@seams/wallet-server 0.6.2 → 0.7.3

package/dist/esm/router/cloudflare/durableObjects/thresholdStore.js

@@ -1,7 +1,7 @@
 import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
+import { failure } from "../../../shared-ts/src/utils/failure.js";
+import { EXPORT_REPLAY_GUARD_CLOCK_SKEW_MS, EXPORT_REPLAY_GUARD_MIN_RETENTION_MS } from "../../../core/ThresholdService/stores/exportReplayGuard.js";
 //#region src/router/cloudflare/durableObjects/thresholdStore.ts
-const EXPORT_REPLAY_GUARD_CLOCK_SKEW_MS = 5 * 6e4;
-const EXPORT_REPLAY_GUARD_MIN_RETENTION_MS = 1440 * 6e4;
 const ECDSA_SHARED_IDENTITY_CONFLICT_MESSAGE = "[threshold-ecdsa] EVM-family key identity already exists for wallet/subject/rp/signing root";
 const ECDSA_KEY_HANDLE_CONFLICT_MESSAGE = "[threshold-ecdsa] ECDSA key handle already exists in this namespace";
 function json(body, init) {
@@ -19,13 +19,6 @@ function ok(value) {
 		value
 	};
 }
-function err(code, message) {
-	return {
-		ok: false,
-		code,
-		message
-	};
-}
 function toKey(input) {
 	return typeof input === "string" ? input.trim() : "";
 }
@@ -94,25 +87,25 @@ var ThresholdStoreDurableObject = class {
 		this.state = state;
 	}
 	async fetch(request) {
-		if (request.method.toUpperCase() !== "POST") return json(err("method_not_allowed", "POST required"), { status: 405 });
+		if (request.method.toUpperCase() !== "POST") return json(failure("method_not_allowed", "POST required"), { status: 405 });
 		let body;
 		try {
 			body = await request.json();
 		} catch {
 			body = null;
 		}
-		if (!isPlainObject(body)) return json(err("invalid_body", "Expected JSON object"));
+		if (!isPlainObject(body)) return json(failure("invalid_body", "Expected JSON object"));
 		const op = body.op;
-		if (typeof op !== "string") return json(err("invalid_body", "Missing op"));
+		if (typeof op !== "string") return json(failure("invalid_body", "Missing op"));
 		const req = body;
 		if (op === "get") {
 			const key = toKey(req.key);
-			if (!key) return json(err("invalid_body", "Missing key"));
+			if (!key) return json(failure("invalid_body", "Missing key"));
 			return json(ok(await this.state.storage.get(key) ?? null));
 		}
 		if (op === "readVersioned") {
 			const key = toKey(req.key);
-			if (!key) return json(err("invalid_body", "Missing key"));
+			if (!key) return json(failure("invalid_body", "Missing key"));
 			const value = await this.state.storage.get(key);
 			if (value === null || value === void 0) return json(ok(null));
 			return json(ok({
@@ -122,7 +115,7 @@ var ThresholdStoreDurableObject = class {
 		}
 		if (op === "readVersionedJson") {
 			const key = toKey(req.key);
-			if (!key) return json(err("invalid_body", "Missing key"));
+			if (!key) return json(failure("invalid_body", "Missing key"));
 			const stored = await this.state.storage.get(key);
 			if (stored === null || stored === void 0) return json(ok({ status: "missing" }));
 			if (!isVersionedJsonRecordEnvelope(stored)) return json(ok({ status: "invalid_record" }));
@@ -134,12 +127,12 @@ var ThresholdStoreDurableObject = class {
 		}
 		if (op === "putVersionedJson") {
 			const key = toKey(req.key);
-			if (!key) return json(err("invalid_body", "Missing key"));
+			if (!key) return json(failure("invalid_body", "Missing key"));
 			const expectedVersion = req.expectedVersion;
-			if (expectedVersion !== null && typeof expectedVersion !== "string") return json(err("invalid_body", "expectedVersion must be null or a non-empty string"));
-			if (typeof expectedVersion === "string" && !toKey(expectedVersion)) return json(err("invalid_body", "expectedVersion must be null or a non-empty string"));
+			if (expectedVersion !== null && typeof expectedVersion !== "string") return json(failure("invalid_body", "expectedVersion must be null or a non-empty string"));
+			if (typeof expectedVersion === "string" && !toKey(expectedVersion)) return json(failure("invalid_body", "expectedVersion must be null or a non-empty string"));
 			const value = req.value;
-			if (!isJsonValue(value)) return json(err("invalid_body", "value must be JSON serializable"));
+			if (!isJsonValue(value)) return json(failure("invalid_body", "value must be JSON serializable"));
 			const ttl = toTtlSeconds(req.ttlMs);
 			return json(ok(await withRequiredTxn(this.state, async (store) => {
 				const current = await store.get(key);
@@ -163,7 +156,7 @@ var ThresholdStoreDurableObject = class {
 		}
 		if (op === "set") {
 			const key = toKey(req.key);
-			if (!key) return json(err("invalid_body", "Missing key"));
+			if (!key) return json(failure("invalid_body", "Missing key"));
 			const ttl = toTtlSeconds(req.ttlMs);
 			await this.state.storage.put(key, req.value, ttl ? { expirationTtl: ttl } : void 0);
 			return json(ok(true));
@@ -171,8 +164,8 @@ var ThresholdStoreDurableObject = class {
 		if (op === "claimVersioned") {
 			const key = toKey(req.key);
 			const expectedVersion = toKey(req.expectedVersion);
-			if (!key) return json(err("invalid_body", "Missing key"));
-			if (!expectedVersion) return json(err("invalid_body", "Missing expectedVersion"));
+			if (!key) return json(failure("invalid_body", "Missing key"));
+			if (!expectedVersion) return json(failure("invalid_body", "Missing expectedVersion"));
 			return json(ok(await withTxn(this.state, async (store) => {
 				const value = await store.get(key);
 				if (value === null || value === void 0) return { status: "not_found" };
@@ -195,17 +188,17 @@ var ThresholdStoreDurableObject = class {
 			const identityValue = toKey(req.identityValue);
 			const keyHandleKey = toKey(req.keyHandleKey);
 			const keyHandleValue = toKey(req.keyHandleValue);
-			if (!key) return json(err("invalid_body", "Missing key"));
-			if (!identityKey) return json(err("invalid_body", "Missing identityKey"));
-			if (!identityValue) return json(err("invalid_body", "Missing identityValue"));
-			if (!keyHandleKey) return json(err("invalid_body", "Missing keyHandleKey"));
-			if (!keyHandleValue) return json(err("invalid_body", "Missing keyHandleValue"));
+			if (!key) return json(failure("invalid_body", "Missing key"));
+			if (!identityKey) return json(failure("invalid_body", "Missing identityKey"));
+			if (!identityValue) return json(failure("invalid_body", "Missing identityValue"));
+			if (!keyHandleKey) return json(failure("invalid_body", "Missing keyHandleKey"));
+			if (!keyHandleValue) return json(failure("invalid_body", "Missing keyHandleValue"));
 			const ttl = toTtlSeconds(req.ttlMs);
 			return json(await withTxn(this.state, async (store) => {
 				const existing = await store.get(identityKey);
-				if (existing !== null && existing !== void 0 && existing !== identityValue) return err("conflict", ECDSA_SHARED_IDENTITY_CONFLICT_MESSAGE);
+				if (existing !== null && existing !== void 0 && existing !== identityValue) return failure("conflict", ECDSA_SHARED_IDENTITY_CONFLICT_MESSAGE);
 				const existingKeyHandle = await store.get(keyHandleKey);
-				if (existingKeyHandle !== null && existingKeyHandle !== void 0 && existingKeyHandle !== keyHandleValue) return err("conflict", ECDSA_KEY_HANDLE_CONFLICT_MESSAGE);
+				if (existingKeyHandle !== null && existingKeyHandle !== void 0 && existingKeyHandle !== keyHandleValue) return failure("conflict", ECDSA_KEY_HANDLE_CONFLICT_MESSAGE);
 				await store.put(key, req.value, ttl ? { expirationTtl: ttl } : void 0);
 				await store.put(identityKey, identityValue);
 				await store.put(keyHandleKey, keyHandleValue);
@@ -214,7 +207,7 @@ var ThresholdStoreDurableObject = class {
 		}
 		if (op === "del") {
 			const key = toKey(req.key);
-			if (!key) return json(err("invalid_body", "Missing key"));
+			if (!key) return json(failure("invalid_body", "Missing key"));
 			return json(ok(await this.state.storage.delete(key)));
 		}
 		if (op === "delWithIdentityGuard") {
@@ -223,11 +216,11 @@ var ThresholdStoreDurableObject = class {
 			const identityValue = toKey(req.identityValue);
 			const keyHandleKey = toKey(req.keyHandleKey);
 			const keyHandleValue = toKey(req.keyHandleValue);
-			if (!key) return json(err("invalid_body", "Missing key"));
-			if (!identityKey) return json(err("invalid_body", "Missing identityKey"));
-			if (!identityValue) return json(err("invalid_body", "Missing identityValue"));
-			if (!keyHandleKey) return json(err("invalid_body", "Missing keyHandleKey"));
-			if (!keyHandleValue) return json(err("invalid_body", "Missing keyHandleValue"));
+			if (!key) return json(failure("invalid_body", "Missing key"));
+			if (!identityKey) return json(failure("invalid_body", "Missing identityKey"));
+			if (!identityValue) return json(failure("invalid_body", "Missing identityValue"));
+			if (!keyHandleKey) return json(failure("invalid_body", "Missing keyHandleKey"));
+			if (!keyHandleValue) return json(failure("invalid_body", "Missing keyHandleValue"));
 			await withTxn(this.state, async (store) => {
 				await store.delete(key);
 				if (await store.get(identityKey) === identityValue) await store.delete(identityKey);
@@ -237,7 +230,7 @@ var ThresholdStoreDurableObject = class {
 		}
 		if (op === "getdel") {
 			const key = toKey(req.key);
-			if (!key) return json(err("invalid_body", "Missing key"));
+			if (!key) return json(failure("invalid_body", "Missing key"));
 			return json(ok(await withTxn(this.state, async (store) => {
 				const v = await store.get(key);
 				await store.delete(key);
@@ -247,8 +240,8 @@ var ThresholdStoreDurableObject = class {
 		if (op === "getdelIfRelatedMatches") {
 			const key = toKey(req.key);
 			const relatedKey = toKey(req.relatedKey);
-			if (!key) return json(err("invalid_body", "Missing key"));
-			if (!relatedKey) return json(err("invalid_body", "Missing relatedKey"));
+			if (!key) return json(failure("invalid_body", "Missing key"));
+			if (!relatedKey) return json(failure("invalid_body", "Missing relatedKey"));
 			const expectedRelated = req.expectedRelated;
 			return json(ok(await withTxn(this.state, async (store) => {
 				if (!jsonValueContains(await store.get(relatedKey), expectedRelated)) return {
@@ -266,9 +259,9 @@ var ThresholdStoreDurableObject = class {
 		if (op === "walletTakeEcdsaPendingSessionActivationPair") {
 			const recoveryKey = toKey(req.recoveryKey);
 			const refreshKey = toKey(req.refreshKey);
-			if (!recoveryKey) return json(err("invalid_body", "Missing recoveryKey"));
-			if (!refreshKey) return json(err("invalid_body", "Missing refreshKey"));
-			if (recoveryKey === refreshKey) return json(err("invalid_body", "Recovery and refresh keys must be distinct"));
+			if (!recoveryKey) return json(failure("invalid_body", "Missing recoveryKey"));
+			if (!refreshKey) return json(failure("invalid_body", "Missing refreshKey"));
+			if (recoveryKey === refreshKey) return json(failure("invalid_body", "Recovery and refresh keys must be distinct"));
 			return json(ok(await withRequiredTxn(this.state, async (store) => {
 				const recovery = await store.get(recoveryKey);
 				const refresh = await store.get(refreshKey);
@@ -285,9 +278,9 @@ var ThresholdStoreDurableObject = class {
 			const ceremonyKey = toKey(req.ceremonyKey);
 			const registrationCeremonyId = toKey(req.registrationCeremonyId);
 			const walletId = toKey(req.walletId);
-			if (!ceremonyKey) return json(err("invalid_body", "Missing terminal registration ceremony key"));
-			if (!registrationCeremonyId) return json(err("invalid_body", "Missing terminal registration ceremony ID"));
-			if (!walletId) return json(err("invalid_body", "Missing terminal registration walletId"));
+			if (!ceremonyKey) return json(failure("invalid_body", "Missing terminal registration ceremony key"));
+			if (!registrationCeremonyId) return json(failure("invalid_body", "Missing terminal registration ceremony ID"));
+			if (!walletId) return json(failure("invalid_body", "Missing terminal registration walletId"));
 			return json(await withRequiredTxn(this.state, async (store) => {
 				const ceremony = await store.get(ceremonyKey);
 				if (ceremony === null || ceremony === void 0) return ok({
@@ -298,7 +291,7 @@ var ThresholdStoreDurableObject = class {
 					raw: ceremony,
 					registrationCeremonyId,
 					walletId
-				})) return err("registration_ceremony_identity_mismatch", "Terminal registration cancellation does not match the stored ceremony");
+				})) return failure("registration_ceremony_identity_mismatch", "Terminal registration cancellation does not match the stored ceremony");
 				await store.delete(ceremonyKey);
 				return ok({
 					kind: "cancelled",
@@ -308,15 +301,15 @@ var ThresholdStoreDurableObject = class {
 		}
 		if (op === "authConsumeUseCount") {
 			const key = toKey(req.key);
-			if (!key) return json(err("invalid_body", "Missing key"));
+			if (!key) return json(failure("invalid_body", "Missing key"));
 			return json(await withTxn(this.state, async (store) => {
 				const entry = parseAuthEntry(await store.get(key));
-				if (!entry) return err("wallet_session_missing", "Wallet Session is missing");
+				if (!entry) return failure("wallet_session_missing", "Wallet Session is missing");
 				if (entry.expiresAtMs <= Date.now()) {
 					await store.delete(key);
-					return err("wallet_session_expired", "Wallet Session expired");
+					return failure("wallet_session_expired", "Wallet Session expired");
 				}
-				if (entry.remainingUses <= 0) return err("wallet_budget_exhausted", "Wallet Session exhausted");
+				if (entry.remainingUses <= 0) return failure("wallet_budget_exhausted", "Wallet Session exhausted");
 				entry.remainingUses -= 1;
 				const ttlSeconds = Math.max(1, Math.ceil(Math.max(0, entry.expiresAtMs - Date.now()) / 1e3));
 				await store.put(key, entry, { expirationTtl: ttlSeconds });
@@ -326,18 +319,18 @@ var ThresholdStoreDurableObject = class {
 		if (op === "authConsumeUseCountOnce") {
 			const key = toKey(req.key);
 			const idempotencyKey = toKey(req.idempotencyKey);
-			if (!key) return json(err("invalid_body", "Missing key"));
-			if (!idempotencyKey) return json(err("invalid_body", "Missing idempotencyKey"));
+			if (!key) return json(failure("invalid_body", "Missing key"));
+			if (!idempotencyKey) return json(failure("invalid_body", "Missing idempotencyKey"));
 			return json(await withTxn(this.state, async (store) => {
 				const entry = parseAuthEntry(await store.get(key));
-				if (!entry) return err("wallet_session_missing", "Wallet Session is missing");
+				if (!entry) return failure("wallet_session_missing", "Wallet Session is missing");
 				if (entry.expiresAtMs <= Date.now()) {
 					await store.delete(key);
-					return err("wallet_session_expired", "Wallet Session expired");
+					return failure("wallet_session_expired", "Wallet Session expired");
 				}
 				const consumedIdempotencyKeys = entry.consumedIdempotencyKeys || {};
 				if (consumedIdempotencyKeys[idempotencyKey]) return ok({ remainingUses: entry.remainingUses });
-				if (entry.remainingUses <= 0) return err("wallet_budget_exhausted", "Wallet Session exhausted");
+				if (entry.remainingUses <= 0) return failure("wallet_budget_exhausted", "Wallet Session exhausted");
 				entry.remainingUses -= 1;
 				entry.consumedIdempotencyKeys = {
 					...consumedIdempotencyKeys,
@@ -351,26 +344,26 @@ var ThresholdStoreDurableObject = class {
 		if (op === "authHasConsumedUseCountOnce") {
 			const key = toKey(req.key);
 			const idempotencyKey = toKey(req.idempotencyKey);
-			if (!key) return json(err("invalid_body", "Missing key"));
-			if (!idempotencyKey) return json(err("invalid_body", "Missing idempotencyKey"));
+			if (!key) return json(failure("invalid_body", "Missing key"));
+			if (!idempotencyKey) return json(failure("invalid_body", "Missing idempotencyKey"));
 			return json(await withTxn(this.state, async (store) => {
 				const entry = parseAuthEntry(await store.get(key));
-				if (!entry) return err("wallet_session_missing", "Wallet Session is missing");
+				if (!entry) return failure("wallet_session_missing", "Wallet Session is missing");
 				if (entry.expiresAtMs <= Date.now()) {
 					await store.delete(key);
-					return err("wallet_session_expired", "Wallet Session expired");
+					return failure("wallet_session_expired", "Wallet Session expired");
 				}
 				return ok({ consumed: (entry.consumedIdempotencyKeys || {})[idempotencyKey] === true });
 			}));
 		}
 		if (op === "authGetSessionStatus") {
 			const key = toKey(req.key);
-			if (!key) return json(err("invalid_body", "Missing key"));
+			if (!key) return json(failure("invalid_body", "Missing key"));
 			const entry = parseAuthEntry(await this.state.storage.get(key));
-			if (!entry) return json(err("wallet_session_missing", "Wallet Session is missing"));
+			if (!entry) return json(failure("wallet_session_missing", "Wallet Session is missing"));
 			if (entry.expiresAtMs <= Date.now()) {
 				await this.state.storage.delete(key);
-				return json(err("wallet_session_expired", "Wallet Session expired"));
+				return json(failure("wallet_session_expired", "Wallet Session expired"));
 			}
 			return json(ok({
 				record: entry.record,
@@ -381,21 +374,21 @@ var ThresholdStoreDurableObject = class {
 		if (op === "authReserveReplayGuard") {
 			const key = toKey(req.key);
 			const expiresAtMs = Number(req.expiresAtMs);
-			if (!key) return json(err("invalid_body", "Missing key"));
-			if (!Number.isFinite(expiresAtMs)) return json(err("invalid_body", "Invalid expiresAtMs"));
+			if (!key) return json(failure("invalid_body", "Missing key"));
+			if (!Number.isFinite(expiresAtMs)) return json(failure("invalid_body", "Invalid expiresAtMs"));
 			return json(await withTxn(this.state, async (store) => {
 				const nowMs = Date.now();
-				if (expiresAtMs <= nowMs) return err("export_authorization_expired", "Export authorization expired");
+				if (expiresAtMs <= nowMs) return failure("export_authorization_expired", "Export authorization expired");
 				const raw = await store.get(key);
 				const existingExpiresAtMs = raw && typeof raw === "object" && "expiresAtMs" in raw ? Number(raw.expiresAtMs) : NaN;
-				if (Number.isFinite(existingExpiresAtMs) && existingExpiresAtMs > nowMs) return err("export_nonce_replay", "Export authorization nonce already used");
+				if (Number.isFinite(existingExpiresAtMs) && existingExpiresAtMs > nowMs) return failure("export_nonce_replay", "Export authorization nonce already used");
 				const retainedUntilMs = Math.max(nowMs + EXPORT_REPLAY_GUARD_MIN_RETENTION_MS, expiresAtMs + EXPORT_REPLAY_GUARD_CLOCK_SKEW_MS);
 				const ttlSeconds = Math.max(1, Math.ceil((retainedUntilMs - nowMs) / 1e3));
 				await store.put(key, { expiresAtMs: retainedUntilMs }, { expirationTtl: ttlSeconds });
 				return ok({ reserved: true });
 			}));
 		}
-		return json(err("invalid_body", `Unknown op: ${op}`));
+		return json(failure("invalid_body", `Unknown op: ${op}`));
 	}
 };
 //#endregion

package/dist/esm/router/cloudflare/runtime/createSelfHostedCloudflareSigningWorker.js

@@ -1,4 +1,3 @@
-import "../../../shared-ts/src/utils/validation.js";
 import { coerceRouterLogger } from "../../framework/logger.js";
 import { json, withCors } from "../../framework/http.js";
 import { handleThresholdEcdsa } from "../../transport/fetch/routes/thresholdEcdsa.js";
@@ -45,7 +44,7 @@ function createSelfHostedCloudflareSigningRouter(service, opts = {}) {
 	};
 	if (effectiveOpts.ror) validateRouterApiRorOptions(effectiveOpts.ror);
 	const logger = coerceRouterLogger(effectiveOpts.logger);
-	const handler = async (request, env, cfCtx) => {
+	const handler = async (request, _env, cfCtx) => {
 		if (request.method.toUpperCase() === "OPTIONS") {
 			const res = new Response(null, { status: 204 });
 			withCors(res.headers, effectiveOpts, request);

package/dist/esm/router/cloudflare/runtime/routerAbPrewarm.js

@@ -1,8 +1,8 @@
+import { ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1 } from "../../../core/ThresholdService/routerAb/internalServiceHttp.js";
 import { ROUTER_AB_MPC_ROUTER_ORIGIN } from "./routerAbServiceBindings.js";
 //#region src/router/cloudflare/runtime/routerAbPrewarm.ts
 const ROUTER_AB_PREWARM_CRON = "* * * * *";
 const ROUTER_AB_PREWARM_PATH = "/internal/prewarm";
-const ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER = "x-router-ab-internal-service-auth";
 function parseRouterAbPrewarmEnabled(value) {
 	if (value === "true") return true;
 	if (value === "false") return false;
@@ -23,7 +23,7 @@ async function runRouterAbPrewarmScheduledV1(event, env) {
 	if (!parseRouterAbPrewarmEnabled(env.ROUTER_AB_PREWARM_ENABLED)) return;
 	const response = await env.MPC_ROUTER.fetch(new Request(`${ROUTER_AB_MPC_ROUTER_ORIGIN}${ROUTER_AB_PREWARM_PATH}`, {
 		method: "POST",
-		headers: { [ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER]: requireRouterAbInternalServiceAuthSecret(env) }
+		headers: { [ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1]: requireRouterAbInternalServiceAuthSecret(env) }
 	}));
 	if (!response.ok) throw new Error(`Router A/B prewarm failed with HTTP ${response.status}`);
 	if (!isSuccessfulRouterAbPrewarmResponse(await response.json())) throw new Error("Router A/B prewarm returned an invalid response");

package/dist/esm/router/cloudflare/runtime/staticWalletConsoleBinding.js

@@ -1,3 +1,4 @@
+import { failure } from "../../../shared-ts/src/utils/failure.js";
 import { ROUTER_API_CREDENTIAL_SCOPES } from "../../framework/apiCredentialPorts.js";
 import { WALLET_CONSOLE_OP_PATHS_V1, decodeWalletConsoleTenantRootActiveLineageRequestV1 } from "./walletConsoleOps.js";
 //#region src/router/cloudflare/runtime/staticWalletConsoleBinding.ts
@@ -101,11 +102,7 @@ function includesScope(scopes, value) {
 }
 function projectEnvironmentsResponse(config, value) {
 	const context = record(record(value)?.context);
-	if (!context || context.orgId !== config.deployment.orgId) return json({
-		ok: false,
-		code: "environment_not_found",
-		message: "Environment not found"
-	}, 404);
+	if (!context || context.orgId !== config.deployment.orgId) return json(failure("environment_not_found", "Environment not found"), 404);
 	return json({
 		ok: true,
 		environments: [{
@@ -119,17 +116,9 @@ function projectEnvironmentsResponse(config, value) {
 }
 function activeLineageResponse(config, value) {
 	const decoded = decodeWalletConsoleTenantRootActiveLineageRequestV1(value);
-	if (!decoded.ok) return json({
-		ok: false,
-		code: "invalid_body",
-		message: "Identity is invalid"
-	}, 400);
+	if (!decoded.ok) return json(failure("invalid_body", "Identity is invalid"), 400);
 	const identity = decoded.value;
-	if (identity.orgId !== config.deployment.orgId || identity.projectId !== config.deployment.projectId || identity.envId !== config.deployment.environmentId || identity.signingRootId !== config.tenantRoot.signingRootId || identity.signingRootVersion !== config.deployment.signingRootVersion) return json({
-		ok: false,
-		code: "tenant_root_active_lineage_not_found",
-		message: "Active tenant-root lineage was not found"
-	}, 404);
+	if (identity.orgId !== config.deployment.orgId || identity.projectId !== config.deployment.projectId || identity.envId !== config.deployment.environmentId || identity.signingRootId !== config.tenantRoot.signingRootId || identity.signingRootVersion !== config.deployment.signingRootVersion) return json(failure("tenant_root_active_lineage_not_found", "Active tenant-root lineage was not found"), 404);
 	return json({
 		ok: true,
 		identityDigestB64u: config.tenantRoot.identityDigestB64u,
@@ -147,11 +136,7 @@ function principal(config) {
 	};
 }
 function authFailure(code, message, status = 401) {
-	return json({
-		ok: false,
-		code,
-		message
-	}, status);
+	return json(failure(code, message), status);
 }
 function record(value) {
 	return value && typeof value === "object" && !Array.isArray(value) ? value : null;

package/dist/esm/router/cloudflare/runtime/tenantRootCreationGrant.js

@@ -1,4 +1,5 @@
 import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
+import { hasControlCharacters } from "../../../shared-ts/src/tenant-root/tenantRootIdentifier.js";
 import { encodeTenantRootIdentityV1 } from "../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
 //#region src/router/cloudflare/runtime/tenantRootCreationGrant.ts
 const GRANT_DOMAIN = new TextEncoder().encode("tenant_root_creation_grant_v1");
@@ -22,7 +23,6 @@ const ED25519_PKCS8_SEED_PREFIX = Uint8Array.from([
 	4,
 	32
 ]);
-const MAX_IDENTIFIER_BYTES = 256;
 const MAX_GRANT_LIFETIME_MS = 3e5;
 function concatBytes(parts) {
 	const length = parts.reduce((sum, part) => sum + part.length, 0);
@@ -47,17 +47,10 @@ function u64(value, label) {
 	new DataView(output.buffer).setBigUint64(0, BigInt(value), false);
 	return output;
 }
-function hasControlCharacters(value) {
-	for (const character of value) {
-		const codePoint = character.codePointAt(0) ?? 0;
-		if (codePoint <= 31 || codePoint >= 127 && codePoint <= 159) return true;
-	}
-	return false;
-}
 function identifierBytes(value, label) {
 	if (!value || value.trim() !== value || hasControlCharacters(value)) throw new Error(`${label} is invalid`);
 	const bytes = new TextEncoder().encode(value);
-	if (bytes.length > MAX_IDENTIFIER_BYTES) throw new Error(`${label} exceeds ${MAX_IDENTIFIER_BYTES} UTF-8 bytes`);
+	if (bytes.length > 256) throw new Error(`${label} exceeds 256 UTF-8 bytes`);
 	return bytes;
 }
 async function tenantRootIdentityDigestB64uV1(identity) {

package/dist/esm/router/cloudflare/runtime/walletConsoleTenantRootLineage.js

@@ -1,5 +1,6 @@
+import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { deriveSigningRootId } from "../../../shared-ts/src/threshold/signingRootScope.js";
-import { buildTenantRootIdentityFromAuthenticatedDeploymentV1 } from "../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
+import { buildTenantRootIdentityFromAuthenticatedDeploymentV1, encodeTenantRootIdentityV1 } from "../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
 import "../../../shared-ts/src/tenant-root/index.js";
 //#region src/router/cloudflare/runtime/walletConsoleTenantRootLineage.ts
 async function resolveRuntimeTenantRootLineage(environments, roots, scope) {
@@ -19,7 +20,15 @@ async function resolveRuntimeTenantRootLineage(environments, roots, scope) {
 		signingRootVersion: scope.signingRootVersion
 	});
 	if (!identity.ok) throw new Error("Resolved tenant-root environment identity is invalid");
-	return roots.resolveActiveLineage(identity.value);
+	const lineage = await roots.resolveActiveLineage(identity.value);
+	if (!lineage) return null;
+	const digest = await crypto.subtle.digest("SHA-256", encodeTenantRootIdentityV1(identity.value));
+	if (lineage.identityDigestB64u !== base64UrlEncode(digest)) throw new Error("Active tenant-root lineage differs from the resolved Console environment");
+	return {
+		...lineage,
+		identity: identity.value,
+		projectEnvironmentId: environment.id
+	};
 }
 function matchesRuntimeEnvironment(scope, environment) {
 	return environment.projectId === scope.projectId && environment.key === scope.envId && environment.signingRootVersion === scope.signingRootVersion && environment.status === "ACTIVE";

package/dist/esm/router/cloudflare/runtime/walletControlOps.js

@@ -1,3 +1,4 @@
+import { ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1 } from "../../../core/ThresholdService/routerAb/internalServiceHttp.js";
 //#region src/router/cloudflare/runtime/walletControlOps.ts
 const WALLET_CONTROL_SERVICE_ORIGIN_V1 = "https://wallet-runtime.internal";
 const WALLET_CONTROL_BASE_PATH_V1 = "/internal/wallet-runtime/v1/tenant-root-control";
@@ -74,7 +75,7 @@ async function handleWalletControlRequest(request, env) {
 		redirect: "manual",
 		headers: {
 			"content-type": contentType,
-			"x-router-ab-internal-service-auth": requireInternalServiceAuth(env)
+			[ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1]: requireInternalServiceAuth(env)
 		},
 		body
 	}));

package/dist/esm/router/cloudflare/runtime/walletGateway.js

@@ -140,7 +140,7 @@ function createCloudflareWalletGatewayRouterV1(input) {
 		apiKeyUsageMeter: consoleOps.usageMeter,
 		orgProjectEnv: consoleOps.projectEnvironments,
 		routerAbNormalSigningAdmission: createRouterAbNormalSigningAdmissionAdapter(admissionStore),
-		routeExtensions: [createWalletConsoleRelayProxyExtensionV1(input.walletConsole)]
+		routeExtensions: [createWalletConsoleRelayProxyExtensionV1(input.walletConsole), ...input.routeExtensions ?? []]
 	});
 }
 //#endregion

package/dist/esm/router/cloudflare/signingLanes/cloudflareLaneCurveExecution.js

@@ -1,12 +1,12 @@
 import { buildMpcMaterialActivationRef, mpcMaterialActivationRefsEqual, parseMpcSigningWorkerRef } from "../../../shared-ts/src/utils/domainIds.js";
-import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { sha256Bytes } from "../../../shared-ts/src/utils/digests.js";
+import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
+import { parseDigestB64u, sha256DigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { base58Encode } from "../../../shared-ts/src/utils/base58.js";
 import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseEcdsaLifecycleId } from "../../../shared-ts/src/utils/ecdsaCapabilityActivation.js";
 import { parseLaneProtocolCommitReceiptV1, parseLaneServerActivationReceiptV1, parseRevokeSigningLaneV1 } from "../../../shared-ts/src/signing-lanes/rotationParsers.js";
 import { encodeLaneProtocolCommitReceiptV1 } from "../../../shared-ts/src/signing-lanes/rotationDigests.js";
+import { ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1 } from "../../../core/ThresholdService/routerAb/internalServiceHttp.js";
 import { buildEcdsaServerRetirementRequestV1, parseAndVerifyEcdsaServerRetirementEffectV1 } from "../../../core/signingLanes/ecdsaServerRetirement.js";
 import { buildEd25519ServerRetirementRequestV1, parseAndVerifyEd25519ServerRetirementEffectV1 } from "../../../core/signingLanes/ed25519ServerRetirement.js";
 //#region src/router/cloudflare/signingLanes/cloudflareLaneCurveExecution.ts
@@ -448,7 +448,7 @@ async function identityFromProtocolReceiptV1(job, receipt) {
 		holderRecipientKeyDigestB64u: job.targetHolder.hpkePublicKeyDigestB64u,
 		serverRecipientKeyDigestB64u: job.targetSigningWorker.hpkePublicKeyDigestB64u,
 		transcriptHashB64u: parseDigestB64u(receipt.transcriptHashB64u),
-		protocolCommitReceiptDigestB64u: parseDigestB64u(base64UrlEncode(await sha256Bytes(encodeLaneProtocolCommitReceiptV1(receipt))))
+		protocolCommitReceiptDigestB64u: await sha256DigestB64u(encodeLaneProtocolCommitReceiptV1(receipt))
 	};
 }
 async function buildEd25519ActivationBindingV1(input) {
@@ -471,7 +471,7 @@ async function buildEd25519ActivationBindingV1(input) {
 			holderRecipientKeyDigestB64u: input.job.targetHolder.hpkePublicKeyDigestB64u,
 			serverRecipientKeyDigestB64u: input.job.targetSigningWorker.hpkePublicKeyDigestB64u,
 			transcriptHashB64u: parseDigestB64u(receipt.transcriptHashB64u),
-			protocolCommitReceiptDigestB64u: parseDigestB64u(base64UrlEncode(await sha256Bytes(encodeLaneProtocolCommitReceiptV1(receipt))))
+			protocolCommitReceiptDigestB64u: await sha256DigestB64u(encodeLaneProtocolCommitReceiptV1(receipt))
 		},
 		targetMaterialActivation: buildMpcMaterialActivationRef({
 			activationId: input.job.targetMaterialActivationId,
@@ -513,7 +513,7 @@ async function digestSigningWorkerLaneIdentityV1(identity) {
 		bytes.set(chunk, offset);
 		offset += chunk.length;
 	}
-	return parseDigestB64u(base64UrlEncode(await sha256Bytes(bytes)));
+	return sha256DigestB64u(bytes);
 }
 function u64Length(value) {
 	let remaining = BigInt(value);
@@ -570,7 +570,7 @@ async function postSigningWorkerJsonV1(input) {
 		method: "POST",
 		headers: {
 			"content-type": "application/json",
-			"x-router-ab-internal-service-auth": input.internalServiceAuth
+			[ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1]: input.internalServiceAuth
 		},
 		body: JSON.stringify(input.body)
 	}));

package/dist/esm/router/cloudflare/signingLanes/cloudflareLaneProtocolCommitter.js

@@ -1,9 +1,10 @@
 import { mpcMaterialActivationRefsEqual } from "../../../shared-ts/src/utils/domainIds.js";
-import { parseLaneProtocolCommitReceiptV1, parseRotatableSigningLaneJobV1 } from "../../../shared-ts/src/signing-lanes/rotationParsers.js";
+import { parseLaneProtocolCommitReceiptV1 } from "../../../shared-ts/src/signing-lanes/rotationParsers.js";
 import { LaneLifecycleApplicationService } from "../../../core/signingLanes/LaneLifecycleApplicationService.js";
+import { ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1 } from "../../../core/ThresholdService/routerAb/internalServiceHttp.js";
+import { parseRotatableSigningLaneJobV1 } from "../../../shared-ts/src/signing-lanes/rotationProtocolParsers.js";
 //#region src/router/cloudflare/signingLanes/cloudflareLaneProtocolCommitter.ts
 const ROUTER_AB_ED25519_YAO_LANE_EXECUTE_PATH_V1 = "/router-ab/internal/ed25519-yao/lane/execute";
-const INTERNAL_SERVICE_AUTH_HEADER = "x-router-ab-internal-service-auth";
 const REPLAY_HEADER = "x-seams-lane-replay";
 const INTERNAL_ROUTER_ORIGIN = "https://router.router-ab.internal";
 var CloudflareEd25519LaneProtocolTransportV1 = class {
@@ -154,7 +155,7 @@ function boundedLaneWorkerErrorBodyV1(body) {
 async function fetchInternal(input, body, replay) {
 	const headers = {
 		"content-type": "application/json",
-		[INTERNAL_SERVICE_AUTH_HEADER]: input.internalServiceAuth
+		[ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1]: input.internalServiceAuth
 	};
 	if (replay) headers[REPLAY_HEADER] = "1";
 	return await input.binding.fetch(new Request(`${INTERNAL_ROUTER_ORIGIN}${input.path}`, {