@seams/wallet-server 0.7.1 → 0.8.0

package/dist/esm/router/express.js

@@ -38,6 +38,15 @@ function normalizeLogger(logger) {
 //#region src/router/framework/logger.ts
 const coerceRouterLogger = normalizeLogger;
 //#endregion
+//#region ../shared-ts/src/utils/failure.ts
+function failure(code, message) {
+	return {
+		ok: false,
+		code,
+		message
+	};
+}
+//#endregion
 //#region src/core/SessionService.ts
 function normalizeParsedCorsOrigin(url) {
 	const host = url.hostname.toLowerCase();
@@ -81,6 +90,21 @@ function buildCorsOrigins(...inputs) {
 }
 //#endregion
 //#region ../shared-ts/src/device-linking/contracts.ts
+function isLinkSessionTerminalFailureV1(state) {
+	switch (state.state) {
+		case "failed_before_commit":
+		case "cancelled":
+		case "expired": return true;
+		case "displaying_qr":
+		case "claimed":
+		case "awaiting_target_factor":
+		case "awaiting_source_contribution":
+		case "provisioning":
+		case "authority_pending_local_install":
+		case "active": return false;
+		default: return assertNeverLinkSessionStateV1(state);
+	}
+}
 function assertNeverLinkSessionStateV1(value) {
 	throw new Error(`[LinkSessionStateV1] unsupported state: ${String(value)}`);
 }
@@ -389,112 +413,6 @@ function toRorOriginOrNull(value) {
 	}
 }
 //#endregion
-//#region ../shared-ts/src/utils/base58.ts
-/**
-* Encodes binary data to base58 string using Bitcoin's base58 alphabet.
-*
-* @param data - Binary data to encode (Uint8Array, ArrayBuffer, or number[])
-* @returns Base58-encoded string
-*/
-const base58Encode = (data) => {
-	if (data instanceof ArrayBuffer) return bs58.encode(new Uint8Array(data));
-	if (Array.isArray(data)) return bs58.encode(new Uint8Array(data));
-	return bs58.encode(data);
-};
-/**
-* Decodes a base58 string to binary data using Bitcoin's base58 alphabet.
-* Returns a Uint8Array containing the decoded bytes.
-*
-* @param base58String - Base58-encoded string to decode
-* @returns Uint8Array containing the decoded bytes
-* @throws Error if input contains invalid base58 characters
-*/
-const base58Decode = (base58String) => {
-	return bs58.decode(base58String);
-};
-//#endregion
-//#region ../shared-ts/src/utils/near.ts
-/**
-* NEAR-specific utility helpers.
-*
-* Keep chain-specific parsing and validation logic here so generic utility
-* modules (`validation`, `errors`, `encoders`, etc.) stay chain-agnostic.
-*/
-/**
-* Ensure a key string has the NEAR Ed25519 prefix (`ed25519:`).
-*
-* - Accepts either `ed25519:<base58>` or a bare `<base58>` string.
-* - Canonicalizes `ED25519:` -> `ed25519:`.
-* - If a different prefix is present (e.g. `secp256k1:`), returns the input unchanged.
-*/
-function ensureEd25519Prefix(value) {
-	const raw = String(value ?? "").trim();
-	if (!raw) return "";
-	if (/^[a-z0-9_]+:/i.test(raw)) {
-		if (/^ed25519:/i.test(raw)) return `ed25519:${raw.replace(/^ed25519:/i, "")}`;
-		return raw;
-	}
-	return `ed25519:${raw}`;
-}
-/**
-* Lightweight NEAR account ID validation used by server-side helpers.
-* - length: 2..64
-* - chars: lowercase letters, digits, `_`, `.`, `-`
-*/
-function isValidAccountId(accountId) {
-	if (typeof accountId !== "string") return false;
-	if (!accountId || accountId.length < 2 || accountId.length > 64) return false;
-	return /^[a-z0-9_.-]+$/.test(accountId);
-}
-function isImplicitNearAccountId(value) {
-	return typeof value === "string" && /^[0-9a-f]{64}$/.test(value);
-}
-function parseImplicitNearAccountId(raw) {
-	const value = typeof raw === "string" ? raw.trim() : "";
-	if (!value) return {
-		ok: false,
-		code: "missing",
-		message: "implicit NEAR account ID is required"
-	};
-	if (!isImplicitNearAccountId(value)) return {
-		ok: false,
-		code: "invalid",
-		message: "implicit NEAR account ID must be 64 lowercase hex characters"
-	};
-	return {
-		ok: true,
-		value
-	};
-}
-function parseNamedNearAccountId(raw) {
-	const value = typeof raw === "string" ? raw.trim() : "";
-	if (!value) return {
-		ok: false,
-		code: "missing",
-		message: "named NEAR account ID is required"
-	};
-	if (isImplicitNearAccountId(value) || !isValidAccountId(value) || !value.includes(".")) return {
-		ok: false,
-		code: "invalid",
-		message: "named NEAR account ID must be a valid named account containing a dot"
-	};
-	return {
-		ok: true,
-		value
-	};
-}
-function bytesToLowerHex(bytes) {
-	return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
-}
-function deriveImplicitNearAccountIdFromEd25519PublicKey(publicKey) {
-	const normalized = ensureEd25519Prefix(publicKey);
-	const encoded = normalized.startsWith("ed25519:") ? normalized.slice(8) : "";
-	if (!encoded) throw new Error("Ed25519 public key is required");
-	const decoded = base58Decode(encoded);
-	if (decoded.length !== 32) throw new Error("Ed25519 public key must decode to 32 bytes");
-	return bytesToLowerHex(decoded);
-}
-//#endregion
 //#region ../shared-ts/src/utils/validation.ts
 function requireTrimmedString(value, label, message = "is required") {
 	const parsed = normalizeOptionalTrimmedString(value);
@@ -984,6 +902,10 @@ function requireCanonicalBase64Url(value, label) {
 	if (base64UrlEncode(decoded) !== value) throw new Error(`${label} must be canonical base64url`);
 	return decoded;
 }
+function requireParsed$2(result, label) {
+	if (result.ok) return result.value;
+	throw new Error(`${label} ${result.error.message}`);
+}
 function parseDigestField$2(value, label) {
 	try {
 		return parseDigestB64u(value);
@@ -1204,11 +1126,11 @@ function parseLinkedDeviceEd25519ExportRootRecipientV1(raw) {
 	requireTransferAlg(record.transferAlg, "LinkedDeviceEd25519ExportRootRecipientV1.transferAlg");
 	return {
 		kind: "linked_device_ed25519_export_root_recipient_v1",
-		linkSessionId: parseRequired(parseLinkDeviceSessionId(record.linkSessionId), "LinkedDeviceEd25519ExportRootRecipientV1.linkSessionId"),
-		walletId: parseRequired(parseWalletId(record.walletId), "walletId"),
-		walletKeyId: parseRequired(parseWalletKeyId(record.walletKeyId), "walletKeyId"),
-		enrollmentId: parseRequired(parseLinkedDeviceEnrollmentId(record.enrollmentId), "enrollmentId"),
-		deviceId: parseRequired(parseLinkedDeviceId(record.deviceId), "deviceId"),
+		linkSessionId: requireParsed$2(parseLinkDeviceSessionId(record.linkSessionId), "LinkedDeviceEd25519ExportRootRecipientV1.linkSessionId"),
+		walletId: requireParsed$2(parseWalletId(record.walletId), "walletId"),
+		walletKeyId: requireParsed$2(parseWalletKeyId(record.walletKeyId), "walletKeyId"),
+		enrollmentId: requireParsed$2(parseLinkedDeviceEnrollmentId(record.enrollmentId), "enrollmentId"),
+		deviceId: requireParsed$2(parseLinkedDeviceId(record.deviceId), "deviceId"),
 		transferAlg: LINKED_DEVICE_ED25519_EXPORT_ROOT_TRANSFER_ALG_V1,
 		applicationBindingDigestB64u: parseDigestField$2(record.applicationBindingDigestB64u, "applicationBindingDigestB64u"),
 		registeredPublicKeyB64u: parseEd25519PublicKeyB64u(record.registeredPublicKeyB64u, "registeredPublicKeyB64u"),
@@ -1227,11 +1149,11 @@ function parseLinkedDeviceEd25519ExportRootPackageV1(raw) {
 	if (recipientPublicKeyB64u === ephemeralPublicKeyB64u) throw new Error("ephemeralPublicKeyB64u repeats the recipient key");
 	return {
 		kind: "linked_device_ed25519_export_root_package_v1",
-		linkSessionId: parseRequired(parseLinkDeviceSessionId(record.linkSessionId), "linkSessionId"),
-		walletId: parseRequired(parseWalletId(record.walletId), "walletId"),
-		walletKeyId: parseRequired(parseWalletKeyId(record.walletKeyId), "walletKeyId"),
-		enrollmentId: parseRequired(parseLinkedDeviceEnrollmentId(record.enrollmentId), "enrollmentId"),
-		deviceId: parseRequired(parseLinkedDeviceId(record.deviceId), "deviceId"),
+		linkSessionId: requireParsed$2(parseLinkDeviceSessionId(record.linkSessionId), "linkSessionId"),
+		walletId: requireParsed$2(parseWalletId(record.walletId), "walletId"),
+		walletKeyId: requireParsed$2(parseWalletKeyId(record.walletKeyId), "walletKeyId"),
+		enrollmentId: requireParsed$2(parseLinkedDeviceEnrollmentId(record.enrollmentId), "enrollmentId"),
+		deviceId: requireParsed$2(parseLinkedDeviceId(record.deviceId), "deviceId"),
 		transferAlg: LINKED_DEVICE_ED25519_EXPORT_ROOT_TRANSFER_ALG_V1,
 		applicationBindingDigestB64u: parseDigestField$2(record.applicationBindingDigestB64u, "applicationBindingDigestB64u"),
 		registeredPublicKeyB64u: parseEd25519PublicKeyB64u(record.registeredPublicKeyB64u, "registeredPublicKeyB64u"),
@@ -1251,7 +1173,7 @@ function parseLinkedDeviceEd25519ExportRootSubmissionV1(raw) {
 	if (record.kind !== "linked_device_ed25519_export_root_submission_v1") throw new Error("LinkedDeviceEd25519ExportRootSubmissionV1.kind is invalid");
 	return {
 		kind: "linked_device_ed25519_export_root_submission_v1",
-		linkSessionId: parseRequired(parseLinkDeviceSessionId(record.linkSessionId), "linkSessionId"),
+		linkSessionId: requireParsed$2(parseLinkDeviceSessionId(record.linkSessionId), "linkSessionId"),
 		package: parseLinkedDeviceEd25519ExportRootPackageV1(record.package)
 	};
 }
@@ -1279,10 +1201,6 @@ function parseUnixMs(value, label) {
 	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive unix-millisecond timestamp`);
 	return value;
 }
-function parseRequired(parsed, label) {
-	if (!parsed.ok) throw new Error(`${label} ${parsed.error.message}`);
-	return parsed.value;
-}
 //#endregion
 //#region ../shared-ts/src/device-linking/delegatedActivationPlan.ts
 const MANIFEST_FIELDS = [
@@ -1406,10 +1324,6 @@ function exactRecord$2(raw, fields, label) {
 	for (const field of fields) if (!(field in record)) throw new Error(`${label}.${field} is required`);
 	return record;
 }
-function requireParsed$2(parsed, label) {
-	if (!parsed.ok) throw new Error(`${label} ${parsed.error.message}`);
-	return parsed.value;
-}
 //#endregion
 //#region ../shared-ts/src/utils/addAuthMethodRegistration.ts
 /**
@@ -3874,7 +3788,7 @@ function parseLinkedDeviceEd25519SourcePreservingReservationV1(raw) {
 	const participantIds = parseRouterAbEd25519YaoParticipantIdsV1(record.participant_ids);
 	const deriverA = parseEd25519ClientPackage(record.deriver_a_client_package, "deriver_a");
 	const deriverB = parseEd25519ClientPackage(record.deriver_b_client_package, "deriver_b");
-	if (!sameBytes(activationReceipt.transcript, deriverA.transcript) || !sameBytes(activationReceipt.transcript, deriverB.transcript)) throw new Error("linked-device Ed25519 reservation packages have mismatched transcripts");
+	if (!sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, deriverA.transcript) || !sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, deriverB.transcript)) throw new Error("linked-device Ed25519 reservation packages have mismatched transcripts");
 	return {
 		state: "inactive",
 		reservationId: requireText(record.reservation_id, "reservation_id"),
@@ -4033,10 +3947,10 @@ function parseEd25519Contribution(record) {
 	if (!sameEdStableIdentity(sourceBinding, targetBinding)) throw new Error("linked-device Ed25519 source contribution stable identity differs");
 	if (!mpcMaterialActivationRefsEqual(routerAbMpcMaterialActivationRefFromWire(activationReceipt.material_activation), targetMaterialActivation)) throw new Error("linked-device Ed25519 source contribution receipt activation differs");
 	const sourceRegisteredPublicKeyB64u = parseEd25519PublicKeyB64u(record.sourceRegisteredPublicKeyB64u, "sourceRegisteredPublicKeyB64u");
-	if (!sameBytes(activationReceipt.registered_public_key, Array.from(base64UrlDecode(sourceRegisteredPublicKeyB64u)))) throw new Error("linked-device Ed25519 source contribution receipt public key differs");
+	if (!sameRouterAbEd25519YaoByteSequence(activationReceipt.registered_public_key, Array.from(base64UrlDecode(sourceRegisteredPublicKeyB64u)))) throw new Error("linked-device Ed25519 source contribution receipt public key differs");
 	const deriverA = parseEd25519ClientPackage(record.deriver_a_client_package, "deriver_a");
 	const deriverB = parseEd25519ClientPackage(record.deriver_b_client_package, "deriver_b");
-	if (!sameBytes(activationReceipt.transcript, deriverA.transcript) || !sameBytes(activationReceipt.transcript, deriverB.transcript)) throw new Error("linked-device Ed25519 source contribution package transcript differs");
+	if (!sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, deriverA.transcript) || !sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, deriverB.transcript)) throw new Error("linked-device Ed25519 source contribution package transcript differs");
 	if (sourceBinding.material_activation.activation_id === targetMaterialActivation.activationId) throw new Error("linked-device Ed25519 source contribution reuses the source activation");
 	return {
 		kind: "linked_device_ed25519_source_contribution_v1",
@@ -4316,9 +4230,6 @@ function parseFixedBase64(raw, byteLength, label) {
 	if (decoded.length !== byteLength || base64UrlEncode(decoded) !== raw) throw new Error(`${label} must decode to ${byteLength} bytes`);
 	return raw;
 }
-function sameBytes(left, right) {
-	return left.length === right.length && left.every((value, index) => value === right[index]);
-}
 function requireText(raw, label) {
 	if (typeof raw !== "string" || raw.length === 0 || raw.trim() !== raw || [...raw].some((character) => {
 		const code = character.charCodeAt(0);
@@ -5414,11 +5325,15 @@ function createRouterAbTraceContextV1() {
 	};
 }
 //#endregion
+//#region ../shared-ts/src/utils/walletManagementProtocol.ts
+const WALLET_MANAGEMENT_PROTOCOL_HEADER = "X-Seams-Wallet-Protocol";
+//#endregion
 //#region src/router/framework/http.ts
 const CORS_ALLOW_METHODS = "GET,POST,PUT,PATCH,DELETE,OPTIONS";
 const CORS_PREFLIGHT_MAX_AGE_SECONDS = 600;
 const CORS_ALLOW_HEADERS = [
 	"Content-Type",
+	WALLET_MANAGEMENT_PROTOCOL_HEADER,
 	"Authorization",
 	"X-Seams-Benchmark-Diagnostics",
 	LINKED_DEVICE_REQUEST_PROOF_HEADER_V1,
@@ -5441,6 +5356,9 @@ function json$1(body, init, extraHeaders) {
 		headers
 	});
 }
+function jsonFailure(status, code, message) {
+	return json$1(failure(code, message), { status });
+}
 function withCors(headers, opts, request) {
 	const pathname = request ? new URL(request.url).pathname : "";
 	if (pathname === "/healthz" || pathname === "/readyz") {
@@ -5479,6 +5397,13 @@ async function readJson(request) {
 		return null;
 	}
 }
+function headersToRecord(headers) {
+	const out = {};
+	headers.forEach((v, k) => {
+		out[k] = v;
+	});
+	return out;
+}
 //#endregion
 //#region src/router/transport/fetch/routes/health.ts
 async function handleHealth(ctx) {
@@ -5517,6 +5442,11 @@ async function handleReady(ctx) {
 	}
 }
 //#endregion
+//#region ../shared-ts/src/utils/registrationSetupOperation.ts
+function parseRegistrationSetupOperationId(value) {
+	return typeof value === "string" && /^wreg_[A-Za-z0-9_-]{43}$/u.test(value) ? value : null;
+}
+//#endregion
 //#region src/router/auth/routerApiKeyAuth.ts
 function readHeader(headers, name) {
 	if (headers instanceof Headers) return String(headers.get(name) || "").trim();
@@ -5611,6 +5541,12 @@ async function resolvePublishableKeyApiCredentialAuth(input) {
 	};
 }
 //#endregion
+//#region ../shared-ts/src/utils/thresholdEcdsaChainTarget.ts
+function thresholdEcdsaChainTargetKey(target) {
+	if (target.kind === "evm") return `evm:eip155:${target.chainId}`;
+	return `tempo:${target.chainId}`;
+}
+//#endregion
 //#region src/core/thresholdEcdsaChainTarget.ts
 function positiveSafeInteger(value) {
 	return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : null;
@@ -5671,11 +5607,7 @@ function walletSessionFailureStatus(code) {
 	}
 }
 function walletSessionFailure(code) {
-	return {
-		ok: false,
-		code,
-		message: walletSessionFailureMessage(code)
-	};
+	return failure(code, walletSessionFailureMessage(code));
 }
 //#endregion
 //#region ../shared-ts/src/signing-lanes/participants.ts
@@ -5715,22 +5647,6 @@ function parseLaneParticipantBindingDigestB64u(raw) {
 	return parseDigest(raw, "participantBindingDigestB64u", brandParticipantDigest);
 }
 //#endregion
-//#region ../shared-ts/src/utils/registrationIds.ts
-function walletIdFromString(value) {
-	const parsed = parseWalletId(value);
-	if (!parsed.ok) throw new Error(parsed.error.message);
-	return parsed.value;
-}
-function nearEd25519SigningKeyIdFromString(value) {
-	const normalized = String(value || "").trim();
-	if (!normalized) throw new Error("nearEd25519SigningKeyId is required");
-	return normalized;
-}
-function parseNearEd25519SigningKeyId(value) {
-	if (typeof value !== "string") throw new Error("nearEd25519SigningKeyId must be a string");
-	return nearEd25519SigningKeyIdFromString(value);
-}
-//#endregion
 //#region ../shared-ts/src/signing-lanes/participantDigest.ts
 function u32(value) {
 	if (!Number.isInteger(value) || value < 0 || value > 4294967295) throw new Error("canonical u32 must be an integer between 0 and 4294967295");
@@ -5761,6 +5677,17 @@ function encodeLaneCanonicalU64V1(value) {
 	return output;
 }
 //#endregion
+//#region ../shared-ts/src/signing-lanes/execution.ts
+function buildPreparedOwnerWalletExecution(input) {
+	return {
+		kind: "prepared_owner_wallet_execution",
+		laneKind: input.lane.laneKind,
+		authorization: input.authorization,
+		materialActivation: input.materialActivation,
+		lane: input.lane
+	};
+}
+//#endregion
 //#region ../shared-ts/src/signing-lanes/ownerContinuity.ts
 const OWNER_LANE_PARTICIPANT_BINDING_DOMAIN_V1 = "seams/rotatable-signing-lanes/owner-lane-participant-continuity/v1";
 const OWNER_LANE_PARTICIPANT_CONTINUITY_FIELDS = [
@@ -5771,10 +5698,6 @@ const OWNER_LANE_PARTICIPANT_CONTINUITY_FIELDS = [
 	"custodyKeyManifestDigestB64u",
 	"sourceIdentityDigestB64u"
 ];
-function requireResult(result, label) {
-	if (result.ok) return result.value;
-	throw new Error(`${label} ${result.error.message}`);
-}
 /** Parse the owner signer identity without widening it into a generic string. */
 function parseWalletSignerId(raw, label = "walletSignerId") {
 	if (typeof raw !== "string") throw new Error(`${label} must be a string`);
@@ -5800,7 +5723,7 @@ function buildOwnerLaneParticipantContinuityV1(args) {
 		kind: "owner_lane_participant_continuity_v1",
 		signerId: parseWalletSignerId(args.signerId),
 		participantIds,
-		signingWorkerId: requireResult(parseMpcSigningWorkerRef(args.signingWorkerId), "signingWorkerId"),
+		signingWorkerId: requireParsed$2(parseMpcSigningWorkerRef(args.signingWorkerId), "signingWorkerId"),
 		custodyKeyManifestDigestB64u: parseDigestField$2(args.custodyKeyManifestDigestB64u, "custodyKeyManifestDigestB64u"),
 		sourceIdentityDigestB64u: parseDigestField$2(args.sourceIdentityDigestB64u, "sourceIdentityDigestB64u")
 	};
@@ -5812,7 +5735,7 @@ function parseOwnerLaneParticipantContinuityV1(raw, label = "ownerParticipantCon
 	return buildOwnerLaneParticipantContinuityV1({
 		signerId: parseWalletSignerId(record.signerId, `${label}.signerId`),
 		participantIds: parseParticipantIds$1(record.participantIds, `${label}.participantIds`),
-		signingWorkerId: requireResult(parseMpcSigningWorkerRef(record.signingWorkerId), `${label}.signingWorkerId`),
+		signingWorkerId: requireParsed$2(parseMpcSigningWorkerRef(record.signingWorkerId), `${label}.signingWorkerId`),
 		custodyKeyManifestDigestB64u: parseDigestField$2(record.custodyKeyManifestDigestB64u, `${label}.custodyKeyManifestDigestB64u`),
 		sourceIdentityDigestB64u: parseDigestField$2(record.sourceIdentityDigestB64u, `${label}.sourceIdentityDigestB64u`)
 	});
@@ -5830,19 +5753,7 @@ function ownerLaneParticipantContinuityCanonicalBytesV1(input) {
 	]);
 }
 async function computeOwnerLaneParticipantBindingDigestV1(input) {
-	return requireResult(parseLaneParticipantBindingDigestB64u(base64UrlEncode(await sha256Bytes(ownerLaneParticipantContinuityCanonicalBytesV1(input)))), "owner participant digest");
-}
-new TextEncoder();
-//#endregion
-//#region ../shared-ts/src/signing-lanes/execution.ts
-function buildPreparedOwnerWalletExecution(input) {
-	return {
-		kind: "prepared_owner_wallet_execution",
-		laneKind: input.lane.laneKind,
-		authorization: input.authorization,
-		materialActivation: input.materialActivation,
-		lane: input.lane
-	};
+	return requireParsed$2(parseLaneParticipantBindingDigestB64u(base64UrlEncode(await sha256Bytes(ownerLaneParticipantContinuityCanonicalBytesV1(input)))), "owner participant digest");
 }
 //#endregion
 //#region ../shared-ts/src/authorization/operationFingerprint.ts
@@ -5896,6 +5807,30 @@ function parseSigningOperationFingerprintDigest(value) {
 	return parseDigestB64u(value.slice(7));
 }
 //#endregion
+//#region ../shared-ts/src/utils/base58.ts
+/**
+* Encodes binary data to base58 string using Bitcoin's base58 alphabet.
+*
+* @param data - Binary data to encode (Uint8Array, ArrayBuffer, or number[])
+* @returns Base58-encoded string
+*/
+const base58Encode = (data) => {
+	if (data instanceof ArrayBuffer) return bs58.encode(new Uint8Array(data));
+	if (Array.isArray(data)) return bs58.encode(new Uint8Array(data));
+	return bs58.encode(data);
+};
+/**
+* Decodes a base58 string to binary data using Bitcoin's base58 alphabet.
+* Returns a Uint8Array containing the decoded bytes.
+*
+* @param base58String - Base58-encoded string to decode
+* @returns Uint8Array containing the decoded bytes
+* @throws Error if input contains invalid base58 characters
+*/
+const base58Decode = (base58String) => {
+	return bs58.decode(base58String);
+};
+//#endregion
 //#region src/authorization/domain.ts
 /**
 * The digest-free authorization projection published to the browser. It carries
@@ -6134,8 +6069,7 @@ function resolveWalletSessionAuthorizationV2AdministrationAdmission(input) {
 			if (!subject || subject.authorityId !== input.authority.authorityId) return admissionRefused("capability_subject_mismatch");
 			return {
 				ok: true,
-				operationKind: "link_devices",
-				authorityId: input.authority.authorityId
+				operationKind: "link_devices"
 			};
 		}
 		default: return assertNeverWalletSessionAuthorizationV2AdministrationOperation(input.operation.kind);
@@ -6225,7 +6159,7 @@ async function prepareOwnerWalletExecution(input) {
 	if (lane.walletKeyId !== input.evidence.walletKey.walletKeyId) return refused("wallet_key_mismatch");
 	if (!operationMatchesWalletKey(input.authorizedOperation, input.evidence.walletKey)) return refused("curve_mismatch");
 	if (String(claimedOperation.operation.capabilityId) !== String(input.evidence.materialActivation.capability)) return refused("capability_mismatch");
-	if (!sameMaterialActivation(input.evidence.materialActivation, input.evidence.expectedMaterialActivation)) return refused("material_activation_mismatch");
+	if (!mpcMaterialActivationRefsEqual(input.evidence.materialActivation, input.evidence.expectedMaterialActivation)) return refused("material_activation_mismatch");
 	if (lane.participantBindingDigestB64u !== input.evidence.verifiedLaneParticipantBindingDigestB64u || String(lane.ownerParticipantContinuity.signingWorkerId) !== String(input.evidence.materialActivation.signingWorker)) return refused("participant_binding_mismatch");
 	if (await computeOwnerLaneParticipantBindingDigestV1(lane.ownerParticipantContinuity) !== lane.participantBindingDigestB64u) return refused("participant_binding_mismatch");
 	if (lane.lifecycle.activationReceiptDigestB64u !== input.evidence.verifiedActivationReceiptDigestB64u) return refused("activation_receipt_mismatch");
@@ -6273,9 +6207,6 @@ function operationMatchesWalletKey(operation, walletKey) {
 		case "ecdsa_secp256k1": return operation.operation.operation.capabilityKind === CAPABILITY_KINDS.evmEcdsaMpcSigning;
 	}
 }
-function sameMaterialActivation(left, right) {
-	return left.activationId === right.activationId && left.capability === right.capability && left.materialOwner === right.materialOwner && left.keyBinding === right.keyBinding && left.lifecycleBinding === right.lifecycleBinding && left.signingWorker === right.signingWorker;
-}
 function refused(reason) {
 	return {
 		kind: "refused",
@@ -6472,32 +6403,46 @@ async function validateRouterAbEcdsaDerivationWalletSessionInputs(input) {
 	const token = extractBearerCredential(input.headers);
 	if (!token) return walletSessionFailure("wallet_session_missing");
 	const nowMs = input.nowMs || Date.now;
-	let resolution;
+	let candidate;
 	try {
-		resolution = await resolveWalletSessionOperationCredentialAdmission({
-			authorizationSessions,
+		candidate = await authorizationSessions.readWalletSessionSigningCandidateByOperationCredential({
+			tenantId: authorizationSessions.tenantId,
 			token,
 			nowMs: nowMs(),
-			operation: {
-				keyFamily: "ecdsa_secp256k1",
-				operationKind: input.operationKind
-			}
+			materialActivation: input.materialActivation
 		});
 	} catch {
 		return walletSessionFailure("wallet_session_unavailable");
 	}
-	if (resolution.kind === "rejected") return walletSessionFailure("wallet_session_scope_mismatch");
-	if (resolution.kind === "not_found") return {
+	if (!candidate) return {
 		ok: false,
 		code: "wallet_session_invalid",
 		message: walletSessionFailureMessage("wallet_session_invalid")
 	};
+	if (candidate.kind === "exhausted") return {
+		ok: true,
+		kind: "wallet_session_operation_credential_exhausted_candidate_v1",
+		candidate: candidate.candidate,
+		materialRead: candidate.materialRead,
+		policyRead: candidate.policyRead
+	};
+	const resolution = resolveWalletSessionOperationCredentialAdmissionFromContext({
+		context: candidate.context,
+		nowMs: nowMs(),
+		operation: {
+			keyFamily: "ecdsa_secp256k1",
+			operationKind: input.operationKind
+		}
+	});
+	if (resolution.kind === "rejected") return walletSessionFailure("wallet_session_scope_mismatch");
 	if (resolution.admission.curve !== "ecdsa") return walletSessionFailure("wallet_session_scope_mismatch");
 	return {
 		ok: true,
 		kind: "wallet_session_operation_credential_v1",
 		admission: resolution.admission,
-		context: resolution.admission.context
+		context: resolution.admission.context,
+		materialRead: candidate.materialRead,
+		policyRead: candidate.policyRead
 	};
 }
 async function resolveThresholdRuntimePolicyScope(input) {
@@ -6747,6 +6692,22 @@ function toFetchRouteResponse(response) {
 	});
 }
 //#endregion
+//#region ../shared-ts/src/utils/registrationIds.ts
+function walletIdFromString(value) {
+	const parsed = parseWalletId(value);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+function nearEd25519SigningKeyIdFromString(value) {
+	const normalized = String(value || "").trim();
+	if (!normalized) throw new Error("nearEd25519SigningKeyId is required");
+	return normalized;
+}
+function parseNearEd25519SigningKeyId(value) {
+	if (typeof value !== "string") throw new Error("nearEd25519SigningKeyId must be a string");
+	return nearEd25519SigningKeyIdFromString(value);
+}
+//#endregion
 //#region ../shared-ts/src/passkey-custody/custodySecretBinding.ts
 /** The only derivation scheme owner custody supports. */
 const WALLET_SEED_DERIVATION_SCHEME_V1 = "wallet_seed_parallel_hkdf_sha256_v1";
@@ -7217,9 +7178,6 @@ function parseWalletRegistrationSetupPolicy(value) {
 }
 //#endregion
 //#region ../shared-ts/src/utils/ecdsaKeyFactsInventory.ts
-function chainTargetKey(target) {
-	return target.kind === "evm" ? `evm:eip155:${target.chainId}` : `tempo:${target.chainId}`;
-}
 function normalizeChainTarget(target) {
 	if (target.kind === "evm") return {
 		kind: "evm",
@@ -7237,7 +7195,7 @@ function canonicalizeWalletEcdsaKeyFactsInventoryChallenge(input) {
 	const keyTargets = input.keyTargets.map((target) => ({
 		keyHandle: target.keyHandle,
 		chainTarget: normalizeChainTarget(target.chainTarget),
-		targetKey: chainTargetKey(target.chainTarget)
+		targetKey: thresholdEcdsaChainTargetKey(target.chainTarget)
 	})).sort((left, right) => {
 		const leftKey = `${left.keyHandle}:${left.targetKey}`;
 		const rightKey = `${right.keyHandle}:${right.targetKey}`;
@@ -7256,8 +7214,90 @@ async function computeWalletEcdsaKeyFactsInventoryChallengeDigestB64u(input) {
 	return base64UrlEncode(await sha256BytesUtf8(canonicalizeWalletEcdsaKeyFactsInventoryChallenge(input)));
 }
 //#endregion
-//#region ../shared-ts/src/utils/registrationSignerPlan.ts
-function normalizePositiveInteger(raw, fallback) {
+//#region ../shared-ts/src/utils/near.ts
+/**
+* NEAR-specific utility helpers.
+*
+* Keep chain-specific parsing and validation logic here so generic utility
+* modules (`validation`, `errors`, `encoders`, etc.) stay chain-agnostic.
+*/
+/**
+* Ensure a key string has the NEAR Ed25519 prefix (`ed25519:`).
+*
+* - Accepts either `ed25519:<base58>` or a bare `<base58>` string.
+* - Canonicalizes `ED25519:` -> `ed25519:`.
+* - If a different prefix is present (e.g. `secp256k1:`), returns the input unchanged.
+*/
+function ensureEd25519Prefix(value) {
+	const raw = String(value ?? "").trim();
+	if (!raw) return "";
+	if (/^[a-z0-9_]+:/i.test(raw)) {
+		if (/^ed25519:/i.test(raw)) return `ed25519:${raw.replace(/^ed25519:/i, "")}`;
+		return raw;
+	}
+	return `ed25519:${raw}`;
+}
+/**
+* Lightweight NEAR account ID validation used by server-side helpers.
+* - length: 2..64
+* - chars: lowercase letters, digits, `_`, `.`, `-`
+*/
+function isValidAccountId(accountId) {
+	if (typeof accountId !== "string") return false;
+	if (!accountId || accountId.length < 2 || accountId.length > 64) return false;
+	return /^[a-z0-9_.-]+$/.test(accountId);
+}
+function isImplicitNearAccountId(value) {
+	return typeof value === "string" && /^[0-9a-f]{64}$/.test(value);
+}
+function parseImplicitNearAccountId(raw) {
+	const value = typeof raw === "string" ? raw.trim() : "";
+	if (!value) return {
+		ok: false,
+		code: "missing",
+		message: "implicit NEAR account ID is required"
+	};
+	if (!isImplicitNearAccountId(value)) return {
+		ok: false,
+		code: "invalid",
+		message: "implicit NEAR account ID must be 64 lowercase hex characters"
+	};
+	return {
+		ok: true,
+		value
+	};
+}
+function parseNamedNearAccountId(raw) {
+	const value = typeof raw === "string" ? raw.trim() : "";
+	if (!value) return {
+		ok: false,
+		code: "missing",
+		message: "named NEAR account ID is required"
+	};
+	if (isImplicitNearAccountId(value) || !isValidAccountId(value) || !value.includes(".")) return {
+		ok: false,
+		code: "invalid",
+		message: "named NEAR account ID must be a valid named account containing a dot"
+	};
+	return {
+		ok: true,
+		value
+	};
+}
+function bytesToLowerHex(bytes) {
+	return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function deriveImplicitNearAccountIdFromEd25519PublicKey(publicKey) {
+	const normalized = ensureEd25519Prefix(publicKey);
+	const encoded = normalized.startsWith("ed25519:") ? normalized.slice(8) : "";
+	if (!encoded) throw new Error("Ed25519 public key is required");
+	const decoded = base58Decode(encoded);
+	if (decoded.length !== 32) throw new Error("Ed25519 public key must decode to 32 bytes");
+	return bytesToLowerHex(decoded);
+}
+//#endregion
+//#region ../shared-ts/src/utils/registrationSignerPlan.ts
+function normalizePositiveInteger(raw, fallback) {
 	const value = typeof raw === "number" ? raw : Number(raw);
 	return Number.isFinite(value) && value >= 1 ? Math.floor(value) : fallback;
 }
@@ -7317,11 +7357,8 @@ function registrationSignerBranchKeyFromString(value) {
 function registrationNearEd25519BranchKey(signerSlot) {
 	return registrationSignerBranchKeyFromString(`near_ed25519:slot:${signerSlot}`);
 }
-function registrationEvmFamilyEcdsaTargetKey(target) {
-	return alphabetizeStringify(target);
-}
 function registrationEvmFamilyEcdsaBranchKey(chainTargets) {
-	return registrationSignerBranchKeyFromString(`evm_family_ecdsa:${chainTargets.map(registrationEvmFamilyEcdsaTargetKey).join("|")}`);
+	return registrationSignerBranchKeyFromString(`evm_family_ecdsa:${chainTargets.map(alphabetizeStringify).join("|")}`);
 }
 function registrationSignerPlanFromRequests(signers) {
 	return registrationSignerPlanFromBranches(signers.map(registrationSignerPlanBranchFromRequest));
@@ -7405,7 +7442,7 @@ function findDuplicateRegistrationSignerBranch(branch, branchKeys) {
 }
 function findDuplicateRegistrationEcdsaTarget(branch, ecdsaTargetKeys) {
 	for (const target of branch.chainTargets) {
-		const targetKey = registrationEvmFamilyEcdsaTargetKey(target);
+		const targetKey = alphabetizeStringify(target);
 		if (ecdsaTargetKeys.has(targetKey)) return {
 			ok: false,
 			code: "invalid_body",
@@ -7591,17 +7628,11 @@ function addAuthMethodIntentGrantFromString(value) {
 function addSignerIntentGrantFromString(value) {
 	return String(value || "").trim();
 }
-function serializeAddSignerIntentV1(intent) {
-	return alphabetizeStringify(intent);
-}
-function serializeAddAuthMethodIntentV1(intent) {
-	return alphabetizeStringify(intent);
-}
 async function computeAddSignerIntentDigestB64u(intent) {
-	return base64UrlEncode(await sha256BytesUtf8(serializeAddSignerIntentV1(intent)));
+	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(intent)));
 }
 async function computeAddAuthMethodIntentDigestB64u(intent) {
-	return base64UrlEncode(await sha256BytesUtf8(serializeAddAuthMethodIntentV1(intent)));
+	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(intent)));
 }
 function normalizeAddAuthMethodIntentCaller(raw) {
 	const record = inspectRawObject(raw);
@@ -7932,6 +7963,12 @@ function parseWalletRegistrationSetupWallet(raw) {
 	};
 }
 function parseWalletRegistrationSetupRequest(body) {
+	const registrationOperationId = parseRegistrationSetupOperationId(body.registrationOperationId);
+	if (!registrationOperationId) return {
+		ok: false,
+		code: "invalid_body",
+		message: "registrationOperationId is required"
+	};
 	const signerSelection = parseRegistrationSignerSet(body.signerSelection);
 	if (!signerSelection.ok) return signerSelection;
 	const authMethod = normalizeRegistrationAuthMethodInput(body.authMethod);
@@ -7945,6 +7982,7 @@ function parseWalletRegistrationSetupRequest(body) {
 	return {
 		ok: true,
 		value: {
+			registrationOperationId,
 			...wallet.value ? { wallet: wallet.value } : {},
 			signerSelection: signerSelection.value.selection,
 			authMethod
@@ -9162,14 +9200,6 @@ async function handleRouterApiWalletAddSignerIntent(input) {
 	});
 	return routeJson(result.ok ? 200 : 400, result);
 }
-/**
-* `POST /wallets/register/setup` — the single admitted entry point that
-* replaces the bootstrap grant, the intent, and start.
-*
-* Authentication is the same API-credential plane the intent route used, so
-* origin and environment binding are unchanged; what is gone is the stored
-* grant that used to sit between the check and its only reader.
-*/
 async function handleRouterApiWalletRegistrationSetup(input) {
 	if (!isPlainObject(input.body)) return routeError(400, "invalid_body", "JSON body required");
 	const origin = normalizeCorsOrigin(input.origin);
@@ -9212,7 +9242,7 @@ async function handleRouterApiWalletRegistrationSetup(input) {
 	if (!session) return routeError(500, "internal", "wallet registration setup requires session signing");
 	const request = parseWalletRegistrationSetupRequest(input.body);
 	if (!request.ok) return routeError(400, request.code, request.message);
-	const result = await input.services.walletRegistration.setupWalletRegistration({
+	return input.services.walletRegistration.setupWalletRegistration({
 		request: request.value,
 		orgId: principal.orgId,
 		expectedOrigin: origin,
@@ -9223,7 +9253,6 @@ async function handleRouterApiWalletRegistrationSetup(input) {
 			signingRootVersion: runtimePolicyScope.signingRootVersion
 		} : {}
 	});
-	return routeJson(result.ok ? 200 : 400, result);
 }
 /**
 * `POST /wallets/register/respond` — the authenticated leg.
@@ -10073,24 +10102,12 @@ function buildSigningSessionSealRemovePath(basePath) {
 }
 function parseSigningSessionSealApplyBody(body) {
 	const obj = asRecord(body);
-	if (!obj) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Request body must be a JSON object"
-	};
+	if (!obj) return failure("invalid_body", "Request body must be a JSON object");
 	const thresholdSessionId = readRequiredString(obj, "thresholdSessionId");
 	const ciphertext = readRequiredString(obj, "ciphertext");
-	if (!thresholdSessionId || !ciphertext) return {
-		ok: false,
-		code: "invalid_body",
-		message: "thresholdSessionId and ciphertext are required"
-	};
+	if (!thresholdSessionId || !ciphertext) return failure("invalid_body", "thresholdSessionId and ciphertext are required");
 	const parsedThresholdSessionId = parseThresholdSessionId(thresholdSessionId);
-	if (!parsedThresholdSessionId.ok) return {
-		ok: false,
-		code: "invalid_body",
-		message: "thresholdSessionId is invalid"
-	};
+	if (!parsedThresholdSessionId.ok) return failure("invalid_body", "thresholdSessionId is invalid");
 	return {
 		ok: true,
 		value: {
@@ -10113,11 +10130,7 @@ async function authorizeSigningSessionSealRequest(args) {
 			thresholdSessionId: args.thresholdSessionId
 		});
 	} catch (error) {
-		return {
-			ok: false,
-			code: "internal",
-			message: error instanceof Error ? error.message : String(error || "Authorization failed")
-		};
+		return failure("internal", error instanceof Error ? error.message : String(error || "Authorization failed"));
 	}
 	return {
 		ok: false,
@@ -10240,7 +10253,6 @@ const ROUTER_API_ECDSA_STRICT_LIFECYCLE_SERVICES = [
 	"session"
 ];
 const ROUTER_API_WEBAUTHN_AUTHENTICATOR_SERVICES = ["webAuthn", "session"];
-const ROUTER_API_NEAR_PUBLIC_KEY_SERVICES = ["nearFunding", "session"];
 const ROUTER_API_PASSKEY_CUSTODY_SERVICES = [
 	"passkeyCustody",
 	"walletAuthMethods",
@@ -10607,7 +10619,7 @@ function createRouterApiRouteDefinitions(options = {}) {
 	}, ROUTER_API_ED25519_WALLET_SESSION_SERVICES), sessionPrincipalRoute("router_ab_ed25519_sign_prepare", "POST", ROUTER_AB_ED25519_NORMAL_SIGNING_PREPARE_PATH, "Prepare Router A/B Ed25519 normal signing", ROUTER_API_NORMAL_SIGNING_PROXY_SERVICES), sessionPrincipalRoute("router_ab_ed25519_sign_finalize", "POST", ROUTER_AB_ED25519_NORMAL_SIGNING_PATH, "Finalize Router A/B Ed25519 normal signing", ROUTER_API_NORMAL_SIGNING_PROXY_SERVICES), publicRoute("router_ab_ecdsa_derivation_healthz", "GET", ROUTER_AB_ECDSA_DERIVATION_HEALTH_PATH, "Router A/B ECDSA derivation health probe", {
 		plane: "public",
 		rationale: "Router A/B health probes are intentionally public diagnostics."
-	}, ROUTER_API_THRESHOLD_RUNTIME_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_export", "POST", ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, "Export authorized Router A/B ECDSA derivation material", ROUTER_API_ECDSA_STRICT_LIFECYCLE_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_refresh", "POST", ROUTER_AB_ECDSA_DERIVATION_REFRESH_PATH, "Refresh Router A/B ECDSA derivation activation", ROUTER_API_ECDSA_STRICT_LIFECYCLE_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_session_activate", "POST", ROUTER_AB_ECDSA_DERIVATION_SESSION_ACTIVATION_PATH, "Activate Router A/B ECDSA normal-signing session", ROUTER_API_THRESHOLD_SESSION_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_sign_prepare", "POST", ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_PREPARE_PATH, "Prepare Router A/B ECDSA derivation normal signing", ROUTER_API_NORMAL_SIGNING_PROXY_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_sign_finalize", "POST", ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_PATH, "Finalize Router A/B ECDSA derivation normal signing", ROUTER_API_NORMAL_SIGNING_PROXY_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_presignature_pool_fill_init", "POST", ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_INIT_PATH, "Begin Router A/B ECDSA derivation presignature pool-fill session", ROUTER_API_THRESHOLD_SESSION_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_presignature_pool_fill_step", "POST", ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_STEP_PATH, "Continue Router A/B ECDSA derivation presignature pool-fill session", ROUTER_API_THRESHOLD_SESSION_SERVICES), sessionPrincipalRoute("webauthn_authenticators", "GET", "/webauthn/authenticators", "List registered WebAuthn authenticators", ROUTER_API_WEBAUTHN_AUTHENTICATOR_SERVICES), sessionPrincipalRoute("near_public_keys", "GET", "/near/public-keys", "List NEAR public keys for current session", ROUTER_API_NEAR_PUBLIC_KEY_SERVICES), publicRoute("wallet_unlock_challenge", "POST", "/wallet/unlock/challenge", "Create wallet unlock challenge", {
+	}, ROUTER_API_THRESHOLD_RUNTIME_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_export", "POST", ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, "Export authorized Router A/B ECDSA derivation material", ROUTER_API_ECDSA_STRICT_LIFECYCLE_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_refresh", "POST", ROUTER_AB_ECDSA_DERIVATION_REFRESH_PATH, "Refresh Router A/B ECDSA derivation activation", ROUTER_API_ECDSA_STRICT_LIFECYCLE_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_session_activate", "POST", ROUTER_AB_ECDSA_DERIVATION_SESSION_ACTIVATION_PATH, "Activate Router A/B ECDSA normal-signing session", ROUTER_API_THRESHOLD_SESSION_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_sign_prepare", "POST", ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_PREPARE_PATH, "Prepare Router A/B ECDSA derivation normal signing", ROUTER_API_NORMAL_SIGNING_PROXY_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_sign_finalize", "POST", ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_PATH, "Finalize Router A/B ECDSA derivation normal signing", ROUTER_API_NORMAL_SIGNING_PROXY_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_presignature_pool_fill_init", "POST", ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_INIT_PATH, "Begin Router A/B ECDSA derivation presignature pool-fill session", ROUTER_API_THRESHOLD_SESSION_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_presignature_pool_fill_step", "POST", ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_STEP_PATH, "Continue Router A/B ECDSA derivation presignature pool-fill session", ROUTER_API_THRESHOLD_SESSION_SERVICES), sessionPrincipalRoute("webauthn_authenticators", "GET", "/webauthn/authenticators", "List registered WebAuthn authenticators", ROUTER_API_WEBAUTHN_AUTHENTICATOR_SERVICES), publicRoute("wallet_unlock_challenge", "POST", "/wallet/unlock/challenge", "Create wallet unlock challenge", {
 		plane: "public",
 		proof: "challenge_exchange",
 		rationale: "Wallet unlock challenge issuance is intentionally public."
@@ -10687,6 +10699,7 @@ function resolveWalletRegistrationRoute(ctx) {
 async function handleWalletRegistration(ctx) {
 	const route = resolveWalletRegistrationRoute(ctx);
 	if (!route) return null;
+	if (ctx.request.headers.get("X-Seams-Wallet-Protocol") !== "2") return jsonFailure(409, "wallet_protocol_mismatch", "Your wallet application needs an update. Reload this page and try again. If the problem continues, ask the application developer to upgrade the Wallet SDK.");
 	const common = {
 		body: await readJson(ctx.request),
 		headers: Object.fromEntries(ctx.request.headers.entries()),
@@ -10982,6 +10995,8 @@ function requireVerificationWindow(verifiedAtMs, expiresAtMs) {
 //#endregion
 //#region ../shared-ts/src/utils/emailOtpDomain.ts
 const EMAIL_OTP_CHANNEL = "email_otp";
+/** Domain label that opens the AAD binding a released Email OTP factor to its challenge. */
+const EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN_V1 = "seams/email-otp/factor-release/v1";
 const WALLET_UNLOCK_BACKENDS = ["passkey", EMAIL_OTP_CHANNEL];
 const WALLET_EMAIL_OTP_LOGIN_OPERATIONS = [
 	"wallet_unlock",
@@ -11753,6 +11768,7 @@ async function handleWalletRecoveryPrepare(ctx) {
 			case "refused": return toFetchRouteResponse(refusedSpend());
 			case "reserved":
 			case "consumed": return routeErrorResponse(401, "recovery_code_used", "that recovery code has already been used");
+			case "routing_unavailable": return routeErrorResponse(503, "wallet_home_unavailable", "Wallet recovery routing is temporarily unavailable");
 			case "manifest_unavailable":
 			case "registration_unavailable": return routeErrorResponse(409, "recovery_preparation_conflict", "wallet recovery could not be prepared");
 		}
@@ -12559,11 +12575,7 @@ async function refreshEmailOtpWalletUnlockSessionState(input) {
 			ok: false,
 			response: {
 				status: 500,
-				body: {
-					ok: false,
-					code: "internal",
-					message: error instanceof Error ? error.message : "Email OTP authority refresh resolution failed"
-				}
+				body: failure("internal", error instanceof Error ? error.message : "Email OTP authority refresh resolution failed")
 			}
 		};
 	}
@@ -12571,11 +12583,7 @@ async function refreshEmailOtpWalletUnlockSessionState(input) {
 		ok: false,
 		response: {
 			status: authorityResolution.code === "internal" ? 500 : 403,
-			body: {
-				ok: false,
-				code: authorityResolution.code,
-				message: authorityResolution.message
-			}
+			body: failure(authorityResolution.code, authorityResolution.message)
 		}
 	};
 	try {
@@ -12592,11 +12600,7 @@ async function refreshEmailOtpWalletUnlockSessionState(input) {
 			ok: false,
 			response: {
 				status: 500,
-				body: {
-					ok: false,
-					code: "internal",
-					message: error instanceof Error ? error.message : "Email OTP Wallet Session authority projection refresh failed"
-				}
+				body: failure("internal", error instanceof Error ? error.message : "Email OTP Wallet Session authority projection refresh failed")
 			}
 		};
 	}
@@ -12607,11 +12611,7 @@ function walletUnlockCustodyUnavailableResponse(lookup, factor) {
 		ok: false,
 		response: {
 			status: lookup.kind === "manifest_unavailable" ? 503 : lookup.kind === "conflict" ? 409 : lookup.kind === "missing" ? 404 : 409,
-			body: {
-				ok: false,
-				code: lookup.kind === "manifest_unavailable" ? "custody_manifest_unavailable" : "custody_envelope_unavailable",
-				message: `${factor} wallet custody is unavailable`
-			}
+			body: failure(lookup.kind === "manifest_unavailable" ? "custody_manifest_unavailable" : "custody_envelope_unavailable", `${factor} wallet custody is unavailable`)
 		}
 	};
 }
@@ -12626,11 +12626,7 @@ function projectEmailOtpCustody(verifiedUnlock, lookup) {
 		ok: false,
 		response: {
 			status: 500,
-			body: {
-				ok: false,
-				code: "custody_binding_mismatch",
-				message: "Email OTP wallet custody binding is invalid"
-			}
+			body: failure("custody_binding_mismatch", "Email OTP wallet custody binding is invalid")
 		}
 	};
 	return {
@@ -12660,11 +12656,7 @@ function projectPasskeyCustody(verifiedUnlock, resolution) {
 		ok: false,
 		response: {
 			status: 500,
-			body: {
-				ok: false,
-				code: "custody_binding_mismatch",
-				message: "Passkey wallet custody binding is invalid"
-			}
+			body: failure("custody_binding_mismatch", "Passkey wallet custody binding is invalid")
 		}
 	};
 	let ed25519 = { kind: "absent" };
@@ -12676,11 +12668,7 @@ function projectPasskeyCustody(verifiedUnlock, resolution) {
 			ok: false,
 			response: {
 				status: 500,
-				body: {
-					ok: false,
-					code: "custody_binding_mismatch",
-					message: "Passkey Ed25519 custody binding is invalid"
-				}
+				body: failure("custody_binding_mismatch", "Passkey Ed25519 custody binding is invalid")
 			}
 		};
 		ed25519 = {
@@ -12711,11 +12699,7 @@ async function provisionFirstEcdsaWalletSession(input) {
 				ok: false,
 				response: {
 					status: 403,
-					body: {
-						ok: false,
-						code: "scope_mismatch",
-						message: "Wallet unlock proof does not match the requested ECDSA wallet"
-					}
+					body: failure("scope_mismatch", "Wallet unlock proof does not match the requested ECDSA wallet")
 				}
 			};
 			const provisioned = await input.context.provisionWalletSession(input.authorization);
@@ -12723,11 +12707,7 @@ async function provisionFirstEcdsaWalletSession(input) {
 				ok: false,
 				response: {
 					status: provisioned.status,
-					body: {
-						ok: false,
-						code: provisioned.code,
-						message: provisioned.message
-					}
+					body: failure(provisioned.code, provisioned.message)
 				}
 			};
 			return {
@@ -12755,11 +12735,7 @@ function walletUnlockScopeMismatchResponse() {
 		ok: false,
 		response: {
 			status: 403,
-			body: {
-				ok: false,
-				code: "scope_mismatch",
-				message: "Email OTP unlock proof does not match the requested Ed25519 wallet"
-			}
+			body: failure("scope_mismatch", "Email OTP unlock proof does not match the requested Ed25519 wallet")
 		}
 	};
 }
@@ -12823,11 +12799,7 @@ function planWalletUnlockAuthorityEcdsaSession(input) {
 function walletUnlockDeviceLinkEcdsaSessionRejection() {
 	return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "ecdsaSessionPolicy is not supported for device-linked wallet unlock"
-		}
+		body: failure("invalid_body", "ecdsaSessionPolicy is not supported for device-linked wallet unlock")
 	};
 }
 function planWalletUnlockPasskeySession(input) {
@@ -12870,11 +12842,7 @@ async function provisionPasskeyEd25519YaoSession(input) {
 		ok: false,
 		response: {
 			status: 409,
-			body: {
-				ok: false,
-				code: "capability_unavailable",
-				message: "Requested Ed25519 Wallet Session is unavailable"
-			}
+			body: failure("capability_unavailable", "Requested Ed25519 Wallet Session is unavailable")
 		}
 	};
 	const provisioned = await input.context.provisionWalletSession({
@@ -12928,11 +12896,7 @@ function walletUnlockEcdsaOperationCredential(input) {
 function walletUnlockEcdsaCredentialUnavailableResponse() {
 	return {
 		status: 409,
-		body: {
-			ok: false,
-			code: "capability_unavailable",
-			message: "ECDSA activation requires the exact Wallet Session operation credential"
-		}
+		body: failure("capability_unavailable", "ECDSA activation requires the exact Wallet Session operation credential")
 	};
 }
 /** The unlock response's Wallet Session, when the unlock holds one. */
@@ -12968,11 +12932,7 @@ function parseWalletUnlockRouteBody(body) {
 		ok: false,
 		response: {
 			status: 400,
-			body: {
-				ok: false,
-				code: "invalid_body",
-				message: "Request body is required"
-			}
+			body: failure("invalid_body", "Request body is required")
 		}
 	};
 	const record = body;
@@ -12981,11 +12941,7 @@ function parseWalletUnlockRouteBody(body) {
 		ok: false,
 		response: {
 			status: 400,
-			body: {
-				ok: false,
-				code: "invalid_body",
-				message: "unlockBackend is required"
-			}
+			body: failure("invalid_body", "unlockBackend is required")
 		}
 	};
 	return {
@@ -13002,11 +12958,7 @@ async function handleWalletUnlockChallengeRoute(input) {
 		const walletAuthMethodId = parseRequiredWalletAuthMethodId(body.walletAuthMethodId);
 		if (!walletAuthMethodId.ok) return {
 			status: 400,
-			body: {
-				ok: false,
-				code: "invalid_body",
-				message: walletAuthMethodId.message
-			}
+			body: failure("invalid_body", walletAuthMethodId.message)
 		};
 	}
 	const result = unlockBackend === "passkey" ? await input.service.createWebAuthnLoginOptions({
@@ -13018,6 +12970,20 @@ async function handleWalletUnlockChallengeRoute(input) {
 		orgId: body.orgId,
 		ttlMs: body.ttlMs
 	});
+	if (!result.ok && result.code === "wallet_home_unavailable") return {
+		status: 503,
+		body: {
+			...result,
+			unlockBackend
+		}
+	};
+	if (!result.ok && result.code === "wallet_home_conflict") return {
+		status: 409,
+		body: {
+			...result,
+			unlockBackend
+		}
+	};
 	return {
 		status: result.ok ? 200 : result.code === "internal" ? 500 : 400,
 		body: {
@@ -13189,20 +13155,12 @@ async function handleWalletUnlockVerifyRoute(input) {
 	const challengeId = String(body.challengeId || "").trim();
 	if (!challengeId) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "challengeId is required"
-		}
+		body: failure("invalid_body", "challengeId is required")
 	};
 	if (unlockBackend === "passkey") {
 		if (input.capabilityContext.kind !== "passkey_unlock") return {
 			status: 400,
-			body: {
-				ok: false,
-				code: "invalid_body",
-				message: "Passkey unlock context is invalid"
-			}
+			body: failure("invalid_body", "Passkey unlock context is invalid")
 		};
 		let ed25519SessionRequest;
 		try {
@@ -13210,11 +13168,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 		} catch (error) {
 			return {
 				status: 400,
-				body: {
-					ok: false,
-					code: "invalid_body",
-					message: error instanceof Error ? error.message : "Ed25519 session request is invalid"
-				}
+				body: failure("invalid_body", error instanceof Error ? error.message : "Ed25519 session request is invalid")
 			};
 		}
 		const result = await verifyPasskeyWalletUnlock({
@@ -13233,11 +13187,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 		const userId = String(result.userId || "").trim();
 		if (!userId) return {
 			status: 500,
-			body: {
-				ok: false,
-				code: "internal",
-				message: "Verified passkey user is missing"
-			}
+			body: failure("internal", "Verified passkey user is missing")
 		};
 		const walletId = parseWalletId(userId);
 		const walletAuthMethodId = parseWalletAuthMethodId(result.walletAuthMethodId);
@@ -13246,11 +13196,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 		const credentialIdB64u = parseWebAuthnCredentialIdB64u(result.credentialIdB64u);
 		if (!walletId.ok || !walletAuthMethodId.ok || !walletAuthorityId.ok || !rpId.ok || !credentialIdB64u.ok) return {
 			status: 500,
-			body: {
-				ok: false,
-				code: "internal",
-				message: "Verified passkey identity is invalid"
-			}
+			body: failure("internal", "Verified passkey identity is invalid")
 		};
 		let authorization;
 		try {
@@ -13268,11 +13214,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 		} catch (error) {
 			return {
 				status: 403,
-				body: {
-					ok: false,
-					code: "owner_proof_rejected",
-					message: error instanceof Error ? error.message : "Passkey owner proof is invalid"
-				}
+				body: failure("owner_proof_rejected", error instanceof Error ? error.message : "Passkey owner proof is invalid")
 			};
 		}
 		const resolvePasskeyAuthority = () => input.service.resolveActivePasskeyAuthorityForUnlock({
@@ -13290,11 +13232,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 		} catch (error) {
 			return {
 				status: 500,
-				body: {
-					ok: false,
-					code: "internal",
-					message: error instanceof Error ? error.message : "Passkey authority resolution failed"
-				}
+				body: failure("internal", error instanceof Error ? error.message : "Passkey authority resolution failed")
 			};
 		}
 		if (authorityResolution.kind === "active_authority") {
@@ -13311,11 +13249,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 		switch (sessionPlan.kind) {
 			case "rejected": return {
 				status: walletUnlockIssuanceRejectionStatus(sessionPlan.authorityResolution),
-				body: {
-					ok: false,
-					code: sessionPlan.authorityResolution.code,
-					message: sessionPlan.authorityResolution.message
-				}
+				body: failure(sessionPlan.authorityResolution.code, sessionPlan.authorityResolution.message)
 			};
 			case "wallet_registration":
 				passkeyCustodyRequired = true;
@@ -13337,11 +13271,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 				} catch (error) {
 					return {
 						status: 500,
-						body: {
-							ok: false,
-							code: "internal",
-							message: error instanceof Error ? error.message : "Passkey Wallet Session issuance failed"
-						}
+						body: failure("internal", error instanceof Error ? error.message : "Passkey Wallet Session issuance failed")
 					};
 				}
 				switch (sessionResolution.kind) {
@@ -13362,11 +13292,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 						break;
 					case "rejected": return {
 						status: walletUnlockIssuanceRejectionStatus(sessionResolution),
-						body: {
-							ok: false,
-							code: sessionResolution.code,
-							message: sessionResolution.message
-						}
+						body: failure(sessionResolution.code, sessionResolution.message)
 					};
 				}
 				break;
@@ -13385,11 +13311,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 		} catch (error) {
 			return {
 				status: 503,
-				body: {
-					ok: false,
-					code: "custody_unavailable",
-					message: error instanceof Error ? error.message : "Passkey wallet custody is unavailable"
-				}
+				body: failure("custody_unavailable", error instanceof Error ? error.message : "Passkey wallet custody is unavailable")
 			};
 		}
 		const ed25519Session = await provisionPasskeyEd25519YaoSession({
@@ -13431,20 +13353,12 @@ async function handleWalletUnlockVerifyRoute(input) {
 			} catch (error) {
 				return {
 					status: 500,
-					body: {
-						ok: false,
-						code: "internal",
-						message: error instanceof Error ? error.message : "Passkey authority refresh resolution failed"
-					}
+					body: failure("internal", error instanceof Error ? error.message : "Passkey authority refresh resolution failed")
 				};
 			}
 			if (refreshedAuthority.kind === "rejected") return {
 				status: walletUnlockIssuanceRejectionStatus(refreshedAuthority),
-				body: {
-					ok: false,
-					code: refreshedAuthority.code,
-					message: refreshedAuthority.message
-				}
+				body: failure(refreshedAuthority.code, refreshedAuthority.message)
 			};
 			try {
 				walletSessionState = await refreshWalletUnlockSessionState({
@@ -13455,11 +13369,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 			} catch (error) {
 				return {
 					status: 500,
-					body: {
-						ok: false,
-						code: "internal",
-						message: error instanceof Error ? error.message : "Passkey Wallet Session authority projection refresh failed"
-					}
+					body: failure("internal", error instanceof Error ? error.message : "Passkey Wallet Session authority projection refresh failed")
 				};
 			}
 		}
@@ -13488,20 +13398,12 @@ async function handleWalletUnlockVerifyRoute(input) {
 	}
 	if (input.capabilityContext.kind === "passkey_unlock") return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "Email OTP unlock context is invalid"
-		}
+		body: failure("invalid_body", "Email OTP unlock context is invalid")
 	};
 	const requestedWalletAuthMethodId = parseRequiredWalletAuthMethodId(body.walletAuthMethodId);
 	if (!requestedWalletAuthMethodId.ok) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: requestedWalletAuthMethodId.message
-		}
+		body: failure("invalid_body", requestedWalletAuthMethodId.message)
 	};
 	const result = await input.service.verifyEmailOtpUnlockProof({
 		walletId: body.walletId,
@@ -13528,11 +13430,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 	const walletId = parseWalletId(result.walletId);
 	if (!walletId.ok) return {
 		status: 500,
-		body: {
-			ok: false,
-			code: "internal",
-			message: "Verified Email OTP wallet identity is invalid"
-		}
+		body: failure("internal", "Verified Email OTP wallet identity is invalid")
 	};
 	let authorityResolution;
 	try {
@@ -13545,20 +13443,12 @@ async function handleWalletUnlockVerifyRoute(input) {
 	} catch (error) {
 		return {
 			status: 500,
-			body: {
-				ok: false,
-				code: "internal",
-				message: error instanceof Error ? error.message : "Email OTP authority resolution failed"
-			}
+			body: failure("internal", error instanceof Error ? error.message : "Email OTP authority resolution failed")
 		};
 	}
 	if (authorityResolution.kind === "rejected") return {
 		status: authorityResolution.code === "internal" ? 500 : 403,
-		body: {
-			ok: false,
-			code: authorityResolution.code,
-			message: authorityResolution.message
-		}
+		body: failure(authorityResolution.code, authorityResolution.message)
 	};
 	const exactEmailOtpAuthority = authorityResolution;
 	if (planWalletUnlockAuthorityEcdsaSession({
@@ -13592,11 +13482,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 	} catch (error) {
 		return {
 			status: 403,
-			body: {
-				ok: false,
-				code: "owner_proof_rejected",
-				message: error instanceof Error ? error.message : "Email OTP owner proof is invalid"
-			}
+			body: failure("owner_proof_rejected", error instanceof Error ? error.message : "Email OTP owner proof is invalid")
 		};
 	}
 	let walletSessionState = { kind: "absent" };
@@ -13604,11 +13490,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 		const walletId = parseWalletId(result.walletId);
 		if (!walletId.ok) return {
 			status: 500,
-			body: {
-				ok: false,
-				code: "internal",
-				message: "Verified Email OTP wallet identity is invalid"
-			}
+			body: failure("internal", "Verified Email OTP wallet identity is invalid")
 		};
 		let sessionResolution;
 		try {
@@ -13623,11 +13505,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 		} catch (error) {
 			return {
 				status: 500,
-				body: {
-					ok: false,
-					code: "internal",
-					message: error instanceof Error ? error.message : "Email OTP Wallet Session issuance failed"
-				}
+				body: failure("internal", error instanceof Error ? error.message : "Email OTP Wallet Session issuance failed")
 			};
 		}
 		switch (sessionResolution.kind) {
@@ -13645,11 +13523,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 			case "wallet_registration": break;
 			case "rejected": return {
 				status: walletUnlockIssuanceRejectionStatus(sessionResolution),
-				body: {
-					ok: false,
-					code: sessionResolution.code,
-					message: sessionResolution.message
-				}
+				body: failure(sessionResolution.code, sessionResolution.message)
 			};
 		}
 	}
@@ -13699,11 +13573,7 @@ async function handleWalletUnlockVerifyRoute(input) {
 	});
 	if (!isWalletUnlockEd25519YaoRequestedContext(input.capabilityContext)) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "Email OTP capability context is invalid"
-		}
+		body: failure("invalid_body", "Email OTP capability context is invalid")
 	};
 	const capabilityResult = await provisionEmailOtpEd25519YaoCapability({
 		context: input.capabilityContext,
@@ -13742,7 +13612,6 @@ const ECDSA_TIMING_METRICS = new Set([
 	"ecdsa_sign_proxy",
 	"ecdsa_sign_complete",
 	"ecdsa_sign_total",
-	"ecdsa_presign_queue",
 	"ecdsa_presign_authenticate",
 	"ecdsa_presign_material",
 	"ecdsa_presign_admit",
@@ -13831,6 +13700,7 @@ async function evaluateRouterAbNormalSigningAdmission(input) {
 	});
 	return await input.adapter.evaluatePolicy({
 		curve: "ecdsa",
+		policyReadSource: input.policyReadSource,
 		phase: input.phase,
 		walletId: input.walletId,
 		materialActivationId: requireMpcMaterialActivationId(input.admission.materialActivation.activation_id),
@@ -14104,6 +13974,7 @@ async function authenticateRouterAbWalletOperationStepUpIdentity(input) {
 		if (admission.curve === "ecdsa" && input.keyFamily === "ecdsa_secp256k1") {
 			const active = ecdsaStepUpActiveMaterial({
 				activeMaterial: await input.resolveEcdsaMaterialActivation({
+					source: { kind: "database" },
 					walletId: input.walletId,
 					materialActivation: admittedMaterialActivation
 				}),
@@ -14546,7 +14417,7 @@ async function buildRouterAbEd25519PrivateSigningWorkerBody(input) {
 	const scope = parseRouterAbEd25519NormalSigningScopeV2(input.body.scope);
 	const signingContext = privateSigningAuthorizationContext(scope, input.authorization);
 	const trustedSourceDigest = await privateSigningTrustedSourceDigest(input.headers);
-	const materialSource = input.materialSource ?? registrationMaterialSourceV1({
+	const materialSource = registrationMaterialSourceV1({
 		accountId: scope.account_id,
 		materialActivationId: scope.material_activation.activation_id,
 		signingWorkerId: scope.signing_worker_id
@@ -14663,6 +14534,7 @@ async function resolveRouterAbEcdsaOwnerOperationStepUpPreparation(input) {
 		const walletId = parseWalletId(request.scope.wallet_id);
 		if (!walletId.ok) return void 0;
 		const activeMaterial = await input.resolveEcdsaMaterialActivation({
+			source: { kind: "database" },
 			walletId: walletId.value,
 			materialActivation: request.material_activation
 		});
@@ -14763,6 +14635,7 @@ function routerAbWalletSessionError(code) {
 */
 async function resolveFreshRouterAbEcdsaMaterialActivation(input) {
 	const resolved = await input.resolveEcdsaMaterialActivation({
+		source: { kind: "database" },
 		walletId: input.walletId,
 		materialActivation: input.expected
 	});
@@ -14782,15 +14655,7 @@ async function resolveFreshRouterAbEcdsaMaterialActivation(input) {
 	};
 }
 function validateRouterAbEcdsaV2NormalSigningRequestForSession(input) {
-	let request;
-	try {
-		request = parseRouterAbEcdsaOperationStepUpRequest(input);
-	} catch (error) {
-		return {
-			ok: false,
-			error: routerAbStepUpError(400, "invalid_body", routerAbErrorMessage(error))
-		};
-	}
+	const request = input.request;
 	if (request.authorization.kind !== "reusable_wallet_session" || request.authorization.wallet_session_id !== input.session.walletSessionId || request.scope.wallet_id !== String(input.session.walletId) || request.material_activation.material_owner !== String(input.session.walletId) || request.material_activation.signing_worker !== request.scope.signing_worker.server_id || !sameRouterAbMpcMaterialActivationRef(request.material_activation, request.scope.material_activation) || !sameRouterAbMpcMaterialActivationRef(request.material_activation, input.admittedMaterialActivation)) return {
 		ok: false,
 		error: routerAbWalletSessionError(WALLET_SESSION_FAILURE_CODES.scopeMismatch)
@@ -14819,7 +14684,7 @@ function validateRouterAbEcdsaV2NormalSigningRequestForSession(input) {
 	};
 }
 async function admitRouterAbEcdsaReusableWalletSessionOperation(input) {
-	if (typeof input.authorizedOperations.admitEcdsaWalletSessionOperation !== "function") return {
+	if (typeof input.authorizedOperations.admitEcdsaWalletSessionOperation !== "function" || typeof input.authorizedOperations.resolveEcdsaWalletSessionOperation !== "function") return {
 		ok: false,
 		error: routerAbStepUpError(501, "not_configured", "ECDSA atomic authorization is not configured")
 	};
@@ -14829,7 +14694,7 @@ async function admitRouterAbEcdsaReusableWalletSessionOperation(input) {
 	};
 	const nowMs = Date.now();
 	try {
-		const session = input.binding.kind === "wallet_session_operation_credential_v1" ? input.binding.context.authorization.session : input.binding.candidate.status.session;
+		const session = input.binding.kind === "wallet_session_operation_credential_v1" ? input.binding.validated.admission.context.authorization.session : input.binding.candidate.status.session;
 		const tenantId = session.tenantId;
 		const principalId = session.principalId;
 		const walletId = session.walletId;
@@ -14840,16 +14705,12 @@ async function admitRouterAbEcdsaReusableWalletSessionOperation(input) {
 			ok: false,
 			error: routerAbStepUpError(403, "wallet_session_mismatch", "Reusable Wallet Session identity does not match")
 		};
-		const freshMaterial = await resolveFreshRouterAbEcdsaMaterialActivation({
-			resolveEcdsaMaterialActivation: input.resolveEcdsaMaterialActivation,
-			walletId: String(walletId),
-			expected: input.materialActivation
-		});
-		if (!freshMaterial.ok) return {
+		const material = input.material;
+		if (!sameRouterAbMpcMaterialActivationRef(material.materialActivation, input.request.material_activation)) return {
 			ok: false,
-			error: routerAbStepUpError(freshMaterial.code === "internal" ? 500 : 403, freshMaterial.code === "internal" ? "internal" : "wallet_session_mismatch", freshMaterial.message)
+			error: routerAbStepUpError(403, "material_mismatch", "Signing material does not match the request")
 		};
-		const capabilityId = requireAuthorizationValue$2(parseCapabilityId(freshMaterial.materialActivation.capability));
+		const capabilityId = requireAuthorizationValue$2(parseCapabilityId(material.materialActivation.capability));
 		const operationId = requireAuthorizationValue$2(parseCapabilityOperationId(input.request.operation_id));
 		const envelope = buildCapabilityOperationEnvelope({
 			tenantId,
@@ -14863,13 +14724,11 @@ async function admitRouterAbEcdsaReusableWalletSessionOperation(input) {
 				displayDigest: parseDigestB64u(input.request.operation_digests.display_digest_b64u)
 			}
 		});
-		const authorizedOperationId = requireAuthorizationValue$2(parseAuthorizedOperationId(`ecdsa-authorized-operation:${operationId}:${input.request.request_id}`));
-		const auditEventId = requireAuthorizationValue$2(parseAuthorizationAuditEventId(`ecdsa-operation-audit:${operationId}`));
-		const outcome = await input.authorizedOperations.admitEcdsaWalletSessionOperation({
+		const admissionInput = {
 			operation: {
 				tenantId,
-				authorizedOperationId,
-				auditEventId,
+				authorizedOperationId: requireAuthorizationValue$2(parseAuthorizedOperationId(`ecdsa-authorized-operation:${operationId}:${input.request.request_id}`)),
+				auditEventId: requireAuthorizationValue$2(parseAuthorizationAuditEventId(`ecdsa-operation-audit:${operationId}`)),
 				operation: envelope,
 				authorization: {
 					kind: "authorization_grant",
@@ -14882,12 +14741,35 @@ async function admitRouterAbEcdsaReusableWalletSessionOperation(input) {
 				claimedAtMs: nowMs
 			},
 			material: {
+				readSnapshot: material.readSnapshot,
 				walletId,
-				keyHandle: freshMaterial.keyHandle,
-				runtimePolicyScope: freshMaterial.runtimePolicyScope,
-				materialActivation: freshMaterial.materialActivation
+				keyHandle: material.keyHandle,
+				runtimePolicyScope: material.runtimePolicyScope,
+				materialActivation: material.materialActivation
 			}
-		});
+		};
+		if (input.phase === "finalize") {
+			const resolved = await input.authorizedOperations.resolveEcdsaWalletSessionOperation(admissionInput);
+			if (resolved.kind === "authorized_operation_missing") return {
+				ok: false,
+				error: routerAbStepUpError(409, resolved.kind, "ECDSA finalize requires a claimed prepare operation")
+			};
+			const failure = routerAbReusableWalletSessionClaimFailure(resolved);
+			if (failure) return {
+				ok: false,
+				error: failure
+			};
+			if (resolved.kind === "operation_in_progress" || resolved.kind === "replayed") return {
+				ok: true,
+				phase: "finalize",
+				admission: resolved
+			};
+			return {
+				ok: false,
+				error: routerAbStepUpError(409, resolved.kind, "Authorized operation is unavailable")
+			};
+		}
+		const outcome = await input.authorizedOperations.admitEcdsaWalletSessionOperation(admissionInput);
 		const claimFailure = routerAbReusableWalletSessionClaimFailure(outcome);
 		if (claimFailure) return {
 			ok: false,
@@ -14895,6 +14777,7 @@ async function admitRouterAbEcdsaReusableWalletSessionOperation(input) {
 		};
 		if (outcome.kind === "claimed" || outcome.kind === "operation_in_progress" || outcome.kind === "replayed") return {
 			ok: true,
+			phase: "prepare",
 			admission: outcome
 		};
 		return {
@@ -14940,6 +14823,10 @@ async function authorizeRouterAbEcdsaWalletSessionRequest(input) {
 		result: validated.error
 	};
 	const activeMaterial = await input.resolveEcdsaMaterialActivation({
+		source: {
+			kind: "credential_snapshot",
+			materialRead: input.materialRead
+		},
 		walletId: String(input.session.walletId),
 		materialActivation: validated.admission.materialActivation
 	});
@@ -14957,6 +14844,10 @@ async function authorizeRouterAbEcdsaWalletSessionRequest(input) {
 		result: routerAbStepUpError(403, "wallet_session_scope_mismatch", "Wallet Session V2 scope does not match the active material")
 	};
 	const admissionDecision = await evaluateRouterAbNormalSigningAdmission({
+		policyReadSource: {
+			kind: "credential_snapshot",
+			policyRead: input.policyRead
+		},
 		adapter: input.admissionAdapter,
 		curve: "ecdsa",
 		authorizationKind: "wallet_session_operation_credential_v1",
@@ -14991,29 +14882,21 @@ async function authorizeRouterAbEcdsaWalletSessionRequest(input) {
 	};
 }
 async function resolveRouterAbEcdsaExhaustedCandidateAuthorization(input) {
-	const token = extractBearerCredential(input.headers);
-	if (!token) return null;
-	const exhausted = await readExhaustedWalletSessionCandidate({
-		authorizationSessions: input.authorizationSessions,
-		token,
-		operation: {
-			keyFamily: "ecdsa_secp256k1",
-			operationKind: "evm.sign_transaction"
-		}
+	const candidate = input.candidate;
+	const session = candidate.status.session;
+	const admission = walletSessionCandidateAdmission(session, candidate, {
+		keyFamily: "ecdsa_secp256k1",
+		operationKind: "evm.sign_transaction"
 	});
-	if (!exhausted) return null;
-	if (!exhausted.ok) return {
-		ok: false,
-		result: exhausted.error
-	};
-	const { candidate, session, admission } = exhausted;
 	if (!admission.ok || admission.keyFamily !== "ecdsa_secp256k1") return {
 		ok: false,
 		result: routerAbWalletSessionError(WALLET_SESSION_FAILURE_CODES.scopeMismatch)
 	};
 	const authorized = await authorizeRouterAbEcdsaWalletSessionRequest({
+		materialRead: input.materialRead,
+		policyRead: input.policyRead,
 		phase: input.phase,
-		body: input.body,
+		request: input.request,
 		session,
 		admittedMaterialActivation: routerAbMpcMaterialActivationRefToWire(admission.materialActivation),
 		admissionAdapter: input.admissionAdapter,
@@ -15066,6 +14949,7 @@ async function authenticateRouterAbEcdsaOperationStepUp(input) {
 	let resolvedMaterial;
 	try {
 		resolvedMaterial = await input.resolveEcdsaMaterialActivation({
+			source: { kind: "database" },
 			walletId: scope.wallet_id,
 			materialActivation: admittedMaterialActivation
 		});
@@ -15173,6 +15057,7 @@ async function handleRouterAbEcdsaOperationStepUpRoute(input) {
 	const materialActivationId = requireMpcMaterialActivationId(activeMaterial.materialActivation.activation_id);
 	if (!input.admissionAdapter) return routerAbStepUpError(501, "not_configured", "Router A/B ECDSA operation step-up admission is not configured");
 	const admission = await input.admissionAdapter.evaluatePolicy({
+		policyReadSource: { kind: "database" },
 		curve: "ecdsa",
 		phase: input.phase,
 		walletId: authenticated.session.walletId,
@@ -15222,19 +15107,19 @@ async function handleRouterAbEcdsaOperationStepUpRoute(input) {
 	};
 }
 async function authorizeRouterAbEcdsaDerivationNormalSigningRoute(input) {
-	let requestedAuthorizationKind;
+	let parsedRequest;
 	try {
-		requestedAuthorizationKind = parseRouterAbEcdsaOperationStepUpRequest({
+		parsedRequest = parseRouterAbEcdsaOperationStepUpRequest({
 			phase: input.phase,
 			body: input.body
-		}).authorization.kind;
+		});
 	} catch (error) {
 		return {
 			ok: false,
 			result: routerAbStepUpError(400, "invalid_body", routerAbErrorMessage(error))
 		};
 	}
-	if (requestedAuthorizationKind === "operation_step_up") {
+	if (parsedRequest.authorization.kind === "operation_step_up") {
 		const stepUp = await handleRouterAbEcdsaOperationStepUpRoute({
 			body: input.body,
 			headers: input.headers,
@@ -15258,22 +15143,12 @@ async function authorizeRouterAbEcdsaDerivationNormalSigningRoute(input) {
 		};
 	}
 	const validated = await validateRouterAbEcdsaDerivationWalletSessionInputs({
+		materialActivation: parsedRequest.material_activation,
 		headers: input.headers,
 		authorizationSessions: input.authorizationSessions,
 		operationKind: "evm.sign_transaction"
 	});
 	if (!validated.ok) {
-		if (validated.code === "wallet_session_unavailable" && input.authorizationSessions) {
-			const exhaustedCandidate = await resolveRouterAbEcdsaExhaustedCandidateAuthorization({
-				phase: input.phase,
-				body: input.body,
-				headers: input.headers,
-				authorizationSessions: input.authorizationSessions,
-				admissionAdapter: input.admissionAdapter,
-				resolveEcdsaMaterialActivation: input.resolveEcdsaMaterialActivation
-			});
-			if (exhaustedCandidate) return exhaustedCandidate;
-		}
 		const stepUp = await resolveRouterAbEcdsaOwnerOperationStepUpPreparation({
 			body: input.body,
 			phase: input.phase,
@@ -15290,10 +15165,21 @@ async function authorizeRouterAbEcdsaDerivationNormalSigningRoute(input) {
 			})
 		};
 	}
+	if (validated.kind === "wallet_session_operation_credential_exhausted_candidate_v1") return await resolveRouterAbEcdsaExhaustedCandidateAuthorization({
+		materialRead: validated.materialRead,
+		policyRead: validated.policyRead,
+		phase: input.phase,
+		request: parsedRequest,
+		candidate: validated.candidate,
+		admissionAdapter: input.admissionAdapter,
+		resolveEcdsaMaterialActivation: input.resolveEcdsaMaterialActivation
+	});
 	const session = validated.admission.context.authorization.session;
 	const authorized = await authorizeRouterAbEcdsaWalletSessionRequest({
+		materialRead: validated.materialRead,
+		policyRead: validated.policyRead,
 		phase: input.phase,
-		body: input.body,
+		request: parsedRequest,
 		session,
 		admittedMaterialActivation: routerAbMpcMaterialActivationRefToWire(validated.admission.admission.materialActivation),
 		admissionAdapter: input.admissionAdapter,
@@ -15445,6 +15331,164 @@ function parseRouterAbEcdsaDerivationPoolFillStepRouteRequest(raw) {
 	};
 }
 //#endregion
+//#region src/router/transport/fetch/routes/ecdsaOperationStepUpFactor.ts
+async function verifyEcdsaOperationStepUpFactor(input) {
+	const proof = input.proof;
+	switch (proof.kind) {
+		case "passkey": {
+			if (input.authSource.kind !== "passkey" || proof.authority.factor.credentialIdB64u !== input.authSource.credentialIdB64u) return {
+				ok: false,
+				response: json$1({
+					ok: false,
+					code: "scope_mismatch",
+					message: "Passkey authority changed"
+				}, { status: 403 })
+			};
+			const credential = proof.webauthn_authentication;
+			if (String(credential.rawId || credential.id).trim() !== input.authSource.credentialIdB64u) return {
+				ok: false,
+				response: json$1({
+					ok: false,
+					code: "unauthorized",
+					message: "Passkey credential changed"
+				}, { status: 401 })
+			};
+			const verified = await input.webAuthn.verifyWebAuthnAuthenticationLite({
+				userId: input.walletId,
+				rpId: proof.authority.verifier.rpId,
+				expectedChallenge: input.expectedChallenge,
+				expected_origin: input.requestOrigin,
+				webauthn_authentication: credential
+			});
+			if (!verified.success || !verified.verified) return {
+				ok: false,
+				response: json$1({
+					ok: false,
+					code: verified.code || "not_verified",
+					message: verified.message || "WebAuthn authentication verification failed"
+				}, { status: 401 })
+			};
+			const assertionDigest = parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(credential))));
+			const verifiedAtMs = Date.now();
+			if (input.expiresAtMs <= verifiedAtMs) return expiredStepUpFactor();
+			const factorId = parseAuthFactorId(`passkey:${input.authSource.credentialIdB64u}`);
+			if (!factorId.ok) throw new Error(factorId.error.message);
+			return {
+				ok: true,
+				factor: buildVerifiedWalletOperationPasskeyFactorResult({
+					tenantId: input.operation.tenantId,
+					principalId: input.operation.principalId,
+					walletId: input.walletId,
+					requestOrigin: input.requestOrigin,
+					audience: input.requestOrigin,
+					factorId: factorId.value,
+					authorityRef: input.authorityRef,
+					operation: input.operation,
+					credentialIdB64u: proof.authority.factor.credentialIdB64u,
+					assertionDigest,
+					verifiedAtMs,
+					expiresAtMs: input.expiresAtMs
+				}),
+				unseal: { kind: "not_requested" }
+			};
+		}
+		case "email_otp": {
+			const isExport = input.operation.operation.operationKind === "evm.export_key";
+			const emailOtpOperation = isExport ? WALLET_EMAIL_OTP_EXPORT_OPERATION : WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION;
+			const operationBinding = await hashEmailOtpOperationBinding({
+				walletId: input.walletId,
+				providerUserId: proof.authority.factor.providerUserId,
+				orgId: input.operation.tenantId,
+				operation: emailOtpOperation,
+				requestOrigin: input.requestOrigin,
+				audience: input.requestOrigin,
+				authorityRef: input.authorityRef,
+				...isExport ? {} : { operationFingerprintDigest: input.operation.digests.laneDigest }
+			});
+			const verified = await input.emailOtp.verifyEmailOtpChallenge({
+				userId: proof.authority.factor.providerUserId,
+				walletId: input.walletId,
+				orgId: input.operation.tenantId,
+				challengeId: proof.challenge_id,
+				otpCode: proof.otp_code,
+				otpChannel: EMAIL_OTP_CHANNEL,
+				ownerProofBindingDigest: operationBinding,
+				operation: emailOtpOperation
+			});
+			if (!verified.ok) return {
+				ok: false,
+				response: json$1(verified, { status: verified.code === "invalid_body" ? 400 : 401 })
+			};
+			let verifiedChallengeId = verified.challengeId;
+			if (!isExport) {
+				const orgId = parseOrgId(input.operation.tenantId);
+				const providerSubject = parseProviderSubject(proof.authority.factor.providerUserId);
+				if (!orgId.ok) throw new Error(orgId.error.message);
+				if (!providerSubject.ok) throw new Error(providerSubject.error.message);
+				const consumed = await input.emailOtp.consumeEmailOtpGrant({
+					subject: {
+						kind: "provider_identity",
+						orgId: orgId.value,
+						providerSubject: providerSubject.value,
+						walletId: input.walletId
+					},
+					loginGrant: verified.loginGrant,
+					otpChannel: EMAIL_OTP_CHANNEL
+				});
+				if (!consumed.ok) return {
+					ok: false,
+					response: json$1(consumed, { status: consumed.code === "invalid_body" ? 400 : 401 })
+				};
+				verifiedChallengeId = consumed.challengeId;
+			}
+			const verificationReceiptDigest = parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
+				challengeId: verifiedChallengeId,
+				operationFingerprint: input.expectedChallenge
+			}))));
+			const verifiedAtMs = Date.now();
+			const expiresAtMs = Math.min(input.expiresAtMs, verified.grantExpiresAtMs);
+			if (expiresAtMs <= verifiedAtMs) return expiredStepUpFactor();
+			const factorId = parseAuthFactorId(`email_otp:${proof.authority.factor.provider}:${proof.authority.factor.providerUserId}`);
+			const challengeId = parseEmailOtpChallengeId(verifiedChallengeId);
+			if (!factorId.ok) throw new Error(factorId.error.message);
+			if (!challengeId.ok) throw new Error(challengeId.error.message);
+			return {
+				ok: true,
+				factor: buildVerifiedWalletOperationEmailOtpFactorResult({
+					tenantId: input.operation.tenantId,
+					principalId: input.operation.principalId,
+					walletId: input.walletId,
+					requestOrigin: input.requestOrigin,
+					audience: input.requestOrigin,
+					factorId: factorId.value,
+					authorityRef: input.authorityRef,
+					operation: input.operation,
+					challengeId: challengeId.value,
+					verificationReceiptDigest,
+					verifiedAtMs,
+					expiresAtMs
+				}),
+				unseal: isExport ? {
+					kind: "email_otp_grant",
+					grant: verified.loginGrant,
+					challenge_id: verified.challengeId
+				} : { kind: "not_requested" }
+			};
+		}
+		default: throw new Error("Unsupported ECDSA operation step-up proof");
+	}
+}
+function expiredStepUpFactor() {
+	return {
+		ok: false,
+		response: json$1({
+			ok: false,
+			code: "verified_step_up_rejected",
+			message: "Operation step-up authorization expired"
+		}, { status: 403 })
+	};
+}
+//#endregion
 //#region ../shared-ts/src/signing-lanes/recordParsers.ts
 const WALLET_KEY_COMMON_FIELDS = [
 	"kind",
@@ -15860,18 +15904,13 @@ async function executeRouterAbEcdsaDerivationNormalSigningRoute(input, timing) {
 			binding: await ecdsaOperationStepUpBinding(input.ctx, authorization.session, authorizedOperation)
 		});
 	} else {
+		const request = input.phase === "prepare" ? parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1(input.body) : parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1(input.body);
 		const operation = await admitRouterAbEcdsaReusableWalletSessionOperation({
-			request: input.phase === "prepare" ? parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1(input.body) : parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1(input.body),
-			materialActivation: authorization.admission.materialActivation,
-			binding: authorization.kind === "wallet_session_operation_credential_v1" ? {
-				kind: "wallet_session_operation_credential_v1",
-				context: authorization.validated.admission.context
-			} : {
-				kind: "wallet_session_operation_credential_exhausted_candidate_v1",
-				candidate: authorization.candidate
-			},
-			authorizedOperations: input.ctx.service.authorizedOperations,
-			resolveEcdsaMaterialActivation: input.ctx.service.walletRegistration.resolveEcdsaMaterialActivation.bind(input.ctx.service.walletRegistration)
+			phase: input.phase,
+			request,
+			material: authorization.activeMaterial,
+			binding: authorization,
+			authorizedOperations: input.ctx.service.authorizedOperations
 		});
 		if (!operation.ok) {
 			const failureBody = operation.error.body;
@@ -15897,11 +15936,6 @@ async function executeRouterAbEcdsaDerivationNormalSigningRoute(input, timing) {
 			return json$1(failure.body, { status: failure.status });
 		}
 		if (operation.admission.kind === "replayed") return routerAbEcdsaReplayResponse(operation.admission.operation);
-		if (operation.admission.kind === "claimed" && input.phase === "finalize") return json$1({
-			ok: false,
-			code: "authorized_operation_missing",
-			message: "ECDSA finalize requires a claimed prepare operation"
-		}, { status: 409 });
 		const ownerDecision = decideRouterAbEcdsaOwnerOperationAuthorization({ operation: operation.admission.operation });
 		switch (ownerDecision.kind) {
 			case "authorized": break;
@@ -16126,6 +16160,7 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 		message: v2Resolution.message
 	}, { status: 403 });
 	const activeMaterial = v2Resolution.kind === "admitted" ? v2Resolution.activeMaterial : await input.ctx.service.walletRegistration.resolveEcdsaMaterialActivation({
+		source: { kind: "database" },
 		walletId: operation.wallet_id,
 		materialActivation: operation.material_activation
 	});
@@ -16215,7 +16250,6 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 		}, { status: 400 });
 	}
 	const expectedChallenge = await computeRouterAbEcdsaOperationStepUpChallengeB64u(operation);
-	const nowMs = Date.now();
 	const requestId = operation.operation_id;
 	let freshMaterial;
 	if (v2Resolution.kind === "admitted") {
@@ -16256,112 +16290,24 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 	const evidenceSetId = requireAuthorizationValue$1(parseAuthorizationEvidenceSetId(`ecdsa-step-up-evidence-set:${requestId}`));
 	const expiresAtMs = operation.expires_at_ms;
 	const requestOrigin = authenticated.requestOrigin;
-	let emailOtpUnseal;
-	let factor;
-	switch (proof.kind) {
-		case "passkey": {
-			if (authenticated.session.laneAuthorization.authSource.kind !== "passkey" || proof.authority.factor.credentialIdB64u !== authenticated.session.laneAuthorization.authSource.credentialIdB64u) return json$1({
-				ok: false,
-				code: "scope_mismatch",
-				message: "Passkey authority changed"
-			}, { status: 403 });
-			const credential = proof.webauthn_authentication;
-			if (String(credential.rawId || credential.id).trim() !== authenticated.session.laneAuthorization.authSource.credentialIdB64u) return json$1({
-				ok: false,
-				code: "unauthorized",
-				message: "Passkey credential changed"
-			}, { status: 401 });
-			const verified = await input.ctx.service.webAuthn.verifyWebAuthnAuthenticationLite({
-				userId: authenticated.session.walletId,
-				rpId: proof.authority.verifier.rpId,
-				expectedChallenge,
-				expected_origin: requestOrigin,
-				webauthn_authentication: credential
-			});
-			if (!verified.success || !verified.verified) return json$1({
-				ok: false,
-				code: verified.code || "not_verified",
-				message: verified.message || "WebAuthn authentication verification failed"
-			}, { status: 401 });
-			factor = buildVerifiedWalletOperationPasskeyFactorResult({
-				tenantId: authenticated.session.tenantId,
-				principalId: authenticated.session.principalId,
-				walletId: walletIdFromString(authenticated.session.walletId),
-				requestOrigin,
-				audience: requestOrigin,
-				factorId: requireAuthorizationValue$1(parseAuthFactorId(`passkey:${authenticated.session.laneAuthorization.authSource.credentialIdB64u}`)),
-				authorityRef: authenticated.authorityRef,
-				operation: envelope,
-				credentialIdB64u: proof.authority.factor.credentialIdB64u,
-				assertionDigest: parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(credential)))),
-				verifiedAtMs: nowMs,
-				expiresAtMs
-			});
-			break;
-		}
-		case "email_otp": {
-			const operationBinding = await hashEmailOtpOperationBinding({
-				walletId: authenticated.session.walletId,
-				providerUserId: proof.authority.factor.providerUserId,
-				orgId: authenticated.session.tenantId,
-				operation: operation.operation_kind === "evm.export_key" ? WALLET_EMAIL_OTP_EXPORT_OPERATION : WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION,
-				requestOrigin,
-				audience: requestOrigin,
-				authorityRef: authenticated.authorityRef,
-				...operation.operation_kind === "evm.sign_transaction" ? { operationFingerprintDigest: envelope.digests.laneDigest } : {}
-			});
-			const verified = await input.ctx.service.emailOtp.verifyEmailOtpChallenge({
-				userId: proof.authority.factor.providerUserId,
-				walletId: authenticated.session.walletId,
-				orgId: authenticated.session.tenantId,
-				challengeId: proof.challenge_id,
-				otpCode: proof.otp_code,
-				otpChannel: EMAIL_OTP_CHANNEL,
-				ownerProofBindingDigest: operationBinding,
-				operation: operation.operation_kind === "evm.export_key" ? WALLET_EMAIL_OTP_EXPORT_OPERATION : WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION
-			});
-			if (!verified.ok) return json$1(verified, { status: verified.code === "invalid_body" ? 400 : 401 });
-			const consumed = operation.operation_kind === "evm.export_key" ? null : await input.ctx.service.emailOtp.consumeEmailOtpGrant({
-				subject: {
-					kind: "provider_identity",
-					orgId: requireAuthorizationValue$1(parseOrgId(authenticated.session.tenantId)),
-					providerSubject: requireAuthorizationValue$1(parseProviderSubject(proof.authority.factor.providerUserId)),
-					walletId: walletIdFromString(authenticated.session.walletId)
-				},
-				loginGrant: verified.loginGrant,
-				otpChannel: EMAIL_OTP_CHANNEL
-			});
-			if (consumed && !consumed.ok) return json$1(consumed, { status: consumed.code === "invalid_body" ? 400 : 401 });
-			if (operation.operation_kind === "evm.export_key") emailOtpUnseal = {
-				grant: verified.loginGrant,
-				challengeId: verified.challengeId
-			};
-			const verifiedChallengeId = consumed?.ok ? consumed.challengeId : verified.challengeId;
-			factor = buildVerifiedWalletOperationEmailOtpFactorResult({
-				tenantId: authenticated.session.tenantId,
-				principalId: authenticated.session.principalId,
-				walletId: walletIdFromString(authenticated.session.walletId),
-				requestOrigin,
-				audience: requestOrigin,
-				factorId: requireAuthorizationValue$1(parseAuthFactorId(`email_otp:${proof.authority.factor.provider}:${proof.authority.factor.providerUserId}`)),
-				authorityRef: authenticated.authorityRef,
-				operation: envelope,
-				challengeId: requireAuthorizationValue$1(parseEmailOtpChallengeId(verifiedChallengeId)),
-				verificationReceiptDigest: parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
-					challengeId: verifiedChallengeId,
-					operationFingerprint: expectedChallenge
-				})))),
-				verifiedAtMs: nowMs,
-				expiresAtMs: Math.min(expiresAtMs, verified.grantExpiresAtMs)
-			});
-			break;
-		}
-	}
+	const verifiedFactor = await verifyEcdsaOperationStepUpFactor({
+		proof,
+		operation: envelope,
+		walletId: walletIdFromString(authenticated.session.walletId),
+		authorityRef: authenticated.authorityRef,
+		authSource: authenticated.session.laneAuthorization.authSource,
+		requestOrigin,
+		expectedChallenge,
+		expiresAtMs,
+		webAuthn: input.ctx.service.webAuthn,
+		emailOtp: input.ctx.service.emailOtp
+	});
+	if (!verifiedFactor.ok) return verifiedFactor.response;
 	const evidenceSet = await input.ctx.service.authorizedOperations.recordVerifiedWalletOperationFactorEvidenceSet({
 		operation: envelope,
 		evidenceId,
 		evidenceSetId,
-		factor
+		factor: verifiedFactor.factor
 	});
 	const authorizedOperationId = requireAuthorizationValue$1(parseAuthorizedOperationId(`ecdsa-step-up-authorized-operation:${operation.operation_id}`));
 	const atomicOperation = await input.ctx.service.authorizedOperations.admitAuthorizedOperation({
@@ -16375,7 +16321,7 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 				evidenceSetDigest: evidenceSet.evidenceSetDigest
 			},
 			quota: { kind: "quota_neutral" },
-			claimedAtMs: nowMs
+			claimedAtMs: Date.now()
 		},
 		material: {
 			walletId: walletIdFromString(authenticated.session.walletId),
@@ -16408,11 +16354,7 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 	const responseAuthorization = {
 		kind: "operation_step_up",
 		evidence_set_digest: evidenceSet.evidenceSetDigest,
-		unseal: emailOtpUnseal ? {
-			kind: "email_otp_grant",
-			grant: emailOtpUnseal.grant,
-			challenge_id: emailOtpUnseal.challengeId
-		} : { kind: "not_requested" }
+		unseal: verifiedFactor.unseal
 	};
 	if (operation.operation_kind === "evm.export_key") {
 		const exportTopology = v2Resolution.kind === "admitted" && v2Resolution.operationKind === "evm.export_key" ? v2Resolution.exportTopology : await resolveStrictEcdsaExportTopology({
@@ -16444,7 +16386,6 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 async function handleEcdsaPoolFillRoute(input) {
 	const startedAt = performance.now();
 	const timing = {
-		queue: null,
 		authenticate: null,
 		material: null,
 		admit: null,
@@ -16479,31 +16420,24 @@ async function executeEcdsaPoolFillRoute(input, timing, workerTimings) {
 	const parsed = input.phase === "init" ? parseRouterAbEcdsaDerivationPoolFillInitRouteRequest(input.body) : parseRouterAbEcdsaDerivationPoolFillStepRouteRequest(input.body);
 	if (!parsed.ok) return json$1(parsed.body, { status: thresholdEcdsaStatusCode(parsed.body) });
 	const request = parsed.request;
-	const queuedAt = performance.now();
-	const gateTicket = await presignPriorityGate.acquire(resolvePresignTrafficClass(request.requestTag));
-	timing.queue = performance.now() - queuedAt;
-	try {
-		const authorized = await authorizeEcdsaPoolFill({
-			ctx: input.ctx,
-			request,
-			timing
-		});
-		if (!authorized.ok) return json$1(authorized.error.body, { status: authorized.error.status });
-		const proxyStartedAt = performance.now();
-		const result = "poolFill" in request ? await runtime.initializePoolFill({
-			binding: authorized.binding,
-			request: ecdsaPoolFillInitRuntimeRequest(request),
-			onServerTiming: collectEcdsaPresignWorkerTiming.bind(void 0, workerTimings)
-		}) : await runtime.advancePoolFill({
-			binding: authorized.binding,
-			request: ecdsaPoolFillStepRuntimeRequest(request),
-			onServerTiming: collectEcdsaPresignWorkerTiming.bind(void 0, workerTimings)
-		});
-		timing.proxy = performance.now() - proxyStartedAt;
-		return json$1(result, { status: thresholdEcdsaStatusCode(result) });
-	} finally {
-		gateTicket.release();
-	}
+	const authorized = await authorizeEcdsaPoolFill({
+		ctx: input.ctx,
+		request,
+		timing
+	});
+	if (!authorized.ok) return json$1(authorized.error.body, { status: authorized.error.status });
+	const proxyStartedAt = performance.now();
+	const result = "poolFill" in request ? await runtime.initializePoolFill({
+		binding: authorized.binding,
+		request: ecdsaPoolFillInitRuntimeRequest(request),
+		onServerTiming: collectEcdsaPresignWorkerTiming.bind(void 0, workerTimings)
+	}) : await runtime.advancePoolFill({
+		binding: authorized.binding,
+		request: ecdsaPoolFillStepRuntimeRequest(request),
+		onServerTiming: collectEcdsaPresignWorkerTiming.bind(void 0, workerTimings)
+	});
+	timing.proxy = performance.now() - proxyStartedAt;
+	return json$1(result, { status: thresholdEcdsaStatusCode(result) });
 }
 function poolFillMaterialActivation(request) {
 	return "poolFill" in request ? request.poolFill.scope.material_activation : null;
@@ -16642,6 +16576,7 @@ async function authorizeEcdsaPoolFill(input) {
 			const admitted = validated;
 			const materialStartedAt = performance.now();
 			const activeMaterial = await input.ctx.service.walletRegistration.resolveEcdsaMaterialActivation({
+				source: { kind: "database" },
 				walletId: String(session.walletId),
 				materialActivation: routerAbMpcMaterialActivationRefToWire(admitted.materialActivation)
 			});
@@ -16730,43 +16665,6 @@ function ecdsaPoolFillStepRuntimeRequest(request) {
 		...request.requestTag === void 0 ? {} : { requestTag: request.requestTag }
 	};
 }
-function resolvePresignPriorityTurn(resolve) {
-	setTimeout(resolve, 5);
-}
-function waitForPresignPriorityTurn() {
-	return new Promise(resolvePresignPriorityTurn);
-}
-var PresignPriorityGate = class {
-	constructor() {
-		this.foregroundInFlight = 0;
-		this.backgroundInFlight = 0;
-	}
-	async acquire(trafficClass) {
-		if (trafficClass === "foreground") {
-			this.foregroundInFlight += 1;
-			return this.createTicket("foreground");
-		}
-		while (!this.canRunBackgroundNow()) await waitForPresignPriorityTurn();
-		this.backgroundInFlight += 1;
-		return this.createTicket("background");
-	}
-	createTicket(trafficClass) {
-		let released = false;
-		return { release: () => {
-			if (released) return;
-			released = true;
-			if (trafficClass === "foreground") this.foregroundInFlight = Math.max(0, this.foregroundInFlight - 1);
-			else this.backgroundInFlight = Math.max(0, this.backgroundInFlight - 1);
-		} };
-	}
-	canRunBackgroundNow() {
-		return this.foregroundInFlight === 0 && this.backgroundInFlight === 0;
-	}
-};
-function resolvePresignTrafficClass(requestTag) {
-	return requestTag === "background_presign_pool_refill" ? "background" : "foreground";
-}
-const presignPriorityGate = new PresignPriorityGate();
 function strictEcdsaAuthorizationFailureStatus(failure) {
 	switch (failure.code) {
 		case "unauthorized": return 401;
@@ -17149,6 +17047,7 @@ async function authorizeStrictEcdsaExport(input) {
 			scope: operation.normal_signing_scope
 		})) return strictEcdsaExportFailure(403, "scope_mismatch", "ECDSA export operation scope does not match the request");
 		const activeMaterial = await input.ctx.service.walletRegistration.resolveEcdsaMaterialActivation({
+			source: { kind: "database" },
 			walletId: operation.wallet_id,
 			materialActivation: input.request.material_activation
 		});
@@ -17453,7 +17352,6 @@ async function handleThresholdEcdsa(ctx) {
 }
 //#endregion
 //#region src/router/domains/emailOtp/emailOtpRouteHandlers.ts
-const EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN = "seams/email-otp/factor-release/v1";
 function decodeEmailOtpFactorSecret32(value) {
 	const magnitude = base64UrlDecode(value);
 	if (magnitude.length === 0 || magnitude.length > 32) {
@@ -17467,7 +17365,7 @@ function decodeEmailOtpFactorSecret32(value) {
 }
 function emailOtpFactorReleaseAad(input) {
 	return new TextEncoder().encode([
-		EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN,
+		EMAIL_OTP_FACTOR_RELEASE_AAD_DOMAIN_V1,
 		input.walletId,
 		input.enrollmentId,
 		input.enrollmentSealKeyVersion,
@@ -17481,19 +17379,11 @@ async function sealEmailOtpFactorSecretForWorker(input) {
 		factorSecret32 = decodeEmailOtpFactorSecret32(input.factorSecret32B64u);
 		workerPublicKey65 = base64UrlDecode(input.workerEphemeralPublicKey65B64u);
 	} catch {
-		return {
-			ok: false,
-			code: "invalid_body",
-			message: "Email OTP factor release key is invalid"
-		};
+		return failure("invalid_body", "Email OTP factor release key is invalid");
 	}
 	if (workerPublicKey65.length !== 65 || workerPublicKey65[0] !== 4) {
 		factorSecret32.fill(0);
-		return {
-			ok: false,
-			code: "invalid_body",
-			message: "Email OTP factor release key is invalid"
-		};
+		return failure("invalid_body", "Email OTP factor release key is invalid");
 	}
 	try {
 		const workerPublicKey = await crypto.subtle.importKey("raw", workerPublicKey65, {
@@ -17525,11 +17415,7 @@ async function sealEmailOtpFactorSecretForWorker(input) {
 			ciphertextB64u: base64UrlEncode(ciphertext)
 		};
 	} catch {
-		return {
-			ok: false,
-			code: "factor_release_failed",
-			message: "Email OTP factor release encryption failed"
-		};
+		return failure("factor_release_failed", "Email OTP factor release encryption failed");
 	} finally {
 		factorSecret32.fill(0);
 	}
@@ -17541,11 +17427,7 @@ async function handleEmailOtpDevCleanupGoogleRegistrationRoute(input) {
 		const code = verified.code || "not_verified";
 		return {
 			status: code === "internal" ? 500 : code === "not_configured" || code === "unsupported" ? 501 : code === "invalid_body" ? 400 : 401,
-			body: {
-				ok: false,
-				code,
-				message: verified.message || "Google login failed"
-			}
+			body: failure(code, verified.message || "Google login failed")
 		};
 	}
 	const runtimePolicyScope = isPlainObject(body.runtimePolicyScope) ? body.runtimePolicyScope : null;
@@ -17562,30 +17444,18 @@ async function handleEmailOtpDevCleanupGoogleRegistrationRoute(input) {
 async function handleEmailOtpRegistrationSealRoute(input) {
 	if (!isPlainObject(input.body)) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "Invalid body"
-		}
+		body: failure("invalid_body", "Invalid body")
 	};
 	const allowedFields = new Set(["walletId", "wrappedCiphertext"]);
 	for (const field of Object.keys(input.body)) if (!allowedFields.has(field)) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: `Unsupported field: ${field}`
-		}
+		body: failure("invalid_body", `Unsupported field: ${field}`)
 	};
 	const walletId = normalizeOptionalTrimmedString(input.body.walletId);
 	const wrappedCiphertext = normalizeOptionalTrimmedString(input.body.wrappedCiphertext);
 	if (!walletId || !wrappedCiphertext) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing walletId or wrappedCiphertext"
-		}
+		body: failure("invalid_body", "Missing walletId or wrappedCiphertext")
 	};
 	const result = await input.service.applyEmailOtpServerSeal({ wrappedCiphertext });
 	return {
@@ -17599,11 +17469,7 @@ async function handleEmailOtpRegistrationSealRoute(input) {
 async function handleEmailOtpDevOutboxRoute(input) {
 	if (!isPlainObject(input.body)) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "Invalid body"
-		}
+		body: failure("invalid_body", "Invalid body")
 	};
 	const allowedFields = new Set([
 		"idToken",
@@ -17613,11 +17479,7 @@ async function handleEmailOtpDevOutboxRoute(input) {
 	]);
 	for (const field of Object.keys(input.body)) if (!allowedFields.has(field)) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: `Unsupported field: ${field}`
-		}
+		body: failure("invalid_body", `Unsupported field: ${field}`)
 	};
 	const idToken = normalizeOptionalTrimmedString(input.body.idToken);
 	const walletId = normalizeOptionalTrimmedString(input.body.walletId);
@@ -17625,30 +17487,18 @@ async function handleEmailOtpDevOutboxRoute(input) {
 	const challengeSubjectId = normalizeOptionalTrimmedString(input.body.challengeSubjectId);
 	if (!idToken || !walletId) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "Missing idToken or walletId"
-		}
+		body: failure("invalid_body", "Missing idToken or walletId")
 	};
 	if (challengeSubjectId && !challengeId) return {
 		status: 400,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message: "challengeSubjectId requires the exact challengeId it belongs to"
-		}
+		body: failure("invalid_body", "challengeSubjectId requires the exact challengeId it belongs to")
 	};
 	const verified = await input.service.verifyGoogleLogin({ idToken });
 	if (!verified.ok || !verified.verified || !verified.userId) {
 		const code = verified.code || "not_verified";
 		return {
 			status: code === "internal" ? 500 : code === "not_configured" ? 501 : 401,
-			body: {
-				ok: false,
-				code,
-				message: verified.message || "Google login failed"
-			}
+			body: failure(code, verified.message || "Google login failed")
 		};
 	}
 	const result = await input.service.readEmailOtpOutboxEntry({
@@ -17894,6 +17744,7 @@ async function resolveWalletEmailOtpChallengeSignerSelection(args) {
 		};
 	}
 	const resolved = await args.ctx.service.walletRegistration.resolveEcdsaMaterialActivation({
+		source: { kind: "database" },
 		walletId: String(args.authority.walletId),
 		materialActivation: routerAbMpcMaterialActivationRefToWire(ecdsaActivation.materialActivation)
 	});
@@ -19078,7 +18929,12 @@ function bootstrapError(code, message, status) {
 //#region src/router/transport/fetch/routes/syncAccount.ts
 function syncAccountResponseStatus(result) {
 	if (result.ok && result.verified) return 200;
-	switch (result.code) {
+	return syncAccountFailureStatus(result.code);
+}
+function syncAccountFailureStatus(code) {
+	switch (code) {
+		case "wallet_home_unavailable": return 503;
+		case "wallet_home_conflict": return 409;
 		case "internal": return 500;
 		case "ed25519_not_provisioned": return 409;
 		default: return 400;
@@ -19108,7 +18964,7 @@ async function handleSyncAccount(ctx) {
 		const parsed = parseSyncAccountOptionsRequest(await readJson(ctx.request));
 		if (!parsed.ok) return json$1(parsed.body, { status: parsed.status });
 		const result = await ctx.service.webAuthn.createWebAuthnSyncAccountOptions(parsed.request);
-		return json$1(result, { status: result.ok ? 200 : result.code === "internal" ? 500 : 400 });
+		return json$1(result, { status: result.ok ? 200 : syncAccountFailureStatus(result.code) });
 	}
 	if (ctx.pathname === "/sync-account/verify") {
 		const parsed = parseSyncAccountVerifyRequest({
@@ -19120,11 +18976,7 @@ async function handleSyncAccount(ctx) {
 		let responseBody = result;
 		if (result.ok && result.verified && result.thresholdEd25519) {
 			const custodyKeyManifestDigestB64u = result.custodyKeyManifestDigestB64u;
-			if (!custodyKeyManifestDigestB64u) return json$1({
-				ok: false,
-				code: "internal",
-				message: "Sync verification did not resolve the wallet key manifest"
-			}, { status: 500 });
+			if (!custodyKeyManifestDigestB64u) return jsonFailure(500, "internal", "Sync verification did not resolve the wallet key manifest");
 			const thresholdEd25519 = result.thresholdEd25519;
 			const walletId = String(result.walletId || "").trim();
 			const nearAccountId = String(result.nearAccountId || "").trim();
@@ -19132,11 +18984,7 @@ async function handleSyncAccount(ctx) {
 			const signerSlot = Number(result.signerSlot);
 			const walletBinding = result.walletBinding;
 			const credentialIdB64u = String(result.credentialIdB64u || "").trim();
-			if (!thresholdEd25519 || !walletId || !nearAccountId || !nearEd25519SigningKeyId || !Number.isSafeInteger(signerSlot) || signerSlot < 1 || !walletBinding || !credentialIdB64u || !String(result.publicKey || "").trim() || !String(result.credentialPublicKeyB64u || "").trim() || String(walletBinding.walletId) !== walletId || String(walletBinding.nearAccountId) !== nearAccountId || String(walletBinding.nearEd25519SigningKeyId) !== nearEd25519SigningKeyId || walletBinding.signerSlot !== signerSlot) return json$1({
-				ok: false,
-				code: "internal",
-				message: "verified passkey wallet is missing its Ed25519 Yao identity"
-			}, { status: 500 });
+			if (!thresholdEd25519 || !walletId || !nearAccountId || !nearEd25519SigningKeyId || !Number.isSafeInteger(signerSlot) || signerSlot < 1 || !walletBinding || !credentialIdB64u || !String(result.publicKey || "").trim() || !String(result.credentialPublicKeyB64u || "").trim() || String(walletBinding.walletId) !== walletId || String(walletBinding.nearAccountId) !== nearAccountId || String(walletBinding.nearEd25519SigningKeyId) !== nearEd25519SigningKeyId || walletBinding.signerSlot !== signerSlot) return jsonFailure(500, "internal", "verified passkey wallet is missing its Ed25519 Yao identity");
 			const authority = passkeyWalletAuthAuthorityForMethod({
 				walletId: walletBinding.walletId,
 				rpId: walletBinding.rpId,
@@ -19148,29 +18996,17 @@ async function handleSyncAccount(ctx) {
 				rpId: authority.verifier.rpId,
 				credentialIdB64u: authority.factor.credentialIdB64u
 			});
-			if (!activeAuthority.ok || activeAuthority.walletAuthority.authorityId !== result.walletAuthorityId || activeAuthority.authMethod.walletAuthMethodId !== result.walletAuthMethodId) return json$1({
-				ok: false,
-				code: "internal",
-				message: "Verified passkey wallet authority is unavailable"
-			}, { status: 500 });
+			if (!activeAuthority.ok || activeAuthority.walletAuthority.authorityId !== result.walletAuthorityId || activeAuthority.authMethod.walletAuthMethodId !== result.walletAuthMethodId) return jsonFailure(500, "internal", "Verified passkey wallet authority is unavailable");
 			const authorityRef = await walletAuthAuthorityRef({ authority });
 			const principalId = parsePrincipalId(walletId);
 			const mintId = parseWalletSessionMintId(parsed.request.challengeId);
-			if (!principalId.ok || !mintId.ok) return json$1({
-				ok: false,
-				code: "internal",
-				message: "Verified passkey Wallet Session identity is invalid"
-			}, { status: 500 });
+			if (!principalId.ok || !mintId.ok) return jsonFailure(500, "internal", "Verified passkey Wallet Session identity is invalid");
 			const issuedAtMs = Date.now();
 			const expiresAtMs = issuedAtMs + DEFAULT_WALLET_SESSION_TTL_MS;
 			const origin = parseSessionOrigin(parsed.request.expected_origin);
 			const factorId = parseAuthFactorId(`passkey:${credentialIdB64u}`);
 			const credentialId = parseWebAuthnCredentialIdB64u(credentialIdB64u);
-			if (!factorId.ok || !credentialId.ok) return json$1({
-				ok: false,
-				code: "internal",
-				message: "Verified passkey factor identity is invalid"
-			}, { status: 500 });
+			if (!factorId.ok || !credentialId.ok) return jsonFailure(500, "internal", "Verified passkey factor identity is invalid");
 			const proof = await ctx.service.authorizedOperations.buildVerifiedOwnerProof({
 				purpose: "wallet_session",
 				proofId: parseVerifiedOwnerProofId(`sync-account:${parsed.request.challengeId}`),
@@ -19188,11 +19024,7 @@ async function handleSyncAccount(ctx) {
 					expiresAtMs
 				})
 			});
-			if (proof.purpose !== "wallet_session") return json$1({
-				ok: false,
-				code: "internal",
-				message: "Owner proof purpose is invalid"
-			}, { status: 500 });
+			if (proof.purpose !== "wallet_session") return jsonFailure(500, "internal", "Owner proof purpose is invalid");
 			const bootstrap = await issueSyncAccountBootstrapV1({
 				ctx,
 				result: {
@@ -19233,11 +19065,7 @@ async function handleSyncAccount(ctx) {
 				message: "Wallet Session sync is already committed; retry the exact method",
 				...bootstrap.committed
 			}, { status: 409 });
-			if (bootstrap.kind === "error") return json$1({
-				ok: false,
-				code: bootstrap.code,
-				message: bootstrap.message
-			}, { status: bootstrap.status });
+			if (bootstrap.kind === "error") return jsonFailure(bootstrap.status, bootstrap.code, bootstrap.message);
 			responseBody = bootstrap.body;
 		}
 		return json$1(responseBody, { status: syncAccountResponseStatus(result) });
@@ -21780,11 +21608,13 @@ async function handleOwnerWalletExecutionLanePreflight(ctx) {
 		};
 	} else {
 		const validated = await validateRouterAbEcdsaDerivationWalletSessionInputs({
+			materialActivation: routerAbMpcMaterialActivationRefToWire(request.expectedMaterialActivation),
 			headers,
 			authorizationSessions: ctx.service.authorizationSessions,
 			operationKind: EVM_ECDSA_MPC_OPERATION_KINDS.signTransaction
 		});
 		if (!validated.ok) return validationFailure(validated);
+		if (validated.kind === "wallet_session_operation_credential_exhausted_candidate_v1") return validationFailure(walletSessionFailure("wallet_session_unavailable"));
 		walletIdRaw = String(validated.admission.context.authorization.session.walletId);
 		authorization = {
 			kind: "wallet_auth_method",
@@ -21832,22 +21662,14 @@ async function handleWebAuthnAuthenticators(ctx) {
 	if (ctx.pathname !== "/webauthn/authenticators") return null;
 	try {
 		const token = extractBearerCredential(ctx.request.headers);
-		if (!token) return json$1({
-			ok: false,
-			code: "unauthorized",
-			message: "No valid Wallet Session"
-		}, { status: 401 });
+		if (!token) return jsonFailure(401, "unauthorized", "No valid Wallet Session");
 		const nowMs = Date.now();
 		const exact = await ctx.service.authorizationSessions.readWalletSessionAuthorizationV2ByOperationCredential({
 			tenantId: ctx.service.authorizationSessions.tenantId,
 			token,
 			nowMs
 		});
-		if (!exact) return json$1({
-			ok: false,
-			code: "unauthorized",
-			message: "No valid Wallet Session"
-		}, { status: 401 });
+		if (!exact) return jsonFailure(401, "unauthorized", "No valid Wallet Session");
 		const rpIdFromQuery = String(ctx.url.searchParams.get("rpId") || ctx.url.searchParams.get("rp_id") || "").trim();
 		const result = await ctx.service.webAuthn.listWebAuthnAuthenticatorsForUser({
 			userId: String(exact.authorization.session.walletId),
@@ -21856,11 +21678,7 @@ async function handleWebAuthnAuthenticators(ctx) {
 		if (!result.ok) return json$1(result, { status: result.code === "not_supported" ? 501 : result.code === "invalid_args" ? 400 : 500 });
 		return json$1(result, { status: 200 });
 	} catch (e) {
-		return json$1({
-			ok: false,
-			code: "internal",
-			message: e?.message || "Internal error"
-		}, { status: 500 });
+		return jsonFailure(500, "internal", e?.message || "Internal error");
 	}
 }
 //#endregion
@@ -21939,23 +21757,15 @@ function parseOptionalPositiveInteger(raw, fieldName) {
 		value: Math.floor(value)
 	};
 }
-function parseAuthProviderAction(input) {
-	const provider = normalizeOptionalTrimmedString(input.provider);
-	const action = normalizeOptionalTrimmedString(input.action);
-	if (provider === "passkey" && action === "options") return { kind: "passkey_options" };
-	if (provider === "passkey" && action === "verify") return { kind: "passkey_verify" };
-	if (provider === "google" && action === "options") return { kind: "google_options" };
-	if (provider === "google" && action === "verify") return { kind: "google_verify" };
-	if (provider === "github" && action === "options") return { kind: "github_options" };
-	return null;
-}
 function parseAuthProviderActionPath(pathname) {
-	const parts = String(pathname || "").split("/").filter(Boolean);
-	if (parts.length !== 3 || parts[0] !== "auth") return null;
-	return parseAuthProviderAction({
-		provider: parts[1],
-		action: parts[2]
-	});
+	switch (pathname) {
+		case "/auth/passkey/options": return { kind: "passkey_options" };
+		case "/auth/passkey/verify": return { kind: "passkey_verify" };
+		case "/auth/google/options": return { kind: "google_options" };
+		case "/auth/google/verify": return { kind: "google_verify" };
+		case "/auth/github/options": return { kind: "github_options" };
+		default: return null;
+	}
 }
 function parsePasskeyLoginOptionsRequest(raw) {
 	const body = requireJsonObject(raw);
@@ -22133,11 +21943,7 @@ async function requireExactWalletSession(ctx) {
 	const token = extractBearerCredential(ctx.request.headers);
 	if (!token) return {
 		ok: false,
-		response: json$1({
-			ok: false,
-			code: "unauthorized",
-			message: "No valid Wallet Session"
-		}, { status: 401 })
+		response: jsonFailure(401, "unauthorized", "No valid Wallet Session")
 	};
 	try {
 		const context = await ctx.service.authorizationSessions.readWalletSessionAuthorizationV2ByOperationCredential({
@@ -22147,11 +21953,7 @@ async function requireExactWalletSession(ctx) {
 		});
 		if (!context) return {
 			ok: false,
-			response: json$1({
-				ok: false,
-				code: "unauthorized",
-				message: "No valid Wallet Session"
-			}, { status: 401 })
+			response: jsonFailure(401, "unauthorized", "No valid Wallet Session")
 		};
 		return {
 			ok: true,
@@ -22160,11 +21962,7 @@ async function requireExactWalletSession(ctx) {
 	} catch {
 		return {
 			ok: false,
-			response: json$1({
-				ok: false,
-				code: "wallet_session_unavailable",
-				message: "Wallet Session is unavailable"
-			}, { status: 503 })
+			response: jsonFailure(503, "wallet_session_unavailable", "Wallet Session is unavailable")
 		};
 	}
 }
@@ -22177,19 +21975,11 @@ async function requireExactPasskeyStepUp(input) {
 	const walletId = String(input.context.authorization.session.walletId);
 	if (String(result.userId).trim() !== walletId) return {
 		ok: false,
-		response: json$1({
-			ok: false,
-			code: "forbidden",
-			message: "Step-up user mismatch"
-		}, { status: 403 })
+		response: jsonFailure(403, "forbidden", "Step-up user mismatch")
 	};
 	if (result.walletAuthMethodId !== input.context.authMethod.walletAuthMethodId || result.walletAuthorityId !== input.context.authority.authorityId) return {
 		ok: false,
-		response: json$1({
-			ok: false,
-			code: "forbidden",
-			message: "Step-up authority mismatch"
-		}, { status: 403 })
+		response: jsonFailure(403, "forbidden", "Step-up authority mismatch")
 	};
 	return { ok: true };
 }
@@ -22247,11 +22037,7 @@ async function handleAuth(ctx) {
 			default: assertNeverAuthIdentityMutation(command);
 		}
 		const subject = command.request.subject;
-		if (subject.startsWith("near:")) return json$1({
-			ok: false,
-			code: "not_supported",
-			message: "near: subjects cannot be unlinked"
-		}, { status: 400 });
+		if (subject.startsWith("near:")) return jsonFailure(400, "not_supported", "near: subjects cannot be unlinked");
 		const out = await ctx.service.identity.unlinkIdentity({
 			userId: walletId,
 			subject
@@ -22274,6 +22060,8 @@ async function handleAuth(ctx) {
 			const parsed = parsePasskeyLoginOptionsRequest(await readJson(ctx.request));
 			if (!parsed.ok) return json$1(parsed.body, { status: parsed.status });
 			const result = await ctx.service.webAuthn.createWebAuthnLoginOptions(parsed.request);
+			if (result.code === "wallet_home_unavailable") return json$1(result, { status: 503 });
+			if (result.code === "wallet_home_conflict") return json$1(result, { status: 409 });
 			return json$1(result, { status: result.ok ? 200 : result.code === "internal" ? 500 : 400 });
 		}
 		case "passkey_verify": {
@@ -22308,16 +22096,8 @@ async function handleAuth(ctx) {
 				publishableKeyAuth: ctx.opts.publishableKeyAuth,
 				orgProjectEnv: ctx.opts.orgProjectEnv
 			});
-			if (!runtimePolicyScope.ok) return json$1({
-				ok: false,
-				code: runtimePolicyScope.code,
-				message: runtimePolicyScope.message
-			}, { status: runtimePolicyScope.status });
-			if (!runtimePolicyScope.scope) return json$1({
-				ok: false,
-				code: "runtime_policy_scope_unavailable",
-				message: "Google Email OTP requires an active managed runtime policy scope"
-			}, { status: 500 });
+			if (!runtimePolicyScope.ok) return jsonFailure(runtimePolicyScope.status, runtimePolicyScope.code, runtimePolicyScope.message);
+			if (!runtimePolicyScope.scope) return jsonFailure(500, "runtime_policy_scope_unavailable", "Google Email OTP requires an active managed runtime policy scope");
 			const result = await ctx.service.identity.verifyGoogleLogin(parsed.request);
 			if (!result.ok || !result.verified || !result.providerSubject) return json$1(result, { status: result.code === "internal" ? 500 : 400 });
 			const resolution = await ctx.service.identity.resolveGoogleEmailOtpSession({
@@ -22334,40 +22114,6 @@ async function handleAuth(ctx) {
 	}
 }
 //#endregion
-//#region src/router/transport/fetch/routes/nearPublicKeys.ts
-async function handleNearPublicKeys(ctx) {
-	if (ctx.method !== "GET") return null;
-	if (ctx.pathname !== "/near/public-keys") return null;
-	try {
-		const token = extractBearerCredential(ctx.request.headers);
-		if (!token) return json$1({
-			ok: false,
-			code: "unauthorized",
-			message: "No valid Wallet Session"
-		}, { status: 401 });
-		const nowMs = Date.now();
-		const exact = await ctx.service.authorizationSessions.readWalletSessionAuthorizationV2ByOperationCredential({
-			tenantId: ctx.service.authorizationSessions.tenantId,
-			token,
-			nowMs
-		});
-		if (!exact) return json$1({
-			ok: false,
-			code: "unauthorized",
-			message: "No valid Wallet Session"
-		}, { status: 401 });
-		const result = await ctx.service.nearFunding.listNearPublicKeysForUser({ userId: String(exact.authorization.session.walletId) });
-		if (!result.ok) return json$1(result, { status: result.code === "not_supported" ? 501 : result.code === "invalid_args" ? 400 : 500 });
-		return json$1(result, { status: 200 });
-	} catch (e) {
-		return json$1({
-			ok: false,
-			code: "internal",
-			message: e?.message || "Internal error"
-		}, { status: 500 });
-	}
-}
-//#endregion
 //#region src/router/framework/ror/normalize.ts
 function sanitizeRorOrigins(origins) {
 	const list = Array.isArray(origins) ? origins : [];
@@ -22482,10 +22228,166 @@ async function handleWellKnown(ctx) {
 	});
 }
 //#endregion
+//#region src/router/transport/fetch/routes/deviceLinkingResponses.ts
+function projectLinkSessionStateV1(state) {
+	switch (state.state) {
+		case "displaying_qr": return { state: "displaying_qr" };
+		case "claimed":
+		case "awaiting_target_factor":
+		case "awaiting_source_contribution":
+		case "provisioning": return {
+			state: state.state,
+			deviceId: state.deviceId
+		};
+		case "authority_pending_local_install": return {
+			state: "authority_pending_local_install",
+			deviceId: state.deviceId,
+			authorityId: state.authorityId,
+			packageSetDigestB64u: state.packageSetDigestB64u
+		};
+		case "active": return {
+			state: "active",
+			deviceId: state.deviceId,
+			authorityId: state.authorityId,
+			activatedAtMs: state.activatedAtMs
+		};
+		case "failed_before_commit": return {
+			state: "failed_before_commit",
+			error: state.error
+		};
+		case "cancelled": return {
+			state: "cancelled",
+			cancelledAtMs: state.cancelledAtMs
+		};
+		case "expired": return {
+			state: "expired",
+			expiredAtMs: state.expiredAtMs
+		};
+		default: return assertNeverLinkSessionStateV1(state);
+	}
+}
+function projectSession(record) {
+	return {
+		kind: "linked_device_session_projection_v1",
+		linkSessionId: record.linkSessionId,
+		qrPayload: record.qrPayload,
+		revision: record.revision,
+		createdAtMs: record.createdAtMs,
+		updatedAtMs: record.updatedAtMs,
+		state: projectLinkSessionStateV1(record.state)
+	};
+}
+function invalidStateResponse(record) {
+	return json$1({
+		ok: false,
+		outcome: "invalid_state",
+		state: record.state.state,
+		session: projectSession(record)
+	}, { status: 409 });
+}
+function sessionProjectionResponse(record, outcome) {
+	return json$1({
+		ok: true,
+		outcome,
+		session: projectSession(record)
+	}, { status: 200 });
+}
+function targetCredentialResultResponse(record, outcome, targetCredential) {
+	return json$1({
+		ok: true,
+		outcome,
+		targetCredential,
+		session: projectSession(record)
+	}, { status: 200 });
+}
+function exportRootWriteResponse(result) {
+	return result.outcome === "conflict" ? json$1({
+		ok: false,
+		code: result.reason ?? "conflict",
+		message: "export-root relay conflict"
+	}, { status: 409 }) : json$1({
+		ok: true,
+		outcome: result.outcome
+	}, { status: 200 });
+}
+function invalidInputResponse(message) {
+	return json$1({
+		ok: false,
+		outcome: "invalid_input",
+		code: "invalid_input",
+		message
+	}, { status: 400 });
+}
+function notSupportedResponse(message = "Device linking is not configured") {
+	return json$1({
+		ok: false,
+		code: "not_supported",
+		message
+	}, { status: 501 });
+}
+function notFoundResponse() {
+	return json$1({
+		ok: false,
+		code: "not_found",
+		message: "Linked-device session not found"
+	}, { status: 404 });
+}
+function methodNotAllowedResponse$2() {
+	return json$1({
+		ok: false,
+		code: "method_not_allowed",
+		message: "Method is not allowed"
+	}, { status: 405 });
+}
+function authDeniedResponse$2(result) {
+	if (result.code === "unavailable") return json$1({
+		ok: false,
+		code: result.code,
+		message: result.message
+	}, { status: 503 });
+	return json$1({
+		ok: false,
+		outcome: "unauthorized",
+		code: result.code,
+		message: result.message
+	}, { status: result.code === "expired" ? 410 : 401 });
+}
+//#endregion
+//#region src/core/deviceLinking/linkedDeviceBootstrap.ts
+function linkedDeviceBootstrapFailure(error) {
+	if (error && typeof error === "object" && "code" in error && (error.code === "home_conflict" || error.code === "home_unavailable")) return error.code;
+	return null;
+}
+//#endregion
+//#region ../shared-ts/src/utils/exactKeys.ts
+/**
+* True when `value` is a non-array object whose own enumerable string keys are exactly `keys`.
+*
+* A key whose value is `undefined` still counts as present. Symbol, non-enumerable and inherited
+* keys are not counted, and the prototype is not checked. A list that repeats a key never matches.
+* Kept apart from validation.ts, which the wallet iframe's boot path loads.
+*/
+function hasExactKeys$1(value, keys) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const actual = Object.keys(value);
+	return actual.length === keys.length && actual.every((key) => keys.includes(key));
+}
+//#endregion
 //#region src/core/deviceLinking/requestProof.ts
 function parseLinkedDeviceRequestProofV1(raw) {
 	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("linked-device request proof must be an object");
-	if (!isLinkedDeviceRequestProofRecordV1(raw)) throw new Error("record contains invalid fields");
+	if (!hasExactKeys$1(raw, [
+		"kind",
+		"linkSessionId",
+		"devicePublicKeyDigestB64u",
+		"requestNonceB64u",
+		"method",
+		"canonicalPath",
+		"bodyDigestB64u",
+		"issuedAtMs",
+		"expiresAtMs",
+		"signatureB64u"
+	])) throw new Error("record contains invalid fields");
 	const record = raw;
 	if (record.kind !== "linked_device_request_proof_v1") throw new Error("linked-device request proof kind is invalid");
 	const linkSessionId = parseSessionId$1(record.linkSessionId);
@@ -22542,9 +22444,6 @@ function parseFixedB64u(raw, expectedBytes, field) {
 	if (bytes.length !== expectedBytes || base64UrlEncode(bytes) !== raw) throw new Error(`${field} is invalid`);
 	return raw;
 }
-function isLinkedDeviceRequestProofRecordV1(value) {
-	return Object.keys(value).sort().join("|") === "bodyDigestB64u|canonicalPath|devicePublicKeyDigestB64u|expiresAtMs|issuedAtMs|kind|linkSessionId|method|requestNonceB64u|signatureB64u";
-}
 //#endregion
 //#region src/router/transport/fetch/routes/deviceLinking.ts
 const DEVICE_LINKING_BASE = "/wallet/device-linking/v1/sessions";
@@ -22581,6 +22480,11 @@ async function handleDeviceLinking(ctx) {
 			default: return assertNever$1(action);
 		}
 	} catch (error) {
+		const bootstrapFailure = linkedDeviceBootstrapFailure(error);
+		if (bootstrapFailure) return sessionResultResponse({
+			outcome: bootstrapFailure,
+			message: "Linked-device bootstrap authority failed"
+		});
 		if (error instanceof DeviceLinkingInputError) return invalidInputResponse(error.message);
 		return json$1({
 			ok: false,
@@ -22592,7 +22496,7 @@ async function handleDeviceLinking(ctx) {
 async function handleCreate(ctx, service, nowMs) {
 	if (ctx.method !== "POST") return methodNotAllowedResponse$2();
 	const bodyDigestB64u = await requestBodyDigest$1(ctx.request);
-	const rawBody = await readJsonBody(ctx.request);
+	const rawBody = await readJson(ctx.request);
 	const body = parseBoundary$1(() => parseCreateRequest(rawBody));
 	const keyDigest = await computeDevicePublicKeyDigestB64u(body.payload.devicePublicKeyB64u);
 	const proof = parseBoundary$1(() => parseRequestProofHeader(ctx.request));
@@ -22669,7 +22573,7 @@ async function handleApproval(ctx, service, rawLinkSessionId, nowMs) {
 		});
 		if (!session) return notFoundResponse();
 		const ownerMismatch = requireOwnerMatchesClaimedWallet(authentication.owner, session);
-		if (ownerMismatch) return ownerMismatch;
+		if (ownerMismatch) return authDeniedResponse$2(ownerMismatch);
 		if (authentication.owner.walletId !== approval.walletId) return authDeniedResponse$2({
 			kind: "denied",
 			code: "unauthorized",
@@ -22753,6 +22657,7 @@ async function handleCredential(ctx, service, rawLinkSessionId, nowMs) {
 async function handleSourceContributionPreparation(ctx, service, rawLinkSessionId, nowMs) {
 	const owner = await authenticateOwnerForSession(ctx, service, parseSessionId(rawLinkSessionId), nowMs);
 	if (owner.kind !== "authorized") return ownerSessionResponse(owner);
+	if (isLinkSessionTerminalFailureV1(owner.session.state)) return invalidStateResponse(owner.session);
 	if (ctx.method !== "GET") return methodNotAllowedResponse$2();
 	const preparation = owner.session.sourceContributionPreparation;
 	if (!preparation) return new Response(null, { status: 204 });
@@ -22803,10 +22708,6 @@ async function handleSourceContribution(ctx, service, rawLinkSessionId, nowMs) {
 	}));
 	return sessionProjectionResponse(committed.session, committed.kind === "replayed" ? "replayed" : recorded.outcome);
 }
-/**
-* A precommit failure's reason is a single token. The installer's message
-* keeps its words, joined, so the session still says what failed.
-*/
 function precommitFailureReasonV1(message) {
 	const token = message.trim().replace(/\s+/g, "_").replace(/[\u0000-\u001f\u007f]/g, "");
 	return token.length > 0 ? token : "authority_commit_failed";
@@ -22815,6 +22716,7 @@ async function handleSourceContributionExecute(ctx, service, rawLinkSessionId, n
 	if (ctx.method !== "POST") return methodNotAllowedResponse$2();
 	const owner = await authenticateOwnerForSession(ctx, service, parseSessionId(rawLinkSessionId), nowMs);
 	if (owner.kind !== "authorized") return ownerSessionResponse(owner);
+	if (isLinkSessionTerminalFailureV1(owner.session.state)) return invalidStateResponse(owner.session);
 	const router = service.sourceContributionRouter;
 	if (!router) return notSupportedResponse("Ed25519 source-preserving linking is not configured");
 	const preparation = requireEd25519SourceContributionPreparation(owner.session);
@@ -22887,8 +22789,6 @@ async function handleEmailOtpBaseFactor(ctx, service, rawLinkSessionId, nowMs) {
 	const authenticated = await authenticateOwnerForSession(ctx, service, parseSessionId(rawLinkSessionId), nowMs);
 	if (authenticated.kind !== "authorized") return ownerSessionResponse(authenticated);
 	const session = authenticated.session;
-	const ownerMismatch = requireOwnerMatchesClaimedWallet(authenticated.owner, session);
-	if (ownerMismatch) return ownerMismatch;
 	if (session.state.state !== "claimed" || session.qrPayload.targetFactor.kind !== "email_otp" || !session.claimTranscript) return invalidStateResponse(session);
 	const walletId = session.claimTranscript.value.walletId;
 	const request = parseBoundary$1(() => parseLinkedDeviceEmailOtpBaseFactorRequestV1(authenticated.body));
@@ -22916,8 +22816,6 @@ async function handleOwnerCancel(ctx, service, rawLinkSessionId, nowMs) {
 	if (authenticated.kind !== "authorized") return ownerSessionResponse(authenticated);
 	parseBoundary$1(() => parseOwnerCancelRequest(authenticated.body));
 	const session = authenticated.session;
-	const ownerMismatch = requireOwnerMatchesClaimedWallet(authenticated.owner, session);
-	if (ownerMismatch) return ownerMismatch;
 	if (session.state.state === "cancelled") return sessionProjectionResponse(session, "replayed");
 	return sessionResultResponse(await service.sessionService.cancelSessionV1({
 		linkSessionId,
@@ -22965,6 +22863,7 @@ async function handleExportRootRecipient(ctx, service, rawLinkSessionId, nowMs)
 	if (ctx.method === "GET") {
 		const owner = await authenticateOwnerForSession(ctx, service, sessionId, nowMs);
 		if (owner.kind !== "authorized") return ownerSessionResponse(owner);
+		if (isLinkSessionTerminalFailureV1(owner.session.state)) return invalidStateResponse(owner.session);
 		const transfer = await port.readTransferV1(sessionId);
 		return transfer ? json$1(transfer.recipient, { status: 200 }) : new Response(null, { status: 204 });
 	}
@@ -22972,8 +22871,14 @@ async function handleExportRootRecipient(ctx, service, rawLinkSessionId, nowMs)
 	const authenticated = await authenticateDeviceForSession(ctx, service, rawLinkSessionId, nowMs);
 	if (authenticated.kind === "denied") return authDeniedResponse$2(authenticated);
 	if (authenticated.kind === "not_found") return notFoundResponse();
+	if (isLinkSessionTerminalFailureV1(authenticated.session.state)) return invalidStateResponse(authenticated.session);
 	const recipient = parseBoundary$1(() => parseLinkedDeviceEd25519ExportRootRecipientV1(authenticated.body));
 	if (recipient.linkSessionId !== authenticated.linkSessionId) return invalidInputResponse("link session id does not match route");
+	const session = authenticated.session;
+	const preparation = await readTargetPreparation(service, session, requireApproval(session), { access: "replay_only" }, nowMs);
+	if (preparation.kind === "conflict") return invalidStateResponse(session);
+	const facts = preparation.ed25519ExportRoot;
+	if (!facts || recipient.walletId !== preparation.walletId || recipient.enrollmentId !== preparation.enrollmentId || recipient.deviceId !== preparation.deviceId || recipient.targetFactor.kind !== preparation.targetFactor.kind || recipient.walletKeyId !== facts.walletKeyId || recipient.revocationEpoch !== facts.revocationEpoch || recipient.applicationBindingDigestB64u !== facts.applicationBindingDigestB64u || recipient.registeredPublicKeyB64u !== facts.registeredPublicKeyB64u) return invalidInputResponse("export-root recipient does not match target preparation");
 	return exportRootWriteResponse(await port.registerRecipientV1({ recipient }));
 }
 async function handleExportRootPackage(ctx, service, rawLinkSessionId, nowMs) {
@@ -22984,12 +22889,14 @@ async function handleExportRootPackage(ctx, service, rawLinkSessionId, nowMs) {
 		const authenticated = await authenticateDeviceForSession(ctx, service, rawLinkSessionId, nowMs);
 		if (authenticated.kind === "denied") return authDeniedResponse$2(authenticated);
 		if (authenticated.kind === "not_found") return notFoundResponse();
+		if (isLinkSessionTerminalFailureV1(authenticated.session.state)) return invalidStateResponse(authenticated.session);
 		const transfer = await port.readTransferV1(sessionId);
 		return transfer?.state === "sealed" ? json$1(transfer.package, { status: 200 }) : new Response(null, { status: 204 });
 	}
 	if (ctx.method !== "POST") return methodNotAllowedResponse$2();
 	const owner = await authenticateOwnerForSession(ctx, service, sessionId, nowMs);
 	if (owner.kind !== "authorized") return ownerSessionResponse(owner);
+	if (isLinkSessionTerminalFailureV1(owner.session.state)) return invalidStateResponse(owner.session);
 	const submission = parseBoundary$1(() => parseLinkedDeviceEd25519ExportRootSubmissionV1(owner.body));
 	if (submission.linkSessionId !== sessionId) return invalidInputResponse("link session id does not match route");
 	return exportRootWriteResponse(await port.submitPackageV1({
@@ -23001,7 +22908,7 @@ async function handleReceipt(ctx, service, rawLinkSessionId, nowMs) {
 	if (!service.installationReceipt) return notSupportedResponse("Installation receipt is not configured");
 	if (ctx.method !== "POST") return methodNotAllowedResponse$2();
 	const linkSessionId = parseSessionId(rawLinkSessionId);
-	const rawBody = await readJsonBody(ctx.request.clone());
+	const rawBody = await readJson(ctx.request.clone());
 	if (isFinalActivationAcknowledgement(rawBody)) {
 		const acknowledgement = parseBoundary$1(() => parseLocalAuthorityActivationFinalAckV1(rawBody));
 		if (acknowledgement.linkSessionId !== linkSessionId) return invalidInputResponse("activation acknowledgement session does not match the route");
@@ -23187,6 +23094,8 @@ async function authenticateOwnerForSession(ctx, service, linkSessionId, nowMs) {
 	});
 	if (!session) return { kind: "not_found" };
 	validateOwnerRequestBinding(authentication.binding, ctx, bodyDigestB64u, nowMs);
+	const ownerMismatch = requireOwnerMatchesClaimedWallet(authentication.owner, session);
+	if (ownerMismatch) return ownerMismatch;
 	return {
 		kind: "authorized",
 		body: authentication.body,
@@ -23391,69 +23300,6 @@ async function authenticateTargetPasskeyOriginV1(ctx, routeId) {
 		expectedOrigin
 	};
 }
-function projectLinkSessionStateV1(state) {
-	switch (state.state) {
-		case "displaying_qr": return { state: "displaying_qr" };
-		case "claimed":
-		case "awaiting_target_factor":
-		case "awaiting_source_contribution":
-		case "provisioning": return {
-			state: state.state,
-			deviceId: state.deviceId
-		};
-		case "authority_pending_local_install": return {
-			state: "authority_pending_local_install",
-			deviceId: state.deviceId,
-			authorityId: state.authorityId,
-			packageSetDigestB64u: state.packageSetDigestB64u
-		};
-		case "active": return {
-			state: "active",
-			deviceId: state.deviceId,
-			authorityId: state.authorityId,
-			activatedAtMs: state.activatedAtMs
-		};
-		case "failed_before_commit": return {
-			state: "failed_before_commit",
-			error: state.error
-		};
-		case "cancelled": return {
-			state: "cancelled",
-			cancelledAtMs: state.cancelledAtMs
-		};
-		case "expired": return {
-			state: "expired",
-			expiredAtMs: state.expiredAtMs
-		};
-		default: return assertNeverLinkSessionStateV1(state);
-	}
-}
-function projectSession(record) {
-	return {
-		kind: "linked_device_session_projection_v1",
-		linkSessionId: record.linkSessionId,
-		qrPayload: record.qrPayload,
-		revision: record.revision,
-		createdAtMs: record.createdAtMs,
-		updatedAtMs: record.updatedAtMs,
-		state: projectLinkSessionStateV1(record.state)
-	};
-}
-function sessionProjectionResponse(record, outcome) {
-	return json$1({
-		ok: true,
-		outcome,
-		session: projectSession(record)
-	}, { status: 200 });
-}
-function targetCredentialResultResponse(record, outcome, targetCredential) {
-	return json$1({
-		ok: true,
-		outcome,
-		targetCredential,
-		session: projectSession(record)
-	}, { status: 200 });
-}
 function claimResultResponse(result) {
 	if (result.outcome !== "applied" && result.outcome !== "replayed") return sessionResultResponse(result);
 	const claim = result.record.claimTranscript?.value;
@@ -23482,6 +23328,16 @@ function approvalResultResponse(result) {
 }
 function sessionResultResponse(result) {
 	switch (result.outcome) {
+		case "home_conflict": return json$1({
+			ok: false,
+			code: "wallet_home_conflict",
+			message: result.message
+		}, { status: 409 });
+		case "home_unavailable": return json$1({
+			ok: false,
+			code: "wallet_home_unavailable",
+			message: result.message
+		}, { status: 503 });
 		case "applied":
 		case "replayed": return sessionProjectionResponse(result.record, result.outcome);
 		case "conflict": return json$1({
@@ -23522,49 +23378,19 @@ function sessionResultResponse(result) {
 		default: return assertNever$1(result);
 	}
 }
-function invalidStateResponse(record) {
-	return json$1({
-		ok: false,
-		outcome: "invalid_state",
-		state: record.state.state,
-		session: projectSession(record)
-	}, { status: 409 });
-}
-function exportRootWriteResponse(result) {
-	return result.outcome === "conflict" ? json$1({
-		ok: false,
-		code: result.reason ?? "conflict",
-		message: "export-root relay conflict"
-	}, { status: 409 }) : json$1({
-		ok: true,
-		outcome: result.outcome
-	}, { status: 200 });
-}
 function ownerSessionResponse(context) {
 	return context.kind === "denied" ? authDeniedResponse$2(context) : notFoundResponse();
 }
-/**
-* The one owner-to-session binding, shared by every owner route on a claimed
-* session. It runs before any state is disclosed: an authenticated owner of a
-* DIFFERENT wallet must get the same denial for every state, not a projection
-* or an invalid-state body. An unclaimed session has no wallet to bind to yet,
-* so the caller's state checks answer instead.
-*/
 function requireOwnerMatchesClaimedWallet(owner, session) {
 	const claimWalletId = session.claimTranscript?.value.walletId;
 	if (claimWalletId === void 0) return null;
 	if (owner.walletId === claimWalletId) return null;
-	return authDeniedResponse$2({
+	return {
 		kind: "denied",
 		code: "unauthorized",
 		message: "owner session does not match link wallet"
-	});
+	};
 }
-/**
-* Approval-time revalidation of the selected Email OTP base method. The same
-* eligibility question the dedicated base-factor route answers, asked once
-* more with the id the approval names, so the two paths cannot drift.
-*/
 async function requireSelectedEmailOtpBaseFactorV1(service, session, input) {
 	const provider = service.emailOtpTargetFactor;
 	if (!provider) return notSupportedResponse("Email OTP linking is not configured");
@@ -23583,43 +23409,6 @@ async function requireSelectedEmailOtpBaseFactorV1(service, session, input) {
 	});
 	return null;
 }
-function authDeniedResponse$2(result) {
-	return json$1({
-		ok: false,
-		outcome: "unauthorized",
-		code: result.code,
-		message: result.message
-	}, { status: result.code === "expired" ? 410 : 401 });
-}
-function invalidInputResponse(message) {
-	return json$1({
-		ok: false,
-		outcome: "invalid_input",
-		code: "invalid_input",
-		message
-	}, { status: 400 });
-}
-function notSupportedResponse(message = "Device linking is not configured") {
-	return json$1({
-		ok: false,
-		code: "not_supported",
-		message
-	}, { status: 501 });
-}
-function notFoundResponse() {
-	return json$1({
-		ok: false,
-		code: "not_found",
-		message: "Linked-device session not found"
-	}, { status: 404 });
-}
-function methodNotAllowedResponse$2() {
-	return json$1({
-		ok: false,
-		code: "method_not_allowed",
-		message: "Method is not allowed"
-	}, { status: 405 });
-}
 function parseCreateRequest(raw) {
 	const record = requireRecord(raw, "device-linking create request");
 	requireExactKeys$1(record, ["kind", "payload"]);
@@ -23684,9 +23473,6 @@ function parseB64uBytes(raw, field) {
 	if (bytes.length === 0 || base64UrlEncode(bytes) !== raw) throw new Error(`${field} is not canonical base64url`);
 	return bytes;
 }
-async function readJsonBody(request) {
-	return await readJson(request);
-}
 function parseBoundary$1(parse) {
 	try {
 		return parse();
@@ -24039,11 +23825,7 @@ async function authenticateDeviceLinkingOwnerWalletSessionRequestV1(input) {
 async function handleDeviceLinkingOwnerAuthorization(ctx, service) {
 	if (ctx.pathname !== "/wallet/device-linking/v1/owner-authorization") return null;
 	if (ctx.method !== "POST") return methodNotAllowedResponse();
-	if (!service) return json$1({
-		ok: false,
-		code: "not_supported",
-		message: "Linked-device owner authorization is not configured"
-	}, { status: 501 });
+	if (!service) return jsonFailure(501, "not_supported", "Linked-device owner authorization is not configured");
 	const nowV1 = Date.now;
 	let body;
 	let rawBody;
@@ -24053,11 +23835,7 @@ async function handleDeviceLinkingOwnerAuthorization(ctx, service) {
 		rawBody = await readJson(ctx.request.clone());
 		body = parseLinkedDeviceOwnerAuthorizationRequestV1(rawBody);
 	} catch (error) {
-		return json$1({
-			ok: false,
-			code: "invalid_body",
-			message: error instanceof Error ? error.message : "Owner authorization body is invalid"
-		}, { status: 400 });
+		return jsonFailure(400, "invalid_body", error instanceof Error ? error.message : "Owner authorization body is invalid");
 	}
 	const validated = await authenticateDeviceLinkingOwnerWalletSessionRequestV1({
 		request: ctx.request,
@@ -24077,11 +23855,7 @@ async function handleDeviceLinkingOwnerAuthorization(ctx, service) {
 			owner: validated.owner
 		}), { status: 200 });
 	} catch (error) {
-		return json$1({
-			ok: false,
-			code: "internal",
-			message: error instanceof Error ? error.message : String(error)
-		}, { status: 500 });
+		return jsonFailure(500, "internal", error instanceof Error ? error.message : String(error));
 	}
 }
 async function validateOwnerWalletSessionV1(input) {
@@ -24245,12 +24019,8 @@ function methodNotAllowedResponse() {
 	}, { status: 405 });
 }
 function authDeniedResponse(value) {
-	const status = value.code === "expired" ? 401 : value.code === "invalid" ? 403 : 401;
-	return json$1({
-		ok: false,
-		code: value.code,
-		message: value.message
-	}, { status });
+	if (value.code === "unavailable") return jsonFailure(503, value.code, value.message);
+	return jsonFailure(value.code === "invalid" ? 403 : 401, value.code, value.message);
 }
 //#endregion
 //#region src/threshold/session/signingSessionSeal/transport/fetch.ts
@@ -24260,20 +24030,6 @@ function json(body, status = 200) {
 		headers: { "Content-Type": "application/json; charset=utf-8" }
 	});
 }
-async function readJsonSafe(request) {
-	try {
-		return await request.json();
-	} catch {
-		return null;
-	}
-}
-function headersToRecord(headers) {
-	const out = {};
-	headers.forEach((value, key) => {
-		out[key] = value;
-	});
-	return out;
-}
 function errMessage(error) {
 	return error instanceof Error ? error.message : String(error || "Internal error");
 }
@@ -24293,7 +24049,7 @@ async function handleSigningSessionSealRoutes(ctx) {
 			route: isApply ? applyPath : removePath,
 			operation
 		});
-		const body = await readJsonSafe(ctx.request);
+		const body = await readJson(ctx.request);
 		const parsed = isApply ? parseSigningSessionSealApplyBody(body) : parseSigningSessionSealRemoveBody(body);
 		if (!parsed.ok) {
 			ctx.logger.warn("[threshold-signing-session-seal] invalid_body", {
@@ -24303,11 +24059,7 @@ async function handleSigningSessionSealRoutes(ctx) {
 				message: parsed.message,
 				durationMs: Math.max(0, Date.now() - startedAtMs)
 			});
-			return json({
-				ok: false,
-				code: parsed.code,
-				message: parsed.message
-			}, 400);
+			return json(failure(parsed.code, parsed.message), 400);
 		}
 		const authorized = await authorizeSigningSessionSealRequest({
 			options,
@@ -24323,11 +24075,7 @@ async function handleSigningSessionSealRoutes(ctx) {
 				message: authorized.message || "Unauthorized",
 				durationMs: Math.max(0, Date.now() - startedAtMs)
 			});
-			return json({
-				ok: false,
-				code: authorized.code || "unauthorized",
-				message: authorized.message || "Unauthorized"
-			}, signingSessionSealAuthorizeStatusCode(authorized));
+			return json(failure(authorized.code || "unauthorized", authorized.message || "Unauthorized"), signingSessionSealAuthorizeStatusCode(authorized));
 		}
 		const result = isApply ? await options.service.applyServerSeal(parsed.value, authorized.auth) : await options.service.removeServerSeal(parsed.value, authorized.auth);
 		const status = signingSessionSealStatusCode(result);
@@ -24347,11 +24095,7 @@ async function handleSigningSessionSealRoutes(ctx) {
 			message,
 			durationMs: Math.max(0, Date.now() - startedAtMs)
 		});
-		return json({
-			ok: false,
-			code: "internal",
-			message
-		}, 500);
+		return json(failure("internal", message), 500);
 	}
 }
 //#endregion
@@ -24496,6 +24240,7 @@ async function signingSessionSealRecordFromExactAdmission(input) {
 	switch (admission.curve) {
 		case "ecdsa": {
 			const active = await input.walletRegistration.resolveEcdsaMaterialActivation({
+				source: { kind: "database" },
 				walletId,
 				materialActivation
 			});
@@ -24656,11 +24401,7 @@ function createFetchRouter(service, opts, runtime) {
 		async (context) => {
 			if (!context.pathname.startsWith("/wallet/device-linking/v1/devices")) return null;
 			const service = context.service.deviceManagement;
-			if (!service) return json$1({
-				ok: false,
-				code: "not_supported",
-				message: "Linked-device management is not configured"
-			}, { status: 501 });
+			if (!service) return jsonFailure(501, "not_supported", "Linked-device management is not configured");
 			return await handleDeviceManagement(context, service);
 		},
 		handlePasskeyCustody,
@@ -24685,7 +24426,6 @@ function createFetchRouter(service, opts, runtime) {
 		handleThresholdEcdsa,
 		handleExactWalletSigningSessionSeal,
 		handleWebAuthnAuthenticators,
-		handleNearPublicKeys,
 		handleExactWalletSessionStatus,
 		handleHostedWalletSessionExchangeIssue,
 		handleHostedWalletSessionExchangeRedeem,
@@ -24900,45 +24640,17 @@ function parseExpectation(raw) {
 }
 async function validateRuntimeSnapshotExpectation(input) {
 	const expectationResult = parseExpectation(input.expectationRaw);
-	if (expectationResult.error) return {
-		ok: false,
-		code: "runtime_snapshot_invalid_expectation",
-		message: expectationResult.error
-	};
+	if (expectationResult.error) return failure("runtime_snapshot_invalid_expectation", expectationResult.error);
 	const expectation = expectationResult.parsed;
 	if (!expectation) return { ok: true };
 	const scope = input.scope;
-	if (!scope) return {
-		ok: false,
-		code: "runtime_snapshot_scope_missing",
-		message: "threshold session is missing runtimePolicyScope"
-	};
-	if (!input.runtimeSnapshots) return {
-		ok: false,
-		code: "runtime_snapshots_not_configured",
-		message: "Runtime snapshot consumer is not configured on this server"
-	};
+	if (!scope) return failure("runtime_snapshot_scope_missing", "threshold session is missing runtimePolicyScope");
+	if (!input.runtimeSnapshots) return failure("runtime_snapshots_not_configured", "Runtime snapshot consumer is not configured on this server");
 	const latest = await input.runtimeSnapshots.getLatestSnapshot(scope);
-	if (!latest) return {
-		ok: false,
-		code: "runtime_snapshot_not_found",
-		message: `No runtime snapshot found for org=${scope.orgId} project=${scope.projectId} env=${scope.envId}`
-	};
-	if (expectation.snapshotId && latest.snapshotId !== expectation.snapshotId) return {
-		ok: false,
-		code: "runtime_snapshot_id_mismatch",
-		message: `Runtime snapshot id mismatch: expected ${expectation.snapshotId}, got ${latest.snapshotId}`
-	};
-	if (expectation.version !== void 0 && latest.version !== expectation.version) return {
-		ok: false,
-		code: "runtime_snapshot_version_mismatch",
-		message: `Runtime snapshot version mismatch: expected ${expectation.version}, got ${latest.version}`
-	};
-	if (expectation.checksum && latest.checksum !== expectation.checksum) return {
-		ok: false,
-		code: "runtime_snapshot_checksum_mismatch",
-		message: `Runtime snapshot checksum mismatch: expected ${expectation.checksum}, got ${latest.checksum}`
-	};
+	if (!latest) return failure("runtime_snapshot_not_found", `No runtime snapshot found for org=${scope.orgId} project=${scope.projectId} env=${scope.envId}`);
+	if (expectation.snapshotId && latest.snapshotId !== expectation.snapshotId) return failure("runtime_snapshot_id_mismatch", `Runtime snapshot id mismatch: expected ${expectation.snapshotId}, got ${latest.snapshotId}`);
+	if (expectation.version !== void 0 && latest.version !== expectation.version) return failure("runtime_snapshot_version_mismatch", `Runtime snapshot version mismatch: expected ${expectation.version}, got ${latest.version}`);
+	if (expectation.checksum && latest.checksum !== expectation.checksum) return failure("runtime_snapshot_checksum_mismatch", `Runtime snapshot checksum mismatch: expected ${expectation.checksum}, got ${latest.checksum}`);
 	return { ok: true };
 }
 function makeScopeKey(scope) {
@@ -25002,9 +24714,17 @@ function createInMemoryRouterApiRuntimeSnapshotConsumer() {
 	};
 }
 //#endregion
+//#region ../shared-ts/src/tenant-root/tenantRootIdentifier.ts
+function hasControlCharacters(value) {
+	for (const character of value) {
+		const codePoint = character.codePointAt(0) ?? 0;
+		if (codePoint <= 31 || codePoint >= 127 && codePoint <= 159) return true;
+	}
+	return false;
+}
+//#endregion
 //#region ../shared-ts/src/tenant-root/tenantRootIdentity.ts
 const TENANT_ROOT_IDENTITY_DOMAIN_V1 = new TextEncoder().encode("seams/tenant-root-identity/v1");
-const TENANT_ROOT_IDENTITY_MAX_IDENTIFIER_BYTES_V1 = 256;
 function concatenateBytes(parts) {
 	let length = 0;
 	for (const part of parts) length += part.length;
@@ -25023,13 +24743,6 @@ function hasLeadingOrTrailingRustWhitespace(value) {
 	const codePoints = Array.from(value, (character) => character.codePointAt(0) ?? 0);
 	return codePoints.length > 0 && (isRustWhitespace(codePoints[0]) || isRustWhitespace(codePoints[codePoints.length - 1]));
 }
-function hasControlCharacters(value) {
-	for (const character of value) {
-		const codePoint = character.codePointAt(0) ?? 0;
-		if (codePoint <= 31 || codePoint >= 127 && codePoint <= 159) return true;
-	}
-	return false;
-}
 function hasUnpairedSurrogate(value) {
 	for (let index = 0; index < value.length; index += 1) {
 		const codeUnit = value.charCodeAt(index);
@@ -25047,7 +24760,7 @@ function isCanonicalTenantRootIdentityField(value) {
 	if (typeof value !== "string" || value.length === 0) return false;
 	if (hasLeadingOrTrailingRustWhitespace(value) || hasControlCharacters(value)) return false;
 	if (hasUnpairedSurrogate(value)) return false;
-	return new TextEncoder().encode(value).length <= TENANT_ROOT_IDENTITY_MAX_IDENTIFIER_BYTES_V1;
+	return new TextEncoder().encode(value).length <= 256;
 }
 function lengthPrefixTenantRootIdentityField(value) {
 	const output = new Uint8Array(4 + value.length);
@@ -26320,8 +26033,8 @@ function resolveTraceContext(request) {
 var InMemoryRouterAbEd25519YaoExportStateV1 = class {
 	constructor() {
 		this.exports = /* @__PURE__ */ new Map();
-		this.authorizationNonces = /* @__PURE__ */ new Set();
-		this.authorizationUncertain = /* @__PURE__ */ new Set();
+		this.authorizationNonceOwners = /* @__PURE__ */ new Map();
+		this.authorizationUncertainOwners = /* @__PURE__ */ new Map();
 	}
 };
 const ROUTES = Object.freeze([defineRoute({