@seams/wallet-server 0.7.3 → 0.8.0

package/dist/esm/router/express.js

@@ -90,6 +90,21 @@ function buildCorsOrigins(...inputs) {
 }
 //#endregion
 //#region ../shared-ts/src/device-linking/contracts.ts
+function isLinkSessionTerminalFailureV1(state) {
+	switch (state.state) {
+		case "failed_before_commit":
+		case "cancelled":
+		case "expired": return true;
+		case "displaying_qr":
+		case "claimed":
+		case "awaiting_target_factor":
+		case "awaiting_source_contribution":
+		case "provisioning":
+		case "authority_pending_local_install":
+		case "active": return false;
+		default: return assertNeverLinkSessionStateV1(state);
+	}
+}
 function assertNeverLinkSessionStateV1(value) {
 	throw new Error(`[LinkSessionStateV1] unsupported state: ${String(value)}`);
 }
@@ -398,112 +413,6 @@ function toRorOriginOrNull(value) {
 	}
 }
 //#endregion
-//#region ../shared-ts/src/utils/base58.ts
-/**
-* Encodes binary data to base58 string using Bitcoin's base58 alphabet.
-*
-* @param data - Binary data to encode (Uint8Array, ArrayBuffer, or number[])
-* @returns Base58-encoded string
-*/
-const base58Encode = (data) => {
-	if (data instanceof ArrayBuffer) return bs58.encode(new Uint8Array(data));
-	if (Array.isArray(data)) return bs58.encode(new Uint8Array(data));
-	return bs58.encode(data);
-};
-/**
-* Decodes a base58 string to binary data using Bitcoin's base58 alphabet.
-* Returns a Uint8Array containing the decoded bytes.
-*
-* @param base58String - Base58-encoded string to decode
-* @returns Uint8Array containing the decoded bytes
-* @throws Error if input contains invalid base58 characters
-*/
-const base58Decode = (base58String) => {
-	return bs58.decode(base58String);
-};
-//#endregion
-//#region ../shared-ts/src/utils/near.ts
-/**
-* NEAR-specific utility helpers.
-*
-* Keep chain-specific parsing and validation logic here so generic utility
-* modules (`validation`, `errors`, `encoders`, etc.) stay chain-agnostic.
-*/
-/**
-* Ensure a key string has the NEAR Ed25519 prefix (`ed25519:`).
-*
-* - Accepts either `ed25519:<base58>` or a bare `<base58>` string.
-* - Canonicalizes `ED25519:` -> `ed25519:`.
-* - If a different prefix is present (e.g. `secp256k1:`), returns the input unchanged.
-*/
-function ensureEd25519Prefix(value) {
-	const raw = String(value ?? "").trim();
-	if (!raw) return "";
-	if (/^[a-z0-9_]+:/i.test(raw)) {
-		if (/^ed25519:/i.test(raw)) return `ed25519:${raw.replace(/^ed25519:/i, "")}`;
-		return raw;
-	}
-	return `ed25519:${raw}`;
-}
-/**
-* Lightweight NEAR account ID validation used by server-side helpers.
-* - length: 2..64
-* - chars: lowercase letters, digits, `_`, `.`, `-`
-*/
-function isValidAccountId(accountId) {
-	if (typeof accountId !== "string") return false;
-	if (!accountId || accountId.length < 2 || accountId.length > 64) return false;
-	return /^[a-z0-9_.-]+$/.test(accountId);
-}
-function isImplicitNearAccountId(value) {
-	return typeof value === "string" && /^[0-9a-f]{64}$/.test(value);
-}
-function parseImplicitNearAccountId(raw) {
-	const value = typeof raw === "string" ? raw.trim() : "";
-	if (!value) return {
-		ok: false,
-		code: "missing",
-		message: "implicit NEAR account ID is required"
-	};
-	if (!isImplicitNearAccountId(value)) return {
-		ok: false,
-		code: "invalid",
-		message: "implicit NEAR account ID must be 64 lowercase hex characters"
-	};
-	return {
-		ok: true,
-		value
-	};
-}
-function parseNamedNearAccountId(raw) {
-	const value = typeof raw === "string" ? raw.trim() : "";
-	if (!value) return {
-		ok: false,
-		code: "missing",
-		message: "named NEAR account ID is required"
-	};
-	if (isImplicitNearAccountId(value) || !isValidAccountId(value) || !value.includes(".")) return {
-		ok: false,
-		code: "invalid",
-		message: "named NEAR account ID must be a valid named account containing a dot"
-	};
-	return {
-		ok: true,
-		value
-	};
-}
-function bytesToLowerHex(bytes) {
-	return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
-}
-function deriveImplicitNearAccountIdFromEd25519PublicKey(publicKey) {
-	const normalized = ensureEd25519Prefix(publicKey);
-	const encoded = normalized.startsWith("ed25519:") ? normalized.slice(8) : "";
-	if (!encoded) throw new Error("Ed25519 public key is required");
-	const decoded = base58Decode(encoded);
-	if (decoded.length !== 32) throw new Error("Ed25519 public key must decode to 32 bytes");
-	return bytesToLowerHex(decoded);
-}
-//#endregion
 //#region ../shared-ts/src/utils/validation.ts
 function requireTrimmedString(value, label, message = "is required") {
 	const parsed = normalizeOptionalTrimmedString(value);
@@ -5416,11 +5325,15 @@ function createRouterAbTraceContextV1() {
 	};
 }
 //#endregion
+//#region ../shared-ts/src/utils/walletManagementProtocol.ts
+const WALLET_MANAGEMENT_PROTOCOL_HEADER = "X-Seams-Wallet-Protocol";
+//#endregion
 //#region src/router/framework/http.ts
 const CORS_ALLOW_METHODS = "GET,POST,PUT,PATCH,DELETE,OPTIONS";
 const CORS_PREFLIGHT_MAX_AGE_SECONDS = 600;
 const CORS_ALLOW_HEADERS = [
 	"Content-Type",
+	WALLET_MANAGEMENT_PROTOCOL_HEADER,
 	"Authorization",
 	"X-Seams-Benchmark-Diagnostics",
 	LINKED_DEVICE_REQUEST_PROOF_HEADER_V1,
@@ -5529,6 +5442,11 @@ async function handleReady(ctx) {
 	}
 }
 //#endregion
+//#region ../shared-ts/src/utils/registrationSetupOperation.ts
+function parseRegistrationSetupOperationId(value) {
+	return typeof value === "string" && /^wreg_[A-Za-z0-9_-]{43}$/u.test(value) ? value : null;
+}
+//#endregion
 //#region src/router/auth/routerApiKeyAuth.ts
 function readHeader(headers, name) {
 	if (headers instanceof Headers) return String(headers.get(name) || "").trim();
@@ -5729,22 +5647,6 @@ function parseLaneParticipantBindingDigestB64u(raw) {
 	return parseDigest(raw, "participantBindingDigestB64u", brandParticipantDigest);
 }
 //#endregion
-//#region ../shared-ts/src/utils/registrationIds.ts
-function walletIdFromString(value) {
-	const parsed = parseWalletId(value);
-	if (!parsed.ok) throw new Error(parsed.error.message);
-	return parsed.value;
-}
-function nearEd25519SigningKeyIdFromString(value) {
-	const normalized = String(value || "").trim();
-	if (!normalized) throw new Error("nearEd25519SigningKeyId is required");
-	return normalized;
-}
-function parseNearEd25519SigningKeyId(value) {
-	if (typeof value !== "string") throw new Error("nearEd25519SigningKeyId must be a string");
-	return nearEd25519SigningKeyIdFromString(value);
-}
-//#endregion
 //#region ../shared-ts/src/signing-lanes/participantDigest.ts
 function u32(value) {
 	if (!Number.isInteger(value) || value < 0 || value > 4294967295) throw new Error("canonical u32 must be an integer between 0 and 4294967295");
@@ -5775,6 +5677,17 @@ function encodeLaneCanonicalU64V1(value) {
 	return output;
 }
 //#endregion
+//#region ../shared-ts/src/signing-lanes/execution.ts
+function buildPreparedOwnerWalletExecution(input) {
+	return {
+		kind: "prepared_owner_wallet_execution",
+		laneKind: input.lane.laneKind,
+		authorization: input.authorization,
+		materialActivation: input.materialActivation,
+		lane: input.lane
+	};
+}
+//#endregion
 //#region ../shared-ts/src/signing-lanes/ownerContinuity.ts
 const OWNER_LANE_PARTICIPANT_BINDING_DOMAIN_V1 = "seams/rotatable-signing-lanes/owner-lane-participant-continuity/v1";
 const OWNER_LANE_PARTICIPANT_CONTINUITY_FIELDS = [
@@ -5842,18 +5755,6 @@ function ownerLaneParticipantContinuityCanonicalBytesV1(input) {
 async function computeOwnerLaneParticipantBindingDigestV1(input) {
 	return requireParsed$2(parseLaneParticipantBindingDigestB64u(base64UrlEncode(await sha256Bytes(ownerLaneParticipantContinuityCanonicalBytesV1(input)))), "owner participant digest");
 }
-new TextEncoder();
-//#endregion
-//#region ../shared-ts/src/signing-lanes/execution.ts
-function buildPreparedOwnerWalletExecution(input) {
-	return {
-		kind: "prepared_owner_wallet_execution",
-		laneKind: input.lane.laneKind,
-		authorization: input.authorization,
-		materialActivation: input.materialActivation,
-		lane: input.lane
-	};
-}
 //#endregion
 //#region ../shared-ts/src/authorization/operationFingerprint.ts
 const CAPABILITY_OPERATION_FINGERPRINT_DOMAIN_V1 = "seams:authorization:capability-operation-fingerprint:v1";
@@ -5906,6 +5807,30 @@ function parseSigningOperationFingerprintDigest(value) {
 	return parseDigestB64u(value.slice(7));
 }
 //#endregion
+//#region ../shared-ts/src/utils/base58.ts
+/**
+* Encodes binary data to base58 string using Bitcoin's base58 alphabet.
+*
+* @param data - Binary data to encode (Uint8Array, ArrayBuffer, or number[])
+* @returns Base58-encoded string
+*/
+const base58Encode = (data) => {
+	if (data instanceof ArrayBuffer) return bs58.encode(new Uint8Array(data));
+	if (Array.isArray(data)) return bs58.encode(new Uint8Array(data));
+	return bs58.encode(data);
+};
+/**
+* Decodes a base58 string to binary data using Bitcoin's base58 alphabet.
+* Returns a Uint8Array containing the decoded bytes.
+*
+* @param base58String - Base58-encoded string to decode
+* @returns Uint8Array containing the decoded bytes
+* @throws Error if input contains invalid base58 characters
+*/
+const base58Decode = (base58String) => {
+	return bs58.decode(base58String);
+};
+//#endregion
 //#region src/authorization/domain.ts
 /**
 * The digest-free authorization projection published to the browser. It carries
@@ -6144,8 +6069,7 @@ function resolveWalletSessionAuthorizationV2AdministrationAdmission(input) {
 			if (!subject || subject.authorityId !== input.authority.authorityId) return admissionRefused("capability_subject_mismatch");
 			return {
 				ok: true,
-				operationKind: "link_devices",
-				authorityId: input.authority.authorityId
+				operationKind: "link_devices"
 			};
 		}
 		default: return assertNeverWalletSessionAuthorizationV2AdministrationOperation(input.operation.kind);
@@ -6768,6 +6692,22 @@ function toFetchRouteResponse(response) {
 	});
 }
 //#endregion
+//#region ../shared-ts/src/utils/registrationIds.ts
+function walletIdFromString(value) {
+	const parsed = parseWalletId(value);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+function nearEd25519SigningKeyIdFromString(value) {
+	const normalized = String(value || "").trim();
+	if (!normalized) throw new Error("nearEd25519SigningKeyId is required");
+	return normalized;
+}
+function parseNearEd25519SigningKeyId(value) {
+	if (typeof value !== "string") throw new Error("nearEd25519SigningKeyId must be a string");
+	return nearEd25519SigningKeyIdFromString(value);
+}
+//#endregion
 //#region ../shared-ts/src/passkey-custody/custodySecretBinding.ts
 /** The only derivation scheme owner custody supports. */
 const WALLET_SEED_DERIVATION_SCHEME_V1 = "wallet_seed_parallel_hkdf_sha256_v1";
@@ -7274,40 +7214,122 @@ async function computeWalletEcdsaKeyFactsInventoryChallengeDigestB64u(input) {
 	return base64UrlEncode(await sha256BytesUtf8(canonicalizeWalletEcdsaKeyFactsInventoryChallenge(input)));
 }
 //#endregion
-//#region ../shared-ts/src/utils/registrationSignerPlan.ts
-function normalizePositiveInteger(raw, fallback) {
-	const value = typeof raw === "number" ? raw : Number(raw);
-	return Number.isFinite(value) && value >= 1 ? Math.floor(value) : fallback;
-}
-function collectPositiveParticipantIds(raw) {
-	if (!Array.isArray(raw)) return [];
-	const participantIds = [];
-	for (const id of raw) {
-		const numericId = Number(id);
-		if (Number.isInteger(numericId) && numericId > 0) participantIds.push(numericId);
+//#region ../shared-ts/src/utils/near.ts
+/**
+* NEAR-specific utility helpers.
+*
+* Keep chain-specific parsing and validation logic here so generic utility
+* modules (`validation`, `errors`, `encoders`, etc.) stay chain-agnostic.
+*/
+/**
+* Ensure a key string has the NEAR Ed25519 prefix (`ed25519:`).
+*
+* - Accepts either `ed25519:<base58>` or a bare `<base58>` string.
+* - Canonicalizes `ED25519:` -> `ed25519:`.
+* - If a different prefix is present (e.g. `secp256k1:`), returns the input unchanged.
+*/
+function ensureEd25519Prefix(value) {
+	const raw = String(value ?? "").trim();
+	if (!raw) return "";
+	if (/^[a-z0-9_]+:/i.test(raw)) {
+		if (/^ed25519:/i.test(raw)) return `ed25519:${raw.replace(/^ed25519:/i, "")}`;
+		return raw;
 	}
-	return participantIds;
+	return `ed25519:${raw}`;
 }
-function normalizeUnknownArray(raw) {
-	return Array.isArray(raw) ? raw : [];
+/**
+* Lightweight NEAR account ID validation used by server-side helpers.
+* - length: 2..64
+* - chars: lowercase letters, digits, `_`, `.`, `-`
+*/
+function isValidAccountId(accountId) {
+	if (typeof accountId !== "string") return false;
+	if (!accountId || accountId.length < 2 || accountId.length > 64) return false;
+	return /^[a-z0-9_.-]+$/.test(accountId);
 }
-function normalizeRegistrationNearAccountProvisioning(raw) {
-	const record = inspectRawObject(raw);
-	if (!record || !("kind" in record)) return null;
-	switch (trimString(record.kind)) {
-		case "implicit_account":
-			if (Object.prototype.hasOwnProperty.call(record, "requestedAccountId") || Object.prototype.hasOwnProperty.call(record, "sponsor")) return null;
-			return {
-				kind: "implicit_account",
-				accountIdSource: "ed25519_public_key"
-			};
-		case "sponsored_named_account": {
-			if (Object.prototype.hasOwnProperty.call(record, "accountIdSource") || !("requestedAccountId" in record)) return null;
-			const parsed = parseNamedNearAccountId(record.requestedAccountId);
-			if (!parsed.ok) return null;
-			return {
-				kind: "sponsored_named_account",
-				requestedAccountId: parsed.value,
+function isImplicitNearAccountId(value) {
+	return typeof value === "string" && /^[0-9a-f]{64}$/.test(value);
+}
+function parseImplicitNearAccountId(raw) {
+	const value = typeof raw === "string" ? raw.trim() : "";
+	if (!value) return {
+		ok: false,
+		code: "missing",
+		message: "implicit NEAR account ID is required"
+	};
+	if (!isImplicitNearAccountId(value)) return {
+		ok: false,
+		code: "invalid",
+		message: "implicit NEAR account ID must be 64 lowercase hex characters"
+	};
+	return {
+		ok: true,
+		value
+	};
+}
+function parseNamedNearAccountId(raw) {
+	const value = typeof raw === "string" ? raw.trim() : "";
+	if (!value) return {
+		ok: false,
+		code: "missing",
+		message: "named NEAR account ID is required"
+	};
+	if (isImplicitNearAccountId(value) || !isValidAccountId(value) || !value.includes(".")) return {
+		ok: false,
+		code: "invalid",
+		message: "named NEAR account ID must be a valid named account containing a dot"
+	};
+	return {
+		ok: true,
+		value
+	};
+}
+function bytesToLowerHex(bytes) {
+	return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function deriveImplicitNearAccountIdFromEd25519PublicKey(publicKey) {
+	const normalized = ensureEd25519Prefix(publicKey);
+	const encoded = normalized.startsWith("ed25519:") ? normalized.slice(8) : "";
+	if (!encoded) throw new Error("Ed25519 public key is required");
+	const decoded = base58Decode(encoded);
+	if (decoded.length !== 32) throw new Error("Ed25519 public key must decode to 32 bytes");
+	return bytesToLowerHex(decoded);
+}
+//#endregion
+//#region ../shared-ts/src/utils/registrationSignerPlan.ts
+function normalizePositiveInteger(raw, fallback) {
+	const value = typeof raw === "number" ? raw : Number(raw);
+	return Number.isFinite(value) && value >= 1 ? Math.floor(value) : fallback;
+}
+function collectPositiveParticipantIds(raw) {
+	if (!Array.isArray(raw)) return [];
+	const participantIds = [];
+	for (const id of raw) {
+		const numericId = Number(id);
+		if (Number.isInteger(numericId) && numericId > 0) participantIds.push(numericId);
+	}
+	return participantIds;
+}
+function normalizeUnknownArray(raw) {
+	return Array.isArray(raw) ? raw : [];
+}
+function normalizeRegistrationNearAccountProvisioning(raw) {
+	const record = inspectRawObject(raw);
+	if (!record || !("kind" in record)) return null;
+	switch (trimString(record.kind)) {
+		case "implicit_account":
+			if (Object.prototype.hasOwnProperty.call(record, "requestedAccountId") || Object.prototype.hasOwnProperty.call(record, "sponsor")) return null;
+			return {
+				kind: "implicit_account",
+				accountIdSource: "ed25519_public_key"
+			};
+		case "sponsored_named_account": {
+			if (Object.prototype.hasOwnProperty.call(record, "accountIdSource") || !("requestedAccountId" in record)) return null;
+			const parsed = parseNamedNearAccountId(record.requestedAccountId);
+			if (!parsed.ok) return null;
+			return {
+				kind: "sponsored_named_account",
+				requestedAccountId: parsed.value,
 				sponsor: "relayer"
 			};
 		}
@@ -7941,6 +7963,12 @@ function parseWalletRegistrationSetupWallet(raw) {
 	};
 }
 function parseWalletRegistrationSetupRequest(body) {
+	const registrationOperationId = parseRegistrationSetupOperationId(body.registrationOperationId);
+	if (!registrationOperationId) return {
+		ok: false,
+		code: "invalid_body",
+		message: "registrationOperationId is required"
+	};
 	const signerSelection = parseRegistrationSignerSet(body.signerSelection);
 	if (!signerSelection.ok) return signerSelection;
 	const authMethod = normalizeRegistrationAuthMethodInput(body.authMethod);
@@ -7954,6 +7982,7 @@ function parseWalletRegistrationSetupRequest(body) {
 	return {
 		ok: true,
 		value: {
+			registrationOperationId,
 			...wallet.value ? { wallet: wallet.value } : {},
 			signerSelection: signerSelection.value.selection,
 			authMethod
@@ -9171,14 +9200,6 @@ async function handleRouterApiWalletAddSignerIntent(input) {
 	});
 	return routeJson(result.ok ? 200 : 400, result);
 }
-/**
-* `POST /wallets/register/setup` — the single admitted entry point that
-* replaces the bootstrap grant, the intent, and start.
-*
-* Authentication is the same API-credential plane the intent route used, so
-* origin and environment binding are unchanged; what is gone is the stored
-* grant that used to sit between the check and its only reader.
-*/
 async function handleRouterApiWalletRegistrationSetup(input) {
 	if (!isPlainObject(input.body)) return routeError(400, "invalid_body", "JSON body required");
 	const origin = normalizeCorsOrigin(input.origin);
@@ -9221,7 +9242,7 @@ async function handleRouterApiWalletRegistrationSetup(input) {
 	if (!session) return routeError(500, "internal", "wallet registration setup requires session signing");
 	const request = parseWalletRegistrationSetupRequest(input.body);
 	if (!request.ok) return routeError(400, request.code, request.message);
-	const result = await input.services.walletRegistration.setupWalletRegistration({
+	return input.services.walletRegistration.setupWalletRegistration({
 		request: request.value,
 		orgId: principal.orgId,
 		expectedOrigin: origin,
@@ -9232,7 +9253,6 @@ async function handleRouterApiWalletRegistrationSetup(input) {
 			signingRootVersion: runtimePolicyScope.signingRootVersion
 		} : {}
 	});
-	return routeJson(result.ok ? 200 : 400, result);
 }
 /**
 * `POST /wallets/register/respond` — the authenticated leg.
@@ -10233,7 +10253,6 @@ const ROUTER_API_ECDSA_STRICT_LIFECYCLE_SERVICES = [
 	"session"
 ];
 const ROUTER_API_WEBAUTHN_AUTHENTICATOR_SERVICES = ["webAuthn", "session"];
-const ROUTER_API_NEAR_PUBLIC_KEY_SERVICES = ["nearFunding", "session"];
 const ROUTER_API_PASSKEY_CUSTODY_SERVICES = [
 	"passkeyCustody",
 	"walletAuthMethods",
@@ -10600,7 +10619,7 @@ function createRouterApiRouteDefinitions(options = {}) {
 	}, ROUTER_API_ED25519_WALLET_SESSION_SERVICES), sessionPrincipalRoute("router_ab_ed25519_sign_prepare", "POST", ROUTER_AB_ED25519_NORMAL_SIGNING_PREPARE_PATH, "Prepare Router A/B Ed25519 normal signing", ROUTER_API_NORMAL_SIGNING_PROXY_SERVICES), sessionPrincipalRoute("router_ab_ed25519_sign_finalize", "POST", ROUTER_AB_ED25519_NORMAL_SIGNING_PATH, "Finalize Router A/B Ed25519 normal signing", ROUTER_API_NORMAL_SIGNING_PROXY_SERVICES), publicRoute("router_ab_ecdsa_derivation_healthz", "GET", ROUTER_AB_ECDSA_DERIVATION_HEALTH_PATH, "Router A/B ECDSA derivation health probe", {
 		plane: "public",
 		rationale: "Router A/B health probes are intentionally public diagnostics."
-	}, ROUTER_API_THRESHOLD_RUNTIME_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_export", "POST", ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, "Export authorized Router A/B ECDSA derivation material", ROUTER_API_ECDSA_STRICT_LIFECYCLE_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_refresh", "POST", ROUTER_AB_ECDSA_DERIVATION_REFRESH_PATH, "Refresh Router A/B ECDSA derivation activation", ROUTER_API_ECDSA_STRICT_LIFECYCLE_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_session_activate", "POST", ROUTER_AB_ECDSA_DERIVATION_SESSION_ACTIVATION_PATH, "Activate Router A/B ECDSA normal-signing session", ROUTER_API_THRESHOLD_SESSION_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_sign_prepare", "POST", ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_PREPARE_PATH, "Prepare Router A/B ECDSA derivation normal signing", ROUTER_API_NORMAL_SIGNING_PROXY_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_sign_finalize", "POST", ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_PATH, "Finalize Router A/B ECDSA derivation normal signing", ROUTER_API_NORMAL_SIGNING_PROXY_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_presignature_pool_fill_init", "POST", ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_INIT_PATH, "Begin Router A/B ECDSA derivation presignature pool-fill session", ROUTER_API_THRESHOLD_SESSION_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_presignature_pool_fill_step", "POST", ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_STEP_PATH, "Continue Router A/B ECDSA derivation presignature pool-fill session", ROUTER_API_THRESHOLD_SESSION_SERVICES), sessionPrincipalRoute("webauthn_authenticators", "GET", "/webauthn/authenticators", "List registered WebAuthn authenticators", ROUTER_API_WEBAUTHN_AUTHENTICATOR_SERVICES), sessionPrincipalRoute("near_public_keys", "GET", "/near/public-keys", "List NEAR public keys for current session", ROUTER_API_NEAR_PUBLIC_KEY_SERVICES), publicRoute("wallet_unlock_challenge", "POST", "/wallet/unlock/challenge", "Create wallet unlock challenge", {
+	}, ROUTER_API_THRESHOLD_RUNTIME_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_export", "POST", ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, "Export authorized Router A/B ECDSA derivation material", ROUTER_API_ECDSA_STRICT_LIFECYCLE_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_refresh", "POST", ROUTER_AB_ECDSA_DERIVATION_REFRESH_PATH, "Refresh Router A/B ECDSA derivation activation", ROUTER_API_ECDSA_STRICT_LIFECYCLE_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_session_activate", "POST", ROUTER_AB_ECDSA_DERIVATION_SESSION_ACTIVATION_PATH, "Activate Router A/B ECDSA normal-signing session", ROUTER_API_THRESHOLD_SESSION_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_sign_prepare", "POST", ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_PREPARE_PATH, "Prepare Router A/B ECDSA derivation normal signing", ROUTER_API_NORMAL_SIGNING_PROXY_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_sign_finalize", "POST", ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_PATH, "Finalize Router A/B ECDSA derivation normal signing", ROUTER_API_NORMAL_SIGNING_PROXY_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_presignature_pool_fill_init", "POST", ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_INIT_PATH, "Begin Router A/B ECDSA derivation presignature pool-fill session", ROUTER_API_THRESHOLD_SESSION_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_presignature_pool_fill_step", "POST", ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_STEP_PATH, "Continue Router A/B ECDSA derivation presignature pool-fill session", ROUTER_API_THRESHOLD_SESSION_SERVICES), sessionPrincipalRoute("webauthn_authenticators", "GET", "/webauthn/authenticators", "List registered WebAuthn authenticators", ROUTER_API_WEBAUTHN_AUTHENTICATOR_SERVICES), publicRoute("wallet_unlock_challenge", "POST", "/wallet/unlock/challenge", "Create wallet unlock challenge", {
 		plane: "public",
 		proof: "challenge_exchange",
 		rationale: "Wallet unlock challenge issuance is intentionally public."
@@ -10680,6 +10699,7 @@ function resolveWalletRegistrationRoute(ctx) {
 async function handleWalletRegistration(ctx) {
 	const route = resolveWalletRegistrationRoute(ctx);
 	if (!route) return null;
+	if (ctx.request.headers.get("X-Seams-Wallet-Protocol") !== "2") return jsonFailure(409, "wallet_protocol_mismatch", "Your wallet application needs an update. Reload this page and try again. If the problem continues, ask the application developer to upgrade the Wallet SDK.");
 	const common = {
 		body: await readJson(ctx.request),
 		headers: Object.fromEntries(ctx.request.headers.entries()),
@@ -11748,6 +11768,7 @@ async function handleWalletRecoveryPrepare(ctx) {
 			case "refused": return toFetchRouteResponse(refusedSpend());
 			case "reserved":
 			case "consumed": return routeErrorResponse(401, "recovery_code_used", "that recovery code has already been used");
+			case "routing_unavailable": return routeErrorResponse(503, "wallet_home_unavailable", "Wallet recovery routing is temporarily unavailable");
 			case "manifest_unavailable":
 			case "registration_unavailable": return routeErrorResponse(409, "recovery_preparation_conflict", "wallet recovery could not be prepared");
 		}
@@ -12949,6 +12970,20 @@ async function handleWalletUnlockChallengeRoute(input) {
 		orgId: body.orgId,
 		ttlMs: body.ttlMs
 	});
+	if (!result.ok && result.code === "wallet_home_unavailable") return {
+		status: 503,
+		body: {
+			...result,
+			unlockBackend
+		}
+	};
+	if (!result.ok && result.code === "wallet_home_conflict") return {
+		status: 409,
+		body: {
+			...result,
+			unlockBackend
+		}
+	};
 	return {
 		status: result.ok ? 200 : result.code === "internal" ? 500 : 400,
 		body: {
@@ -14382,7 +14417,7 @@ async function buildRouterAbEd25519PrivateSigningWorkerBody(input) {
 	const scope = parseRouterAbEd25519NormalSigningScopeV2(input.body.scope);
 	const signingContext = privateSigningAuthorizationContext(scope, input.authorization);
 	const trustedSourceDigest = await privateSigningTrustedSourceDigest(input.headers);
-	const materialSource = input.materialSource ?? registrationMaterialSourceV1({
+	const materialSource = registrationMaterialSourceV1({
 		accountId: scope.account_id,
 		materialActivationId: scope.material_activation.activation_id,
 		signingWorkerId: scope.signing_worker_id
@@ -15296,6 +15331,164 @@ function parseRouterAbEcdsaDerivationPoolFillStepRouteRequest(raw) {
 	};
 }
 //#endregion
+//#region src/router/transport/fetch/routes/ecdsaOperationStepUpFactor.ts
+async function verifyEcdsaOperationStepUpFactor(input) {
+	const proof = input.proof;
+	switch (proof.kind) {
+		case "passkey": {
+			if (input.authSource.kind !== "passkey" || proof.authority.factor.credentialIdB64u !== input.authSource.credentialIdB64u) return {
+				ok: false,
+				response: json$1({
+					ok: false,
+					code: "scope_mismatch",
+					message: "Passkey authority changed"
+				}, { status: 403 })
+			};
+			const credential = proof.webauthn_authentication;
+			if (String(credential.rawId || credential.id).trim() !== input.authSource.credentialIdB64u) return {
+				ok: false,
+				response: json$1({
+					ok: false,
+					code: "unauthorized",
+					message: "Passkey credential changed"
+				}, { status: 401 })
+			};
+			const verified = await input.webAuthn.verifyWebAuthnAuthenticationLite({
+				userId: input.walletId,
+				rpId: proof.authority.verifier.rpId,
+				expectedChallenge: input.expectedChallenge,
+				expected_origin: input.requestOrigin,
+				webauthn_authentication: credential
+			});
+			if (!verified.success || !verified.verified) return {
+				ok: false,
+				response: json$1({
+					ok: false,
+					code: verified.code || "not_verified",
+					message: verified.message || "WebAuthn authentication verification failed"
+				}, { status: 401 })
+			};
+			const assertionDigest = parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(credential))));
+			const verifiedAtMs = Date.now();
+			if (input.expiresAtMs <= verifiedAtMs) return expiredStepUpFactor();
+			const factorId = parseAuthFactorId(`passkey:${input.authSource.credentialIdB64u}`);
+			if (!factorId.ok) throw new Error(factorId.error.message);
+			return {
+				ok: true,
+				factor: buildVerifiedWalletOperationPasskeyFactorResult({
+					tenantId: input.operation.tenantId,
+					principalId: input.operation.principalId,
+					walletId: input.walletId,
+					requestOrigin: input.requestOrigin,
+					audience: input.requestOrigin,
+					factorId: factorId.value,
+					authorityRef: input.authorityRef,
+					operation: input.operation,
+					credentialIdB64u: proof.authority.factor.credentialIdB64u,
+					assertionDigest,
+					verifiedAtMs,
+					expiresAtMs: input.expiresAtMs
+				}),
+				unseal: { kind: "not_requested" }
+			};
+		}
+		case "email_otp": {
+			const isExport = input.operation.operation.operationKind === "evm.export_key";
+			const emailOtpOperation = isExport ? WALLET_EMAIL_OTP_EXPORT_OPERATION : WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION;
+			const operationBinding = await hashEmailOtpOperationBinding({
+				walletId: input.walletId,
+				providerUserId: proof.authority.factor.providerUserId,
+				orgId: input.operation.tenantId,
+				operation: emailOtpOperation,
+				requestOrigin: input.requestOrigin,
+				audience: input.requestOrigin,
+				authorityRef: input.authorityRef,
+				...isExport ? {} : { operationFingerprintDigest: input.operation.digests.laneDigest }
+			});
+			const verified = await input.emailOtp.verifyEmailOtpChallenge({
+				userId: proof.authority.factor.providerUserId,
+				walletId: input.walletId,
+				orgId: input.operation.tenantId,
+				challengeId: proof.challenge_id,
+				otpCode: proof.otp_code,
+				otpChannel: EMAIL_OTP_CHANNEL,
+				ownerProofBindingDigest: operationBinding,
+				operation: emailOtpOperation
+			});
+			if (!verified.ok) return {
+				ok: false,
+				response: json$1(verified, { status: verified.code === "invalid_body" ? 400 : 401 })
+			};
+			let verifiedChallengeId = verified.challengeId;
+			if (!isExport) {
+				const orgId = parseOrgId(input.operation.tenantId);
+				const providerSubject = parseProviderSubject(proof.authority.factor.providerUserId);
+				if (!orgId.ok) throw new Error(orgId.error.message);
+				if (!providerSubject.ok) throw new Error(providerSubject.error.message);
+				const consumed = await input.emailOtp.consumeEmailOtpGrant({
+					subject: {
+						kind: "provider_identity",
+						orgId: orgId.value,
+						providerSubject: providerSubject.value,
+						walletId: input.walletId
+					},
+					loginGrant: verified.loginGrant,
+					otpChannel: EMAIL_OTP_CHANNEL
+				});
+				if (!consumed.ok) return {
+					ok: false,
+					response: json$1(consumed, { status: consumed.code === "invalid_body" ? 400 : 401 })
+				};
+				verifiedChallengeId = consumed.challengeId;
+			}
+			const verificationReceiptDigest = parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
+				challengeId: verifiedChallengeId,
+				operationFingerprint: input.expectedChallenge
+			}))));
+			const verifiedAtMs = Date.now();
+			const expiresAtMs = Math.min(input.expiresAtMs, verified.grantExpiresAtMs);
+			if (expiresAtMs <= verifiedAtMs) return expiredStepUpFactor();
+			const factorId = parseAuthFactorId(`email_otp:${proof.authority.factor.provider}:${proof.authority.factor.providerUserId}`);
+			const challengeId = parseEmailOtpChallengeId(verifiedChallengeId);
+			if (!factorId.ok) throw new Error(factorId.error.message);
+			if (!challengeId.ok) throw new Error(challengeId.error.message);
+			return {
+				ok: true,
+				factor: buildVerifiedWalletOperationEmailOtpFactorResult({
+					tenantId: input.operation.tenantId,
+					principalId: input.operation.principalId,
+					walletId: input.walletId,
+					requestOrigin: input.requestOrigin,
+					audience: input.requestOrigin,
+					factorId: factorId.value,
+					authorityRef: input.authorityRef,
+					operation: input.operation,
+					challengeId: challengeId.value,
+					verificationReceiptDigest,
+					verifiedAtMs,
+					expiresAtMs
+				}),
+				unseal: isExport ? {
+					kind: "email_otp_grant",
+					grant: verified.loginGrant,
+					challenge_id: verified.challengeId
+				} : { kind: "not_requested" }
+			};
+		}
+		default: throw new Error("Unsupported ECDSA operation step-up proof");
+	}
+}
+function expiredStepUpFactor() {
+	return {
+		ok: false,
+		response: json$1({
+			ok: false,
+			code: "verified_step_up_rejected",
+			message: "Operation step-up authorization expired"
+		}, { status: 403 })
+	};
+}
+//#endregion
 //#region ../shared-ts/src/signing-lanes/recordParsers.ts
 const WALLET_KEY_COMMON_FIELDS = [
 	"kind",
@@ -16057,7 +16250,6 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 		}, { status: 400 });
 	}
 	const expectedChallenge = await computeRouterAbEcdsaOperationStepUpChallengeB64u(operation);
-	const nowMs = Date.now();
 	const requestId = operation.operation_id;
 	let freshMaterial;
 	if (v2Resolution.kind === "admitted") {
@@ -16098,112 +16290,24 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 	const evidenceSetId = requireAuthorizationValue$1(parseAuthorizationEvidenceSetId(`ecdsa-step-up-evidence-set:${requestId}`));
 	const expiresAtMs = operation.expires_at_ms;
 	const requestOrigin = authenticated.requestOrigin;
-	let emailOtpUnseal;
-	let factor;
-	switch (proof.kind) {
-		case "passkey": {
-			if (authenticated.session.laneAuthorization.authSource.kind !== "passkey" || proof.authority.factor.credentialIdB64u !== authenticated.session.laneAuthorization.authSource.credentialIdB64u) return json$1({
-				ok: false,
-				code: "scope_mismatch",
-				message: "Passkey authority changed"
-			}, { status: 403 });
-			const credential = proof.webauthn_authentication;
-			if (String(credential.rawId || credential.id).trim() !== authenticated.session.laneAuthorization.authSource.credentialIdB64u) return json$1({
-				ok: false,
-				code: "unauthorized",
-				message: "Passkey credential changed"
-			}, { status: 401 });
-			const verified = await input.ctx.service.webAuthn.verifyWebAuthnAuthenticationLite({
-				userId: authenticated.session.walletId,
-				rpId: proof.authority.verifier.rpId,
-				expectedChallenge,
-				expected_origin: requestOrigin,
-				webauthn_authentication: credential
-			});
-			if (!verified.success || !verified.verified) return json$1({
-				ok: false,
-				code: verified.code || "not_verified",
-				message: verified.message || "WebAuthn authentication verification failed"
-			}, { status: 401 });
-			factor = buildVerifiedWalletOperationPasskeyFactorResult({
-				tenantId: authenticated.session.tenantId,
-				principalId: authenticated.session.principalId,
-				walletId: walletIdFromString(authenticated.session.walletId),
-				requestOrigin,
-				audience: requestOrigin,
-				factorId: requireAuthorizationValue$1(parseAuthFactorId(`passkey:${authenticated.session.laneAuthorization.authSource.credentialIdB64u}`)),
-				authorityRef: authenticated.authorityRef,
-				operation: envelope,
-				credentialIdB64u: proof.authority.factor.credentialIdB64u,
-				assertionDigest: parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(credential)))),
-				verifiedAtMs: nowMs,
-				expiresAtMs
-			});
-			break;
-		}
-		case "email_otp": {
-			const operationBinding = await hashEmailOtpOperationBinding({
-				walletId: authenticated.session.walletId,
-				providerUserId: proof.authority.factor.providerUserId,
-				orgId: authenticated.session.tenantId,
-				operation: operation.operation_kind === "evm.export_key" ? WALLET_EMAIL_OTP_EXPORT_OPERATION : WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION,
-				requestOrigin,
-				audience: requestOrigin,
-				authorityRef: authenticated.authorityRef,
-				...operation.operation_kind === "evm.sign_transaction" ? { operationFingerprintDigest: envelope.digests.laneDigest } : {}
-			});
-			const verified = await input.ctx.service.emailOtp.verifyEmailOtpChallenge({
-				userId: proof.authority.factor.providerUserId,
-				walletId: authenticated.session.walletId,
-				orgId: authenticated.session.tenantId,
-				challengeId: proof.challenge_id,
-				otpCode: proof.otp_code,
-				otpChannel: EMAIL_OTP_CHANNEL,
-				ownerProofBindingDigest: operationBinding,
-				operation: operation.operation_kind === "evm.export_key" ? WALLET_EMAIL_OTP_EXPORT_OPERATION : WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION
-			});
-			if (!verified.ok) return json$1(verified, { status: verified.code === "invalid_body" ? 400 : 401 });
-			const consumed = operation.operation_kind === "evm.export_key" ? null : await input.ctx.service.emailOtp.consumeEmailOtpGrant({
-				subject: {
-					kind: "provider_identity",
-					orgId: requireAuthorizationValue$1(parseOrgId(authenticated.session.tenantId)),
-					providerSubject: requireAuthorizationValue$1(parseProviderSubject(proof.authority.factor.providerUserId)),
-					walletId: walletIdFromString(authenticated.session.walletId)
-				},
-				loginGrant: verified.loginGrant,
-				otpChannel: EMAIL_OTP_CHANNEL
-			});
-			if (consumed && !consumed.ok) return json$1(consumed, { status: consumed.code === "invalid_body" ? 400 : 401 });
-			if (operation.operation_kind === "evm.export_key") emailOtpUnseal = {
-				grant: verified.loginGrant,
-				challengeId: verified.challengeId
-			};
-			const verifiedChallengeId = consumed?.ok ? consumed.challengeId : verified.challengeId;
-			factor = buildVerifiedWalletOperationEmailOtpFactorResult({
-				tenantId: authenticated.session.tenantId,
-				principalId: authenticated.session.principalId,
-				walletId: walletIdFromString(authenticated.session.walletId),
-				requestOrigin,
-				audience: requestOrigin,
-				factorId: requireAuthorizationValue$1(parseAuthFactorId(`email_otp:${proof.authority.factor.provider}:${proof.authority.factor.providerUserId}`)),
-				authorityRef: authenticated.authorityRef,
-				operation: envelope,
-				challengeId: requireAuthorizationValue$1(parseEmailOtpChallengeId(verifiedChallengeId)),
-				verificationReceiptDigest: parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
-					challengeId: verifiedChallengeId,
-					operationFingerprint: expectedChallenge
-				})))),
-				verifiedAtMs: nowMs,
-				expiresAtMs: Math.min(expiresAtMs, verified.grantExpiresAtMs)
-			});
-			break;
-		}
-	}
+	const verifiedFactor = await verifyEcdsaOperationStepUpFactor({
+		proof,
+		operation: envelope,
+		walletId: walletIdFromString(authenticated.session.walletId),
+		authorityRef: authenticated.authorityRef,
+		authSource: authenticated.session.laneAuthorization.authSource,
+		requestOrigin,
+		expectedChallenge,
+		expiresAtMs,
+		webAuthn: input.ctx.service.webAuthn,
+		emailOtp: input.ctx.service.emailOtp
+	});
+	if (!verifiedFactor.ok) return verifiedFactor.response;
 	const evidenceSet = await input.ctx.service.authorizedOperations.recordVerifiedWalletOperationFactorEvidenceSet({
 		operation: envelope,
 		evidenceId,
 		evidenceSetId,
-		factor
+		factor: verifiedFactor.factor
 	});
 	const authorizedOperationId = requireAuthorizationValue$1(parseAuthorizedOperationId(`ecdsa-step-up-authorized-operation:${operation.operation_id}`));
 	const atomicOperation = await input.ctx.service.authorizedOperations.admitAuthorizedOperation({
@@ -16217,7 +16321,7 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 				evidenceSetDigest: evidenceSet.evidenceSetDigest
 			},
 			quota: { kind: "quota_neutral" },
-			claimedAtMs: nowMs
+			claimedAtMs: Date.now()
 		},
 		material: {
 			walletId: walletIdFromString(authenticated.session.walletId),
@@ -16250,11 +16354,7 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 	const responseAuthorization = {
 		kind: "operation_step_up",
 		evidence_set_digest: evidenceSet.evidenceSetDigest,
-		unseal: emailOtpUnseal ? {
-			kind: "email_otp_grant",
-			grant: emailOtpUnseal.grant,
-			challenge_id: emailOtpUnseal.challengeId
-		} : { kind: "not_requested" }
+		unseal: verifiedFactor.unseal
 	};
 	if (operation.operation_kind === "evm.export_key") {
 		const exportTopology = v2Resolution.kind === "admitted" && v2Resolution.operationKind === "evm.export_key" ? v2Resolution.exportTopology : await resolveStrictEcdsaExportTopology({
@@ -18829,7 +18929,12 @@ function bootstrapError(code, message, status) {
 //#region src/router/transport/fetch/routes/syncAccount.ts
 function syncAccountResponseStatus(result) {
 	if (result.ok && result.verified) return 200;
-	switch (result.code) {
+	return syncAccountFailureStatus(result.code);
+}
+function syncAccountFailureStatus(code) {
+	switch (code) {
+		case "wallet_home_unavailable": return 503;
+		case "wallet_home_conflict": return 409;
 		case "internal": return 500;
 		case "ed25519_not_provisioned": return 409;
 		default: return 400;
@@ -18859,7 +18964,7 @@ async function handleSyncAccount(ctx) {
 		const parsed = parseSyncAccountOptionsRequest(await readJson(ctx.request));
 		if (!parsed.ok) return json$1(parsed.body, { status: parsed.status });
 		const result = await ctx.service.webAuthn.createWebAuthnSyncAccountOptions(parsed.request);
-		return json$1(result, { status: result.ok ? 200 : result.code === "internal" ? 500 : 400 });
+		return json$1(result, { status: result.ok ? 200 : syncAccountFailureStatus(result.code) });
 	}
 	if (ctx.pathname === "/sync-account/verify") {
 		const parsed = parseSyncAccountVerifyRequest({
@@ -21652,23 +21757,15 @@ function parseOptionalPositiveInteger(raw, fieldName) {
 		value: Math.floor(value)
 	};
 }
-function parseAuthProviderAction(input) {
-	const provider = normalizeOptionalTrimmedString(input.provider);
-	const action = normalizeOptionalTrimmedString(input.action);
-	if (provider === "passkey" && action === "options") return { kind: "passkey_options" };
-	if (provider === "passkey" && action === "verify") return { kind: "passkey_verify" };
-	if (provider === "google" && action === "options") return { kind: "google_options" };
-	if (provider === "google" && action === "verify") return { kind: "google_verify" };
-	if (provider === "github" && action === "options") return { kind: "github_options" };
-	return null;
-}
 function parseAuthProviderActionPath(pathname) {
-	const parts = String(pathname || "").split("/").filter(Boolean);
-	if (parts.length !== 3 || parts[0] !== "auth") return null;
-	return parseAuthProviderAction({
-		provider: parts[1],
-		action: parts[2]
-	});
+	switch (pathname) {
+		case "/auth/passkey/options": return { kind: "passkey_options" };
+		case "/auth/passkey/verify": return { kind: "passkey_verify" };
+		case "/auth/google/options": return { kind: "google_options" };
+		case "/auth/google/verify": return { kind: "google_verify" };
+		case "/auth/github/options": return { kind: "github_options" };
+		default: return null;
+	}
 }
 function parsePasskeyLoginOptionsRequest(raw) {
 	const body = requireJsonObject(raw);
@@ -21963,6 +22060,8 @@ async function handleAuth(ctx) {
 			const parsed = parsePasskeyLoginOptionsRequest(await readJson(ctx.request));
 			if (!parsed.ok) return json$1(parsed.body, { status: parsed.status });
 			const result = await ctx.service.webAuthn.createWebAuthnLoginOptions(parsed.request);
+			if (result.code === "wallet_home_unavailable") return json$1(result, { status: 503 });
+			if (result.code === "wallet_home_conflict") return json$1(result, { status: 409 });
 			return json$1(result, { status: result.ok ? 200 : result.code === "internal" ? 500 : 400 });
 		}
 		case "passkey_verify": {
@@ -22015,28 +22114,6 @@ async function handleAuth(ctx) {
 	}
 }
 //#endregion
-//#region src/router/transport/fetch/routes/nearPublicKeys.ts
-async function handleNearPublicKeys(ctx) {
-	if (ctx.method !== "GET") return null;
-	if (ctx.pathname !== "/near/public-keys") return null;
-	try {
-		const token = extractBearerCredential(ctx.request.headers);
-		if (!token) return jsonFailure(401, "unauthorized", "No valid Wallet Session");
-		const nowMs = Date.now();
-		const exact = await ctx.service.authorizationSessions.readWalletSessionAuthorizationV2ByOperationCredential({
-			tenantId: ctx.service.authorizationSessions.tenantId,
-			token,
-			nowMs
-		});
-		if (!exact) return jsonFailure(401, "unauthorized", "No valid Wallet Session");
-		const result = await ctx.service.nearFunding.listNearPublicKeysForUser({ userId: String(exact.authorization.session.walletId) });
-		if (!result.ok) return json$1(result, { status: result.code === "not_supported" ? 501 : result.code === "invalid_args" ? 400 : 500 });
-		return json$1(result, { status: 200 });
-	} catch (e) {
-		return jsonFailure(500, "internal", e?.message || "Internal error");
-	}
-}
-//#endregion
 //#region src/router/framework/ror/normalize.ts
 function sanitizeRorOrigins(origins) {
 	const list = Array.isArray(origins) ? origins : [];
@@ -22151,6 +22228,137 @@ async function handleWellKnown(ctx) {
 	});
 }
 //#endregion
+//#region src/router/transport/fetch/routes/deviceLinkingResponses.ts
+function projectLinkSessionStateV1(state) {
+	switch (state.state) {
+		case "displaying_qr": return { state: "displaying_qr" };
+		case "claimed":
+		case "awaiting_target_factor":
+		case "awaiting_source_contribution":
+		case "provisioning": return {
+			state: state.state,
+			deviceId: state.deviceId
+		};
+		case "authority_pending_local_install": return {
+			state: "authority_pending_local_install",
+			deviceId: state.deviceId,
+			authorityId: state.authorityId,
+			packageSetDigestB64u: state.packageSetDigestB64u
+		};
+		case "active": return {
+			state: "active",
+			deviceId: state.deviceId,
+			authorityId: state.authorityId,
+			activatedAtMs: state.activatedAtMs
+		};
+		case "failed_before_commit": return {
+			state: "failed_before_commit",
+			error: state.error
+		};
+		case "cancelled": return {
+			state: "cancelled",
+			cancelledAtMs: state.cancelledAtMs
+		};
+		case "expired": return {
+			state: "expired",
+			expiredAtMs: state.expiredAtMs
+		};
+		default: return assertNeverLinkSessionStateV1(state);
+	}
+}
+function projectSession(record) {
+	return {
+		kind: "linked_device_session_projection_v1",
+		linkSessionId: record.linkSessionId,
+		qrPayload: record.qrPayload,
+		revision: record.revision,
+		createdAtMs: record.createdAtMs,
+		updatedAtMs: record.updatedAtMs,
+		state: projectLinkSessionStateV1(record.state)
+	};
+}
+function invalidStateResponse(record) {
+	return json$1({
+		ok: false,
+		outcome: "invalid_state",
+		state: record.state.state,
+		session: projectSession(record)
+	}, { status: 409 });
+}
+function sessionProjectionResponse(record, outcome) {
+	return json$1({
+		ok: true,
+		outcome,
+		session: projectSession(record)
+	}, { status: 200 });
+}
+function targetCredentialResultResponse(record, outcome, targetCredential) {
+	return json$1({
+		ok: true,
+		outcome,
+		targetCredential,
+		session: projectSession(record)
+	}, { status: 200 });
+}
+function exportRootWriteResponse(result) {
+	return result.outcome === "conflict" ? json$1({
+		ok: false,
+		code: result.reason ?? "conflict",
+		message: "export-root relay conflict"
+	}, { status: 409 }) : json$1({
+		ok: true,
+		outcome: result.outcome
+	}, { status: 200 });
+}
+function invalidInputResponse(message) {
+	return json$1({
+		ok: false,
+		outcome: "invalid_input",
+		code: "invalid_input",
+		message
+	}, { status: 400 });
+}
+function notSupportedResponse(message = "Device linking is not configured") {
+	return json$1({
+		ok: false,
+		code: "not_supported",
+		message
+	}, { status: 501 });
+}
+function notFoundResponse() {
+	return json$1({
+		ok: false,
+		code: "not_found",
+		message: "Linked-device session not found"
+	}, { status: 404 });
+}
+function methodNotAllowedResponse$2() {
+	return json$1({
+		ok: false,
+		code: "method_not_allowed",
+		message: "Method is not allowed"
+	}, { status: 405 });
+}
+function authDeniedResponse$2(result) {
+	if (result.code === "unavailable") return json$1({
+		ok: false,
+		code: result.code,
+		message: result.message
+	}, { status: 503 });
+	return json$1({
+		ok: false,
+		outcome: "unauthorized",
+		code: result.code,
+		message: result.message
+	}, { status: result.code === "expired" ? 410 : 401 });
+}
+//#endregion
+//#region src/core/deviceLinking/linkedDeviceBootstrap.ts
+function linkedDeviceBootstrapFailure(error) {
+	if (error && typeof error === "object" && "code" in error && (error.code === "home_conflict" || error.code === "home_unavailable")) return error.code;
+	return null;
+}
+//#endregion
 //#region ../shared-ts/src/utils/exactKeys.ts
 /**
 * True when `value` is a non-array object whose own enumerable string keys are exactly `keys`.
@@ -22272,6 +22480,11 @@ async function handleDeviceLinking(ctx) {
 			default: return assertNever$1(action);
 		}
 	} catch (error) {
+		const bootstrapFailure = linkedDeviceBootstrapFailure(error);
+		if (bootstrapFailure) return sessionResultResponse({
+			outcome: bootstrapFailure,
+			message: "Linked-device bootstrap authority failed"
+		});
 		if (error instanceof DeviceLinkingInputError) return invalidInputResponse(error.message);
 		return json$1({
 			ok: false,
@@ -22283,7 +22496,7 @@ async function handleDeviceLinking(ctx) {
 async function handleCreate(ctx, service, nowMs) {
 	if (ctx.method !== "POST") return methodNotAllowedResponse$2();
 	const bodyDigestB64u = await requestBodyDigest$1(ctx.request);
-	const rawBody = await readJsonBody(ctx.request);
+	const rawBody = await readJson(ctx.request);
 	const body = parseBoundary$1(() => parseCreateRequest(rawBody));
 	const keyDigest = await computeDevicePublicKeyDigestB64u(body.payload.devicePublicKeyB64u);
 	const proof = parseBoundary$1(() => parseRequestProofHeader(ctx.request));
@@ -22360,7 +22573,7 @@ async function handleApproval(ctx, service, rawLinkSessionId, nowMs) {
 		});
 		if (!session) return notFoundResponse();
 		const ownerMismatch = requireOwnerMatchesClaimedWallet(authentication.owner, session);
-		if (ownerMismatch) return ownerMismatch;
+		if (ownerMismatch) return authDeniedResponse$2(ownerMismatch);
 		if (authentication.owner.walletId !== approval.walletId) return authDeniedResponse$2({
 			kind: "denied",
 			code: "unauthorized",
@@ -22444,6 +22657,7 @@ async function handleCredential(ctx, service, rawLinkSessionId, nowMs) {
 async function handleSourceContributionPreparation(ctx, service, rawLinkSessionId, nowMs) {
 	const owner = await authenticateOwnerForSession(ctx, service, parseSessionId(rawLinkSessionId), nowMs);
 	if (owner.kind !== "authorized") return ownerSessionResponse(owner);
+	if (isLinkSessionTerminalFailureV1(owner.session.state)) return invalidStateResponse(owner.session);
 	if (ctx.method !== "GET") return methodNotAllowedResponse$2();
 	const preparation = owner.session.sourceContributionPreparation;
 	if (!preparation) return new Response(null, { status: 204 });
@@ -22494,10 +22708,6 @@ async function handleSourceContribution(ctx, service, rawLinkSessionId, nowMs) {
 	}));
 	return sessionProjectionResponse(committed.session, committed.kind === "replayed" ? "replayed" : recorded.outcome);
 }
-/**
-* A precommit failure's reason is a single token. The installer's message
-* keeps its words, joined, so the session still says what failed.
-*/
 function precommitFailureReasonV1(message) {
 	const token = message.trim().replace(/\s+/g, "_").replace(/[\u0000-\u001f\u007f]/g, "");
 	return token.length > 0 ? token : "authority_commit_failed";
@@ -22506,6 +22716,7 @@ async function handleSourceContributionExecute(ctx, service, rawLinkSessionId, n
 	if (ctx.method !== "POST") return methodNotAllowedResponse$2();
 	const owner = await authenticateOwnerForSession(ctx, service, parseSessionId(rawLinkSessionId), nowMs);
 	if (owner.kind !== "authorized") return ownerSessionResponse(owner);
+	if (isLinkSessionTerminalFailureV1(owner.session.state)) return invalidStateResponse(owner.session);
 	const router = service.sourceContributionRouter;
 	if (!router) return notSupportedResponse("Ed25519 source-preserving linking is not configured");
 	const preparation = requireEd25519SourceContributionPreparation(owner.session);
@@ -22578,8 +22789,6 @@ async function handleEmailOtpBaseFactor(ctx, service, rawLinkSessionId, nowMs) {
 	const authenticated = await authenticateOwnerForSession(ctx, service, parseSessionId(rawLinkSessionId), nowMs);
 	if (authenticated.kind !== "authorized") return ownerSessionResponse(authenticated);
 	const session = authenticated.session;
-	const ownerMismatch = requireOwnerMatchesClaimedWallet(authenticated.owner, session);
-	if (ownerMismatch) return ownerMismatch;
 	if (session.state.state !== "claimed" || session.qrPayload.targetFactor.kind !== "email_otp" || !session.claimTranscript) return invalidStateResponse(session);
 	const walletId = session.claimTranscript.value.walletId;
 	const request = parseBoundary$1(() => parseLinkedDeviceEmailOtpBaseFactorRequestV1(authenticated.body));
@@ -22607,8 +22816,6 @@ async function handleOwnerCancel(ctx, service, rawLinkSessionId, nowMs) {
 	if (authenticated.kind !== "authorized") return ownerSessionResponse(authenticated);
 	parseBoundary$1(() => parseOwnerCancelRequest(authenticated.body));
 	const session = authenticated.session;
-	const ownerMismatch = requireOwnerMatchesClaimedWallet(authenticated.owner, session);
-	if (ownerMismatch) return ownerMismatch;
 	if (session.state.state === "cancelled") return sessionProjectionResponse(session, "replayed");
 	return sessionResultResponse(await service.sessionService.cancelSessionV1({
 		linkSessionId,
@@ -22656,6 +22863,7 @@ async function handleExportRootRecipient(ctx, service, rawLinkSessionId, nowMs)
 	if (ctx.method === "GET") {
 		const owner = await authenticateOwnerForSession(ctx, service, sessionId, nowMs);
 		if (owner.kind !== "authorized") return ownerSessionResponse(owner);
+		if (isLinkSessionTerminalFailureV1(owner.session.state)) return invalidStateResponse(owner.session);
 		const transfer = await port.readTransferV1(sessionId);
 		return transfer ? json$1(transfer.recipient, { status: 200 }) : new Response(null, { status: 204 });
 	}
@@ -22663,8 +22871,14 @@ async function handleExportRootRecipient(ctx, service, rawLinkSessionId, nowMs)
 	const authenticated = await authenticateDeviceForSession(ctx, service, rawLinkSessionId, nowMs);
 	if (authenticated.kind === "denied") return authDeniedResponse$2(authenticated);
 	if (authenticated.kind === "not_found") return notFoundResponse();
+	if (isLinkSessionTerminalFailureV1(authenticated.session.state)) return invalidStateResponse(authenticated.session);
 	const recipient = parseBoundary$1(() => parseLinkedDeviceEd25519ExportRootRecipientV1(authenticated.body));
 	if (recipient.linkSessionId !== authenticated.linkSessionId) return invalidInputResponse("link session id does not match route");
+	const session = authenticated.session;
+	const preparation = await readTargetPreparation(service, session, requireApproval(session), { access: "replay_only" }, nowMs);
+	if (preparation.kind === "conflict") return invalidStateResponse(session);
+	const facts = preparation.ed25519ExportRoot;
+	if (!facts || recipient.walletId !== preparation.walletId || recipient.enrollmentId !== preparation.enrollmentId || recipient.deviceId !== preparation.deviceId || recipient.targetFactor.kind !== preparation.targetFactor.kind || recipient.walletKeyId !== facts.walletKeyId || recipient.revocationEpoch !== facts.revocationEpoch || recipient.applicationBindingDigestB64u !== facts.applicationBindingDigestB64u || recipient.registeredPublicKeyB64u !== facts.registeredPublicKeyB64u) return invalidInputResponse("export-root recipient does not match target preparation");
 	return exportRootWriteResponse(await port.registerRecipientV1({ recipient }));
 }
 async function handleExportRootPackage(ctx, service, rawLinkSessionId, nowMs) {
@@ -22675,12 +22889,14 @@ async function handleExportRootPackage(ctx, service, rawLinkSessionId, nowMs) {
 		const authenticated = await authenticateDeviceForSession(ctx, service, rawLinkSessionId, nowMs);
 		if (authenticated.kind === "denied") return authDeniedResponse$2(authenticated);
 		if (authenticated.kind === "not_found") return notFoundResponse();
+		if (isLinkSessionTerminalFailureV1(authenticated.session.state)) return invalidStateResponse(authenticated.session);
 		const transfer = await port.readTransferV1(sessionId);
 		return transfer?.state === "sealed" ? json$1(transfer.package, { status: 200 }) : new Response(null, { status: 204 });
 	}
 	if (ctx.method !== "POST") return methodNotAllowedResponse$2();
 	const owner = await authenticateOwnerForSession(ctx, service, sessionId, nowMs);
 	if (owner.kind !== "authorized") return ownerSessionResponse(owner);
+	if (isLinkSessionTerminalFailureV1(owner.session.state)) return invalidStateResponse(owner.session);
 	const submission = parseBoundary$1(() => parseLinkedDeviceEd25519ExportRootSubmissionV1(owner.body));
 	if (submission.linkSessionId !== sessionId) return invalidInputResponse("link session id does not match route");
 	return exportRootWriteResponse(await port.submitPackageV1({
@@ -22692,7 +22908,7 @@ async function handleReceipt(ctx, service, rawLinkSessionId, nowMs) {
 	if (!service.installationReceipt) return notSupportedResponse("Installation receipt is not configured");
 	if (ctx.method !== "POST") return methodNotAllowedResponse$2();
 	const linkSessionId = parseSessionId(rawLinkSessionId);
-	const rawBody = await readJsonBody(ctx.request.clone());
+	const rawBody = await readJson(ctx.request.clone());
 	if (isFinalActivationAcknowledgement(rawBody)) {
 		const acknowledgement = parseBoundary$1(() => parseLocalAuthorityActivationFinalAckV1(rawBody));
 		if (acknowledgement.linkSessionId !== linkSessionId) return invalidInputResponse("activation acknowledgement session does not match the route");
@@ -22878,6 +23094,8 @@ async function authenticateOwnerForSession(ctx, service, linkSessionId, nowMs) {
 	});
 	if (!session) return { kind: "not_found" };
 	validateOwnerRequestBinding(authentication.binding, ctx, bodyDigestB64u, nowMs);
+	const ownerMismatch = requireOwnerMatchesClaimedWallet(authentication.owner, session);
+	if (ownerMismatch) return ownerMismatch;
 	return {
 		kind: "authorized",
 		body: authentication.body,
@@ -23082,69 +23300,6 @@ async function authenticateTargetPasskeyOriginV1(ctx, routeId) {
 		expectedOrigin
 	};
 }
-function projectLinkSessionStateV1(state) {
-	switch (state.state) {
-		case "displaying_qr": return { state: "displaying_qr" };
-		case "claimed":
-		case "awaiting_target_factor":
-		case "awaiting_source_contribution":
-		case "provisioning": return {
-			state: state.state,
-			deviceId: state.deviceId
-		};
-		case "authority_pending_local_install": return {
-			state: "authority_pending_local_install",
-			deviceId: state.deviceId,
-			authorityId: state.authorityId,
-			packageSetDigestB64u: state.packageSetDigestB64u
-		};
-		case "active": return {
-			state: "active",
-			deviceId: state.deviceId,
-			authorityId: state.authorityId,
-			activatedAtMs: state.activatedAtMs
-		};
-		case "failed_before_commit": return {
-			state: "failed_before_commit",
-			error: state.error
-		};
-		case "cancelled": return {
-			state: "cancelled",
-			cancelledAtMs: state.cancelledAtMs
-		};
-		case "expired": return {
-			state: "expired",
-			expiredAtMs: state.expiredAtMs
-		};
-		default: return assertNeverLinkSessionStateV1(state);
-	}
-}
-function projectSession(record) {
-	return {
-		kind: "linked_device_session_projection_v1",
-		linkSessionId: record.linkSessionId,
-		qrPayload: record.qrPayload,
-		revision: record.revision,
-		createdAtMs: record.createdAtMs,
-		updatedAtMs: record.updatedAtMs,
-		state: projectLinkSessionStateV1(record.state)
-	};
-}
-function sessionProjectionResponse(record, outcome) {
-	return json$1({
-		ok: true,
-		outcome,
-		session: projectSession(record)
-	}, { status: 200 });
-}
-function targetCredentialResultResponse(record, outcome, targetCredential) {
-	return json$1({
-		ok: true,
-		outcome,
-		targetCredential,
-		session: projectSession(record)
-	}, { status: 200 });
-}
 function claimResultResponse(result) {
 	if (result.outcome !== "applied" && result.outcome !== "replayed") return sessionResultResponse(result);
 	const claim = result.record.claimTranscript?.value;
@@ -23173,6 +23328,16 @@ function approvalResultResponse(result) {
 }
 function sessionResultResponse(result) {
 	switch (result.outcome) {
+		case "home_conflict": return json$1({
+			ok: false,
+			code: "wallet_home_conflict",
+			message: result.message
+		}, { status: 409 });
+		case "home_unavailable": return json$1({
+			ok: false,
+			code: "wallet_home_unavailable",
+			message: result.message
+		}, { status: 503 });
 		case "applied":
 		case "replayed": return sessionProjectionResponse(result.record, result.outcome);
 		case "conflict": return json$1({
@@ -23213,49 +23378,19 @@ function sessionResultResponse(result) {
 		default: return assertNever$1(result);
 	}
 }
-function invalidStateResponse(record) {
-	return json$1({
-		ok: false,
-		outcome: "invalid_state",
-		state: record.state.state,
-		session: projectSession(record)
-	}, { status: 409 });
-}
-function exportRootWriteResponse(result) {
-	return result.outcome === "conflict" ? json$1({
-		ok: false,
-		code: result.reason ?? "conflict",
-		message: "export-root relay conflict"
-	}, { status: 409 }) : json$1({
-		ok: true,
-		outcome: result.outcome
-	}, { status: 200 });
-}
 function ownerSessionResponse(context) {
 	return context.kind === "denied" ? authDeniedResponse$2(context) : notFoundResponse();
 }
-/**
-* The one owner-to-session binding, shared by every owner route on a claimed
-* session. It runs before any state is disclosed: an authenticated owner of a
-* DIFFERENT wallet must get the same denial for every state, not a projection
-* or an invalid-state body. An unclaimed session has no wallet to bind to yet,
-* so the caller's state checks answer instead.
-*/
 function requireOwnerMatchesClaimedWallet(owner, session) {
 	const claimWalletId = session.claimTranscript?.value.walletId;
 	if (claimWalletId === void 0) return null;
 	if (owner.walletId === claimWalletId) return null;
-	return authDeniedResponse$2({
+	return {
 		kind: "denied",
 		code: "unauthorized",
 		message: "owner session does not match link wallet"
-	});
+	};
 }
-/**
-* Approval-time revalidation of the selected Email OTP base method. The same
-* eligibility question the dedicated base-factor route answers, asked once
-* more with the id the approval names, so the two paths cannot drift.
-*/
 async function requireSelectedEmailOtpBaseFactorV1(service, session, input) {
 	const provider = service.emailOtpTargetFactor;
 	if (!provider) return notSupportedResponse("Email OTP linking is not configured");
@@ -23274,43 +23409,6 @@ async function requireSelectedEmailOtpBaseFactorV1(service, session, input) {
 	});
 	return null;
 }
-function authDeniedResponse$2(result) {
-	return json$1({
-		ok: false,
-		outcome: "unauthorized",
-		code: result.code,
-		message: result.message
-	}, { status: result.code === "expired" ? 410 : 401 });
-}
-function invalidInputResponse(message) {
-	return json$1({
-		ok: false,
-		outcome: "invalid_input",
-		code: "invalid_input",
-		message
-	}, { status: 400 });
-}
-function notSupportedResponse(message = "Device linking is not configured") {
-	return json$1({
-		ok: false,
-		code: "not_supported",
-		message
-	}, { status: 501 });
-}
-function notFoundResponse() {
-	return json$1({
-		ok: false,
-		code: "not_found",
-		message: "Linked-device session not found"
-	}, { status: 404 });
-}
-function methodNotAllowedResponse$2() {
-	return json$1({
-		ok: false,
-		code: "method_not_allowed",
-		message: "Method is not allowed"
-	}, { status: 405 });
-}
 function parseCreateRequest(raw) {
 	const record = requireRecord(raw, "device-linking create request");
 	requireExactKeys$1(record, ["kind", "payload"]);
@@ -23375,9 +23473,6 @@ function parseB64uBytes(raw, field) {
 	if (bytes.length === 0 || base64UrlEncode(bytes) !== raw) throw new Error(`${field} is not canonical base64url`);
 	return bytes;
 }
-async function readJsonBody(request) {
-	return await readJson(request);
-}
 function parseBoundary$1(parse) {
 	try {
 		return parse();
@@ -23924,7 +24019,8 @@ function methodNotAllowedResponse() {
 	}, { status: 405 });
 }
 function authDeniedResponse(value) {
-	return jsonFailure(value.code === "expired" ? 401 : value.code === "invalid" ? 403 : 401, value.code, value.message);
+	if (value.code === "unavailable") return jsonFailure(503, value.code, value.message);
+	return jsonFailure(value.code === "invalid" ? 403 : 401, value.code, value.message);
 }
 //#endregion
 //#region src/threshold/session/signingSessionSeal/transport/fetch.ts
@@ -24330,7 +24426,6 @@ function createFetchRouter(service, opts, runtime) {
 		handleThresholdEcdsa,
 		handleExactWalletSigningSessionSeal,
 		handleWebAuthnAuthenticators,
-		handleNearPublicKeys,
 		handleExactWalletSessionStatus,
 		handleHostedWalletSessionExchangeIssue,
 		handleHostedWalletSessionExchangeRedeem,
@@ -25938,8 +26033,8 @@ function resolveTraceContext(request) {
 var InMemoryRouterAbEd25519YaoExportStateV1 = class {
 	constructor() {
 		this.exports = /* @__PURE__ */ new Map();
-		this.authorizationNonces = /* @__PURE__ */ new Set();
-		this.authorizationUncertain = /* @__PURE__ */ new Set();
+		this.authorizationNonceOwners = /* @__PURE__ */ new Map();
+		this.authorizationUncertainOwners = /* @__PURE__ */ new Map();
 	}
 };
 const ROUTES = Object.freeze([defineRoute({