@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRuntime.js

@@ -1,21 +1,14 @@
 import { InMemoryRouterAbEd25519YaoRegistrationService } from "../registration/routerAbEd25519YaoRegistration.js";
 import { InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter } from "../registration/routerAbEd25519YaoRegistrationIntentAuthorization.js";
-import { InMemoryRouterAbEd25519YaoRecoveryService } from "../recovery/routerAbEd25519YaoRecovery.js";
-import { routerAbEd25519YaoPersistedCapabilityMatchesLookupV1 } from "./routerAbEd25519YaoProductRegistration.js";
-import { parseRouterAbEd25519YaoRegistrationRouterAnswerV1 } from "../registration/routerAbEd25519YaoHttpRegistrationBackend.js";
 import { pinRouterAbEd25519YaoRegistrationDispatchRootV1, routerAbEd25519YaoRegistrationExecuteRequestFromRouterRequestJsonV1, routerAbEd25519YaoRegistrationResultFromRouterAnswerV1 } from "../registration/routerAbEd25519YaoRegistrationExecutionRecord.js";
+import { resolveRouterAbEd25519YaoActiveCapability } from "../recovery/routerAbEd25519YaoRecovery.js";
+import { routerAbEd25519YaoRegistrationSigningRootIdV1 } from "../routerAbEd25519YaoGatewayEnvelope.js";
+import { routerAbEd25519YaoPersistedCapabilityMatchesLookupV1 } from "./routerAbEd25519YaoProductRegistration.js";
 import { routerAbEd25519YaoAdmittedRegistrationAuthorityV1 } from "./routerAbEd25519YaoProductRegistrationPartitionedStateStore.js";
+import { parseRouterAbEd25519YaoRegistrationRouterAnswerV1 } from "../registration/routerAbEd25519YaoHttpRegistrationBackend.js";
+import { rehydrateRouterAbEd25519YaoCapability } from "./routerAbEd25519YaoCapabilityCommit.js";
 //#region src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRuntime.ts
-const SHARED_CAPABILITY_READ_LIFECYCLE_ID = "shared-capability-read";
 const MAX_DETERMINISTIC_COMMIT_ATTEMPTS = 2;
-const UNUSED_BACKEND = {
-	admit: rejectUnusedBackend,
-	execute: rejectUnusedBackend,
-	admitRecovery: rejectUnusedBackend,
-	resolveRecoveryDispatchRoot: rejectUnusedBackend,
-	executeRecovery: rejectUnusedBackend,
-	activateRecovery: rejectUnusedBackend
-};
 /**
 * Product-state runtime for wallet start/finalize routes. Each mutation loads
 * fresh partitioned state and reconciles CAS conflicts by reapplying only the
@@ -33,11 +26,28 @@ var RouterAbEd25519YaoProductRegistrationRequestScopedRuntime = class {
 		if (!this.signingWorkerId) throw new Error("Ed25519 Yao SigningWorker ID is required");
 	}
 	async bindVerifiedIntent(input) {
-		return await this.commitUntilReconciled(input.admissionRequest.scope.lifecycle_id, bindVerifiedIntentMutation.bind(void 0, input));
+		for (let attempt = 0; attempt < MAX_DETERMINISTIC_COMMIT_ATTEMPTS; attempt += 1) {
+			const loaded = await this.input.store.loadRegistration(input.admissionRequest.scope.lifecycle_id);
+			const result = await new InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter(loaded.state.authorization).bindVerifiedIntent(input);
+			if (!result.ok) return result;
+			if ((await this.input.store.commitRegistration(loaded, null)).kind !== "stored") continue;
+			return result;
+		}
+		throw new Error("Registration intent remained contended after one reconciliation");
+	}
+	startRegistrationDispatchRoot(signingRootId) {
+		const dispatchRoot = this.input.registrationBackend.resolveRegistrationDispatchRoot(signingRootId);
+		dispatchRoot.catch(ignoreUnobservedDispatchRoot);
+		return {
+			signingRootId,
+			dispatchRoot
+		};
 	}
-	async bindAndAdmitVerifiedRegistration(input) {
+	async bindAndAdmitVerifiedRegistration(input, companionWrite, startedDispatchRoot) {
 		return await bindAndAdmitVerifiedRegistration({
 			input,
+			companionWrite,
+			startedDispatchRoot,
 			store: this.input.store,
 			backend: this.input.registrationBackend
 		});
@@ -51,7 +61,7 @@ var RouterAbEd25519YaoProductRegistrationRequestScopedRuntime = class {
 	*/
 	async consumeActivated(input) {
 		const lifecycleId = input.reference.lifecycleId;
-		const authority = routerAbEd25519YaoAdmittedRegistrationAuthorityV1((await this.input.store.load(lifecycleId)).state, lifecycleId);
+		const authority = routerAbEd25519YaoAdmittedRegistrationAuthorityV1((await this.input.store.loadRegistration(lifecycleId)).state, lifecycleId);
 		if (!authority) return {
 			ok: false,
 			code: "unknown_registration",
@@ -59,9 +69,7 @@ var RouterAbEd25519YaoProductRegistrationRequestScopedRuntime = class {
 		};
 		const backend = this.input.registrationBackend;
 		const consumed = await backend.consumeRegistration({
-			tenantRoot: authority.dispatchRoot,
-			walletId: authority.admissionReceipt.binding.lifecycle.account_id,
-			lifecycleId,
+			authority,
 			sessionId: input.reference.sessionId,
 			consumerBinding: input.consumerBinding
 		});
@@ -91,14 +99,11 @@ var RouterAbEd25519YaoProductRegistrationRequestScopedRuntime = class {
 			}
 		};
 	}
-	async installRegistrationFinalizeCapability(input) {
-		return await this.commitUntilReconciled(input.registrationAdmissionRequest.scope.lifecycle_id, installRegistrationFinalizeCapabilityMutation.bind(void 0, input));
-	}
 	async installPersistedActiveCapability(input) {
-		return await this.commitUntilReconciled(input.admissionRequest.scope.lifecycle_id, installPersistedActiveCapabilityMutation.bind(void 0, input));
+		return await rehydrateRouterAbEd25519YaoCapability(this.input.store, input);
 	}
 	async resolveActiveCapability(input) {
-		const result = recoveryService((await this.input.store.load(SHARED_CAPABILITY_READ_LIFECYCLE_ID)).state).resolveActiveCapability(input);
+		const result = resolveRouterAbEd25519YaoActiveCapability((await this.input.store.loadCapabilities()).value.recoveryCapabilities, input);
 		if (result.ok || result.code !== "unknown_capability" || !this.input.loadPersistedActiveCapability) return result;
 		const persisted = await this.input.loadPersistedActiveCapability(input);
 		if (!persisted || !routerAbEd25519YaoPersistedCapabilityMatchesLookupV1(persisted, input)) return result;
@@ -108,48 +113,52 @@ var RouterAbEd25519YaoProductRegistrationRequestScopedRuntime = class {
 			code: "capability_conflict",
 			message: installed.message
 		};
-		return recoveryService((await this.input.store.load(SHARED_CAPABILITY_READ_LIFECYCLE_ID)).state).resolveActiveCapability(input);
-	}
-	async commitUntilReconciled(lifecycleId, mutate) {
-		for (let attempt = 0; attempt < MAX_DETERMINISTIC_COMMIT_ATTEMPTS; attempt += 1) {
-			const loaded = await this.input.store.load(lifecycleId);
-			const mutation = await mutate(loaded.state);
-			if (mutation.kind === "reject") return mutation.value;
-			if ((await this.input.store.commit(commitInput(lifecycleId, loaded))).kind === "stored") return mutation.value;
-		}
-		throw new Error("Request-scoped product state remained contended after one reconciliation");
+		return resolveRouterAbEd25519YaoActiveCapability((await this.input.store.loadCapabilities()).value.recoveryCapabilities, input);
 	}
 };
 /**
 * Binds a verified intent and admits its registration. The tenant root the
 * registration dispatches to is resolved once, for a fresh admission, and
-* pinned with the admission in the ceremony record.
+* pinned with the admission in the ceremony record. A companion write commits
+* in that record's batch.
 */
 async function bindAndAdmitVerifiedRegistration(input) {
 	const lifecycleId = input.input.admissionRequest.scope.lifecycle_id;
 	let backendResult = null;
 	let dispatchRoot = null;
 	for (let attempt = 0; attempt < MAX_DETERMINISTIC_COMMIT_ATTEMPTS; attempt += 1) {
-		const loaded = await input.store.load(lifecycleId);
-		const bound = await new InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter(loaded.state.authorization).bindVerifiedIntent(input.input);
+		const loaded = await input.store.loadRegistration(lifecycleId);
+		const bound = await new InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter(loaded.state.authorization).bindAndAuthorizeAdmission(input.input);
 		if (!bound.ok) return bound;
 		const service = new InMemoryRouterAbEd25519YaoRegistrationService(input.backend, loaded.state.registration);
 		const preparation = service.prepareAdmit(bound.admissionRequest);
 		if (preparation.kind === "completed") return {
 			ok: true,
 			status: 200,
-			value: preparation.value
+			admissionRequest: bound.admissionRequest,
+			value: preparation.value,
+			companionWrite: "not_committed"
 		};
 		if (preparation.kind === "failed") return preparation.failure;
-		if (dispatchRoot === null) try {
-			dispatchRoot = await input.backend.resolveRegistrationDispatchRoot(bound.admissionRequest);
-		} catch (error) {
-			return {
+		if (dispatchRoot === null) {
+			const signingRootId = routerAbEd25519YaoRegistrationSigningRootIdV1(bound.admissionRequest);
+			const started = input.startedDispatchRoot;
+			if (started !== null && (started.signingRootId.signing_root_id !== signingRootId.signing_root_id || started.signingRootId.root_share_epoch !== signingRootId.root_share_epoch)) return {
 				ok: false,
 				status: 503,
 				code: "admission_failed",
-				message: `registration tenant root is unavailable: ${error instanceof Error ? error.message : String(error)}`
+				message: "registration tenant root was read for another signing root ID"
 			};
+			try {
+				dispatchRoot = await (started ? started.dispatchRoot : input.backend.resolveRegistrationDispatchRoot(signingRootId));
+			} catch (error) {
+				return {
+					ok: false,
+					status: 503,
+					code: "admission_failed",
+					message: `registration tenant root is unavailable: ${error instanceof Error ? error.message : String(error)}`
+				};
+			}
 		}
 		if (backendResult === null) try {
 			backendResult = await input.backend.admit(bound.admissionRequest);
@@ -171,7 +180,13 @@ async function bindAndAdmitVerifiedRegistration(input) {
 		});
 		if (!admitted.ok) return admitted;
 		pinRouterAbEd25519YaoRegistrationDispatchRootV1(loaded.state.registration, lifecycleId, dispatchRoot);
-		if ((await input.store.commit(commitInput(lifecycleId, loaded))).kind === "stored") return admitted;
+		if ((await input.store.commitRegistration(loaded, input.companionWrite?.(bound.admissionRequest) ?? null)).kind === "stored") return {
+			ok: true,
+			status: 200,
+			admissionRequest: bound.admissionRequest,
+			value: admitted.value,
+			companionWrite: input.companionWrite ? "committed" : "not_committed"
+		};
 	}
 	return {
 		ok: false,
@@ -180,50 +195,7 @@ async function bindAndAdmitVerifiedRegistration(input) {
 		message: "Yao verified registration admission remained contended after one reconciliation"
 	};
 }
-async function bindVerifiedIntentMutation(input, state) {
-	const result = await new InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter(state.authorization).bindVerifiedIntent(input);
-	return result.ok ? {
-		kind: "commit",
-		value: result
-	} : {
-		kind: "reject",
-		value: result
-	};
-}
-async function installRegistrationFinalizeCapabilityMutation(input, state) {
-	const result = recoveryService(state).installRegistrationFinalizeCapability(input);
-	return result.ok ? {
-		kind: "commit",
-		value: result
-	} : {
-		kind: "reject",
-		value: result
-	};
-}
-async function installPersistedActiveCapabilityMutation(input, state) {
-	const result = recoveryService(state).installPersistedActiveCapability(input);
-	return result.ok ? {
-		kind: "commit",
-		value: result
-	} : {
-		kind: "reject",
-		value: result
-	};
-}
-function recoveryService(state) {
-	return new InMemoryRouterAbEd25519YaoRecoveryService(UNUSED_BACKEND, state.recovery);
-}
-function commitInput(lifecycleId, loaded) {
-	return {
-		lifecycleId,
-		state: loaded.state,
-		baseline: loaded.baseline,
-		companionWrite: null
-	};
-}
-async function rejectUnusedBackend() {
-	throw new Error("Request-scoped product runtime invoked an unavailable protocol backend");
-}
+function ignoreUnobservedDispatchRoot() {}
 //#endregion
 export { createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1 };
 

package/dist/esm/router/domains/ed25519Yao/export/routerAbEd25519YaoExport.js

@@ -1,11 +1,11 @@
 import { parseEmailOtpChallengeId, parseThresholdEd25519SessionId, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseAuthFactorId, parseAuthorizationAuditEventId, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parsePrincipalId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { buildCapabilityOperationEnvelope } from "../../../../shared-ts/src/authorization/operationFingerprint.js";
 import "../../../../shared-ts/src/utils/encoders.js";
-import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
 import { sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { deriveRouterAbEd25519YaoExportAuthorizationDigestV1, deriveRouterAbEd25519YaoExportConfirmationDigestV1, deriveRouterAbEd25519YaoRuntimePolicyBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519YaoDigests.js";
 import { ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, parseRouterAbEd25519YaoExportAdmissionReceiptV1, parseRouterAbEd25519YaoExportAdmissionRequestV1, parseRouterAbEd25519YaoExportExecuteRequestV1, parseRouterAbEd25519YaoExportResultV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
@@ -45,8 +45,8 @@ function resolveTraceContext(request) {
 var InMemoryRouterAbEd25519YaoExportStateV1 = class {
 	constructor() {
 		this.exports = /* @__PURE__ */ new Map();
-		this.authorizationNonces = /* @__PURE__ */ new Set();
-		this.authorizationUncertain = /* @__PURE__ */ new Set();
+		this.authorizationNonceOwners = /* @__PURE__ */ new Map();
+		this.authorizationUncertainOwners = /* @__PURE__ */ new Map();
 	}
 };
 function bytesToHex(bytes) {
@@ -177,19 +177,19 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 		this.state = state;
 	}
 	authorizationIsUncertain(request) {
-		return this.state.authorizationUncertain.has(exportKey(request));
+		return this.state.authorizationUncertainOwners.has(exportKey(request));
 	}
 	recordAuthorizationUncertain(request) {
-		this.state.authorizationUncertain.add(exportKey(request));
+		this.state.authorizationUncertainOwners.set(exportKey(request), request.scope.account_id);
 	}
-	async admitExport(request, authorizationIdentity, admission, factorRelease, traceContext) {
+	async admitExport(request, authorizationIdentity, ownershipGeneration, admission, factorRelease, traceContext) {
 		const admitted = await admission.admit();
 		if (!admitted.ok) return failure({
 			status: admitted.status === 503 ? 503 : 409,
 			code: "admission_failed",
 			message: admitted.message
 		});
-		const authorization = this.authorizeExport(request, exportKey(request), authorizationIdentity, factorRelease);
+		const authorization = this.authorizeExport(request, exportKey(request), authorizationIdentity, ownershipGeneration, factorRelease);
 		if (authorization.kind === "completed" && !authorization.value.ok) return failure({
 			status: authorization.value.status === 503 ? 503 : 409,
 			code: "admission_failed",
@@ -226,11 +226,11 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 	* admission. An export already here answers from its state instead, with
 	* the factor release it recorded.
 	*/
-	authorizeExport(request, authorizationFingerprint, authorizationIdentity, factorRelease) {
+	authorizeExport(request, authorizationFingerprint, authorizationIdentity, ownershipGeneration, factorRelease) {
 		const key = exportKey(request);
 		const existing = this.state.exports.get(key);
 		if (existing) {
-			if (!sameExportServerAuthorizationIdentityV1(existing.authorizationIdentity, authorizationIdentity)) return {
+			if (existing.ownershipGeneration !== ownershipGeneration || !sameExportServerAuthorizationIdentityV1(existing.authorizationIdentity, authorizationIdentity)) return {
 				kind: "completed",
 				value: authorizationConflict("export_authorization_conflict", "Export authorization owner changed for an existing request")
 			};
@@ -256,22 +256,28 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 			}
 		}
 		const nonce = bytesToHex(request.authorization.nonce);
-		if (this.state.authorizationNonces.has(nonce)) return {
+		if (this.state.authorizationNonceOwners.has(nonce)) return {
 			kind: "completed",
 			value: authorizationConflict("export_authorization_replayed", "Ed25519 Yao export authorization was already used")
 		};
-		this.state.authorizationNonces.add(nonce);
+		this.state.authorizationNonceOwners.set(nonce, request.scope.account_id);
 		this.state.exports.set(key, {
 			kind: "authorized",
 			request,
 			authorizationFingerprint,
 			authorizationIdentity,
+			ownershipGeneration,
 			factorRelease
 		});
 		return { kind: "authorized" };
 	}
-	readAuthorizationIdentity(request) {
-		return this.state.exports.get(exportKey(request))?.authorizationIdentity ?? null;
+	readAdmissionAuthority(request) {
+		const current = this.state.exports.get(exportKey(request));
+		if (!current) return null;
+		return {
+			authorizationIdentity: current.authorizationIdentity,
+			ownershipGeneration: current.ownershipGeneration
+		};
 	}
 	async prepareAdmitExport(request, _authorizationIdentity) {
 		const key = exportKey(request);
@@ -351,6 +357,7 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 			request: current.request,
 			authorizationFingerprint: current.authorizationFingerprint,
 			authorizationIdentity: current.authorizationIdentity,
+			ownershipGeneration: current.ownershipGeneration,
 			factorRelease: current.factorRelease
 		});
 		return {
@@ -412,6 +419,7 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 			request: current.request,
 			authorizationFingerprint: current.authorizationFingerprint,
 			authorizationIdentity: current.authorizationIdentity,
+			ownershipGeneration: current.ownershipGeneration,
 			factorRelease: current.factorRelease,
 			receipt: parsed.value
 		});
@@ -436,7 +444,7 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 		try {
 			outcome = {
 				kind: "backend_response",
-				result: await this.backend.executeExport(request, preparation.claim.admissionRequest, traceContext)
+				result: await this.backend.executeExport(request, preparation.claim, traceContext)
 			};
 		} catch (error) {
 			return this.failUncertainExecution(preparation.claim, error);
@@ -470,6 +478,7 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 				request: current.request,
 				authorizationFingerprint: current.authorizationFingerprint,
 				authorizationIdentity: current.authorizationIdentity,
+				ownershipGeneration: current.ownershipGeneration,
 				factorRelease: current.factorRelease,
 				receipt: current.receipt,
 				executeFingerprint: canonicalFingerprint(request),
@@ -488,6 +497,7 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 					request: current.request,
 					authorizationFingerprint: current.authorizationFingerprint,
 					authorizationIdentity: current.authorizationIdentity,
+					ownershipGeneration: current.ownershipGeneration,
 					factorRelease: current.factorRelease,
 					receipt: current.receipt,
 					executeFingerprint
@@ -500,7 +510,8 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 						exportKey: found.key,
 						sessionId: session,
 						executeFingerprint,
-						admissionRequest: current.request
+						admissionRequest: current.request,
+						ownershipGeneration: current.ownershipGeneration
 					}
 				};
 			case "executing": return {
@@ -561,6 +572,7 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 			request: current.request,
 			authorizationFingerprint: current.authorizationFingerprint,
 			authorizationIdentity: current.authorizationIdentity,
+			ownershipGeneration: current.ownershipGeneration,
 			factorRelease: current.factorRelease,
 			receipt: current.receipt,
 			executeFingerprint: current.executeFingerprint,
@@ -598,6 +610,7 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 			request: current.request,
 			authorizationFingerprint: current.authorizationFingerprint,
 			authorizationIdentity: current.authorizationIdentity,
+			ownershipGeneration: current.ownershipGeneration,
 			factorRelease: current.factorRelease,
 			failure: rejected
 		});
@@ -608,6 +621,7 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 			request: current.request,
 			authorizationFingerprint: current.authorizationFingerprint,
 			authorizationIdentity: current.authorizationIdentity,
+			ownershipGeneration: current.ownershipGeneration,
 			factorRelease: current.factorRelease,
 			receipt: current.receipt,
 			executeFingerprint: current.executeFingerprint,
@@ -810,6 +824,7 @@ async function authorizeExportAdmission(args) {
 		});
 		if (!checked.ok) return checked;
 		return await recordFreshExportProof({
+			walletId: walletId.value,
 			input: args.input,
 			authority,
 			authorizedOperations: args.authorizedOperations,
@@ -836,6 +851,7 @@ async function authorizeExportAdmission(args) {
 	});
 	if (!checked.ok) return checked;
 	const recorded = await recordFreshExportProof({
+		walletId: walletId.value,
 		input: args.input,
 		authority: authority.authority,
 		authorizedOperations: args.authorizedOperations,
@@ -847,18 +863,13 @@ async function authorizeExportAdmission(args) {
 	return {
 		ok: true,
 		admission: recorded.admission,
+		walletId: recorded.walletId,
 		factorRelease: checked.factorRelease
 	};
 }
 async function recordFreshExportProof(args) {
-	const walletId = parseWalletId(args.input.body.application_binding.wallet_id);
-	if (!walletId.ok) return authorizationFailure({
-		status: 403,
-		code: "invalid_body",
-		message: walletId.error.message
-	});
 	const authorizationIdentitySuffix = base64UrlEncode(Uint8Array.from(args.input.body.authorization.authorization_digest));
-	const principalId = parsePrincipalId(`ed25519-export:${walletId.value}`);
+	const principalId = parsePrincipalId(`ed25519-export:${args.walletId}`);
 	const capabilityId = parseCapabilityId(String(args.input.body.scope.material_activation.capability));
 	const operationId = parseCapabilityOperationId(`ed25519-export:${args.input.body.scope.lifecycle_id}:${authorizationIdentitySuffix}`);
 	const evidenceId = parseAuthorizationEvidenceId(`ed25519-export:evidence:${args.input.body.scope.lifecycle_id}:${authorizationIdentitySuffix}`);
@@ -931,7 +942,7 @@ async function recordFreshExportProof(args) {
 			factor = buildVerifiedWalletOperationPasskeyFactorResult({
 				tenantId: args.authorizedOperations.tenantId,
 				principalId: principalId.value,
-				walletId: walletId.value,
+				walletId: args.walletId,
 				requestOrigin,
 				audience: requestOrigin,
 				factorId: factorId.value,
@@ -948,7 +959,7 @@ async function recordFreshExportProof(args) {
 			factor = buildVerifiedWalletOperationEmailOtpFactorResult({
 				tenantId: args.authorizedOperations.tenantId,
 				principalId: principalId.value,
-				walletId: walletId.value,
+				walletId: args.walletId,
 				requestOrigin,
 				audience: requestOrigin,
 				factorId: factorId.value,
@@ -974,6 +985,7 @@ async function recordFreshExportProof(args) {
 	});
 	return {
 		ok: true,
+		walletId: args.walletId,
 		admission: new ExportOperationAdmission(args.authorizedOperations, {
 			tenantId: args.authorizedOperations.tenantId,
 			authorizedOperationId: authorizedOperationId.value,
@@ -1036,12 +1048,13 @@ function exportOwnerProofRejected(code) {
 	});
 }
 var RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter = class {
-	constructor(webAuthn, emailOtp, walletAuthMethods, authorizedOperations, resolveEd25519MaterialActivation) {
+	constructor(webAuthn, emailOtp, walletAuthMethods, authorizedOperations, resolveEd25519MaterialActivation, admitEstablishedHome) {
 		this.webAuthn = webAuthn;
 		this.emailOtp = emailOtp;
 		this.walletAuthMethods = walletAuthMethods;
 		this.authorizedOperations = authorizedOperations;
 		this.resolveEd25519MaterialActivation = resolveEd25519MaterialActivation;
+		this.admitEstablishedHome = admitEstablishedHome;
 	}
 	async authorizeAdmission(input) {
 		const activeIdentity = await resolveActiveExportAuthorizationIdentity({
@@ -1056,12 +1069,29 @@ var RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter = class {
 			walletAuthMethods: this.walletAuthMethods,
 			authorizedOperations: this.authorizedOperations
 		});
-		return checked.ok ? {
+		if (!checked.ok) return checked;
+		let home;
+		try {
+			home = await this.admitEstablishedHome({ walletId: checked.walletId });
+		} catch {
+			return authorizationFailure({
+				status: 503,
+				code: "wallet_home_unavailable",
+				message: "Export wallet home is unavailable"
+			});
+		}
+		if (!home.ok) return authorizationFailure({
+			status: 409,
+			code: home.code,
+			message: home.message
+		});
+		return {
 			ok: true,
 			authorizationIdentity: activeIdentity.authorizationIdentity,
+			ownershipGeneration: home.ownershipGeneration,
 			admission: checked.admission,
 			...checked.factorRelease ? { factorRelease: checked.factorRelease } : {}
-		} : checked;
+		};
 	}
 	authorizeExecution(input) {
 		const thresholdSessionId = parseThresholdEd25519SessionId(input.body.binding.ceremony.lifecycle.session_id);
@@ -1273,7 +1303,7 @@ var RouterAbEd25519YaoExportRouteExtension = class {
 				code: authorized.code,
 				message: authorized.message
 			}, { status: authorized.status });
-			const result = await this.service.admitExport(parsed.protocol, authorized.authorizationIdentity, authorized.admission, authorized.factorRelease ?? null, traceContext.value);
+			const result = await this.service.admitExport(parsed.protocol, authorized.authorizationIdentity, authorized.ownershipGeneration, authorized.admission, authorized.factorRelease ?? null, traceContext.value);
 			return result.ok ? json({
 				protocol: result.value,
 				...authorized.factorRelease ? { factorRelease: authorized.factorRelease } : {}

package/dist/esm/router/domains/ed25519Yao/export/routerAbEd25519YaoExportRequestScopedCloudflare.js

@@ -2,6 +2,7 @@ import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import "../../../../shared-ts/src/utils/encoders.js";
 import "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { publishWalletLifecycleHome } from "../../../../authorization/lifecycleRouting.js";
 import { normalizeCorsOrigin } from "../../../../core/SessionService.js";
 import { ROUTER_AB_TRACE_ID_HEADER_V1, createRouterAbTraceContextV1, parseRouterAbTraceContextV1 } from "../../../../shared-ts/src/utils/routerAbTraceContext.js";
 import { json, readJson } from "../../../framework/http.js";
@@ -84,11 +85,11 @@ var ExportExecutionRequestRun = class {
 			};
 		}
 	}
-	async backend(_claim) {
+	async backend(claim) {
 		try {
 			return {
 				kind: "response",
-				value: await this.context.input.backend.executeExport(this.request, _claim.admissionRequest, this.context.trace)
+				value: await this.context.input.backend.executeExport(this.request, claim, this.context.trace)
 			};
 		} catch (error) {
 			return {
@@ -159,6 +160,8 @@ async function handleAdmissionRequest(context, raw) {
 	}, { status: 403 });
 	const admission = await runAuthorization(context, parsed, expectedOrigin);
 	if (!admission.ok) return exportResponse(admission);
+	const published = await publishWalletLifecycleHome(context.input.lifecycleRouting ?? null, "yao_export", parsed.protocol);
+	if (!published.ok) return exportResponse(published);
 	const result = await runAdmission(context, parsed.protocol, admission.authorizationIdentity);
 	if (result.ok) return json({
 		protocol: result.value,
@@ -194,15 +197,16 @@ async function runAuthorization(context, parsed, expectedOrigin) {
 	let loaded = await context.input.store.load(lifecycleId);
 	const service = exportService(context, loaded.state);
 	if (service.authorizationIsUncertain(parsed.protocol)) return authorizationFailure(503, "export_authorization_uncertain", "Export authorization outcome is uncertain and cannot be retried");
-	const existingIdentity = service.readAuthorizationIdentity(parsed.protocol);
+	const existingAuthority = service.readAdmissionAuthority(parsed.protocol);
 	let verified;
-	if (existingIdentity) {
+	if (existingAuthority) {
 		if (parsed.protocol.authorization.expires_at_ms <= Date.now()) return authorizationFailure(403, "export_authorization_expired", "Ed25519 Yao export authorization is expired");
 		const resolved = await context.input.authorization.resolveAuthorizationIdentity(parsed.protocol);
 		if (!resolved.ok) return resolved;
-		if (!sameAuthorizationIdentity(resolved.authorizationIdentity, existingIdentity)) return authorizationFailure(409, "export_authorization_conflict", "Export authorization owner changed for an existing request");
+		if (!sameAuthorizationIdentity(resolved.authorizationIdentity, existingAuthority.authorizationIdentity)) return authorizationFailure(409, "export_authorization_conflict", "Export authorization owner changed for an existing request");
 		verified = {
-			identity: existingIdentity,
+			identity: existingAuthority.authorizationIdentity,
+			ownershipGeneration: existingAuthority.ownershipGeneration,
 			admission: null
 		};
 	} else {
@@ -220,15 +224,17 @@ async function runAuthorization(context, parsed, expectedOrigin) {
 		if (!authorized.ok) return authorized;
 		verified = {
 			identity: authorized.authorizationIdentity,
+			ownershipGeneration: authorized.ownershipGeneration,
 			admission: authorized.admission,
 			...authorized.factorRelease ? { factorRelease: authorized.factorRelease } : {}
 		};
 	}
 	const authorizationFingerprint = await authorizationFingerprintForIdentity(parsed, verified.identity);
 	for (let attempt = 1;; attempt += 1) {
-		const decision = exportService(context, loaded.state).authorizeExport(parsed.protocol, authorizationFingerprint, verified.identity, verified.factorRelease ?? null);
+		const decision = exportService(context, loaded.state).authorizeExport(parsed.protocol, authorizationFingerprint, verified.identity, verified.ownershipGeneration, verified.factorRelease ?? null);
 		if (decision.kind === "completed") return decision.value.ok ? authorizedRun({
 			identity: verified.identity,
+			ownershipGeneration: verified.ownershipGeneration,
 			admission: verified.admission,
 			...decision.value.factorRelease ? { factorRelease: decision.value.factorRelease } : {}
 		}) : decision.value;