@seams/wallet-server 0.7.1 → 0.7.3

package/dist/esm/router/domains/signingOperations/routerAbEcdsaDerivationNormalSigningRoute.js

@@ -10,7 +10,7 @@ import { extractBearerCredential } from "../../auth/routerApiKeyAuth.js";
 import { walletSessionFailure, walletSessionFailureStatus } from "../../auth/walletSessionFailure.js";
 import { validateRouterAbEcdsaDerivationWalletSessionInputs } from "../../auth/commonRouterUtils.js";
 import { evaluateRouterAbNormalSigningAdmission, requireAuthorizationValue, requireMpcMaterialActivationId, routerAbErrorMessage, routerAbOwnerOperationFailureResult, routerAbOwnerOperationStepUpDecision, routerAbSigningError, routerAbStepUpError, routerAbWalletSessionValidationStatus } from "./routerAbNormalSigningAdmission.js";
-import { ecdsaStepUpActiveMaterial, exactOperationStepUpSession, parseStepUpRequestOrigin, readExhaustedWalletSessionCandidate, recordedStepUpOperationClaim, routerAbOperationStepUpClaimFailure, walletSessionCandidateAdmission, walletSessionScopeInvalidFailure, walletSessionUnavailableFailure } from "./routerAbOperationStepUp.js";
+import { ecdsaStepUpActiveMaterial, exactOperationStepUpSession, parseStepUpRequestOrigin, recordedStepUpOperationClaim, routerAbOperationStepUpClaimFailure, walletSessionCandidateAdmission, walletSessionScopeInvalidFailure, walletSessionUnavailableFailure } from "./routerAbOperationStepUp.js";
 import { buildRouterAbEcdsaDerivationPrivateSigningWorkerBody, isRouterAbEcdsaSigningWorkerOperationInProgress, postRouterAbSigningWorkerJson, replayResponseFromSigningWorkerResult } from "./routerAbPrivateSigningWorker.js";
 //#region src/router/domains/signingOperations/routerAbEcdsaDerivationNormalSigningRoute.ts
 function routerAbEcdsaAtomicAuthorizationConfigured(authorizedOperations) {
@@ -43,6 +43,7 @@ async function resolveRouterAbEcdsaOwnerOperationStepUpPreparation(input) {
 		const walletId = parseWalletId(request.scope.wallet_id);
 		if (!walletId.ok) return void 0;
 		const activeMaterial = await input.resolveEcdsaMaterialActivation({
+			source: { kind: "database" },
 			walletId: walletId.value,
 			materialActivation: request.material_activation
 		});
@@ -165,6 +166,7 @@ function routerAbWalletSessionError(code) {
 */
 async function resolveFreshRouterAbEcdsaMaterialActivation(input) {
 	const resolved = await input.resolveEcdsaMaterialActivation({
+		source: { kind: "database" },
 		walletId: input.walletId,
 		materialActivation: input.expected
 	});
@@ -184,15 +186,7 @@ async function resolveFreshRouterAbEcdsaMaterialActivation(input) {
 	};
 }
 function validateRouterAbEcdsaV2NormalSigningRequestForSession(input) {
-	let request;
-	try {
-		request = parseRouterAbEcdsaOperationStepUpRequest(input);
-	} catch (error) {
-		return {
-			ok: false,
-			error: routerAbStepUpError(400, "invalid_body", routerAbErrorMessage(error))
-		};
-	}
+	const request = input.request;
 	if (request.authorization.kind !== "reusable_wallet_session" || request.authorization.wallet_session_id !== input.session.walletSessionId || request.scope.wallet_id !== String(input.session.walletId) || request.material_activation.material_owner !== String(input.session.walletId) || request.material_activation.signing_worker !== request.scope.signing_worker.server_id || !sameRouterAbMpcMaterialActivationRef(request.material_activation, request.scope.material_activation) || !sameRouterAbMpcMaterialActivationRef(request.material_activation, input.admittedMaterialActivation)) return {
 		ok: false,
 		error: routerAbWalletSessionError(WALLET_SESSION_FAILURE_CODES.scopeMismatch)
@@ -221,7 +215,7 @@ function validateRouterAbEcdsaV2NormalSigningRequestForSession(input) {
 	};
 }
 async function admitRouterAbEcdsaReusableWalletSessionOperation(input) {
-	if (typeof input.authorizedOperations.admitEcdsaWalletSessionOperation !== "function") return {
+	if (typeof input.authorizedOperations.admitEcdsaWalletSessionOperation !== "function" || typeof input.authorizedOperations.resolveEcdsaWalletSessionOperation !== "function") return {
 		ok: false,
 		error: routerAbStepUpError(501, "not_configured", "ECDSA atomic authorization is not configured")
 	};
@@ -231,7 +225,7 @@ async function admitRouterAbEcdsaReusableWalletSessionOperation(input) {
 	};
 	const nowMs = Date.now();
 	try {
-		const session = input.binding.kind === "wallet_session_operation_credential_v1" ? input.binding.context.authorization.session : input.binding.candidate.status.session;
+		const session = input.binding.kind === "wallet_session_operation_credential_v1" ? input.binding.validated.admission.context.authorization.session : input.binding.candidate.status.session;
 		const tenantId = session.tenantId;
 		const principalId = session.principalId;
 		const walletId = session.walletId;
@@ -242,16 +236,12 @@ async function admitRouterAbEcdsaReusableWalletSessionOperation(input) {
 			ok: false,
 			error: routerAbStepUpError(403, "wallet_session_mismatch", "Reusable Wallet Session identity does not match")
 		};
-		const freshMaterial = await resolveFreshRouterAbEcdsaMaterialActivation({
-			resolveEcdsaMaterialActivation: input.resolveEcdsaMaterialActivation,
-			walletId: String(walletId),
-			expected: input.materialActivation
-		});
-		if (!freshMaterial.ok) return {
+		const material = input.material;
+		if (!sameRouterAbMpcMaterialActivationRef(material.materialActivation, input.request.material_activation)) return {
 			ok: false,
-			error: routerAbStepUpError(freshMaterial.code === "internal" ? 500 : 403, freshMaterial.code === "internal" ? "internal" : "wallet_session_mismatch", freshMaterial.message)
+			error: routerAbStepUpError(403, "material_mismatch", "Signing material does not match the request")
 		};
-		const capabilityId = requireAuthorizationValue(parseCapabilityId(freshMaterial.materialActivation.capability));
+		const capabilityId = requireAuthorizationValue(parseCapabilityId(material.materialActivation.capability));
 		const operationId = requireAuthorizationValue(parseCapabilityOperationId(input.request.operation_id));
 		const envelope = buildCapabilityOperationEnvelope({
 			tenantId,
@@ -265,13 +255,11 @@ async function admitRouterAbEcdsaReusableWalletSessionOperation(input) {
 				displayDigest: parseDigestB64u(input.request.operation_digests.display_digest_b64u)
 			}
 		});
-		const authorizedOperationId = requireAuthorizationValue(parseAuthorizedOperationId(`ecdsa-authorized-operation:${operationId}:${input.request.request_id}`));
-		const auditEventId = requireAuthorizationValue(parseAuthorizationAuditEventId(`ecdsa-operation-audit:${operationId}`));
-		const outcome = await input.authorizedOperations.admitEcdsaWalletSessionOperation({
+		const admissionInput = {
 			operation: {
 				tenantId,
-				authorizedOperationId,
-				auditEventId,
+				authorizedOperationId: requireAuthorizationValue(parseAuthorizedOperationId(`ecdsa-authorized-operation:${operationId}:${input.request.request_id}`)),
+				auditEventId: requireAuthorizationValue(parseAuthorizationAuditEventId(`ecdsa-operation-audit:${operationId}`)),
 				operation: envelope,
 				authorization: {
 					kind: "authorization_grant",
@@ -284,12 +272,35 @@ async function admitRouterAbEcdsaReusableWalletSessionOperation(input) {
 				claimedAtMs: nowMs
 			},
 			material: {
+				readSnapshot: material.readSnapshot,
 				walletId,
-				keyHandle: freshMaterial.keyHandle,
-				runtimePolicyScope: freshMaterial.runtimePolicyScope,
-				materialActivation: freshMaterial.materialActivation
+				keyHandle: material.keyHandle,
+				runtimePolicyScope: material.runtimePolicyScope,
+				materialActivation: material.materialActivation
 			}
-		});
+		};
+		if (input.phase === "finalize") {
+			const resolved = await input.authorizedOperations.resolveEcdsaWalletSessionOperation(admissionInput);
+			if (resolved.kind === "authorized_operation_missing") return {
+				ok: false,
+				error: routerAbStepUpError(409, resolved.kind, "ECDSA finalize requires a claimed prepare operation")
+			};
+			const failure = routerAbReusableWalletSessionClaimFailure(resolved);
+			if (failure) return {
+				ok: false,
+				error: failure
+			};
+			if (resolved.kind === "operation_in_progress" || resolved.kind === "replayed") return {
+				ok: true,
+				phase: "finalize",
+				admission: resolved
+			};
+			return {
+				ok: false,
+				error: routerAbStepUpError(409, resolved.kind, "Authorized operation is unavailable")
+			};
+		}
+		const outcome = await input.authorizedOperations.admitEcdsaWalletSessionOperation(admissionInput);
 		const claimFailure = routerAbReusableWalletSessionClaimFailure(outcome);
 		if (claimFailure) return {
 			ok: false,
@@ -297,6 +308,7 @@ async function admitRouterAbEcdsaReusableWalletSessionOperation(input) {
 		};
 		if (outcome.kind === "claimed" || outcome.kind === "operation_in_progress" || outcome.kind === "replayed") return {
 			ok: true,
+			phase: "prepare",
 			admission: outcome
 		};
 		return {
@@ -342,6 +354,10 @@ async function authorizeRouterAbEcdsaWalletSessionRequest(input) {
 		result: validated.error
 	};
 	const activeMaterial = await input.resolveEcdsaMaterialActivation({
+		source: {
+			kind: "credential_snapshot",
+			materialRead: input.materialRead
+		},
 		walletId: String(input.session.walletId),
 		materialActivation: validated.admission.materialActivation
 	});
@@ -359,6 +375,10 @@ async function authorizeRouterAbEcdsaWalletSessionRequest(input) {
 		result: routerAbStepUpError(403, "wallet_session_scope_mismatch", "Wallet Session V2 scope does not match the active material")
 	};
 	const admissionDecision = await evaluateRouterAbNormalSigningAdmission({
+		policyReadSource: {
+			kind: "credential_snapshot",
+			policyRead: input.policyRead
+		},
 		adapter: input.admissionAdapter,
 		curve: "ecdsa",
 		authorizationKind: "wallet_session_operation_credential_v1",
@@ -393,29 +413,21 @@ async function authorizeRouterAbEcdsaWalletSessionRequest(input) {
 	};
 }
 async function resolveRouterAbEcdsaExhaustedCandidateAuthorization(input) {
-	const token = extractBearerCredential(input.headers);
-	if (!token) return null;
-	const exhausted = await readExhaustedWalletSessionCandidate({
-		authorizationSessions: input.authorizationSessions,
-		token,
-		operation: {
-			keyFamily: "ecdsa_secp256k1",
-			operationKind: "evm.sign_transaction"
-		}
+	const candidate = input.candidate;
+	const session = candidate.status.session;
+	const admission = walletSessionCandidateAdmission(session, candidate, {
+		keyFamily: "ecdsa_secp256k1",
+		operationKind: "evm.sign_transaction"
 	});
-	if (!exhausted) return null;
-	if (!exhausted.ok) return {
-		ok: false,
-		result: exhausted.error
-	};
-	const { candidate, session, admission } = exhausted;
 	if (!admission.ok || admission.keyFamily !== "ecdsa_secp256k1") return {
 		ok: false,
 		result: routerAbWalletSessionError(WALLET_SESSION_FAILURE_CODES.scopeMismatch)
 	};
 	const authorized = await authorizeRouterAbEcdsaWalletSessionRequest({
+		materialRead: input.materialRead,
+		policyRead: input.policyRead,
 		phase: input.phase,
-		body: input.body,
+		request: input.request,
 		session,
 		admittedMaterialActivation: routerAbMpcMaterialActivationRefToWire(admission.materialActivation),
 		admissionAdapter: input.admissionAdapter,
@@ -468,6 +480,7 @@ async function authenticateRouterAbEcdsaOperationStepUp(input) {
 	let resolvedMaterial;
 	try {
 		resolvedMaterial = await input.resolveEcdsaMaterialActivation({
+			source: { kind: "database" },
 			walletId: scope.wallet_id,
 			materialActivation: admittedMaterialActivation
 		});
@@ -575,6 +588,7 @@ async function handleRouterAbEcdsaOperationStepUpRoute(input) {
 	const materialActivationId = requireMpcMaterialActivationId(activeMaterial.materialActivation.activation_id);
 	if (!input.admissionAdapter) return routerAbStepUpError(501, "not_configured", "Router A/B ECDSA operation step-up admission is not configured");
 	const admission = await input.admissionAdapter.evaluatePolicy({
+		policyReadSource: { kind: "database" },
 		curve: "ecdsa",
 		phase: input.phase,
 		walletId: authenticated.session.walletId,
@@ -624,19 +638,19 @@ async function handleRouterAbEcdsaOperationStepUpRoute(input) {
 	};
 }
 async function authorizeRouterAbEcdsaDerivationNormalSigningRoute(input) {
-	let requestedAuthorizationKind;
+	let parsedRequest;
 	try {
-		requestedAuthorizationKind = parseRouterAbEcdsaOperationStepUpRequest({
+		parsedRequest = parseRouterAbEcdsaOperationStepUpRequest({
 			phase: input.phase,
 			body: input.body
-		}).authorization.kind;
+		});
 	} catch (error) {
 		return {
 			ok: false,
 			result: routerAbStepUpError(400, "invalid_body", routerAbErrorMessage(error))
 		};
 	}
-	if (requestedAuthorizationKind === "operation_step_up") {
+	if (parsedRequest.authorization.kind === "operation_step_up") {
 		const stepUp = await handleRouterAbEcdsaOperationStepUpRoute({
 			body: input.body,
 			headers: input.headers,
@@ -660,22 +674,12 @@ async function authorizeRouterAbEcdsaDerivationNormalSigningRoute(input) {
 		};
 	}
 	const validated = await validateRouterAbEcdsaDerivationWalletSessionInputs({
+		materialActivation: parsedRequest.material_activation,
 		headers: input.headers,
 		authorizationSessions: input.authorizationSessions,
 		operationKind: "evm.sign_transaction"
 	});
 	if (!validated.ok) {
-		if (validated.code === "wallet_session_unavailable" && input.authorizationSessions) {
-			const exhaustedCandidate = await resolveRouterAbEcdsaExhaustedCandidateAuthorization({
-				phase: input.phase,
-				body: input.body,
-				headers: input.headers,
-				authorizationSessions: input.authorizationSessions,
-				admissionAdapter: input.admissionAdapter,
-				resolveEcdsaMaterialActivation: input.resolveEcdsaMaterialActivation
-			});
-			if (exhaustedCandidate) return exhaustedCandidate;
-		}
 		const stepUp = await resolveRouterAbEcdsaOwnerOperationStepUpPreparation({
 			body: input.body,
 			phase: input.phase,
@@ -692,10 +696,21 @@ async function authorizeRouterAbEcdsaDerivationNormalSigningRoute(input) {
 			})
 		};
 	}
+	if (validated.kind === "wallet_session_operation_credential_exhausted_candidate_v1") return await resolveRouterAbEcdsaExhaustedCandidateAuthorization({
+		materialRead: validated.materialRead,
+		policyRead: validated.policyRead,
+		phase: input.phase,
+		request: parsedRequest,
+		candidate: validated.candidate,
+		admissionAdapter: input.admissionAdapter,
+		resolveEcdsaMaterialActivation: input.resolveEcdsaMaterialActivation
+	});
 	const session = validated.admission.context.authorization.session;
 	const authorized = await authorizeRouterAbEcdsaWalletSessionRequest({
+		materialRead: validated.materialRead,
+		policyRead: validated.policyRead,
 		phase: input.phase,
-		body: input.body,
+		request: parsedRequest,
 		session,
 		admittedMaterialActivation: routerAbMpcMaterialActivationRefToWire(validated.admission.admission.materialActivation),
 		admissionAdapter: input.admissionAdapter,
@@ -727,18 +742,13 @@ async function handleRouterAbEcdsaDerivationNormalSigningRouteCore(input) {
 		headers: input.headers
 	});
 	if (!input.authorizedOperations) return routerAbStepUpError(501, "not_configured", "Reusable Wallet Session authorization is not configured");
+	const request = parseRouterAbEcdsaOperationStepUpRequest(input);
 	const claimed = await admitRouterAbEcdsaReusableWalletSessionOperation({
-		request: parseRouterAbEcdsaOperationStepUpRequest(input),
-		materialActivation: authorization.admission.materialActivation,
-		binding: authorization.kind === "wallet_session_operation_credential_v1" ? {
-			kind: "wallet_session_operation_credential_v1",
-			context: authorization.validated.admission.context
-		} : {
-			kind: "wallet_session_operation_credential_exhausted_candidate_v1",
-			candidate: authorization.candidate
-		},
-		authorizedOperations: input.authorizedOperations,
-		resolveEcdsaMaterialActivation: input.resolveEcdsaMaterialActivation
+		phase: input.phase,
+		request,
+		material: authorization.activeMaterial,
+		binding: authorization,
+		authorizedOperations: input.authorizedOperations
 	});
 	if (!claimed.ok) return claimed.error;
 	if (claimed.admission.kind === "replayed") return routerAbEcdsaReplayResult(claimed.admission.operation);
@@ -746,7 +756,7 @@ async function handleRouterAbEcdsaDerivationNormalSigningRouteCore(input) {
 	if (!runtime) return routerAbEcdsaPrivateSigningWorkerUnavailableResult();
 	const signingWorker = runtime.getSigningWorkerPrivateTransport();
 	if (signingWorker.kind === "unconfigured") return routerAbEcdsaPrivateSigningWorkerUnavailableResult();
-	if (input.phase === "prepare") {
+	if (claimed.phase === "prepare") {
 		if (claimed.admission.kind === "operation_in_progress") return routerAbEcdsaOperationInProgressResult();
 		const operation = claimed.admission.operation;
 		const replay = await runtime.reservePrepareReplay({
@@ -801,7 +811,6 @@ async function handleRouterAbEcdsaDerivationNormalSigningRouteCore(input) {
 			body: forwarded.body
 		};
 	}
-	if (claimed.admission.kind === "claimed") return routerAbStepUpError(409, "authorized_operation_missing", "ECDSA finalize requires a claimed prepare operation");
 	const forwarded = await postRouterAbSigningWorkerJson({
 		config: signingWorker,
 		path: input.privatePath,

package/dist/esm/router/domains/signingOperations/routerAbNormalSigningAdmission.js

@@ -152,6 +152,7 @@ async function evaluateRouterAbNormalSigningAdmission(input) {
 	});
 	return await input.adapter.evaluatePolicy({
 		curve: "ecdsa",
+		policyReadSource: input.policyReadSource,
 		phase: input.phase,
 		walletId: input.walletId,
 		materialActivationId: requireMpcMaterialActivationId(input.admission.materialActivation.activation_id),

package/dist/esm/router/domains/signingOperations/routerAbOperationStepUp.js

@@ -230,6 +230,7 @@ async function authenticateRouterAbWalletOperationStepUpIdentity(input) {
 		if (admission.curve === "ecdsa" && input.keyFamily === "ecdsa_secp256k1") {
 			const active = ecdsaStepUpActiveMaterial({
 				activeMaterial: await input.resolveEcdsaMaterialActivation({
+					source: { kind: "database" },
 					walletId: input.walletId,
 					materialActivation: admittedMaterialActivation
 				}),

package/dist/esm/router/domains/signingOperations/walletExecutionAdmission.js

@@ -165,7 +165,7 @@ async function prepareOwnerWalletExecution(input) {
 	if (lane.walletKeyId !== input.evidence.walletKey.walletKeyId) return refused("wallet_key_mismatch");
 	if (!operationMatchesWalletKey(input.authorizedOperation, input.evidence.walletKey)) return refused("curve_mismatch");
 	if (String(claimedOperation.operation.capabilityId) !== String(input.evidence.materialActivation.capability)) return refused("capability_mismatch");
-	if (!sameMaterialActivation(input.evidence.materialActivation, input.evidence.expectedMaterialActivation)) return refused("material_activation_mismatch");
+	if (!mpcMaterialActivationRefsEqual(input.evidence.materialActivation, input.evidence.expectedMaterialActivation)) return refused("material_activation_mismatch");
 	if (lane.participantBindingDigestB64u !== input.evidence.verifiedLaneParticipantBindingDigestB64u || String(lane.ownerParticipantContinuity.signingWorkerId) !== String(input.evidence.materialActivation.signingWorker)) return refused("participant_binding_mismatch");
 	if (await computeOwnerLaneParticipantBindingDigestV1(lane.ownerParticipantContinuity) !== lane.participantBindingDigestB64u) return refused("participant_binding_mismatch");
 	if (lane.lifecycle.activationReceiptDigestB64u !== input.evidence.verifiedActivationReceiptDigestB64u) return refused("activation_receipt_mismatch");
@@ -213,9 +213,6 @@ function operationMatchesWalletKey(operation, walletKey) {
 		case "ecdsa_secp256k1": return operation.operation.operation.capabilityKind === CAPABILITY_KINDS.evmEcdsaMpcSigning;
 	}
 }
-function sameMaterialActivation(left, right) {
-	return left.activationId === right.activationId && left.capability === right.capability && left.materialOwner === right.materialOwner && left.keyBinding === right.keyBinding && left.lifecycleBinding === right.lifecycleBinding && left.signingWorker === right.signingWorker;
-}
 function refused(reason) {
 	return {
 		kind: "refused",

package/dist/esm/router/domains/tenantRoot/tenantRootIdentityResolution.js

@@ -1,5 +1,6 @@
 import { sameRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { signingRootScopeFromRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
+import { failure } from "../../../shared-ts/src/utils/failure.js";
 import { buildTenantRootIdentityFromAuthenticatedDeploymentV1, isTenantRootIdentityFieldCanonicalV1 } from "../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
 //#region src/router/domains/tenantRoot/tenantRootIdentityResolution.ts
 const FORBIDDEN_TENANT_ROOT_SELECTOR_FIELDS_V1 = [
@@ -59,20 +60,13 @@ function ecdsaStableMaterialRootBinding(activeMaterial) {
 function assertNeverServerResolvedMaterial(value) {
 	throw new Error(`Unsupported server-resolved tenant-root material: ${String(value)}`);
 }
-function mismatch(code, message) {
-	return {
-		ok: false,
-		code,
-		message
-	};
-}
 function findForbiddenTenantRootSelectorFieldV1(input) {
 	for (const field of FORBIDDEN_TENANT_ROOT_SELECTOR_FIELDS_V1) if (Object.prototype.hasOwnProperty.call(input, field)) return field;
 	return null;
 }
 function resolveTenantRootIdentityV1(input) {
 	const forbiddenSelector = findForbiddenTenantRootSelectorFieldV1(input);
-	if (forbiddenSelector) return mismatch("caller_selected_tenant_root", `Caller-supplied tenant-root selector field is forbidden: ${forbiddenSelector}`);
+	if (forbiddenSelector) return failure("caller_selected_tenant_root", `Caller-supplied tenant-root selector field is forbidden: ${forbiddenSelector}`);
 	let runtimePolicyScope;
 	let materialRootBinding;
 	switch (input.kind) {
@@ -86,12 +80,12 @@ function resolveTenantRootIdentityV1(input) {
 			break;
 		default: return assertNeverServerResolvedMaterial(input);
 	}
-	if (!materialRootBinding.materialActivationMatches) return mismatch("material_activation_mismatch", "B5 material activation does not match its established material identity");
+	if (!materialRootBinding.materialActivationMatches) return failure("material_activation_mismatch", "B5 material activation does not match its established material identity");
 	const nonCanonicalScopeField = findNonCanonicalRuntimePolicyScopeFieldV1(runtimePolicyScope);
-	if (nonCanonicalScopeField) return mismatch("non_canonical_tenant_root_field", `B5 runtime policy scope field is not canonical: ${nonCanonicalScopeField}`);
+	if (nonCanonicalScopeField) return failure("non_canonical_tenant_root_field", `B5 runtime policy scope field is not canonical: ${nonCanonicalScopeField}`);
 	const expectedSigningRoot = signingRootScopeFromRuntimePolicyScope(runtimePolicyScope);
-	if (materialRootBinding.signingRootId !== expectedSigningRoot.signingRootId) return mismatch("signing_root_id_mismatch", "B5 signing-root ID does not match authenticated deployment configuration");
-	if (materialRootBinding.signingRootVersion !== expectedSigningRoot.signingRootVersion) return mismatch("signing_root_version_mismatch", "B5 signing-root version does not match authenticated deployment configuration");
+	if (materialRootBinding.signingRootId !== expectedSigningRoot.signingRootId) return failure("signing_root_id_mismatch", "B5 signing-root ID does not match authenticated deployment configuration");
+	if (materialRootBinding.signingRootVersion !== expectedSigningRoot.signingRootVersion) return failure("signing_root_version_mismatch", "B5 signing-root version does not match authenticated deployment configuration");
 	const identity = buildTenantRootIdentityFromAuthenticatedDeploymentV1({
 		orgId: runtimePolicyScope.orgId,
 		projectId: runtimePolicyScope.projectId,
@@ -99,7 +93,7 @@ function resolveTenantRootIdentityV1(input) {
 		signingRootId: expectedSigningRoot.signingRootId,
 		signingRootVersion: expectedSigningRoot.signingRootVersion
 	});
-	if (!identity.ok) return mismatch("non_canonical_tenant_root_field", `Authenticated tenant-root identity field is not canonical: ${identity.error.kind === "invalid_field" ? identity.error.field : "identity"}`);
+	if (!identity.ok) return failure("non_canonical_tenant_root_field", `Authenticated tenant-root identity field is not canonical: ${identity.error.kind === "invalid_field" ? identity.error.field : "identity"}`);
 	return {
 		ok: true,
 		identity: identity.value