@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/router/transport/fetch/routes/thresholdEcdsa.js

@@ -1,28 +1,29 @@
-import { parseEmailOtpChallengeId, parseOrgId, parseProviderSubject, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { EVM_ECDSA_MPC_OPERATION_KINDS, buildEvmEcdsaMpcOperationRef, parseAuthFactorId, parseAuthorizationAuditEventId, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parseEcdsaAuthorizationSessionId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { EVM_ECDSA_MPC_OPERATION_KINDS, buildEvmEcdsaMpcOperationRef, parseAuthorizationAuditEventId, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parseEcdsaAuthorizationSessionId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { buildCapabilityOperationEnvelope } from "../../../../shared-ts/src/authorization/operationFingerprint.js";
 import "../../../../shared-ts/src/utils/encoders.js";
 import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1, ROUTER_AB_ECDSA_DERIVATION_REFRESH_PATH, computeRouterAbEcdsaOperationStepUpChallengeB64u, parseRouterAbEcdsaDerivationActivationRefreshCommitRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1, parseRouterAbEcdsaDerivationExplicitExportRequestV1, parseRouterAbEcdsaOperationStepUpAuthorizationRequestV1, parseRouterAbEcdsaPostRegistrationSessionActivationRequestV1, parseRouterAbEcdsaPrepareSourceV1, sameRouterAbEcdsaDerivationNormalSigningScopeV1, sameRouterAbEcdsaDerivationPublicCapabilityV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { buildWalletSessionCapabilitySubjectsV1, projectActiveWalletSession } from "../../../../authorization/domain.js";
-import { buildVerifiedWalletOperationEmailOtpFactorResult, buildVerifiedWalletOperationPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
+import { buildWalletSessionCapabilitySubjectsV1, projectActiveWalletSession, walletSessionAuthorizationV2RecordsEqual } from "../../../../authorization/domain.js";
 import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { WALLET_SESSION_FAILURE_CODES } from "../../../../shared-ts/src/utils/walletSessionFailure.js";
-import { json, readJson } from "../../../framework/http.js";
 import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
 import { walletSessionFailure, walletSessionFailureStatus } from "../../../auth/walletSessionFailure.js";
+import { resolveWalletSessionAuthorizationV2Admission } from "../../../domains/signingOperations/walletExecutionAdmission.js";
 import { resolveWalletSessionOperationCredentialAdmission, validateEcdsaPreprocessingSession } from "../../../auth/commonRouterUtils.js";
-import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
+import { json, readJson } from "../../../framework/http.js";
 import { thresholdEcdsaStatusCode } from "../../../../threshold/statusCodes.js";
-import { parseEcdsaServerTiming } from "../../../../shared-ts/src/utils/ecdsaServerTiming.js";
+import { signingPrepareSessionResponse } from "../../../domains/signingOperations/signingPrepareSession.js";
 import { authenticateRouterAbWalletOperationStepUpIdentity } from "../../../domains/signingOperations/routerAbOperationStepUp.js";
-import { admitRouterAbEcdsaReusableWalletSessionOperation, authenticateRouterAbEcdsaOperationStepUp, authorizeRouterAbEcdsaDerivationNormalSigningRoute, buildRouterAbEcdsaOwnerOperationStepUpPreparation, claimRouterAbEcdsaOperationStepUp, completeRouterAbEcdsaOperation, decideRouterAbEcdsaOwnerOperationAuthorization, resolveFreshRouterAbEcdsaMaterialActivation, routerAbEcdsaAtomicAuthorizationConfigured, routerAbEcdsaOperationInProgressResult, routerAbEcdsaOwnerOperationFailureResult, routerAbEcdsaReplayHttpResponse, routerAbEcdsaReplayUnavailableResult } from "../../../domains/signingOperations/routerAbEcdsaDerivationNormalSigningRoute.js";
+import { admitRouterAbEcdsaReusableWalletSessionOperation, authenticateRouterAbEcdsaOperationStepUp, authorizeRouterAbEcdsaDerivationNormalSigningRoute, buildRouterAbEcdsaOwnerOperationStepUpPreparation, claimRouterAbEcdsaOperationStepUp, decideRouterAbEcdsaOwnerOperationAuthorization, resolveFreshRouterAbEcdsaMaterialActivation, routerAbEcdsaAtomicAuthorizationConfigured, routerAbEcdsaOperationInProgressResult, routerAbEcdsaOwnerOperationFailureResult, routerAbEcdsaReplayHttpResponse, routerAbEcdsaReplayUnavailableResult } from "../../../domains/signingOperations/routerAbEcdsaDerivationNormalSigningRoute.js";
+import { finishRouterAbEcdsaSigningResponse } from "../../../domains/signingOperations/ecdsaSigningResponse.js";
+import { buildAuthorizedOperationWire } from "../../../domains/signingOperations/authorizedOperationWire.js";
+import { parseEcdsaServerTiming } from "../../../../shared-ts/src/utils/ecdsaServerTiming.js";
 import { parseRouterAbEcdsaDerivationPoolFillInitRouteRequest, parseRouterAbEcdsaDerivationPoolFillStepRouteRequest } from "../../../domains/ecdsa/thresholdEcdsaRequestValidation.js";
+import { verifyEcdsaOperationStepUpFactor } from "./ecdsaOperationStepUpFactor.js";
 import { resolveWalletAuthMethodIdForAuthority } from "../../../../core/signingLanes/WalletExecutionLaneProjection.js";
 import { proxyNormalSigningRequestToMpcRouter, proxyOwnerLaneAdmittedNormalSigningRequest } from "./normalSigningRouterProxy.js";
 //#region src/router/transport/fetch/routes/thresholdEcdsa.ts
@@ -52,6 +53,7 @@ async function ecdsaOperationStepUpBinding(ctx, session, operation) {
 	const pinned = await readPinnedEcdsaStepUpWalletScope(ctx, session, operation);
 	return {
 		kind: "operation_step_up",
+		ownershipGeneration: pinned.ownershipGeneration,
 		authorizationSessionId: session.sessionId,
 		orgId: scope.orgId,
 		projectId: scope.projectId,
@@ -71,7 +73,10 @@ async function readPinnedEcdsaStepUpWalletScope(ctx, session, operation) {
 	const scope = session.runtimePolicyScope;
 	if (pinned.orgId !== scope.orgId || pinned.projectId !== scope.projectId) throw new Error("Step-up wallet scope differs from the Wallet Session scope");
 	return {
-		...pinned,
+		orgId: pinned.orgId,
+		projectId: pinned.projectId,
+		projectEnvironmentId: pinned.projectEnvironmentId,
+		ownershipGeneration: pinned.ownershipGeneration,
 		walletId: session.walletId
 	};
 }
@@ -79,7 +84,7 @@ function buildRouterAbEcdsaAuthorizedOperationWire(input) {
 	const operation = input.operation;
 	const operationRef = operation.operation.operation;
 	if (operationRef.capabilityKind !== "evm_ecdsa_mpc_signing" || operationRef.operationKind !== "evm.sign_transaction") throw new Error("ECDSA authorized operation capability or operation kind is invalid");
-	const commonAuthorizedOperation = {
+	return buildAuthorizedOperationWire(input, {
 		authorized_operation_id: operation.authorizedOperationId,
 		operation_id: operation.operation.operationId,
 		capability_kind: "evm_ecdsa_mpc_signing",
@@ -88,66 +93,7 @@ function buildRouterAbEcdsaAuthorizedOperationWire(input) {
 		intent_digest_b64u: operation.operation.digests.intentDigest,
 		display_digest_b64u: operation.operation.digests.displayDigest,
 		operation_fingerprint_digest: operation.operationFingerprintDigest
-	};
-	switch (input.binding.kind) {
-		case "reusable_wallet_session":
-			if (operation.authorization.kind !== "authorization_grant" || operation.quota.kind !== "consume_reusable_wallet_session") throw new Error("Reusable Wallet Session authorized operation is invalid");
-			return {
-				binding: {
-					kind: "reusable_wallet_session",
-					authorization_id: operation.authorization.authorizationGrantRef.authorizationId,
-					wallet_session_id: input.binding.walletSessionId,
-					quota_id: input.binding.quotaId
-				},
-				authorized_operation: {
-					kind: "reusable_wallet_session_authorized_operation_v1",
-					...commonAuthorizedOperation
-				}
-			};
-		case "gateway_owner_wallet_session":
-			if (operation.authorization.kind !== "authorization_grant" || operation.quota.kind !== "consume_reusable_wallet_session") throw new Error("Gateway owner Wallet Session authorized operation is invalid");
-			return {
-				binding: {
-					kind: "gateway_owner_wallet_session",
-					subject_id: input.binding.subjectId,
-					account_id: input.binding.accountId,
-					authorization_id: input.binding.authorizationId,
-					wallet_session_id: input.binding.walletSessionId,
-					quota_id: input.binding.quotaId,
-					threshold_session_id: input.binding.thresholdSessionId,
-					org_id: input.binding.orgId,
-					project_id: input.binding.projectId,
-					environment: input.binding.environment,
-					project_environment_id: input.binding.projectEnvironmentId,
-					signing_worker_id: input.binding.signingWorkerId,
-					expires_at_ms: input.binding.expiresAtMs
-				},
-				authorized_operation: {
-					kind: "reusable_wallet_session_authorized_operation_v1",
-					...commonAuthorizedOperation
-				}
-			};
-		case "operation_step_up":
-			if (operation.authorization.kind !== "verified_step_up" || operation.quota.kind !== "quota_neutral") throw new Error("Verified step-up authorized operation is invalid");
-			return {
-				binding: {
-					kind: "operation_step_up",
-					authorization_session_id: input.binding.authorizationSessionId,
-					org_id: input.binding.orgId,
-					project_id: input.binding.projectId,
-					environment: input.binding.environment,
-					project_environment_id: input.binding.projectEnvironmentId,
-					subject_id: input.binding.subjectId,
-					account_id: input.binding.accountId
-				},
-				authorized_operation: {
-					kind: "verified_step_up_authorized_operation_v1",
-					authorization_session_id: input.binding.authorizationSessionId,
-					evidence_set_digest: operation.authorization.evidenceSetDigest,
-					...commonAuthorizedOperation
-				}
-			};
-	}
+	});
 }
 function decideRouterAbEcdsaOperationStepUpExecution(input) {
 	if (input.admissionKind === "replayed") return {
@@ -302,6 +248,7 @@ async function executeRouterAbEcdsaDerivationNormalSigningRoute(input, timing) {
 			operation: authorizedOperation,
 			binding: {
 				kind: "gateway_owner_wallet_session",
+				ownershipGeneration: pinnedOwnerScope.ownershipGeneration,
 				subjectId: String(session.principalId),
 				accountId: String(session.walletId),
 				authorizationId: String(session.authorizationId),
@@ -348,8 +295,18 @@ async function executeRouterAbEcdsaDerivationNormalSigningRoute(input, timing) {
 		walletRegistration: input.ctx.service.walletRegistration,
 		body: admittedBody
 	});
+	if (input.phase === "prepare" && upstream.ok) {
+		const body = signingPrepareSessionResponse(await upstream.json(), authorization);
+		timing.proxy = performance.now() - proxyStartedAt;
+		const headers = new Headers(upstream.headers);
+		headers.delete("content-length");
+		headers.delete("content-encoding");
+		return new Response(JSON.stringify(body), {
+			status: upstream.status,
+			headers
+		});
+	}
 	return finishRouterAbEcdsaSigningResponse({
-		phase: input.phase,
 		upstream,
 		operation: authorizedOperation,
 		authorizedOperations: input.ctx.service.authorizedOperations,
@@ -357,35 +314,6 @@ async function executeRouterAbEcdsaDerivationNormalSigningRoute(input, timing) {
 		proxyStartedAt
 	});
 }
-async function finishRouterAbEcdsaSigningResponse(input) {
-	const upstream = input.upstream;
-	if (input.phase === "prepare" && upstream.ok) {
-		input.timing.proxy = performance.now() - input.proxyStartedAt;
-		return upstream;
-	}
-	const upstreamBodyText = await upstream.clone().text().catch(() => "");
-	input.timing.proxy = performance.now() - input.proxyStartedAt;
-	if (isRouterAbEcdsaOperationInProgressResponse({
-		status: upstream.status,
-		bodyText: upstreamBodyText
-	})) return upstream;
-	const completionStartedAt = performance.now();
-	await completeRouterAbEcdsaOperation({
-		authorizedOperations: input.authorizedOperations,
-		operation: input.operation,
-		result: upstream.ok ? "succeeded" : upstream.status < 500 ? "failed_before_side_effect" : "failed_after_side_effect",
-		response: {
-			status: upstream.status,
-			contentType: upstream.headers.get("content-type") || "application/json",
-			bodyText: upstreamBodyText
-		}
-	});
-	input.timing.complete = performance.now() - completionStartedAt;
-	return upstream;
-}
-function isRouterAbEcdsaOperationInProgressResponse(input) {
-	return input.status === 409 && input.bodyText.includes("ReplayedLocalRequest:") && input.bodyText.includes("SigningWorker ECDSA effect is already in progress");
-}
 function routerAbEcdsaReplayResponse(operation) {
 	const response = routerAbEcdsaReplayHttpResponse(operation);
 	if (response) return response;
@@ -395,31 +323,40 @@ function routerAbEcdsaReplayResponse(operation) {
 async function resolveV2EcdsaOperationStepUpAdmission(input) {
 	const token = extractBearerCredential(input.ctx.request.headers);
 	if (!token) return { kind: "not_found" };
-	let resolution;
+	let context;
 	try {
-		resolution = await resolveWalletSessionOperationCredentialAdmission({
-			authorizationSessions: input.ctx.service.authorizationSessions,
+		context = await input.ctx.service.authorizationSessions.readWalletSessionExactOperationContextByCredential({
+			tenantId: input.ctx.service.authorizationSessions.tenantId,
 			token,
-			nowMs: Date.now(),
-			operation: {
-				keyFamily: "ecdsa_secp256k1",
-				operationKind: input.operation.operation_kind
-			}
+			nowMs: Date.now()
 		});
 	} catch {
 		return { kind: "unavailable" };
 	}
-	if (resolution.kind === "not_found") return { kind: "not_found" };
-	if (resolution.kind === "rejected") return {
+	if (!context) return {
 		kind: "rejected",
-		message: "ECDSA operation step-up Wallet Session authorization is invalid"
+		message: "ECDSA operation step-up Wallet Session is unavailable"
 	};
-	if (resolution.admission.curve !== "ecdsa") return {
+	const session = context.session;
+	const admission = resolveWalletSessionAuthorizationV2Admission({
+		authorization: session,
+		authority: context.authority,
+		authMethod: context.authMethod,
+		retiredAtMs: context.retiredAtMs,
+		nowMs: Date.now(),
+		operation: {
+			tenantId: session.tenantId,
+			principalId: session.principalId,
+			walletId: session.walletId,
+			keyFamily: "ecdsa_secp256k1",
+			operationKind: input.operation.operation_kind
+		}
+	});
+	if (!admission.ok || admission.keyFamily !== "ecdsa_secp256k1") return {
 		kind: "rejected",
-		message: "ECDSA operation step-up Wallet Session family is invalid"
+		message: "ECDSA operation step-up Wallet Session authorization is invalid"
 	};
-	const session = resolution.admission.context.authorization.session;
-	const admittedSigner = resolution.admission.admission.signer;
+	const admittedSigner = admission.signer;
 	if (input.operation.wallet_id !== String(session.walletId) || input.operation.material_activation.material_owner !== String(session.walletId) || input.operation.expires_at_ms > session.expiresAtMs || input.operation.expires_at_ms <= Date.now()) return {
 		kind: "rejected",
 		message: "ECDSA operation step-up Wallet Session scope is invalid"
@@ -435,13 +372,13 @@ async function resolveV2EcdsaOperationStepUpAdmission(input) {
 		kind: "rejected",
 		message: "ECDSA operation step-up material is not uniquely active"
 	};
-	if (input.operation.signing_worker_id !== input.operation.normal_signing_scope.signing_worker.server_id || !sameRouterAbMpcMaterialActivationRef(input.operation.material_activation, input.operation.normal_signing_scope.material_activation) || !sameRouterAbMpcMaterialActivationRef(input.operation.material_activation, routerAbMpcMaterialActivationRefToWire(resolution.admission.admission.materialActivation))) return {
+	if (input.operation.signing_worker_id !== input.operation.normal_signing_scope.signing_worker.server_id || !sameRouterAbMpcMaterialActivationRef(input.operation.material_activation, input.operation.normal_signing_scope.material_activation) || !sameRouterAbMpcMaterialActivationRef(input.operation.material_activation, routerAbMpcMaterialActivationRefToWire(admission.materialActivation))) return {
 		kind: "rejected",
 		message: "ECDSA operation step-up material activation is invalid"
 	};
 	const activeMaterial = {
 		ok: true,
-		materialActivation: routerAbMpcMaterialActivationRefToWire(resolution.admission.admission.materialActivation),
+		materialActivation: routerAbMpcMaterialActivationRefToWire(admission.materialActivation),
 		keyHandle: signer.walletKey.keyHandle,
 		relayerKeyId: signer.walletKey.relayerKeyId,
 		participantIds: signer.walletKey.participantIds,
@@ -450,13 +387,13 @@ async function resolveV2EcdsaOperationStepUpAdmission(input) {
 	if (input.operation.operation_kind === "evm.sign_transaction") return {
 		kind: "admitted",
 		operationKind: "evm.sign_transaction",
-		admission: resolution.admission,
+		context,
 		activeMaterial
 	};
 	return {
 		kind: "admitted",
 		operationKind: "evm.export_key",
-		admission: resolution.admission,
+		context,
 		activeMaterial,
 		exportTopology: {
 			signer_set: signer.walletKey.publicCapability.signer_set,
@@ -516,8 +453,8 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 	let v2AuthorityRef;
 	if (v2Resolution.kind === "admitted") {
 		v2AuthorityRef = await walletAuthAuthorityRef({ authority });
-		const session = v2Resolution.admission.context.authorization.session;
-		const context = v2Resolution.admission.context;
+		const session = v2Resolution.context.session;
+		const context = v2Resolution.context;
 		if (authority.walletId !== String(session.walletId) || authority.bindingId !== context.authMethod.walletAuthMethodId || context.authMethod.walletAuthorityId !== context.authority.authorityId) return json({
 			ok: false,
 			code: "scope_mismatch",
@@ -545,10 +482,10 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 		ok: true,
 		authorizedOperations: proofAuthenticated.authorizedOperations,
 		session: {
-			tenantId: v2Resolution.admission.context.authorization.session.tenantId,
-			principalId: v2Resolution.admission.context.authorization.session.principalId,
-			sessionId: String(v2Resolution.admission.context.authorization.session.authorizationId),
-			walletId: String(v2Resolution.admission.context.authorization.session.walletId),
+			tenantId: v2Resolution.context.session.tenantId,
+			principalId: v2Resolution.context.session.principalId,
+			sessionId: String(v2Resolution.context.session.authorizationId),
+			walletId: String(v2Resolution.context.session.walletId),
 			runtimePolicyScope: activeMaterial.runtimePolicyScope,
 			laneAuthorization: {
 				kind: "authority_ref",
@@ -582,7 +519,6 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 		}, { status: 400 });
 	}
 	const expectedChallenge = await computeRouterAbEcdsaOperationStepUpChallengeB64u(operation);
-	const nowMs = Date.now();
 	const requestId = operation.operation_id;
 	let freshMaterial;
 	if (v2Resolution.kind === "admitted") {
@@ -595,7 +531,7 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 			code: "wallet_session_unavailable",
 			message: "Wallet Session authorization is unavailable"
 		}, { status: 503 });
-		if (refreshedV2Resolution.kind !== "admitted" || !sameWalletSessionOperationCredentialAdmission(v2Resolution.admission, refreshedV2Resolution.admission)) return json({
+		if (refreshedV2Resolution.kind !== "admitted" || !walletSessionAuthorizationV2RecordsEqual(v2Resolution.context.session, refreshedV2Resolution.context.session)) return json({
 			ok: false,
 			code: "scope_mismatch",
 			message: "ECDSA operation step-up Wallet Session authorization changed"
@@ -623,112 +559,24 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 	const evidenceSetId = requireAuthorizationValue(parseAuthorizationEvidenceSetId(`ecdsa-step-up-evidence-set:${requestId}`));
 	const expiresAtMs = operation.expires_at_ms;
 	const requestOrigin = authenticated.requestOrigin;
-	let emailOtpUnseal;
-	let factor;
-	switch (proof.kind) {
-		case "passkey": {
-			if (authenticated.session.laneAuthorization.authSource.kind !== "passkey" || proof.authority.factor.credentialIdB64u !== authenticated.session.laneAuthorization.authSource.credentialIdB64u) return json({
-				ok: false,
-				code: "scope_mismatch",
-				message: "Passkey authority changed"
-			}, { status: 403 });
-			const credential = proof.webauthn_authentication;
-			if (String(credential.rawId || credential.id).trim() !== authenticated.session.laneAuthorization.authSource.credentialIdB64u) return json({
-				ok: false,
-				code: "unauthorized",
-				message: "Passkey credential changed"
-			}, { status: 401 });
-			const verified = await input.ctx.service.webAuthn.verifyWebAuthnAuthenticationLite({
-				userId: authenticated.session.walletId,
-				rpId: proof.authority.verifier.rpId,
-				expectedChallenge,
-				expected_origin: requestOrigin,
-				webauthn_authentication: credential
-			});
-			if (!verified.success || !verified.verified) return json({
-				ok: false,
-				code: verified.code || "not_verified",
-				message: verified.message || "WebAuthn authentication verification failed"
-			}, { status: 401 });
-			factor = buildVerifiedWalletOperationPasskeyFactorResult({
-				tenantId: authenticated.session.tenantId,
-				principalId: authenticated.session.principalId,
-				walletId: walletIdFromString(authenticated.session.walletId),
-				requestOrigin,
-				audience: requestOrigin,
-				factorId: requireAuthorizationValue(parseAuthFactorId(`passkey:${authenticated.session.laneAuthorization.authSource.credentialIdB64u}`)),
-				authorityRef: authenticated.authorityRef,
-				operation: envelope,
-				credentialIdB64u: proof.authority.factor.credentialIdB64u,
-				assertionDigest: parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(credential)))),
-				verifiedAtMs: nowMs,
-				expiresAtMs
-			});
-			break;
-		}
-		case "email_otp": {
-			const operationBinding = await hashEmailOtpOperationBinding({
-				walletId: authenticated.session.walletId,
-				providerUserId: proof.authority.factor.providerUserId,
-				orgId: authenticated.session.tenantId,
-				operation: operation.operation_kind === "evm.export_key" ? WALLET_EMAIL_OTP_EXPORT_OPERATION : WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION,
-				requestOrigin,
-				audience: requestOrigin,
-				authorityRef: authenticated.authorityRef,
-				...operation.operation_kind === "evm.sign_transaction" ? { operationFingerprintDigest: envelope.digests.laneDigest } : {}
-			});
-			const verified = await input.ctx.service.emailOtp.verifyEmailOtpChallenge({
-				userId: proof.authority.factor.providerUserId,
-				walletId: authenticated.session.walletId,
-				orgId: authenticated.session.tenantId,
-				challengeId: proof.challenge_id,
-				otpCode: proof.otp_code,
-				otpChannel: EMAIL_OTP_CHANNEL,
-				ownerProofBindingDigest: operationBinding,
-				operation: operation.operation_kind === "evm.export_key" ? WALLET_EMAIL_OTP_EXPORT_OPERATION : WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION
-			});
-			if (!verified.ok) return json(verified, { status: verified.code === "invalid_body" ? 400 : 401 });
-			const consumed = operation.operation_kind === "evm.export_key" ? null : await input.ctx.service.emailOtp.consumeEmailOtpGrant({
-				subject: {
-					kind: "provider_identity",
-					orgId: requireAuthorizationValue(parseOrgId(authenticated.session.tenantId)),
-					providerSubject: requireAuthorizationValue(parseProviderSubject(proof.authority.factor.providerUserId)),
-					walletId: walletIdFromString(authenticated.session.walletId)
-				},
-				loginGrant: verified.loginGrant,
-				otpChannel: EMAIL_OTP_CHANNEL
-			});
-			if (consumed && !consumed.ok) return json(consumed, { status: consumed.code === "invalid_body" ? 400 : 401 });
-			if (operation.operation_kind === "evm.export_key") emailOtpUnseal = {
-				grant: verified.loginGrant,
-				challengeId: verified.challengeId
-			};
-			const verifiedChallengeId = consumed?.ok ? consumed.challengeId : verified.challengeId;
-			factor = buildVerifiedWalletOperationEmailOtpFactorResult({
-				tenantId: authenticated.session.tenantId,
-				principalId: authenticated.session.principalId,
-				walletId: walletIdFromString(authenticated.session.walletId),
-				requestOrigin,
-				audience: requestOrigin,
-				factorId: requireAuthorizationValue(parseAuthFactorId(`email_otp:${proof.authority.factor.provider}:${proof.authority.factor.providerUserId}`)),
-				authorityRef: authenticated.authorityRef,
-				operation: envelope,
-				challengeId: requireAuthorizationValue(parseEmailOtpChallengeId(verifiedChallengeId)),
-				verificationReceiptDigest: parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
-					challengeId: verifiedChallengeId,
-					operationFingerprint: expectedChallenge
-				})))),
-				verifiedAtMs: nowMs,
-				expiresAtMs: Math.min(expiresAtMs, verified.grantExpiresAtMs)
-			});
-			break;
-		}
-	}
+	const verifiedFactor = await verifyEcdsaOperationStepUpFactor({
+		proof,
+		operation: envelope,
+		walletId: walletIdFromString(authenticated.session.walletId),
+		authorityRef: authenticated.authorityRef,
+		authSource: authenticated.session.laneAuthorization.authSource,
+		requestOrigin,
+		expectedChallenge,
+		expiresAtMs,
+		webAuthn: input.ctx.service.webAuthn,
+		emailOtp: input.ctx.service.emailOtp
+	});
+	if (!verifiedFactor.ok) return verifiedFactor.response;
 	const evidenceSet = await input.ctx.service.authorizedOperations.recordVerifiedWalletOperationFactorEvidenceSet({
 		operation: envelope,
 		evidenceId,
 		evidenceSetId,
-		factor
+		factor: verifiedFactor.factor
 	});
 	const authorizedOperationId = requireAuthorizationValue(parseAuthorizedOperationId(`ecdsa-step-up-authorized-operation:${operation.operation_id}`));
 	const atomicOperation = await input.ctx.service.authorizedOperations.admitAuthorizedOperation({
@@ -742,7 +590,7 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 				evidenceSetDigest: evidenceSet.evidenceSetDigest
 			},
 			quota: { kind: "quota_neutral" },
-			claimedAtMs: nowMs
+			claimedAtMs: Date.now()
 		},
 		material: {
 			walletId: walletIdFromString(authenticated.session.walletId),
@@ -775,11 +623,7 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 	const responseAuthorization = {
 		kind: "operation_step_up",
 		evidence_set_digest: evidenceSet.evidenceSetDigest,
-		unseal: emailOtpUnseal ? {
-			kind: "email_otp_grant",
-			grant: emailOtpUnseal.grant,
-			challenge_id: emailOtpUnseal.challengeId
-		} : { kind: "not_requested" }
+		unseal: verifiedFactor.unseal
 	};
 	if (operation.operation_kind === "evm.export_key") {
 		const exportTopology = v2Resolution.kind === "admitted" && v2Resolution.operationKind === "evm.export_key" ? v2Resolution.exportTopology : await resolveStrictEcdsaExportTopology({
@@ -963,6 +807,7 @@ async function authorizeEcdsaPoolFillOperationStepUp(input) {
 				materialExpiresAtMs: input.operation.expires_at_ms
 			},
 			ownerWalletScope,
+			ownershipGeneration: ownerWalletScope.ownershipGeneration,
 			routerAbEcdsaDerivationNormalSigning: {
 				kind: ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1,
 				scope: input.operation.normal_signing_scope
@@ -1042,6 +887,7 @@ async function authorizeEcdsaPoolFill(input) {
 					thresholdExpiresAtMs: session.expiresAtMs,
 					authorization: { kind: "wallet_session" },
 					ownerWalletScope: validated.ownerWalletScope,
+					ownershipGeneration: validated.ownerWalletScope.ownershipGeneration,
 					routerAbEcdsaDerivationNormalSigning: normalSigning
 				}
 			};
@@ -1410,11 +1256,6 @@ async function admitStrictEcdsaExportOperationStepUp(input) {
 		case "wallet_session_quota_exhausted": return strictEcdsaExportFailure(409, result.kind, "Operation step-up authorization is invalid");
 	}
 }
-function sameWalletSessionOperationCredentialAdmission(left, right) {
-	const leftSession = left.context.authorization.session;
-	const rightSession = right.context.authorization.session;
-	return leftSession.tenantId === rightSession.tenantId && leftSession.principalId === rightSession.principalId && leftSession.walletId === rightSession.walletId && leftSession.authorityId === rightSession.authorityId && leftSession.walletAuthMethodId === rightSession.walletAuthMethodId && leftSession.authorityDigestB64u === rightSession.authorityDigestB64u && leftSession.authorityRevocationEpoch === rightSession.authorityRevocationEpoch && leftSession.authorizationId === rightSession.authorizationId && leftSession.walletSessionId === rightSession.walletSessionId && leftSession.quotaId === rightSession.quotaId && leftSession.expiresAtMs === rightSession.expiresAtMs && left.context.authority.authorityId === right.context.authority.authorityId && left.context.authority.authorityDigestB64u === right.context.authority.authorityDigestB64u && left.context.authMethod.walletAuthMethodId === right.context.authMethod.walletAuthMethodId && left.context.authMethod.walletAuthorityId === right.context.authMethod.walletAuthorityId && left.context.retiredAtMs === right.context.retiredAtMs && sameRouterAbMpcMaterialActivationRef(routerAbMpcMaterialActivationRefToWire(left.admission.materialActivation), routerAbMpcMaterialActivationRefToWire(right.admission.materialActivation));
-}
 async function authorizeStrictEcdsaV2ExportOperationStepUp(input) {
 	const operation = input.request.operation;
 	if (!operation) return strictEcdsaExportFailure(400, "invalid_body", "Operation step-up export requires operation preparation");
@@ -1424,8 +1265,8 @@ async function authorizeStrictEcdsaV2ExportOperationStepUp(input) {
 	});
 	if (resolution.kind === "unavailable") return strictEcdsaExportFailure(503, "wallet_session_unavailable", "Wallet Session authorization is unavailable");
 	if (resolution.kind !== "admitted") return strictEcdsaExportFailure(403, "scope_mismatch", "ECDSA export operation step-up Wallet Session authorization is invalid");
-	if (!sameWalletSessionOperationCredentialAdmission(input.authorization.v2Admission, resolution.admission)) return strictEcdsaExportFailure(403, "scope_mismatch", "ECDSA export operation step-up Wallet Session changed");
-	const session = resolution.admission.context.authorization.session;
+	if (!walletSessionAuthorizationV2RecordsEqual(input.authorization.v2Admission.context.authorization.session, resolution.context.session)) return strictEcdsaExportFailure(403, "scope_mismatch", "ECDSA export operation step-up Wallet Session changed");
+	const session = resolution.context.session;
 	const activeMaterial = resolution.activeMaterial;
 	if (input.request.authorization.kind !== "operation_step_up" || operation.operation_kind !== "evm.export_key" || operation.wallet_id !== String(session.walletId) || operation.wallet_id !== input.request.lifecycle.account_id || operation.material_activation.material_owner !== String(session.walletId) || operation.material_activation.signing_worker !== input.request.lifecycle.selected_server_id || operation.signing_worker_id !== input.request.lifecycle.selected_server_id || !sameRouterAbMpcMaterialActivationRef(operation.material_activation, input.request.material_activation) || operation.expires_at_ms < input.request.expires_at_ms || !strictEcdsaExportScopeMatchesRequest({
 		request: input.request,
@@ -1776,6 +1617,6 @@ async function handleThresholdEcdsa(ctx) {
 	return null;
 }
 //#endregion
-export { authorizeEcdsaPoolFill, finishRouterAbEcdsaSigningResponse, handleStrictEcdsaSessionActivation, handleThresholdEcdsa };
+export { authorizeEcdsaPoolFill, handleStrictEcdsaSessionActivation, handleThresholdEcdsa };
 
 //# sourceMappingURL=thresholdEcdsa.js.map