@seams/wallet-server 0.7.1 → 0.7.3

package/dist/esm/router/framework/http.js

@@ -1,6 +1,7 @@
 import { ROUTER_AB_ED25519_YAO_RECOVERY_CHALLENGE_ID_HEADER_V1 } from "../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { LINKED_DEVICE_REQUEST_PROOF_HEADER_V1 } from "../../shared-ts/src/device-linking/requestProof.js";
 import "../../shared-ts/src/device-linking/index.js";
+import { failure } from "../../shared-ts/src/utils/failure.js";
 import { buildCorsOrigins, normalizeCorsOrigin } from "../../core/SessionService.js";
 import { ROUTER_AB_TRACE_ID_HEADER_V1 } from "../../shared-ts/src/utils/routerAbTraceContext.js";
 //#region src/router/framework/http.ts
@@ -30,6 +31,9 @@ function json(body, init, extraHeaders) {
 		headers
 	});
 }
+function jsonFailure(status, code, message) {
+	return json(failure(code, message), { status });
+}
 function withCors(headers, opts, request) {
 	const pathname = request ? new URL(request.url).pathname : "";
 	if (pathname === "/healthz" || pathname === "/readyz") {
@@ -82,6 +86,6 @@ function headersToRecord(headers) {
 	return out;
 }
 //#endregion
-export { headersToRecord, json, readJson, toResponse, withCors };
+export { headersToRecord, json, jsonFailure, readJson, toResponse, withCors };
 
 //# sourceMappingURL=http.js.map

package/dist/esm/router/framework/runtimeSnapshotConsumer.js

@@ -1,3 +1,4 @@
+import { failure } from "../../shared-ts/src/utils/failure.js";
 //#region src/router/framework/runtimeSnapshotConsumer.ts
 function parseExpectation(raw) {
 	if (raw === void 0 || raw === null) return { parsed: null };
@@ -38,45 +39,17 @@ function parseExpectation(raw) {
 }
 async function validateRuntimeSnapshotExpectation(input) {
 	const expectationResult = parseExpectation(input.expectationRaw);
-	if (expectationResult.error) return {
-		ok: false,
-		code: "runtime_snapshot_invalid_expectation",
-		message: expectationResult.error
-	};
+	if (expectationResult.error) return failure("runtime_snapshot_invalid_expectation", expectationResult.error);
 	const expectation = expectationResult.parsed;
 	if (!expectation) return { ok: true };
 	const scope = input.scope;
-	if (!scope) return {
-		ok: false,
-		code: "runtime_snapshot_scope_missing",
-		message: "threshold session is missing runtimePolicyScope"
-	};
-	if (!input.runtimeSnapshots) return {
-		ok: false,
-		code: "runtime_snapshots_not_configured",
-		message: "Runtime snapshot consumer is not configured on this server"
-	};
+	if (!scope) return failure("runtime_snapshot_scope_missing", "threshold session is missing runtimePolicyScope");
+	if (!input.runtimeSnapshots) return failure("runtime_snapshots_not_configured", "Runtime snapshot consumer is not configured on this server");
 	const latest = await input.runtimeSnapshots.getLatestSnapshot(scope);
-	if (!latest) return {
-		ok: false,
-		code: "runtime_snapshot_not_found",
-		message: `No runtime snapshot found for org=${scope.orgId} project=${scope.projectId} env=${scope.envId}`
-	};
-	if (expectation.snapshotId && latest.snapshotId !== expectation.snapshotId) return {
-		ok: false,
-		code: "runtime_snapshot_id_mismatch",
-		message: `Runtime snapshot id mismatch: expected ${expectation.snapshotId}, got ${latest.snapshotId}`
-	};
-	if (expectation.version !== void 0 && latest.version !== expectation.version) return {
-		ok: false,
-		code: "runtime_snapshot_version_mismatch",
-		message: `Runtime snapshot version mismatch: expected ${expectation.version}, got ${latest.version}`
-	};
-	if (expectation.checksum && latest.checksum !== expectation.checksum) return {
-		ok: false,
-		code: "runtime_snapshot_checksum_mismatch",
-		message: `Runtime snapshot checksum mismatch: expected ${expectation.checksum}, got ${latest.checksum}`
-	};
+	if (!latest) return failure("runtime_snapshot_not_found", `No runtime snapshot found for org=${scope.orgId} project=${scope.projectId} env=${scope.envId}`);
+	if (expectation.snapshotId && latest.snapshotId !== expectation.snapshotId) return failure("runtime_snapshot_id_mismatch", `Runtime snapshot id mismatch: expected ${expectation.snapshotId}, got ${latest.snapshotId}`);
+	if (expectation.version !== void 0 && latest.version !== expectation.version) return failure("runtime_snapshot_version_mismatch", `Runtime snapshot version mismatch: expected ${expectation.version}, got ${latest.version}`);
+	if (expectation.checksum && latest.checksum !== expectation.checksum) return failure("runtime_snapshot_checksum_mismatch", `Runtime snapshot checksum mismatch: expected ${expectation.checksum}, got ${latest.checksum}`);
 	return { ok: true };
 }
 function makeScopeKey(scope) {

package/dist/esm/router/transport/fetch/createFetchRouter.js

@@ -5,7 +5,7 @@ import { routerAbEcdsaDerivationActiveStateId } from "../../../shared-ts/src/uti
 import { findRouteDefinitionForRequest } from "../../framework/routeDefinitions.js";
 import { getRouterApiRouteExtensionRoutes, getRouterApiRouteExtensionsForTransport } from "../../framework/routeExtensions.js";
 import { coerceRouterLogger } from "../../framework/logger.js";
-import { json, withCors } from "../../framework/http.js";
+import { json, jsonFailure, withCors } from "../../framework/http.js";
 import { handleHealth, handleReady } from "./routes/health.js";
 import { extractBearerCredential } from "../../auth/routerApiKeyAuth.js";
 import { resolveWalletSessionOperationCredentialAdmissionFromContext } from "../../auth/commonRouterUtils.js";
@@ -44,6 +44,7 @@ async function signingSessionSealRecordFromExactAdmission(input) {
 	switch (admission.curve) {
 		case "ecdsa": {
 			const active = await input.walletRegistration.resolveEcdsaMaterialActivation({
+				source: { kind: "database" },
 				walletId,
 				materialActivation
 			});
@@ -204,11 +205,7 @@ function createFetchRouter(service, opts, runtime) {
 		async (context) => {
 			if (!context.pathname.startsWith("/wallet/device-linking/v1/devices")) return null;
 			const service = context.service.deviceManagement;
-			if (!service) return json({
-				ok: false,
-				code: "not_supported",
-				message: "Linked-device management is not configured"
-			}, { status: 501 });
+			if (!service) return jsonFailure(501, "not_supported", "Linked-device management is not configured");
 			return await handleDeviceManagement(context, service);
 		},
 		handlePasskeyCustody,

package/dist/esm/router/transport/fetch/routes/auth.js

@@ -1,4 +1,4 @@
-import { json, readJson } from "../../../framework/http.js";
+import { json, jsonFailure, readJson } from "../../../framework/http.js";
 import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
 import { resolveThresholdRuntimePolicyScope } from "../../../auth/commonRouterUtils.js";
 import { parseAuthIdentityMutationRequest, parseAuthProviderActionPath, parseGoogleLoginVerifyRequest, parsePasskeyLoginOptionsRequest, parsePasskeyLoginVerifyRequest } from "../../../auth/authRequestValidation.js";
@@ -13,11 +13,7 @@ async function requireExactWalletSession(ctx) {
 	const token = extractBearerCredential(ctx.request.headers);
 	if (!token) return {
 		ok: false,
-		response: json({
-			ok: false,
-			code: "unauthorized",
-			message: "No valid Wallet Session"
-		}, { status: 401 })
+		response: jsonFailure(401, "unauthorized", "No valid Wallet Session")
 	};
 	try {
 		const context = await ctx.service.authorizationSessions.readWalletSessionAuthorizationV2ByOperationCredential({
@@ -27,11 +23,7 @@ async function requireExactWalletSession(ctx) {
 		});
 		if (!context) return {
 			ok: false,
-			response: json({
-				ok: false,
-				code: "unauthorized",
-				message: "No valid Wallet Session"
-			}, { status: 401 })
+			response: jsonFailure(401, "unauthorized", "No valid Wallet Session")
 		};
 		return {
 			ok: true,
@@ -40,11 +32,7 @@ async function requireExactWalletSession(ctx) {
 	} catch {
 		return {
 			ok: false,
-			response: json({
-				ok: false,
-				code: "wallet_session_unavailable",
-				message: "Wallet Session is unavailable"
-			}, { status: 503 })
+			response: jsonFailure(503, "wallet_session_unavailable", "Wallet Session is unavailable")
 		};
 	}
 }
@@ -57,19 +45,11 @@ async function requireExactPasskeyStepUp(input) {
 	const walletId = String(input.context.authorization.session.walletId);
 	if (String(result.userId).trim() !== walletId) return {
 		ok: false,
-		response: json({
-			ok: false,
-			code: "forbidden",
-			message: "Step-up user mismatch"
-		}, { status: 403 })
+		response: jsonFailure(403, "forbidden", "Step-up user mismatch")
 	};
 	if (result.walletAuthMethodId !== input.context.authMethod.walletAuthMethodId || result.walletAuthorityId !== input.context.authority.authorityId) return {
 		ok: false,
-		response: json({
-			ok: false,
-			code: "forbidden",
-			message: "Step-up authority mismatch"
-		}, { status: 403 })
+		response: jsonFailure(403, "forbidden", "Step-up authority mismatch")
 	};
 	return { ok: true };
 }
@@ -127,11 +107,7 @@ async function handleAuth(ctx) {
 			default: assertNeverAuthIdentityMutation(command);
 		}
 		const subject = command.request.subject;
-		if (subject.startsWith("near:")) return json({
-			ok: false,
-			code: "not_supported",
-			message: "near: subjects cannot be unlinked"
-		}, { status: 400 });
+		if (subject.startsWith("near:")) return jsonFailure(400, "not_supported", "near: subjects cannot be unlinked");
 		const out = await ctx.service.identity.unlinkIdentity({
 			userId: walletId,
 			subject
@@ -188,16 +164,8 @@ async function handleAuth(ctx) {
 				publishableKeyAuth: ctx.opts.publishableKeyAuth,
 				orgProjectEnv: ctx.opts.orgProjectEnv
 			});
-			if (!runtimePolicyScope.ok) return json({
-				ok: false,
-				code: runtimePolicyScope.code,
-				message: runtimePolicyScope.message
-			}, { status: runtimePolicyScope.status });
-			if (!runtimePolicyScope.scope) return json({
-				ok: false,
-				code: "runtime_policy_scope_unavailable",
-				message: "Google Email OTP requires an active managed runtime policy scope"
-			}, { status: 500 });
+			if (!runtimePolicyScope.ok) return jsonFailure(runtimePolicyScope.status, runtimePolicyScope.code, runtimePolicyScope.message);
+			if (!runtimePolicyScope.scope) return jsonFailure(500, "runtime_policy_scope_unavailable", "Google Email OTP requires an active managed runtime policy scope");
 			const result = await ctx.service.identity.verifyGoogleLogin(parsed.request);
 			if (!result.ok || !result.verified || !result.providerSubject) return json(result, { status: result.code === "internal" ? 500 : 400 });
 			const resolution = await ctx.service.identity.resolveGoogleEmailOtpSession({

package/dist/esm/router/transport/fetch/routes/deviceLinkingOwnerAuthorization.js

@@ -5,7 +5,7 @@ import { buildEmailOtpWalletAuthAuthority, buildPasskeyWalletAuthAuthority, wall
 import { parseLinkedDeviceOwnerAuthorizationRequestV1 } from "../../../../shared-ts/src/device-linking/parsers.js";
 import { buildWalletSessionCapabilitySubjectsV1, walletSessionCapabilitySubjectsV1Equal } from "../../../../authorization/domain.js";
 import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
-import { json, readJson } from "../../../framework/http.js";
+import { json, jsonFailure, readJson } from "../../../framework/http.js";
 import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
 //#region src/router/transport/fetch/routes/deviceLinkingOwnerAuthorization.ts
 const LINKED_DEVICE_OWNER_AUTHORIZATION_PATH_V1 = "/wallet/device-linking/v1/owner-authorization";
@@ -61,11 +61,7 @@ async function authenticateDeviceLinkingOwnerWalletSessionRequestV1(input) {
 async function handleDeviceLinkingOwnerAuthorization(ctx, service) {
 	if (ctx.pathname !== "/wallet/device-linking/v1/owner-authorization") return null;
 	if (ctx.method !== "POST") return methodNotAllowedResponse();
-	if (!service) return json({
-		ok: false,
-		code: "not_supported",
-		message: "Linked-device owner authorization is not configured"
-	}, { status: 501 });
+	if (!service) return jsonFailure(501, "not_supported", "Linked-device owner authorization is not configured");
 	const nowV1 = Date.now;
 	let body;
 	let rawBody;
@@ -75,11 +71,7 @@ async function handleDeviceLinkingOwnerAuthorization(ctx, service) {
 		rawBody = await readJson(ctx.request.clone());
 		body = parseLinkedDeviceOwnerAuthorizationRequestV1(rawBody);
 	} catch (error) {
-		return json({
-			ok: false,
-			code: "invalid_body",
-			message: error instanceof Error ? error.message : "Owner authorization body is invalid"
-		}, { status: 400 });
+		return jsonFailure(400, "invalid_body", error instanceof Error ? error.message : "Owner authorization body is invalid");
 	}
 	const validated = await authenticateDeviceLinkingOwnerWalletSessionRequestV1({
 		request: ctx.request,
@@ -99,11 +91,7 @@ async function handleDeviceLinkingOwnerAuthorization(ctx, service) {
 			owner: validated.owner
 		}), { status: 200 });
 	} catch (error) {
-		return json({
-			ok: false,
-			code: "internal",
-			message: error instanceof Error ? error.message : String(error)
-		}, { status: 500 });
+		return jsonFailure(500, "internal", error instanceof Error ? error.message : String(error));
 	}
 }
 async function validateOwnerWalletSessionV1(input) {
@@ -267,12 +255,7 @@ function methodNotAllowedResponse() {
 	}, { status: 405 });
 }
 function authDeniedResponse(value) {
-	const status = value.code === "expired" ? 401 : value.code === "invalid" ? 403 : 401;
-	return json({
-		ok: false,
-		code: value.code,
-		message: value.message
-	}, { status });
+	return jsonFailure(value.code === "expired" ? 401 : value.code === "invalid" ? 403 : 401, value.code, value.message);
 }
 //#endregion
 export { LINKED_DEVICE_OWNER_AUTHORIZATION_PATH_V1, authenticateDeviceLinkingOwnerWalletSessionRequestV1, createDeviceLinkingOwnerRequestAuthenticatorV1, handleDeviceLinkingOwnerAuthorization };

package/dist/esm/router/transport/fetch/routes/nearPublicKeys.js

@@ -1,4 +1,4 @@
-import { json } from "../../../framework/http.js";
+import { json, jsonFailure } from "../../../framework/http.js";
 import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
 //#region src/router/transport/fetch/routes/nearPublicKeys.ts
 async function handleNearPublicKeys(ctx) {
@@ -6,31 +6,19 @@ async function handleNearPublicKeys(ctx) {
 	if (ctx.pathname !== "/near/public-keys") return null;
 	try {
 		const token = extractBearerCredential(ctx.request.headers);
-		if (!token) return json({
-			ok: false,
-			code: "unauthorized",
-			message: "No valid Wallet Session"
-		}, { status: 401 });
+		if (!token) return jsonFailure(401, "unauthorized", "No valid Wallet Session");
 		const nowMs = Date.now();
 		const exact = await ctx.service.authorizationSessions.readWalletSessionAuthorizationV2ByOperationCredential({
 			tenantId: ctx.service.authorizationSessions.tenantId,
 			token,
 			nowMs
 		});
-		if (!exact) return json({
-			ok: false,
-			code: "unauthorized",
-			message: "No valid Wallet Session"
-		}, { status: 401 });
+		if (!exact) return jsonFailure(401, "unauthorized", "No valid Wallet Session");
 		const result = await ctx.service.nearFunding.listNearPublicKeysForUser({ userId: String(exact.authorization.session.walletId) });
 		if (!result.ok) return json(result, { status: result.code === "not_supported" ? 501 : result.code === "invalid_args" ? 400 : 500 });
 		return json(result, { status: 200 });
 	} catch (e) {
-		return json({
-			ok: false,
-			code: "internal",
-			message: e?.message || "Internal error"
-		}, { status: 500 });
+		return jsonFailure(500, "internal", e?.message || "Internal error");
 	}
 }
 //#endregion

package/dist/esm/router/transport/fetch/routes/sessions.js

@@ -123,6 +123,7 @@ async function resolveWalletEmailOtpChallengeSignerSelection(args) {
 		};
 	}
 	const resolved = await args.ctx.service.walletRegistration.resolveEcdsaMaterialActivation({
+		source: { kind: "database" },
 		walletId: String(args.authority.walletId),
 		materialActivation: routerAbMpcMaterialActivationRefToWire(ecdsaActivation.materialActivation)
 	});

package/dist/esm/router/transport/fetch/routes/syncAccount.js

@@ -6,7 +6,7 @@ import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAu
 import { parseSessionOrigin, parseVerifiedOwnerProofId } from "../../../../authorization/domain.js";
 import { buildVerifiedWalletSessionPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
 import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
-import { json, readJson } from "../../../framework/http.js";
+import { json, jsonFailure, readJson } from "../../../framework/http.js";
 import { parseSyncAccountOptionsRequest, parseSyncAccountVerifyRequest } from "../../../domains/syncAccount/syncAccountRequestValidation.js";
 import { DEFAULT_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
 import { issueSyncAccountBootstrapV1 } from "./syncAccountBootstrap.js";
@@ -55,11 +55,7 @@ async function handleSyncAccount(ctx) {
 		let responseBody = result;
 		if (result.ok && result.verified && result.thresholdEd25519) {
 			const custodyKeyManifestDigestB64u = result.custodyKeyManifestDigestB64u;
-			if (!custodyKeyManifestDigestB64u) return json({
-				ok: false,
-				code: "internal",
-				message: "Sync verification did not resolve the wallet key manifest"
-			}, { status: 500 });
+			if (!custodyKeyManifestDigestB64u) return jsonFailure(500, "internal", "Sync verification did not resolve the wallet key manifest");
 			const thresholdEd25519 = result.thresholdEd25519;
 			const walletId = String(result.walletId || "").trim();
 			const nearAccountId = String(result.nearAccountId || "").trim();
@@ -67,11 +63,7 @@ async function handleSyncAccount(ctx) {
 			const signerSlot = Number(result.signerSlot);
 			const walletBinding = result.walletBinding;
 			const credentialIdB64u = String(result.credentialIdB64u || "").trim();
-			if (!thresholdEd25519 || !walletId || !nearAccountId || !nearEd25519SigningKeyId || !Number.isSafeInteger(signerSlot) || signerSlot < 1 || !walletBinding || !credentialIdB64u || !String(result.publicKey || "").trim() || !String(result.credentialPublicKeyB64u || "").trim() || String(walletBinding.walletId) !== walletId || String(walletBinding.nearAccountId) !== nearAccountId || String(walletBinding.nearEd25519SigningKeyId) !== nearEd25519SigningKeyId || walletBinding.signerSlot !== signerSlot) return json({
-				ok: false,
-				code: "internal",
-				message: "verified passkey wallet is missing its Ed25519 Yao identity"
-			}, { status: 500 });
+			if (!thresholdEd25519 || !walletId || !nearAccountId || !nearEd25519SigningKeyId || !Number.isSafeInteger(signerSlot) || signerSlot < 1 || !walletBinding || !credentialIdB64u || !String(result.publicKey || "").trim() || !String(result.credentialPublicKeyB64u || "").trim() || String(walletBinding.walletId) !== walletId || String(walletBinding.nearAccountId) !== nearAccountId || String(walletBinding.nearEd25519SigningKeyId) !== nearEd25519SigningKeyId || walletBinding.signerSlot !== signerSlot) return jsonFailure(500, "internal", "verified passkey wallet is missing its Ed25519 Yao identity");
 			const authority = passkeyWalletAuthAuthorityForMethod({
 				walletId: walletBinding.walletId,
 				rpId: walletBinding.rpId,
@@ -83,29 +75,17 @@ async function handleSyncAccount(ctx) {
 				rpId: authority.verifier.rpId,
 				credentialIdB64u: authority.factor.credentialIdB64u
 			});
-			if (!activeAuthority.ok || activeAuthority.walletAuthority.authorityId !== result.walletAuthorityId || activeAuthority.authMethod.walletAuthMethodId !== result.walletAuthMethodId) return json({
-				ok: false,
-				code: "internal",
-				message: "Verified passkey wallet authority is unavailable"
-			}, { status: 500 });
+			if (!activeAuthority.ok || activeAuthority.walletAuthority.authorityId !== result.walletAuthorityId || activeAuthority.authMethod.walletAuthMethodId !== result.walletAuthMethodId) return jsonFailure(500, "internal", "Verified passkey wallet authority is unavailable");
 			const authorityRef = await walletAuthAuthorityRef({ authority });
 			const principalId = parsePrincipalId(walletId);
 			const mintId = parseWalletSessionMintId(parsed.request.challengeId);
-			if (!principalId.ok || !mintId.ok) return json({
-				ok: false,
-				code: "internal",
-				message: "Verified passkey Wallet Session identity is invalid"
-			}, { status: 500 });
+			if (!principalId.ok || !mintId.ok) return jsonFailure(500, "internal", "Verified passkey Wallet Session identity is invalid");
 			const issuedAtMs = Date.now();
 			const expiresAtMs = issuedAtMs + DEFAULT_WALLET_SESSION_TTL_MS;
 			const origin = parseSessionOrigin(parsed.request.expected_origin);
 			const factorId = parseAuthFactorId(`passkey:${credentialIdB64u}`);
 			const credentialId = parseWebAuthnCredentialIdB64u(credentialIdB64u);
-			if (!factorId.ok || !credentialId.ok) return json({
-				ok: false,
-				code: "internal",
-				message: "Verified passkey factor identity is invalid"
-			}, { status: 500 });
+			if (!factorId.ok || !credentialId.ok) return jsonFailure(500, "internal", "Verified passkey factor identity is invalid");
 			const proof = await ctx.service.authorizedOperations.buildVerifiedOwnerProof({
 				purpose: "wallet_session",
 				proofId: parseVerifiedOwnerProofId(`sync-account:${parsed.request.challengeId}`),
@@ -123,11 +103,7 @@ async function handleSyncAccount(ctx) {
 					expiresAtMs
 				})
 			});
-			if (proof.purpose !== "wallet_session") return json({
-				ok: false,
-				code: "internal",
-				message: "Owner proof purpose is invalid"
-			}, { status: 500 });
+			if (proof.purpose !== "wallet_session") return jsonFailure(500, "internal", "Owner proof purpose is invalid");
 			const bootstrap = await issueSyncAccountBootstrapV1({
 				ctx,
 				result: {
@@ -168,11 +144,7 @@ async function handleSyncAccount(ctx) {
 				message: "Wallet Session sync is already committed; retry the exact method",
 				...bootstrap.committed
 			}, { status: 409 });
-			if (bootstrap.kind === "error") return json({
-				ok: false,
-				code: bootstrap.code,
-				message: bootstrap.message
-			}, { status: bootstrap.status });
+			if (bootstrap.kind === "error") return jsonFailure(bootstrap.status, bootstrap.code, bootstrap.message);
 			responseBody = bootstrap.body;
 		}
 		return json(responseBody, { status: syncAccountResponseStatus(result) });

package/dist/esm/router/transport/fetch/routes/thresholdEcdsa.js

@@ -236,18 +236,13 @@ async function executeRouterAbEcdsaDerivationNormalSigningRoute(input, timing) {
 			binding: await ecdsaOperationStepUpBinding(input.ctx, authorization.session, authorizedOperation)
 		});
 	} else {
+		const request = input.phase === "prepare" ? parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1(input.body) : parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1(input.body);
 		const operation = await admitRouterAbEcdsaReusableWalletSessionOperation({
-			request: input.phase === "prepare" ? parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1(input.body) : parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1(input.body),
-			materialActivation: authorization.admission.materialActivation,
-			binding: authorization.kind === "wallet_session_operation_credential_v1" ? {
-				kind: "wallet_session_operation_credential_v1",
-				context: authorization.validated.admission.context
-			} : {
-				kind: "wallet_session_operation_credential_exhausted_candidate_v1",
-				candidate: authorization.candidate
-			},
-			authorizedOperations: input.ctx.service.authorizedOperations,
-			resolveEcdsaMaterialActivation: input.ctx.service.walletRegistration.resolveEcdsaMaterialActivation.bind(input.ctx.service.walletRegistration)
+			phase: input.phase,
+			request,
+			material: authorization.activeMaterial,
+			binding: authorization,
+			authorizedOperations: input.ctx.service.authorizedOperations
 		});
 		if (!operation.ok) {
 			const failureBody = operation.error.body;
@@ -273,11 +268,6 @@ async function executeRouterAbEcdsaDerivationNormalSigningRoute(input, timing) {
 			return json(failure.body, { status: failure.status });
 		}
 		if (operation.admission.kind === "replayed") return routerAbEcdsaReplayResponse(operation.admission.operation);
-		if (operation.admission.kind === "claimed" && input.phase === "finalize") return json({
-			ok: false,
-			code: "authorized_operation_missing",
-			message: "ECDSA finalize requires a claimed prepare operation"
-		}, { status: 409 });
 		const ownerDecision = decideRouterAbEcdsaOwnerOperationAuthorization({ operation: operation.admission.operation });
 		switch (ownerDecision.kind) {
 			case "authorized": break;
@@ -502,6 +492,7 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 		message: v2Resolution.message
 	}, { status: 403 });
 	const activeMaterial = v2Resolution.kind === "admitted" ? v2Resolution.activeMaterial : await input.ctx.service.walletRegistration.resolveEcdsaMaterialActivation({
+		source: { kind: "database" },
 		walletId: operation.wallet_id,
 		materialActivation: operation.material_activation
 	});
@@ -820,7 +811,6 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 async function handleEcdsaPoolFillRoute(input) {
 	const startedAt = performance.now();
 	const timing = {
-		queue: null,
 		authenticate: null,
 		material: null,
 		admit: null,
@@ -855,31 +845,24 @@ async function executeEcdsaPoolFillRoute(input, timing, workerTimings) {
 	const parsed = input.phase === "init" ? parseRouterAbEcdsaDerivationPoolFillInitRouteRequest(input.body) : parseRouterAbEcdsaDerivationPoolFillStepRouteRequest(input.body);
 	if (!parsed.ok) return json(parsed.body, { status: thresholdEcdsaStatusCode(parsed.body) });
 	const request = parsed.request;
-	const queuedAt = performance.now();
-	const gateTicket = await presignPriorityGate.acquire(resolvePresignTrafficClass(request.requestTag));
-	timing.queue = performance.now() - queuedAt;
-	try {
-		const authorized = await authorizeEcdsaPoolFill({
-			ctx: input.ctx,
-			request,
-			timing
-		});
-		if (!authorized.ok) return json(authorized.error.body, { status: authorized.error.status });
-		const proxyStartedAt = performance.now();
-		const result = "poolFill" in request ? await runtime.initializePoolFill({
-			binding: authorized.binding,
-			request: ecdsaPoolFillInitRuntimeRequest(request),
-			onServerTiming: collectEcdsaPresignWorkerTiming.bind(void 0, workerTimings)
-		}) : await runtime.advancePoolFill({
-			binding: authorized.binding,
-			request: ecdsaPoolFillStepRuntimeRequest(request),
-			onServerTiming: collectEcdsaPresignWorkerTiming.bind(void 0, workerTimings)
-		});
-		timing.proxy = performance.now() - proxyStartedAt;
-		return json(result, { status: thresholdEcdsaStatusCode(result) });
-	} finally {
-		gateTicket.release();
-	}
+	const authorized = await authorizeEcdsaPoolFill({
+		ctx: input.ctx,
+		request,
+		timing
+	});
+	if (!authorized.ok) return json(authorized.error.body, { status: authorized.error.status });
+	const proxyStartedAt = performance.now();
+	const result = "poolFill" in request ? await runtime.initializePoolFill({
+		binding: authorized.binding,
+		request: ecdsaPoolFillInitRuntimeRequest(request),
+		onServerTiming: collectEcdsaPresignWorkerTiming.bind(void 0, workerTimings)
+	}) : await runtime.advancePoolFill({
+		binding: authorized.binding,
+		request: ecdsaPoolFillStepRuntimeRequest(request),
+		onServerTiming: collectEcdsaPresignWorkerTiming.bind(void 0, workerTimings)
+	});
+	timing.proxy = performance.now() - proxyStartedAt;
+	return json(result, { status: thresholdEcdsaStatusCode(result) });
 }
 function poolFillMaterialActivation(request) {
 	return "poolFill" in request ? request.poolFill.scope.material_activation : null;
@@ -1018,6 +1001,7 @@ async function authorizeEcdsaPoolFill(input) {
 			const admitted = validated;
 			const materialStartedAt = performance.now();
 			const activeMaterial = await input.ctx.service.walletRegistration.resolveEcdsaMaterialActivation({
+				source: { kind: "database" },
 				walletId: String(session.walletId),
 				materialActivation: routerAbMpcMaterialActivationRefToWire(admitted.materialActivation)
 			});
@@ -1106,43 +1090,6 @@ function ecdsaPoolFillStepRuntimeRequest(request) {
 		...request.requestTag === void 0 ? {} : { requestTag: request.requestTag }
 	};
 }
-function resolvePresignPriorityTurn(resolve) {
-	setTimeout(resolve, 5);
-}
-function waitForPresignPriorityTurn() {
-	return new Promise(resolvePresignPriorityTurn);
-}
-var PresignPriorityGate = class {
-	constructor() {
-		this.foregroundInFlight = 0;
-		this.backgroundInFlight = 0;
-	}
-	async acquire(trafficClass) {
-		if (trafficClass === "foreground") {
-			this.foregroundInFlight += 1;
-			return this.createTicket("foreground");
-		}
-		while (!this.canRunBackgroundNow()) await waitForPresignPriorityTurn();
-		this.backgroundInFlight += 1;
-		return this.createTicket("background");
-	}
-	createTicket(trafficClass) {
-		let released = false;
-		return { release: () => {
-			if (released) return;
-			released = true;
-			if (trafficClass === "foreground") this.foregroundInFlight = Math.max(0, this.foregroundInFlight - 1);
-			else this.backgroundInFlight = Math.max(0, this.backgroundInFlight - 1);
-		} };
-	}
-	canRunBackgroundNow() {
-		return this.foregroundInFlight === 0 && this.backgroundInFlight === 0;
-	}
-};
-function resolvePresignTrafficClass(requestTag) {
-	return requestTag === "background_presign_pool_refill" ? "background" : "foreground";
-}
-const presignPriorityGate = new PresignPriorityGate();
 function strictEcdsaAuthorizationFailureStatus(failure) {
 	switch (failure.code) {
 		case "unauthorized": return 401;
@@ -1525,6 +1472,7 @@ async function authorizeStrictEcdsaExport(input) {
 			scope: operation.normal_signing_scope
 		})) return strictEcdsaExportFailure(403, "scope_mismatch", "ECDSA export operation scope does not match the request");
 		const activeMaterial = await input.ctx.service.walletRegistration.resolveEcdsaMaterialActivation({
+			source: { kind: "database" },
 			walletId: operation.wallet_id,
 			materialActivation: input.request.material_activation
 		});

package/dist/esm/router/transport/fetch/routes/walletExecutionLanePreflight.js

@@ -1,9 +1,10 @@
 import { parseMpcMaterialActivationRef, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
+import { routerAbMpcMaterialActivationRefToWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { WALLET_SESSION_FAILURE_CODES } from "../../../../shared-ts/src/utils/walletSessionFailure.js";
 import { json, readJson } from "../../../framework/http.js";
-import { walletSessionFailureStatus } from "../../../auth/walletSessionFailure.js";
+import { walletSessionFailure, walletSessionFailureStatus } from "../../../auth/walletSessionFailure.js";
 import { validateRouterAbEcdsaDerivationWalletSessionInputs, validateRouterAbEd25519WalletSessionInputs } from "../../../auth/commonRouterUtils.js";
 //#region src/router/transport/fetch/routes/walletExecutionLanePreflight.ts
 const OWNER_WALLET_EXECUTION_LANE_PREFLIGHT_PATH = "/wallet/execution-lane/owner";
@@ -177,11 +178,13 @@ async function handleOwnerWalletExecutionLanePreflight(ctx) {
 		};
 	} else {
 		const validated = await validateRouterAbEcdsaDerivationWalletSessionInputs({
+			materialActivation: routerAbMpcMaterialActivationRefToWire(request.expectedMaterialActivation),
 			headers,
 			authorizationSessions: ctx.service.authorizationSessions,
 			operationKind: EVM_ECDSA_MPC_OPERATION_KINDS.signTransaction
 		});
 		if (!validated.ok) return validationFailure(validated);
+		if (validated.kind === "wallet_session_operation_credential_exhausted_candidate_v1") return validationFailure(walletSessionFailure("wallet_session_unavailable"));
 		walletIdRaw = String(validated.admission.context.authorization.session.walletId);
 		authorization = {
 			kind: "wallet_auth_method",

package/dist/esm/router/transport/fetch/routes/webauthnAuthenticators.js

@@ -1,4 +1,4 @@
-import { json } from "../../../framework/http.js";
+import { json, jsonFailure } from "../../../framework/http.js";
 import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
 //#region src/router/transport/fetch/routes/webauthnAuthenticators.ts
 async function handleWebAuthnAuthenticators(ctx) {
@@ -6,22 +6,14 @@ async function handleWebAuthnAuthenticators(ctx) {
 	if (ctx.pathname !== "/webauthn/authenticators") return null;
 	try {
 		const token = extractBearerCredential(ctx.request.headers);
-		if (!token) return json({
-			ok: false,
-			code: "unauthorized",
-			message: "No valid Wallet Session"
-		}, { status: 401 });
+		if (!token) return jsonFailure(401, "unauthorized", "No valid Wallet Session");
 		const nowMs = Date.now();
 		const exact = await ctx.service.authorizationSessions.readWalletSessionAuthorizationV2ByOperationCredential({
 			tenantId: ctx.service.authorizationSessions.tenantId,
 			token,
 			nowMs
 		});
-		if (!exact) return json({
-			ok: false,
-			code: "unauthorized",
-			message: "No valid Wallet Session"
-		}, { status: 401 });
+		if (!exact) return jsonFailure(401, "unauthorized", "No valid Wallet Session");
 		const rpIdFromQuery = String(ctx.url.searchParams.get("rpId") || ctx.url.searchParams.get("rp_id") || "").trim();
 		const result = await ctx.service.webAuthn.listWebAuthnAuthenticatorsForUser({
 			userId: String(exact.authorization.session.walletId),
@@ -30,11 +22,7 @@ async function handleWebAuthnAuthenticators(ctx) {
 		if (!result.ok) return json(result, { status: result.code === "not_supported" ? 501 : result.code === "invalid_args" ? 400 : 500 });
 		return json(result, { status: 200 });
 	} catch (e) {
-		return json({
-			ok: false,
-			code: "internal",
-			message: e?.message || "Internal error"
-		}, { status: 500 });
+		return jsonFailure(500, "internal", e?.message || "Internal error");
 	}
 }
 //#endregion