			}
+			materialActivation: input.materialActivation
 		});
 	} catch {
 		return walletSessionFailure("wallet_session_unavailable");
 	}
-	if (resolution.kind === "rejected") return walletSessionFailure("wallet_session_scope_mismatch");
-	if (resolution.kind === "not_found") return {
+	if (!candidate) return {
 		ok: false,
 		code: "wallet_session_invalid",
 		message: walletSessionFailureMessage("wallet_session_invalid")
 	};
+	if (candidate.kind === "exhausted") return {
+		ok: true,
+		kind: "wallet_session_operation_credential_exhausted_candidate_v1",
+		candidate: candidate.candidate,
+		materialRead: candidate.materialRead,
+		policyRead: candidate.policyRead
+	};
+	const resolution = resolveWalletSessionOperationCredentialAdmissionFromContext({
+		context: candidate.context,
+		nowMs: nowMs(),
+		operation: {
+			keyFamily: "ecdsa_secp256k1",
+			operationKind: input.operationKind
+		}
+	});
+	if (resolution.kind === "rejected") return walletSessionFailure("wallet_session_scope_mismatch");
 	if (resolution.admission.curve !== "ecdsa") return walletSessionFailure("wallet_session_scope_mismatch");
 	return {
 		ok: true,
 		kind: "wallet_session_operation_credential_v1",
 		admission: resolution.admission,
-		context: resolution.admission.context
+		context: resolution.admission.context,
+		materialRead: candidate.materialRead,
+		policyRead: candidate.policyRead
 	};
 }
 async function resolveThresholdRuntimePolicyScope(input) {
@@ -343,6 +365,6 @@ async function resolveRuntimeProjectEnvironment(input) {
 	}
 }
 //#endregion
-export { resolveActiveRuntimePolicyScopeForEnvironment, resolveActiveRuntimePolicyScopeFromFields, resolveThresholdRuntimePolicyScope, resolveWalletSessionAdministrationAdmission, resolveWalletSessionOperationCredentialAdmission, resolveWalletSessionOperationCredentialAdmissionFromContext, validateEcdsaPreprocessingSession, validateRouterAbEcdsaDerivationWalletSessionInputs, validateRouterAbEd25519WalletSessionInputs };
+export { resolveActiveRuntimePolicyScopeForEnvironment, resolveThresholdRuntimePolicyScope, resolveWalletSessionAdministrationAdmission, resolveWalletSessionOperationCredentialAdmission, resolveWalletSessionOperationCredentialAdmissionFromContext, validateEcdsaPreprocessingSession, validateRouterAbEcdsaDerivationWalletSessionInputs, validateRouterAbEd25519WalletSessionInputs };
 
 //# sourceMappingURL=commonRouterUtils.js.map

package/dist/esm/router/auth/walletSessionFailure.js

@@ -1,14 +1,5 @@
-import { WALLET_SESSION_FAILURE_CODES } from "../../shared-ts/src/utils/walletSessionFailure.js";
+import { failure } from "../../shared-ts/src/utils/failure.js";
 //#region src/router/auth/walletSessionFailure.ts
-function walletSessionFailureCodeFromParseReason(reason) {
-	switch (reason) {
-		case "missing": return WALLET_SESSION_FAILURE_CODES.missing;
-		case "signature_invalid": return WALLET_SESSION_FAILURE_CODES.signatureInvalid;
-		case "claims_invalid":
-		case "not_active": return WALLET_SESSION_FAILURE_CODES.claimsInvalid;
-		case "expired": return WALLET_SESSION_FAILURE_CODES.expired;
-	}
-}
 function walletSessionFailureMessage(code) {
 	switch (code) {
 		case "wallet_session_missing": return "Wallet Session is missing";
@@ -33,17 +24,10 @@ function walletSessionFailureStatus(code) {
 		case "wallet_session_unavailable": return 503;
 	}
 }
-function walletSessionParseFailure(reason) {
-	return walletSessionFailure(walletSessionFailureCodeFromParseReason(reason));
-}
 function walletSessionFailure(code) {
-	return {
-		ok: false,
-		code,
-		message: walletSessionFailureMessage(code)
-	};
+	return failure(code, walletSessionFailureMessage(code));
 }
 //#endregion
-export { walletSessionFailure, walletSessionFailureCodeFromParseReason, walletSessionFailureMessage, walletSessionFailureStatus, walletSessionParseFailure };
+export { walletSessionFailure, walletSessionFailureMessage, walletSessionFailureStatus };
 
 //# sourceMappingURL=walletSessionFailure.js.map