@seams/wallet-server 0.6.1 → 0.7.1

package/dist/esm/router/transport/fetch/routes/sessions.js

@@ -1,20 +1,20 @@
 import { parseOrgId, parseProviderSubject, parseWalletAuthMethodId, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseMpcWalletSigningQuotaId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { base58Encode } from "../../../../shared-ts/src/utils/base58.js";
-import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
-import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
+import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1, parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1, parseRouterAbEcdsaPostRegistrationSessionActivationResponseV1, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { parseHostedWalletSeamsSessionExchangeCode, parseHostedWalletSeamsSessionExchangeNonce, parsePrimaryWalletSessionOperationCredentialToken, parseSessionOrigin, projectExactWalletSessionAuthorizationV1 } from "../../../../authorization/domain.js";
+import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { json, readJson } from "../../../framework/http.js";
 import { extractBearerCredential, resolveSourceIpFromFetchHeaders } from "../../../auth/routerApiKeyAuth.js";
 import { routerApiEmailOtpRouteService } from "../../../framework/authServicePort.js";
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_EXPORT_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { emailOtpStatusCode, hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_EXPORT_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { emitRouterApiWebhookEvent } from "../../../framework/routerApiWebhooks.js";
 import { parseWalletEmailOtpLoginOperation } from "../../../domains/emailOtp/emailOtpRequestValidation.js";
 import { handleWalletUnlockChallengeRoute, handleWalletUnlockVerifyRoute } from "../../../domains/walletUnlock/walletUnlockRouteHandlers.js";

package/dist/esm/router/transport/fetch/routes/syncAccount.js

@@ -1,13 +1,11 @@
 import { parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseAuthFactorId, parsePrincipalId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
-import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
-import "../../../../shared-ts/src/utils/encoders.js";
-import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
+import { sha256Utf8DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseSessionOrigin, parseVerifiedOwnerProofId } from "../../../../authorization/domain.js";
 import { buildVerifiedWalletSessionPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
+import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { json, readJson } from "../../../framework/http.js";
 import { parseSyncAccountOptionsRequest, parseSyncAccountVerifyRequest } from "../../../domains/syncAccount/syncAccountRequestValidation.js";
 import { DEFAULT_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
@@ -120,7 +118,7 @@ async function handleSyncAccount(ctx) {
 					audience: origin,
 					factorId: factorId.value,
 					credentialIdB64u: credentialId.value,
-					assertionDigest: parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(parsed.request)))),
+					assertionDigest: await sha256Utf8DigestB64u(alphabetizeStringify(parsed.request)),
 					verifiedAtMs: issuedAtMs,
 					expiresAtMs
 				})

package/dist/esm/router/transport/fetch/routes/syncAccountBootstrap.js

@@ -1,10 +1,10 @@
 import { mpcMaterialActivationRefsEqual, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parsePrincipalId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
-import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
-import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
+import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1, parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { projectActiveWalletSession } from "../../../../authorization/domain.js";
+import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { handleStrictEcdsaSessionActivation } from "./thresholdEcdsa.js";
 import { authorWalletUnlockEcdsaRequest } from "./sessions.js";
 import { DEFAULT_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";

package/dist/esm/router/transport/fetch/routes/thresholdEcdsa.js

@@ -1,26 +1,27 @@
 import { parseEmailOtpChallengeId, parseOrgId, parseProviderSubject, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { EVM_ECDSA_MPC_OPERATION_KINDS, buildEvmEcdsaMpcOperationRef, parseAuthFactorId, parseAuthorizationAuditEventId, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parseEcdsaAuthorizationSessionId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { buildCapabilityOperationEnvelope } from "../../../../shared-ts/src/authorization/operationFingerprint.js";
 import "../../../../shared-ts/src/utils/encoders.js";
-import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1, ROUTER_AB_ECDSA_DERIVATION_REFRESH_PATH, computeRouterAbEcdsaOperationStepUpChallengeB64u, parseRouterAbEcdsaDerivationActivationRefreshCommitRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1, parseRouterAbEcdsaDerivationExplicitExportRequestV1, parseRouterAbEcdsaOperationStepUpAuthorizationRequestV1, parseRouterAbEcdsaPostRegistrationSessionActivationRequestV1, parseRouterAbEcdsaPrepareSourceV1, sameRouterAbEcdsaDerivationNormalSigningScopeV1, sameRouterAbEcdsaDerivationPublicCapabilityV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { buildWalletSessionCapabilitySubjectsV1, projectActiveWalletSession } from "../../../../authorization/domain.js";
 import { buildVerifiedWalletOperationEmailOtpFactorResult, buildVerifiedWalletOperationPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
+import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { WALLET_SESSION_FAILURE_CODES } from "../../../../shared-ts/src/utils/walletSessionFailure.js";
 import { json, readJson } from "../../../framework/http.js";
 import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
 import { walletSessionFailure, walletSessionFailureStatus } from "../../../auth/walletSessionFailure.js";
 import { resolveWalletSessionOperationCredentialAdmission, validateEcdsaPreprocessingSession } from "../../../auth/commonRouterUtils.js";
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { thresholdEcdsaStatusCode } from "../../../../threshold/statusCodes.js";
 import { parseEcdsaServerTiming } from "../../../../shared-ts/src/utils/ecdsaServerTiming.js";
-import { admitRouterAbEcdsaReusableWalletSessionOperation, authenticateRouterAbEcdsaOperationStepUp, authenticateRouterAbWalletOperationStepUpIdentity, authorizeRouterAbEcdsaDerivationNormalSigningRoute, buildRouterAbEcdsaOwnerOperationStepUpPreparation, claimRouterAbEcdsaOperationStepUp, completeRouterAbEcdsaOperation, decideRouterAbEcdsaOwnerOperationAuthorization, resolveFreshRouterAbEcdsaMaterialActivation, routerAbEcdsaAtomicAuthorizationConfigured, routerAbEcdsaOperationInProgressResult, routerAbEcdsaOwnerOperationFailureResult, routerAbEcdsaReplayHttpResponse, routerAbEcdsaReplayUnavailableResult } from "../../../domains/signingOperations/routerAbPrivateSigningWorker.js";
+import { authenticateRouterAbWalletOperationStepUpIdentity } from "../../../domains/signingOperations/routerAbOperationStepUp.js";
+import { admitRouterAbEcdsaReusableWalletSessionOperation, authenticateRouterAbEcdsaOperationStepUp, authorizeRouterAbEcdsaDerivationNormalSigningRoute, buildRouterAbEcdsaOwnerOperationStepUpPreparation, claimRouterAbEcdsaOperationStepUp, completeRouterAbEcdsaOperation, decideRouterAbEcdsaOwnerOperationAuthorization, resolveFreshRouterAbEcdsaMaterialActivation, routerAbEcdsaAtomicAuthorizationConfigured, routerAbEcdsaOperationInProgressResult, routerAbEcdsaOwnerOperationFailureResult, routerAbEcdsaReplayHttpResponse, routerAbEcdsaReplayUnavailableResult } from "../../../domains/signingOperations/routerAbEcdsaDerivationNormalSigningRoute.js";
 import { parseRouterAbEcdsaDerivationPoolFillInitRouteRequest, parseRouterAbEcdsaDerivationPoolFillStepRouteRequest } from "../../../domains/ecdsa/thresholdEcdsaRequestValidation.js";
 import { resolveWalletAuthMethodIdForAuthority } from "../../../../core/signingLanes/WalletExecutionLaneProjection.js";
 import { proxyNormalSigningRequestToMpcRouter, proxyOwnerLaneAdmittedNormalSigningRequest } from "./normalSigningRouterProxy.js";
@@ -41,6 +42,39 @@ function requireAuthorizationValue(result) {
 	if (!result.ok) throw new Error(result.error.message);
 	return result.value;
 }
+/**
+* The Router binding for a verified step-up: the wallet it signs for and the
+* Console project environment of the store that claimed the operation, so
+* the SigningWorker reaches the wallet's own storage.
+*/
+async function ecdsaOperationStepUpBinding(ctx, session, operation) {
+	const scope = session.runtimePolicyScope;
+	const pinned = await readPinnedEcdsaStepUpWalletScope(ctx, session, operation);
+	return {
+		kind: "operation_step_up",
+		authorizationSessionId: session.sessionId,
+		orgId: scope.orgId,
+		projectId: scope.projectId,
+		environment: scope.envId,
+		projectEnvironmentId: pinned.projectEnvironmentId,
+		subjectId: session.principalId,
+		accountId: session.walletId
+	};
+}
+async function readPinnedEcdsaStepUpWalletScope(ctx, session, operation) {
+	const walletId = parseWalletId(session.walletId);
+	if (!walletId.ok) throw new Error("ECDSA step-up wallet identity is invalid");
+	const pinned = await ctx.service.authorizedOperations.readPinnedOwnerWalletScope({
+		operation,
+		walletId: walletId.value
+	});
+	const scope = session.runtimePolicyScope;
+	if (pinned.orgId !== scope.orgId || pinned.projectId !== scope.projectId) throw new Error("Step-up wallet scope differs from the Wallet Session scope");
+	return {
+		...pinned,
+		walletId: session.walletId
+	};
+}
 function buildRouterAbEcdsaAuthorizedOperationWire(input) {
 	const operation = input.operation;
 	const operationRef = operation.operation.operation;
@@ -84,6 +118,7 @@ function buildRouterAbEcdsaAuthorizedOperationWire(input) {
 					org_id: input.binding.orgId,
 					project_id: input.binding.projectId,
 					environment: input.binding.environment,
+					project_environment_id: input.binding.projectEnvironmentId,
 					signing_worker_id: input.binding.signingWorkerId,
 					expires_at_ms: input.binding.expiresAtMs
 				},
@@ -101,7 +136,9 @@ function buildRouterAbEcdsaAuthorizedOperationWire(input) {
 					org_id: input.binding.orgId,
 					project_id: input.binding.projectId,
 					environment: input.binding.environment,
-					subject_id: input.binding.subjectId
+					project_environment_id: input.binding.projectEnvironmentId,
+					subject_id: input.binding.subjectId,
+					account_id: input.binding.accountId
 				},
 				authorized_operation: {
 					kind: "verified_step_up_authorized_operation_v1",
@@ -147,16 +184,16 @@ async function executeRouterAbEcdsaDerivationNormalSigningRoute(input, timing) {
 	if (input.phase === "finalize" && rawSource !== void 0) return json({
 		ok: false,
 		code: "invalid_body",
-		message: "Finalize cannot carry a presign batch"
+		message: "Finalize cannot carry a presign source"
 	}, { status: 400 });
-	let source = { kind: "available_pool" };
 	if (input.phase === "prepare") try {
-		source = parseRouterAbEcdsaPrepareSourceV1(rawSource, parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1(signingBody));
+		parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1(signingBody);
+		parseRouterAbEcdsaPrepareSourceV1(rawSource);
 	} catch {
 		return json({
 			ok: false,
 			code: "invalid_body",
-			message: "Invalid signing prepare request or final batch"
+			message: "Invalid signing prepare request or source"
 		}, { status: 400 });
 	}
 	input = {
@@ -196,14 +233,7 @@ async function executeRouterAbEcdsaDerivationNormalSigningRoute(input, timing) {
 		authorizedOperation = decision.operation;
 		authorizedOperationWire = buildRouterAbEcdsaAuthorizedOperationWire({
 			operation: authorizedOperation,
-			binding: {
-				kind: "operation_step_up",
-				authorizationSessionId: authorization.session.sessionId,
-				orgId: authorization.session.runtimePolicyScope.orgId,
-				projectId: authorization.session.runtimePolicyScope.projectId,
-				environment: authorization.session.runtimePolicyScope.envId,
-				subjectId: authorization.session.principalId
-			}
+			binding: await ecdsaOperationStepUpBinding(input.ctx, authorization.session, authorizedOperation)
 		});
 	} else {
 		const operation = await admitRouterAbEcdsaReusableWalletSessionOperation({
@@ -276,6 +306,8 @@ async function executeRouterAbEcdsaDerivationNormalSigningRoute(input, timing) {
 		authorizedOperation = operation.admission.operation;
 		const session = authorization.kind === "wallet_session_operation_credential_v1" ? authorization.validated.admission.context.authorization.session : authorization.candidate.status.session;
 		const runtimePolicyScope = authorization.activeMaterial.runtimePolicyScope;
+		const pinnedOwnerScope = operation.admission.ownerScope;
+		if (pinnedOwnerScope.orgId !== runtimePolicyScope.orgId || pinnedOwnerScope.projectId !== runtimePolicyScope.projectId) throw new Error("Pinned ECDSA owner Wallet Session scope differs from active material");
 		authorizedOperationWire = buildRouterAbEcdsaAuthorizedOperationWire({
 			operation: authorizedOperation,
 			binding: {
@@ -289,6 +321,7 @@ async function executeRouterAbEcdsaDerivationNormalSigningRoute(input, timing) {
 				orgId: runtimePolicyScope.orgId,
 				projectId: runtimePolicyScope.projectId,
 				environment: runtimePolicyScope.envId,
+				projectEnvironmentId: pinnedOwnerScope.projectEnvironmentId,
 				signingWorkerId: authorization.activeMaterial.materialActivation.signing_worker,
 				expiresAtMs: session.expiresAtMs
 			}
@@ -308,8 +341,7 @@ async function executeRouterAbEcdsaDerivationNormalSigningRoute(input, timing) {
 	};
 	const admittedBody = {
 		...input.body,
-		authorized_operation: authorizedOperationWire,
-		...source.kind === "final_presign_batch" ? { presign_source: source } : {}
+		authorized_operation: authorizedOperationWire
 	};
 	const proxyStartedAt = performance.now();
 	const upstream = authorization.kind === "wallet_session_operation_credential_v1" || authorization.kind === "wallet_session_operation_credential_exhausted_candidate_v1" ? await proxyNormalSigningRequestToMpcRouter({
@@ -898,7 +930,7 @@ async function authorizeEcdsaPoolFillOperationStepUp(input) {
 		}
 	};
 	const admissionStartedAt = performance.now();
-	const claimFailure = await claimRouterAbEcdsaOperationStepUp({
+	const claim = await claimRouterAbEcdsaOperationStepUp({
 		operationKind: "evm.sign_transaction",
 		operation: input.operation,
 		materialActivation: freshMaterial.materialActivation,
@@ -906,10 +938,22 @@ async function authorizeEcdsaPoolFillOperationStepUp(input) {
 		authenticated
 	});
 	input.timing.admit = performance.now() - admissionStartedAt;
-	if (claimFailure && "status" in claimFailure) return {
+	if (claim && "status" in claim) return {
 		ok: false,
-		error: claimFailure
+		error: claim
+	};
+	if (!claim) return {
+		ok: false,
+		error: {
+			status: 409,
+			body: {
+				ok: false,
+				code: "authorized_operation_missing",
+				message: "ECDSA pool-fill step-up operation is unavailable"
+			}
+		}
 	};
+	const ownerWalletScope = await readPinnedEcdsaStepUpWalletScope(input.ctx, authenticated.session, claim.operation);
 	const walletId = parseWalletId(input.operation.wallet_id);
 	if (!walletId.ok) return {
 		ok: false,
@@ -935,6 +979,7 @@ async function authorizeEcdsaPoolFillOperationStepUp(input) {
 				kind: "operation_step_up",
 				materialExpiresAtMs: input.operation.expires_at_ms
 			},
+			ownerWalletScope,
 			routerAbEcdsaDerivationNormalSigning: {
 				kind: ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1,
 				scope: input.operation.normal_signing_scope
@@ -1012,6 +1057,7 @@ async function authorizeEcdsaPoolFill(input) {
 					participantIds: activeMaterial.participantIds,
 					thresholdExpiresAtMs: session.expiresAtMs,
 					authorization: { kind: "wallet_session" },
+					ownerWalletScope: validated.ownerWalletScope,
 					routerAbEcdsaDerivationNormalSigning: normalSigning
 				}
 			};
@@ -1782,6 +1828,6 @@ async function handleThresholdEcdsa(ctx) {
 	return null;
 }
 //#endregion
-export { authorizeEcdsaPoolFill, authorizeStrictEcdsaSessionActivationFromOperationCredential, decideRouterAbEcdsaOperationStepUpExecution, finishRouterAbEcdsaSigningResponse, handleStrictEcdsaSessionActivation, handleThresholdEcdsa, resolveV2EcdsaCustodySigner };
+export { authorizeEcdsaPoolFill, finishRouterAbEcdsaSigningResponse, handleStrictEcdsaSessionActivation, handleThresholdEcdsa };
 
 //# sourceMappingURL=thresholdEcdsa.js.map

package/dist/esm/router/transport/fetch/routes/thresholdEd25519.js

@@ -1,27 +1,29 @@
 import { parseEmailOtpChallengeId, parseOrgId, parseProviderSubject, parseWalletId, parseWebAuthnCredentialIdB64u } from "../../../../shared-ts/src/utils/domainIds.js";
 import { buildAuthorizationGrantRef, buildNearEd25519MpcOperationRef, parseAuthFactorId, parseAuthorizationAuditEventId, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parsePrincipalId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { buildCapabilityOperationEnvelope, computeCapabilityOperationFingerprintDigest, parseCapabilityOperationFingerprintDigest, parseSigningOperationFingerprintDigest } from "../../../../shared-ts/src/authorization/operationFingerprint.js";
 import "../../../../shared-ts/src/utils/encoders.js";
-import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
-import { sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
+import { sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { isPasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { authorizedOperationReplayBodyInit, parseSessionOrigin, parseVerifiedOwnerProofId } from "../../../../authorization/domain.js";
 import { buildVerifiedWalletOperationEmailOtpFactorResult, buildVerifiedWalletOperationPasskeyFactorResult, buildVerifiedWalletSessionPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
 import { ROUTER_AB_ED25519_NORMAL_SIGNING_PATH, ROUTER_AB_ED25519_NORMAL_SIGNING_PREPARE_PATH, ROUTER_AB_ED25519_WALLET_SESSION_PATH } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 import { normalizeCorsOrigin } from "../../../../core/SessionService.js";
+import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { json, readJson } from "../../../framework/http.js";
 import { resolveThresholdRuntimePolicyScope } from "../../../auth/commonRouterUtils.js";
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { emailOtpStatusCode, hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { thresholdEd25519StatusCode } from "../../../../threshold/statusCodes.js";
-import { parseEd25519ReusableAuthorizedOperationReceipt, parseEd25519VerifiedStepUpAuthorizedOperationReceipt, requireEd25519OperationKind } from "../../../domains/signingOperations/ed25519AuthorizedOperationReceipt.js";
-import { authenticateRouterAbWalletOperationStepUpIdentity, authorizeRouterAbEd25519NormalSigningRoute, buildRouterAbEd25519OwnerOperationStepUpPreparation, buildRouterAbEd25519PrivateSigningWorkerBody, decideRouterAbEd25519OwnerOperationAuthorization, parseRouterAbEd25519OperationStepUpScope, parseRouterAbOperationStepUpOperation, routerAbEd25519OwnerOperationFailureResult } from "../../../domains/signingOperations/routerAbPrivateSigningWorker.js";
+import { authenticateRouterAbWalletOperationStepUpIdentity } from "../../../domains/signingOperations/routerAbOperationStepUp.js";
+import { buildRouterAbEd25519PrivateSigningWorkerBody } from "../../../domains/signingOperations/routerAbPrivateSigningWorker.js";
 import { proxyNormalSigningRequestToMpcRouter, proxyOwnerLaneAdmittedNormalSigningRequest } from "./normalSigningRouterProxy.js";
 import { sealEmailOtpFactorSecretForWorker } from "../../../domains/emailOtp/emailOtpRouteHandlers.js";
+import { parseEd25519ReusableAuthorizedOperationReceipt, parseEd25519VerifiedStepUpAuthorizedOperationReceipt, requireEd25519OperationKind } from "../../../domains/signingOperations/ed25519AuthorizedOperationReceipt.js";
+import { authorizeRouterAbEd25519NormalSigningRoute, buildRouterAbEd25519OwnerOperationStepUpPreparation, decideRouterAbEd25519OwnerOperationAuthorization, parseRouterAbEd25519OperationStepUpScope, parseRouterAbOperationStepUpOperation, routerAbEd25519OwnerOperationFailureResult } from "../../../domains/signingOperations/routerAbEd25519NormalSigningRoute.js";
 import { parseThresholdEd25519OperationStepUpGrantRequest, parseThresholdEd25519SessionRouteRequest } from "../../../domains/ed25519Yao/session/thresholdEd25519RequestValidation.js";
 //#region src/router/transport/fetch/routes/thresholdEd25519.ts
 async function resolveActiveEd25519OperationStepUpAuthority(walletAuthMethods, proof) {
@@ -54,7 +56,7 @@ function ed25519ReusableWalletSessionIdentity(authorization) {
 		quotaId: session.quotaId
 	};
 }
-function buildEd25519GatewayOwnerWalletSessionBinding(authorization) {
+function buildEd25519GatewayOwnerWalletSessionBinding(authorization, projectEnvironmentId) {
 	const session = ed25519ReusableWalletSession(authorization);
 	const runtimePolicyScope = authorization.activeMaterial.runtimePolicyScope;
 	return {
@@ -68,10 +70,44 @@ function buildEd25519GatewayOwnerWalletSessionBinding(authorization) {
 		orgId: runtimePolicyScope.orgId,
 		projectId: runtimePolicyScope.projectId,
 		environment: runtimePolicyScope.envId,
+		projectEnvironmentId,
 		signingWorkerId: authorization.activeMaterial.signingWorkerId,
 		expiresAtMs: session.expiresAtMs
 	};
 }
+async function readPinnedEd25519WalletProjectEnvironmentId(ctx, authorization, operation) {
+	const session = ed25519ReusableWalletSession(authorization);
+	const scope = authorization.activeMaterial.runtimePolicyScope;
+	const pinned = await ctx.service.authorizedOperations.readPinnedOwnerWalletScope({
+		operation,
+		walletId: session.walletId
+	});
+	if (pinned.orgId !== scope.orgId || pinned.projectId !== scope.projectId) throw new Error("Pinned owner Wallet Session scope differs from active material");
+	return pinned.projectEnvironmentId;
+}
+/**
+* The Router binding for a verified step-up: the wallet it signs for and the
+* Console project environment of the store that claimed the operation, so
+* the SigningWorker reaches the wallet's own storage.
+*/
+async function ed25519OperationStepUpBinding(ctx, session, operation) {
+	const scope = session.runtimePolicyScope;
+	const pinned = await ctx.service.authorizedOperations.readPinnedOwnerWalletScope({
+		operation,
+		walletId: requireAuthorizationValue(parseWalletId(session.walletId))
+	});
+	if (pinned.orgId !== scope.orgId || pinned.projectId !== scope.projectId) throw new Error("Step-up wallet scope differs from the Wallet Session scope");
+	return {
+		kind: "operation_step_up",
+		authorizationSessionId: session.sessionId,
+		orgId: scope.orgId,
+		projectId: scope.projectId,
+		environment: scope.envId,
+		projectEnvironmentId: pinned.projectEnvironmentId,
+		subjectId: session.principalId,
+		accountId: session.walletId
+	};
+}
 function buildRouterAbEd25519AuthorizedOperationWire(input) {
 	const operation = input.operation;
 	const operationRef = operation.operation.operation;
@@ -116,6 +152,7 @@ function buildRouterAbEd25519AuthorizedOperationWire(input) {
 					org_id: input.binding.orgId,
 					project_id: input.binding.projectId,
 					environment: input.binding.environment,
+					project_environment_id: input.binding.projectEnvironmentId,
 					signing_worker_id: input.binding.signingWorkerId,
 					expires_at_ms: input.binding.expiresAtMs
 				},
@@ -133,7 +170,9 @@ function buildRouterAbEd25519AuthorizedOperationWire(input) {
 					org_id: input.binding.orgId,
 					project_id: input.binding.projectId,
 					environment: input.binding.environment,
-					subject_id: input.binding.subjectId
+					project_environment_id: input.binding.projectEnvironmentId,
+					subject_id: input.binding.subjectId,
+					account_id: input.binding.accountId
 				},
 				authorized_operation: {
 					kind: "verified_step_up_authorized_operation_v1",
@@ -1020,14 +1059,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 					...input.body,
 					authorized_operation: buildRouterAbEd25519AuthorizedOperationWire({
 						operation: execution.operation,
-						binding: {
-							kind: "operation_step_up",
-							authorizationSessionId: authorization.session.sessionId,
-							orgId: authorization.session.runtimePolicyScope.orgId,
-							projectId: authorization.session.runtimePolicyScope.projectId,
-							environment: authorization.session.runtimePolicyScope.envId,
-							subjectId: authorization.session.principalId
-						}
+						binding: await ed25519OperationStepUpBinding(input.ctx, authorization.session, execution.operation)
 					})
 				}
 			});
@@ -1077,14 +1109,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 				...input.body,
 				authorized_operation: buildRouterAbEd25519AuthorizedOperationWire({
 					operation: validatedAuthorization.operation,
-					binding: {
-						kind: "operation_step_up",
-						authorizationSessionId: authorization.session.sessionId,
-						orgId: authorization.session.runtimePolicyScope.orgId,
-						projectId: authorization.session.runtimePolicyScope.projectId,
-						environment: authorization.session.runtimePolicyScope.envId,
-						subjectId: authorization.session.principalId
-					}
+					binding: await ed25519OperationStepUpBinding(input.ctx, authorization.session, validatedAuthorization.operation)
 				})
 			}
 		});
@@ -1138,7 +1163,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 				...input.body,
 				authorized_operation: buildRouterAbEd25519AuthorizedOperationWire({
 					operation: execution.operation,
-					binding: { ...buildEd25519GatewayOwnerWalletSessionBinding(authorization) }
+					binding: { ...buildEd25519GatewayOwnerWalletSessionBinding(authorization, await readPinnedEd25519WalletProjectEnvironmentId(input.ctx, authorization, execution.operation)) }
 				})
 			}
 		});
@@ -1187,7 +1212,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 			...input.body,
 			authorized_operation: buildRouterAbEd25519AuthorizedOperationWire({
 				operation: validatedAuthorization.operation,
-				binding: { ...buildEd25519GatewayOwnerWalletSessionBinding(authorization) }
+				binding: { ...buildEd25519GatewayOwnerWalletSessionBinding(authorization, await readPinnedEd25519WalletProjectEnvironmentId(input.ctx, authorization, validatedAuthorization.operation)) }
 			})
 		}
 	});
@@ -1316,6 +1341,6 @@ function sameThresholdEd25519RuntimePolicyScopeV1(left, right) {
 	return left.orgId === right.orgId && left.projectId === right.projectId && left.envId === right.envId && left.signingRootVersion === right.signingRootVersion;
 }
 //#endregion
-export { buildEd25519ReplayResponse, decideEd25519NormalSigningExecution, decideEd25519OperationStepUpExecution, handleThresholdEd25519, isRouterAbEd25519OperationInProgressResponse, replayCompletedEd25519Operation, requireCompletedEd25519OperationResponse };
+export { handleThresholdEd25519 };
 
 //# sourceMappingURL=thresholdEd25519.js.map

package/dist/esm/shared-ts/src/authorization/capabilityKinds.js

@@ -219,6 +219,6 @@ function invalidResult(message) {
 	};
 }
 //#endregion
-export { AUTHORIZATION_EVIDENCE_KINDS, AUTHORIZATION_GRANT_KINDS, CAPABILITY_KINDS, EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS, VAULT_OPERATION_KINDS, buildAuthorizationEvidenceRequirement, buildAuthorizationGrantRef, buildEvmEcdsaMpcOperationRef, buildNearEd25519MpcOperationRef, buildVaultOperationRef, isAuthorizationEvidenceKind, isCapabilityKind, parseAuthFactorId, parseAuthorizationAuditEventId, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseAuthorizationGrantRef, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parseCapabilityOperationRef, parseDeviceId, parseEcdsaAuthorizationSessionId, parseHostedWalletSessionExchangeCodeId, parseMpcWalletSigningQuotaId, parsePrincipalId, parseTenantId, parseVaultId, parseVaultItemId, parseWalletSessionAuthorizationId, parseWalletSessionId, parseWalletSessionMintId };
+export { AUTHORIZATION_EVIDENCE_KINDS, CAPABILITY_KINDS, EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS, VAULT_OPERATION_KINDS, buildAuthorizationEvidenceRequirement, buildAuthorizationGrantRef, buildEvmEcdsaMpcOperationRef, buildNearEd25519MpcOperationRef, buildVaultOperationRef, isAuthorizationEvidenceKind, parseAuthFactorId, parseAuthorizationAuditEventId, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseAuthorizationGrantRef, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parseCapabilityOperationRef, parseDeviceId, parseEcdsaAuthorizationSessionId, parseHostedWalletSessionExchangeCodeId, parseMpcWalletSigningQuotaId, parsePrincipalId, parseTenantId, parseVaultId, parseVaultItemId, parseWalletSessionAuthorizationId, parseWalletSessionId, parseWalletSessionMintId };
 
 //# sourceMappingURL=capabilityKinds.js.map

package/dist/esm/shared-ts/src/authorization/delegatedAuthority.js

@@ -129,6 +129,6 @@ function invalidAuthorityResult(message) {
 	};
 }
 //#endregion
-export { FULL_OWNER_PERMISSIONS, buildDelegatedWalletAuthorityV1, buildFullOwnerDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, delegatedWalletPermissionNamesV1, hasDelegatedWalletPermissionV1, isDelegatedWalletPermissionV1, parseDelegatedWalletAuthorityV1, parseDelegatedWalletPermissionSetV1, sameDelegatedWalletAuthorityV1, validateDelegatedWalletAuthorityAttenuationV1 };
+export { buildDelegatedWalletAuthorityV1, buildFullOwnerDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, delegatedWalletPermissionNamesV1, hasDelegatedWalletPermissionV1, parseDelegatedWalletAuthorityV1, parseDelegatedWalletPermissionSetV1, sameDelegatedWalletAuthorityV1, validateDelegatedWalletAuthorityAttenuationV1 };
 
 //# sourceMappingURL=delegatedAuthority.js.map

package/dist/esm/shared-ts/src/authorization/operationFingerprint.js

@@ -1,7 +1,6 @@
-import "./capabilityKinds.js";
 import { base64UrlEncode } from "../utils/base64.js";
-import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../utils/digests.js";
+import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
 //#region ../shared-ts/src/authorization/operationFingerprint.ts
 const CAPABILITY_OPERATION_FINGERPRINT_DOMAIN_V1 = "seams:authorization:capability-operation-fingerprint:v1";
 var CapabilityOperationEnvelopeProof = class {