@seams/wallet-server 0.7.1 → 0.8.0

package/dist/esm/router/domains/emailOtp/emailOtpRouteHandlers.js

@@ -2,9 +2,10 @@ import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/b
 import "../../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
+import { failure } from "../../../shared-ts/src/utils/failure.js";
 import { emailOtpStatusCode } from "./emailOtpSessionRouteHelpers.js";
+import { EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN_V1 } from "../../../shared-ts/src/utils/emailOtpDomain.js";
 //#region src/router/domains/emailOtp/emailOtpRouteHandlers.ts
-const EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN = "seams/email-otp/factor-release/v1";
 function decodeEmailOtpFactorSecret32(value) {
 	const magnitude = base64UrlDecode(value);
 	if (magnitude.length === 0 || magnitude.length > 32) {
@@ -18,7 +19,7 @@ function decodeEmailOtpFactorSecret32(value) {
 }
 function emailOtpFactorReleaseAad(input) {
 	return new TextEncoder().encode([
-		EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN,
+		EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN_V1,
 		input.walletId,
 		input.enrollmentId,
 		input.enrollmentSealKeyVersion,
@@ -32,19 +33,11 @@ async function sealEmailOtpFactorSecretForWorker(input) {
 		factorSecret32 = decodeEmailOtpFactorSecret32(input.factorSecret32B64u);
 		workerPublicKey65 = base64UrlDecode(input.workerEphemeralPublicKey65B64u);
 	} catch {
-		return {
-			ok: false,
-			code: "invalid_body",
-			message: "Email OTP factor release key is invalid"
-		};
+		return failure("invalid_body", "Email OTP factor release key is invalid");
 	}
 	if (workerPublicKey65.length !== 65 || workerPublicKey65[0] !== 4) {
 		factorSecret32.fill(0);
-		return {
-			ok: false,
-			code: "invalid_body",
-			message: "Email OTP factor release key is invalid"
-		};
+		return failure("invalid_body", "Email OTP factor release key is invalid");
 	}
 	try {
 		const workerPublicKey = await crypto.subtle.importKey("raw", workerPublicKey65, {
@@ -76,11 +69,7 @@ async function sealEmailOtpFactorSecretForWorker(input) {
 			ciphertextB64u: base64UrlEncode(ciphertext)
 		};
 	} catch {
-		return {
-			ok: false,
-			code: "factor_release_failed",
-			message: "Email OTP factor release encryption failed"
-		};
+		return failure("factor_release_failed", "Email OTP factor release encryption failed");
 	} finally {
 		factorSecret32.fill(0);
 	}
@@ -92,11 +81,7 @@ async function handleEmailOtpDevCleanupGoogleRegistrationRoute(input) {
 		const code = verified.code || "not_verified";
 		return {
 			status: code === "internal" ? 500 : code === "not_configured" || code === "unsupported" ? 501 : code === "invalid_body" ? 400 : 401,
-			body: {
-				ok: false,
-				code,
-				message: verified.message || "Google login failed"
-			}
+			body: failure(code, verified.message || "Google login failed")
 		};
 	}
 	const runtimePolicyScope = isPlainObject(body.runtimePolicyScope) ? body.runtimePolicyScope : null;
@@ -113,30 +98,18 @@ async function handleEmailOtpDevCleanupGoogleRegistrationRoute(input) {
 async function handleEmailOtpRegistrationSealRoute(input) {
 	if (!isPlainObject(input.body)) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "Invalid body"
-		}
+		body: failure("invalid_body", "Invalid body")
 	};
 	const allowedFields = new Set(["walletId", "wrappedCiphertext"]);
 	for (const field of Object.keys(input.body)) if (!allowedFields.has(field)) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: `Unsupported field: ${field}`
-		}
+		body: failure("invalid_body", `Unsupported field: ${field}`)
 	};
 	const walletId = normalizeOptionalTrimmedString(input.body.walletId);
 	const wrappedCiphertext = normalizeOptionalTrimmedString(input.body.wrappedCiphertext);
 	if (!walletId || !wrappedCiphertext) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing walletId or wrappedCiphertext"
-		}
+		body: failure("invalid_body", "Missing walletId or wrappedCiphertext")
 	};
 	const result = await input.service.applyEmailOtpServerSeal({ wrappedCiphertext });
 	return {
@@ -150,11 +123,7 @@ async function handleEmailOtpRegistrationSealRoute(input) {
 async function handleEmailOtpDevOutboxRoute(input) {
 	if (!isPlainObject(input.body)) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "Invalid body"
-		}
+		body: failure("invalid_body", "Invalid body")
 	};
 	const allowedFields = new Set([
 		"idToken",
@@ -164,11 +133,7 @@ async function handleEmailOtpDevOutboxRoute(input) {
 	]);
 	for (const field of Object.keys(input.body)) if (!allowedFields.has(field)) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: `Unsupported field: ${field}`
-		}
+		body: failure("invalid_body", `Unsupported field: ${field}`)
 	};
 	const idToken = normalizeOptionalTrimmedString(input.body.idToken);
 	const walletId = normalizeOptionalTrimmedString(input.body.walletId);
@@ -176,30 +141,18 @@ async function handleEmailOtpDevOutboxRoute(input) {
 	const challengeSubjectId = normalizeOptionalTrimmedString(input.body.challengeSubjectId);
 	if (!idToken || !walletId) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing idToken or walletId"
-		}
+		body: failure("invalid_body", "Missing idToken or walletId")
 	};
 	if (challengeSubjectId && !challengeId) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "challengeSubjectId requires the exact challengeId it belongs to"
-		}
+		body: failure("invalid_body", "challengeSubjectId requires the exact challengeId it belongs to")
 	};
 	const verified = await input.service.verifyGoogleLogin({ idToken });
 	if (!verified.ok || !verified.verified || !verified.userId) {
 		const code = verified.code || "not_verified";
 		return {
 			status: code === "internal" ? 500 : code === "not_configured" ? 501 : 401,
-			body: {
-				ok: false,
-				code,
-				message: verified.message || "Google login failed"
-			}
+			body: failure(code, verified.message || "Google login failed")
 		};
 	}
 	const result = await input.service.readEmailOtpOutboxEntry({

package/dist/esm/router/domains/passkeyCustody/passkeyCustodyEnvelopeRetrieval.js

@@ -84,14 +84,8 @@ async function retrievePasskeyCustodyEnvelope(input) {
 			envelope: lookup.envelope,
 			storeVersion: lookup.storeVersion
 		};
-		case "retired": return {
-			kind: "retired",
-			retiredAtMs: lookup.retiredAtMs
-		};
-		case "revoked": return {
-			kind: "revoked",
-			revokedAtMs: lookup.revokedAtMs
-		};
+		case "retired": return { kind: "retired" };
+		case "revoked": return { kind: "revoked" };
 		case "digest_mismatch":
 			input.logger.error("[passkey-custody] stored envelope failed its ciphertext digest", {
 				walletId: String(request.locator.walletId),

package/dist/esm/router/domains/passkeyCustody/walletCustodyRegistrationCommit.js

@@ -150,14 +150,8 @@ async function commitWalletCustodyRegistration(input) {
 			envelopeStoreVersion: stored.envelopeStoreVersion,
 			recoverySetStoreVersion: stored.recoverySetStoreVersion
 		};
-		case "already_exists": return {
-			kind: "already_exists",
-			key: stored.key
-		};
-		case "custody_already_established": return {
-			kind: "custody_already_established",
-			walletId: stored.walletId
-		};
+		case "already_exists": return { kind: "already_exists" };
+		case "custody_already_established": return { kind: "custody_already_established" };
 		case "inconsistent": return {
 			kind: "rejected",
 			reason: stored.reason

package/dist/esm/router/domains/signingOperations/routerAbEcdsaDerivationNormalSigningRoute.js

@@ -10,7 +10,7 @@ import { extractBearerCredential } from "../../auth/routerApiKeyAuth.js";
 import { walletSessionFailure, walletSessionFailureStatus } from "../../auth/walletSessionFailure.js";
 import { validateRouterAbEcdsaDerivationWalletSessionInputs } from "../../auth/commonRouterUtils.js";
 import { evaluateRouterAbNormalSigningAdmission, requireAuthorizationValue, requireMpcMaterialActivationId, routerAbErrorMessage, routerAbOwnerOperationFailureResult, routerAbOwnerOperationStepUpDecision, routerAbSigningError, routerAbStepUpError, routerAbWalletSessionValidationStatus } from "./routerAbNormalSigningAdmission.js";
-import { ecdsaStepUpActiveMaterial, exactOperationStepUpSession, parseStepUpRequestOrigin, readExhaustedWalletSessionCandidate, recordedStepUpOperationClaim, routerAbOperationStepUpClaimFailure, walletSessionCandidateAdmission, walletSessionScopeInvalidFailure, walletSessionUnavailableFailure } from "./routerAbOperationStepUp.js";
+import { ecdsaStepUpActiveMaterial, exactOperationStepUpSession, parseStepUpRequestOrigin, recordedStepUpOperationClaim, routerAbOperationStepUpClaimFailure, walletSessionCandidateAdmission, walletSessionScopeInvalidFailure, walletSessionUnavailableFailure } from "./routerAbOperationStepUp.js";
 import { buildRouterAbEcdsaDerivationPrivateSigningWorkerBody, isRouterAbEcdsaSigningWorkerOperationInProgress, postRouterAbSigningWorkerJson, replayResponseFromSigningWorkerResult } from "./routerAbPrivateSigningWorker.js";
 //#region src/router/domains/signingOperations/routerAbEcdsaDerivationNormalSigningRoute.ts
 function routerAbEcdsaAtomicAuthorizationConfigured(authorizedOperations) {
@@ -43,6 +43,7 @@ async function resolveRouterAbEcdsaOwnerOperationStepUpPreparation(input) {
 		const walletId = parseWalletId(request.scope.wallet_id);
 		if (!walletId.ok) return void 0;
 		const activeMaterial = await input.resolveEcdsaMaterialActivation({
+			source: { kind: "database" },
 			walletId: walletId.value,
 			materialActivation: request.material_activation
 		});
@@ -165,6 +166,7 @@ function routerAbWalletSessionError(code) {
 */
 async function resolveFreshRouterAbEcdsaMaterialActivation(input) {
 	const resolved = await input.resolveEcdsaMaterialActivation({
+		source: { kind: "database" },
 		walletId: input.walletId,
 		materialActivation: input.expected
 	});
@@ -184,15 +186,7 @@ async function resolveFreshRouterAbEcdsaMaterialActivation(input) {
 	};
 }
 function validateRouterAbEcdsaV2NormalSigningRequestForSession(input) {
-	let request;
-	try {
-		request = parseRouterAbEcdsaOperationStepUpRequest(input);
-	} catch (error) {
-		return {
-			ok: false,
-			error: routerAbStepUpError(400, "invalid_body", routerAbErrorMessage(error))
-		};
-	}
+	const request = input.request;
 	if (request.authorization.kind !== "reusable_wallet_session" || request.authorization.wallet_session_id !== input.session.walletSessionId || request.scope.wallet_id !== String(input.session.walletId) || request.material_activation.material_owner !== String(input.session.walletId) || request.material_activation.signing_worker !== request.scope.signing_worker.server_id || !sameRouterAbMpcMaterialActivationRef(request.material_activation, request.scope.material_activation) || !sameRouterAbMpcMaterialActivationRef(request.material_activation, input.admittedMaterialActivation)) return {
 		ok: false,
 		error: routerAbWalletSessionError(WALLET_SESSION_FAILURE_CODES.scopeMismatch)
@@ -221,7 +215,7 @@ function validateRouterAbEcdsaV2NormalSigningRequestForSession(input) {
 	};
 }
 async function admitRouterAbEcdsaReusableWalletSessionOperation(input) {
-	if (typeof input.authorizedOperations.admitEcdsaWalletSessionOperation !== "function") return {
+	if (typeof input.authorizedOperations.admitEcdsaWalletSessionOperation !== "function" || typeof input.authorizedOperations.resolveEcdsaWalletSessionOperation !== "function") return {
 		ok: false,
 		error: routerAbStepUpError(501, "not_configured", "ECDSA atomic authorization is not configured")
 	};
@@ -231,7 +225,7 @@ async function admitRouterAbEcdsaReusableWalletSessionOperation(input) {
 	};
 	const nowMs = Date.now();
 	try {
-		const session = input.binding.kind === "wallet_session_operation_credential_v1" ? input.binding.context.authorization.session : input.binding.candidate.status.session;
+		const session = input.binding.kind === "wallet_session_operation_credential_v1" ? input.binding.validated.admission.context.authorization.session : input.binding.candidate.status.session;
 		const tenantId = session.tenantId;
 		const principalId = session.principalId;
 		const walletId = session.walletId;
@@ -242,16 +236,12 @@ async function admitRouterAbEcdsaReusableWalletSessionOperation(input) {
 			ok: false,
 			error: routerAbStepUpError(403, "wallet_session_mismatch", "Reusable Wallet Session identity does not match")
 		};
-		const freshMaterial = await resolveFreshRouterAbEcdsaMaterialActivation({
-			resolveEcdsaMaterialActivation: input.resolveEcdsaMaterialActivation,
-			walletId: String(walletId),
-			expected: input.materialActivation
-		});
-		if (!freshMaterial.ok) return {
+		const material = input.material;
+		if (!sameRouterAbMpcMaterialActivationRef(material.materialActivation, input.request.material_activation)) return {
 			ok: false,
-			error: routerAbStepUpError(freshMaterial.code === "internal" ? 500 : 403, freshMaterial.code === "internal" ? "internal" : "wallet_session_mismatch", freshMaterial.message)
+			error: routerAbStepUpError(403, "material_mismatch", "Signing material does not match the request")
 		};
-		const capabilityId = requireAuthorizationValue(parseCapabilityId(freshMaterial.materialActivation.capability));
+		const capabilityId = requireAuthorizationValue(parseCapabilityId(material.materialActivation.capability));
 		const operationId = requireAuthorizationValue(parseCapabilityOperationId(input.request.operation_id));
 		const envelope = buildCapabilityOperationEnvelope({
 			tenantId,
@@ -265,13 +255,11 @@ async function admitRouterAbEcdsaReusableWalletSessionOperation(input) {
 				displayDigest: parseDigestB64u(input.request.operation_digests.display_digest_b64u)
 			}
 		});
-		const authorizedOperationId = requireAuthorizationValue(parseAuthorizedOperationId(`ecdsa-authorized-operation:${operationId}:${input.request.request_id}`));
-		const auditEventId = requireAuthorizationValue(parseAuthorizationAuditEventId(`ecdsa-operation-audit:${operationId}`));
-		const outcome = await input.authorizedOperations.admitEcdsaWalletSessionOperation({
+		const admissionInput = {
 			operation: {
 				tenantId,
-				authorizedOperationId,
-				auditEventId,
+				authorizedOperationId: requireAuthorizationValue(parseAuthorizedOperationId(`ecdsa-authorized-operation:${operationId}:${input.request.request_id}`)),
+				auditEventId: requireAuthorizationValue(parseAuthorizationAuditEventId(`ecdsa-operation-audit:${operationId}`)),
 				operation: envelope,
 				authorization: {
 					kind: "authorization_grant",
@@ -284,12 +272,35 @@ async function admitRouterAbEcdsaReusableWalletSessionOperation(input) {
 				claimedAtMs: nowMs
 			},
 			material: {
+				readSnapshot: material.readSnapshot,
 				walletId,
-				keyHandle: freshMaterial.keyHandle,
-				runtimePolicyScope: freshMaterial.runtimePolicyScope,
-				materialActivation: freshMaterial.materialActivation
+				keyHandle: material.keyHandle,
+				runtimePolicyScope: material.runtimePolicyScope,
+				materialActivation: material.materialActivation
 			}
-		});
+		};
+		if (input.phase === "finalize") {
+			const resolved = await input.authorizedOperations.resolveEcdsaWalletSessionOperation(admissionInput);
+			if (resolved.kind === "authorized_operation_missing") return {
+				ok: false,
+				error: routerAbStepUpError(409, resolved.kind, "ECDSA finalize requires a claimed prepare operation")
+			};
+			const failure = routerAbReusableWalletSessionClaimFailure(resolved);
+			if (failure) return {
+				ok: false,
+				error: failure
+			};
+			if (resolved.kind === "operation_in_progress" || resolved.kind === "replayed") return {
+				ok: true,
+				phase: "finalize",
+				admission: resolved
+			};
+			return {
+				ok: false,
+				error: routerAbStepUpError(409, resolved.kind, "Authorized operation is unavailable")
+			};
+		}
+		const outcome = await input.authorizedOperations.admitEcdsaWalletSessionOperation(admissionInput);
 		const claimFailure = routerAbReusableWalletSessionClaimFailure(outcome);
 		if (claimFailure) return {
 			ok: false,
@@ -297,6 +308,7 @@ async function admitRouterAbEcdsaReusableWalletSessionOperation(input) {
 		};
 		if (outcome.kind === "claimed" || outcome.kind === "operation_in_progress" || outcome.kind === "replayed") return {
 			ok: true,
+			phase: "prepare",
 			admission: outcome
 		};
 		return {
@@ -342,6 +354,10 @@ async function authorizeRouterAbEcdsaWalletSessionRequest(input) {
 		result: validated.error
 	};
 	const activeMaterial = await input.resolveEcdsaMaterialActivation({
+		source: {
+			kind: "credential_snapshot",
+			materialRead: input.materialRead
+		},
 		walletId: String(input.session.walletId),
 		materialActivation: validated.admission.materialActivation
 	});
@@ -359,6 +375,10 @@ async function authorizeRouterAbEcdsaWalletSessionRequest(input) {
 		result: routerAbStepUpError(403, "wallet_session_scope_mismatch", "Wallet Session V2 scope does not match the active material")
 	};
 	const admissionDecision = await evaluateRouterAbNormalSigningAdmission({
+		policyReadSource: {
+			kind: "credential_snapshot",
+			policyRead: input.policyRead
+		},
 		adapter: input.admissionAdapter,
 		curve: "ecdsa",
 		authorizationKind: "wallet_session_operation_credential_v1",
@@ -393,29 +413,21 @@ async function authorizeRouterAbEcdsaWalletSessionRequest(input) {
 	};
 }
 async function resolveRouterAbEcdsaExhaustedCandidateAuthorization(input) {
-	const token = extractBearerCredential(input.headers);
-	if (!token) return null;
-	const exhausted = await readExhaustedWalletSessionCandidate({
-		authorizationSessions: input.authorizationSessions,
-		token,
-		operation: {
-			keyFamily: "ecdsa_secp256k1",
-			operationKind: "evm.sign_transaction"
-		}
+	const candidate = input.candidate;
+	const session = candidate.status.session;
+	const admission = walletSessionCandidateAdmission(session, candidate, {
+		keyFamily: "ecdsa_secp256k1",
+		operationKind: "evm.sign_transaction"
 	});
-	if (!exhausted) return null;
-	if (!exhausted.ok) return {
-		ok: false,
-		result: exhausted.error
-	};
-	const { candidate, session, admission } = exhausted;
 	if (!admission.ok || admission.keyFamily !== "ecdsa_secp256k1") return {
 		ok: false,
 		result: routerAbWalletSessionError(WALLET_SESSION_FAILURE_CODES.scopeMismatch)
 	};
 	const authorized = await authorizeRouterAbEcdsaWalletSessionRequest({
+		materialRead: input.materialRead,
+		policyRead: input.policyRead,
 		phase: input.phase,
-		body: input.body,
+		request: input.request,
 		session,
 		admittedMaterialActivation: routerAbMpcMaterialActivationRefToWire(admission.materialActivation),
 		admissionAdapter: input.admissionAdapter,
@@ -468,6 +480,7 @@ async function authenticateRouterAbEcdsaOperationStepUp(input) {
 	let resolvedMaterial;
 	try {
 		resolvedMaterial = await input.resolveEcdsaMaterialActivation({
+			source: { kind: "database" },
 			walletId: scope.wallet_id,
 			materialActivation: admittedMaterialActivation
 		});
@@ -575,6 +588,7 @@ async function handleRouterAbEcdsaOperationStepUpRoute(input) {
 	const materialActivationId = requireMpcMaterialActivationId(activeMaterial.materialActivation.activation_id);
 	if (!input.admissionAdapter) return routerAbStepUpError(501, "not_configured", "Router A/B ECDSA operation step-up admission is not configured");
 	const admission = await input.admissionAdapter.evaluatePolicy({
+		policyReadSource: { kind: "database" },
 		curve: "ecdsa",
 		phase: input.phase,
 		walletId: authenticated.session.walletId,
@@ -624,19 +638,19 @@ async function handleRouterAbEcdsaOperationStepUpRoute(input) {
 	};
 }
 async function authorizeRouterAbEcdsaDerivationNormalSigningRoute(input) {
-	let requestedAuthorizationKind;
+	let parsedRequest;
 	try {
-		requestedAuthorizationKind = parseRouterAbEcdsaOperationStepUpRequest({
+		parsedRequest = parseRouterAbEcdsaOperationStepUpRequest({
 			phase: input.phase,
 			body: input.body
-		}).authorization.kind;
+		});
 	} catch (error) {
 		return {
 			ok: false,
 			result: routerAbStepUpError(400, "invalid_body", routerAbErrorMessage(error))
 		};
 	}
-	if (requestedAuthorizationKind === "operation_step_up") {
+	if (parsedRequest.authorization.kind === "operation_step_up") {
 		const stepUp = await handleRouterAbEcdsaOperationStepUpRoute({
 			body: input.body,
 			headers: input.headers,
@@ -660,22 +674,12 @@ async function authorizeRouterAbEcdsaDerivationNormalSigningRoute(input) {
 		};
 	}
 	const validated = await validateRouterAbEcdsaDerivationWalletSessionInputs({
+		materialActivation: parsedRequest.material_activation,
 		headers: input.headers,
 		authorizationSessions: input.authorizationSessions,
 		operationKind: "evm.sign_transaction"
 	});
 	if (!validated.ok) {
-		if (validated.code === "wallet_session_unavailable" && input.authorizationSessions) {
-			const exhaustedCandidate = await resolveRouterAbEcdsaExhaustedCandidateAuthorization({
-				phase: input.phase,
-				body: input.body,
-				headers: input.headers,
-				authorizationSessions: input.authorizationSessions,
-				admissionAdapter: input.admissionAdapter,
-				resolveEcdsaMaterialActivation: input.resolveEcdsaMaterialActivation
-			});
-			if (exhaustedCandidate) return exhaustedCandidate;
-		}
 		const stepUp = await resolveRouterAbEcdsaOwnerOperationStepUpPreparation({
 			body: input.body,
 			phase: input.phase,
@@ -692,10 +696,21 @@ async function authorizeRouterAbEcdsaDerivationNormalSigningRoute(input) {
 			})
 		};
 	}
+	if (validated.kind === "wallet_session_operation_credential_exhausted_candidate_v1") return await resolveRouterAbEcdsaExhaustedCandidateAuthorization({
+		materialRead: validated.materialRead,
+		policyRead: validated.policyRead,
+		phase: input.phase,
+		request: parsedRequest,
+		candidate: validated.candidate,
+		admissionAdapter: input.admissionAdapter,
+		resolveEcdsaMaterialActivation: input.resolveEcdsaMaterialActivation
+	});
 	const session = validated.admission.context.authorization.session;
 	const authorized = await authorizeRouterAbEcdsaWalletSessionRequest({
+		materialRead: validated.materialRead,
+		policyRead: validated.policyRead,
 		phase: input.phase,
-		body: input.body,
+		request: parsedRequest,
 		session,
 		admittedMaterialActivation: routerAbMpcMaterialActivationRefToWire(validated.admission.admission.materialActivation),
 		admissionAdapter: input.admissionAdapter,
@@ -727,18 +742,13 @@ async function handleRouterAbEcdsaDerivationNormalSigningRouteCore(input) {
 		headers: input.headers
 	});
 	if (!input.authorizedOperations) return routerAbStepUpError(501, "not_configured", "Reusable Wallet Session authorization is not configured");
+	const request = parseRouterAbEcdsaOperationStepUpRequest(input);
 	const claimed = await admitRouterAbEcdsaReusableWalletSessionOperation({
-		request: parseRouterAbEcdsaOperationStepUpRequest(input),
-		materialActivation: authorization.admission.materialActivation,
-		binding: authorization.kind === "wallet_session_operation_credential_v1" ? {
-			kind: "wallet_session_operation_credential_v1",
-			context: authorization.validated.admission.context
-		} : {
-			kind: "wallet_session_operation_credential_exhausted_candidate_v1",
-			candidate: authorization.candidate
-		},
-		authorizedOperations: input.authorizedOperations,
-		resolveEcdsaMaterialActivation: input.resolveEcdsaMaterialActivation
+		phase: input.phase,
+		request,
+		material: authorization.activeMaterial,
+		binding: authorization,
+		authorizedOperations: input.authorizedOperations
 	});
 	if (!claimed.ok) return claimed.error;
 	if (claimed.admission.kind === "replayed") return routerAbEcdsaReplayResult(claimed.admission.operation);
@@ -746,7 +756,7 @@ async function handleRouterAbEcdsaDerivationNormalSigningRouteCore(input) {
 	if (!runtime) return routerAbEcdsaPrivateSigningWorkerUnavailableResult();
 	const signingWorker = runtime.getSigningWorkerPrivateTransport();
 	if (signingWorker.kind === "unconfigured") return routerAbEcdsaPrivateSigningWorkerUnavailableResult();
-	if (input.phase === "prepare") {
+	if (claimed.phase === "prepare") {
 		if (claimed.admission.kind === "operation_in_progress") return routerAbEcdsaOperationInProgressResult();
 		const operation = claimed.admission.operation;
 		const replay = await runtime.reservePrepareReplay({
@@ -801,7 +811,6 @@ async function handleRouterAbEcdsaDerivationNormalSigningRouteCore(input) {
 			body: forwarded.body
 		};
 	}
-	if (claimed.admission.kind === "claimed") return routerAbStepUpError(409, "authorized_operation_missing", "ECDSA finalize requires a claimed prepare operation");
 	const forwarded = await postRouterAbSigningWorkerJson({
 		config: signingWorker,
 		path: input.privatePath,

package/dist/esm/router/domains/signingOperations/routerAbNormalSigningAdmission.js

@@ -152,6 +152,7 @@ async function evaluateRouterAbNormalSigningAdmission(input) {
 	});
 	return await input.adapter.evaluatePolicy({
 		curve: "ecdsa",
+		policyReadSource: input.policyReadSource,
 		phase: input.phase,
 		walletId: input.walletId,
 		materialActivationId: requireMpcMaterialActivationId(input.admission.materialActivation.activation_id),

package/dist/esm/router/domains/signingOperations/routerAbOperationStepUp.js

@@ -230,6 +230,7 @@ async function authenticateRouterAbWalletOperationStepUpIdentity(input) {
 		if (admission.curve === "ecdsa" && input.keyFamily === "ecdsa_secp256k1") {
 			const active = ecdsaStepUpActiveMaterial({
 				activeMaterial: await input.resolveEcdsaMaterialActivation({
+					source: { kind: "database" },
 					walletId: input.walletId,
 					materialActivation: admittedMaterialActivation
 				}),

package/dist/esm/router/domains/signingOperations/routerAbPrivateSigningWorker.js

@@ -47,18 +47,6 @@ function registrationMaterialSourceV1(input) {
 		}
 	};
 }
-function routerAbNormalSigningMaterialSourceFromActiveLaneV1(input) {
-	const groupPublicKey = input.groupPublicKey.trim();
-	if (groupPublicKey.length === 0) throw new Error("active lane group public key is required");
-	return {
-		kind: "rotatable_lane",
-		lookup: {
-			identity: input.identity,
-			admittedLaneIdentityDigestB64u: input.admittedLaneIdentityDigestB64u
-		},
-		group_public_key: groupPublicKey
-	};
-}
 function nonEmptyString(value) {
 	return String(value || "").trim();
 }
@@ -395,7 +383,7 @@ async function buildRouterAbEd25519PrivateSigningWorkerBody(input) {
 	const scope = parseRouterAbEd25519NormalSigningScopeV2(input.body.scope);
 	const signingContext = privateSigningAuthorizationContext(scope, input.authorization);
 	const trustedSourceDigest = await privateSigningTrustedSourceDigest(input.headers);
-	const materialSource = input.materialSource ?? registrationMaterialSourceV1({
+	const materialSource = registrationMaterialSourceV1({
 		accountId: scope.account_id,
 		materialActivationId: scope.material_activation.activation_id,
 		signingWorkerId: scope.signing_worker_id
@@ -490,8 +478,7 @@ async function buildRouterAbEcdsaDerivationPrivateSigningWorkerBody(input) {
 			request,
 			requestDigest: await routerAbEcdsaDerivationEvmDigestSigningRequestDigestV1(request),
 			signingContext,
-			trustedSourceDigest,
-			materialSource: input.materialSource
+			trustedSourceDigest
 		});
 	}
 	const request = parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1(input.body);
@@ -500,8 +487,7 @@ async function buildRouterAbEcdsaDerivationPrivateSigningWorkerBody(input) {
 		request,
 		requestDigest: await routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestDigestV1(request),
 		signingContext,
-		trustedSourceDigest,
-		materialSource: input.materialSource
+		trustedSourceDigest
 	});
 }
 function privateEcdsaDerivationSigningWorkerBody(input) {
@@ -514,7 +500,7 @@ function privateEcdsaDerivationSigningWorkerBody(input) {
 			intentDigest: input.requestDigest,
 			trustedSourceDigest: input.trustedSourceDigest
 		}),
-		material_source: input.materialSource ?? registrationMaterialSourceV1({
+		material_source: registrationMaterialSourceV1({
 			accountId: input.request.scope.wallet_id,
 			materialActivationId: input.request.scope.material_activation.activation_id,
 			signingWorkerId: input.request.scope.signing_worker.server_id
@@ -544,6 +530,6 @@ async function postRouterAbSigningWorkerJson(input) {
 	};
 }
 //#endregion
-export { ROUTER_AB_ECDSA_DERIVATION_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_PRIVATE_SIGNING_PATHS, buildRouterAbEcdsaDerivationPrivateSigningWorkerBody, buildRouterAbEd25519PrivateSigningWorkerBody, computeRouterAbEd25519NormalSigningAdmissionMaterial, isRouterAbEcdsaSigningWorkerOperationInProgress, parseRouterAbEd25519NormalSigningScopeV2, postRouterAbSigningWorkerJson, replayResponseFromSigningWorkerResult, requirePrivateSigningDigest, routerAbNormalSigningMaterialSourceFromActiveLaneV1 };
+export { ROUTER_AB_ECDSA_DERIVATION_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_PRIVATE_SIGNING_PATHS, buildRouterAbEcdsaDerivationPrivateSigningWorkerBody, buildRouterAbEd25519PrivateSigningWorkerBody, computeRouterAbEd25519NormalSigningAdmissionMaterial, isRouterAbEcdsaSigningWorkerOperationInProgress, parseRouterAbEd25519NormalSigningScopeV2, postRouterAbSigningWorkerJson, replayResponseFromSigningWorkerResult, requirePrivateSigningDigest };
 
 //# sourceMappingURL=routerAbPrivateSigningWorker.js.map

package/dist/esm/router/domains/signingOperations/walletExecutionAdmission.js

@@ -1,8 +1,8 @@
 import { mpcMaterialActivationRefsEqual } from "../../../shared-ts/src/utils/domainIds.js";
 import { CAPABILITY_KINDS, EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS } from "../../../shared-ts/src/authorization/capabilityKinds.js";
 import { buildWalletSessionCapabilitySubjectsV1, walletSessionCapabilitySubjectsV1Equal } from "../../../authorization/domain.js";
-import { computeOwnerLaneParticipantBindingDigestV1 } from "../../../shared-ts/src/signing-lanes/ownerContinuity.js";
 import { buildPreparedOwnerWalletExecution } from "../../../shared-ts/src/signing-lanes/execution.js";
+import { computeOwnerLaneParticipantBindingDigestV1 } from "../../../shared-ts/src/signing-lanes/ownerContinuity.js";
 import "../../../shared-ts/src/signing-lanes/index.js";
 //#region src/router/domains/signingOperations/walletExecutionAdmission.ts
 function validateWalletSessionAuthorizationV2Context(input) {
@@ -74,8 +74,7 @@ function resolveWalletSessionAuthorizationV2AdministrationAdmission(input) {
 			if (!subject || subject.authorityId !== input.authority.authorityId) return admissionRefused("capability_subject_mismatch");
 			return {
 				ok: true,
-				operationKind: "link_devices",
-				authorityId: input.authority.authorityId
+				operationKind: "link_devices"
 			};
 		}
 		default: return assertNeverWalletSessionAuthorizationV2AdministrationOperation(input.operation.kind);
@@ -165,7 +164,7 @@ async function prepareOwnerWalletExecution(input) {
 	if (lane.walletKeyId !== input.evidence.walletKey.walletKeyId) return refused("wallet_key_mismatch");
 	if (!operationMatchesWalletKey(input.authorizedOperation, input.evidence.walletKey)) return refused("curve_mismatch");
 	if (String(claimedOperation.operation.capabilityId) !== String(input.evidence.materialActivation.capability)) return refused("capability_mismatch");
-	if (!sameMaterialActivation(input.evidence.materialActivation, input.evidence.expectedMaterialActivation)) return refused("material_activation_mismatch");
+	if (!mpcMaterialActivationRefsEqual(input.evidence.materialActivation, input.evidence.expectedMaterialActivation)) return refused("material_activation_mismatch");
 	if (lane.participantBindingDigestB64u !== input.evidence.verifiedLaneParticipantBindingDigestB64u || String(lane.ownerParticipantContinuity.signingWorkerId) !== String(input.evidence.materialActivation.signingWorker)) return refused("participant_binding_mismatch");
 	if (await computeOwnerLaneParticipantBindingDigestV1(lane.ownerParticipantContinuity) !== lane.participantBindingDigestB64u) return refused("participant_binding_mismatch");
 	if (lane.lifecycle.activationReceiptDigestB64u !== input.evidence.verifiedActivationReceiptDigestB64u) return refused("activation_receipt_mismatch");
@@ -213,9 +212,6 @@ function operationMatchesWalletKey(operation, walletKey) {
 		case "ecdsa_secp256k1": return operation.operation.operation.capabilityKind === CAPABILITY_KINDS.evmEcdsaMpcSigning;
 	}
 }
-function sameMaterialActivation(left, right) {
-	return left.activationId === right.activationId && left.capability === right.capability && left.materialOwner === right.materialOwner && left.keyBinding === right.keyBinding && left.lifecycleBinding === right.lifecycleBinding && left.signingWorker === right.signingWorker;
-}
 function refused(reason) {
 	return {
 		kind: "refused",