@seams/wallet-server 0.6.1 → 0.7.1

package/dist/esm/router/domains/signingOperations/routerAbPrivateSigningWorker.js

@@ -1,120 +1,14 @@
-import { mpcMaterialActivationRefsEqual, parseMpcMaterialActivationId, parseProviderSubject, parseWalletId } from "../../../shared-ts/src/utils/domainIds.js";
-import { buildAuthorizationGrantRef, buildEvmEcdsaMpcOperationRef, buildNearEd25519MpcOperationRef, parseAuthorizationAuditEventId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parsePrincipalId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { buildCapabilityOperationEnvelope, computeCapabilityOperationFingerprintDigest, parseSigningOperationFingerprintDigest } from "../../../shared-ts/src/authorization/operationFingerprint.js";
 import "../../../shared-ts/src/utils/encoders.js";
-import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { walletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1, parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1, routerAbEcdsaDerivationActiveStateId, routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestDigestV1, routerAbEcdsaDerivationEvmDigestSigningRequestDigestV1, sameRouterAbEcdsaDerivationNormalSigningScopeV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { authorizedOperationReplayBodyInit, parseSessionOrigin } from "../../../authorization/domain.js";
-import { WALLET_SESSION_FAILURE_CODES } from "../../../shared-ts/src/utils/walletSessionFailure.js";
+import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
+import { parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1, routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestDigestV1, routerAbEcdsaDerivationEvmDigestSigningRequestDigestV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { postRouterAbInternalServiceJson } from "../../../core/ThresholdService/routerAb/internalServiceHttp.js";
-import { extractBearerCredential } from "../../auth/routerApiKeyAuth.js";
-import { walletSessionFailure, walletSessionFailureStatus } from "../../auth/walletSessionFailure.js";
-import { resolveWalletSessionAuthorizationV2Admission } from "./walletExecutionAdmission.js";
-import { resolveWalletSessionOperationCredentialAdmission, validateRouterAbEcdsaDerivationWalletSessionInputs, validateRouterAbEd25519WalletSessionInputs } from "../../auth/commonRouterUtils.js";
-import { parseEd25519ReusableAuthorizedOperationReceipt, parseEd25519VerifiedStepUpAuthorizedOperationReceipt } from "./ed25519AuthorizedOperationReceipt.js";
+import { requireMpcMaterialActivationId, routerAbSigningError } from "./routerAbNormalSigningAdmission.js";
 //#region src/router/domains/signingOperations/routerAbPrivateSigningWorker.ts
 const ED25519_SIGNING_INTENT_VERSION_V2 = "router-ab-protocol/ed25519-normal-signing/intent/v2";
 const ED25519_SIGNING_PAYLOAD_VERSION_V2 = "router-ab-protocol/ed25519-normal-signing/payload/v2";
 const ED25519_ROUND1_BINDING_VERSION_V2 = "router-ab-protocol/ed25519-normal-signing/round1-binding/v2";
 const ED25519_TRUSTED_SOURCE_VERSION_V2 = "router-ab-cloudflare-trusted-source/v2";
-function routerAbEcdsaAtomicAuthorizationConfigured(authorizedOperations) {
-	return typeof authorizedOperations.admitAuthorizedOperation === "function";
-}
-function buildRouterAbEd25519AcceptedAuthorizedOperationV1(input) {
-	const operation = input.operation;
-	const operationRef = operation.operation.operation;
-	if (operationRef.capabilityKind !== "near_ed25519_mpc_signing") throw new Error("Ed25519 authorized operation capability is invalid");
-	if (operationRef.operationKind === "near.export_key") throw new Error("Ed25519 export cannot use normal-signing admission");
-	return buildRouterAbAcceptedAuthorizedOperationV1({
-		operation,
-		operationKind: operationRef.operationKind,
-		capabilityKind: "near_ed25519_mpc_signing",
-		binding: input.binding
-	});
-}
-function buildRouterAbEcdsaAcceptedAuthorizedOperationV1(input) {
-	const operation = input.operation;
-	const operationRef = operation.operation.operation;
-	if (operationRef.capabilityKind !== "evm_ecdsa_mpc_signing" || operationRef.operationKind !== "evm.sign_transaction") throw new Error("ECDSA authorized operation capability or operation kind is invalid");
-	return buildRouterAbAcceptedAuthorizedOperationV1({
-		operation,
-		operationKind: "evm.sign_transaction",
-		capabilityKind: "evm_ecdsa_mpc_signing",
-		binding: input.binding
-	});
-}
-function buildRouterAbAcceptedAuthorizedOperationV1(input) {
-	const operation = input.operation;
-	const commonAuthorizedOperation = {
-		authorized_operation_id: operation.authorizedOperationId,
-		operation_id: operation.operation.operationId,
-		capability_kind: input.capabilityKind,
-		operation_kind: input.operationKind,
-		lane_digest_b64u: operation.operation.digests.laneDigest,
-		intent_digest_b64u: operation.operation.digests.intentDigest,
-		display_digest_b64u: operation.operation.digests.displayDigest,
-		operation_fingerprint_digest: operation.operationFingerprintDigest
-	};
-	switch (input.binding.kind) {
-		case "reusable_wallet_session":
-			if (operation.authorization.kind !== "authorization_grant" || operation.quota.kind !== "consume_reusable_wallet_session") throw new Error("Reusable Wallet Session authorized operation is invalid");
-			return {
-				binding: {
-					kind: "reusable_wallet_session",
-					authorization_id: operation.authorization.authorizationGrantRef.authorizationId,
-					wallet_session_id: input.binding.walletSessionId,
-					quota_id: input.binding.quotaId
-				},
-				authorized_operation: {
-					kind: "reusable_wallet_session_authorized_operation_v1",
-					...commonAuthorizedOperation
-				}
-			};
-		case "gateway_owner_wallet_session":
-			if (operation.authorization.kind !== "authorization_grant" || operation.quota.kind !== "consume_reusable_wallet_session") throw new Error("Gateway owner Wallet Session authorized operation is invalid");
-			return {
-				binding: {
-					kind: "gateway_owner_wallet_session",
-					subject_id: input.binding.subjectId,
-					account_id: input.binding.accountId,
-					authorization_id: input.binding.authorizationId,
-					wallet_session_id: input.binding.walletSessionId,
-					quota_id: input.binding.quotaId,
-					threshold_session_id: input.binding.thresholdSessionId,
-					org_id: input.binding.orgId,
-					project_id: input.binding.projectId,
-					environment: input.binding.environment,
-					signing_worker_id: input.binding.signingWorkerId,
-					expires_at_ms: input.binding.expiresAtMs
-				},
-				authorized_operation: {
-					kind: "reusable_wallet_session_authorized_operation_v1",
-					...commonAuthorizedOperation
-				}
-			};
-		case "operation_step_up":
-			if (operation.authorization.kind !== "verified_step_up" || operation.quota.kind !== "quota_neutral") throw new Error("Verified step-up authorized operation is invalid");
-			return {
-				binding: {
-					kind: "operation_step_up",
-					authorization_session_id: input.binding.authorizationSessionId,
-					org_id: input.binding.orgId,
-					project_id: input.binding.projectId,
-					environment: input.binding.environment,
-					subject_id: input.binding.subjectId
-				},
-				authorized_operation: {
-					kind: "verified_step_up_authorized_operation_v1",
-					authorization_session_id: input.binding.authorizationSessionId,
-					evidence_set_digest: operation.authorization.evidenceSetDigest,
-					...commonAuthorizedOperation
-				}
-			};
-	}
-}
 const PRIVATE_ED25519_SIGNING_PREPARE_PATH = "/router-ab/signing-worker/sign/prepare";
 const PRIVATE_ED25519_SIGNING_FINALIZE_PATH = "/router-ab/signing-worker/sign";
 const PRIVATE_ECDSA_DERIVATION_SIGNING_PREPARE_PATH = "/router-ab/signing-worker/ecdsa-derivation/sign/prepare";
@@ -131,340 +25,6 @@ function resolveRouterAbSigningWorkerFetch(input) {
 	if (input) return input;
 	return typeof globalThis.fetch === "function" ? globalThis.fetch.bind(globalThis) : null;
 }
-function routerAbEcdsaOperationInProgressResult() {
-	return routerAbStepUpError(409, "operation_in_progress", "ECDSA signing operation is already in progress");
-}
-function buildRouterAbEcdsaOwnerOperationStepUpPreparation(input) {
-	const [firstParticipantId, secondParticipantId] = input.participantIds;
-	if (!input.keyHandle || !input.relayerKeyId || firstParticipantId === void 0 || secondParticipantId === void 0 || input.participantIds.length !== 2) return null;
-	return {
-		wallet_id: input.request.scope.wallet_id,
-		operation_kind: "evm.sign_transaction",
-		operation_id: input.request.operation_id,
-		operation_digests: input.request.operation_digests,
-		material_activation: input.request.material_activation,
-		normal_signing_scope: input.request.scope,
-		signing_worker_id: input.request.scope.signing_worker.server_id,
-		key_handle: input.keyHandle,
-		relayer_key_id: input.relayerKeyId,
-		participant_ids: [firstParticipantId, secondParticipantId],
-		expires_at_ms: input.request.expires_at_ms
-	};
-}
-async function resolveRouterAbEcdsaOwnerOperationStepUpPreparation(input) {
-	if (input.phase !== "prepare") return void 0;
-	try {
-		const request = parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1(input.body);
-		const walletId = parseWalletId(request.scope.wallet_id);
-		if (!walletId.ok) return void 0;
-		const activeMaterial = await input.resolveEcdsaMaterialActivation({
-			walletId: walletId.value,
-			materialActivation: request.material_activation
-		});
-		if (!activeMaterial.ok) return void 0;
-		return buildRouterAbEcdsaOwnerOperationStepUpPreparation({
-			request,
-			keyHandle: activeMaterial.keyHandle,
-			relayerKeyId: activeMaterial.relayerKeyId,
-			participantIds: activeMaterial.participantIds
-		}) ?? void 0;
-	} catch {
-		return;
-	}
-}
-function decideRouterAbEcdsaOwnerOperationAuthorization(input) {
-	if (input.operation.lifecycle !== "claimed" || input.operation.authorization.kind !== "authorization_grant" || input.operation.quota.kind !== "consume_reusable_wallet_session" || input.operation.authorization.authorizationGrantRef.kind !== "wallet_session_authorization") return {
-		kind: "denied",
-		denial: {
-			code: "invalid_authority",
-			message: "ECDSA reusable Wallet Session authorization is invalid"
-		}
-	};
-	return {
-		kind: "authorized",
-		operation: input.operation,
-		source: {
-			kind: "authorization_grant",
-			authorizationGrantRef: input.operation.authorization.authorizationGrantRef
-		}
-	};
-}
-function buildRouterAbEd25519OwnerOperationStepUpPreparation(input) {
-	const operation = parseRouterAbOperationStepUpOperation(input.body.intent);
-	const expiresAtMs = Number(input.body.expires_at_ms);
-	if (!operation.ok || !Number.isSafeInteger(expiresAtMs) || expiresAtMs <= 0 || input.scope.account_id !== input.scope.material_activation.material_owner || input.material.signingWorkerId !== input.scope.signing_worker_id || input.material.participantIds.length !== 2) return null;
-	return {
-		wallet_id: input.scope.account_id,
-		operation_kind: operation.operation.operationKind,
-		operation_id: operation.operationId,
-		request_id: input.scope.request_id,
-		account_id: input.scope.account_id,
-		material_activation: input.scope.material_activation,
-		signing_worker_id: input.scope.signing_worker_id,
-		near_account_id: input.material.nearAccountId,
-		signer_slot: input.material.signerSlot,
-		participant_ids: input.material.participantIds,
-		expires_at_ms: expiresAtMs
-	};
-}
-async function resolveRouterAbEd25519OwnerOperationStepUpPreparation(input) {
-	if (input.phase !== "prepare") return void 0;
-	try {
-		const activeMaterial = await input.resolveEd25519MaterialActivation({
-			walletId: input.scope.account_id,
-			materialActivation: input.scope.material_activation
-		});
-		if (!activeMaterial.ok) return void 0;
-		return buildRouterAbEd25519OwnerOperationStepUpPreparation({
-			scope: input.scope,
-			body: input.body,
-			material: activeMaterial
-		}) ?? void 0;
-	} catch {
-		return;
-	}
-}
-function decideRouterAbEd25519OwnerOperationAuthorization(input) {
-	if (input.operation.lifecycle !== "claimed" || input.operation.authorization.kind !== "authorization_grant" || input.operation.authorization.authorizationGrantRef.kind !== "wallet_session_authorization" || input.operation.quota.kind !== "consume_reusable_wallet_session") return {
-		kind: "denied",
-		denial: {
-			code: "invalid_authority",
-			message: "Ed25519 reusable Wallet Session authorization is invalid"
-		}
-	};
-	return {
-		kind: "authorized",
-		operation: input.operation,
-		source: {
-			kind: "authorization_grant",
-			authorizationGrantRef: input.operation.authorization.authorizationGrantRef
-		}
-	};
-}
-function routerAbEd25519OwnerOperationDecisionForFailure(input) {
-	const reason = (() => {
-		switch (input.code) {
-			case "wallet_session_missing": return "wallet_session_missing";
-			case "wallet_session_expired": return "wallet_session_expired";
-			case "wallet_budget_exhausted":
-			case "wallet_session_quota_exhausted": return "wallet_session_exhausted";
-			case "wallet_session_invalid": return "wallet_session_ended";
-			default: return null;
-		}
-	})();
-	if (reason && input.phase === "prepare" && input.stepUp) return {
-		kind: "step_up_required",
-		reason,
-		step_up: input.stepUp
-	};
-	if (reason && input.phase === "prepare") return {
-		kind: "denied",
-		denial: {
-			code: "authorization_unavailable",
-			message: "Owner operation step-up preparation is unavailable"
-		}
-	};
-	switch (input.code) {
-		case "invalid_body": return {
-			kind: "denied",
-			denial: {
-				code: "invalid_operation",
-				message: "Ed25519 operation request is invalid"
-			}
-		};
-		case "wallet_session_mismatch":
-		case "wallet_session_scope_mismatch":
-		case "scope_mismatch":
-		case "authorization_grant_rejected":
-		case "verified_step_up_rejected": return {
-			kind: "denied",
-			denial: {
-				code: "invalid_authority",
-				message: "Ed25519 operation authority is invalid"
-			}
-		};
-		case "material_mismatch": return {
-			kind: "denied",
-			denial: {
-				code: "inactive_material",
-				message: "Ed25519 signing material is inactive"
-			}
-		};
-		case "internal":
-		case "not_configured": return {
-			kind: "denied",
-			denial: {
-				code: "authorization_unavailable",
-				message: "Ed25519 operation authorization is unavailable"
-			}
-		};
-		default: return null;
-	}
-}
-function routerAbEd25519OwnerOperationFailureResult(input) {
-	const decision = routerAbEd25519OwnerOperationDecisionForFailure(input);
-	return {
-		status: input.status,
-		body: {
-			ok: false,
-			code: input.code,
-			message: input.message,
-			...decision ? { authorization_decision: decision } : {}
-		}
-	};
-}
-function routerAbEcdsaOwnerOperationDecisionForFailure(input) {
-	const reason = (() => {
-		switch (input.code) {
-			case "wallet_session_missing": return "wallet_session_missing";
-			case "wallet_session_expired": return "wallet_session_expired";
-			case "wallet_budget_exhausted":
-			case "wallet_session_quota_exhausted": return "wallet_session_exhausted";
-			case "wallet_session_invalid": return "wallet_session_ended";
-			default: return null;
-		}
-	})();
-	if (reason && input.phase === "prepare" && input.stepUp) {
-		const decision = {
-			kind: "step_up_required",
-			reason,
-			stepUp: input.stepUp
-		};
-		return {
-			kind: decision.kind,
-			reason: decision.reason,
-			step_up: decision.stepUp
-		};
-	}
-	if (reason && input.phase === "prepare") return {
-		kind: "denied",
-		denial: {
-			code: "authorization_unavailable",
-			message: "Owner operation step-up preparation is unavailable"
-		}
-	};
-	switch (input.code) {
-		case "invalid_body": return {
-			kind: "denied",
-			denial: {
-				code: "invalid_operation",
-				message: "ECDSA operation request is invalid"
-			}
-		};
-		case "wallet_session_mismatch":
-		case "wallet_session_scope_mismatch":
-		case "scope_mismatch":
-		case "authorization_grant_rejected":
-		case "verified_step_up_rejected": return {
-			kind: "denied",
-			denial: {
-				code: "invalid_authority",
-				message: "ECDSA operation authority is invalid"
-			}
-		};
-		case "material_mismatch": return {
-			kind: "denied",
-			denial: {
-				code: "inactive_material",
-				message: "ECDSA signing material is inactive"
-			}
-		};
-		case "internal":
-		case "not_configured": return {
-			kind: "denied",
-			denial: {
-				code: "authorization_unavailable",
-				message: "ECDSA operation authorization is unavailable"
-			}
-		};
-		default: return null;
-	}
-}
-function routerAbEcdsaOwnerOperationFailureResult(input) {
-	const decision = routerAbEcdsaOwnerOperationDecisionForFailure(input);
-	return {
-		status: input.status,
-		body: {
-			ok: false,
-			code: input.code,
-			message: input.message,
-			...decision ? { authorization_decision: decision } : {}
-		}
-	};
-}
-function routerAbEcdsaReplayUnavailableResult() {
-	return routerAbStepUpError(409, "authorized_operation_replay_unavailable", "Completed ECDSA signing operation has no replayable response");
-}
-function routerAbEcdsaRecordedResponse(operation) {
-	return operation.lifecycle === "completed" ? operation.response : null;
-}
-function routerAbEcdsaReplayResult(operation) {
-	const response = routerAbEcdsaRecordedResponse(operation);
-	if (!response) return routerAbEcdsaReplayUnavailableResult();
-	let body = response.bodyText;
-	try {
-		body = JSON.parse(response.bodyText);
-	} catch {}
-	return {
-		status: response.status,
-		body
-	};
-}
-function routerAbEcdsaReplayHttpResponse(operation) {
-	const response = routerAbEcdsaRecordedResponse(operation);
-	if (!response) return null;
-	return new Response(authorizedOperationReplayBodyInit(response), {
-		status: response.status,
-		headers: { "content-type": response.contentType }
-	});
-}
-function routerAbEcdsaPrivateSigningWorkerUnavailableResult() {
-	return {
-		status: 501,
-		body: {
-			ok: false,
-			code: "not_configured",
-			message: "Router A/B SigningWorker private HTTP target is not configured"
-		}
-	};
-}
-async function evaluateRouterAbNormalSigningAdmission(input) {
-	if (!input.adapter) return {
-		ok: false,
-		status: 501,
-		code: "not_configured",
-		message: "Router A/B normal-signing admission adapter is not configured"
-	};
-	if (input.curve === "ed25519") return await input.adapter.evaluatePolicy({
-		curve: "ed25519",
-		authorityKind: "wallet_authority_v1",
-		authorityId: input.authorityId,
-		phase: input.phase,
-		walletId: input.walletId,
-		thresholdSessionId: input.thresholdSessionId,
-		walletSessionId: input.walletSessionId,
-		quotaId: input.quotaId,
-		requestId: input.requestId,
-		expiresAtMs: input.expiresAtMs,
-		signingWorkerId: input.signingWorkerId,
-		runtimePolicyScope: input.runtimePolicyScope
-	});
-	return await input.adapter.evaluatePolicy({
-		curve: "ecdsa",
-		phase: input.phase,
-		walletId: input.walletId,
-		materialActivationId: requireMpcMaterialActivationId(input.admission.materialActivation.activation_id),
-		authorizationIdentity: {
-			kind: "reusable_wallet_session",
-			walletSessionId: input.walletSessionId
-		},
-		requestId: input.admission.requestId,
-		expiresAtMs: input.admission.expiresAtMs,
-		signingWorkerId: input.signingWorkerId,
-		keyHandle: input.keyHandle,
-		runtimePolicyScope: input.runtimePolicyScope
-	});
-}
 function validateRouterAbNormalSigningEffectClaim(claim, scope, authorization) {
 	requirePrivateSigningString(claim.authorized_operation_id, "effect_claim.authorized_operation_id");
 	requirePrivateSigningString(claim.operation_id, "effect_claim.operation_id");
@@ -499,9 +59,6 @@ function routerAbNormalSigningMaterialSourceFromActiveLaneV1(input) {
 		group_public_key: groupPublicKey
 	};
 }
-function isPlainObject(value) {
-	return !!value && typeof value === "object" && !Array.isArray(value);
-}
 function nonEmptyString(value) {
 	return String(value || "").trim();
 }
@@ -528,25 +85,6 @@ async function sha256B64u(bytes) {
 async function sha256Digest32(bytes) {
 	return digest32FromB64u(await sha256B64u(bytes));
 }
-function routerAbSigningError(status, code, message) {
-	return {
-		ok: false,
-		status,
-		body: {
-			ok: false,
-			code,
-			message
-		}
-	};
-}
-function routerAbWalletSessionError(code) {
-	const failure = walletSessionFailure(code);
-	return routerAbSigningError(walletSessionFailureStatus(code), failure.code, failure.message);
-}
-function routerAbWalletSessionValidationStatus(code) {
-	if (code === "sessions_disabled") return 501;
-	return walletSessionFailureStatus(code);
-}
 function replayResponseFromSigningWorkerResult(result) {
 	if (result.ok) return result.replay;
 	return {
@@ -624,11 +162,6 @@ function requirePrivateSigningMaterialActivation(value) {
 		signing_worker: requirePrivateSigningString(activation.signing_worker, "scope.material_activation.signing_worker")
 	};
 }
-function requireMpcMaterialActivationId(value) {
-	const parsed = parseMpcMaterialActivationId(value);
-	if (!parsed.ok) throw new Error(parsed.error.message);
-	return parsed.value;
-}
 function parseRouterAbEd25519NormalSigningScopeV2(value) {
 	const scope = requirePrivateSigningRecord(value, "scope");
 	requirePrivateSigningExactFields(scope, [
@@ -744,7 +277,7 @@ function privateSigningPayloadPreimage(value) {
 function privateSigningDigestsEqual(left, right) {
 	return left.bytes.every((byte, index) => byte === right.bytes[index]);
 }
-async function privateSigningAdmissionMaterial(input) {
+async function computeRouterAbEd25519NormalSigningAdmissionMaterial(input) {
 	const payload = privateSigningPayloadPreimage(input.signingPayload);
 	const [intentDigest, signingPayloadDigest, admittedSigningDigest] = await Promise.all([
 		sha256Digest32(canonicalPrivateSigningIntentBytes(input.intent)),
@@ -758,9 +291,6 @@ async function privateSigningAdmissionMaterial(input) {
 		admittedSigningDigest
 	};
 }
-async function computeRouterAbEd25519NormalSigningAdmissionMaterial(input) {
-	return await privateSigningAdmissionMaterial(input);
-}
 async function privateSigningRound1BindingDigest(input) {
 	const out = [];
 	pushLen32(out, textBytes(ED25519_ROUND1_BINDING_VERSION_V2));
@@ -807,17 +337,17 @@ async function privateSigningTrustedSourceDigest(headers) {
 function privateSigningTrustedAdmission(input) {
 	return {
 		metadata: {
-			org_id: input.runtimePolicyScope.orgId,
-			project_id: input.runtimePolicyScope.projectId,
-			environment: input.runtimePolicyScope.envId,
+			org_id: input.authorization.runtimePolicyScope.orgId,
+			project_id: input.authorization.runtimePolicyScope.projectId,
+			environment: input.authorization.runtimePolicyScope.envId,
 			account_id: input.accountId,
 			auth: input.authorization.kind === "reusable_wallet_session" ? {
 				auth: "owner_wallet_session",
-				subject_id: input.subjectId,
+				subject_id: input.authorization.subjectId,
 				wallet_session_id: input.authorization.walletSessionId
 			} : {
 				auth: "owner_operation_step_up",
-				subject_id: input.subjectId,
+				subject_id: input.authorization.subjectId,
 				authorization_session_id: input.authorization.authorizationSessionId
 			},
 			trusted_source_digest: input.trustedSourceDigest,
@@ -865,6 +395,11 @@ async function buildRouterAbEd25519PrivateSigningWorkerBody(input) {
 	const scope = parseRouterAbEd25519NormalSigningScopeV2(input.body.scope);
 	const signingContext = privateSigningAuthorizationContext(scope, input.authorization);
 	const trustedSourceDigest = await privateSigningTrustedSourceDigest(input.headers);
+	const materialSource = input.materialSource ?? registrationMaterialSourceV1({
+		accountId: scope.account_id,
+		materialActivationId: scope.material_activation.activation_id,
+		signingWorkerId: scope.signing_worker_id
+	});
 	if (input.phase === "finalize") {
 		validateRouterAbNormalSigningEffectClaim(input.effectClaim, scope, signingContext);
 		const prepareBinding = requirePrivateSigningRecord(input.body.prepare_binding, "prepare_binding");
@@ -875,20 +410,7 @@ async function buildRouterAbEd25519PrivateSigningWorkerBody(input) {
 		return {
 			request: input.body,
 			admission_candidate: {
-				org_id: signingContext.runtimePolicyScope.orgId,
-				project_id: signingContext.runtimePolicyScope.projectId,
-				environment: signingContext.runtimePolicyScope.envId,
-				account_id: scope.account_id,
-				subject_id: signingContext.subjectId,
-				authorization: signingContext.kind === "reusable_wallet_session" ? {
-					kind: "reusable_wallet_session",
-					wallet_session_id: signingContext.walletSessionId
-				} : {
-					kind: "operation_step_up",
-					authorization_session_id: signingContext.authorizationSessionId
-				},
-				signing_worker_id: scope.signing_worker_id,
-				request_id: scope.request_id,
+				...privateSigningAdmissionCandidateScope(scope, signingContext),
 				intent_digest: intentDigest,
 				signing_payload_digest: signingPayloadDigest,
 				round1_binding_digest: round1BindingDigest,
@@ -896,8 +418,6 @@ async function buildRouterAbEd25519PrivateSigningWorkerBody(input) {
 				expires_at_ms: expiresAtMs
 			},
 			trusted_admission: privateSigningTrustedAdmission({
-				runtimePolicyScope: signingContext.runtimePolicyScope,
-				subjectId: signingContext.subjectId,
 				accountId: scope.account_id,
 				authorization: signingContext,
 				requestId: scope.request_id,
@@ -905,15 +425,11 @@ async function buildRouterAbEd25519PrivateSigningWorkerBody(input) {
 				trustedSourceDigest
 			}),
 			effect_claim: input.effectClaim,
-			material_source: input.materialSource ?? registrationMaterialSourceV1({
-				accountId: scope.account_id,
-				materialActivationId: scope.material_activation.activation_id,
-				signingWorkerId: scope.signing_worker_id
-			})
+			material_source: materialSource
 		};
 	}
 	const expiresAtMs = requirePrivateSigningPositiveSafeInteger(input.body.expires_at_ms, "expires_at_ms");
-	const material = await privateSigningAdmissionMaterial({
+	const material = await computeRouterAbEd25519NormalSigningAdmissionMaterial({
 		intent: input.body.intent,
 		signingPayload: input.body.signing_payload
 	});
@@ -924,8 +440,6 @@ async function buildRouterAbEd25519PrivateSigningWorkerBody(input) {
 		...material
 	});
 	const trustedAdmission = privateSigningTrustedAdmission({
-		runtimePolicyScope: signingContext.runtimePolicyScope,
-		subjectId: signingContext.subjectId,
 		accountId: scope.account_id,
 		authorization: signingContext,
 		requestId: scope.request_id,
@@ -936,20 +450,7 @@ async function buildRouterAbEd25519PrivateSigningWorkerBody(input) {
 		scope,
 		expires_at_ms: expiresAtMs,
 		admission_candidate: {
-			org_id: signingContext.runtimePolicyScope.orgId,
-			project_id: signingContext.runtimePolicyScope.projectId,
-			environment: signingContext.runtimePolicyScope.envId,
-			account_id: scope.account_id,
-			subject_id: signingContext.subjectId,
-			authorization: signingContext.kind === "reusable_wallet_session" ? {
-				kind: "reusable_wallet_session",
-				wallet_session_id: signingContext.walletSessionId
-			} : {
-				kind: "operation_step_up",
-				authorization_session_id: signingContext.authorizationSessionId
-			},
-			signing_worker_id: scope.signing_worker_id,
-			request_id: scope.request_id,
+			...privateSigningAdmissionCandidateScope(scope, signingContext),
 			intent_digest: material.intentDigest,
 			signing_payload_digest: material.signingPayloadDigest,
 			admitted_signing_digest: material.admittedSigningDigest,
@@ -958,11 +459,25 @@ async function buildRouterAbEd25519PrivateSigningWorkerBody(input) {
 			expires_at_ms: expiresAtMs
 		},
 		trusted_admission: trustedAdmission,
-		material_source: input.materialSource ?? registrationMaterialSourceV1({
-			accountId: scope.account_id,
-			materialActivationId: scope.material_activation.activation_id,
-			signingWorkerId: scope.signing_worker_id
-		})
+		material_source: materialSource
+	};
+}
+function privateSigningAdmissionCandidateScope(scope, signingContext) {
+	return {
+		org_id: signingContext.runtimePolicyScope.orgId,
+		project_id: signingContext.runtimePolicyScope.projectId,
+		environment: signingContext.runtimePolicyScope.envId,
+		account_id: scope.account_id,
+		subject_id: signingContext.subjectId,
+		authorization: signingContext.kind === "reusable_wallet_session" ? {
+			kind: "reusable_wallet_session",
+			wallet_session_id: signingContext.walletSessionId
+		} : {
+			kind: "operation_step_up",
+			authorization_session_id: signingContext.authorizationSessionId
+		},
+		signing_worker_id: scope.signing_worker_id,
+		request_id: scope.request_id
 	};
 }
 async function buildRouterAbEcdsaDerivationPrivateSigningWorkerBody(input) {
@@ -971,1652 +486,40 @@ async function buildRouterAbEcdsaDerivationPrivateSigningWorkerBody(input) {
 	if (input.phase === "prepare") {
 		const request = parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1(input.body);
 		validatePrivateSigningAuthorizationContext(request.authorization, signingContext);
-		const requestDigest = await routerAbEcdsaDerivationEvmDigestSigningRequestDigestV1(request);
-		return {
+		return privateEcdsaDerivationSigningWorkerBody({
 			request,
-			trusted_admission: privateSigningTrustedAdmission({
-				runtimePolicyScope: signingContext.runtimePolicyScope,
-				subjectId: signingContext.subjectId,
-				accountId: request.scope.wallet_id,
-				authorization: signingContext,
-				requestId: request.request_id,
-				intentDigest: requestDigest,
-				trustedSourceDigest
-			}),
-			material_source: input.materialSource ?? registrationMaterialSourceV1({
-				accountId: request.scope.wallet_id,
-				materialActivationId: request.scope.material_activation.activation_id,
-				signingWorkerId: request.scope.signing_worker.server_id
-			})
-		};
+			requestDigest: await routerAbEcdsaDerivationEvmDigestSigningRequestDigestV1(request),
+			signingContext,
+			trustedSourceDigest,
+			materialSource: input.materialSource
+		});
 	}
 	const request = parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1(input.body);
 	validatePrivateSigningAuthorizationContext(request.authorization, signingContext);
-	const requestDigest = await routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestDigestV1(request);
-	return {
+	return privateEcdsaDerivationSigningWorkerBody({
 		request,
-		trusted_admission: privateSigningTrustedAdmission({
-			runtimePolicyScope: signingContext.runtimePolicyScope,
-			subjectId: signingContext.subjectId,
-			accountId: request.scope.wallet_id,
-			authorization: signingContext,
-			requestId: request.request_id,
-			intentDigest: requestDigest,
-			trustedSourceDigest
-		}),
-		material_source: input.materialSource ?? registrationMaterialSourceV1({
-			accountId: request.scope.wallet_id,
-			materialActivationId: request.scope.material_activation.activation_id,
-			signingWorkerId: request.scope.signing_worker.server_id
-		})
-	};
-}
-async function handleRouterAbEd25519OperationStepUpRoute(input) {
-	if (input.scope.authorization.kind !== "operation_step_up") return routerAbStepUpError(400, "invalid_body", "Operation step-up authority is required");
-	const expiresAtMs = Number(input.body.expires_at_ms);
-	if (!Number.isSafeInteger(expiresAtMs) || expiresAtMs <= Date.now()) return routerAbStepUpError(408, "expired_request", "Router A/B Ed25519 step-up request is expired");
-	let authenticated = await authenticateRouterAbWalletOperationStepUp({
-		headers: input.headers,
-		scope: input.scope,
-		operationKind: input.operationKind,
-		requestExpiresAtMs: expiresAtMs,
-		authorizedOperations: input.authorizedOperations,
-		authorizationSessions: input.authorizationSessions,
-		resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation
-	});
-	if (!authenticated.ok && input.authorizedOperations && input.authorizationSessions && isWalletSessionUnavailableStepUpError(authenticated.error)) {
-		const exhaustedCandidate = await resolveRouterAbEd25519ExhaustedCandidateOperationStepUpAuthentication({
-			headers: input.headers,
-			scope: input.scope,
-			operationKind: input.operationKind,
-			requestExpiresAtMs: expiresAtMs,
-			authorizedOperations: input.authorizedOperations,
-			authorizationSessions: input.authorizationSessions,
-			resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation
-		});
-		if (exhaustedCandidate) {
-			if (!exhaustedCandidate.ok) return exhaustedCandidate.error;
-			authenticated = exhaustedCandidate;
-		}
-	}
-	if (!authenticated.ok) return authenticated.error;
-	const activeMaterial = "activeMaterial" in authenticated ? authenticated.activeMaterial : await input.resolveEd25519MaterialActivation({
-		walletId: authenticated.session.walletId,
-		materialActivation: input.scope.material_activation
-	});
-	if (!activeMaterial.ok) return routerAbStepUpError(activeMaterial.code === "internal" ? 500 : 403, activeMaterial.code === "internal" ? "internal" : "scope_mismatch", activeMaterial.code === "internal" ? activeMaterial.message : "Operation step-up material is no longer active");
-	if (!sameRouterAbMpcMaterialActivationRef(activeMaterial.materialActivation, input.scope.material_activation)) return routerAbStepUpError(403, "scope_mismatch", "Operation step-up scope does not name the active material");
-	if (input.phase === "prepare") {
-		let privateBody;
-		try {
-			privateBody = await buildRouterAbEd25519PrivateSigningWorkerBody({
-				phase: "prepare",
-				body: input.body,
-				authorization: {
-					kind: "operation_step_up",
-					session: authenticated.session
-				},
-				headers: input.headers
-			});
-		} catch (error) {
-			return routerAbStepUpError(400, "invalid_body", errorMessage(error));
-		}
-		const operation = parseRouterAbOperationStepUpOperation(input.body.intent);
-		if (!operation.ok) return routerAbStepUpError(400, "invalid_body", operation.message);
-		let authorizedOperationId;
-		let capabilityId;
-		let laneDigest;
-		let intentDigest;
-		let displayDigest;
-		try {
-			authorizedOperationId = requireAuthorizationValue(parseAuthorizedOperationId(`normal-signing-operation:${input.scope.request_id}`));
-			capabilityId = requireAuthorizationValue(parseCapabilityId(input.scope.material_activation.capability));
-			if (!("admission_candidate" in privateBody)) throw new Error("Router A/B step-up prepare admission is missing");
-			laneDigest = parseSigningOperationFingerprintDigest(input.body.intent.operation_fingerprint);
-			intentDigest = parseDigestB64u(base64UrlEncode(Uint8Array.from(privateBody.admission_candidate.intent_digest.bytes)));
-			displayDigest = parseDigestB64u(base64UrlEncode(Uint8Array.from(requirePrivateSigningDigest(input.body.display_digest, "display_digest").bytes)));
-		} catch (error) {
-			return routerAbStepUpError(400, "invalid_body", errorMessage(error));
-		}
-		const operationFingerprintDigest = await computeCapabilityOperationFingerprintDigest(buildCapabilityOperationEnvelope({
-			tenantId: authenticated.session.tenantId,
-			principalId: authenticated.session.principalId,
-			capabilityId,
-			operationId: operation.operationId,
-			operation: operation.operation,
-			digests: {
-				laneDigest,
-				intentDigest,
-				displayDigest
-			}
-		}));
-		const existing = await authenticated.authorizedOperations.readAuthorizedOperation({
-			tenantId: authenticated.session.tenantId,
-			operationFingerprintDigest
-		});
-		if (!existing || existing.authorizedOperationId !== authorizedOperationId) return routerAbStepUpError(409, "authorized_operation_missing", "Authorized operation is unavailable");
-		if (existing.authorization.kind !== "verified_step_up" || existing.quota.kind !== "quota_neutral") return routerAbStepUpError(409, "authorized_operation_missing", "Operation authorization has an invalid source or quota");
-		let claimResult;
-		try {
-			claimResult = await authenticated.authorizedOperations.admitAuthorizedOperation({ operation: {
-				tenantId: existing.tenantId,
-				authorizedOperationId: existing.authorizedOperationId,
-				auditEventId: existing.auditEventId,
-				operation: existing.operation,
-				authorization: existing.authorization,
-				quota: existing.quota,
-				claimedAtMs: Date.now()
-			} });
-		} catch (error) {
-			return routerAbStepUpError(400, "invalid_body", errorMessage(error));
-		}
-		const claimFailure = routerAbOperationStepUpClaimFailure(claimResult);
-		if (claimFailure) return claimFailure;
-		if (claimResult.kind !== "claimed" && claimResult.kind !== "operation_in_progress" && claimResult.kind !== "replayed") return routerAbStepUpError(409, "authorized_operation_missing", "Authorized operation is unavailable");
-		return {
-			phase: "prepare",
-			session: authenticated.session,
-			operation: claimResult.operation,
-			operationDigests: {
-				laneDigest,
-				intentDigest,
-				displayDigest
-			},
-			admissionKind: claimResult.kind
-		};
-	}
-	return {
-		phase: "finalize",
-		session: authenticated.session
-	};
-}
-async function resolveRouterAbEd25519OperationStepUpSession(input) {
-	const admittedMaterialActivation = routerAbMpcMaterialActivationRefToWire(input.admission.materialActivation);
-	if (input.admission.operationKind !== input.operationKind || String(input.session.walletId) !== input.walletId || input.materialOwner !== input.walletId || !Number.isSafeInteger(input.requestExpiresAtMs) || input.requestExpiresAtMs > input.session.expiresAtMs || !sameRouterAbMpcMaterialActivationRef(admittedMaterialActivation, input.materialActivation)) return {
-		ok: false,
-		error: routerAbStepUpError(403, "scope_mismatch", "Wallet Session scope is invalid")
-	};
-	let activeMaterial;
-	try {
-		activeMaterial = await input.resolveEd25519MaterialActivation({
-			walletId: input.walletId,
-			materialActivation: admittedMaterialActivation
-		});
-	} catch {
-		return {
-			ok: false,
-			error: routerAbStepUpError(503, "wallet_session_unavailable", "Wallet Session is unavailable")
-		};
-	}
-	if (!activeMaterial.ok || !sameRouterAbMpcMaterialActivationRef(activeMaterial.materialActivation, admittedMaterialActivation) || !sameRouterAbMpcMaterialActivationRef(activeMaterial.exportIdentity.scope.material_activation, admittedMaterialActivation) || activeMaterial.exportIdentity.scope.account_id !== input.walletId || activeMaterial.exportIdentity.application_binding.wallet_id !== input.walletId || base64UrlEncode(Uint8Array.from(activeMaterial.exportIdentity.registered_public_key)) !== input.admission.signer.registeredPublicKeyB64u) return {
-		ok: false,
-		error: routerAbStepUpError(activeMaterial.ok || activeMaterial.code !== "internal" ? 403 : 503, activeMaterial.ok || activeMaterial.code !== "internal" ? "scope_mismatch" : "wallet_session_unavailable", activeMaterial.ok ? "Wallet Session material does not match the active Ed25519 material" : activeMaterial.message)
-	};
-	if (input.session.tenantId !== input.authorizedOperations.tenantId || activeMaterial.runtimePolicyScope.orgId !== input.session.tenantId || input.session.expiresAtMs <= Date.now()) return {
-		ok: false,
-		error: routerAbStepUpError(403, "scope_mismatch", "Wallet Session scope is invalid")
-	};
-	return {
-		ok: true,
-		activeMaterial,
-		session: {
-			tenantId: input.session.tenantId,
-			principalId: input.session.principalId,
-			sessionId: String(input.session.authorizationId),
-			walletId: String(input.session.walletId),
-			runtimePolicyScope: activeMaterial.runtimePolicyScope,
-			laneAuthorization: {
-				kind: "wallet_auth_method",
-				walletAuthMethodId: input.session.walletAuthMethodId
-			}
-		}
-	};
-}
-async function resolveRouterAbEd25519ExhaustedCandidateOperationStepUpAuthentication(input) {
-	const token = extractBearerCredential(input.headers);
-	if (!token) return null;
-	const requestOriginRaw = (Array.isArray(input.headers.origin) ? input.headers.origin[0] : input.headers.origin) || "";
-	let requestOrigin;
-	try {
-		requestOrigin = parseSessionOrigin(String(requestOriginRaw).trim());
-	} catch {
-		return {
-			ok: false,
-			error: routerAbStepUpError(401, "unauthorized", "Wallet owner proof origin is invalid")
-		};
-	}
-	let candidate;
-	try {
-		candidate = await input.authorizationSessions.readExhaustedWalletSessionAuthorizationV2CandidateByOperationCredential({
-			tenantId: input.authorizationSessions.tenantId,
-			token,
-			nowMs: Date.now()
-		});
-	} catch {
-		return {
-			ok: false,
-			error: routerAbStepUpError(503, "wallet_session_unavailable", "Wallet Session is unavailable")
-		};
-	}
-	if (!candidate) return null;
-	const session = candidate.status.session;
-	const admission = resolveWalletSessionAuthorizationV2Admission({
-		authorization: session,
-		authority: candidate.authority,
-		authMethod: candidate.authMethod,
-		operation: {
-			tenantId: session.tenantId,
-			principalId: session.principalId,
-			walletId: session.walletId,
-			keyFamily: "ed25519",
-			operationKind: input.operationKind
-		},
-		retiredAtMs: candidate.retiredAtMs,
-		nowMs: Date.now()
-	});
-	if (!admission.ok || admission.keyFamily !== "ed25519") return {
-		ok: false,
-		error: routerAbStepUpError(403, "scope_mismatch", "Wallet Session scope is invalid")
-	};
-	const resolved = await resolveRouterAbEd25519OperationStepUpSession({
-		walletId: input.scope.account_id,
-		materialOwner: input.scope.material_activation.material_owner,
-		materialActivation: input.scope.material_activation,
-		requestExpiresAtMs: input.requestExpiresAtMs,
-		operationKind: input.operationKind,
-		authorizedOperations: input.authorizedOperations,
-		session,
-		admission,
-		resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation
-	});
-	if (!resolved.ok) return resolved;
-	return {
-		ok: true,
-		kind: "wallet_session_operation_credential_exhausted_candidate_v1",
-		authorizedOperations: input.authorizedOperations,
-		candidate,
-		activeMaterial: resolved.activeMaterial,
-		session: resolved.session,
-		requestOrigin,
-		expiresAtMs: session.expiresAtMs
-	};
-}
-function isWalletSessionUnavailableStepUpError(result) {
-	return isPlainObject(result.body) && result.body.code === "wallet_session_unavailable";
-}
-async function authenticateRouterAbWalletOperationStepUpIdentity(input) {
-	if (!input.authorizedOperations) return {
-		ok: false,
-		error: routerAbStepUpError(501, "not_configured", "Router A/B operation step-up authorization is not configured")
-	};
-	const requestOriginRaw = (Array.isArray(input.headers.origin) ? input.headers.origin[0] : input.headers.origin) || "";
-	let requestOrigin;
-	try {
-		requestOrigin = parseSessionOrigin(String(requestOriginRaw).trim());
-	} catch {
-		return {
-			ok: false,
-			error: routerAbStepUpError(401, "unauthorized", "Wallet owner proof origin is invalid")
-		};
-	}
-	if (input.kind === "verified_owner_proof") {
-		const tenantId = input.authorizedOperations.tenantId;
-		const authorityRef = await walletAuthAuthorityRef({ authority: input.authority });
-		const principal = parsePrincipalId(input.authority.factor.kind === "email_otp" ? input.authority.factor.providerUserId : input.walletId);
-		const authSource = walletExecutionLaneAuthSourceFromAuthority(input.authority);
-		if (!principal.ok || !authSource || input.walletId !== input.materialOwner || input.authority.walletId !== input.walletId || input.runtimePolicyScope.orgId !== tenantId || input.expiresAtMs <= Date.now()) return {
-			ok: false,
-			error: routerAbStepUpError(403, "scope_mismatch", "Wallet owner proof scope is invalid")
-		};
-		return {
-			ok: true,
-			authorizedOperations: input.authorizedOperations,
-			session: {
-				tenantId,
-				principalId: principal.value,
-				sessionId: input.operationId,
-				walletId: input.walletId,
-				runtimePolicyScope: input.runtimePolicyScope,
-				laneAuthorization: {
-					kind: "authority_ref",
-					authorityRef,
-					authSource
-				}
-			},
-			authorityRef,
-			requestOrigin,
-			expiresAtMs: input.expiresAtMs
-		};
-	}
-	if (!input.authorizationSessions) return {
-		ok: false,
-		error: routerAbStepUpError(501, "not_configured", "Router A/B Wallet Sessions are not configured")
-	};
-	const token = extractBearerCredential(input.headers);
-	if (!token) return {
-		ok: false,
-		error: routerAbStepUpError(401, "unauthorized", "Wallet Session is required")
-	};
-	let resolution;
-	try {
-		const operation = input.keyFamily === "ed25519" ? {
-			keyFamily: "ed25519",
-			operationKind: input.operationKind
-		} : {
-			keyFamily: "ecdsa_secp256k1",
-			operationKind: input.operationKind
-		};
-		resolution = await resolveWalletSessionOperationCredentialAdmission({
-			authorizationSessions: input.authorizationSessions,
-			token,
-			nowMs: Date.now(),
-			operation
-		});
-	} catch {
-		return {
-			ok: false,
-			error: routerAbStepUpError(503, "wallet_session_unavailable", "Wallet Session is unavailable")
-		};
-	}
-	if (resolution.kind === "not_found") return {
-		ok: false,
-		error: routerAbStepUpError(401, "unauthorized", "Wallet Session is invalid")
-	};
-	if (resolution.kind === "rejected") return {
-		ok: false,
-		error: routerAbStepUpError(403, "scope_mismatch", "Wallet Session scope is invalid")
-	};
-	const admission = resolution.admission;
-	const session = admission.context.authorization.session;
-	const admittedMaterialActivation = routerAbMpcMaterialActivationRefToWire(admission.admission.materialActivation);
-	if (admission.curve === "ed25519" && input.keyFamily === "ed25519") {
-		const resolved = await resolveRouterAbEd25519OperationStepUpSession({
-			walletId: input.walletId,
-			materialOwner: input.materialOwner,
-			materialActivation: input.materialActivation,
-			requestExpiresAtMs: input.requestExpiresAtMs,
-			operationKind: input.operationKind,
-			authorizedOperations: input.authorizedOperations,
-			session,
-			admission: admission.admission,
-			resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation
-		});
-		if (!resolved.ok) return {
-			ok: false,
-			error: resolved.error
-		};
-		return {
-			ok: true,
-			authorizedOperations: input.authorizedOperations,
-			session: resolved.session,
-			requestOrigin,
-			expiresAtMs: session.expiresAtMs
-		};
-	}
-	if (admission.admission.keyFamily !== input.keyFamily || admission.admission.operationKind !== input.operationKind || String(session.walletId) !== input.walletId || input.materialOwner !== input.walletId || !Number.isSafeInteger(input.requestExpiresAtMs) || input.requestExpiresAtMs > session.expiresAtMs || !sameRouterAbMpcMaterialActivationRef(admittedMaterialActivation, input.materialActivation)) return {
-		ok: false,
-		error: routerAbStepUpError(403, "scope_mismatch", "Wallet Session scope is invalid")
-	};
-	let runtimePolicyScope;
-	try {
-		if (admission.curve === "ecdsa" && input.keyFamily === "ecdsa_secp256k1") {
-			const activeMaterial = await input.resolveEcdsaMaterialActivation({
-				walletId: input.walletId,
-				materialActivation: admittedMaterialActivation
-			});
-			const normalSigning = activeMaterial.ok ? activeMaterial.routerAbEcdsaDerivationNormalSigning : null;
-			if (!activeMaterial.ok || !normalSigning || !sameRouterAbMpcMaterialActivationRef(activeMaterial.materialActivation, admittedMaterialActivation) || !sameRouterAbMpcMaterialActivationRef(normalSigning.scope.material_activation, admittedMaterialActivation) || normalSigning.scope.wallet_id !== input.walletId || normalSigning.scope.public_identity.threshold_public_key33_b64u !== admission.admission.signer.thresholdPublicKey33B64u || normalSigning.scope.public_identity.ethereum_address20_b64u !== evmAddress20B64u(admission.admission.signer.evmAddress)) return {
-				ok: false,
-				error: routerAbStepUpError(activeMaterial.ok || activeMaterial.code !== "internal" ? 403 : 503, activeMaterial.ok || activeMaterial.code !== "internal" ? "scope_mismatch" : "wallet_session_unavailable", activeMaterial.ok ? "Wallet Session material does not match the active ECDSA material" : activeMaterial.message)
-			};
-			runtimePolicyScope = activeMaterial.runtimePolicyScope;
-		} else return {
-			ok: false,
-			error: routerAbStepUpError(403, "scope_mismatch", "Wallet Session family is invalid")
-		};
-	} catch {
-		return {
-			ok: false,
-			error: routerAbStepUpError(503, "wallet_session_unavailable", "Wallet Session is unavailable")
-		};
-	}
-	if (session.tenantId !== input.authorizedOperations.tenantId || runtimePolicyScope.orgId !== session.tenantId || session.expiresAtMs <= Date.now()) return {
-		ok: false,
-		error: routerAbStepUpError(403, "scope_mismatch", "Wallet Session scope is invalid")
-	};
-	return {
-		ok: true,
-		authorizedOperations: input.authorizedOperations,
-		session: {
-			tenantId: session.tenantId,
-			principalId: session.principalId,
-			sessionId: String(session.authorizationId),
-			walletId: String(session.walletId),
-			runtimePolicyScope,
-			laneAuthorization: {
-				kind: "wallet_auth_method",
-				walletAuthMethodId: session.walletAuthMethodId
-			}
-		},
-		requestOrigin,
-		expiresAtMs: session.expiresAtMs
-	};
-}
-function walletExecutionLaneAuthSourceFromAuthority(authority) {
-	if (authority.factor.kind === "passkey") return {
-		kind: "passkey",
-		credentialIdB64u: authority.factor.credentialIdB64u
-	};
-	const providerSubject = parseProviderSubject(authority.factor.providerUserId);
-	return providerSubject.ok ? {
-		kind: "oidc_provider",
-		providerId: authority.factor.provider === "google" ? "google_oidc" : "oidc",
-		providerSubject: providerSubject.value
-	} : null;
-}
-function evmAddress20B64u(value) {
-	if (!/^0x[0-9a-fA-F]{40}$/.test(value)) return null;
-	const bytes = new Uint8Array(20);
-	for (let index = 0; index < bytes.length; index += 1) bytes[index] = Number.parseInt(value.slice(2 + index * 2, 4 + index * 2), 16);
-	return base64UrlEncode(bytes);
-}
-async function authenticateRouterAbWalletOperationStepUp(input) {
-	return authenticateRouterAbWalletOperationStepUpIdentity({
-		kind: "wallet_session_operation_credential_v1",
-		headers: input.headers,
-		keyFamily: "ed25519",
-		operationKind: input.operationKind,
-		walletId: input.scope.account_id,
-		materialOwner: input.scope.material_activation.material_owner,
-		materialActivation: input.scope.material_activation,
-		requestExpiresAtMs: input.requestExpiresAtMs,
-		authorizedOperations: input.authorizedOperations,
-		authorizationSessions: input.authorizationSessions,
-		resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation
-	});
-}
-function parseRouterAbEd25519OperationStepUpScope(value) {
-	return parseRouterAbEd25519NormalSigningScopeV2(value);
-}
-function parseRouterAbOperationStepUpOperation(value) {
-	const intent = isPlainObject(value) ? value : null;
-	if (!intent) return {
-		ok: false,
-		message: "Router A/B step-up intent is required"
-	};
-	let operationKind;
-	switch (intent.kind) {
-		case "near_transaction_v1":
-			operationKind = "near.sign_transaction";
-			break;
-		case "near_delegate_action_v1":
-			operationKind = "near.sign_delegate_action";
-			break;
-		case "nep413_v1":
-			operationKind = "near.sign_nep413_message";
-			break;
-		default: return {
-			ok: false,
-			message: "Router A/B step-up intent kind is invalid"
-		};
-	}
-	const operationId = parseCapabilityOperationId(intent.operation_id);
-	if (!operationId.ok) return {
-		ok: false,
-		message: operationId.error.message
-	};
-	return {
-		ok: true,
-		operationId: operationId.value,
-		operation: buildNearEd25519MpcOperationRef(operationKind)
-	};
-}
-function parseRouterAbEd25519NormalSigningOperationForAdmission(input) {
-	if (input.phase === "prepare") {
-		const requestedOperation = parseRouterAbOperationStepUpOperation(input.body.intent);
-		if (!requestedOperation.ok) return requestedOperation;
-		return {
-			ok: true,
-			operation: {
-				phase: "prepare",
-				operationKind: requestedOperation.operation.operationKind
-			}
-		};
-	}
-	try {
-		switch (input.authorizationKind) {
-			case "reusable_wallet_session": {
-				const receipt = parseEd25519ReusableAuthorizedOperationReceipt(input.body.authorized_operation);
-				return {
-					ok: true,
-					operation: {
-						phase: "finalize",
-						operationKind: receipt.operation_kind,
-						authorizationKind: "reusable_wallet_session",
-						receipt
-					}
-				};
-			}
-			case "operation_step_up": {
-				const receipt = parseEd25519VerifiedStepUpAuthorizedOperationReceipt(input.body.authorized_operation);
-				return {
-					ok: true,
-					operation: {
-						phase: "finalize",
-						operationKind: receipt.operation_kind,
-						authorizationKind: "operation_step_up",
-						receipt
-					}
-				};
-			}
-		}
-	} catch (error) {
-		return {
-			ok: false,
-			message: errorMessage(error)
-		};
-	}
-}
-async function validateRouterAbEd25519V2FinalizeAuthorizedOperation(input) {
-	if (!input.authorizedOperations) return {
-		ok: false,
-		result: routerAbEd25519OwnerOperationFailureResult({
-			status: 501,
-			code: "not_configured",
-			message: "Reusable Wallet Session authorization is not configured",
-			phase: input.phase
-		})
-	};
-	let authorizedOperationId;
-	try {
-		authorizedOperationId = requireAuthorizationValue(parseAuthorizedOperationId(input.receipt.authorized_operation_id));
-		requireAuthorizationValue(parseCapabilityOperationId(input.receipt.operation_id));
-	} catch (error) {
-		return {
-			ok: false,
-			result: routerAbEd25519OwnerOperationFailureResult({
-				status: 400,
-				code: "invalid_authorized_operation",
-				message: errorMessage(error),
-				phase: input.phase
-			})
-		};
-	}
-	let operation;
-	try {
-		operation = await input.authorizedOperations.readAuthorizedOperationById({
-			tenantId: input.authorizedOperations.tenantId,
-			authorizedOperationId
-		});
-	} catch (error) {
-		return {
-			ok: false,
-			result: routerAbEd25519OwnerOperationFailureResult({
-				status: 500,
-				code: "internal",
-				message: errorMessage(error),
-				phase: input.phase
-			})
-		};
-	}
-	if (!operation) return {
-		ok: false,
-		result: routerAbEd25519OwnerOperationFailureResult({
-			status: 409,
-			code: "authorized_operation_missing",
-			message: "Authorized operation is unavailable",
-			phase: input.phase
-		})
-	};
-	const operationRef = operation.operation.operation;
-	if (operation.tenantId !== input.authorizedOperations.tenantId || operation.authorizedOperationId !== authorizedOperationId || operation.operation.operationId !== input.receipt.operation_id || operation.operationFingerprintDigest !== input.receipt.operation_fingerprint_digest || operation.operation.digests.laneDigest !== input.receipt.lane_digest_b64u || operation.operation.digests.intentDigest !== input.receipt.intent_digest_b64u || operation.operation.digests.displayDigest !== input.receipt.display_digest_b64u || operationRef.capabilityKind !== "near_ed25519_mpc_signing" || operationRef.operationKind !== input.receipt.operation_kind) return {
-		ok: false,
-		result: routerAbEd25519OwnerOperationFailureResult({
-			status: 400,
-			code: "invalid_authorized_operation",
-			message: "Ed25519 authorized operation does not match its receipt",
-			phase: input.phase
-		})
-	};
-	switch (operationRef.operationKind) {
-		case "near.sign_transaction":
-		case "near.sign_delegate_action":
-		case "near.sign_nep413_message": return {
-			ok: true,
-			operationKind: operationRef.operationKind
-		};
-	}
-}
-function requireAuthorizationValue(result) {
-	if (!result.ok) throw new Error(result.error.message);
-	return result.value;
-}
-async function authorizeRouterAbEd25519WalletSessionRequest(input) {
-	if (input.operation.phase === "finalize") {
-		const exactOperation = await validateRouterAbEd25519V2FinalizeAuthorizedOperation({
-			receipt: input.operation.receipt,
-			authorizedOperations: input.authorizedOperations,
-			phase: input.phase
-		});
-		if (!exactOperation.ok) return exactOperation;
-		if (exactOperation.operationKind !== input.admission.operationKind) return {
-			ok: false,
-			result: routerAbEd25519OwnerOperationFailureResult({
-				status: 403,
-				code: "wallet_session_scope_mismatch",
-				message: "Exact Wallet Session operation does not match the authorized operation",
-				phase: input.phase
-			})
-		};
-	}
-	const expectedMaterialActivation = routerAbMpcMaterialActivationRefFromWire(input.scope.material_activation);
-	const admittedMaterialActivation = routerAbMpcMaterialActivationRefToWire(input.admission.materialActivation);
-	const expiresAtMs = Number(input.body.expires_at_ms);
-	if (input.scope.authorization.wallet_session_id !== input.session.walletSessionId || input.scope.account_id !== String(input.session.walletId) || input.scope.material_activation.material_owner !== String(input.session.walletId) || input.scope.signing_worker_id !== input.scope.material_activation.signing_worker || !mpcMaterialActivationRefsEqual(expectedMaterialActivation, input.admission.materialActivation) || !Number.isFinite(expiresAtMs) || expiresAtMs <= 0) return {
-		ok: false,
-		result: routerAbEd25519OwnerOperationFailureResult({
-			status: 403,
-			code: "wallet_session_scope_mismatch",
-			message: "Exact Wallet Session does not authorize this Ed25519 request",
-			phase: input.phase
-		})
-	};
-	if (expiresAtMs <= Date.now()) return {
-		ok: false,
-		result: routerAbEd25519OwnerOperationFailureResult({
-			status: 408,
-			code: "expired_request",
-			message: "Router A/B Ed25519 normal-signing request is expired",
-			phase: input.phase
-		})
-	};
-	if (expiresAtMs > input.session.expiresAtMs) return {
-		ok: false,
-		result: routerAbEd25519OwnerOperationFailureResult({
-			status: 403,
-			code: "wallet_session_scope_mismatch",
-			message: "Ed25519 request exceeds the exact Wallet Session lifetime",
-			phase: input.phase
-		})
-	};
-	const activeMaterial = await input.resolveEd25519MaterialActivation({
-		walletId: String(input.session.walletId),
-		materialActivation: admittedMaterialActivation
-	});
-	if (!activeMaterial.ok || !sameRouterAbMpcMaterialActivationRef(activeMaterial.materialActivation, admittedMaterialActivation) || activeMaterial.signingWorkerId !== input.scope.signing_worker_id || base64UrlEncode(Uint8Array.from(activeMaterial.exportIdentity.registered_public_key)) !== input.admission.signer.registeredPublicKeyB64u) return {
-		ok: false,
-		result: routerAbEd25519OwnerOperationFailureResult({
-			status: activeMaterial.ok || activeMaterial.code !== "internal" ? 403 : 500,
-			code: activeMaterial.ok || activeMaterial.code !== "internal" ? "material_mismatch" : "internal",
-			message: activeMaterial.ok ? "Exact Wallet Session material does not match the active Ed25519 material" : activeMaterial.message,
-			phase: input.phase
-		})
-	};
-	const admission = {
-		ok: true,
-		thresholdSessionId: activeMaterial.exportIdentity.scope.threshold_session_id,
-		requestId: input.scope.request_id,
-		expiresAtMs,
-		materialActivation: admittedMaterialActivation
-	};
-	const admissionDecision = await evaluateRouterAbNormalSigningAdmission({
-		adapter: input.admissionAdapter,
-		curve: "ed25519",
-		authorizationKind: "wallet_session_operation_credential_v1",
-		phase: input.phase,
-		walletId: String(input.session.walletId),
-		authorityId: input.authorityId,
-		thresholdSessionId: activeMaterial.exportIdentity.scope.threshold_session_id,
-		walletSessionId: String(input.session.walletSessionId),
-		quotaId: String(input.session.quotaId),
-		requestId: input.scope.request_id,
-		expiresAtMs,
-		signingWorkerId: activeMaterial.signingWorkerId,
-		runtimePolicyScope: activeMaterial.runtimePolicyScope
-	});
-	if (!admissionDecision.ok) return {
-		ok: false,
-		result: routerAbEd25519OwnerOperationFailureResult({
-			status: admissionDecision.status,
-			code: admissionDecision.code,
-			message: admissionDecision.message,
-			phase: input.phase
-		})
-	};
-	return {
-		ok: true,
-		admission,
-		activeMaterial
-	};
-}
-async function resolveRouterAbEd25519ExhaustedCandidateAuthorization(input) {
-	const token = extractBearerCredential(input.headers);
-	if (!token) return null;
-	let candidate;
-	try {
-		candidate = await input.authorizationSessions.readExhaustedWalletSessionAuthorizationV2CandidateByOperationCredential({
-			tenantId: input.authorizationSessions.tenantId,
-			token,
-			nowMs: Date.now()
-		});
-	} catch {
-		return {
-			ok: false,
-			result: routerAbStepUpError(503, "wallet_session_unavailable", "Wallet Session is unavailable")
-		};
-	}
-	if (!candidate) return null;
-	const session = candidate.status.session;
-	const admission = resolveWalletSessionAuthorizationV2Admission({
-		authorization: session,
-		authority: candidate.authority,
-		authMethod: candidate.authMethod,
-		operation: {
-			tenantId: session.tenantId,
-			principalId: session.principalId,
-			walletId: session.walletId,
-			keyFamily: "ed25519",
-			operationKind: input.operation.operationKind
-		},
-		retiredAtMs: candidate.retiredAtMs,
-		nowMs: Date.now()
-	});
-	if (!admission.ok || admission.keyFamily !== "ed25519") return {
-		ok: false,
-		result: routerAbEd25519OwnerOperationFailureResult({
-			status: 403,
-			code: "wallet_session_scope_mismatch",
-			message: "Exact Wallet Session does not authorize this Ed25519 request",
-			phase: input.phase
-		})
-	};
-	const authorized = await authorizeRouterAbEd25519WalletSessionRequest({
-		phase: input.phase,
-		body: input.body,
-		scope: input.scope,
-		operation: input.operation,
-		session,
-		authorityId: String(candidate.authority.authorityId),
-		admission,
-		authorizedOperations: input.authorizedOperations,
-		admissionAdapter: input.admissionAdapter,
-		resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation
+		requestDigest: await routerAbEcdsaDerivationEvmDigestSigningFinalizeCoreRequestDigestV1(request),
+		signingContext,
+		trustedSourceDigest,
+		materialSource: input.materialSource
 	});
-	if (!authorized.ok) return authorized;
-	return {
-		ok: true,
-		kind: "wallet_session_operation_credential_exhausted_candidate_v1",
-		candidate,
-		admission: authorized.admission,
-		activeMaterial: authorized.activeMaterial
-	};
 }
-function routerAbOperationStepUpClaimFailure(result) {
-	switch (result.kind) {
-		case "claimed":
-		case "operation_in_progress":
-		case "replayed": return null;
-		case "authorization_grant_rejected":
-		case "verified_step_up_rejected": return routerAbStepUpError(403, result.kind, "Operation step-up authorization is invalid");
-		case "wallet_session_quota_exhausted": return routerAbStepUpError(409, result.kind, "Operation step-up authorization is invalid");
-		case "material_mismatch": return routerAbStepUpError(403, result.kind, "Operation step-up material is invalid");
-	}
-}
-function routerAbStepUpError(status, code, message) {
+function privateEcdsaDerivationSigningWorkerBody(input) {
 	return {
-		status,
-		body: {
-			ok: false,
-			code,
-			message
-		}
-	};
-}
-async function authorizeRouterAbEd25519NormalSigningRoute(input) {
-	let scope;
-	try {
-		scope = parseRouterAbEd25519NormalSigningScopeV2(input.body.scope);
-	} catch (error) {
-		return {
-			ok: false,
-			result: routerAbEd25519OwnerOperationFailureResult({
-				status: 400,
-				code: "invalid_body",
-				message: errorMessage(error),
-				phase: input.phase
-			})
-		};
-	}
-	const operationForAdmission = parseRouterAbEd25519NormalSigningOperationForAdmission({
-		phase: input.phase,
-		body: input.body,
-		authorizationKind: scope.authorization.kind
-	});
-	if (!operationForAdmission.ok) return {
-		ok: false,
-		result: routerAbEd25519OwnerOperationFailureResult({
-			status: 400,
-			code: "invalid_body",
-			message: operationForAdmission.message,
-			phase: input.phase
-		})
-	};
-	if (scope.authorization.kind === "operation_step_up") {
-		const result = await handleRouterAbEd25519OperationStepUpRoute({
-			body: input.body,
-			headers: input.headers,
-			authorizedOperations: input.authorizedOperations,
-			authorizationSessions: input.authorizationSessions,
-			resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation,
-			phase: input.phase,
-			scope,
-			operationKind: operationForAdmission.operation.operationKind
-		});
-		return "status" in result ? {
-			ok: false,
-			result
-		} : {
-			ok: true,
-			kind: "operation_step_up",
-			...result
-		};
-	}
-	const validated = await validateRouterAbEd25519WalletSessionInputs({
-		headers: input.headers,
-		authorizationSessions: input.authorizationSessions,
-		operationKind: operationForAdmission.operation.operationKind
-	});
-	if (!validated.ok) {
-		const operation = operationForAdmission.operation;
-		if (validated.code === "wallet_session_unavailable" && input.authorizationSessions && (operation.phase === "prepare" || operation.authorizationKind === "reusable_wallet_session")) {
-			const exhaustedCandidate = await resolveRouterAbEd25519ExhaustedCandidateAuthorization({
-				body: input.body,
-				headers: input.headers,
-				scope,
-				phase: input.phase,
-				operation,
-				authorizedOperations: input.authorizedOperations,
-				authorizationSessions: input.authorizationSessions,
-				admissionAdapter: input.admissionAdapter,
-				resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation
-			});
-			if (exhaustedCandidate) return exhaustedCandidate;
-		}
-		const stepUp = await resolveRouterAbEd25519OwnerOperationStepUpPreparation({
-			scope,
-			body: input.body,
-			phase: input.phase,
-			resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation
-		});
-		return {
-			ok: false,
-			result: routerAbEd25519OwnerOperationFailureResult({
-				status: routerAbWalletSessionValidationStatus(validated.code),
-				code: validated.code,
-				message: validated.message,
-				phase: input.phase,
-				stepUp
-			})
-		};
-	}
-	const operation = operationForAdmission.operation;
-	if (operation.phase === "finalize" && operation.authorizationKind !== "reusable_wallet_session") return {
-		ok: false,
-		result: routerAbEd25519OwnerOperationFailureResult({
-			status: 400,
-			code: "invalid_authorized_operation",
-			message: "Reusable Wallet Session authorized operation is required",
-			phase: input.phase
-		})
-	};
-	const authorized = await authorizeRouterAbEd25519WalletSessionRequest({
-		phase: input.phase,
-		body: input.body,
-		scope,
-		operation,
-		session: validated.admission.context.authorization.session,
-		authorityId: String(validated.admission.context.authority.authorityId),
-		admission: validated.admission.admission,
-		authorizedOperations: input.authorizedOperations,
-		admissionAdapter: input.admissionAdapter,
-		resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation
-	});
-	if (!authorized.ok) return authorized;
-	return {
-		ok: true,
-		kind: "wallet_session_operation_credential_v1",
-		validated,
-		admission: authorized.admission,
-		activeMaterial: authorized.activeMaterial
-	};
-}
-function errorMessage(error) {
-	return String(error && typeof error === "object" && "message" in error ? error.message : error || "unknown error");
-}
-/**
-* Re-resolve the complete activation reference immediately before a claim or
-* evidence write. The resolver is authoritative for capability identity and
-* all owner/key/lifecycle/worker bindings; a stale or superseded reference
-* must fail before any authorization side effect is attempted.
-*/
-async function resolveFreshRouterAbEcdsaMaterialActivation(input) {
-	const resolved = await input.resolveEcdsaMaterialActivation({
-		walletId: input.walletId,
-		materialActivation: input.expected
-	});
-	if (!resolved.ok) return resolved;
-	if (!sameRouterAbMpcMaterialActivationRef(resolved.materialActivation, input.expected)) return {
-		ok: false,
-		code: "scope_mismatch",
-		message: "ECDSA material activation changed before authorization claim"
-	};
-	return {
-		ok: true,
-		materialActivation: resolved.materialActivation,
-		keyHandle: resolved.keyHandle,
-		relayerKeyId: resolved.relayerKeyId,
-		participantIds: resolved.participantIds,
-		runtimePolicyScope: resolved.runtimePolicyScope
-	};
-}
-function validateRouterAbEcdsaV2NormalSigningRequestForSession(input) {
-	let request;
-	try {
-		request = input.phase === "prepare" ? parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1(input.body) : parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1(input.body);
-	} catch (error) {
-		return {
-			ok: false,
-			error: routerAbStepUpError(400, "invalid_body", errorMessage(error))
-		};
-	}
-	if (request.authorization.kind !== "reusable_wallet_session" || request.authorization.wallet_session_id !== input.session.walletSessionId || request.scope.wallet_id !== String(input.session.walletId) || request.material_activation.material_owner !== String(input.session.walletId) || request.material_activation.signing_worker !== request.scope.signing_worker.server_id || !sameRouterAbMpcMaterialActivationRef(request.material_activation, request.scope.material_activation) || !sameRouterAbMpcMaterialActivationRef(request.material_activation, input.admittedMaterialActivation)) return {
-		ok: false,
-		error: routerAbWalletSessionError(WALLET_SESSION_FAILURE_CODES.scopeMismatch)
-	};
-	if (request.expires_at_ms <= Date.now()) return {
-		ok: false,
-		error: routerAbSigningError(408, "expired_request", "Router A/B ECDSA derivation normal-signing request is expired")
-	};
-	if (request.expires_at_ms > input.session.expiresAtMs) return {
-		ok: false,
-		error: routerAbWalletSessionError(WALLET_SESSION_FAILURE_CODES.scopeMismatch)
-	};
-	return {
-		ok: true,
-		request,
-		admission: {
-			ok: true,
-			thresholdSessionId: routerAbEcdsaDerivationActiveStateId({
-				kind: ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1,
-				scope: request.scope
-			}),
-			requestId: request.request_id,
-			expiresAtMs: request.expires_at_ms,
-			materialActivation: input.admittedMaterialActivation
-		}
-	};
-}
-async function admitRouterAbEcdsaReusableWalletSessionOperation(input) {
-	if (!routerAbEcdsaAtomicAuthorizationConfigured(input.authorizedOperations)) return {
-		ok: false,
-		error: routerAbStepUpError(501, "not_configured", "ECDSA atomic authorization is not configured")
-	};
-	if (input.request.authorization.kind !== "reusable_wallet_session") return {
-		ok: false,
-		error: routerAbStepUpError(400, "invalid_body", "Reusable Wallet Session authority is required")
-	};
-	const nowMs = Date.now();
-	try {
-		const session = input.binding.kind === "wallet_session_operation_credential_v1" ? input.binding.context.authorization.session : input.binding.candidate.status.session;
-		const tenantId = session.tenantId;
-		const principalId = session.principalId;
-		const walletId = session.walletId;
-		const walletSessionId = session.walletSessionId;
-		const authorizationId = session.authorizationId;
-		const quotaId = session.quotaId;
-		if (tenantId !== input.authorizedOperations.tenantId || input.request.authorization.wallet_session_id !== walletSessionId) return {
-			ok: false,
-			error: routerAbStepUpError(403, "wallet_session_mismatch", "Reusable Wallet Session identity does not match")
-		};
-		const freshMaterial = await resolveFreshRouterAbEcdsaMaterialActivation({
-			resolveEcdsaMaterialActivation: input.resolveEcdsaMaterialActivation,
-			walletId: String(walletId),
-			expected: input.materialActivation
-		});
-		if (!freshMaterial.ok) return {
-			ok: false,
-			error: routerAbStepUpError(freshMaterial.code === "internal" ? 500 : 403, freshMaterial.code === "internal" ? "internal" : "wallet_session_mismatch", freshMaterial.message)
-		};
-		const capabilityId = requireAuthorizationValue(parseCapabilityId(freshMaterial.materialActivation.capability));
-		const operationId = requireAuthorizationValue(parseCapabilityOperationId(input.request.operation_id));
-		const envelope = buildCapabilityOperationEnvelope({
-			tenantId,
-			principalId,
-			capabilityId,
-			operationId,
-			operation: buildEvmEcdsaMpcOperationRef("evm.sign_transaction"),
-			digests: {
-				laneDigest: parseDigestB64u(input.request.operation_digests.lane_digest_b64u),
-				intentDigest: parseDigestB64u(input.request.operation_digests.intent_digest_b64u),
-				displayDigest: parseDigestB64u(input.request.operation_digests.display_digest_b64u)
-			}
-		});
-		const authorizedOperationId = requireAuthorizationValue(parseAuthorizedOperationId(`ecdsa-authorized-operation:${operationId}:${input.request.request_id}`));
-		const auditEventId = requireAuthorizationValue(parseAuthorizationAuditEventId(`ecdsa-operation-audit:${operationId}`));
-		const outcome = await input.authorizedOperations.admitAuthorizedOperation({
-			operation: {
-				tenantId,
-				authorizedOperationId,
-				auditEventId,
-				operation: envelope,
-				authorization: {
-					kind: "authorization_grant",
-					authorizationGrantRef: buildAuthorizationGrantRef(authorizationId)
-				},
-				quota: {
-					kind: "consume_reusable_wallet_session",
-					quotaId
-				},
-				claimedAtMs: nowMs
-			},
-			material: {
-				walletId,
-				keyHandle: freshMaterial.keyHandle,
-				runtimePolicyScope: freshMaterial.runtimePolicyScope,
-				materialActivation: freshMaterial.materialActivation
-			}
-		});
-		const claimFailure = routerAbReusableWalletSessionClaimFailure(outcome);
-		if (claimFailure) return {
-			ok: false,
-			error: claimFailure
-		};
-		if (outcome.kind === "claimed" || outcome.kind === "operation_in_progress" || outcome.kind === "replayed") return {
-			ok: true,
-			admission: {
-				kind: outcome.kind,
-				operation: outcome.operation
-			}
-		};
-		return {
-			ok: false,
-			error: routerAbStepUpError(409, outcome.kind, "Authorized operation is unavailable")
-		};
-	} catch (error) {
-		return {
-			ok: false,
-			error: routerAbStepUpError(400, "invalid_body", errorMessage(error))
-		};
-	}
-}
-function routerAbReusableWalletSessionClaimFailure(result) {
-	switch (result.kind) {
-		case "claimed":
-		case "operation_in_progress":
-		case "replayed": return null;
-		case "wallet_session_quota_exhausted": return routerAbStepUpError(409, result.kind, "Reusable Wallet Session quota is exhausted");
-		case "authorization_grant_rejected": return routerAbStepUpError(403, result.kind, "Reusable Wallet Session authorization is invalid");
-		case "verified_step_up_rejected": return routerAbStepUpError(403, result.kind, "Reusable Wallet Session authorization is invalid");
-		case "material_mismatch": return routerAbStepUpError(403, result.kind, "ECDSA material activation is no longer active");
-	}
-}
-async function completeRouterAbEcdsaOperation(input) {
-	await input.authorizedOperations.completeAuthorizedOperation({
-		operation: input.operation,
-		result: input.result,
-		response: input.response,
-		completedAtMs: Date.now()
-	});
-}
-function routerAbEcdsaOperationStepUpScope(request) {
-	return "scope" in request ? request.scope : request.normal_signing_scope;
-}
-function parseRouterAbEcdsaOperationStepUpRequest(input) {
-	return input.phase === "prepare" ? parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1(input.body) : parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1(input.body);
-}
-async function authorizeRouterAbEcdsaWalletSessionRequest(input) {
-	const validated = validateRouterAbEcdsaV2NormalSigningRequestForSession(input);
-	if (!validated.ok) return {
-		ok: false,
-		result: validated.error
-	};
-	const activeMaterial = await input.resolveEcdsaMaterialActivation({
-		walletId: String(input.session.walletId),
-		materialActivation: validated.admission.materialActivation
-	});
-	if (!activeMaterial.ok) return {
-		ok: false,
-		result: routerAbEcdsaOwnerOperationFailureResult({
-			status: activeMaterial.code === "internal" ? 500 : 403,
-			code: activeMaterial.code === "internal" ? "internal" : "material_mismatch",
-			message: activeMaterial.code === "internal" ? activeMaterial.message : "Wallet Session V2 material is no longer active",
-			phase: input.phase
-		})
-	};
-	if (!sameRouterAbMpcMaterialActivationRef(activeMaterial.materialActivation, validated.admission.materialActivation) || !sameRouterAbEcdsaDerivationNormalSigningScopeV1(validated.request.scope, activeMaterial.routerAbEcdsaDerivationNormalSigning.scope)) return {
-		ok: false,
-		result: routerAbStepUpError(403, "wallet_session_scope_mismatch", "Wallet Session V2 scope does not match the active material")
-	};
-	const admissionDecision = await evaluateRouterAbNormalSigningAdmission({
-		adapter: input.admissionAdapter,
-		curve: "ecdsa",
-		authorizationKind: "wallet_session_operation_credential_v1",
-		phase: input.phase,
-		walletId: String(input.session.walletId),
-		walletSessionId: String(input.session.walletSessionId),
-		materialActivation: activeMaterial.materialActivation,
-		requestId: validated.admission.requestId,
-		expiresAtMs: validated.admission.expiresAtMs,
-		signingWorkerId: activeMaterial.materialActivation.signing_worker,
-		keyHandle: activeMaterial.keyHandle,
-		runtimePolicyScope: activeMaterial.runtimePolicyScope,
-		admission: validated.admission
-	});
-	if (!admissionDecision.ok) return {
-		ok: false,
-		result: routerAbEcdsaOwnerOperationFailureResult({
-			status: admissionDecision.status,
-			code: admissionDecision.code,
-			message: admissionDecision.message,
-			phase: input.phase
+		request: input.request,
+		trusted_admission: privateSigningTrustedAdmission({
+			accountId: input.request.scope.wallet_id,
+			authorization: input.signingContext,
+			requestId: input.request.request_id,
+			intentDigest: input.requestDigest,
+			trustedSourceDigest: input.trustedSourceDigest
+		}),
+		material_source: input.materialSource ?? registrationMaterialSourceV1({
+			accountId: input.request.scope.wallet_id,
+			materialActivationId: input.request.scope.material_activation.activation_id,
+			signingWorkerId: input.request.scope.signing_worker.server_id
 		})
 	};
-	return {
-		ok: true,
-		request: validated.request,
-		admission: {
-			...validated.admission,
-			materialActivation: activeMaterial.materialActivation
-		},
-		activeMaterial
-	};
-}
-async function resolveRouterAbEcdsaExhaustedCandidateAuthorization(input) {
-	const token = extractBearerCredential(input.headers);
-	if (!token) return null;
-	let candidate;
-	try {
-		candidate = await input.authorizationSessions.readExhaustedWalletSessionAuthorizationV2CandidateByOperationCredential({
-			tenantId: input.authorizationSessions.tenantId,
-			token,
-			nowMs: Date.now()
-		});
-	} catch {
-		return {
-			ok: false,
-			result: routerAbStepUpError(503, "wallet_session_unavailable", "Wallet Session is unavailable")
-		};
-	}
-	if (!candidate) return null;
-	const session = candidate.status.session;
-	const admission = resolveWalletSessionAuthorizationV2Admission({
-		authorization: session,
-		authority: candidate.authority,
-		authMethod: candidate.authMethod,
-		operation: {
-			tenantId: session.tenantId,
-			principalId: session.principalId,
-			walletId: session.walletId,
-			keyFamily: "ecdsa_secp256k1",
-			operationKind: "evm.sign_transaction"
-		},
-		retiredAtMs: candidate.retiredAtMs,
-		nowMs: Date.now()
-	});
-	if (!admission.ok || admission.keyFamily !== "ecdsa_secp256k1") return {
-		ok: false,
-		result: routerAbWalletSessionError(WALLET_SESSION_FAILURE_CODES.scopeMismatch)
-	};
-	const authorized = await authorizeRouterAbEcdsaWalletSessionRequest({
-		phase: input.phase,
-		body: input.body,
-		session,
-		admittedMaterialActivation: routerAbMpcMaterialActivationRefToWire(admission.materialActivation),
-		admissionAdapter: input.admissionAdapter,
-		resolveEcdsaMaterialActivation: input.resolveEcdsaMaterialActivation
-	});
-	if (!authorized.ok) return authorized;
-	return {
-		ok: true,
-		kind: "wallet_session_operation_credential_exhausted_candidate_v1",
-		candidate,
-		admission: authorized.admission,
-		activeMaterial: authorized.activeMaterial
-	};
-}
-async function authenticateRouterAbEcdsaOperationStepUp(input) {
-	if (!input.authorizedOperations || !input.authorizationSessions) return {
-		ok: false,
-		error: routerAbStepUpError(501, "not_configured", "ECDSA operation step-up authorization is not configured")
-	};
-	const token = extractBearerCredential(input.headers);
-	if (!token) return {
-		ok: false,
-		error: routerAbStepUpError(401, "unauthorized", "Wallet Session is required")
-	};
-	const requestOriginRaw = (Array.isArray(input.headers.origin) ? input.headers.origin[0] : input.headers.origin) || "";
-	let requestOrigin;
-	try {
-		requestOrigin = parseSessionOrigin(String(requestOriginRaw).trim());
-	} catch {
-		return {
-			ok: false,
-			error: routerAbStepUpError(401, "unauthorized", "Wallet owner proof origin is invalid")
-		};
-	}
-	let candidate;
-	try {
-		candidate = await input.authorizationSessions.readWalletSessionExactOperationContextByCredential({
-			tenantId: input.authorizationSessions.tenantId,
-			token,
-			nowMs: Date.now()
-		});
-	} catch {
-		return {
-			ok: false,
-			error: routerAbStepUpError(503, "wallet_session_unavailable", "Wallet Session is unavailable")
-		};
-	}
-	if (!candidate) return {
-		ok: false,
-		error: routerAbStepUpError(401, "unauthorized", "Wallet Session is invalid")
-	};
-	const session = candidate.session;
-	const scope = routerAbEcdsaOperationStepUpScope(input.request);
-	const admission = resolveWalletSessionAuthorizationV2Admission({
-		authorization: session,
-		authority: candidate.authority,
-		authMethod: candidate.authMethod,
-		operation: {
-			tenantId: session.tenantId,
-			principalId: session.principalId,
-			walletId: session.walletId,
-			keyFamily: "ecdsa_secp256k1",
-			operationKind: "evm.sign_transaction"
-		},
-		retiredAtMs: candidate.retiredAtMs,
-		nowMs: Date.now()
-	});
-	if (!admission.ok || admission.keyFamily !== "ecdsa_secp256k1") return {
-		ok: false,
-		error: routerAbStepUpError(403, "scope_mismatch", "Wallet Session scope is invalid")
-	};
-	const admittedMaterialActivation = routerAbMpcMaterialActivationRefToWire(admission.materialActivation);
-	if (admission.operationKind !== "evm.sign_transaction" || session.walletId.toString() !== scope.wallet_id || input.request.material_activation.material_owner !== scope.wallet_id || !Number.isSafeInteger(input.request.expires_at_ms) || input.request.expires_at_ms > session.expiresAtMs || !sameRouterAbMpcMaterialActivationRef(admittedMaterialActivation, input.request.material_activation)) return {
-		ok: false,
-		error: routerAbStepUpError(403, "scope_mismatch", "Wallet Session scope is invalid")
-	};
-	let activeMaterial;
-	try {
-		activeMaterial = await input.resolveEcdsaMaterialActivation({
-			walletId: scope.wallet_id,
-			materialActivation: admittedMaterialActivation
-		});
-	} catch {
-		return {
-			ok: false,
-			error: routerAbStepUpError(503, "wallet_session_unavailable", "Wallet Session is unavailable")
-		};
-	}
-	const normalSigning = activeMaterial.ok ? activeMaterial.routerAbEcdsaDerivationNormalSigning : null;
-	if (!activeMaterial.ok || !normalSigning || !sameRouterAbMpcMaterialActivationRef(activeMaterial.materialActivation, admittedMaterialActivation) || !sameRouterAbMpcMaterialActivationRef(normalSigning.scope.material_activation, admittedMaterialActivation) || normalSigning.scope.wallet_id !== scope.wallet_id || normalSigning.scope.public_identity.threshold_public_key33_b64u !== admission.signer.thresholdPublicKey33B64u || normalSigning.scope.public_identity.ethereum_address20_b64u !== evmAddress20B64u(admission.signer.evmAddress)) return {
-		ok: false,
-		error: routerAbStepUpError(activeMaterial.ok || activeMaterial.code !== "internal" ? 403 : 503, activeMaterial.ok || activeMaterial.code !== "internal" ? "scope_mismatch" : "wallet_session_unavailable", activeMaterial.ok ? "Wallet Session material does not match the active ECDSA material" : activeMaterial.message)
-	};
-	if (session.tenantId !== input.authorizedOperations.tenantId || activeMaterial.runtimePolicyScope.orgId !== session.tenantId || session.expiresAtMs <= Date.now()) return {
-		ok: false,
-		error: routerAbStepUpError(403, "scope_mismatch", "Wallet Session scope is invalid")
-	};
-	return {
-		ok: true,
-		authorizedOperations: input.authorizedOperations,
-		activeMaterial,
-		session: {
-			tenantId: session.tenantId,
-			principalId: session.principalId,
-			sessionId: String(session.authorizationId),
-			walletId: String(session.walletId),
-			runtimePolicyScope: activeMaterial.runtimePolicyScope,
-			laneAuthorization: {
-				kind: "wallet_auth_method",
-				walletAuthMethodId: session.walletAuthMethodId
-			}
-		},
-		requestOrigin,
-		expiresAtMs: session.expiresAtMs
-	};
-}
-function validateRouterAbEcdsaOperationStepUpIdentity(input) {
-	const request = input.request;
-	if (request.authorization.kind !== "operation_step_up" || request.scope.wallet_id !== input.session.walletId || request.material_activation.material_owner !== input.session.walletId || request.material_activation.signing_worker !== request.scope.signing_worker.server_id || !sameRouterAbMpcMaterialActivationRef(request.material_activation, request.scope.material_activation)) return routerAbStepUpError(403, "scope_mismatch", "ECDSA operation step-up identity does not match");
-	if (request.expires_at_ms <= Date.now()) return routerAbStepUpError(408, "expired_request", "Router A/B ECDSA operation step-up request is expired");
-	return null;
-}
-async function claimRouterAbEcdsaOperationStepUp(input) {
-	if (!routerAbEcdsaAtomicAuthorizationConfigured(input.authenticated.authorizedOperations)) return routerAbStepUpError(501, "not_configured", "ECDSA atomic authorization is not configured");
-	let authorizedOperationId;
-	let operationEnvelope;
-	try {
-		const operationId = requireAuthorizationValue(parseCapabilityOperationId(input.operation.operation_id));
-		authorizedOperationId = requireAuthorizationValue(parseAuthorizedOperationId(`ecdsa-step-up-authorized-operation:${input.operation.operation_id}`));
-		operationEnvelope = buildCapabilityOperationEnvelope({
-			tenantId: input.authenticated.session.tenantId,
-			principalId: input.authenticated.session.principalId,
-			capabilityId: requireAuthorizationValue(parseCapabilityId(input.materialActivation.capability)),
-			operationId,
-			operation: buildEvmEcdsaMpcOperationRef(input.operationKind),
-			digests: {
-				laneDigest: parseDigestB64u(input.operation.operation_digests.lane_digest_b64u),
-				intentDigest: parseDigestB64u(input.operation.operation_digests.intent_digest_b64u),
-				displayDigest: parseDigestB64u(input.operation.operation_digests.display_digest_b64u)
-			}
-		});
-	} catch (error) {
-		return routerAbStepUpError(400, "invalid_body", errorMessage(error));
-	}
-	const existing = await input.authenticated.authorizedOperations.readAuthorizedOperation({
-		tenantId: input.authenticated.session.tenantId,
-		operationFingerprintDigest: await computeCapabilityOperationFingerprintDigest(operationEnvelope)
-	});
-	if (!existing || existing.authorizedOperationId !== authorizedOperationId) return routerAbStepUpError(409, "authorized_operation_missing", "Operation authorization is unavailable");
-	if (existing.authorization.kind !== "verified_step_up" || existing.quota.kind !== "quota_neutral") return routerAbStepUpError(409, "authorized_operation_missing", "Operation authorization has an invalid source or quota");
-	const result = await input.authenticated.authorizedOperations.admitAuthorizedOperation({
-		operation: {
-			tenantId: existing.tenantId,
-			authorizedOperationId: existing.authorizedOperationId,
-			auditEventId: existing.auditEventId,
-			operation: existing.operation,
-			authorization: existing.authorization,
-			quota: existing.quota,
-			claimedAtMs: Date.now()
-		},
-		material: {
-			walletId: requireAuthorizationValue(parseWalletId(input.authenticated.session.walletId)),
-			keyHandle: input.keyHandle,
-			runtimePolicyScope: input.authenticated.session.runtimePolicyScope,
-			materialActivation: input.materialActivation
-		}
-	});
-	if (result.kind === "material_mismatch") return routerAbStepUpError(403, "scope_mismatch", "ECDSA material activation changed before authorized-operation admission");
-	const claimFailure = routerAbOperationStepUpClaimFailure(result);
-	if (claimFailure) return claimFailure;
-	if (result.kind === "claimed" || result.kind === "operation_in_progress" || result.kind === "replayed") return {
-		kind: result.kind,
-		operation: result.operation
-	};
-	return routerAbStepUpError(409, "authorized_operation_missing", "Authorized operation is unavailable");
-}
-async function handleRouterAbEcdsaOperationStepUpRoute(input) {
-	let request;
-	try {
-		request = parseRouterAbEcdsaOperationStepUpRequest(input);
-	} catch (error) {
-		return routerAbStepUpError(400, "invalid_body", errorMessage(error));
-	}
-	if (request.authorization.kind !== "operation_step_up") return routerAbStepUpError(400, "invalid_body", "Operation step-up authority is required");
-	const authenticated = await authenticateRouterAbEcdsaOperationStepUp({
-		headers: input.headers,
-		request,
-		authorizedOperations: input.authorizedOperations,
-		authorizationSessions: input.authorizationSessions,
-		resolveEcdsaMaterialActivation: input.resolveEcdsaMaterialActivation
-	});
-	if (!authenticated.ok) return authenticated.error;
-	const identityFailure = validateRouterAbEcdsaOperationStepUpIdentity({
-		request,
-		session: authenticated.session
-	});
-	if (identityFailure) return identityFailure;
-	const activeMaterial = authenticated.activeMaterial;
-	if (!sameRouterAbMpcMaterialActivationRef(activeMaterial.materialActivation, request.scope.material_activation)) return routerAbStepUpError(403, "scope_mismatch", "ECDSA operation step-up scope does not name the active material");
-	const materialActivationId = requireMpcMaterialActivationId(activeMaterial.materialActivation.activation_id);
-	if (!input.admissionAdapter) return routerAbStepUpError(501, "not_configured", "Router A/B ECDSA operation step-up admission is not configured");
-	const admission = await input.admissionAdapter.evaluatePolicy({
-		curve: "ecdsa",
-		phase: input.phase,
-		walletId: authenticated.session.walletId,
-		materialActivationId,
-		authorizationIdentity: {
-			kind: "operation_step_up",
-			materialActivationId
-		},
-		requestId: request.request_id,
-		expiresAtMs: request.expires_at_ms,
-		signingWorkerId: activeMaterial.materialActivation.signing_worker,
-		keyHandle: activeMaterial.keyHandle,
-		runtimePolicyScope: authenticated.session.runtimePolicyScope
-	});
-	if (!admission.ok) return {
-		status: admission.status,
-		body: {
-			ok: false,
-			code: admission.code,
-			message: admission.message
-		}
-	};
-	const freshMaterial = await resolveFreshRouterAbEcdsaMaterialActivation({
-		resolveEcdsaMaterialActivation: input.resolveEcdsaMaterialActivation,
-		walletId: authenticated.session.walletId,
-		expected: request.material_activation
-	});
-	if (!freshMaterial.ok) return routerAbStepUpError(freshMaterial.code === "internal" ? 500 : 403, freshMaterial.code === "internal" ? "internal" : "scope_mismatch", freshMaterial.message);
-	if (freshMaterial.keyHandle !== activeMaterial.keyHandle || freshMaterial.relayerKeyId !== activeMaterial.relayerKeyId || freshMaterial.participantIds[0] !== activeMaterial.participantIds[0] || freshMaterial.participantIds[1] !== activeMaterial.participantIds[1]) return routerAbStepUpError(403, "scope_mismatch", "ECDSA operation step-up signer facts changed before authorized-operation admission");
-	const claimResult = await claimRouterAbEcdsaOperationStepUp({
-		operationKind: "evm.sign_transaction",
-		operation: {
-			operation_id: request.operation_id,
-			operation_digests: request.operation_digests,
-			material_activation: request.material_activation
-		},
-		materialActivation: freshMaterial.materialActivation,
-		keyHandle: freshMaterial.keyHandle,
-		authenticated
-	});
-	if (!claimResult) return routerAbStepUpError(409, "authorized_operation_missing", "Authorized operation is unavailable");
-	if ("status" in claimResult) return claimResult;
-	return {
-		operation: claimResult.operation,
-		session: authenticated.session,
-		admissionKind: claimResult.kind
-	};
-}
-async function authorizeRouterAbEcdsaDerivationNormalSigningRoute(input) {
-	let requestedAuthorizationKind;
-	try {
-		requestedAuthorizationKind = parseRouterAbEcdsaOperationStepUpRequest({
-			phase: input.phase,
-			body: input.body
-		}).authorization.kind;
-	} catch (error) {
-		return {
-			ok: false,
-			result: routerAbStepUpError(400, "invalid_body", errorMessage(error))
-		};
-	}
-	if (requestedAuthorizationKind === "operation_step_up") {
-		const stepUp = await handleRouterAbEcdsaOperationStepUpRoute({
-			body: input.body,
-			headers: input.headers,
-			authorizedOperations: input.authorizedOperations,
-			authorizationSessions: input.authorizationSessions,
-			admissionAdapter: input.admissionAdapter,
-			resolveEcdsaMaterialActivation: input.resolveEcdsaMaterialActivation,
-			phase: input.phase
-		});
-		if ("status" in stepUp) return {
-			ok: false,
-			result: stepUp
-		};
-		return {
-			ok: true,
-			kind: "operation_step_up",
-			phase: input.phase,
-			operation: stepUp.operation,
-			session: stepUp.session,
-			admissionKind: stepUp.admissionKind
-		};
-	}
-	const validated = await validateRouterAbEcdsaDerivationWalletSessionInputs({
-		headers: input.headers,
-		authorizationSessions: input.authorizationSessions,
-		operationKind: "evm.sign_transaction"
-	});
-	if (!validated.ok) {
-		if (validated.code === "wallet_session_unavailable" && input.authorizationSessions) {
-			const exhaustedCandidate = await resolveRouterAbEcdsaExhaustedCandidateAuthorization({
-				phase: input.phase,
-				body: input.body,
-				headers: input.headers,
-				authorizationSessions: input.authorizationSessions,
-				admissionAdapter: input.admissionAdapter,
-				resolveEcdsaMaterialActivation: input.resolveEcdsaMaterialActivation
-			});
-			if (exhaustedCandidate) return exhaustedCandidate;
-		}
-		const stepUp = await resolveRouterAbEcdsaOwnerOperationStepUpPreparation({
-			body: input.body,
-			phase: input.phase,
-			resolveEcdsaMaterialActivation: input.resolveEcdsaMaterialActivation
-		});
-		return {
-			ok: false,
-			result: routerAbEcdsaOwnerOperationFailureResult({
-				status: routerAbWalletSessionValidationStatus(validated.code),
-				code: validated.code,
-				message: validated.message,
-				phase: input.phase,
-				stepUp
-			})
-		};
-	}
-	const session = validated.admission.context.authorization.session;
-	const authorized = await authorizeRouterAbEcdsaWalletSessionRequest({
-		phase: input.phase,
-		body: input.body,
-		session,
-		admittedMaterialActivation: routerAbMpcMaterialActivationRefToWire(validated.admission.admission.materialActivation),
-		admissionAdapter: input.admissionAdapter,
-		resolveEcdsaMaterialActivation: input.resolveEcdsaMaterialActivation
-	});
-	if (!authorized.ok) return authorized;
-	return {
-		ok: true,
-		kind: "wallet_session_operation_credential_v1",
-		validated,
-		admission: authorized.admission,
-		activeMaterial: authorized.activeMaterial
-	};
-}
-async function handleRouterAbEcdsaDerivationNormalSigningRouteCore(input) {
-	const authorization = await authorizeRouterAbEcdsaDerivationNormalSigningRoute(input);
-	if (!authorization.ok) return authorization.result;
-	if (authorization.kind === "operation_step_up") return routerAbStepUpError(500, "internal", "Operation step-up must execute through the MPC router");
-	const walletSession = authorization.kind === "wallet_session_operation_credential_v1" ? authorization.validated.admission.context.authorization.session : authorization.candidate.status.session;
-	const privateBody = await buildRouterAbEcdsaDerivationPrivateSigningWorkerBody({
-		phase: input.phase,
-		body: input.body,
-		authorization: {
-			kind: "wallet_session_operation_credential_v1",
-			walletSessionId: String(walletSession.walletSessionId),
-			principalId: String(walletSession.principalId),
-			runtimePolicyScope: authorization.activeMaterial.runtimePolicyScope
-		},
-		headers: input.headers
-	});
-	if (!input.authorizedOperations) return routerAbStepUpError(501, "not_configured", "Reusable Wallet Session authorization is not configured");
-	const claimed = await admitRouterAbEcdsaReusableWalletSessionOperation({
-		request: input.phase === "prepare" ? parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1(input.body) : parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1(input.body),
-		materialActivation: authorization.admission.materialActivation,
-		binding: authorization.kind === "wallet_session_operation_credential_v1" ? {
-			kind: "wallet_session_operation_credential_v1",
-			context: authorization.validated.admission.context
-		} : {
-			kind: "wallet_session_operation_credential_exhausted_candidate_v1",
-			candidate: authorization.candidate
-		},
-		authorizedOperations: input.authorizedOperations,
-		resolveEcdsaMaterialActivation: input.resolveEcdsaMaterialActivation
-	});
-	if (!claimed.ok) return claimed.error;
-	if (claimed.admission.kind === "replayed") return routerAbEcdsaReplayResult(claimed.admission.operation);
-	const runtime = input.runtime;
-	if (!runtime) return routerAbEcdsaPrivateSigningWorkerUnavailableResult();
-	const signingWorker = runtime.getSigningWorkerPrivateTransport();
-	if (signingWorker.kind === "unconfigured") return routerAbEcdsaPrivateSigningWorkerUnavailableResult();
-	if (input.phase === "prepare") {
-		if (claimed.admission.kind === "operation_in_progress") return routerAbEcdsaOperationInProgressResult();
-		const operation = claimed.admission.operation;
-		const replay = await runtime.reservePrepareReplay({
-			curve: "ecdsa",
-			authorizationIdentity: {
-				kind: "reusable_wallet_session",
-				walletSessionId: String(walletSession.walletSessionId)
-			},
-			requestId: authorization.admission.requestId,
-			expiresAtMs: authorization.admission.expiresAtMs
-		});
-		if (!replay.ok) {
-			await completeRouterAbEcdsaOperation({
-				authorizedOperations: input.authorizedOperations,
-				operation,
-				result: "failed_before_side_effect",
-				response: {
-					status: replay.status,
-					contentType: "application/json",
-					bodyText: JSON.stringify({
-						ok: false,
-						code: replay.code,
-						message: replay.message
-					})
-				}
-			});
-			return {
-				status: replay.status,
-				body: {
-					ok: false,
-					code: replay.code,
-					message: replay.message
-				}
-			};
-		}
-		const forwarded = await postRouterAbSigningWorkerJson({
-			config: signingWorker,
-			path: input.privatePath,
-			body: privateBody
-		});
-		if (!forwarded.ok && !isRouterAbEcdsaSigningWorkerOperationInProgress(forwarded)) await completeRouterAbEcdsaOperation({
-			authorizedOperations: input.authorizedOperations,
-			operation,
-			result: forwarded.status < 500 ? "failed_before_side_effect" : "failed_after_side_effect",
-			response: replayResponseFromSigningWorkerResult(forwarded)
-		});
-		return forwarded.ok ? {
-			status: 200,
-			body: forwarded.body
-		} : {
-			status: forwarded.status,
-			body: forwarded.body
-		};
-	}
-	if (claimed.admission.kind === "claimed") return routerAbStepUpError(409, "authorized_operation_missing", "ECDSA finalize requires a claimed prepare operation");
-	const forwarded = await postRouterAbSigningWorkerJson({
-		config: signingWorker,
-		path: input.privatePath,
-		body: privateBody
-	});
-	await completeRouterAbEcdsaOperation({
-		authorizedOperations: input.authorizedOperations,
-		operation: claimed.admission.operation,
-		result: forwarded.ok ? "succeeded" : forwarded.status < 500 ? "failed_before_side_effect" : "failed_after_side_effect",
-		response: replayResponseFromSigningWorkerResult(forwarded)
-	});
-	return forwarded.ok ? {
-		status: 200,
-		body: forwarded.body
-	} : {
-		status: forwarded.status,
-		body: forwarded.body
-	};
 }
 async function postRouterAbSigningWorkerJson(input) {
 	const fetchImpl = resolveRouterAbSigningWorkerFetch(input.config.fetchImpl);
@@ -2641,6 +544,6 @@ async function postRouterAbSigningWorkerJson(input) {
 	};
 }
 //#endregion
-export { ROUTER_AB_ECDSA_DERIVATION_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_PRIVATE_SIGNING_PATHS, admitRouterAbEcdsaReusableWalletSessionOperation, authenticateRouterAbEcdsaOperationStepUp, authenticateRouterAbWalletOperationStepUp, authenticateRouterAbWalletOperationStepUpIdentity, authorizeRouterAbEcdsaDerivationNormalSigningRoute, authorizeRouterAbEd25519NormalSigningRoute, buildRouterAbEcdsaAcceptedAuthorizedOperationV1, buildRouterAbEcdsaDerivationPrivateSigningWorkerBody, buildRouterAbEcdsaOwnerOperationStepUpPreparation, buildRouterAbEd25519AcceptedAuthorizedOperationV1, buildRouterAbEd25519OwnerOperationStepUpPreparation, buildRouterAbEd25519PrivateSigningWorkerBody, claimRouterAbEcdsaOperationStepUp, completeRouterAbEcdsaOperation, computeRouterAbEd25519NormalSigningAdmissionMaterial, decideRouterAbEcdsaOwnerOperationAuthorization, decideRouterAbEd25519OwnerOperationAuthorization, evaluateRouterAbNormalSigningAdmission, handleRouterAbEcdsaDerivationNormalSigningRouteCore, parseRouterAbEd25519NormalSigningScopeV2, parseRouterAbEd25519OperationStepUpScope, parseRouterAbOperationStepUpOperation, postRouterAbSigningWorkerJson, resolveFreshRouterAbEcdsaMaterialActivation, routerAbEcdsaAtomicAuthorizationConfigured, routerAbEcdsaOperationInProgressResult, routerAbEcdsaOwnerOperationFailureResult, routerAbEcdsaRecordedResponse, routerAbEcdsaReplayHttpResponse, routerAbEcdsaReplayResult, routerAbEcdsaReplayUnavailableResult, routerAbEd25519OwnerOperationFailureResult, routerAbNormalSigningMaterialSourceFromActiveLaneV1 };
+export { ROUTER_AB_ECDSA_DERIVATION_PRIVATE_SIGNING_PATHS, ROUTER_AB_ED25519_PRIVATE_SIGNING_PATHS, buildRouterAbEcdsaDerivationPrivateSigningWorkerBody, buildRouterAbEd25519PrivateSigningWorkerBody, computeRouterAbEd25519NormalSigningAdmissionMaterial, isRouterAbEcdsaSigningWorkerOperationInProgress, parseRouterAbEd25519NormalSigningScopeV2, postRouterAbSigningWorkerJson, replayResponseFromSigningWorkerResult, requirePrivateSigningDigest, routerAbNormalSigningMaterialSourceFromActiveLaneV1 };
 
 //# sourceMappingURL=routerAbPrivateSigningWorker.js.map