@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/core/IdentityStore.js

@@ -1,339 +1,2 @@
-import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
-import { isObject } from "../shared-ts/src/utils/validation.js";
-import { failure } from "../shared-ts/src/utils/failure.js";
-import { resolveStorePrefix } from "./d1TenantStore.js";
-import { createKeyValueStore } from "./storeBackends.js";
-import { D1IdentityStore, IDENTITY_D1_STORE, IDENTITY_STORE_D1_SCHEMA_SQL, ensureIdentityStoreD1Schema } from "./d1IdentityStore.js";
-//#region src/core/IdentityStore.ts
-function resolveIdentityStoreNamespace(config) {
-	return resolveStorePrefix(config, ["IDENTITY_PREFIX", "IDENTITY_MAP_PREFIX"], "identity:");
-}
-function parseIdentitySubjectRecord(raw) {
-	if (!isObject(raw)) return null;
-	const version = normalizeOptionalTrimmedString(raw.version);
-	const subject = normalizeOptionalTrimmedString(raw.subject);
-	const userId = normalizeOptionalTrimmedString(raw.userId);
-	const createdAtMsRaw = raw.createdAtMs;
-	const updatedAtMsRaw = raw.updatedAtMs;
-	const createdAtMs = typeof createdAtMsRaw === "number" ? createdAtMsRaw : Number(createdAtMsRaw);
-	const updatedAtMs = typeof updatedAtMsRaw === "number" ? updatedAtMsRaw : Number(updatedAtMsRaw);
-	if (version !== "identity_subject_v1") return null;
-	if (!subject || !userId) return null;
-	if (!Number.isFinite(createdAtMs) || createdAtMs <= 0) return null;
-	if (!Number.isFinite(updatedAtMs) || updatedAtMs <= 0) return null;
-	return {
-		version: "identity_subject_v1",
-		subject,
-		userId,
-		createdAtMs: Math.floor(createdAtMs),
-		updatedAtMs: Math.floor(updatedAtMs)
-	};
-}
-function parseIdentityUserRecord(raw) {
-	if (!isObject(raw)) return null;
-	const version = normalizeOptionalTrimmedString(raw.version);
-	const userId = normalizeOptionalTrimmedString(raw.userId);
-	const subjectsRaw = raw.subjects;
-	const subjects = Array.isArray(subjectsRaw) ? subjectsRaw.map((s) => typeof s === "string" ? s.trim() : "").filter(Boolean) : null;
-	const createdAtMsRaw = raw.createdAtMs;
-	const updatedAtMsRaw = raw.updatedAtMs;
-	const createdAtMs = typeof createdAtMsRaw === "number" ? createdAtMsRaw : Number(createdAtMsRaw);
-	const updatedAtMs = typeof updatedAtMsRaw === "number" ? updatedAtMsRaw : Number(updatedAtMsRaw);
-	if (version !== "identity_user_v1") return null;
-	if (!userId || !subjects) return null;
-	if (!Number.isFinite(createdAtMs) || createdAtMs <= 0) return null;
-	if (!Number.isFinite(updatedAtMs) || updatedAtMs <= 0) return null;
-	const uniqueSubjects = Array.from(new Set(subjects));
-	uniqueSubjects.sort();
-	return {
-		version: "identity_user_v1",
-		userId,
-		subjects: uniqueSubjects,
-		createdAtMs: Math.floor(createdAtMs),
-		updatedAtMs: Math.floor(updatedAtMs)
-	};
-}
-var InMemoryIdentityStore = class {
-	constructor(prefix) {
-		this.subjectToUser = /* @__PURE__ */ new Map();
-		this.userToSubjects = /* @__PURE__ */ new Map();
-		this.prefix = prefix;
-	}
-	subjectKey(subject) {
-		return `${this.prefix}subject:${subject}`;
-	}
-	userKey(userId) {
-		return `${this.prefix}user:${userId}`;
-	}
-	async getUserIdBySubject(subject) {
-		const s = normalizeOptionalTrimmedString(subject);
-		if (!s) return null;
-		return this.subjectToUser.get(this.subjectKey(s))?.userId || null;
-	}
-	async listSubjectsByUserId(userId) {
-		const uid = normalizeOptionalTrimmedString(userId);
-		if (!uid) return [];
-		return this.userToSubjects.get(this.userKey(uid))?.subjects || [];
-	}
-	async linkSubjectToUserId(input) {
-		const userId = normalizeOptionalTrimmedString(input.userId);
-		const subject = normalizeOptionalTrimmedString(input.subject);
-		if (!userId) return failure("invalid_args", "Missing userId");
-		if (!subject) return failure("invalid_args", "Missing subject");
-		const now = Date.now();
-		const existing = this.subjectToUser.get(this.subjectKey(subject)) || null;
-		if (existing && existing.userId !== userId) {
-			if (!input.allowMoveIfSoleIdentity) return failure("already_linked", "Subject is already linked to a different user");
-			const sourceUser = existing.userId;
-			const source = this.userToSubjects.get(this.userKey(sourceUser)) || null;
-			const sourceSubjects = source?.subjects || [];
-			if (sourceSubjects.length !== 1 || sourceSubjects[0] !== subject) return failure("already_linked", "Subject is linked to a different user with other identities; merge is not allowed");
-			this.userToSubjects.set(this.userKey(sourceUser), {
-				version: "identity_user_v1",
-				userId: sourceUser,
-				subjects: [],
-				createdAtMs: source?.createdAtMs || now,
-				updatedAtMs: now
-			});
-			this.subjectToUser.set(this.subjectKey(subject), {
-				version: "identity_subject_v1",
-				subject,
-				userId,
-				createdAtMs: existing.createdAtMs,
-				updatedAtMs: now
-			});
-			const dest = this.userToSubjects.get(this.userKey(userId)) || null;
-			const destSubjects = Array.from(new Set([...dest?.subjects || [], subject]));
-			destSubjects.sort();
-			this.userToSubjects.set(this.userKey(userId), {
-				version: "identity_user_v1",
-				userId,
-				subjects: destSubjects,
-				createdAtMs: dest?.createdAtMs || now,
-				updatedAtMs: now
-			});
-			return {
-				ok: true,
-				movedFromUserId: sourceUser
-			};
-		}
-		if (!existing) this.subjectToUser.set(this.subjectKey(subject), {
-			version: "identity_subject_v1",
-			subject,
-			userId,
-			createdAtMs: now,
-			updatedAtMs: now
-		});
-		else this.subjectToUser.set(this.subjectKey(subject), {
-			...existing,
-			updatedAtMs: now
-		});
-		const existingUser = this.userToSubjects.get(this.userKey(userId)) || null;
-		const nextSubjects = Array.from(new Set([...existingUser?.subjects || [], subject]));
-		nextSubjects.sort();
-		this.userToSubjects.set(this.userKey(userId), {
-			version: "identity_user_v1",
-			userId,
-			subjects: nextSubjects,
-			createdAtMs: existingUser?.createdAtMs || now,
-			updatedAtMs: now
-		});
-		return { ok: true };
-	}
-	async unlinkSubjectFromUserId(input) {
-		const userId = normalizeOptionalTrimmedString(input.userId);
-		const subject = normalizeOptionalTrimmedString(input.subject);
-		if (!userId) return failure("invalid_args", "Missing userId");
-		if (!subject) return failure("invalid_args", "Missing subject");
-		const existing = this.subjectToUser.get(this.subjectKey(subject)) || null;
-		if (!existing || existing.userId !== userId) return failure("not_found", "Subject is not linked to this user");
-		const userRec = this.userToSubjects.get(this.userKey(userId)) || null;
-		const subjects = userRec?.subjects || [];
-		if (subjects.length <= 1) return failure("cannot_unlink_last_identity", "Refusing to remove the last remaining identity");
-		this.subjectToUser.delete(this.subjectKey(subject));
-		const now = Date.now();
-		const nextSubjects = subjects.filter((s) => s !== subject);
-		nextSubjects.sort();
-		this.userToSubjects.set(this.userKey(userId), {
-			version: "identity_user_v1",
-			userId,
-			subjects: nextSubjects,
-			createdAtMs: userRec?.createdAtMs || now,
-			updatedAtMs: now
-		});
-		return { ok: true };
-	}
-	async deleteSubjectLinkForDevCleanup(input) {
-		const userId = normalizeOptionalTrimmedString(input.userId);
-		const subject = normalizeOptionalTrimmedString(input.subject);
-		if (!userId) return failure("invalid_args", "Missing userId");
-		if (!subject) return failure("invalid_args", "Missing subject");
-		const existing = this.subjectToUser.get(this.subjectKey(subject)) || null;
-		if (!existing || existing.userId !== userId) return failure("not_found", "Subject is not linked to this user");
-		this.subjectToUser.delete(this.subjectKey(subject));
-		const now = Date.now();
-		const userRec = this.userToSubjects.get(this.userKey(userId)) || null;
-		const nextSubjects = (userRec?.subjects || []).filter((s) => s !== subject);
-		if (nextSubjects.length > 0) {
-			nextSubjects.sort();
-			this.userToSubjects.set(this.userKey(userId), {
-				version: "identity_user_v1",
-				userId,
-				subjects: nextSubjects,
-				createdAtMs: userRec?.createdAtMs || now,
-				updatedAtMs: now
-			});
-		} else this.userToSubjects.delete(this.userKey(userId));
-		return { ok: true };
-	}
-};
-/** Upstash REST, Redis TCP and Durable Object backends, which hold records unparsed. */
-var KeyValueIdentityStore = class {
-	constructor(records, prefix) {
-		this.records = records;
-		this.prefix = prefix;
-	}
-	subjectKey(subject) {
-		return `${this.prefix}subject:${subject}`;
-	}
-	userKey(userId) {
-		return `${this.prefix}user:${userId}`;
-	}
-	async getUserIdBySubject(subject) {
-		const s = normalizeOptionalTrimmedString(subject);
-		if (!s) return null;
-		return parseIdentitySubjectRecord(await this.records.get(this.subjectKey(s)))?.userId || null;
-	}
-	async listSubjectsByUserId(userId) {
-		const uid = normalizeOptionalTrimmedString(userId);
-		if (!uid) return [];
-		return parseIdentityUserRecord(await this.records.get(this.userKey(uid)))?.subjects || [];
-	}
-	async linkSubjectToUserId(input) {
-		const userId = normalizeOptionalTrimmedString(input.userId);
-		const subject = normalizeOptionalTrimmedString(input.subject);
-		if (!userId) return failure("invalid_args", "Missing userId");
-		if (!subject) return failure("invalid_args", "Missing subject");
-		const now = Date.now();
-		const existingSubject = parseIdentitySubjectRecord(await this.records.get(this.subjectKey(subject)));
-		if (existingSubject && existingSubject.userId !== userId) {
-			if (!input.allowMoveIfSoleIdentity) return failure("already_linked", "Subject is already linked to a different user");
-			const sourceUser = existingSubject.userId;
-			const sourceUserRec = parseIdentityUserRecord(await this.records.get(this.userKey(sourceUser)));
-			const sourceSubjects = sourceUserRec?.subjects || [];
-			if (sourceSubjects.length !== 1 || sourceSubjects[0] !== subject) return failure("already_linked", "Subject is linked to a different user with other identities; merge is not allowed");
-			const destUserRec = parseIdentityUserRecord(await this.records.get(this.userKey(userId)));
-			const destSubjects = Array.from(new Set([...destUserRec?.subjects || [], subject]));
-			destSubjects.sort();
-			await this.records.set(this.userKey(userId), {
-				version: "identity_user_v1",
-				userId,
-				subjects: destSubjects,
-				createdAtMs: destUserRec?.createdAtMs || now,
-				updatedAtMs: now
-			});
-			await this.records.set(this.userKey(sourceUser), {
-				version: "identity_user_v1",
-				userId: sourceUser,
-				subjects: [],
-				createdAtMs: sourceUserRec?.createdAtMs || existingSubject.createdAtMs || now,
-				updatedAtMs: now
-			});
-			await this.records.set(this.subjectKey(subject), {
-				version: "identity_subject_v1",
-				subject,
-				userId,
-				createdAtMs: existingSubject.createdAtMs || now,
-				updatedAtMs: now
-			});
-			return {
-				ok: true,
-				movedFromUserId: sourceUser
-			};
-		}
-		await this.records.set(this.subjectKey(subject), {
-			version: "identity_subject_v1",
-			subject,
-			userId,
-			createdAtMs: existingSubject?.createdAtMs || now,
-			updatedAtMs: now
-		});
-		const userRec = parseIdentityUserRecord(await this.records.get(this.userKey(userId)));
-		const subjects = Array.from(new Set([...userRec?.subjects || [], subject]));
-		subjects.sort();
-		await this.records.set(this.userKey(userId), {
-			version: "identity_user_v1",
-			userId,
-			subjects,
-			createdAtMs: userRec?.createdAtMs || now,
-			updatedAtMs: now
-		});
-		return { ok: true };
-	}
-	async unlinkSubjectFromUserId(input) {
-		const userId = normalizeOptionalTrimmedString(input.userId);
-		const subject = normalizeOptionalTrimmedString(input.subject);
-		if (!userId) return failure("invalid_args", "Missing userId");
-		if (!subject) return failure("invalid_args", "Missing subject");
-		const subjectRec = parseIdentitySubjectRecord(await this.records.get(this.subjectKey(subject)));
-		if (!subjectRec || subjectRec.userId !== userId) return failure("not_found", "Subject is not linked to this user");
-		const userRec = parseIdentityUserRecord(await this.records.get(this.userKey(userId)));
-		const subjects = userRec?.subjects || [];
-		if (subjects.length <= 1) return failure("cannot_unlink_last_identity", "Refusing to remove the last remaining identity");
-		const nextSubjects = subjects.filter((s) => s !== subject);
-		nextSubjects.sort();
-		await this.records.set(this.userKey(userId), {
-			version: "identity_user_v1",
-			userId,
-			subjects: nextSubjects,
-			createdAtMs: userRec?.createdAtMs || Date.now(),
-			updatedAtMs: Date.now()
-		});
-		await this.records.del(this.subjectKey(subject));
-		return { ok: true };
-	}
-	async deleteSubjectLinkForDevCleanup(input) {
-		const userId = normalizeOptionalTrimmedString(input.userId);
-		const subject = normalizeOptionalTrimmedString(input.subject);
-		if (!userId) return failure("invalid_args", "Missing userId");
-		if (!subject) return failure("invalid_args", "Missing subject");
-		const subjectRec = parseIdentitySubjectRecord(await this.records.get(this.subjectKey(subject)));
-		if (!subjectRec || subjectRec.userId !== userId) return failure("not_found", "Subject is not linked to this user");
-		const userRec = parseIdentityUserRecord(await this.records.get(this.userKey(userId)));
-		const nextSubjects = (userRec?.subjects || []).filter((s) => s !== subject);
-		if (nextSubjects.length > 0) {
-			nextSubjects.sort();
-			await this.records.set(this.userKey(userId), {
-				version: "identity_user_v1",
-				userId,
-				subjects: nextSubjects,
-				createdAtMs: userRec?.createdAtMs || Date.now(),
-				updatedAtMs: Date.now()
-			});
-		} else await this.records.del(this.userKey(userId));
-		await this.records.del(this.subjectKey(subject));
-		return { ok: true };
-	}
-};
-const IDENTITY_STORE = {
-	tag: "identity",
-	label: "identity",
-	connectionErrorSubject: "identity store",
-	durableObjectLog: "identity store",
-	durableObjectErrorName: "Identity",
-	unconfiguredNote: "non-persistent",
-	d1StoreName: IDENTITY_D1_STORE,
-	resolvePrefix: resolveIdentityStoreNamespace,
-	parse: (raw) => raw
-};
-function createIdentityStore(input) {
-	return createKeyValueStore(input, IDENTITY_STORE, {
-		d1: (options) => new D1IdentityStore(options),
-		keyValue: (records, prefix) => new KeyValueIdentityStore(records, prefix),
-		inMemory: (prefix) => new InMemoryIdentityStore(prefix)
-	});
-}
-//#endregion
-export { D1IdentityStore, IDENTITY_STORE_D1_SCHEMA_SQL, createIdentityStore, ensureIdentityStoreD1Schema, resolveIdentityStoreNamespace };
-
-//# sourceMappingURL=IdentityStore.js.map
+import { D1IdentityStore, IDENTITY_STORE_D1_SCHEMA_SQL, ensureIdentityStoreD1Schema } from "./d1IdentityStore.js";
+export { D1IdentityStore, IDENTITY_STORE_D1_SCHEMA_SQL, ensureIdentityStoreD1Schema };

package/dist/esm/core/ThresholdService/config.js

@@ -1,13 +1,5 @@
-import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
 import { THRESHOLD_ED25519_2P_PARTICIPANT_IDS, normalizeThresholdEd25519ParticipantId, normalizeThresholdEd25519ParticipantIds } from "../../shared-ts/src/threshold/participants.js";
 //#region src/core/ThresholdService/config.ts
-function coerceThresholdNodeRole(input) {
-	const role = normalizeOptionalTrimmedString(input);
-	if (role === "cosigner") return "cosigner";
-	if (role === "coordinator") return "coordinator";
-	return "coordinator";
-}
 function parseThresholdEd25519ParticipantIds2p(input) {
 	const clientIdRaw = input.THRESHOLD_ED25519_CLIENT_PARTICIPANT_ID;
 	const relayerIdRaw = input.THRESHOLD_ED25519_RELAYER_PARTICIPANT_ID;
@@ -25,6 +17,6 @@ function parseThresholdEd25519ParticipantIds2p(input) {
 	};
 }
 //#endregion
-export { coerceThresholdNodeRole, parseThresholdEd25519ParticipantIds2p };
+export { parseThresholdEd25519ParticipantIds2p };
 
 //# sourceMappingURL=config.js.map

package/dist/esm/core/ThresholdService/index.js

@@ -1,4 +0,0 @@
-import { createEcdsaWalletSessionStore, createEd25519WalletSessionStore } from "./stores/WalletSessionStore.js";
-import { createThresholdEd25519KeyStore } from "./stores/KeyStore.js";
-import { createThresholdEd25519SessionStore } from "./stores/SessionStore.js";
-export { createEcdsaWalletSessionStore, createEd25519WalletSessionStore, createThresholdEd25519KeyStore, createThresholdEd25519SessionStore };

package/dist/esm/core/ThresholdService/kv.js

@@ -65,43 +65,6 @@ var UpstashRedisRestClient = class {
 	async setJson(key, value, ttlMs) {
 		await this.setRaw(key, JSON.stringify(value), ttlMs);
 	}
-	async getdelJson(key) {
-		const k = encodeURIComponent(key);
-		try {
-			const raw = readResult(await this.call(`/getdel/${k}`, "POST"));
-			if (raw === null) return null;
-			if (typeof raw === "string") return tryParseJson(raw);
-			return raw;
-		} catch {
-			const raw = await this.getJson(key);
-			if (raw) await this.del(key);
-			return raw;
-		}
-	}
-	async incrby(key, delta) {
-		const k = encodeURIComponent(key);
-		const d = encodeURIComponent(String(Math.trunc(Number(delta) || 0)));
-		const raw = readResult(await this.call(`/incrby/${k}/${d}`, "POST"));
-		const n = typeof raw === "number" ? raw : Number(raw);
-		if (!Number.isFinite(n)) throw new Error(`Upstash INCRBY returned non-number result: ${String(raw)}`);
-		return n;
-	}
-	async rpush(key, value) {
-		const k = encodeURIComponent(key);
-		const v = encodeURIComponent(value);
-		const raw = readResult(await this.call(`/rpush/${k}/${v}`, "POST"));
-		const n = typeof raw === "number" ? raw : Number(raw);
-		if (!Number.isFinite(n)) throw new Error(`Upstash RPUSH returned non-number result: ${String(raw)}`);
-		return n;
-	}
-	async lpop(key) {
-		const k = encodeURIComponent(key);
-		const raw = readResult(await this.call(`/lpop/${k}`, "POST"));
-		if (raw === null || raw === void 0) return null;
-		if (typeof raw === "string") return raw;
-		if (Array.isArray(raw) && typeof raw[0] === "string") return raw[0];
-		return String(raw);
-	}
 	async eval(script, keys, args) {
 		const keyList = Array.isArray(keys) ? keys : [];
 		const argList = Array.isArray(args) ? args : [];
@@ -334,35 +297,7 @@ async function redisSetJson(client, key, value, ttlMs) {
 	]);
 	if (resp.type === "error") throw new Error(`Redis SET error: ${resp.value}`);
 }
-async function redisGetdelJson(client, key) {
-	const resp = await client.send(["GETDEL", key]);
-	if (resp.type === "bulk") {
-		if (!resp.value) return null;
-		return tryParseJson(resp.value);
-	}
-	if (resp.type === "error") {
-		const msg = resp.value;
-		if (/unknown\s+command|ERR\s+unknown\s+command/i.test(msg)) {
-			const raw = await redisGetJson(client, key);
-			if (raw) await redisDel(client, key);
-			return raw;
-		}
-		throw new Error(`Redis GETDEL error: ${resp.value}`);
-	}
-	return null;
-}
-async function redisEval(client, script, keys, args) {
-	const resp = await client.send([
-		"EVAL",
-		script,
-		String(keys.length),
-		...keys,
-		...args
-	]);
-	if (resp.type === "error") throw new Error(`Redis EVAL error: ${resp.value}`);
-	return resp;
-}
 //#endregion
-export { RedisTcpClient, UpstashRedisRestClient, redisDel, redisEval, redisGetJson, redisGetRaw, redisGetdelJson, redisSetJson };
+export { RedisTcpClient, UpstashRedisRestClient, redisDel, redisGetJson, redisSetJson };
 
 //# sourceMappingURL=kv.js.map

package/dist/esm/core/ThresholdService/routerAb/ecdsaDerivationPoolFillHandlers.js

@@ -1,11 +1,10 @@
 import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
-import "../../../shared-ts/src/utils/validation.js";
 import { signingRootScopeFromRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
 import { ROUTER_AB_ECDSA_PRESIGN_CEREMONY_MAX_LIFETIME_MS, parseRouterAbEcdsaDerivationNormalSigningScopeV1, sameRouterAbEcdsaDerivationNormalSigningScopeV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { normalizeThresholdEd25519ParticipantIds } from "../../../shared-ts/src/threshold/participants.js";
-import { parseEcdsaKeyHandle } from "../../../shared-ts/src/threshold/keyMaterialBrands.js";
 import { WALLET_SESSION_FAILURE_CODES } from "../../../shared-ts/src/utils/walletSessionFailure.js";
 import { startRouterAbEcdsaPresignSession, stepRouterAbEcdsaPresignSession } from "./ecdsaDerivationPresignBridge.js";
+import { parseEcdsaKeyHandle } from "../../../shared-ts/src/threshold/keyMaterialBrands.js";
 //#region src/core/ThresholdService/routerAb/ecdsaDerivationPoolFillHandlers.ts
 const PRESIGN_SESSION_ID_PREFIX = "ecdsa-presign-v2";
 const MAX_DURABLE_PRESIGNATURE_LIFETIME_MS = 2160 * 60 * 6e4;
@@ -24,9 +23,11 @@ function presignAuthorityForBinding(binding) {
 	};
 	return binding.authorization.kind === "operation_step_up" ? {
 		kind: "operation_step_up",
+		ownership_generation: binding.ownershipGeneration,
 		wallet_scope: walletScope
 	} : {
 		kind: "owner_wallet_session",
+		ownership_generation: binding.ownershipGeneration,
 		wallet_scope: walletScope
 	};
 }
@@ -215,7 +216,6 @@ function sameParticipantIds(a, b) {
 }
 var RouterAbEcdsaDerivationPoolFillHandlers = class {
 	constructor(input) {
-		this.nodeRole = input.nodeRole;
 		this.participantIds2p = input.participantIds2p;
 		this.ensureReady = input.ensureReady;
 		this.signingWorkerTransport = input.signingWorkerTransport;
@@ -347,11 +347,6 @@ var RouterAbEcdsaDerivationPoolFillHandlers = class {
 		};
 	}
 	async routerAbEcdsaDerivationPresignaturePoolFillInit(input) {
-		if (this.nodeRole !== "coordinator") return {
-			ok: false,
-			code: "not_found",
-			message: "Router A/B ECDSA derivation pool-fill endpoints are not enabled on this server (set THRESHOLD_NODE_ROLE=coordinator)"
-		};
 		await this.ensureReady();
 		const parsedRequest = parseRouterAbEcdsaDerivationPoolFillInitRequest(input.request);
 		if (!parsedRequest.ok) return parsedRequest;
@@ -399,11 +394,6 @@ var RouterAbEcdsaDerivationPoolFillHandlers = class {
 		});
 	}
 	async routerAbEcdsaDerivationPresignaturePoolFillStep(input) {
-		if (this.nodeRole !== "coordinator") return {
-			ok: false,
-			code: "not_found",
-			message: "Router A/B ECDSA derivation pool-fill endpoints are not enabled on this server (set THRESHOLD_NODE_ROLE=coordinator)"
-		};
 		await this.ensureReady();
 		const parsedRequest = parseRouterAbEcdsaDerivationPoolFillStepRequest(input.request);
 		if (!parsedRequest.ok) return parsedRequest;

package/dist/esm/core/ThresholdService/routerAb/ecdsaDerivationPresignBridge.js

@@ -1,4 +1,5 @@
 import { parseRouterAbEcdsaDerivationNormalSigningScopeV1, parseRouterAbEcdsaSigningWorkerProtocolExportShareEnvelopeV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { walletObjectIdentityFromWireScope, walletObjectIdentityHeaders } from "../../../router/cloudflare/runtime/walletObjectAddresses.js";
 import { ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1, postRouterAbInternalServiceJson } from "./internalServiceHttp.js";
 //#region src/core/ThresholdService/routerAb/ecdsaDerivationPresignBridge.ts
 const CLOUDFLARE_SIGNING_WORKER_ECDSA_PRESIGN_SESSION_INIT_PATH = "/router-ab/signing-worker/ecdsa-derivation/presignature-session/init";
@@ -112,6 +113,7 @@ async function postStrictPresignSession(input) {
 	const response = await postRouterAbInternalServiceJson({
 		url: `${base}${input.path}`,
 		body: input.body,
+		headers: walletObjectIdentityHeaders(input.walletIdentity),
 		authSecret: input.auth.secret,
 		fetchImpl: input.fetchImpl,
 		onServerTiming: input.onServerTiming
@@ -136,6 +138,7 @@ async function postStrictPresignSession(input) {
 }
 async function startRouterAbEcdsaPresignSession(input) {
 	return postStrictPresignSession({
+		walletIdentity: walletObjectIdentityFromWireScope(input.authority.wallet_scope, input.authority.ownership_generation),
 		signingWorkerBaseUrl: input.signingWorkerBaseUrl,
 		path: CLOUDFLARE_SIGNING_WORKER_ECDSA_PRESIGN_SESSION_INIT_PATH,
 		body: {
@@ -153,6 +156,7 @@ async function startRouterAbEcdsaPresignSession(input) {
 }
 async function stepRouterAbEcdsaPresignSession(input) {
 	return postStrictPresignSession({
+		walletIdentity: walletObjectIdentityFromWireScope(input.authority.wallet_scope, input.authority.ownership_generation),
 		signingWorkerBaseUrl: input.signingWorkerBaseUrl,
 		path: CLOUDFLARE_SIGNING_WORKER_ECDSA_PRESIGN_SESSION_STEP_PATH,
 		body: {
@@ -176,10 +180,13 @@ async function stepRouterAbEcdsaPresignSession(input) {
 */
 async function startRouterAbLinkedDeviceEcdsaPresignSession(input) {
 	return postStrictPresignSession({
+		walletIdentity: walletObjectIdentityFromWireScope(input.walletScope, input.ownershipGeneration),
 		signingWorkerBaseUrl: input.signingWorkerBaseUrl,
 		path: CLOUDFLARE_SIGNING_WORKER_ECDSA_LINKED_PRESIGN_SESSION_INIT_PATH,
 		body: {
 			request: input.request,
+			wallet_scope: input.walletScope,
+			ownership_generation: input.ownershipGeneration,
 			material_source: input.materialSource,
 			presign_session_id: input.presignSessionId,
 			expires_at_ms: input.expiresAtMs
@@ -190,10 +197,13 @@ async function startRouterAbLinkedDeviceEcdsaPresignSession(input) {
 }
 async function stepRouterAbLinkedDeviceEcdsaPresignSession(input) {
 	return postStrictPresignSession({
+		walletIdentity: walletObjectIdentityFromWireScope(input.walletScope, input.ownershipGeneration),
 		signingWorkerBaseUrl: input.signingWorkerBaseUrl,
 		path: CLOUDFLARE_SIGNING_WORKER_ECDSA_LINKED_PRESIGN_SESSION_STEP_PATH,
 		body: {
 			request: input.request,
+			wallet_scope: input.walletScope,
+			ownership_generation: input.ownershipGeneration,
 			material_source: input.materialSource,
 			presign_session_id: input.presignSessionId,
 			requested_stage: input.requestedStage,

package/dist/esm/core/ThresholdService/routerAb/internalServiceHttp.js

@@ -15,6 +15,7 @@ async function postRouterAbInternalServiceJson(input) {
 		response = await input.fetchImpl(input.url, {
 			method: "POST",
 			headers: {
+				...input.headers,
 				"content-type": "application/json",
 				[ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1]: normalizeRouterAbInternalServiceAuthSecret(input.authSecret)
 			},

package/dist/esm/core/ThresholdService/routerAbNormalSigningPolicy.js

@@ -1,15 +1,5 @@
-import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
 import { failure } from "../../shared-ts/src/utils/failure.js";
 //#region src/core/ThresholdService/routerAbNormalSigningPolicy.ts
-function parseRouterAbNormalSigningServerPolicy(config) {
-	const signingWorkerId = normalizeOptionalTrimmedString(config.ROUTER_AB_NORMAL_SIGNING_WORKER_ID);
-	if (!signingWorkerId) throw new Error("Missing required server config: ROUTER_AB_NORMAL_SIGNING_WORKER_ID");
-	return {
-		mode: "enabled",
-		signingWorkerId
-	};
-}
 function validateRouterAbNormalSigningServerPolicy(args) {
 	if (!args.requested) return failure("unauthorized", "sessionPolicy.routerAbNormalSigning is required for Router A/B normal signing");
 	if (args.requested.signingWorkerId !== args.policy.signingWorkerId) return failure("unauthorized", "sessionPolicy.routerAbNormalSigning.signingWorkerId is not allowed for this threshold server");
@@ -19,6 +9,6 @@ function validateRouterAbNormalSigningServerPolicy(args) {
 	};
 }
 //#endregion
-export { parseRouterAbNormalSigningServerPolicy, validateRouterAbNormalSigningServerPolicy };
+export { validateRouterAbNormalSigningServerPolicy };
 
 //# sourceMappingURL=routerAbNormalSigningPolicy.js.map