@seams/wallet-server 0.7.1 → 0.8.0

package/dist/esm/router/transport/fetch/routes/ecdsaOperationStepUpFactor.js

@@ -0,0 +1,171 @@
+import { parseEmailOtpChallengeId, parseOrgId, parseProviderSubject } from "../../../../shared-ts/src/utils/domainIds.js";
+import { parseAuthFactorId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
+import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import "../../../../shared-ts/src/utils/encoders.js";
+import { buildVerifiedWalletOperationEmailOtpFactorResult, buildVerifiedWalletOperationPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
+import { json } from "../../../framework/http.js";
+import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
+//#region src/router/transport/fetch/routes/ecdsaOperationStepUpFactor.ts
+async function verifyEcdsaOperationStepUpFactor(input) {
+	const proof = input.proof;
+	switch (proof.kind) {
+		case "passkey": {
+			if (input.authSource.kind !== "passkey" || proof.authority.factor.credentialIdB64u !== input.authSource.credentialIdB64u) return {
+				ok: false,
+				response: json({
+					ok: false,
+					code: "scope_mismatch",
+					message: "Passkey authority changed"
+				}, { status: 403 })
+			};
+			const credential = proof.webauthn_authentication;
+			if (String(credential.rawId || credential.id).trim() !== input.authSource.credentialIdB64u) return {
+				ok: false,
+				response: json({
+					ok: false,
+					code: "unauthorized",
+					message: "Passkey credential changed"
+				}, { status: 401 })
+			};
+			const verified = await input.webAuthn.verifyWebAuthnAuthenticationLite({
+				userId: input.walletId,
+				rpId: proof.authority.verifier.rpId,
+				expectedChallenge: input.expectedChallenge,
+				expected_origin: input.requestOrigin,
+				webauthn_authentication: credential
+			});
+			if (!verified.success || !verified.verified) return {
+				ok: false,
+				response: json({
+					ok: false,
+					code: verified.code || "not_verified",
+					message: verified.message || "WebAuthn authentication verification failed"
+				}, { status: 401 })
+			};
+			const assertionDigest = parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(credential))));
+			const verifiedAtMs = Date.now();
+			if (input.expiresAtMs <= verifiedAtMs) return expiredStepUpFactor();
+			const factorId = parseAuthFactorId(`passkey:${input.authSource.credentialIdB64u}`);
+			if (!factorId.ok) throw new Error(factorId.error.message);
+			return {
+				ok: true,
+				factor: buildVerifiedWalletOperationPasskeyFactorResult({
+					tenantId: input.operation.tenantId,
+					principalId: input.operation.principalId,
+					walletId: input.walletId,
+					requestOrigin: input.requestOrigin,
+					audience: input.requestOrigin,
+					factorId: factorId.value,
+					authorityRef: input.authorityRef,
+					operation: input.operation,
+					credentialIdB64u: proof.authority.factor.credentialIdB64u,
+					assertionDigest,
+					verifiedAtMs,
+					expiresAtMs: input.expiresAtMs
+				}),
+				unseal: { kind: "not_requested" }
+			};
+		}
+		case "email_otp": {
+			const isExport = input.operation.operation.operationKind === "evm.export_key";
+			const emailOtpOperation = isExport ? WALLET_EMAIL_OTP_EXPORT_OPERATION : WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION;
+			const operationBinding = await hashEmailOtpOperationBinding({
+				walletId: input.walletId,
+				providerUserId: proof.authority.factor.providerUserId,
+				orgId: input.operation.tenantId,
+				operation: emailOtpOperation,
+				requestOrigin: input.requestOrigin,
+				audience: input.requestOrigin,
+				authorityRef: input.authorityRef,
+				...isExport ? {} : { operationFingerprintDigest: input.operation.digests.laneDigest }
+			});
+			const verified = await input.emailOtp.verifyEmailOtpChallenge({
+				userId: proof.authority.factor.providerUserId,
+				walletId: input.walletId,
+				orgId: input.operation.tenantId,
+				challengeId: proof.challenge_id,
+				otpCode: proof.otp_code,
+				otpChannel: EMAIL_OTP_CHANNEL,
+				ownerProofBindingDigest: operationBinding,
+				operation: emailOtpOperation
+			});
+			if (!verified.ok) return {
+				ok: false,
+				response: json(verified, { status: verified.code === "invalid_body" ? 400 : 401 })
+			};
+			let verifiedChallengeId = verified.challengeId;
+			if (!isExport) {
+				const orgId = parseOrgId(input.operation.tenantId);
+				const providerSubject = parseProviderSubject(proof.authority.factor.providerUserId);
+				if (!orgId.ok) throw new Error(orgId.error.message);
+				if (!providerSubject.ok) throw new Error(providerSubject.error.message);
+				const consumed = await input.emailOtp.consumeEmailOtpGrant({
+					subject: {
+						kind: "provider_identity",
+						orgId: orgId.value,
+						providerSubject: providerSubject.value,
+						walletId: input.walletId
+					},
+					loginGrant: verified.loginGrant,
+					otpChannel: EMAIL_OTP_CHANNEL
+				});
+				if (!consumed.ok) return {
+					ok: false,
+					response: json(consumed, { status: consumed.code === "invalid_body" ? 400 : 401 })
+				};
+				verifiedChallengeId = consumed.challengeId;
+			}
+			const verificationReceiptDigest = parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
+				challengeId: verifiedChallengeId,
+				operationFingerprint: input.expectedChallenge
+			}))));
+			const verifiedAtMs = Date.now();
+			const expiresAtMs = Math.min(input.expiresAtMs, verified.grantExpiresAtMs);
+			if (expiresAtMs <= verifiedAtMs) return expiredStepUpFactor();
+			const factorId = parseAuthFactorId(`email_otp:${proof.authority.factor.provider}:${proof.authority.factor.providerUserId}`);
+			const challengeId = parseEmailOtpChallengeId(verifiedChallengeId);
+			if (!factorId.ok) throw new Error(factorId.error.message);
+			if (!challengeId.ok) throw new Error(challengeId.error.message);
+			return {
+				ok: true,
+				factor: buildVerifiedWalletOperationEmailOtpFactorResult({
+					tenantId: input.operation.tenantId,
+					principalId: input.operation.principalId,
+					walletId: input.walletId,
+					requestOrigin: input.requestOrigin,
+					audience: input.requestOrigin,
+					factorId: factorId.value,
+					authorityRef: input.authorityRef,
+					operation: input.operation,
+					challengeId: challengeId.value,
+					verificationReceiptDigest,
+					verifiedAtMs,
+					expiresAtMs
+				}),
+				unseal: isExport ? {
+					kind: "email_otp_grant",
+					grant: verified.loginGrant,
+					challenge_id: verified.challengeId
+				} : { kind: "not_requested" }
+			};
+		}
+		default: throw new Error("Unsupported ECDSA operation step-up proof");
+	}
+}
+function expiredStepUpFactor() {
+	return {
+		ok: false,
+		response: json({
+			ok: false,
+			code: "verified_step_up_rejected",
+			message: "Operation step-up authorization expired"
+		}, { status: 403 })
+	};
+}
+//#endregion
+export { verifyEcdsaOperationStepUpFactor };
+
+//# sourceMappingURL=ecdsaOperationStepUpFactor.js.map

package/dist/esm/router/transport/fetch/routes/passkeyCustody.js

@@ -652,6 +652,7 @@ async function handleWalletRecoveryPrepare(ctx) {
 			case "refused": return toFetchRouteResponse(refusedSpend());
 			case "reserved":
 			case "consumed": return routeErrorResponse(401, "recovery_code_used", "that recovery code has already been used");
+			case "routing_unavailable": return routeErrorResponse(503, "wallet_home_unavailable", "Wallet recovery routing is temporarily unavailable");
 			case "manifest_unavailable":
 			case "registration_unavailable": return routeErrorResponse(409, "recovery_preparation_conflict", "wallet recovery could not be prepared");
 		}

package/dist/esm/router/transport/fetch/routes/sessions.js

@@ -123,6 +123,7 @@ async function resolveWalletEmailOtpChallengeSignerSelection(args) {
 		};
 	}
 	const resolved = await args.ctx.service.walletRegistration.resolveEcdsaMaterialActivation({
+		source: { kind: "database" },
 		walletId: String(args.authority.walletId),
 		materialActivation: routerAbMpcMaterialActivationRefToWire(ecdsaActivation.materialActivation)
 	});

package/dist/esm/router/transport/fetch/routes/syncAccount.js

@@ -6,14 +6,19 @@ import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAu
 import { parseSessionOrigin, parseVerifiedOwnerProofId } from "../../../../authorization/domain.js";
 import { buildVerifiedWalletSessionPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
 import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
-import { json, readJson } from "../../../framework/http.js";
+import { json, jsonFailure, readJson } from "../../../framework/http.js";
 import { parseSyncAccountOptionsRequest, parseSyncAccountVerifyRequest } from "../../../domains/syncAccount/syncAccountRequestValidation.js";
 import { DEFAULT_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
 import { issueSyncAccountBootstrapV1 } from "./syncAccountBootstrap.js";
 //#region src/router/transport/fetch/routes/syncAccount.ts
 function syncAccountResponseStatus(result) {
 	if (result.ok && result.verified) return 200;
-	switch (result.code) {
+	return syncAccountFailureStatus(result.code);
+}
+function syncAccountFailureStatus(code) {
+	switch (code) {
+		case "wallet_home_unavailable": return 503;
+		case "wallet_home_conflict": return 409;
 		case "internal": return 500;
 		case "ed25519_not_provisioned": return 409;
 		default: return 400;
@@ -43,7 +48,7 @@ async function handleSyncAccount(ctx) {
 		const parsed = parseSyncAccountOptionsRequest(await readJson(ctx.request));
 		if (!parsed.ok) return json(parsed.body, { status: parsed.status });
 		const result = await ctx.service.webAuthn.createWebAuthnSyncAccountOptions(parsed.request);
-		return json(result, { status: result.ok ? 200 : result.code === "internal" ? 500 : 400 });
+		return json(result, { status: result.ok ? 200 : syncAccountFailureStatus(result.code) });
 	}
 	if (ctx.pathname === "/sync-account/verify") {
 		const parsed = parseSyncAccountVerifyRequest({
@@ -55,11 +60,7 @@ async function handleSyncAccount(ctx) {
 		let responseBody = result;
 		if (result.ok && result.verified && result.thresholdEd25519) {
 			const custodyKeyManifestDigestB64u = result.custodyKeyManifestDigestB64u;
-			if (!custodyKeyManifestDigestB64u) return json({
-				ok: false,
-				code: "internal",
-				message: "Sync verification did not resolve the wallet key manifest"
-			}, { status: 500 });
+			if (!custodyKeyManifestDigestB64u) return jsonFailure(500, "internal", "Sync verification did not resolve the wallet key manifest");
 			const thresholdEd25519 = result.thresholdEd25519;
 			const walletId = String(result.walletId || "").trim();
 			const nearAccountId = String(result.nearAccountId || "").trim();
@@ -67,11 +68,7 @@ async function handleSyncAccount(ctx) {
 			const signerSlot = Number(result.signerSlot);
 			const walletBinding = result.walletBinding;
 			const credentialIdB64u = String(result.credentialIdB64u || "").trim();
-			if (!thresholdEd25519 || !walletId || !nearAccountId || !nearEd25519SigningKeyId || !Number.isSafeInteger(signerSlot) || signerSlot < 1 || !walletBinding || !credentialIdB64u || !String(result.publicKey || "").trim() || !String(result.credentialPublicKeyB64u || "").trim() || String(walletBinding.walletId) !== walletId || String(walletBinding.nearAccountId) !== nearAccountId || String(walletBinding.nearEd25519SigningKeyId) !== nearEd25519SigningKeyId || walletBinding.signerSlot !== signerSlot) return json({
-				ok: false,
-				code: "internal",
-				message: "verified passkey wallet is missing its Ed25519 Yao identity"
-			}, { status: 500 });
+			if (!thresholdEd25519 || !walletId || !nearAccountId || !nearEd25519SigningKeyId || !Number.isSafeInteger(signerSlot) || signerSlot < 1 || !walletBinding || !credentialIdB64u || !String(result.publicKey || "").trim() || !String(result.credentialPublicKeyB64u || "").trim() || String(walletBinding.walletId) !== walletId || String(walletBinding.nearAccountId) !== nearAccountId || String(walletBinding.nearEd25519SigningKeyId) !== nearEd25519SigningKeyId || walletBinding.signerSlot !== signerSlot) return jsonFailure(500, "internal", "verified passkey wallet is missing its Ed25519 Yao identity");
 			const authority = passkeyWalletAuthAuthorityForMethod({
 				walletId: walletBinding.walletId,
 				rpId: walletBinding.rpId,
@@ -83,29 +80,17 @@ async function handleSyncAccount(ctx) {
 				rpId: authority.verifier.rpId,
 				credentialIdB64u: authority.factor.credentialIdB64u
 			});
-			if (!activeAuthority.ok || activeAuthority.walletAuthority.authorityId !== result.walletAuthorityId || activeAuthority.authMethod.walletAuthMethodId !== result.walletAuthMethodId) return json({
-				ok: false,
-				code: "internal",
-				message: "Verified passkey wallet authority is unavailable"
-			}, { status: 500 });
+			if (!activeAuthority.ok || activeAuthority.walletAuthority.authorityId !== result.walletAuthorityId || activeAuthority.authMethod.walletAuthMethodId !== result.walletAuthMethodId) return jsonFailure(500, "internal", "Verified passkey wallet authority is unavailable");
 			const authorityRef = await walletAuthAuthorityRef({ authority });
 			const principalId = parsePrincipalId(walletId);
 			const mintId = parseWalletSessionMintId(parsed.request.challengeId);
-			if (!principalId.ok || !mintId.ok) return json({
-				ok: false,
-				code: "internal",
-				message: "Verified passkey Wallet Session identity is invalid"
-			}, { status: 500 });
+			if (!principalId.ok || !mintId.ok) return jsonFailure(500, "internal", "Verified passkey Wallet Session identity is invalid");
 			const issuedAtMs = Date.now();
 			const expiresAtMs = issuedAtMs + DEFAULT_WALLET_SESSION_TTL_MS;
 			const origin = parseSessionOrigin(parsed.request.expected_origin);
 			const factorId = parseAuthFactorId(`passkey:${credentialIdB64u}`);
 			const credentialId = parseWebAuthnCredentialIdB64u(credentialIdB64u);
-			if (!factorId.ok || !credentialId.ok) return json({
-				ok: false,
-				code: "internal",
-				message: "Verified passkey factor identity is invalid"
-			}, { status: 500 });
+			if (!factorId.ok || !credentialId.ok) return jsonFailure(500, "internal", "Verified passkey factor identity is invalid");
 			const proof = await ctx.service.authorizedOperations.buildVerifiedOwnerProof({
 				purpose: "wallet_session",
 				proofId: parseVerifiedOwnerProofId(`sync-account:${parsed.request.challengeId}`),
@@ -123,11 +108,7 @@ async function handleSyncAccount(ctx) {
 					expiresAtMs
 				})
 			});
-			if (proof.purpose !== "wallet_session") return json({
-				ok: false,
-				code: "internal",
-				message: "Owner proof purpose is invalid"
-			}, { status: 500 });
+			if (proof.purpose !== "wallet_session") return jsonFailure(500, "internal", "Owner proof purpose is invalid");
 			const bootstrap = await issueSyncAccountBootstrapV1({
 				ctx,
 				result: {
@@ -168,11 +149,7 @@ async function handleSyncAccount(ctx) {
 				message: "Wallet Session sync is already committed; retry the exact method",
 				...bootstrap.committed
 			}, { status: 409 });
-			if (bootstrap.kind === "error") return json({
-				ok: false,
-				code: bootstrap.code,
-				message: bootstrap.message
-			}, { status: bootstrap.status });
+			if (bootstrap.kind === "error") return jsonFailure(bootstrap.status, bootstrap.code, bootstrap.message);
 			responseBody = bootstrap.body;
 		}
 		return json(responseBody, { status: syncAccountResponseStatus(result) });

package/dist/esm/router/transport/fetch/routes/thresholdEcdsa.js

@@ -1,7 +1,6 @@
-import { parseEmailOtpChallengeId, parseOrgId, parseProviderSubject, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { EVM_ECDSA_MPC_OPERATION_KINDS, buildEvmEcdsaMpcOperationRef, parseAuthFactorId, parseAuthorizationAuditEventId, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parseEcdsaAuthorizationSessionId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { EVM_ECDSA_MPC_OPERATION_KINDS, buildEvmEcdsaMpcOperationRef, parseAuthorizationAuditEventId, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parseEcdsaAuthorizationSessionId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { buildCapabilityOperationEnvelope } from "../../../../shared-ts/src/authorization/operationFingerprint.js";
 import "../../../../shared-ts/src/utils/encoders.js";
@@ -9,20 +8,18 @@ import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivati
 import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1, ROUTER_AB_ECDSA_DERIVATION_REFRESH_PATH, computeRouterAbEcdsaOperationStepUpChallengeB64u, parseRouterAbEcdsaDerivationActivationRefreshCommitRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1, parseRouterAbEcdsaDerivationExplicitExportRequestV1, parseRouterAbEcdsaOperationStepUpAuthorizationRequestV1, parseRouterAbEcdsaPostRegistrationSessionActivationRequestV1, parseRouterAbEcdsaPrepareSourceV1, sameRouterAbEcdsaDerivationNormalSigningScopeV1, sameRouterAbEcdsaDerivationPublicCapabilityV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { buildWalletSessionCapabilitySubjectsV1, projectActiveWalletSession } from "../../../../authorization/domain.js";
-import { buildVerifiedWalletOperationEmailOtpFactorResult, buildVerifiedWalletOperationPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
 import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { WALLET_SESSION_FAILURE_CODES } from "../../../../shared-ts/src/utils/walletSessionFailure.js";
 import { json, readJson } from "../../../framework/http.js";
 import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
 import { walletSessionFailure, walletSessionFailureStatus } from "../../../auth/walletSessionFailure.js";
 import { resolveWalletSessionOperationCredentialAdmission, validateEcdsaPreprocessingSession } from "../../../auth/commonRouterUtils.js";
-import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { thresholdEcdsaStatusCode } from "../../../../threshold/statusCodes.js";
 import { parseEcdsaServerTiming } from "../../../../shared-ts/src/utils/ecdsaServerTiming.js";
 import { authenticateRouterAbWalletOperationStepUpIdentity } from "../../../domains/signingOperations/routerAbOperationStepUp.js";
 import { admitRouterAbEcdsaReusableWalletSessionOperation, authenticateRouterAbEcdsaOperationStepUp, authorizeRouterAbEcdsaDerivationNormalSigningRoute, buildRouterAbEcdsaOwnerOperationStepUpPreparation, claimRouterAbEcdsaOperationStepUp, completeRouterAbEcdsaOperation, decideRouterAbEcdsaOwnerOperationAuthorization, resolveFreshRouterAbEcdsaMaterialActivation, routerAbEcdsaAtomicAuthorizationConfigured, routerAbEcdsaOperationInProgressResult, routerAbEcdsaOwnerOperationFailureResult, routerAbEcdsaReplayHttpResponse, routerAbEcdsaReplayUnavailableResult } from "../../../domains/signingOperations/routerAbEcdsaDerivationNormalSigningRoute.js";
 import { parseRouterAbEcdsaDerivationPoolFillInitRouteRequest, parseRouterAbEcdsaDerivationPoolFillStepRouteRequest } from "../../../domains/ecdsa/thresholdEcdsaRequestValidation.js";
+import { verifyEcdsaOperationStepUpFactor } from "./ecdsaOperationStepUpFactor.js";
 import { resolveWalletAuthMethodIdForAuthority } from "../../../../core/signingLanes/WalletExecutionLaneProjection.js";
 import { proxyNormalSigningRequestToMpcRouter, proxyOwnerLaneAdmittedNormalSigningRequest } from "./normalSigningRouterProxy.js";
 //#region src/router/transport/fetch/routes/thresholdEcdsa.ts
@@ -236,18 +233,13 @@ async function executeRouterAbEcdsaDerivationNormalSigningRoute(input, timing) {
 			binding: await ecdsaOperationStepUpBinding(input.ctx, authorization.session, authorizedOperation)
 		});
 	} else {
+		const request = input.phase === "prepare" ? parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1(input.body) : parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1(input.body);
 		const operation = await admitRouterAbEcdsaReusableWalletSessionOperation({
-			request: input.phase === "prepare" ? parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1(input.body) : parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1(input.body),
-			materialActivation: authorization.admission.materialActivation,
-			binding: authorization.kind === "wallet_session_operation_credential_v1" ? {
-				kind: "wallet_session_operation_credential_v1",
-				context: authorization.validated.admission.context
-			} : {
-				kind: "wallet_session_operation_credential_exhausted_candidate_v1",
-				candidate: authorization.candidate
-			},
-			authorizedOperations: input.ctx.service.authorizedOperations,
-			resolveEcdsaMaterialActivation: input.ctx.service.walletRegistration.resolveEcdsaMaterialActivation.bind(input.ctx.service.walletRegistration)
+			phase: input.phase,
+			request,
+			material: authorization.activeMaterial,
+			binding: authorization,
+			authorizedOperations: input.ctx.service.authorizedOperations
 		});
 		if (!operation.ok) {
 			const failureBody = operation.error.body;
@@ -273,11 +265,6 @@ async function executeRouterAbEcdsaDerivationNormalSigningRoute(input, timing) {
 			return json(failure.body, { status: failure.status });
 		}
 		if (operation.admission.kind === "replayed") return routerAbEcdsaReplayResponse(operation.admission.operation);
-		if (operation.admission.kind === "claimed" && input.phase === "finalize") return json({
-			ok: false,
-			code: "authorized_operation_missing",
-			message: "ECDSA finalize requires a claimed prepare operation"
-		}, { status: 409 });
 		const ownerDecision = decideRouterAbEcdsaOwnerOperationAuthorization({ operation: operation.admission.operation });
 		switch (ownerDecision.kind) {
 			case "authorized": break;
@@ -502,6 +489,7 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 		message: v2Resolution.message
 	}, { status: 403 });
 	const activeMaterial = v2Resolution.kind === "admitted" ? v2Resolution.activeMaterial : await input.ctx.service.walletRegistration.resolveEcdsaMaterialActivation({
+		source: { kind: "database" },
 		walletId: operation.wallet_id,
 		materialActivation: operation.material_activation
 	});
@@ -591,7 +579,6 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 		}, { status: 400 });
 	}
 	const expectedChallenge = await computeRouterAbEcdsaOperationStepUpChallengeB64u(operation);
-	const nowMs = Date.now();
 	const requestId = operation.operation_id;
 	let freshMaterial;
 	if (v2Resolution.kind === "admitted") {
@@ -632,112 +619,24 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 	const evidenceSetId = requireAuthorizationValue(parseAuthorizationEvidenceSetId(`ecdsa-step-up-evidence-set:${requestId}`));
 	const expiresAtMs = operation.expires_at_ms;
 	const requestOrigin = authenticated.requestOrigin;
-	let emailOtpUnseal;
-	let factor;
-	switch (proof.kind) {
-		case "passkey": {
-			if (authenticated.session.laneAuthorization.authSource.kind !== "passkey" || proof.authority.factor.credentialIdB64u !== authenticated.session.laneAuthorization.authSource.credentialIdB64u) return json({
-				ok: false,
-				code: "scope_mismatch",
-				message: "Passkey authority changed"
-			}, { status: 403 });
-			const credential = proof.webauthn_authentication;
-			if (String(credential.rawId || credential.id).trim() !== authenticated.session.laneAuthorization.authSource.credentialIdB64u) return json({
-				ok: false,
-				code: "unauthorized",
-				message: "Passkey credential changed"
-			}, { status: 401 });
-			const verified = await input.ctx.service.webAuthn.verifyWebAuthnAuthenticationLite({
-				userId: authenticated.session.walletId,
-				rpId: proof.authority.verifier.rpId,
-				expectedChallenge,
-				expected_origin: requestOrigin,
-				webauthn_authentication: credential
-			});
-			if (!verified.success || !verified.verified) return json({
-				ok: false,
-				code: verified.code || "not_verified",
-				message: verified.message || "WebAuthn authentication verification failed"
-			}, { status: 401 });
-			factor = buildVerifiedWalletOperationPasskeyFactorResult({
-				tenantId: authenticated.session.tenantId,
-				principalId: authenticated.session.principalId,
-				walletId: walletIdFromString(authenticated.session.walletId),
-				requestOrigin,
-				audience: requestOrigin,
-				factorId: requireAuthorizationValue(parseAuthFactorId(`passkey:${authenticated.session.laneAuthorization.authSource.credentialIdB64u}`)),
-				authorityRef: authenticated.authorityRef,
-				operation: envelope,
-				credentialIdB64u: proof.authority.factor.credentialIdB64u,
-				assertionDigest: parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(credential)))),
-				verifiedAtMs: nowMs,
-				expiresAtMs
-			});
-			break;
-		}
-		case "email_otp": {
-			const operationBinding = await hashEmailOtpOperationBinding({
-				walletId: authenticated.session.walletId,
-				providerUserId: proof.authority.factor.providerUserId,
-				orgId: authenticated.session.tenantId,
-				operation: operation.operation_kind === "evm.export_key" ? WALLET_EMAIL_OTP_EXPORT_OPERATION : WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION,
-				requestOrigin,
-				audience: requestOrigin,
-				authorityRef: authenticated.authorityRef,
-				...operation.operation_kind === "evm.sign_transaction" ? { operationFingerprintDigest: envelope.digests.laneDigest } : {}
-			});
-			const verified = await input.ctx.service.emailOtp.verifyEmailOtpChallenge({
-				userId: proof.authority.factor.providerUserId,
-				walletId: authenticated.session.walletId,
-				orgId: authenticated.session.tenantId,
-				challengeId: proof.challenge_id,
-				otpCode: proof.otp_code,
-				otpChannel: EMAIL_OTP_CHANNEL,
-				ownerProofBindingDigest: operationBinding,
-				operation: operation.operation_kind === "evm.export_key" ? WALLET_EMAIL_OTP_EXPORT_OPERATION : WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION
-			});
-			if (!verified.ok) return json(verified, { status: verified.code === "invalid_body" ? 400 : 401 });
-			const consumed = operation.operation_kind === "evm.export_key" ? null : await input.ctx.service.emailOtp.consumeEmailOtpGrant({
-				subject: {
-					kind: "provider_identity",
-					orgId: requireAuthorizationValue(parseOrgId(authenticated.session.tenantId)),
-					providerSubject: requireAuthorizationValue(parseProviderSubject(proof.authority.factor.providerUserId)),
-					walletId: walletIdFromString(authenticated.session.walletId)
-				},
-				loginGrant: verified.loginGrant,
-				otpChannel: EMAIL_OTP_CHANNEL
-			});
-			if (consumed && !consumed.ok) return json(consumed, { status: consumed.code === "invalid_body" ? 400 : 401 });
-			if (operation.operation_kind === "evm.export_key") emailOtpUnseal = {
-				grant: verified.loginGrant,
-				challengeId: verified.challengeId
-			};
-			const verifiedChallengeId = consumed?.ok ? consumed.challengeId : verified.challengeId;
-			factor = buildVerifiedWalletOperationEmailOtpFactorResult({
-				tenantId: authenticated.session.tenantId,
-				principalId: authenticated.session.principalId,
-				walletId: walletIdFromString(authenticated.session.walletId),
-				requestOrigin,
-				audience: requestOrigin,
-				factorId: requireAuthorizationValue(parseAuthFactorId(`email_otp:${proof.authority.factor.provider}:${proof.authority.factor.providerUserId}`)),
-				authorityRef: authenticated.authorityRef,
-				operation: envelope,
-				challengeId: requireAuthorizationValue(parseEmailOtpChallengeId(verifiedChallengeId)),
-				verificationReceiptDigest: parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
-					challengeId: verifiedChallengeId,
-					operationFingerprint: expectedChallenge
-				})))),
-				verifiedAtMs: nowMs,
-				expiresAtMs: Math.min(expiresAtMs, verified.grantExpiresAtMs)
-			});
-			break;
-		}
-	}
+	const verifiedFactor = await verifyEcdsaOperationStepUpFactor({
+		proof,
+		operation: envelope,
+		walletId: walletIdFromString(authenticated.session.walletId),
+		authorityRef: authenticated.authorityRef,
+		authSource: authenticated.session.laneAuthorization.authSource,
+		requestOrigin,
+		expectedChallenge,
+		expiresAtMs,
+		webAuthn: input.ctx.service.webAuthn,
+		emailOtp: input.ctx.service.emailOtp
+	});
+	if (!verifiedFactor.ok) return verifiedFactor.response;
 	const evidenceSet = await input.ctx.service.authorizedOperations.recordVerifiedWalletOperationFactorEvidenceSet({
 		operation: envelope,
 		evidenceId,
 		evidenceSetId,
-		factor
+		factor: verifiedFactor.factor
 	});
 	const authorizedOperationId = requireAuthorizationValue(parseAuthorizedOperationId(`ecdsa-step-up-authorized-operation:${operation.operation_id}`));
 	const atomicOperation = await input.ctx.service.authorizedOperations.admitAuthorizedOperation({
@@ -751,7 +650,7 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 				evidenceSetDigest: evidenceSet.evidenceSetDigest
 			},
 			quota: { kind: "quota_neutral" },
-			claimedAtMs: nowMs
+			claimedAtMs: Date.now()
 		},
 		material: {
 			walletId: walletIdFromString(authenticated.session.walletId),
@@ -784,11 +683,7 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 	const responseAuthorization = {
 		kind: "operation_step_up",
 		evidence_set_digest: evidenceSet.evidenceSetDigest,
-		unseal: emailOtpUnseal ? {
-			kind: "email_otp_grant",
-			grant: emailOtpUnseal.grant,
-			challenge_id: emailOtpUnseal.challengeId
-		} : { kind: "not_requested" }
+		unseal: verifiedFactor.unseal
 	};
 	if (operation.operation_kind === "evm.export_key") {
 		const exportTopology = v2Resolution.kind === "admitted" && v2Resolution.operationKind === "evm.export_key" ? v2Resolution.exportTopology : await resolveStrictEcdsaExportTopology({
@@ -820,7 +715,6 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 async function handleEcdsaPoolFillRoute(input) {
 	const startedAt = performance.now();
 	const timing = {
-		queue: null,
 		authenticate: null,
 		material: null,
 		admit: null,
@@ -855,31 +749,24 @@ async function executeEcdsaPoolFillRoute(input, timing, workerTimings) {
 	const parsed = input.phase === "init" ? parseRouterAbEcdsaDerivationPoolFillInitRouteRequest(input.body) : parseRouterAbEcdsaDerivationPoolFillStepRouteRequest(input.body);
 	if (!parsed.ok) return json(parsed.body, { status: thresholdEcdsaStatusCode(parsed.body) });
 	const request = parsed.request;
-	const queuedAt = performance.now();
-	const gateTicket = await presignPriorityGate.acquire(resolvePresignTrafficClass(request.requestTag));
-	timing.queue = performance.now() - queuedAt;
-	try {
-		const authorized = await authorizeEcdsaPoolFill({
-			ctx: input.ctx,
-			request,
-			timing
-		});
-		if (!authorized.ok) return json(authorized.error.body, { status: authorized.error.status });
-		const proxyStartedAt = performance.now();
-		const result = "poolFill" in request ? await runtime.initializePoolFill({
-			binding: authorized.binding,
-			request: ecdsaPoolFillInitRuntimeRequest(request),
-			onServerTiming: collectEcdsaPresignWorkerTiming.bind(void 0, workerTimings)
-		}) : await runtime.advancePoolFill({
-			binding: authorized.binding,
-			request: ecdsaPoolFillStepRuntimeRequest(request),
-			onServerTiming: collectEcdsaPresignWorkerTiming.bind(void 0, workerTimings)
-		});
-		timing.proxy = performance.now() - proxyStartedAt;
-		return json(result, { status: thresholdEcdsaStatusCode(result) });
-	} finally {
-		gateTicket.release();
-	}
+	const authorized = await authorizeEcdsaPoolFill({
+		ctx: input.ctx,
+		request,
+		timing
+	});
+	if (!authorized.ok) return json(authorized.error.body, { status: authorized.error.status });
+	const proxyStartedAt = performance.now();
+	const result = "poolFill" in request ? await runtime.initializePoolFill({
+		binding: authorized.binding,
+		request: ecdsaPoolFillInitRuntimeRequest(request),
+		onServerTiming: collectEcdsaPresignWorkerTiming.bind(void 0, workerTimings)
+	}) : await runtime.advancePoolFill({
+		binding: authorized.binding,
+		request: ecdsaPoolFillStepRuntimeRequest(request),
+		onServerTiming: collectEcdsaPresignWorkerTiming.bind(void 0, workerTimings)
+	});
+	timing.proxy = performance.now() - proxyStartedAt;
+	return json(result, { status: thresholdEcdsaStatusCode(result) });
 }
 function poolFillMaterialActivation(request) {
 	return "poolFill" in request ? request.poolFill.scope.material_activation : null;
@@ -1018,6 +905,7 @@ async function authorizeEcdsaPoolFill(input) {
 			const admitted = validated;
 			const materialStartedAt = performance.now();
 			const activeMaterial = await input.ctx.service.walletRegistration.resolveEcdsaMaterialActivation({
+				source: { kind: "database" },
 				walletId: String(session.walletId),
 				materialActivation: routerAbMpcMaterialActivationRefToWire(admitted.materialActivation)
 			});
@@ -1106,43 +994,6 @@ function ecdsaPoolFillStepRuntimeRequest(request) {
 		...request.requestTag === void 0 ? {} : { requestTag: request.requestTag }
 	};
 }
-function resolvePresignPriorityTurn(resolve) {
-	setTimeout(resolve, 5);
-}
-function waitForPresignPriorityTurn() {
-	return new Promise(resolvePresignPriorityTurn);
-}
-var PresignPriorityGate = class {
-	constructor() {
-		this.foregroundInFlight = 0;
-		this.backgroundInFlight = 0;
-	}
-	async acquire(trafficClass) {
-		if (trafficClass === "foreground") {
-			this.foregroundInFlight += 1;
-			return this.createTicket("foreground");
-		}
-		while (!this.canRunBackgroundNow()) await waitForPresignPriorityTurn();
-		this.backgroundInFlight += 1;
-		return this.createTicket("background");
-	}
-	createTicket(trafficClass) {
-		let released = false;
-		return { release: () => {
-			if (released) return;
-			released = true;
-			if (trafficClass === "foreground") this.foregroundInFlight = Math.max(0, this.foregroundInFlight - 1);
-			else this.backgroundInFlight = Math.max(0, this.backgroundInFlight - 1);
-		} };
-	}
-	canRunBackgroundNow() {
-		return this.foregroundInFlight === 0 && this.backgroundInFlight === 0;
-	}
-};
-function resolvePresignTrafficClass(requestTag) {
-	return requestTag === "background_presign_pool_refill" ? "background" : "foreground";
-}
-const presignPriorityGate = new PresignPriorityGate();
 function strictEcdsaAuthorizationFailureStatus(failure) {
 	switch (failure.code) {
 		case "unauthorized": return 401;
@@ -1525,6 +1376,7 @@ async function authorizeStrictEcdsaExport(input) {
 			scope: operation.normal_signing_scope
 		})) return strictEcdsaExportFailure(403, "scope_mismatch", "ECDSA export operation scope does not match the request");
 		const activeMaterial = await input.ctx.service.walletRegistration.resolveEcdsaMaterialActivation({
+			source: { kind: "database" },
 			walletId: operation.wallet_id,
 			materialActivation: input.request.material_activation
 		});