@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/router/framework/http.js

@@ -4,12 +4,15 @@ import "../../shared-ts/src/device-linking/index.js";
 import { failure } from "../../shared-ts/src/utils/failure.js";
 import { buildCorsOrigins, normalizeCorsOrigin } from "../../core/SessionService.js";
 import { ROUTER_AB_TRACE_ID_HEADER_V1 } from "../../shared-ts/src/utils/routerAbTraceContext.js";
+import { WALLET_MANAGEMENT_PROTOCOL_HEADER } from "../../shared-ts/src/utils/walletManagementProtocol.js";
 //#region src/router/framework/http.ts
 const CORS_ALLOW_METHODS = "GET,POST,PUT,PATCH,DELETE,OPTIONS";
 const CORS_PREFLIGHT_MAX_AGE_SECONDS = 600;
 const CORS_ALLOW_HEADERS = [
 	"Content-Type",
+	WALLET_MANAGEMENT_PROTOCOL_HEADER,
 	"Authorization",
+	"X-Seams-Wallet-Region",
 	"X-Seams-Benchmark-Diagnostics",
 	LINKED_DEVICE_REQUEST_PROOF_HEADER_V1,
 	ROUTER_AB_ED25519_YAO_RECOVERY_CHALLENGE_ID_HEADER_V1,
@@ -62,7 +65,7 @@ function withCors(headers, opts, request) {
 	headers.set("Access-Control-Allow-Methods", CORS_ALLOW_METHODS);
 	headers.set("Access-Control-Allow-Headers", CORS_ALLOW_HEADERS);
 	if (allowedOrigin && request?.method === "OPTIONS") headers.set("Access-Control-Max-Age", String(CORS_PREFLIGHT_MAX_AGE_SECONDS));
-	if (headers.has("Server-Timing")) headers.set("Access-Control-Expose-Headers", "Server-Timing");
+	headers.set("Access-Control-Expose-Headers", "Server-Timing, X-Seams-Wallet-Region");
 	if (allowedOrigin && allowedOrigin !== "*") headers.set("Access-Control-Allow-Credentials", "true");
 }
 function toResponse(out) {

package/dist/esm/router/framework/registrationSetupDispatch.js

@@ -0,0 +1,14 @@
+//#region src/router/framework/registrationSetupDispatch.ts
+async function dispatchWalletRegistrationSetup(context, input) {
+	const forwarded = await context.dispatcher?.dispatch(input);
+	if (forwarded) return forwarded;
+	const result = await context.local.setupWalletRegistration(input);
+	return {
+		status: result.ok ? 200 : 400,
+		body: result
+	};
+}
+//#endregion
+export { dispatchWalletRegistrationSetup };
+
+//# sourceMappingURL=registrationSetupDispatch.js.map

package/dist/esm/router/framework/ror/normalize.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString, toRorOriginOrNull } from "../../../shared-ts/src/utils/normalize.js";
-import "../../../shared-ts/src/utils/validation.js";
 import { SIGNING_SESSION_SEAL_ALG, SIGNING_SESSION_SEAL_GROUP_ID } from "../../../shared-ts/src/utils/signingSessionSeal.js";
 //#region src/router/framework/ror/normalize.ts
 function normalizeCsv(valuesRaw) {

package/dist/esm/router/framework/ror/options.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
-import "../../../shared-ts/src/utils/validation.js";
 import { normalizeCsv, sanitizeRorOrigins } from "./normalize.js";
 import { StaticRorOriginsProvider } from "./staticProvider.js";
 //#region src/router/framework/ror/options.ts

package/dist/esm/router/framework/ror/provider.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
-import "../../../shared-ts/src/utils/validation.js";
 import { normalizeRorHost } from "./normalize.js";
 //#region src/router/framework/ror/provider.ts
 function validateRouterApiRorOptions(ror) {

package/dist/esm/router/framework/ror/staticProvider.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
-import "../../../shared-ts/src/utils/validation.js";
 import { sanitizeRorOrigins } from "./normalize.js";
 //#region src/router/framework/ror/staticProvider.ts
 var StaticRorOriginsProvider = class {

package/dist/esm/router/framework/routeDefinitions.js

@@ -37,7 +37,6 @@ const ROUTER_API_ECDSA_STRICT_LIFECYCLE_SERVICES = [
 	"session"
 ];
 const ROUTER_API_WEBAUTHN_AUTHENTICATOR_SERVICES = ["webAuthn", "session"];
-const ROUTER_API_NEAR_PUBLIC_KEY_SERVICES = ["nearFunding", "session"];
 const ROUTER_API_PASSKEY_CUSTODY_SERVICES = [
 	"passkeyCustody",
 	"walletAuthMethods",
@@ -404,7 +403,7 @@ function createRouterApiRouteDefinitions(options = {}) {
 	}, ROUTER_API_ED25519_WALLET_SESSION_SERVICES), sessionPrincipalRoute("router_ab_ed25519_sign_prepare", "POST", ROUTER_AB_ED25519_NORMAL_SIGNING_PREPARE_PATH, "Prepare Router A/B Ed25519 normal signing", ROUTER_API_NORMAL_SIGNING_PROXY_SERVICES), sessionPrincipalRoute("router_ab_ed25519_sign_finalize", "POST", ROUTER_AB_ED25519_NORMAL_SIGNING_PATH, "Finalize Router A/B Ed25519 normal signing", ROUTER_API_NORMAL_SIGNING_PROXY_SERVICES), publicRoute("router_ab_ecdsa_derivation_healthz", "GET", ROUTER_AB_ECDSA_DERIVATION_HEALTH_PATH, "Router A/B ECDSA derivation health probe", {
 		plane: "public",
 		rationale: "Router A/B health probes are intentionally public diagnostics."
-	}, ROUTER_API_THRESHOLD_RUNTIME_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_export", "POST", ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, "Export authorized Router A/B ECDSA derivation material", ROUTER_API_ECDSA_STRICT_LIFECYCLE_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_refresh", "POST", ROUTER_AB_ECDSA_DERIVATION_REFRESH_PATH, "Refresh Router A/B ECDSA derivation activation", ROUTER_API_ECDSA_STRICT_LIFECYCLE_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_session_activate", "POST", ROUTER_AB_ECDSA_DERIVATION_SESSION_ACTIVATION_PATH, "Activate Router A/B ECDSA normal-signing session", ROUTER_API_THRESHOLD_SESSION_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_sign_prepare", "POST", ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_PREPARE_PATH, "Prepare Router A/B ECDSA derivation normal signing", ROUTER_API_NORMAL_SIGNING_PROXY_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_sign_finalize", "POST", ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_PATH, "Finalize Router A/B ECDSA derivation normal signing", ROUTER_API_NORMAL_SIGNING_PROXY_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_presignature_pool_fill_init", "POST", ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_INIT_PATH, "Begin Router A/B ECDSA derivation presignature pool-fill session", ROUTER_API_THRESHOLD_SESSION_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_presignature_pool_fill_step", "POST", ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_STEP_PATH, "Continue Router A/B ECDSA derivation presignature pool-fill session", ROUTER_API_THRESHOLD_SESSION_SERVICES), sessionPrincipalRoute("webauthn_authenticators", "GET", "/webauthn/authenticators", "List registered WebAuthn authenticators", ROUTER_API_WEBAUTHN_AUTHENTICATOR_SERVICES), sessionPrincipalRoute("near_public_keys", "GET", "/near/public-keys", "List NEAR public keys for current session", ROUTER_API_NEAR_PUBLIC_KEY_SERVICES), publicRoute("wallet_unlock_challenge", "POST", "/wallet/unlock/challenge", "Create wallet unlock challenge", {
+	}, ROUTER_API_THRESHOLD_RUNTIME_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_export", "POST", ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, "Export authorized Router A/B ECDSA derivation material", ROUTER_API_ECDSA_STRICT_LIFECYCLE_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_refresh", "POST", ROUTER_AB_ECDSA_DERIVATION_REFRESH_PATH, "Refresh Router A/B ECDSA derivation activation", ROUTER_API_ECDSA_STRICT_LIFECYCLE_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_session_activate", "POST", ROUTER_AB_ECDSA_DERIVATION_SESSION_ACTIVATION_PATH, "Activate Router A/B ECDSA normal-signing session", ROUTER_API_THRESHOLD_SESSION_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_sign_prepare", "POST", ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_PREPARE_PATH, "Prepare Router A/B ECDSA derivation normal signing", ROUTER_API_NORMAL_SIGNING_PROXY_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_sign_finalize", "POST", ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_PATH, "Finalize Router A/B ECDSA derivation normal signing", ROUTER_API_NORMAL_SIGNING_PROXY_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_presignature_pool_fill_init", "POST", ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_INIT_PATH, "Begin Router A/B ECDSA derivation presignature pool-fill session", ROUTER_API_THRESHOLD_SESSION_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_presignature_pool_fill_step", "POST", ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_STEP_PATH, "Continue Router A/B ECDSA derivation presignature pool-fill session", ROUTER_API_THRESHOLD_SESSION_SERVICES), sessionPrincipalRoute("webauthn_authenticators", "GET", "/webauthn/authenticators", "List registered WebAuthn authenticators", ROUTER_API_WEBAUTHN_AUTHENTICATOR_SERVICES), publicRoute("wallet_unlock_challenge", "POST", "/wallet/unlock/challenge", "Create wallet unlock challenge", {
 		plane: "public",
 		proof: "challenge_exchange",
 		rationale: "Wallet unlock challenge issuance is intentionally public."

package/dist/esm/router/framework/routerApiWebhooks.js

@@ -1,5 +1,4 @@
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
 //#region src/router/framework/routerApiWebhooks.ts
 const DEFAULT_ORG_ID_CLAIM_KEYS = [
 	"orgId",

package/dist/esm/router/ror.js

@@ -1,4 +1,3 @@
-import "bs58";
 //#region ../shared-ts/src/utils/normalize.ts
 /**
 * Generic normalization helpers shared across client/server.

package/dist/esm/router/transport/fetch/createFetchRouter.js

@@ -3,12 +3,12 @@ import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { routerAbEcdsaDerivationActiveStateId } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { findRouteDefinitionForRequest } from "../../framework/routeDefinitions.js";
+import { extractBearerCredential } from "../../auth/routerApiKeyAuth.js";
+import { resolveWalletSessionOperationCredentialAdmissionFromContext } from "../../auth/commonRouterUtils.js";
 import { getRouterApiRouteExtensionRoutes, getRouterApiRouteExtensionsForTransport } from "../../framework/routeExtensions.js";
 import { coerceRouterLogger } from "../../framework/logger.js";
 import { json, jsonFailure, withCors } from "../../framework/http.js";
 import { handleHealth, handleReady } from "./routes/health.js";
-import { extractBearerCredential } from "../../auth/routerApiKeyAuth.js";
-import { resolveWalletSessionOperationCredentialAdmissionFromContext } from "../../auth/commonRouterUtils.js";
 import { handleWalletRegistration } from "./routes/walletRegistration.js";
 import { handlePasskeyCustody, handleWalletCustodyCredentialLabel, handleWalletCustodyCredentialsList, handleWalletCustodyEmailOtpChallenge, handleWalletCustodyEnvelopeOwnershipUpgrade, handleWalletRecoveryBackupAcknowledge, handleWalletRecoveryEmailOtpRelease, handleWalletRecoveryEmailOtpVerify, handleWalletRecoveryFinalize, handleWalletRecoveryGoogleEmailOtpFinalize, handleWalletRecoveryGoogleVerify, handleWalletRecoveryPrepare, handleWalletRecoveryRead, handleWalletRecoveryRotate, handleWalletRecoveryStatus } from "./routes/passkeyCustody.js";
 import { handleThresholdEcdsa } from "./routes/thresholdEcdsa.js";
@@ -18,7 +18,6 @@ import { handleThresholdEd25519 } from "./routes/thresholdEd25519.js";
 import { handleOwnerWalletExecutionLanePreflight } from "./routes/walletExecutionLanePreflight.js";
 import { handleWebAuthnAuthenticators } from "./routes/webauthnAuthenticators.js";
 import { handleAuth } from "./routes/auth.js";
-import { handleNearPublicKeys } from "./routes/nearPublicKeys.js";
 import { validateRouterApiRorOptions } from "../../framework/ror/provider.js";
 import { handleWellKnown } from "./routes/wellKnown.js";
 import { handleDeviceLinking } from "./routes/deviceLinking.js";
@@ -230,7 +229,6 @@ function createFetchRouter(service, opts, runtime) {
 		handleThresholdEcdsa,
 		handleExactWalletSigningSessionSeal,
 		handleWebAuthnAuthenticators,
-		handleNearPublicKeys,
 		handleExactWalletSessionStatus,
 		handleHostedWalletSessionExchangeIssue,
 		handleHostedWalletSessionExchangeRedeem,

package/dist/esm/router/transport/fetch/routes/auth.js

@@ -1,6 +1,6 @@
-import { json, jsonFailure, readJson } from "../../../framework/http.js";
 import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
 import { resolveThresholdRuntimePolicyScope } from "../../../auth/commonRouterUtils.js";
+import { json, jsonFailure, readJson } from "../../../framework/http.js";
 import { parseAuthIdentityMutationRequest, parseAuthProviderActionPath, parseGoogleLoginVerifyRequest, parsePasskeyLoginOptionsRequest, parsePasskeyLoginVerifyRequest } from "../../../auth/authRequestValidation.js";
 //#region src/router/transport/fetch/routes/auth.ts
 function assertNeverAuthProviderAction(route) {
@@ -130,6 +130,8 @@ async function handleAuth(ctx) {
 			const parsed = parsePasskeyLoginOptionsRequest(await readJson(ctx.request));
 			if (!parsed.ok) return json(parsed.body, { status: parsed.status });
 			const result = await ctx.service.webAuthn.createWebAuthnLoginOptions(parsed.request);
+			if (result.code === "wallet_home_unavailable") return json(result, { status: 503 });
+			if (result.code === "wallet_home_conflict") return json(result, { status: 409 });
 			return json(result, { status: result.ok ? 200 : result.code === "internal" ? 500 : 400 });
 		}
 		case "passkey_verify": {

package/dist/esm/router/transport/fetch/routes/deviceLinking.js

@@ -1,10 +1,10 @@
 import { parseLinkDeviceSessionId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { requireRecord } from "../../../../shared-ts/src/utils/validation.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { sha256Bytes } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { assertNeverLinkSessionStateV1 } from "../../../../shared-ts/src/device-linking/contracts.js";
-import { requireRecord } from "../../../../shared-ts/src/utils/validation.js";
 import { parseActiveWalletSessionV1 } from "../../../../shared-ts/src/device-linking/activeWalletSession.js";
+import { isLinkSessionTerminalFailureV1 } from "../../../../shared-ts/src/device-linking/contracts.js";
 import { parseLinkedDeviceEd25519ExportRootRecipientV1, parseLinkedDeviceEd25519ExportRootSubmissionV1 } from "../../../../shared-ts/src/device-linking/ed25519ExportRoot.js";
 import { parseRouterAbEd25519YaoRegistrationActivationExecuteRequestV1, sameRouterAbEd25519YaoActivationBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { parseLinkedDeviceEd25519SourcePreservingReservationV1, parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1 } from "../../../../shared-ts/src/device-linking/sourceContribution.js";
@@ -13,9 +13,11 @@ import { parseLocalAuthorityActivationFinalAckV1, parseLocalAuthorityInstallatio
 import { LINKED_DEVICE_REQUEST_PROOF_HEADER_V1, computeLinkedDevicePublicKeyDigestV1 } from "../../../../shared-ts/src/device-linking/requestProof.js";
 import { findRouteDefinitionById } from "../../../framework/routeDefinitions.js";
 import { normalizeCorsOrigin } from "../../../../core/SessionService.js";
-import { json, readJson } from "../../../framework/http.js";
 import { extractBearerCredential, extractRouterApiEnvironmentId } from "../../../auth/routerApiKeyAuth.js";
 import { resolvePublishableKeyApiCredentialAuth } from "../../../auth/routerApiCredentialAuth.js";
+import { json, readJson } from "../../../framework/http.js";
+import { authDeniedResponse, exportRootWriteResponse, invalidInputResponse, invalidStateResponse, methodNotAllowedResponse, notFoundResponse, notSupportedResponse, projectSession, sessionProjectionResponse, targetCredentialResultResponse } from "./deviceLinkingResponses.js";
+import { linkedDeviceBootstrapFailure } from "../../../../core/deviceLinking/linkedDeviceBootstrap.js";
 import { parseLinkedDeviceRequestProofV1 } from "../../../../core/deviceLinking/requestProof.js";
 //#region src/router/transport/fetch/routes/deviceLinking.ts
 const DEVICE_LINKING_BASE = "/wallet/device-linking/v1/sessions";
@@ -52,6 +54,11 @@ async function handleDeviceLinking(ctx) {
 			default: return assertNever(action);
 		}
 	} catch (error) {
+		const bootstrapFailure = linkedDeviceBootstrapFailure(error);
+		if (bootstrapFailure) return sessionResultResponse({
+			outcome: bootstrapFailure,
+			message: "Linked-device bootstrap authority failed"
+		});
 		if (error instanceof DeviceLinkingInputError) return invalidInputResponse(error.message);
 		return json({
 			ok: false,
@@ -63,7 +70,7 @@ async function handleDeviceLinking(ctx) {
 async function handleCreate(ctx, service, nowMs) {
 	if (ctx.method !== "POST") return methodNotAllowedResponse();
 	const bodyDigestB64u = await requestBodyDigest(ctx.request);
-	const rawBody = await readJsonBody(ctx.request);
+	const rawBody = await readJson(ctx.request);
 	const body = parseBoundary(() => parseCreateRequest(rawBody));
 	const keyDigest = await computeDevicePublicKeyDigestB64u(body.payload.devicePublicKeyB64u);
 	const proof = parseBoundary(() => parseRequestProofHeader(ctx.request));
@@ -140,7 +147,7 @@ async function handleApproval(ctx, service, rawLinkSessionId, nowMs) {
 		});
 		if (!session) return notFoundResponse();
 		const ownerMismatch = requireOwnerMatchesClaimedWallet(authentication.owner, session);
-		if (ownerMismatch) return ownerMismatch;
+		if (ownerMismatch) return authDeniedResponse(ownerMismatch);
 		if (authentication.owner.walletId !== approval.walletId) return authDeniedResponse({
 			kind: "denied",
 			code: "unauthorized",
@@ -224,6 +231,7 @@ async function handleCredential(ctx, service, rawLinkSessionId, nowMs) {
 async function handleSourceContributionPreparation(ctx, service, rawLinkSessionId, nowMs) {
 	const owner = await authenticateOwnerForSession(ctx, service, parseSessionId(rawLinkSessionId), nowMs);
 	if (owner.kind !== "authorized") return ownerSessionResponse(owner);
+	if (isLinkSessionTerminalFailureV1(owner.session.state)) return invalidStateResponse(owner.session);
 	if (ctx.method !== "GET") return methodNotAllowedResponse();
 	const preparation = owner.session.sourceContributionPreparation;
 	if (!preparation) return new Response(null, { status: 204 });
@@ -274,10 +282,6 @@ async function handleSourceContribution(ctx, service, rawLinkSessionId, nowMs) {
 	}));
 	return sessionProjectionResponse(committed.session, committed.kind === "replayed" ? "replayed" : recorded.outcome);
 }
-/**
-* A precommit failure's reason is a single token. The installer's message
-* keeps its words, joined, so the session still says what failed.
-*/
 function precommitFailureReasonV1(message) {
 	const token = message.trim().replace(/\s+/g, "_").replace(/[\u0000-\u001f\u007f]/g, "");
 	return token.length > 0 ? token : "authority_commit_failed";
@@ -286,6 +290,7 @@ async function handleSourceContributionExecute(ctx, service, rawLinkSessionId, n
 	if (ctx.method !== "POST") return methodNotAllowedResponse();
 	const owner = await authenticateOwnerForSession(ctx, service, parseSessionId(rawLinkSessionId), nowMs);
 	if (owner.kind !== "authorized") return ownerSessionResponse(owner);
+	if (isLinkSessionTerminalFailureV1(owner.session.state)) return invalidStateResponse(owner.session);
 	const router = service.sourceContributionRouter;
 	if (!router) return notSupportedResponse("Ed25519 source-preserving linking is not configured");
 	const preparation = requireEd25519SourceContributionPreparation(owner.session);
@@ -358,8 +363,6 @@ async function handleEmailOtpBaseFactor(ctx, service, rawLinkSessionId, nowMs) {
 	const authenticated = await authenticateOwnerForSession(ctx, service, parseSessionId(rawLinkSessionId), nowMs);
 	if (authenticated.kind !== "authorized") return ownerSessionResponse(authenticated);
 	const session = authenticated.session;
-	const ownerMismatch = requireOwnerMatchesClaimedWallet(authenticated.owner, session);
-	if (ownerMismatch) return ownerMismatch;
 	if (session.state.state !== "claimed" || session.qrPayload.targetFactor.kind !== "email_otp" || !session.claimTranscript) return invalidStateResponse(session);
 	const walletId = session.claimTranscript.value.walletId;
 	const request = parseBoundary(() => parseLinkedDeviceEmailOtpBaseFactorRequestV1(authenticated.body));
@@ -387,8 +390,6 @@ async function handleOwnerCancel(ctx, service, rawLinkSessionId, nowMs) {
 	if (authenticated.kind !== "authorized") return ownerSessionResponse(authenticated);
 	parseBoundary(() => parseOwnerCancelRequest(authenticated.body));
 	const session = authenticated.session;
-	const ownerMismatch = requireOwnerMatchesClaimedWallet(authenticated.owner, session);
-	if (ownerMismatch) return ownerMismatch;
 	if (session.state.state === "cancelled") return sessionProjectionResponse(session, "replayed");
 	return sessionResultResponse(await service.sessionService.cancelSessionV1({
 		linkSessionId,
@@ -436,6 +437,7 @@ async function handleExportRootRecipient(ctx, service, rawLinkSessionId, nowMs)
 	if (ctx.method === "GET") {
 		const owner = await authenticateOwnerForSession(ctx, service, sessionId, nowMs);
 		if (owner.kind !== "authorized") return ownerSessionResponse(owner);
+		if (isLinkSessionTerminalFailureV1(owner.session.state)) return invalidStateResponse(owner.session);
 		const transfer = await port.readTransferV1(sessionId);
 		return transfer ? json(transfer.recipient, { status: 200 }) : new Response(null, { status: 204 });
 	}
@@ -443,8 +445,14 @@ async function handleExportRootRecipient(ctx, service, rawLinkSessionId, nowMs)
 	const authenticated = await authenticateDeviceForSession(ctx, service, rawLinkSessionId, nowMs);
 	if (authenticated.kind === "denied") return authDeniedResponse(authenticated);
 	if (authenticated.kind === "not_found") return notFoundResponse();
+	if (isLinkSessionTerminalFailureV1(authenticated.session.state)) return invalidStateResponse(authenticated.session);
 	const recipient = parseBoundary(() => parseLinkedDeviceEd25519ExportRootRecipientV1(authenticated.body));
 	if (recipient.linkSessionId !== authenticated.linkSessionId) return invalidInputResponse("link session id does not match route");
+	const session = authenticated.session;
+	const preparation = await readTargetPreparation(service, session, requireApproval(session), { access: "replay_only" }, nowMs);
+	if (preparation.kind === "conflict") return invalidStateResponse(session);
+	const facts = preparation.ed25519ExportRoot;
+	if (!facts || recipient.walletId !== preparation.walletId || recipient.enrollmentId !== preparation.enrollmentId || recipient.deviceId !== preparation.deviceId || recipient.targetFactor.kind !== preparation.targetFactor.kind || recipient.walletKeyId !== facts.walletKeyId || recipient.revocationEpoch !== facts.revocationEpoch || recipient.applicationBindingDigestB64u !== facts.applicationBindingDigestB64u || recipient.registeredPublicKeyB64u !== facts.registeredPublicKeyB64u) return invalidInputResponse("export-root recipient does not match target preparation");
 	return exportRootWriteResponse(await port.registerRecipientV1({ recipient }));
 }
 async function handleExportRootPackage(ctx, service, rawLinkSessionId, nowMs) {
@@ -455,12 +463,14 @@ async function handleExportRootPackage(ctx, service, rawLinkSessionId, nowMs) {
 		const authenticated = await authenticateDeviceForSession(ctx, service, rawLinkSessionId, nowMs);
 		if (authenticated.kind === "denied") return authDeniedResponse(authenticated);
 		if (authenticated.kind === "not_found") return notFoundResponse();
+		if (isLinkSessionTerminalFailureV1(authenticated.session.state)) return invalidStateResponse(authenticated.session);
 		const transfer = await port.readTransferV1(sessionId);
 		return transfer?.state === "sealed" ? json(transfer.package, { status: 200 }) : new Response(null, { status: 204 });
 	}
 	if (ctx.method !== "POST") return methodNotAllowedResponse();
 	const owner = await authenticateOwnerForSession(ctx, service, sessionId, nowMs);
 	if (owner.kind !== "authorized") return ownerSessionResponse(owner);
+	if (isLinkSessionTerminalFailureV1(owner.session.state)) return invalidStateResponse(owner.session);
 	const submission = parseBoundary(() => parseLinkedDeviceEd25519ExportRootSubmissionV1(owner.body));
 	if (submission.linkSessionId !== sessionId) return invalidInputResponse("link session id does not match route");
 	return exportRootWriteResponse(await port.submitPackageV1({
@@ -472,7 +482,7 @@ async function handleReceipt(ctx, service, rawLinkSessionId, nowMs) {
 	if (!service.installationReceipt) return notSupportedResponse("Installation receipt is not configured");
 	if (ctx.method !== "POST") return methodNotAllowedResponse();
 	const linkSessionId = parseSessionId(rawLinkSessionId);
-	const rawBody = await readJsonBody(ctx.request.clone());
+	const rawBody = await readJson(ctx.request.clone());
 	if (isFinalActivationAcknowledgement(rawBody)) {
 		const acknowledgement = parseBoundary(() => parseLocalAuthorityActivationFinalAckV1(rawBody));
 		if (acknowledgement.linkSessionId !== linkSessionId) return invalidInputResponse("activation acknowledgement session does not match the route");
@@ -658,6 +668,8 @@ async function authenticateOwnerForSession(ctx, service, linkSessionId, nowMs) {
 	});
 	if (!session) return { kind: "not_found" };
 	validateOwnerRequestBinding(authentication.binding, ctx, bodyDigestB64u, nowMs);
+	const ownerMismatch = requireOwnerMatchesClaimedWallet(authentication.owner, session);
+	if (ownerMismatch) return ownerMismatch;
 	return {
 		kind: "authorized",
 		body: authentication.body,
@@ -862,69 +874,6 @@ async function authenticateTargetPasskeyOriginV1(ctx, routeId) {
 		expectedOrigin
 	};
 }
-function projectLinkSessionStateV1(state) {
-	switch (state.state) {
-		case "displaying_qr": return { state: "displaying_qr" };
-		case "claimed":
-		case "awaiting_target_factor":
-		case "awaiting_source_contribution":
-		case "provisioning": return {
-			state: state.state,
-			deviceId: state.deviceId
-		};
-		case "authority_pending_local_install": return {
-			state: "authority_pending_local_install",
-			deviceId: state.deviceId,
-			authorityId: state.authorityId,
-			packageSetDigestB64u: state.packageSetDigestB64u
-		};
-		case "active": return {
-			state: "active",
-			deviceId: state.deviceId,
-			authorityId: state.authorityId,
-			activatedAtMs: state.activatedAtMs
-		};
-		case "failed_before_commit": return {
-			state: "failed_before_commit",
-			error: state.error
-		};
-		case "cancelled": return {
-			state: "cancelled",
-			cancelledAtMs: state.cancelledAtMs
-		};
-		case "expired": return {
-			state: "expired",
-			expiredAtMs: state.expiredAtMs
-		};
-		default: return assertNeverLinkSessionStateV1(state);
-	}
-}
-function projectSession(record) {
-	return {
-		kind: "linked_device_session_projection_v1",
-		linkSessionId: record.linkSessionId,
-		qrPayload: record.qrPayload,
-		revision: record.revision,
-		createdAtMs: record.createdAtMs,
-		updatedAtMs: record.updatedAtMs,
-		state: projectLinkSessionStateV1(record.state)
-	};
-}
-function sessionProjectionResponse(record, outcome) {
-	return json({
-		ok: true,
-		outcome,
-		session: projectSession(record)
-	}, { status: 200 });
-}
-function targetCredentialResultResponse(record, outcome, targetCredential) {
-	return json({
-		ok: true,
-		outcome,
-		targetCredential,
-		session: projectSession(record)
-	}, { status: 200 });
-}
 function claimResultResponse(result) {
 	if (result.outcome !== "applied" && result.outcome !== "replayed") return sessionResultResponse(result);
 	const claim = result.record.claimTranscript?.value;
@@ -953,6 +902,16 @@ function approvalResultResponse(result) {
 }
 function sessionResultResponse(result) {
 	switch (result.outcome) {
+		case "home_conflict": return json({
+			ok: false,
+			code: "wallet_home_conflict",
+			message: result.message
+		}, { status: 409 });
+		case "home_unavailable": return json({
+			ok: false,
+			code: "wallet_home_unavailable",
+			message: result.message
+		}, { status: 503 });
 		case "applied":
 		case "replayed": return sessionProjectionResponse(result.record, result.outcome);
 		case "conflict": return json({
@@ -993,49 +952,19 @@ function sessionResultResponse(result) {
 		default: return assertNever(result);
 	}
 }
-function invalidStateResponse(record) {
-	return json({
-		ok: false,
-		outcome: "invalid_state",
-		state: record.state.state,
-		session: projectSession(record)
-	}, { status: 409 });
-}
-function exportRootWriteResponse(result) {
-	return result.outcome === "conflict" ? json({
-		ok: false,
-		code: result.reason ?? "conflict",
-		message: "export-root relay conflict"
-	}, { status: 409 }) : json({
-		ok: true,
-		outcome: result.outcome
-	}, { status: 200 });
-}
 function ownerSessionResponse(context) {
 	return context.kind === "denied" ? authDeniedResponse(context) : notFoundResponse();
 }
-/**
-* The one owner-to-session binding, shared by every owner route on a claimed
-* session. It runs before any state is disclosed: an authenticated owner of a
-* DIFFERENT wallet must get the same denial for every state, not a projection
-* or an invalid-state body. An unclaimed session has no wallet to bind to yet,
-* so the caller's state checks answer instead.
-*/
 function requireOwnerMatchesClaimedWallet(owner, session) {
 	const claimWalletId = session.claimTranscript?.value.walletId;
 	if (claimWalletId === void 0) return null;
 	if (owner.walletId === claimWalletId) return null;
-	return authDeniedResponse({
+	return {
 		kind: "denied",
 		code: "unauthorized",
 		message: "owner session does not match link wallet"
-	});
+	};
 }
-/**
-* Approval-time revalidation of the selected Email OTP base method. The same
-* eligibility question the dedicated base-factor route answers, asked once
-* more with the id the approval names, so the two paths cannot drift.
-*/
 async function requireSelectedEmailOtpBaseFactorV1(service, session, input) {
 	const provider = service.emailOtpTargetFactor;
 	if (!provider) return notSupportedResponse("Email OTP linking is not configured");
@@ -1054,43 +983,6 @@ async function requireSelectedEmailOtpBaseFactorV1(service, session, input) {
 	});
 	return null;
 }
-function authDeniedResponse(result) {
-	return json({
-		ok: false,
-		outcome: "unauthorized",
-		code: result.code,
-		message: result.message
-	}, { status: result.code === "expired" ? 410 : 401 });
-}
-function invalidInputResponse(message) {
-	return json({
-		ok: false,
-		outcome: "invalid_input",
-		code: "invalid_input",
-		message
-	}, { status: 400 });
-}
-function notSupportedResponse(message = "Device linking is not configured") {
-	return json({
-		ok: false,
-		code: "not_supported",
-		message
-	}, { status: 501 });
-}
-function notFoundResponse() {
-	return json({
-		ok: false,
-		code: "not_found",
-		message: "Linked-device session not found"
-	}, { status: 404 });
-}
-function methodNotAllowedResponse() {
-	return json({
-		ok: false,
-		code: "method_not_allowed",
-		message: "Method is not allowed"
-	}, { status: 405 });
-}
 function parseCreateRequest(raw) {
 	const record = requireRecord(raw, "device-linking create request");
 	requireExactKeys(record, ["kind", "payload"]);
@@ -1155,9 +1047,6 @@ function parseB64uBytes(raw, field) {
 	if (bytes.length === 0 || base64UrlEncode(bytes) !== raw) throw new Error(`${field} is not canonical base64url`);
 	return bytes;
 }
-async function readJsonBody(request) {
-	return await readJson(request);
-}
 function parseBoundary(parse) {
 	try {
 		return parse();

package/dist/esm/router/transport/fetch/routes/deviceLinkingOwnerAuthorization.js

@@ -1,12 +1,12 @@
 import { parseProviderSubject } from "../../../../shared-ts/src/utils/domainIds.js";
-import { sha256DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { buildDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
+import { sha256DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { buildEmailOtpWalletAuthAuthority, buildPasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseLinkedDeviceOwnerAuthorizationRequestV1 } from "../../../../shared-ts/src/device-linking/parsers.js";
 import { buildWalletSessionCapabilitySubjectsV1, walletSessionCapabilitySubjectsV1Equal } from "../../../../authorization/domain.js";
-import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
-import { json, jsonFailure, readJson } from "../../../framework/http.js";
 import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
+import { json, jsonFailure, readJson } from "../../../framework/http.js";
+import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 //#region src/router/transport/fetch/routes/deviceLinkingOwnerAuthorization.ts
 const LINKED_DEVICE_OWNER_AUTHORIZATION_PATH_V1 = "/wallet/device-linking/v1/owner-authorization";
 /**
@@ -255,7 +255,8 @@ function methodNotAllowedResponse() {
 	}, { status: 405 });
 }
 function authDeniedResponse(value) {
-	return jsonFailure(value.code === "expired" ? 401 : value.code === "invalid" ? 403 : 401, value.code, value.message);
+	if (value.code === "unavailable") return jsonFailure(503, value.code, value.message);
+	return jsonFailure(value.code === "invalid" ? 403 : 401, value.code, value.message);
 }
 //#endregion
 export { LINKED_DEVICE_OWNER_AUTHORIZATION_PATH_V1, authenticateDeviceLinkingOwnerWalletSessionRequestV1, createDeviceLinkingOwnerRequestAuthenticatorV1, handleDeviceLinkingOwnerAuthorization };