@seams/wallet-server 0.7.1 → 0.7.3

package/dist/esm/router/express.js

@@ -38,6 +38,15 @@ function normalizeLogger(logger) {
 //#region src/router/framework/logger.ts
 const coerceRouterLogger = normalizeLogger;
 //#endregion
+//#region ../shared-ts/src/utils/failure.ts
+function failure(code, message) {
+	return {
+		ok: false,
+		code,
+		message
+	};
+}
+//#endregion
 //#region src/core/SessionService.ts
 function normalizeParsedCorsOrigin(url) {
 	const host = url.hostname.toLowerCase();
@@ -984,6 +993,10 @@ function requireCanonicalBase64Url(value, label) {
 	if (base64UrlEncode(decoded) !== value) throw new Error(`${label} must be canonical base64url`);
 	return decoded;
 }
+function requireParsed$2(result, label) {
+	if (result.ok) return result.value;
+	throw new Error(`${label} ${result.error.message}`);
+}
 function parseDigestField$2(value, label) {
 	try {
 		return parseDigestB64u(value);
@@ -1204,11 +1217,11 @@ function parseLinkedDeviceEd25519ExportRootRecipientV1(raw) {
 	requireTransferAlg(record.transferAlg, "LinkedDeviceEd25519ExportRootRecipientV1.transferAlg");
 	return {
 		kind: "linked_device_ed25519_export_root_recipient_v1",
-		linkSessionId: parseRequired(parseLinkDeviceSessionId(record.linkSessionId), "LinkedDeviceEd25519ExportRootRecipientV1.linkSessionId"),
-		walletId: parseRequired(parseWalletId(record.walletId), "walletId"),
-		walletKeyId: parseRequired(parseWalletKeyId(record.walletKeyId), "walletKeyId"),
-		enrollmentId: parseRequired(parseLinkedDeviceEnrollmentId(record.enrollmentId), "enrollmentId"),
-		deviceId: parseRequired(parseLinkedDeviceId(record.deviceId), "deviceId"),
+		linkSessionId: requireParsed$2(parseLinkDeviceSessionId(record.linkSessionId), "LinkedDeviceEd25519ExportRootRecipientV1.linkSessionId"),
+		walletId: requireParsed$2(parseWalletId(record.walletId), "walletId"),
+		walletKeyId: requireParsed$2(parseWalletKeyId(record.walletKeyId), "walletKeyId"),
+		enrollmentId: requireParsed$2(parseLinkedDeviceEnrollmentId(record.enrollmentId), "enrollmentId"),
+		deviceId: requireParsed$2(parseLinkedDeviceId(record.deviceId), "deviceId"),
 		transferAlg: LINKED_DEVICE_ED25519_EXPORT_ROOT_TRANSFER_ALG_V1,
 		applicationBindingDigestB64u: parseDigestField$2(record.applicationBindingDigestB64u, "applicationBindingDigestB64u"),
 		registeredPublicKeyB64u: parseEd25519PublicKeyB64u(record.registeredPublicKeyB64u, "registeredPublicKeyB64u"),
@@ -1227,11 +1240,11 @@ function parseLinkedDeviceEd25519ExportRootPackageV1(raw) {
 	if (recipientPublicKeyB64u === ephemeralPublicKeyB64u) throw new Error("ephemeralPublicKeyB64u repeats the recipient key");
 	return {
 		kind: "linked_device_ed25519_export_root_package_v1",
-		linkSessionId: parseRequired(parseLinkDeviceSessionId(record.linkSessionId), "linkSessionId"),
-		walletId: parseRequired(parseWalletId(record.walletId), "walletId"),
-		walletKeyId: parseRequired(parseWalletKeyId(record.walletKeyId), "walletKeyId"),
-		enrollmentId: parseRequired(parseLinkedDeviceEnrollmentId(record.enrollmentId), "enrollmentId"),
-		deviceId: parseRequired(parseLinkedDeviceId(record.deviceId), "deviceId"),
+		linkSessionId: requireParsed$2(parseLinkDeviceSessionId(record.linkSessionId), "linkSessionId"),
+		walletId: requireParsed$2(parseWalletId(record.walletId), "walletId"),
+		walletKeyId: requireParsed$2(parseWalletKeyId(record.walletKeyId), "walletKeyId"),
+		enrollmentId: requireParsed$2(parseLinkedDeviceEnrollmentId(record.enrollmentId), "enrollmentId"),
+		deviceId: requireParsed$2(parseLinkedDeviceId(record.deviceId), "deviceId"),
 		transferAlg: LINKED_DEVICE_ED25519_EXPORT_ROOT_TRANSFER_ALG_V1,
 		applicationBindingDigestB64u: parseDigestField$2(record.applicationBindingDigestB64u, "applicationBindingDigestB64u"),
 		registeredPublicKeyB64u: parseEd25519PublicKeyB64u(record.registeredPublicKeyB64u, "registeredPublicKeyB64u"),
@@ -1251,7 +1264,7 @@ function parseLinkedDeviceEd25519ExportRootSubmissionV1(raw) {
 	if (record.kind !== "linked_device_ed25519_export_root_submission_v1") throw new Error("LinkedDeviceEd25519ExportRootSubmissionV1.kind is invalid");
 	return {
 		kind: "linked_device_ed25519_export_root_submission_v1",
-		linkSessionId: parseRequired(parseLinkDeviceSessionId(record.linkSessionId), "linkSessionId"),
+		linkSessionId: requireParsed$2(parseLinkDeviceSessionId(record.linkSessionId), "linkSessionId"),
 		package: parseLinkedDeviceEd25519ExportRootPackageV1(record.package)
 	};
 }
@@ -1279,10 +1292,6 @@ function parseUnixMs(value, label) {
 	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive unix-millisecond timestamp`);
 	return value;
 }
-function parseRequired(parsed, label) {
-	if (!parsed.ok) throw new Error(`${label} ${parsed.error.message}`);
-	return parsed.value;
-}
 //#endregion
 //#region ../shared-ts/src/device-linking/delegatedActivationPlan.ts
 const MANIFEST_FIELDS = [
@@ -1406,10 +1415,6 @@ function exactRecord$2(raw, fields, label) {
 	for (const field of fields) if (!(field in record)) throw new Error(`${label}.${field} is required`);
 	return record;
 }
-function requireParsed$2(parsed, label) {
-	if (!parsed.ok) throw new Error(`${label} ${parsed.error.message}`);
-	return parsed.value;
-}
 //#endregion
 //#region ../shared-ts/src/utils/addAuthMethodRegistration.ts
 /**
@@ -3874,7 +3879,7 @@ function parseLinkedDeviceEd25519SourcePreservingReservationV1(raw) {
 	const participantIds = parseRouterAbEd25519YaoParticipantIdsV1(record.participant_ids);
 	const deriverA = parseEd25519ClientPackage(record.deriver_a_client_package, "deriver_a");
 	const deriverB = parseEd25519ClientPackage(record.deriver_b_client_package, "deriver_b");
-	if (!sameBytes(activationReceipt.transcript, deriverA.transcript) || !sameBytes(activationReceipt.transcript, deriverB.transcript)) throw new Error("linked-device Ed25519 reservation packages have mismatched transcripts");
+	if (!sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, deriverA.transcript) || !sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, deriverB.transcript)) throw new Error("linked-device Ed25519 reservation packages have mismatched transcripts");
 	return {
 		state: "inactive",
 		reservationId: requireText(record.reservation_id, "reservation_id"),
@@ -4033,10 +4038,10 @@ function parseEd25519Contribution(record) {
 	if (!sameEdStableIdentity(sourceBinding, targetBinding)) throw new Error("linked-device Ed25519 source contribution stable identity differs");
 	if (!mpcMaterialActivationRefsEqual(routerAbMpcMaterialActivationRefFromWire(activationReceipt.material_activation), targetMaterialActivation)) throw new Error("linked-device Ed25519 source contribution receipt activation differs");
 	const sourceRegisteredPublicKeyB64u = parseEd25519PublicKeyB64u(record.sourceRegisteredPublicKeyB64u, "sourceRegisteredPublicKeyB64u");
-	if (!sameBytes(activationReceipt.registered_public_key, Array.from(base64UrlDecode(sourceRegisteredPublicKeyB64u)))) throw new Error("linked-device Ed25519 source contribution receipt public key differs");
+	if (!sameRouterAbEd25519YaoByteSequence(activationReceipt.registered_public_key, Array.from(base64UrlDecode(sourceRegisteredPublicKeyB64u)))) throw new Error("linked-device Ed25519 source contribution receipt public key differs");
 	const deriverA = parseEd25519ClientPackage(record.deriver_a_client_package, "deriver_a");
 	const deriverB = parseEd25519ClientPackage(record.deriver_b_client_package, "deriver_b");
-	if (!sameBytes(activationReceipt.transcript, deriverA.transcript) || !sameBytes(activationReceipt.transcript, deriverB.transcript)) throw new Error("linked-device Ed25519 source contribution package transcript differs");
+	if (!sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, deriverA.transcript) || !sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, deriverB.transcript)) throw new Error("linked-device Ed25519 source contribution package transcript differs");
 	if (sourceBinding.material_activation.activation_id === targetMaterialActivation.activationId) throw new Error("linked-device Ed25519 source contribution reuses the source activation");
 	return {
 		kind: "linked_device_ed25519_source_contribution_v1",
@@ -4316,9 +4321,6 @@ function parseFixedBase64(raw, byteLength, label) {
 	if (decoded.length !== byteLength || base64UrlEncode(decoded) !== raw) throw new Error(`${label} must decode to ${byteLength} bytes`);
 	return raw;
 }
-function sameBytes(left, right) {
-	return left.length === right.length && left.every((value, index) => value === right[index]);
-}
 function requireText(raw, label) {
 	if (typeof raw !== "string" || raw.length === 0 || raw.trim() !== raw || [...raw].some((character) => {
 		const code = character.charCodeAt(0);
@@ -5441,6 +5443,9 @@ function json$1(body, init, extraHeaders) {
 		headers
 	});
 }
+function jsonFailure(status, code, message) {
+	return json$1(failure(code, message), { status });
+}
 function withCors(headers, opts, request) {
 	const pathname = request ? new URL(request.url).pathname : "";
 	if (pathname === "/healthz" || pathname === "/readyz") {
@@ -5479,6 +5484,13 @@ async function readJson(request) {
 		return null;
 	}
 }
+function headersToRecord(headers) {
+	const out = {};
+	headers.forEach((v, k) => {
+		out[k] = v;
+	});
+	return out;
+}
 //#endregion
 //#region src/router/transport/fetch/routes/health.ts
 async function handleHealth(ctx) {
@@ -5611,6 +5623,12 @@ async function resolvePublishableKeyApiCredentialAuth(input) {
 	};
 }
 //#endregion
+//#region ../shared-ts/src/utils/thresholdEcdsaChainTarget.ts
+function thresholdEcdsaChainTargetKey(target) {
+	if (target.kind === "evm") return `evm:eip155:${target.chainId}`;
+	return `tempo:${target.chainId}`;
+}
+//#endregion
 //#region src/core/thresholdEcdsaChainTarget.ts
 function positiveSafeInteger(value) {
 	return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : null;
@@ -5671,11 +5689,7 @@ function walletSessionFailureStatus(code) {
 	}
 }
 function walletSessionFailure(code) {
-	return {
-		ok: false,
-		code,
-		message: walletSessionFailureMessage(code)
-	};
+	return failure(code, walletSessionFailureMessage(code));
 }
 //#endregion
 //#region ../shared-ts/src/signing-lanes/participants.ts
@@ -5771,10 +5785,6 @@ const OWNER_LANE_PARTICIPANT_CONTINUITY_FIELDS = [
 	"custodyKeyManifestDigestB64u",
 	"sourceIdentityDigestB64u"
 ];
-function requireResult(result, label) {
-	if (result.ok) return result.value;
-	throw new Error(`${label} ${result.error.message}`);
-}
 /** Parse the owner signer identity without widening it into a generic string. */
 function parseWalletSignerId(raw, label = "walletSignerId") {
 	if (typeof raw !== "string") throw new Error(`${label} must be a string`);
@@ -5800,7 +5810,7 @@ function buildOwnerLaneParticipantContinuityV1(args) {
 		kind: "owner_lane_participant_continuity_v1",
 		signerId: parseWalletSignerId(args.signerId),
 		participantIds,
-		signingWorkerId: requireResult(parseMpcSigningWorkerRef(args.signingWorkerId), "signingWorkerId"),
+		signingWorkerId: requireParsed$2(parseMpcSigningWorkerRef(args.signingWorkerId), "signingWorkerId"),
 		custodyKeyManifestDigestB64u: parseDigestField$2(args.custodyKeyManifestDigestB64u, "custodyKeyManifestDigestB64u"),
 		sourceIdentityDigestB64u: parseDigestField$2(args.sourceIdentityDigestB64u, "sourceIdentityDigestB64u")
 	};
@@ -5812,7 +5822,7 @@ function parseOwnerLaneParticipantContinuityV1(raw, label = "ownerParticipantCon
 	return buildOwnerLaneParticipantContinuityV1({
 		signerId: parseWalletSignerId(record.signerId, `${label}.signerId`),
 		participantIds: parseParticipantIds$1(record.participantIds, `${label}.participantIds`),
-		signingWorkerId: requireResult(parseMpcSigningWorkerRef(record.signingWorkerId), `${label}.signingWorkerId`),
+		signingWorkerId: requireParsed$2(parseMpcSigningWorkerRef(record.signingWorkerId), `${label}.signingWorkerId`),
 		custodyKeyManifestDigestB64u: parseDigestField$2(record.custodyKeyManifestDigestB64u, `${label}.custodyKeyManifestDigestB64u`),
 		sourceIdentityDigestB64u: parseDigestField$2(record.sourceIdentityDigestB64u, `${label}.sourceIdentityDigestB64u`)
 	});
@@ -5830,7 +5840,7 @@ function ownerLaneParticipantContinuityCanonicalBytesV1(input) {
 	]);
 }
 async function computeOwnerLaneParticipantBindingDigestV1(input) {
-	return requireResult(parseLaneParticipantBindingDigestB64u(base64UrlEncode(await sha256Bytes(ownerLaneParticipantContinuityCanonicalBytesV1(input)))), "owner participant digest");
+	return requireParsed$2(parseLaneParticipantBindingDigestB64u(base64UrlEncode(await sha256Bytes(ownerLaneParticipantContinuityCanonicalBytesV1(input)))), "owner participant digest");
 }
 new TextEncoder();
 //#endregion
@@ -6225,7 +6235,7 @@ async function prepareOwnerWalletExecution(input) {
 	if (lane.walletKeyId !== input.evidence.walletKey.walletKeyId) return refused("wallet_key_mismatch");
 	if (!operationMatchesWalletKey(input.authorizedOperation, input.evidence.walletKey)) return refused("curve_mismatch");
 	if (String(claimedOperation.operation.capabilityId) !== String(input.evidence.materialActivation.capability)) return refused("capability_mismatch");
-	if (!sameMaterialActivation(input.evidence.materialActivation, input.evidence.expectedMaterialActivation)) return refused("material_activation_mismatch");
+	if (!mpcMaterialActivationRefsEqual(input.evidence.materialActivation, input.evidence.expectedMaterialActivation)) return refused("material_activation_mismatch");
 	if (lane.participantBindingDigestB64u !== input.evidence.verifiedLaneParticipantBindingDigestB64u || String(lane.ownerParticipantContinuity.signingWorkerId) !== String(input.evidence.materialActivation.signingWorker)) return refused("participant_binding_mismatch");
 	if (await computeOwnerLaneParticipantBindingDigestV1(lane.ownerParticipantContinuity) !== lane.participantBindingDigestB64u) return refused("participant_binding_mismatch");
 	if (lane.lifecycle.activationReceiptDigestB64u !== input.evidence.verifiedActivationReceiptDigestB64u) return refused("activation_receipt_mismatch");
@@ -6273,9 +6283,6 @@ function operationMatchesWalletKey(operation, walletKey) {
 		case "ecdsa_secp256k1": return operation.operation.operation.capabilityKind === CAPABILITY_KINDS.evmEcdsaMpcSigning;
 	}
 }
-function sameMaterialActivation(left, right) {
-	return left.activationId === right.activationId && left.capability === right.capability && left.materialOwner === right.materialOwner && left.keyBinding === right.keyBinding && left.lifecycleBinding === right.lifecycleBinding && left.signingWorker === right.signingWorker;
-}
 function refused(reason) {
 	return {
 		kind: "refused",
@@ -6472,32 +6479,46 @@ async function validateRouterAbEcdsaDerivationWalletSessionInputs(input) {
 	const token = extractBearerCredential(input.headers);
 	if (!token) return walletSessionFailure("wallet_session_missing");
 	const nowMs = input.nowMs || Date.now;
-	let resolution;
+	let candidate;
 	try {
-		resolution = await resolveWalletSessionOperationCredentialAdmission({
-			authorizationSessions,
+		candidate = await authorizationSessions.readWalletSessionSigningCandidateByOperationCredential({
+			tenantId: authorizationSessions.tenantId,
 			token,
 			nowMs: nowMs(),
-			operation: {
-				keyFamily: "ecdsa_secp256k1",
-				operationKind: input.operationKind
-			}
+			materialActivation: input.materialActivation
 		});
 	} catch {
 		return walletSessionFailure("wallet_session_unavailable");
 	}
-	if (resolution.kind === "rejected") return walletSessionFailure("wallet_session_scope_mismatch");
-	if (resolution.kind === "not_found") return {
+	if (!candidate) return {
 		ok: false,
 		code: "wallet_session_invalid",
 		message: walletSessionFailureMessage("wallet_session_invalid")
 	};
+	if (candidate.kind === "exhausted") return {
+		ok: true,
+		kind: "wallet_session_operation_credential_exhausted_candidate_v1",
+		candidate: candidate.candidate,
+		materialRead: candidate.materialRead,
+		policyRead: candidate.policyRead
+	};
+	const resolution = resolveWalletSessionOperationCredentialAdmissionFromContext({
+		context: candidate.context,
+		nowMs: nowMs(),
+		operation: {
+			keyFamily: "ecdsa_secp256k1",
+			operationKind: input.operationKind
+		}
+	});
+	if (resolution.kind === "rejected") return walletSessionFailure("wallet_session_scope_mismatch");
 	if (resolution.admission.curve !== "ecdsa") return walletSessionFailure("wallet_session_scope_mismatch");
 	return {
 		ok: true,
 		kind: "wallet_session_operation_credential_v1",
 		admission: resolution.admission,
-		context: resolution.admission.context
+		context: resolution.admission.context,
+		materialRead: candidate.materialRead,
+		policyRead: candidate.policyRead
 	};
 }
 async function resolveThresholdRuntimePolicyScope(input) {
@@ -7217,9 +7238,6 @@ function parseWalletRegistrationSetupPolicy(value) {
 }
 //#endregion
 //#region ../shared-ts/src/utils/ecdsaKeyFactsInventory.ts
-function chainTargetKey(target) {
-	return target.kind === "evm" ? `evm:eip155:${target.chainId}` : `tempo:${target.chainId}`;
-}
 function normalizeChainTarget(target) {
 	if (target.kind === "evm") return {
 		kind: "evm",
@@ -7237,7 +7255,7 @@ function canonicalizeWalletEcdsaKeyFactsInventoryChallenge(input) {
 	const keyTargets = input.keyTargets.map((target) => ({
 		keyHandle: target.keyHandle,
 		chainTarget: normalizeChainTarget(target.chainTarget),
-		targetKey: chainTargetKey(target.chainTarget)
+		targetKey: thresholdEcdsaChainTargetKey(target.chainTarget)
 	})).sort((left, right) => {
 		const leftKey = `${left.keyHandle}:${left.targetKey}`;
 		const rightKey = `${right.keyHandle}:${right.targetKey}`;
@@ -7317,11 +7335,8 @@ function registrationSignerBranchKeyFromString(value) {
 function registrationNearEd25519BranchKey(signerSlot) {
 	return registrationSignerBranchKeyFromString(`near_ed25519:slot:${signerSlot}`);
 }
-function registrationEvmFamilyEcdsaTargetKey(target) {
-	return alphabetizeStringify(target);
-}
 function registrationEvmFamilyEcdsaBranchKey(chainTargets) {
-	return registrationSignerBranchKeyFromString(`evm_family_ecdsa:${chainTargets.map(registrationEvmFamilyEcdsaTargetKey).join("|")}`);
+	return registrationSignerBranchKeyFromString(`evm_family_ecdsa:${chainTargets.map(alphabetizeStringify).join("|")}`);
 }
 function registrationSignerPlanFromRequests(signers) {
 	return registrationSignerPlanFromBranches(signers.map(registrationSignerPlanBranchFromRequest));
@@ -7405,7 +7420,7 @@ function findDuplicateRegistrationSignerBranch(branch, branchKeys) {
 }
 function findDuplicateRegistrationEcdsaTarget(branch, ecdsaTargetKeys) {
 	for (const target of branch.chainTargets) {
-		const targetKey = registrationEvmFamilyEcdsaTargetKey(target);
+		const targetKey = alphabetizeStringify(target);
 		if (ecdsaTargetKeys.has(targetKey)) return {
 			ok: false,
 			code: "invalid_body",
@@ -7591,17 +7606,11 @@ function addAuthMethodIntentGrantFromString(value) {
 function addSignerIntentGrantFromString(value) {
 	return String(value || "").trim();
 }
-function serializeAddSignerIntentV1(intent) {
-	return alphabetizeStringify(intent);
-}
-function serializeAddAuthMethodIntentV1(intent) {
-	return alphabetizeStringify(intent);
-}
 async function computeAddSignerIntentDigestB64u(intent) {
-	return base64UrlEncode(await sha256BytesUtf8(serializeAddSignerIntentV1(intent)));
+	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(intent)));
 }
 async function computeAddAuthMethodIntentDigestB64u(intent) {
-	return base64UrlEncode(await sha256BytesUtf8(serializeAddAuthMethodIntentV1(intent)));
+	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(intent)));
 }
 function normalizeAddAuthMethodIntentCaller(raw) {
 	const record = inspectRawObject(raw);
@@ -10073,24 +10082,12 @@ function buildSigningSessionSealRemovePath(basePath) {
 }
 function parseSigningSessionSealApplyBody(body) {
 	const obj = asRecord(body);
-	if (!obj) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Request body must be a JSON object"
-	};
+	if (!obj) return failure("invalid_body", "Request body must be a JSON object");
 	const thresholdSessionId = readRequiredString(obj, "thresholdSessionId");
 	const ciphertext = readRequiredString(obj, "ciphertext");
-	if (!thresholdSessionId || !ciphertext) return {
-		ok: false,
-		code: "invalid_body",
-		message: "thresholdSessionId and ciphertext are required"
-	};
+	if (!thresholdSessionId || !ciphertext) return failure("invalid_body", "thresholdSessionId and ciphertext are required");
 	const parsedThresholdSessionId = parseThresholdSessionId(thresholdSessionId);
-	if (!parsedThresholdSessionId.ok) return {
-		ok: false,
-		code: "invalid_body",
-		message: "thresholdSessionId is invalid"
-	};
+	if (!parsedThresholdSessionId.ok) return failure("invalid_body", "thresholdSessionId is invalid");
 	return {
 		ok: true,
 		value: {
@@ -10113,11 +10110,7 @@ async function authorizeSigningSessionSealRequest(args) {
 			thresholdSessionId: args.thresholdSessionId
 		});
 	} catch (error) {
-		return {
-			ok: false,
-			code: "internal",
-			message: error instanceof Error ? error.message : String(error || "Authorization failed")
-		};
+		return failure("internal", error instanceof Error ? error.message : String(error || "Authorization failed"));
 	}
 	return {
 		ok: false,
@@ -10982,6 +10975,8 @@ function requireVerificationWindow(verifiedAtMs, expiresAtMs) {
 //#endregion
 //#region ../shared-ts/src/utils/emailOtpDomain.ts
 const EMAIL_OTP_CHANNEL = "email_otp";
+/** Domain label that opens the AAD binding a released Email OTP factor to its challenge. */
+const EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN_V1 = "seams/email-otp/factor-release/v1";
 const WALLET_UNLOCK_BACKENDS = ["passkey", EMAIL_OTP_CHANNEL];
 const WALLET_EMAIL_OTP_LOGIN_OPERATIONS = [
 	"wallet_unlock",
@@ -12559,11 +12554,7 @@ async function refreshEmailOtpWalletUnlockSessionState(input) {
 			ok: false,
 			response: {
 				status: 500,
-				body: {
-					ok: false,
-					code: "internal",
-					message: error instanceof Error ? error.message : "Email OTP authority refresh resolution failed"
-				}
+				body: failure("internal", error instanceof Error ? error.message : "Email OTP authority refresh resolution failed")
 			}
 		};
 	}
@@ -12571,11 +12562,7 @@ async function refreshEmailOtpWalletUnlockSessionState(input) {
 		ok: false,
 		response: {
 			status: authorityResolution.code === "internal" ? 500 : 403,
-			body: {
-				ok: false,
-				code: authorityResolution.code,
-				message: authorityResolution.message
-			}
+			body: failure(authorityResolution.code, authorityResolution.message)
 		}
 	};
 	try {
@@ -12592,11 +12579,7 @@ async function refreshEmailOtpWalletUnlockSessionState(input) {
 			ok: false,
 			response: {
 				status: 500,
-				body: {
-					ok: false,
-					code: "internal",
-					message: error instanceof Error ? error.message : "Email OTP Wallet Session authority projection refresh failed"
-				}
+				body: failure("internal", error instanceof Error ? error.message : "Email OTP Wallet Session authority projection refresh failed")
 			}
 		};
 	}
@@ -12607,11 +12590,7 @@ function walletUnlockCustodyUnavailableResponse(lookup, factor) {
 		ok: false,
 		response: {
 			status: lookup.kind === "manifest_unavailable" ? 503 : lookup.kind === "conflict" ? 409 : lookup.kind === "missing" ? 404 : 409,
-			body: {
-				ok: false,
-				code: lookup.kind === "manifest_unavailable" ? "custody_manifest_unavailable" : "custody_envelope_unavailable",
-				message: `${factor} wallet custody is unavailable`
-			}
+			body: failure(lookup.kind === "manifest_unavailable" ? "custody_manifest_unavailable" : "custody_envelope_unavailable", `${factor} wallet custody is unavailable`)
 		}
 	};
 }
@@ -12626,11 +12605,7 @@ function projectEmailOtpCustody(verifiedUnlock, lookup) {
 		ok: false,
 		response: {
 			status: 500,
-			body: {
-				ok: false,
-				code: "custody_binding_mismatch",
-				message: "Email OTP wallet custody binding is invalid"
-			}
+			body: failure("custody_binding_mismatch", "Email OTP wallet custody binding is invalid")
 		}
 	};
 	return {
@@ -12660,11 +12635,7 @@ function projectPasskeyCustody(verifiedUnlock, resolution) {
 		ok: false,
 		response: {
 			status: 500,
-			body: {
-				ok: false,
-				code: "custody_binding_mismatch",
-				message: "Passkey wallet custody binding is invalid"
-			}
+			body: failure("custody_binding_mismatch", "Passkey wallet custody binding is invalid")
 		}
 	};
 	let ed25519 = { kind: "absent" };
@@ -12676,11 +12647,7 @@ function projectPasskeyCustody(verifiedUnlock, resolution) {
 			ok: false,
 			response: {
 				status: 500,
-				body: {
-					ok: false,
-					code: "custody_binding_mismatch",
-					message: "Passkey Ed25519 custody binding is invalid"
-				}
+				body: failure("custody_binding_mismatch", "Passkey Ed25519 custody binding is invalid")
 			}
 		};
 		ed25519 = {
@@ -12711,11 +12678,7 @@ async function provisionFirstEcdsaWalletSession(input) {
 				ok: false,
 				response: {
 					status: 403,
-					body: {
-						ok: false,
-						code: "scope_mismatch",
-						message: "Wallet unlock proof does not match the requested ECDSA wallet"
-					}
+					body: failure("scope_mismatch", "Wallet unlock proof does not match the requested ECDSA wallet")
 				}
 			};
 			const provisioned = await input.context.provisionWalletSession(input.authorization);
@@ -12723,11 +12686,7 @@ async function provisionFirstEcdsaWalletSession(input) {
 				ok: false,
 				response: {
 					status: provisioned.status,
-					body: {
-						ok: false,
-						code: provisioned.code,
-						message: provisioned.message
-					}
+					body: failure(provisioned.code, provisioned.message)
 				}
 			};
 			return {
@@ -12755,11 +12714,7 @@ function walletUnlockScopeMismatchResponse() {
 		ok: false,
 		response: {
 			status: 403,
-			body: {
-				ok: false,
-				code: "scope_mismatch",
-				message: "Email OTP unlock proof does not match the requested Ed25519 wallet"
-			}
+			body: failure("scope_mismatch", "Email OTP unlock proof does not match the requested Ed25519 wallet")
 		}
 	};
 }
@@ -12823,11 +12778,7 @@ function planWalletUnlockAuthorityEcdsaSession(input) {
 function walletUnlockDeviceLinkEcdsaSessionRejection() {
 	return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "ecdsaSessionPolicy is not supported for device-linked wallet unlock"
-		}
+		body: failure("invalid_body", "ecdsaSessionPolicy is not supported for device-linked wallet unlock")
 	};
 }
 function planWalletUnlockPasskeySession(input) {
@@ -12870,11 +12821,7 @@ async function provisionPasskeyEd25519YaoSession(input) {
 		ok: false,
 		response: {
 			status: 409,
-			body: {
-				ok: false,
-				code: "capability_unavailable",
-				message: "Requested Ed25519 Wallet Session is unavailable"
-			}
+			body: failure("capability_unavailable", "Requested Ed25519 Wallet Session is unavailable")
 		}
 	};
 	const provisioned = await input.context.provisionWalletSession({
@@ -12928,11 +12875,7 @@ function walletUnlockEcdsaOperationCredential(input) {
 function walletUnlockEcdsaCredentialUnavailableResponse() {
 	return {
 		status: 409,
-		body: {
-			ok: false,
-			code: "capability_unavailable",
-			message: "ECDSA activation requires the exact Wallet Session operation credential"
-		}
+		body: failure("capability_unavailable", "ECDSA activation requires the exact Wallet Session operation credential")
 	};
 }
 /** The unlock response's Wallet Session, when the unlock holds one. */
@@ -12968,11 +12911,7 @@ function parseWalletUnlockRouteBody(body) {
 		ok: false,
 		response: {
 			status: 400,
-			body: {
-				ok: false,
-				code: "invalid_body",
-				message: "Request body is required"
-			}
+			body: failure("invalid_body", "Request body is required")
 		}
 	};
 	const record = body;
@@ -12981,11 +12920,7 @@ function parseWalletUnlockRouteBody(body) {
 		ok: false,
 		response: {
 			status: 400,
-			body: {
-				ok: false,
-				code: "invalid_body",
-				message: "unlockBackend is required"
-			}
+			body: failure("invalid_body", "unlockBackend is required")
 		}
 	};
 	return {
@@ -13002,11 +12937,7 @@ async function handleWalletUnlockChallengeRoute(input) {
 		const walletAuthMethodId = parseRequiredWalletAuthMethodId(body.walletAuthMethodId);
 		if (!walletAuthMethodId.ok) return {
 			status: 400,
-			body: {
-				ok: false,
-				code: "invalid_body",
-				message: walletAuthMethodId.message
-			}
+			body: failure("invalid_body", walletAuthMethodId.message)
 		};
 	}
 	const result = unlockBackend === "passkey" ? await input.service.createWebAuthnLoginOptions({
@@ -13189,20 +13120,12 @@ async function handleWalletUnlockVerifyRoute(input) {
 	const challengeId = String(body.challengeId || "").trim();
 	if (!challengeId) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "challengeId is required"
-		}
+		body: failure("invalid_body", "challengeId is required")
 	};
 	if (unlockBackend === "passkey") {
 		if (input.capabilityContext.kind !== "passkey_unlock") return {
 			status: 400,
-			body: {
-				ok: false,
-				code: "invalid_body",
-				message: "Passkey unlock context is invalid"
-			}
+			body: failure("invalid_body", "Passkey unlock context is invalid")
 		};
 		let ed25519SessionRequest;
 		try {
@@ -13210,11 +13133,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 		} catch (error) {
 			return {
 				status: 400,
-				body: {
-					ok: false,
-					code: "invalid_body",
-					message: error instanceof Error ? error.message : "Ed25519 session request is invalid"
-				}
+				body: failure("invalid_body", error instanceof Error ? error.message : "Ed25519 session request is invalid")
 			};
 		}
 		const result = await verifyPasskeyWalletUnlock({
@@ -13233,11 +13152,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 		const userId = String(result.userId || "").trim();
 		if (!userId) return {
 			status: 500,
-			body: {
-				ok: false,
-				code: "internal",
-				message: "Verified passkey user is missing"
-			}
+			body: failure("internal", "Verified passkey user is missing")
 		};
 		const walletId = parseWalletId(userId);
 		const walletAuthMethodId = parseWalletAuthMethodId(result.walletAuthMethodId);
@@ -13246,11 +13161,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 		const credentialIdB64u = parseWebAuthnCredentialIdB64u(result.credentialIdB64u);
 		if (!walletId.ok || !walletAuthMethodId.ok || !walletAuthorityId.ok || !rpId.ok || !credentialIdB64u.ok) return {
 			status: 500,
-			body: {
-				ok: false,
-				code: "internal",
-				message: "Verified passkey identity is invalid"
-			}
+			body: failure("internal", "Verified passkey identity is invalid")
 		};
 		let authorization;
 		try {
@@ -13268,11 +13179,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 		} catch (error) {
 			return {
 				status: 403,
-				body: {
-					ok: false,
-					code: "owner_proof_rejected",
-					message: error instanceof Error ? error.message : "Passkey owner proof is invalid"
-				}
+				body: failure("owner_proof_rejected", error instanceof Error ? error.message : "Passkey owner proof is invalid")
 			};
 		}
 		const resolvePasskeyAuthority = () => input.service.resolveActivePasskeyAuthorityForUnlock({
@@ -13290,11 +13197,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 		} catch (error) {
 			return {
 				status: 500,
-				body: {
-					ok: false,
-					code: "internal",
-					message: error instanceof Error ? error.message : "Passkey authority resolution failed"
-				}
+				body: failure("internal", error instanceof Error ? error.message : "Passkey authority resolution failed")
 			};
 		}
 		if (authorityResolution.kind === "active_authority") {
@@ -13311,11 +13214,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 		switch (sessionPlan.kind) {
 			case "rejected": return {
 				status: walletUnlockIssuanceRejectionStatus(sessionPlan.authorityResolution),
-				body: {
-					ok: false,
-					code: sessionPlan.authorityResolution.code,
-					message: sessionPlan.authorityResolution.message
-				}
+				body: failure(sessionPlan.authorityResolution.code, sessionPlan.authorityResolution.message)
 			};
 			case "wallet_registration":
 				passkeyCustodyRequired = true;
@@ -13337,11 +13236,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 				} catch (error) {
 					return {
 						status: 500,
-						body: {
-							ok: false,
-							code: "internal",
-							message: error instanceof Error ? error.message : "Passkey Wallet Session issuance failed"
-						}
+						body: failure("internal", error instanceof Error ? error.message : "Passkey Wallet Session issuance failed")
 					};
 				}
 				switch (sessionResolution.kind) {
@@ -13362,11 +13257,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 						break;
 					case "rejected": return {
 						status: walletUnlockIssuanceRejectionStatus(sessionResolution),
-						body: {
-							ok: false,
-							code: sessionResolution.code,
-							message: sessionResolution.message
-						}
+						body: failure(sessionResolution.code, sessionResolution.message)
 					};
 				}
 				break;
@@ -13385,11 +13276,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 		} catch (error) {
 			return {
 				status: 503,
-				body: {
-					ok: false,
-					code: "custody_unavailable",
-					message: error instanceof Error ? error.message : "Passkey wallet custody is unavailable"
-				}
+				body: failure("custody_unavailable", error instanceof Error ? error.message : "Passkey wallet custody is unavailable")
 			};
 		}
 		const ed25519Session = await provisionPasskeyEd25519YaoSession({
@@ -13431,20 +13318,12 @@ async function handleWalletUnlockVerifyRoute(input) {
 			} catch (error) {
 				return {
 					status: 500,
-					body: {
-						ok: false,
-						code: "internal",
-						message: error instanceof Error ? error.message : "Passkey authority refresh resolution failed"
-					}
+					body: failure("internal", error instanceof Error ? error.message : "Passkey authority refresh resolution failed")
 				};
 			}
 			if (refreshedAuthority.kind === "rejected") return {
 				status: walletUnlockIssuanceRejectionStatus(refreshedAuthority),
-				body: {
-					ok: false,
-					code: refreshedAuthority.code,
-					message: refreshedAuthority.message
-				}
+				body: failure(refreshedAuthority.code, refreshedAuthority.message)
 			};
 			try {
 				walletSessionState = await refreshWalletUnlockSessionState({
@@ -13455,11 +13334,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 			} catch (error) {
 				return {
 					status: 500,
-					body: {
-						ok: false,
-						code: "internal",
-						message: error instanceof Error ? error.message : "Passkey Wallet Session authority projection refresh failed"
-					}
+					body: failure("internal", error instanceof Error ? error.message : "Passkey Wallet Session authority projection refresh failed")
 				};
 			}
 		}
@@ -13488,20 +13363,12 @@ async function handleWalletUnlockVerifyRoute(input) {
 	}
 	if (input.capabilityContext.kind === "passkey_unlock") return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "Email OTP unlock context is invalid"
-		}
+		body: failure("invalid_body", "Email OTP unlock context is invalid")
 	};
 	const requestedWalletAuthMethodId = parseRequiredWalletAuthMethodId(body.walletAuthMethodId);
 	if (!requestedWalletAuthMethodId.ok) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: requestedWalletAuthMethodId.message
-		}
+		body: failure("invalid_body", requestedWalletAuthMethodId.message)
 	};
 	const result = await input.service.verifyEmailOtpUnlockProof({
 		walletId: body.walletId,
@@ -13528,11 +13395,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 	const walletId = parseWalletId(result.walletId);
 	if (!walletId.ok) return {
 		status: 500,
-		body: {
-			ok: false,
-			code: "internal",
-			message: "Verified Email OTP wallet identity is invalid"
-		}
+		body: failure("internal", "Verified Email OTP wallet identity is invalid")
 	};
 	let authorityResolution;
 	try {
@@ -13545,20 +13408,12 @@ async function handleWalletUnlockVerifyRoute(input) {
 	} catch (error) {
 		return {
 			status: 500,
-			body: {
-				ok: false,
-				code: "internal",
-				message: error instanceof Error ? error.message : "Email OTP authority resolution failed"
-			}
+			body: failure("internal", error instanceof Error ? error.message : "Email OTP authority resolution failed")
 		};
 	}
 	if (authorityResolution.kind === "rejected") return {
 		status: authorityResolution.code === "internal" ? 500 : 403,
-		body: {
-			ok: false,
-			code: authorityResolution.code,
-			message: authorityResolution.message
-		}
+		body: failure(authorityResolution.code, authorityResolution.message)
 	};
 	const exactEmailOtpAuthority = authorityResolution;
 	if (planWalletUnlockAuthorityEcdsaSession({
@@ -13592,11 +13447,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 	} catch (error) {
 		return {
 			status: 403,
-			body: {
-				ok: false,
-				code: "owner_proof_rejected",
-				message: error instanceof Error ? error.message : "Email OTP owner proof is invalid"
-			}
+			body: failure("owner_proof_rejected", error instanceof Error ? error.message : "Email OTP owner proof is invalid")
 		};
 	}
 	let walletSessionState = { kind: "absent" };
@@ -13604,11 +13455,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 		const walletId = parseWalletId(result.walletId);
 		if (!walletId.ok) return {
 			status: 500,
-			body: {
-				ok: false,
-				code: "internal",
-				message: "Verified Email OTP wallet identity is invalid"
-			}
+			body: failure("internal", "Verified Email OTP wallet identity is invalid")
 		};
 		let sessionResolution;
 		try {
@@ -13623,11 +13470,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 		} catch (error) {
 			return {
 				status: 500,
-				body: {
-					ok: false,
-					code: "internal",
-					message: error instanceof Error ? error.message : "Email OTP Wallet Session issuance failed"
-				}
+				body: failure("internal", error instanceof Error ? error.message : "Email OTP Wallet Session issuance failed")
 			};
 		}
 		switch (sessionResolution.kind) {
@@ -13645,11 +13488,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 			case "wallet_registration": break;
 			case "rejected": return {
 				status: walletUnlockIssuanceRejectionStatus(sessionResolution),
-				body: {
-					ok: false,
-					code: sessionResolution.code,
-					message: sessionResolution.message
-				}
+				body: failure(sessionResolution.code, sessionResolution.message)
 			};
 		}
 	}
@@ -13699,11 +13538,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 	});
 	if (!isWalletUnlockEd25519YaoRequestedContext(input.capabilityContext)) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "Email OTP capability context is invalid"
-		}
+		body: failure("invalid_body", "Email OTP capability context is invalid")
 	};
 	const capabilityResult = await provisionEmailOtpEd25519YaoCapability({
 		context: input.capabilityContext,
@@ -13742,7 +13577,6 @@ const ECDSA_TIMING_METRICS = new Set([
 	"ecdsa_sign_proxy",
 	"ecdsa_sign_complete",
 	"ecdsa_sign_total",
-	"ecdsa_presign_queue",
 	"ecdsa_presign_authenticate",
 	"ecdsa_presign_material",
 	"ecdsa_presign_admit",
@@ -13831,6 +13665,7 @@ async function evaluateRouterAbNormalSigningAdmission(input) {
 	});
 	return await input.adapter.evaluatePolicy({
 		curve: "ecdsa",
+		policyReadSource: input.policyReadSource,
 		phase: input.phase,
 		walletId: input.walletId,
 		materialActivationId: requireMpcMaterialActivationId(input.admission.materialActivation.activation_id),
@@ -14104,6 +13939,7 @@ async function authenticateRouterAbWalletOperationStepUpIdentity(input) {
 		if (admission.curve === "ecdsa" && input.keyFamily === "ecdsa_secp256k1") {
 			const active = ecdsaStepUpActiveMaterial({
 				activeMaterial: await input.resolveEcdsaMaterialActivation({
+					source: { kind: "database" },
 					walletId: input.walletId,
 					materialActivation: admittedMaterialActivation
 				}),
@@ -14663,6 +14499,7 @@ async function resolveRouterAbEcdsaOwnerOperationStepUpPreparation(input) {
 		const walletId = parseWalletId(request.scope.wallet_id);
 		if (!walletId.ok) return void 0;
 		const activeMaterial = await input.resolveEcdsaMaterialActivation({
+			source: { kind: "database" },
 			walletId: walletId.value,
 			materialActivation: request.material_activation
 		});
@@ -14763,6 +14600,7 @@ function routerAbWalletSessionError(code) {
 */
 async function resolveFreshRouterAbEcdsaMaterialActivation(input) {
 	const resolved = await input.resolveEcdsaMaterialActivation({
+		source: { kind: "database" },
 		walletId: input.walletId,
 		materialActivation: input.expected
 	});
@@ -14782,15 +14620,7 @@ async function resolveFreshRouterAbEcdsaMaterialActivation(input) {
 	};
 }
 function validateRouterAbEcdsaV2NormalSigningRequestForSession(input) {
-	let request;
-	try {
-		request = parseRouterAbEcdsaOperationStepUpRequest(input);
-	} catch (error) {
-		return {
-			ok: false,
-			error: routerAbStepUpError(400, "invalid_body", routerAbErrorMessage(error))
-		};
-	}
+	const request = input.request;
 	if (request.authorization.kind !== "reusable_wallet_session" || request.authorization.wallet_session_id !== input.session.walletSessionId || request.scope.wallet_id !== String(input.session.walletId) || request.material_activation.material_owner !== String(input.session.walletId) || request.material_activation.signing_worker !== request.scope.signing_worker.server_id || !sameRouterAbMpcMaterialActivationRef(request.material_activation, request.scope.material_activation) || !sameRouterAbMpcMaterialActivationRef(request.material_activation, input.admittedMaterialActivation)) return {
 		ok: false,
 		error: routerAbWalletSessionError(WALLET_SESSION_FAILURE_CODES.scopeMismatch)
@@ -14819,7 +14649,7 @@ function validateRouterAbEcdsaV2NormalSigningRequestForSession(input) {
 	};
 }
 async function admitRouterAbEcdsaReusableWalletSessionOperation(input) {
-	if (typeof input.authorizedOperations.admitEcdsaWalletSessionOperation !== "function") return {
+	if (typeof input.authorizedOperations.admitEcdsaWalletSessionOperation !== "function" || typeof input.authorizedOperations.resolveEcdsaWalletSessionOperation !== "function") return {
 		ok: false,
 		error: routerAbStepUpError(501, "not_configured", "ECDSA atomic authorization is not configured")
 	};
@@ -14829,7 +14659,7 @@ async function admitRouterAbEcdsaReusableWalletSessionOperation(input) {
 	};
 	const nowMs = Date.now();
 	try {
-		const session = input.binding.kind === "wallet_session_operation_credential_v1" ? input.binding.context.authorization.session : input.binding.candidate.status.session;
+		const session = input.binding.kind === "wallet_session_operation_credential_v1" ? input.binding.validated.admission.context.authorization.session : input.binding.candidate.status.session;
 		const tenantId = session.tenantId;
 		const principalId = session.principalId;
 		const walletId = session.walletId;
@@ -14840,16 +14670,12 @@ async function admitRouterAbEcdsaReusableWalletSessionOperation(input) {
 			ok: false,
 			error: routerAbStepUpError(403, "wallet_session_mismatch", "Reusable Wallet Session identity does not match")
 		};
-		const freshMaterial = await resolveFreshRouterAbEcdsaMaterialActivation({
-			resolveEcdsaMaterialActivation: input.resolveEcdsaMaterialActivation,
-			walletId: String(walletId),
-			expected: input.materialActivation
-		});
-		if (!freshMaterial.ok) return {
+		const material = input.material;
+		if (!sameRouterAbMpcMaterialActivationRef(material.materialActivation, input.request.material_activation)) return {
 			ok: false,
-			error: routerAbStepUpError(freshMaterial.code === "internal" ? 500 : 403, freshMaterial.code === "internal" ? "internal" : "wallet_session_mismatch", freshMaterial.message)
+			error: routerAbStepUpError(403, "material_mismatch", "Signing material does not match the request")
 		};
-		const capabilityId = requireAuthorizationValue$2(parseCapabilityId(freshMaterial.materialActivation.capability));
+		const capabilityId = requireAuthorizationValue$2(parseCapabilityId(material.materialActivation.capability));
 		const operationId = requireAuthorizationValue$2(parseCapabilityOperationId(input.request.operation_id));
 		const envelope = buildCapabilityOperationEnvelope({
 			tenantId,
@@ -14863,13 +14689,11 @@ async function admitRouterAbEcdsaReusableWalletSessionOperation(input) {
 				displayDigest: parseDigestB64u(input.request.operation_digests.display_digest_b64u)
 			}
 		});
-		const authorizedOperationId = requireAuthorizationValue$2(parseAuthorizedOperationId(`ecdsa-authorized-operation:${operationId}:${input.request.request_id}`));
-		const auditEventId = requireAuthorizationValue$2(parseAuthorizationAuditEventId(`ecdsa-operation-audit:${operationId}`));
-		const outcome = await input.authorizedOperations.admitEcdsaWalletSessionOperation({
+		const admissionInput = {
 			operation: {
 				tenantId,
-				authorizedOperationId,
-				auditEventId,
+				authorizedOperationId: requireAuthorizationValue$2(parseAuthorizedOperationId(`ecdsa-authorized-operation:${operationId}:${input.request.request_id}`)),
+				auditEventId: requireAuthorizationValue$2(parseAuthorizationAuditEventId(`ecdsa-operation-audit:${operationId}`)),
 				operation: envelope,
 				authorization: {
 					kind: "authorization_grant",
@@ -14882,12 +14706,35 @@ async function admitRouterAbEcdsaReusableWalletSessionOperation(input) {
 				claimedAtMs: nowMs
 			},
 			material: {
+				readSnapshot: material.readSnapshot,
 				walletId,
-				keyHandle: freshMaterial.keyHandle,
-				runtimePolicyScope: freshMaterial.runtimePolicyScope,
-				materialActivation: freshMaterial.materialActivation
+				keyHandle: material.keyHandle,
+				runtimePolicyScope: material.runtimePolicyScope,
+				materialActivation: material.materialActivation
 			}
-		});
+		};
+		if (input.phase === "finalize") {
+			const resolved = await input.authorizedOperations.resolveEcdsaWalletSessionOperation(admissionInput);
+			if (resolved.kind === "authorized_operation_missing") return {
+				ok: false,
+				error: routerAbStepUpError(409, resolved.kind, "ECDSA finalize requires a claimed prepare operation")
+			};
+			const failure = routerAbReusableWalletSessionClaimFailure(resolved);
+			if (failure) return {
+				ok: false,
+				error: failure
+			};
+			if (resolved.kind === "operation_in_progress" || resolved.kind === "replayed") return {
+				ok: true,
+				phase: "finalize",
+				admission: resolved
+			};
+			return {
+				ok: false,
+				error: routerAbStepUpError(409, resolved.kind, "Authorized operation is unavailable")
+			};
+		}
+		const outcome = await input.authorizedOperations.admitEcdsaWalletSessionOperation(admissionInput);
 		const claimFailure = routerAbReusableWalletSessionClaimFailure(outcome);
 		if (claimFailure) return {
 			ok: false,
@@ -14895,6 +14742,7 @@ async function admitRouterAbEcdsaReusableWalletSessionOperation(input) {
 		};
 		if (outcome.kind === "claimed" || outcome.kind === "operation_in_progress" || outcome.kind === "replayed") return {
 			ok: true,
+			phase: "prepare",
 			admission: outcome
 		};
 		return {
@@ -14940,6 +14788,10 @@ async function authorizeRouterAbEcdsaWalletSessionRequest(input) {
 		result: validated.error
 	};
 	const activeMaterial = await input.resolveEcdsaMaterialActivation({
+		source: {
+			kind: "credential_snapshot",
+			materialRead: input.materialRead
+		},
 		walletId: String(input.session.walletId),
 		materialActivation: validated.admission.materialActivation
 	});
@@ -14957,6 +14809,10 @@ async function authorizeRouterAbEcdsaWalletSessionRequest(input) {
 		result: routerAbStepUpError(403, "wallet_session_scope_mismatch", "Wallet Session V2 scope does not match the active material")
 	};
 	const admissionDecision = await evaluateRouterAbNormalSigningAdmission({
+		policyReadSource: {
+			kind: "credential_snapshot",
+			policyRead: input.policyRead
+		},
 		adapter: input.admissionAdapter,
 		curve: "ecdsa",
 		authorizationKind: "wallet_session_operation_credential_v1",
@@ -14991,29 +14847,21 @@ async function authorizeRouterAbEcdsaWalletSessionRequest(input) {
 	};
 }
 async function resolveRouterAbEcdsaExhaustedCandidateAuthorization(input) {
-	const token = extractBearerCredential(input.headers);
-	if (!token) return null;
-	const exhausted = await readExhaustedWalletSessionCandidate({
-		authorizationSessions: input.authorizationSessions,
-		token,
-		operation: {
-			keyFamily: "ecdsa_secp256k1",
-			operationKind: "evm.sign_transaction"
-		}
+	const candidate = input.candidate;
+	const session = candidate.status.session;
+	const admission = walletSessionCandidateAdmission(session, candidate, {
+		keyFamily: "ecdsa_secp256k1",
+		operationKind: "evm.sign_transaction"
 	});
-	if (!exhausted) return null;
-	if (!exhausted.ok) return {
-		ok: false,
-		result: exhausted.error
-	};
-	const { candidate, session, admission } = exhausted;
 	if (!admission.ok || admission.keyFamily !== "ecdsa_secp256k1") return {
 		ok: false,
 		result: routerAbWalletSessionError(WALLET_SESSION_FAILURE_CODES.scopeMismatch)
 	};
 	const authorized = await authorizeRouterAbEcdsaWalletSessionRequest({
+		materialRead: input.materialRead,
+		policyRead: input.policyRead,
 		phase: input.phase,
-		body: input.body,
+		request: input.request,
 		session,
 		admittedMaterialActivation: routerAbMpcMaterialActivationRefToWire(admission.materialActivation),
 		admissionAdapter: input.admissionAdapter,
@@ -15066,6 +14914,7 @@ async function authenticateRouterAbEcdsaOperationStepUp(input) {
 	let resolvedMaterial;
 	try {
 		resolvedMaterial = await input.resolveEcdsaMaterialActivation({
+			source: { kind: "database" },
 			walletId: scope.wallet_id,
 			materialActivation: admittedMaterialActivation
 		});
@@ -15173,6 +15022,7 @@ async function handleRouterAbEcdsaOperationStepUpRoute(input) {
 	const materialActivationId = requireMpcMaterialActivationId(activeMaterial.materialActivation.activation_id);
 	if (!input.admissionAdapter) return routerAbStepUpError(501, "not_configured", "Router A/B ECDSA operation step-up admission is not configured");
 	const admission = await input.admissionAdapter.evaluatePolicy({
+		policyReadSource: { kind: "database" },
 		curve: "ecdsa",
 		phase: input.phase,
 		walletId: authenticated.session.walletId,
@@ -15222,19 +15072,19 @@ async function handleRouterAbEcdsaOperationStepUpRoute(input) {
 	};
 }
 async function authorizeRouterAbEcdsaDerivationNormalSigningRoute(input) {
-	let requestedAuthorizationKind;
+	let parsedRequest;
 	try {
-		requestedAuthorizationKind = parseRouterAbEcdsaOperationStepUpRequest({
+		parsedRequest = parseRouterAbEcdsaOperationStepUpRequest({
 			phase: input.phase,
 			body: input.body
-		}).authorization.kind;
+		});
 	} catch (error) {
 		return {
 			ok: false,
 			result: routerAbStepUpError(400, "invalid_body", routerAbErrorMessage(error))
 		};
 	}
-	if (requestedAuthorizationKind === "operation_step_up") {
+	if (parsedRequest.authorization.kind === "operation_step_up") {
 		const stepUp = await handleRouterAbEcdsaOperationStepUpRoute({
 			body: input.body,
 			headers: input.headers,
@@ -15258,22 +15108,12 @@ async function authorizeRouterAbEcdsaDerivationNormalSigningRoute(input) {
 		};
 	}
 	const validated = await validateRouterAbEcdsaDerivationWalletSessionInputs({
+		materialActivation: parsedRequest.material_activation,
 		headers: input.headers,
 		authorizationSessions: input.authorizationSessions,
 		operationKind: "evm.sign_transaction"
 	});
 	if (!validated.ok) {
-		if (validated.code === "wallet_session_unavailable" && input.authorizationSessions) {
-			const exhaustedCandidate = await resolveRouterAbEcdsaExhaustedCandidateAuthorization({
-				phase: input.phase,
-				body: input.body,
-				headers: input.headers,
-				authorizationSessions: input.authorizationSessions,
-				admissionAdapter: input.admissionAdapter,
-				resolveEcdsaMaterialActivation: input.resolveEcdsaMaterialActivation
-			});
-			if (exhaustedCandidate) return exhaustedCandidate;
-		}
 		const stepUp = await resolveRouterAbEcdsaOwnerOperationStepUpPreparation({
 			body: input.body,
 			phase: input.phase,
@@ -15290,10 +15130,21 @@ async function authorizeRouterAbEcdsaDerivationNormalSigningRoute(input) {
 			})
 		};
 	}
+	if (validated.kind === "wallet_session_operation_credential_exhausted_candidate_v1") return await resolveRouterAbEcdsaExhaustedCandidateAuthorization({
+		materialRead: validated.materialRead,
+		policyRead: validated.policyRead,
+		phase: input.phase,
+		request: parsedRequest,
+		candidate: validated.candidate,
+		admissionAdapter: input.admissionAdapter,
+		resolveEcdsaMaterialActivation: input.resolveEcdsaMaterialActivation
+	});
 	const session = validated.admission.context.authorization.session;
 	const authorized = await authorizeRouterAbEcdsaWalletSessionRequest({
+		materialRead: validated.materialRead,
+		policyRead: validated.policyRead,
 		phase: input.phase,
-		body: input.body,
+		request: parsedRequest,
 		session,
 		admittedMaterialActivation: routerAbMpcMaterialActivationRefToWire(validated.admission.admission.materialActivation),
 		admissionAdapter: input.admissionAdapter,
@@ -15860,18 +15711,13 @@ async function executeRouterAbEcdsaDerivationNormalSigningRoute(input, timing) {
 			binding: await ecdsaOperationStepUpBinding(input.ctx, authorization.session, authorizedOperation)
 		});
 	} else {
+		const request = input.phase === "prepare" ? parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1(input.body) : parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1(input.body);
 		const operation = await admitRouterAbEcdsaReusableWalletSessionOperation({
-			request: input.phase === "prepare" ? parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1(input.body) : parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1(input.body),
-			materialActivation: authorization.admission.materialActivation,
-			binding: authorization.kind === "wallet_session_operation_credential_v1" ? {
-				kind: "wallet_session_operation_credential_v1",
-				context: authorization.validated.admission.context
-			} : {
-				kind: "wallet_session_operation_credential_exhausted_candidate_v1",
-				candidate: authorization.candidate
-			},
-			authorizedOperations: input.ctx.service.authorizedOperations,
-			resolveEcdsaMaterialActivation: input.ctx.service.walletRegistration.resolveEcdsaMaterialActivation.bind(input.ctx.service.walletRegistration)
+			phase: input.phase,
+			request,
+			material: authorization.activeMaterial,
+			binding: authorization,
+			authorizedOperations: input.ctx.service.authorizedOperations
 		});
 		if (!operation.ok) {
 			const failureBody = operation.error.body;
@@ -15897,11 +15743,6 @@ async function executeRouterAbEcdsaDerivationNormalSigningRoute(input, timing) {
 			return json$1(failure.body, { status: failure.status });
 		}
 		if (operation.admission.kind === "replayed") return routerAbEcdsaReplayResponse(operation.admission.operation);
-		if (operation.admission.kind === "claimed" && input.phase === "finalize") return json$1({
-			ok: false,
-			code: "authorized_operation_missing",
-			message: "ECDSA finalize requires a claimed prepare operation"
-		}, { status: 409 });
 		const ownerDecision = decideRouterAbEcdsaOwnerOperationAuthorization({ operation: operation.admission.operation });
 		switch (ownerDecision.kind) {
 			case "authorized": break;
@@ -16126,6 +15967,7 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 		message: v2Resolution.message
 	}, { status: 403 });
 	const activeMaterial = v2Resolution.kind === "admitted" ? v2Resolution.activeMaterial : await input.ctx.service.walletRegistration.resolveEcdsaMaterialActivation({
+		source: { kind: "database" },
 		walletId: operation.wallet_id,
 		materialActivation: operation.material_activation
 	});
@@ -16444,7 +16286,6 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 async function handleEcdsaPoolFillRoute(input) {
 	const startedAt = performance.now();
 	const timing = {
-		queue: null,
 		authenticate: null,
 		material: null,
 		admit: null,
@@ -16479,31 +16320,24 @@ async function executeEcdsaPoolFillRoute(input, timing, workerTimings) {
 	const parsed = input.phase === "init" ? parseRouterAbEcdsaDerivationPoolFillInitRouteRequest(input.body) : parseRouterAbEcdsaDerivationPoolFillStepRouteRequest(input.body);
 	if (!parsed.ok) return json$1(parsed.body, { status: thresholdEcdsaStatusCode(parsed.body) });
 	const request = parsed.request;
-	const queuedAt = performance.now();
-	const gateTicket = await presignPriorityGate.acquire(resolvePresignTrafficClass(request.requestTag));
-	timing.queue = performance.now() - queuedAt;
-	try {
-		const authorized = await authorizeEcdsaPoolFill({
-			ctx: input.ctx,
-			request,
-			timing
-		});
-		if (!authorized.ok) return json$1(authorized.error.body, { status: authorized.error.status });
-		const proxyStartedAt = performance.now();
-		const result = "poolFill" in request ? await runtime.initializePoolFill({
-			binding: authorized.binding,
-			request: ecdsaPoolFillInitRuntimeRequest(request),
-			onServerTiming: collectEcdsaPresignWorkerTiming.bind(void 0, workerTimings)
-		}) : await runtime.advancePoolFill({
-			binding: authorized.binding,
-			request: ecdsaPoolFillStepRuntimeRequest(request),
-			onServerTiming: collectEcdsaPresignWorkerTiming.bind(void 0, workerTimings)
-		});
-		timing.proxy = performance.now() - proxyStartedAt;
-		return json$1(result, { status: thresholdEcdsaStatusCode(result) });
-	} finally {
-		gateTicket.release();
-	}
+	const authorized = await authorizeEcdsaPoolFill({
+		ctx: input.ctx,
+		request,
+		timing
+	});
+	if (!authorized.ok) return json$1(authorized.error.body, { status: authorized.error.status });
+	const proxyStartedAt = performance.now();
+	const result = "poolFill" in request ? await runtime.initializePoolFill({
+		binding: authorized.binding,
+		request: ecdsaPoolFillInitRuntimeRequest(request),
+		onServerTiming: collectEcdsaPresignWorkerTiming.bind(void 0, workerTimings)
+	}) : await runtime.advancePoolFill({
+		binding: authorized.binding,
+		request: ecdsaPoolFillStepRuntimeRequest(request),
+		onServerTiming: collectEcdsaPresignWorkerTiming.bind(void 0, workerTimings)
+	});
+	timing.proxy = performance.now() - proxyStartedAt;
+	return json$1(result, { status: thresholdEcdsaStatusCode(result) });
 }
 function poolFillMaterialActivation(request) {
 	return "poolFill" in request ? request.poolFill.scope.material_activation : null;
@@ -16642,6 +16476,7 @@ async function authorizeEcdsaPoolFill(input) {
 			const admitted = validated;
 			const materialStartedAt = performance.now();
 			const activeMaterial = await input.ctx.service.walletRegistration.resolveEcdsaMaterialActivation({
+				source: { kind: "database" },
 				walletId: String(session.walletId),
 				materialActivation: routerAbMpcMaterialActivationRefToWire(admitted.materialActivation)
 			});
@@ -16730,43 +16565,6 @@ function ecdsaPoolFillStepRuntimeRequest(request) {
 		...request.requestTag === void 0 ? {} : { requestTag: request.requestTag }
 	};
 }
-function resolvePresignPriorityTurn(resolve) {
-	setTimeout(resolve, 5);
-}
-function waitForPresignPriorityTurn() {
-	return new Promise(resolvePresignPriorityTurn);
-}
-var PresignPriorityGate = class {
-	constructor() {
-		this.foregroundInFlight = 0;
-		this.backgroundInFlight = 0;
-	}
-	async acquire(trafficClass) {
-		if (trafficClass === "foreground") {
-			this.foregroundInFlight += 1;
-			return this.createTicket("foreground");
-		}
-		while (!this.canRunBackgroundNow()) await waitForPresignPriorityTurn();
-		this.backgroundInFlight += 1;
-		return this.createTicket("background");
-	}
-	createTicket(trafficClass) {
-		let released = false;
-		return { release: () => {
-			if (released) return;
-			released = true;
-			if (trafficClass === "foreground") this.foregroundInFlight = Math.max(0, this.foregroundInFlight - 1);
-			else this.backgroundInFlight = Math.max(0, this.backgroundInFlight - 1);
-		} };
-	}
-	canRunBackgroundNow() {
-		return this.foregroundInFlight === 0 && this.backgroundInFlight === 0;
-	}
-};
-function resolvePresignTrafficClass(requestTag) {
-	return requestTag === "background_presign_pool_refill" ? "background" : "foreground";
-}
-const presignPriorityGate = new PresignPriorityGate();
 function strictEcdsaAuthorizationFailureStatus(failure) {
 	switch (failure.code) {
 		case "unauthorized": return 401;
@@ -17149,6 +16947,7 @@ async function authorizeStrictEcdsaExport(input) {
 			scope: operation.normal_signing_scope
 		})) return strictEcdsaExportFailure(403, "scope_mismatch", "ECDSA export operation scope does not match the request");
 		const activeMaterial = await input.ctx.service.walletRegistration.resolveEcdsaMaterialActivation({
+			source: { kind: "database" },
 			walletId: operation.wallet_id,
 			materialActivation: input.request.material_activation
 		});
@@ -17453,7 +17252,6 @@ async function handleThresholdEcdsa(ctx) {
 }
 //#endregion
 //#region src/router/domains/emailOtp/emailOtpRouteHandlers.ts
-const EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN = "seams/email-otp/factor-release/v1";
 function decodeEmailOtpFactorSecret32(value) {
 	const magnitude = base64UrlDecode(value);
 	if (magnitude.length === 0 || magnitude.length > 32) {
@@ -17467,7 +17265,7 @@ function decodeEmailOtpFactorSecret32(value) {
 }
 function emailOtpFactorReleaseAad(input) {
 	return new TextEncoder().encode([
-		EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN,
+		EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN_V1,
 		input.walletId,
 		input.enrollmentId,
 		input.enrollmentSealKeyVersion,
@@ -17481,19 +17279,11 @@ async function sealEmailOtpFactorSecretForWorker(input) {
 		factorSecret32 = decodeEmailOtpFactorSecret32(input.factorSecret32B64u);
 		workerPublicKey65 = base64UrlDecode(input.workerEphemeralPublicKey65B64u);
 	} catch {
-		return {
-			ok: false,
-			code: "invalid_body",
-			message: "Email OTP factor release key is invalid"
-		};
+		return failure("invalid_body", "Email OTP factor release key is invalid");
 	}
 	if (workerPublicKey65.length !== 65 || workerPublicKey65[0] !== 4) {
 		factorSecret32.fill(0);
-		return {
-			ok: false,
-			code: "invalid_body",
-			message: "Email OTP factor release key is invalid"
-		};
+		return failure("invalid_body", "Email OTP factor release key is invalid");
 	}
 	try {
 		const workerPublicKey = await crypto.subtle.importKey("raw", workerPublicKey65, {
@@ -17525,11 +17315,7 @@ async function sealEmailOtpFactorSecretForWorker(input) {
 			ciphertextB64u: base64UrlEncode(ciphertext)
 		};
 	} catch {
-		return {
-			ok: false,
-			code: "factor_release_failed",
-			message: "Email OTP factor release encryption failed"
-		};
+		return failure("factor_release_failed", "Email OTP factor release encryption failed");
 	} finally {
 		factorSecret32.fill(0);
 	}
@@ -17541,11 +17327,7 @@ async function handleEmailOtpDevCleanupGoogleRegistrationRoute(input) {
 		const code = verified.code || "not_verified";
 		return {
 			status: code === "internal" ? 500 : code === "not_configured" || code === "unsupported" ? 501 : code === "invalid_body" ? 400 : 401,
-			body: {
-				ok: false,
-				code,
-				message: verified.message || "Google login failed"
-			}
+			body: failure(code, verified.message || "Google login failed")
 		};
 	}
 	const runtimePolicyScope = isPlainObject(body.runtimePolicyScope) ? body.runtimePolicyScope : null;
@@ -17562,30 +17344,18 @@ async function handleEmailOtpDevCleanupGoogleRegistrationRoute(input) {
 async function handleEmailOtpRegistrationSealRoute(input) {
 	if (!isPlainObject(input.body)) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "Invalid body"
-		}
+		body: failure("invalid_body", "Invalid body")
 	};
 	const allowedFields = new Set(["walletId", "wrappedCiphertext"]);
 	for (const field of Object.keys(input.body)) if (!allowedFields.has(field)) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: `Unsupported field: ${field}`
-		}
+		body: failure("invalid_body", `Unsupported field: ${field}`)
 	};
 	const walletId = normalizeOptionalTrimmedString(input.body.walletId);
 	const wrappedCiphertext = normalizeOptionalTrimmedString(input.body.wrappedCiphertext);
 	if (!walletId || !wrappedCiphertext) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing walletId or wrappedCiphertext"
-		}
+		body: failure("invalid_body", "Missing walletId or wrappedCiphertext")
 	};
 	const result = await input.service.applyEmailOtpServerSeal({ wrappedCiphertext });
 	return {
@@ -17599,11 +17369,7 @@ async function handleEmailOtpRegistrationSealRoute(input) {
 async function handleEmailOtpDevOutboxRoute(input) {
 	if (!isPlainObject(input.body)) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "Invalid body"
-		}
+		body: failure("invalid_body", "Invalid body")
 	};
 	const allowedFields = new Set([
 		"idToken",
@@ -17613,11 +17379,7 @@ async function handleEmailOtpDevOutboxRoute(input) {
 	]);
 	for (const field of Object.keys(input.body)) if (!allowedFields.has(field)) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: `Unsupported field: ${field}`
-		}
+		body: failure("invalid_body", `Unsupported field: ${field}`)
 	};
 	const idToken = normalizeOptionalTrimmedString(input.body.idToken);
 	const walletId = normalizeOptionalTrimmedString(input.body.walletId);
@@ -17625,30 +17387,18 @@ async function handleEmailOtpDevOutboxRoute(input) {
 	const challengeSubjectId = normalizeOptionalTrimmedString(input.body.challengeSubjectId);
 	if (!idToken || !walletId) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing idToken or walletId"
-		}
+		body: failure("invalid_body", "Missing idToken or walletId")
 	};
 	if (challengeSubjectId && !challengeId) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "challengeSubjectId requires the exact challengeId it belongs to"
-		}
+		body: failure("invalid_body", "challengeSubjectId requires the exact challengeId it belongs to")
 	};
 	const verified = await input.service.verifyGoogleLogin({ idToken });
 	if (!verified.ok || !verified.verified || !verified.userId) {
 		const code = verified.code || "not_verified";
 		return {
 			status: code === "internal" ? 500 : code === "not_configured" ? 501 : 401,
-			body: {
-				ok: false,
-				code,
-				message: verified.message || "Google login failed"
-			}
+			body: failure(code, verified.message || "Google login failed")
 		};
 	}
 	const result = await input.service.readEmailOtpOutboxEntry({
@@ -17894,6 +17644,7 @@ async function resolveWalletEmailOtpChallengeSignerSelection(args) {
 		};
 	}
 	const resolved = await args.ctx.service.walletRegistration.resolveEcdsaMaterialActivation({
+		source: { kind: "database" },
 		walletId: String(args.authority.walletId),
 		materialActivation: routerAbMpcMaterialActivationRefToWire(ecdsaActivation.materialActivation)
 	});
@@ -19120,11 +18871,7 @@ async function handleSyncAccount(ctx) {
 		let responseBody = result;
 		if (result.ok && result.verified && result.thresholdEd25519) {
 			const custodyKeyManifestDigestB64u = result.custodyKeyManifestDigestB64u;
-			if (!custodyKeyManifestDigestB64u) return json$1({
-				ok: false,
-				code: "internal",
-				message: "Sync verification did not resolve the wallet key manifest"
-			}, { status: 500 });
+			if (!custodyKeyManifestDigestB64u) return jsonFailure(500, "internal", "Sync verification did not resolve the wallet key manifest");
 			const thresholdEd25519 = result.thresholdEd25519;
 			const walletId = String(result.walletId || "").trim();
 			const nearAccountId = String(result.nearAccountId || "").trim();
@@ -19132,11 +18879,7 @@ async function handleSyncAccount(ctx) {
 			const signerSlot = Number(result.signerSlot);
 			const walletBinding = result.walletBinding;
 			const credentialIdB64u = String(result.credentialIdB64u || "").trim();
-			if (!thresholdEd25519 || !walletId || !nearAccountId || !nearEd25519SigningKeyId || !Number.isSafeInteger(signerSlot) || signerSlot < 1 || !walletBinding || !credentialIdB64u || !String(result.publicKey || "").trim() || !String(result.credentialPublicKeyB64u || "").trim() || String(walletBinding.walletId) !== walletId || String(walletBinding.nearAccountId) !== nearAccountId || String(walletBinding.nearEd25519SigningKeyId) !== nearEd25519SigningKeyId || walletBinding.signerSlot !== signerSlot) return json$1({
-				ok: false,
-				code: "internal",
-				message: "verified passkey wallet is missing its Ed25519 Yao identity"
-			}, { status: 500 });
+			if (!thresholdEd25519 || !walletId || !nearAccountId || !nearEd25519SigningKeyId || !Number.isSafeInteger(signerSlot) || signerSlot < 1 || !walletBinding || !credentialIdB64u || !String(result.publicKey || "").trim() || !String(result.credentialPublicKeyB64u || "").trim() || String(walletBinding.walletId) !== walletId || String(walletBinding.nearAccountId) !== nearAccountId || String(walletBinding.nearEd25519SigningKeyId) !== nearEd25519SigningKeyId || walletBinding.signerSlot !== signerSlot) return jsonFailure(500, "internal", "verified passkey wallet is missing its Ed25519 Yao identity");
 			const authority = passkeyWalletAuthAuthorityForMethod({
 				walletId: walletBinding.walletId,
 				rpId: walletBinding.rpId,
@@ -19148,29 +18891,17 @@ async function handleSyncAccount(ctx) {
 				rpId: authority.verifier.rpId,
 				credentialIdB64u: authority.factor.credentialIdB64u
 			});
-			if (!activeAuthority.ok || activeAuthority.walletAuthority.authorityId !== result.walletAuthorityId || activeAuthority.authMethod.walletAuthMethodId !== result.walletAuthMethodId) return json$1({
-				ok: false,
-				code: "internal",
-				message: "Verified passkey wallet authority is unavailable"
-			}, { status: 500 });
+			if (!activeAuthority.ok || activeAuthority.walletAuthority.authorityId !== result.walletAuthorityId || activeAuthority.authMethod.walletAuthMethodId !== result.walletAuthMethodId) return jsonFailure(500, "internal", "Verified passkey wallet authority is unavailable");
 			const authorityRef = await walletAuthAuthorityRef({ authority });
 			const principalId = parsePrincipalId(walletId);
 			const mintId = parseWalletSessionMintId(parsed.request.challengeId);
-			if (!principalId.ok || !mintId.ok) return json$1({
-				ok: false,
-				code: "internal",
-				message: "Verified passkey Wallet Session identity is invalid"
-			}, { status: 500 });
+			if (!principalId.ok || !mintId.ok) return jsonFailure(500, "internal", "Verified passkey Wallet Session identity is invalid");
 			const issuedAtMs = Date.now();
 			const expiresAtMs = issuedAtMs + DEFAULT_WALLET_SESSION_TTL_MS;
 			const origin = parseSessionOrigin(parsed.request.expected_origin);
 			const factorId = parseAuthFactorId(`passkey:${credentialIdB64u}`);
 			const credentialId = parseWebAuthnCredentialIdB64u(credentialIdB64u);
-			if (!factorId.ok || !credentialId.ok) return json$1({
-				ok: false,
-				code: "internal",
-				message: "Verified passkey factor identity is invalid"
-			}, { status: 500 });
+			if (!factorId.ok || !credentialId.ok) return jsonFailure(500, "internal", "Verified passkey factor identity is invalid");
 			const proof = await ctx.service.authorizedOperations.buildVerifiedOwnerProof({
 				purpose: "wallet_session",
 				proofId: parseVerifiedOwnerProofId(`sync-account:${parsed.request.challengeId}`),
@@ -19188,11 +18919,7 @@ async function handleSyncAccount(ctx) {
 					expiresAtMs
 				})
 			});
-			if (proof.purpose !== "wallet_session") return json$1({
-				ok: false,
-				code: "internal",
-				message: "Owner proof purpose is invalid"
-			}, { status: 500 });
+			if (proof.purpose !== "wallet_session") return jsonFailure(500, "internal", "Owner proof purpose is invalid");
 			const bootstrap = await issueSyncAccountBootstrapV1({
 				ctx,
 				result: {
@@ -19233,11 +18960,7 @@ async function handleSyncAccount(ctx) {
 				message: "Wallet Session sync is already committed; retry the exact method",
 				...bootstrap.committed
 			}, { status: 409 });
-			if (bootstrap.kind === "error") return json$1({
-				ok: false,
-				code: bootstrap.code,
-				message: bootstrap.message
-			}, { status: bootstrap.status });
+			if (bootstrap.kind === "error") return jsonFailure(bootstrap.status, bootstrap.code, bootstrap.message);
 			responseBody = bootstrap.body;
 		}
 		return json$1(responseBody, { status: syncAccountResponseStatus(result) });
@@ -21780,11 +21503,13 @@ async function handleOwnerWalletExecutionLanePreflight(ctx) {
 		};
 	} else {
 		const validated = await validateRouterAbEcdsaDerivationWalletSessionInputs({
+			materialActivation: routerAbMpcMaterialActivationRefToWire(request.expectedMaterialActivation),
 			headers,
 			authorizationSessions: ctx.service.authorizationSessions,
 			operationKind: EVM_ECDSA_MPC_OPERATION_KINDS.signTransaction
 		});
 		if (!validated.ok) return validationFailure(validated);
+		if (validated.kind === "wallet_session_operation_credential_exhausted_candidate_v1") return validationFailure(walletSessionFailure("wallet_session_unavailable"));
 		walletIdRaw = String(validated.admission.context.authorization.session.walletId);
 		authorization = {
 			kind: "wallet_auth_method",
@@ -21832,22 +21557,14 @@ async function handleWebAuthnAuthenticators(ctx) {
 	if (ctx.pathname !== "/webauthn/authenticators") return null;
 	try {
 		const token = extractBearerCredential(ctx.request.headers);
-		if (!token) return json$1({
-			ok: false,
-			code: "unauthorized",
-			message: "No valid Wallet Session"
-		}, { status: 401 });
+		if (!token) return jsonFailure(401, "unauthorized", "No valid Wallet Session");
 		const nowMs = Date.now();
 		const exact = await ctx.service.authorizationSessions.readWalletSessionAuthorizationV2ByOperationCredential({
 			tenantId: ctx.service.authorizationSessions.tenantId,
 			token,
 			nowMs
 		});
-		if (!exact) return json$1({
-			ok: false,
-			code: "unauthorized",
-			message: "No valid Wallet Session"
-		}, { status: 401 });
+		if (!exact) return jsonFailure(401, "unauthorized", "No valid Wallet Session");
 		const rpIdFromQuery = String(ctx.url.searchParams.get("rpId") || ctx.url.searchParams.get("rp_id") || "").trim();
 		const result = await ctx.service.webAuthn.listWebAuthnAuthenticatorsForUser({
 			userId: String(exact.authorization.session.walletId),
@@ -21856,11 +21573,7 @@ async function handleWebAuthnAuthenticators(ctx) {
 		if (!result.ok) return json$1(result, { status: result.code === "not_supported" ? 501 : result.code === "invalid_args" ? 400 : 500 });
 		return json$1(result, { status: 200 });
 	} catch (e) {
-		return json$1({
-			ok: false,
-			code: "internal",
-			message: e?.message || "Internal error"
-		}, { status: 500 });
+		return jsonFailure(500, "internal", e?.message || "Internal error");
 	}
 }
 //#endregion
@@ -22133,11 +21846,7 @@ async function requireExactWalletSession(ctx) {
 	const token = extractBearerCredential(ctx.request.headers);
 	if (!token) return {
 		ok: false,
-		response: json$1({
-			ok: false,
-			code: "unauthorized",
-			message: "No valid Wallet Session"
-		}, { status: 401 })
+		response: jsonFailure(401, "unauthorized", "No valid Wallet Session")
 	};
 	try {
 		const context = await ctx.service.authorizationSessions.readWalletSessionAuthorizationV2ByOperationCredential({
@@ -22147,11 +21856,7 @@ async function requireExactWalletSession(ctx) {
 		});
 		if (!context) return {
 			ok: false,
-			response: json$1({
-				ok: false,
-				code: "unauthorized",
-				message: "No valid Wallet Session"
-			}, { status: 401 })
+			response: jsonFailure(401, "unauthorized", "No valid Wallet Session")
 		};
 		return {
 			ok: true,
@@ -22160,11 +21865,7 @@ async function requireExactWalletSession(ctx) {
 	} catch {
 		return {
 			ok: false,
-			response: json$1({
-				ok: false,
-				code: "wallet_session_unavailable",
-				message: "Wallet Session is unavailable"
-			}, { status: 503 })
+			response: jsonFailure(503, "wallet_session_unavailable", "Wallet Session is unavailable")
 		};
 	}
 }
@@ -22177,19 +21878,11 @@ async function requireExactPasskeyStepUp(input) {
 	const walletId = String(input.context.authorization.session.walletId);
 	if (String(result.userId).trim() !== walletId) return {
 		ok: false,
-		response: json$1({
-			ok: false,
-			code: "forbidden",
-			message: "Step-up user mismatch"
-		}, { status: 403 })
+		response: jsonFailure(403, "forbidden", "Step-up user mismatch")
 	};
 	if (result.walletAuthMethodId !== input.context.authMethod.walletAuthMethodId || result.walletAuthorityId !== input.context.authority.authorityId) return {
 		ok: false,
-		response: json$1({
-			ok: false,
-			code: "forbidden",
-			message: "Step-up authority mismatch"
-		}, { status: 403 })
+		response: jsonFailure(403, "forbidden", "Step-up authority mismatch")
 	};
 	return { ok: true };
 }
@@ -22247,11 +21940,7 @@ async function handleAuth(ctx) {
 			default: assertNeverAuthIdentityMutation(command);
 		}
 		const subject = command.request.subject;
-		if (subject.startsWith("near:")) return json$1({
-			ok: false,
-			code: "not_supported",
-			message: "near: subjects cannot be unlinked"
-		}, { status: 400 });
+		if (subject.startsWith("near:")) return jsonFailure(400, "not_supported", "near: subjects cannot be unlinked");
 		const out = await ctx.service.identity.unlinkIdentity({
 			userId: walletId,
 			subject
@@ -22308,16 +21997,8 @@ async function handleAuth(ctx) {
 				publishableKeyAuth: ctx.opts.publishableKeyAuth,
 				orgProjectEnv: ctx.opts.orgProjectEnv
 			});
-			if (!runtimePolicyScope.ok) return json$1({
-				ok: false,
-				code: runtimePolicyScope.code,
-				message: runtimePolicyScope.message
-			}, { status: runtimePolicyScope.status });
-			if (!runtimePolicyScope.scope) return json$1({
-				ok: false,
-				code: "runtime_policy_scope_unavailable",
-				message: "Google Email OTP requires an active managed runtime policy scope"
-			}, { status: 500 });
+			if (!runtimePolicyScope.ok) return jsonFailure(runtimePolicyScope.status, runtimePolicyScope.code, runtimePolicyScope.message);
+			if (!runtimePolicyScope.scope) return jsonFailure(500, "runtime_policy_scope_unavailable", "Google Email OTP requires an active managed runtime policy scope");
 			const result = await ctx.service.identity.verifyGoogleLogin(parsed.request);
 			if (!result.ok || !result.verified || !result.providerSubject) return json$1(result, { status: result.code === "internal" ? 500 : 400 });
 			const resolution = await ctx.service.identity.resolveGoogleEmailOtpSession({
@@ -22340,31 +22021,19 @@ async function handleNearPublicKeys(ctx) {
 	if (ctx.pathname !== "/near/public-keys") return null;
 	try {
 		const token = extractBearerCredential(ctx.request.headers);
-		if (!token) return json$1({
-			ok: false,
-			code: "unauthorized",
-			message: "No valid Wallet Session"
-		}, { status: 401 });
+		if (!token) return jsonFailure(401, "unauthorized", "No valid Wallet Session");
 		const nowMs = Date.now();
 		const exact = await ctx.service.authorizationSessions.readWalletSessionAuthorizationV2ByOperationCredential({
 			tenantId: ctx.service.authorizationSessions.tenantId,
 			token,
 			nowMs
 		});
-		if (!exact) return json$1({
-			ok: false,
-			code: "unauthorized",
-			message: "No valid Wallet Session"
-		}, { status: 401 });
+		if (!exact) return jsonFailure(401, "unauthorized", "No valid Wallet Session");
 		const result = await ctx.service.nearFunding.listNearPublicKeysForUser({ userId: String(exact.authorization.session.walletId) });
 		if (!result.ok) return json$1(result, { status: result.code === "not_supported" ? 501 : result.code === "invalid_args" ? 400 : 500 });
 		return json$1(result, { status: 200 });
 	} catch (e) {
-		return json$1({
-			ok: false,
-			code: "internal",
-			message: e?.message || "Internal error"
-		}, { status: 500 });
+		return jsonFailure(500, "internal", e?.message || "Internal error");
 	}
 }
 //#endregion
@@ -22482,10 +22151,35 @@ async function handleWellKnown(ctx) {
 	});
 }
 //#endregion
+//#region ../shared-ts/src/utils/exactKeys.ts
+/**
+* True when `value` is a non-array object whose own enumerable string keys are exactly `keys`.
+*
+* A key whose value is `undefined` still counts as present. Symbol, non-enumerable and inherited
+* keys are not counted, and the prototype is not checked. A list that repeats a key never matches.
+* Kept apart from validation.ts, which the wallet iframe's boot path loads.
+*/
+function hasExactKeys$1(value, keys) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const actual = Object.keys(value);
+	return actual.length === keys.length && actual.every((key) => keys.includes(key));
+}
+//#endregion
 //#region src/core/deviceLinking/requestProof.ts
 function parseLinkedDeviceRequestProofV1(raw) {
 	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("linked-device request proof must be an object");
-	if (!isLinkedDeviceRequestProofRecordV1(raw)) throw new Error("record contains invalid fields");
+	if (!hasExactKeys$1(raw, [
+		"kind",
+		"linkSessionId",
+		"devicePublicKeyDigestB64u",
+		"requestNonceB64u",
+		"method",
+		"canonicalPath",
+		"bodyDigestB64u",
+		"issuedAtMs",
+		"expiresAtMs",
+		"signatureB64u"
+	])) throw new Error("record contains invalid fields");
 	const record = raw;
 	if (record.kind !== "linked_device_request_proof_v1") throw new Error("linked-device request proof kind is invalid");
 	const linkSessionId = parseSessionId$1(record.linkSessionId);
@@ -22542,9 +22236,6 @@ function parseFixedB64u(raw, expectedBytes, field) {
 	if (bytes.length !== expectedBytes || base64UrlEncode(bytes) !== raw) throw new Error(`${field} is invalid`);
 	return raw;
 }
-function isLinkedDeviceRequestProofRecordV1(value) {
-	return Object.keys(value).sort().join("|") === "bodyDigestB64u|canonicalPath|devicePublicKeyDigestB64u|expiresAtMs|issuedAtMs|kind|linkSessionId|method|requestNonceB64u|signatureB64u";
-}
 //#endregion
 //#region src/router/transport/fetch/routes/deviceLinking.ts
 const DEVICE_LINKING_BASE = "/wallet/device-linking/v1/sessions";
@@ -24039,11 +23730,7 @@ async function authenticateDeviceLinkingOwnerWalletSessionRequestV1(input) {
 async function handleDeviceLinkingOwnerAuthorization(ctx, service) {
 	if (ctx.pathname !== "/wallet/device-linking/v1/owner-authorization") return null;
 	if (ctx.method !== "POST") return methodNotAllowedResponse();
-	if (!service) return json$1({
-		ok: false,
-		code: "not_supported",
-		message: "Linked-device owner authorization is not configured"
-	}, { status: 501 });
+	if (!service) return jsonFailure(501, "not_supported", "Linked-device owner authorization is not configured");
 	const nowV1 = Date.now;
 	let body;
 	let rawBody;
@@ -24053,11 +23740,7 @@ async function handleDeviceLinkingOwnerAuthorization(ctx, service) {
 		rawBody = await readJson(ctx.request.clone());
 		body = parseLinkedDeviceOwnerAuthorizationRequestV1(rawBody);
 	} catch (error) {
-		return json$1({
-			ok: false,
-			code: "invalid_body",
-			message: error instanceof Error ? error.message : "Owner authorization body is invalid"
-		}, { status: 400 });
+		return jsonFailure(400, "invalid_body", error instanceof Error ? error.message : "Owner authorization body is invalid");
 	}
 	const validated = await authenticateDeviceLinkingOwnerWalletSessionRequestV1({
 		request: ctx.request,
@@ -24077,11 +23760,7 @@ async function handleDeviceLinkingOwnerAuthorization(ctx, service) {
 			owner: validated.owner
 		}), { status: 200 });
 	} catch (error) {
-		return json$1({
-			ok: false,
-			code: "internal",
-			message: error instanceof Error ? error.message : String(error)
-		}, { status: 500 });
+		return jsonFailure(500, "internal", error instanceof Error ? error.message : String(error));
 	}
 }
 async function validateOwnerWalletSessionV1(input) {
@@ -24245,12 +23924,7 @@ function methodNotAllowedResponse() {
 	}, { status: 405 });
 }
 function authDeniedResponse(value) {
-	const status = value.code === "expired" ? 401 : value.code === "invalid" ? 403 : 401;
-	return json$1({
-		ok: false,
-		code: value.code,
-		message: value.message
-	}, { status });
+	return jsonFailure(value.code === "expired" ? 401 : value.code === "invalid" ? 403 : 401, value.code, value.message);
 }
 //#endregion
 //#region src/threshold/session/signingSessionSeal/transport/fetch.ts
@@ -24260,20 +23934,6 @@ function json(body, status = 200) {
 		headers: { "Content-Type": "application/json; charset=utf-8" }
 	});
 }
-async function readJsonSafe(request) {
-	try {
-		return await request.json();
-	} catch {
-		return null;
-	}
-}
-function headersToRecord(headers) {
-	const out = {};
-	headers.forEach((value, key) => {
-		out[key] = value;
-	});
-	return out;
-}
 function errMessage(error) {
 	return error instanceof Error ? error.message : String(error || "Internal error");
 }
@@ -24293,7 +23953,7 @@ async function handleSigningSessionSealRoutes(ctx) {
 			route: isApply ? applyPath : removePath,
 			operation
 		});
-		const body = await readJsonSafe(ctx.request);
+		const body = await readJson(ctx.request);
 		const parsed = isApply ? parseSigningSessionSealApplyBody(body) : parseSigningSessionSealRemoveBody(body);
 		if (!parsed.ok) {
 			ctx.logger.warn("[threshold-signing-session-seal] invalid_body", {
@@ -24303,11 +23963,7 @@ async function handleSigningSessionSealRoutes(ctx) {
 				message: parsed.message,
 				durationMs: Math.max(0, Date.now() - startedAtMs)
 			});
-			return json({
-				ok: false,
-				code: parsed.code,
-				message: parsed.message
-			}, 400);
+			return json(failure(parsed.code, parsed.message), 400);
 		}
 		const authorized = await authorizeSigningSessionSealRequest({
 			options,
@@ -24323,11 +23979,7 @@ async function handleSigningSessionSealRoutes(ctx) {
 				message: authorized.message || "Unauthorized",
 				durationMs: Math.max(0, Date.now() - startedAtMs)
 			});
-			return json({
-				ok: false,
-				code: authorized.code || "unauthorized",
-				message: authorized.message || "Unauthorized"
-			}, signingSessionSealAuthorizeStatusCode(authorized));
+			return json(failure(authorized.code || "unauthorized", authorized.message || "Unauthorized"), signingSessionSealAuthorizeStatusCode(authorized));
 		}
 		const result = isApply ? await options.service.applyServerSeal(parsed.value, authorized.auth) : await options.service.removeServerSeal(parsed.value, authorized.auth);
 		const status = signingSessionSealStatusCode(result);
@@ -24347,11 +23999,7 @@ async function handleSigningSessionSealRoutes(ctx) {
 			message,
 			durationMs: Math.max(0, Date.now() - startedAtMs)
 		});
-		return json({
-			ok: false,
-			code: "internal",
-			message
-		}, 500);
+		return json(failure("internal", message), 500);
 	}
 }
 //#endregion
@@ -24496,6 +24144,7 @@ async function signingSessionSealRecordFromExactAdmission(input) {
 	switch (admission.curve) {
 		case "ecdsa": {
 			const active = await input.walletRegistration.resolveEcdsaMaterialActivation({
+				source: { kind: "database" },
 				walletId,
 				materialActivation
 			});
@@ -24656,11 +24305,7 @@ function createFetchRouter(service, opts, runtime) {
 		async (context) => {
 			if (!context.pathname.startsWith("/wallet/device-linking/v1/devices")) return null;
 			const service = context.service.deviceManagement;
-			if (!service) return json$1({
-				ok: false,
-				code: "not_supported",
-				message: "Linked-device management is not configured"
-			}, { status: 501 });
+			if (!service) return jsonFailure(501, "not_supported", "Linked-device management is not configured");
 			return await handleDeviceManagement(context, service);
 		},
 		handlePasskeyCustody,
@@ -24900,45 +24545,17 @@ function parseExpectation(raw) {
 }
 async function validateRuntimeSnapshotExpectation(input) {
 	const expectationResult = parseExpectation(input.expectationRaw);
-	if (expectationResult.error) return {
-		ok: false,
-		code: "runtime_snapshot_invalid_expectation",
-		message: expectationResult.error
-	};
+	if (expectationResult.error) return failure("runtime_snapshot_invalid_expectation", expectationResult.error);
 	const expectation = expectationResult.parsed;
 	if (!expectation) return { ok: true };
 	const scope = input.scope;
-	if (!scope) return {
-		ok: false,
-		code: "runtime_snapshot_scope_missing",
-		message: "threshold session is missing runtimePolicyScope"
-	};
-	if (!input.runtimeSnapshots) return {
-		ok: false,
-		code: "runtime_snapshots_not_configured",
-		message: "Runtime snapshot consumer is not configured on this server"
-	};
+	if (!scope) return failure("runtime_snapshot_scope_missing", "threshold session is missing runtimePolicyScope");
+	if (!input.runtimeSnapshots) return failure("runtime_snapshots_not_configured", "Runtime snapshot consumer is not configured on this server");
 	const latest = await input.runtimeSnapshots.getLatestSnapshot(scope);
-	if (!latest) return {
-		ok: false,
-		code: "runtime_snapshot_not_found",
-		message: `No runtime snapshot found for org=${scope.orgId} project=${scope.projectId} env=${scope.envId}`
-	};
-	if (expectation.snapshotId && latest.snapshotId !== expectation.snapshotId) return {
-		ok: false,
-		code: "runtime_snapshot_id_mismatch",
-		message: `Runtime snapshot id mismatch: expected ${expectation.snapshotId}, got ${latest.snapshotId}`
-	};
-	if (expectation.version !== void 0 && latest.version !== expectation.version) return {
-		ok: false,
-		code: "runtime_snapshot_version_mismatch",
-		message: `Runtime snapshot version mismatch: expected ${expectation.version}, got ${latest.version}`
-	};
-	if (expectation.checksum && latest.checksum !== expectation.checksum) return {
-		ok: false,
-		code: "runtime_snapshot_checksum_mismatch",
-		message: `Runtime snapshot checksum mismatch: expected ${expectation.checksum}, got ${latest.checksum}`
-	};
+	if (!latest) return failure("runtime_snapshot_not_found", `No runtime snapshot found for org=${scope.orgId} project=${scope.projectId} env=${scope.envId}`);
+	if (expectation.snapshotId && latest.snapshotId !== expectation.snapshotId) return failure("runtime_snapshot_id_mismatch", `Runtime snapshot id mismatch: expected ${expectation.snapshotId}, got ${latest.snapshotId}`);
+	if (expectation.version !== void 0 && latest.version !== expectation.version) return failure("runtime_snapshot_version_mismatch", `Runtime snapshot version mismatch: expected ${expectation.version}, got ${latest.version}`);
+	if (expectation.checksum && latest.checksum !== expectation.checksum) return failure("runtime_snapshot_checksum_mismatch", `Runtime snapshot checksum mismatch: expected ${expectation.checksum}, got ${latest.checksum}`);
 	return { ok: true };
 }
 function makeScopeKey(scope) {
@@ -25002,9 +24619,17 @@ function createInMemoryRouterApiRuntimeSnapshotConsumer() {
 	};
 }
 //#endregion
+//#region ../shared-ts/src/tenant-root/tenantRootIdentifier.ts
+function hasControlCharacters(value) {
+	for (const character of value) {
+		const codePoint = character.codePointAt(0) ?? 0;
+		if (codePoint <= 31 || codePoint >= 127 && codePoint <= 159) return true;
+	}
+	return false;
+}
+//#endregion
 //#region ../shared-ts/src/tenant-root/tenantRootIdentity.ts
 const TENANT_ROOT_IDENTITY_DOMAIN_V1 = new TextEncoder().encode("seams/tenant-root-identity/v1");
-const TENANT_ROOT_IDENTITY_MAX_IDENTIFIER_BYTES_V1 = 256;
 function concatenateBytes(parts) {
 	let length = 0;
 	for (const part of parts) length += part.length;
@@ -25023,13 +24648,6 @@ function hasLeadingOrTrailingRustWhitespace(value) {
 	const codePoints = Array.from(value, (character) => character.codePointAt(0) ?? 0);
 	return codePoints.length > 0 && (isRustWhitespace(codePoints[0]) || isRustWhitespace(codePoints[codePoints.length - 1]));
 }
-function hasControlCharacters(value) {
-	for (const character of value) {
-		const codePoint = character.codePointAt(0) ?? 0;
-		if (codePoint <= 31 || codePoint >= 127 && codePoint <= 159) return true;
-	}
-	return false;
-}
 function hasUnpairedSurrogate(value) {
 	for (let index = 0; index < value.length; index += 1) {
 		const codeUnit = value.charCodeAt(index);
@@ -25047,7 +24665,7 @@ function isCanonicalTenantRootIdentityField(value) {
 	if (typeof value !== "string" || value.length === 0) return false;
 	if (hasLeadingOrTrailingRustWhitespace(value) || hasControlCharacters(value)) return false;
 	if (hasUnpairedSurrogate(value)) return false;
-	return new TextEncoder().encode(value).length <= TENANT_ROOT_IDENTITY_MAX_IDENTIFIER_BYTES_V1;
+	return new TextEncoder().encode(value).length <= 256;
 }
 function lengthPrefixTenantRootIdentityField(value) {
 	const output = new Uint8Array(4 + value.length);