@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.js

@@ -36,11 +36,17 @@ function resolveTraceContext(request) {
 		message: parsed.message
 	};
 }
-function recoveryAuthorizationBinding(authorization) {
-	if (authorization.kind === "wallet_recovery") return authorization;
+function recoveryAuthorizationBinding(admitted) {
+	const authorization = admitted.authorization;
+	if (authorization.kind === "wallet_recovery") return {
+		kind: "wallet_recovery",
+		walletId: authorization.walletId,
+		ownershipGeneration: admitted.ownershipGeneration
+	};
 	const session = authorization.kind === "wallet_session_v2" ? authorization.context.authorization.session : authorization.context.status.session;
 	return {
 		kind: "wallet_session_v2",
+		ownershipGeneration: admitted.ownershipGeneration,
 		tenantId: session.tenantId,
 		principalId: session.principalId,
 		walletId: session.walletId,
@@ -160,7 +166,7 @@ function equalBytes(left, right) {
 	return true;
 }
 function sameRecoveryAuthorizationBindingV1(left, right) {
-	if (left.kind !== right.kind) return false;
+	if (left.kind !== right.kind || left.ownershipGeneration !== right.ownershipGeneration) return false;
 	switch (left.kind) {
 		case "wallet_recovery": return right.kind === "wallet_recovery" && left.walletId === right.walletId;
 		case "wallet_session_v2": return right.kind === "wallet_session_v2" && left.tenantId === right.tenantId && left.principalId === right.principalId && left.walletId === right.walletId && left.authorityId === right.authorityId && left.walletAuthMethodId === right.walletAuthMethodId && left.mintId === right.mintId && left.authorizationId === right.authorizationId && left.walletSessionId === right.walletSessionId && left.quotaId === right.quotaId;
@@ -649,6 +655,77 @@ function activationReplayResult(state, fingerprint) {
 		default: return assertNever(state);
 	}
 }
+function resolveRouterAbEd25519YaoActiveCapability(capabilities, input) {
+	const walletId = String(input.walletId || "").trim();
+	const nearEd25519SigningKeyId = String(input.nearEd25519SigningKeyId || "").trim();
+	const signingWorkerId = String(input.signingWorkerId || "").trim();
+	const firstParticipantId = input.participantIds?.[0];
+	const secondParticipantId = input.participantIds?.[1];
+	if (input.kind !== "router_ab_ed25519_yao_active_capability_lookup_v1" || !walletId || !nearEd25519SigningKeyId || !signingWorkerId || !Number.isSafeInteger(input.signerSlot) || input.signerSlot < 1 || !Array.isArray(input.participantIds) || input.participantIds.length !== 2 || !Number.isSafeInteger(firstParticipantId) || !Number.isSafeInteger(secondParticipantId) || Number(firstParticipantId) < 1 || Number(secondParticipantId) < 1 || firstParticipantId === secondParticipantId) return {
+		ok: false,
+		code: "invalid_lookup",
+		message: "active Ed25519 Yao capability lookup is invalid"
+	};
+	let matched = null;
+	for (const state of capabilities.values()) {
+		if (state.kind !== "active") continue;
+		const identity = state.identity;
+		if (identity.applicationBinding.wallet_id !== walletId || identity.applicationBinding.near_ed25519_signing_key_id !== nearEd25519SigningKeyId || identity.applicationBinding.key_creation_signer_slot !== input.signerSlot || identity.activationBinding.lifecycle.selected_server_id !== signingWorkerId || identity.participantIds[0] !== firstParticipantId || identity.participantIds[1] !== secondParticipantId) continue;
+		if (matched) return {
+			ok: false,
+			code: "capability_conflict",
+			message: "multiple active Ed25519 Yao capabilities match the wallet identity"
+		};
+		matched = identity;
+	}
+	if (!matched) return {
+		ok: false,
+		code: "unknown_capability",
+		message: "active Ed25519 Yao capability was not found"
+	};
+	const lifecycle = matched.activationBinding.lifecycle;
+	return {
+		ok: true,
+		capability: {
+			kind: "router_ab_ed25519_yao_active_capability_v1",
+			materialActivation: matched.activationBinding.material_activation,
+			activeCapabilityBinding: [...matched.capabilityBinding],
+			registeredPublicKey: [...matched.registeredPublicKey],
+			nearAccountId: matched.nearAccountId,
+			applicationBinding: {
+				wallet_id: matched.applicationBinding.wallet_id,
+				near_ed25519_signing_key_id: matched.applicationBinding.near_ed25519_signing_key_id,
+				signing_root_id: matched.applicationBinding.signing_root_id,
+				key_creation_signer_slot: matched.applicationBinding.key_creation_signer_slot
+			},
+			runtimePolicyScope: {
+				orgId: matched.runtimePolicyScope.orgId,
+				projectId: matched.runtimePolicyScope.projectId,
+				envId: matched.runtimePolicyScope.envId,
+				signingRootVersion: matched.runtimePolicyScope.signingRootVersion
+			},
+			participantIds: [matched.participantIds[0], matched.participantIds[1]],
+			lifecycle: {
+				lifecycleId: lifecycle.lifecycle_id,
+				rootShareEpoch: lifecycle.root_share_epoch,
+				accountId: lifecycle.account_id,
+				thresholdSessionId: requireThresholdEd25519SessionId(lifecycle.session_id, "active capability threshold session identity"),
+				signerSetId: lifecycle.signer_set_id,
+				signingWorkerId: lifecycle.selected_server_id
+			},
+			stateEpoch: matched.stateEpoch,
+			registrationContinuity: matched.persisted.version === "wallet_ed25519_yao_registration_capability_v1" ? {
+				kind: "registration",
+				admissionRequest: matched.persisted.admissionRequest,
+				admissionReceipt: matched.persisted.admissionReceipt,
+				activationTranscript: [...matched.persisted.activationResult.public_receipt.transcript]
+			} : {
+				kind: "recovery",
+				activationTranscript: [...matched.persisted.activationResult.public_receipt.transcript]
+			}
+		}
+	};
+}
 var InMemoryRouterAbEd25519YaoRecoveryService = class {
 	constructor(backend, state = new InMemoryRouterAbEd25519YaoRecoveryStateV1(), capabilityPersistence = new EphemeralRouterAbEd25519YaoCapabilityPersistenceV1()) {
 		this.backend = backend;
@@ -711,75 +788,7 @@ var InMemoryRouterAbEd25519YaoRecoveryService = class {
 		return capabilityInstallResult("installed", identity);
 	}
 	resolveActiveCapability(input) {
-		const walletId = String(input.walletId || "").trim();
-		const nearEd25519SigningKeyId = String(input.nearEd25519SigningKeyId || "").trim();
-		const signingWorkerId = String(input.signingWorkerId || "").trim();
-		const firstParticipantId = input.participantIds?.[0];
-		const secondParticipantId = input.participantIds?.[1];
-		if (input.kind !== "router_ab_ed25519_yao_active_capability_lookup_v1" || !walletId || !nearEd25519SigningKeyId || !signingWorkerId || !Number.isSafeInteger(input.signerSlot) || input.signerSlot < 1 || !Array.isArray(input.participantIds) || input.participantIds.length !== 2 || !Number.isSafeInteger(firstParticipantId) || !Number.isSafeInteger(secondParticipantId) || Number(firstParticipantId) < 1 || Number(secondParticipantId) < 1 || firstParticipantId === secondParticipantId) return {
-			ok: false,
-			code: "invalid_lookup",
-			message: "active Ed25519 Yao capability lookup is invalid"
-		};
-		let matched = null;
-		for (const state of this.capabilities.values()) {
-			if (state.kind !== "active") continue;
-			const identity = state.identity;
-			if (identity.applicationBinding.wallet_id !== walletId || identity.applicationBinding.near_ed25519_signing_key_id !== nearEd25519SigningKeyId || identity.applicationBinding.key_creation_signer_slot !== input.signerSlot || identity.activationBinding.lifecycle.selected_server_id !== signingWorkerId || identity.participantIds[0] !== firstParticipantId || identity.participantIds[1] !== secondParticipantId) continue;
-			if (matched) return {
-				ok: false,
-				code: "capability_conflict",
-				message: "multiple active Ed25519 Yao capabilities match the wallet identity"
-			};
-			matched = identity;
-		}
-		if (!matched) return {
-			ok: false,
-			code: "unknown_capability",
-			message: "active Ed25519 Yao capability was not found"
-		};
-		const lifecycle = matched.activationBinding.lifecycle;
-		return {
-			ok: true,
-			capability: {
-				kind: "router_ab_ed25519_yao_active_capability_v1",
-				materialActivation: matched.activationBinding.material_activation,
-				activeCapabilityBinding: [...matched.capabilityBinding],
-				registeredPublicKey: [...matched.registeredPublicKey],
-				nearAccountId: matched.nearAccountId,
-				applicationBinding: {
-					wallet_id: matched.applicationBinding.wallet_id,
-					near_ed25519_signing_key_id: matched.applicationBinding.near_ed25519_signing_key_id,
-					signing_root_id: matched.applicationBinding.signing_root_id,
-					key_creation_signer_slot: matched.applicationBinding.key_creation_signer_slot
-				},
-				runtimePolicyScope: {
-					orgId: matched.runtimePolicyScope.orgId,
-					projectId: matched.runtimePolicyScope.projectId,
-					envId: matched.runtimePolicyScope.envId,
-					signingRootVersion: matched.runtimePolicyScope.signingRootVersion
-				},
-				participantIds: [matched.participantIds[0], matched.participantIds[1]],
-				lifecycle: {
-					lifecycleId: lifecycle.lifecycle_id,
-					rootShareEpoch: lifecycle.root_share_epoch,
-					accountId: lifecycle.account_id,
-					thresholdSessionId: requireThresholdEd25519SessionId(lifecycle.session_id, "active capability threshold session identity"),
-					signerSetId: lifecycle.signer_set_id,
-					signingWorkerId: lifecycle.selected_server_id
-				},
-				stateEpoch: matched.stateEpoch,
-				registrationContinuity: matched.persisted.version === "wallet_ed25519_yao_registration_capability_v1" ? {
-					kind: "registration",
-					admissionRequest: matched.persisted.admissionRequest,
-					admissionReceipt: matched.persisted.admissionReceipt,
-					activationTranscript: [...matched.persisted.activationResult.public_receipt.transcript]
-				} : {
-					kind: "recovery",
-					activationTranscript: [...matched.persisted.activationResult.public_receipt.transcript]
-				}
-			}
-		};
+		return resolveRouterAbEd25519YaoActiveCapability(this.capabilities, input);
 	}
 	async admitRecovery(request, authorization, traceContext) {
 		const dispatchRoot = await this.backend.resolveRecoveryDispatchRoot(request);
@@ -998,7 +1007,7 @@ var InMemoryRouterAbEd25519YaoRecoveryService = class {
 				try {
 					outcome = {
 						kind: "backend_response",
-						result: await this.backend.executeRecovery(request, preparation.claim.admissionRequest, preparation.claim.dispatchRoot, preparation.claim.attempt, preparation.claim.replay, traceContext)
+						result: await this.backend.executeRecovery(request, preparation.claim, traceContext)
 					};
 				} catch (error) {
 					return this.failUncertainExecution(preparation.claim, error);
@@ -1011,6 +1020,19 @@ var InMemoryRouterAbEd25519YaoRecoveryService = class {
 			}
 		}
 	}
+	recoveryOwnershipGeneration(binding) {
+		const state = this.stateForSession(binding.session_id);
+		if (!state) return recoveryFailure({
+			status: 404,
+			code: "unknown_recovery",
+			message: "Recovery admission was not found"
+		});
+		return {
+			ok: true,
+			status: 200,
+			value: state.context.authorization.ownershipGeneration
+		};
+	}
 	prepareExecuteRecovery(request, authorization, nowMs) {
 		const parsed = parseRouterAbEd25519YaoRecoveryActivationExecuteRequestV1(request);
 		if (!parsed.ok) return {
@@ -1063,6 +1085,7 @@ var InMemoryRouterAbEd25519YaoRecoveryService = class {
 				kind: "claimed",
 				claim: {
 					kind: "router_ab_ed25519_yao_recovery_execute_claim_v1",
+					ownershipGeneration: claimed.context.authorization.ownershipGeneration,
 					lifecycleId: executionRequest.binding.lifecycle.lifecycle_id,
 					recoveryKey: claimed.context.recoveryKey,
 					sessionId,
@@ -1174,7 +1197,7 @@ var InMemoryRouterAbEd25519YaoRecoveryService = class {
 				try {
 					outcome = {
 						kind: "backend_response",
-						result: await this.backend.activateRecovery(request, preparation.claim.dispatchRoot, traceContext)
+						result: await this.backend.activateRecovery(request, preparation.claim.dispatchRoot, preparation.claim.ownershipGeneration, traceContext)
 					};
 				} catch (error) {
 					return this.activationUncertainFailure(error);
@@ -1438,6 +1461,7 @@ var InMemoryRouterAbEd25519YaoRecoveryService = class {
 	activationClaim(state, authorityProjection, disposition) {
 		return {
 			kind: "router_ab_ed25519_yao_recovery_activation_claim_v1",
+			ownershipGeneration: state.context.authorization.ownershipGeneration,
 			lifecycleId: state.context.admissionRequest.scope.lifecycle_id,
 			recoveryKey: state.context.recoveryKey,
 			sessionId: bytesToHex(state.admissionReceipt.binding.session_id),
@@ -1700,7 +1724,7 @@ var RouterAbEd25519YaoRecoveryRouteExtension = class {
 			body: parsed.value
 		});
 		if (!authorization.ok) return routeFailureResponse(authorization);
-		const result = await this.service.admitRecovery(parsed.value, recoveryAuthorizationBinding(authorization.authorization), traceContext.value);
+		const result = await this.service.admitRecovery(parsed.value, recoveryAuthorizationBinding(authorization), traceContext.value);
 		if (!result.ok) return routeFailureResponse(result);
 		return json(result.value, { status: result.status });
 	}
@@ -1717,13 +1741,16 @@ var RouterAbEd25519YaoRecoveryRouteExtension = class {
 			code: parsed.code,
 			message: parsed.message
 		}, { status: 400 });
+		const ownership = this.service.recoveryOwnershipGeneration(parsed.value.binding);
+		if (!ownership.ok) return routeFailureResponse(ownership);
 		const authorization = await this.authorization.authorize({
 			kind: "execute",
+			ownershipGeneration: ownership.value,
 			request,
 			body: parsed.value
 		});
 		if (!authorization.ok) return routeFailureResponse(authorization);
-		const result = await this.service.executeRecovery(parsed.value, recoveryAuthorizationBinding(authorization.authorization), traceContext.value);
+		const result = await this.service.executeRecovery(parsed.value, recoveryAuthorizationBinding(authorization), traceContext.value);
 		if (!result.ok) return routeFailureResponse(result);
 		return json(result.value, { status: result.status });
 	}
@@ -1740,13 +1767,16 @@ var RouterAbEd25519YaoRecoveryRouteExtension = class {
 			code: parsed.code,
 			message: parsed.message
 		}, { status: 400 });
+		const ownership = this.service.recoveryOwnershipGeneration(parsed.value.binding);
+		if (!ownership.ok) return routeFailureResponse(ownership);
 		const authorization = await this.authorization.authorize({
 			kind: "activate",
+			ownershipGeneration: ownership.value,
 			request,
 			body: parsed.value
 		});
 		if (!authorization.ok) return routeFailureResponse(authorization);
-		const result = await this.service.activateRecovery(parsed.value, recoveryAuthorizationBinding(authorization.authorization), traceContext.value);
+		const result = await this.service.activateRecovery(parsed.value, recoveryAuthorizationBinding(authorization), traceContext.value);
 		if (!result.ok) return routeFailureResponse(result);
 		return json(result.value, { status: result.status });
 	}
@@ -1758,6 +1788,6 @@ function createRouterAbEd25519YaoRecoveryModule(input) {
 	});
 }
 //#endregion
-export { InMemoryRouterAbEd25519YaoRecoveryService, InMemoryRouterAbEd25519YaoRecoveryStateV1, buildRouterAbEd25519YaoRegistrationCapabilityRecordV1, buildWarmRecoveryBootstrapResponse, createRouterAbEd25519YaoRecoveryModule, recoveryAuthorityProjection, recoveryAuthorizationBinding };
+export { InMemoryRouterAbEd25519YaoRecoveryService, InMemoryRouterAbEd25519YaoRecoveryStateV1, buildRouterAbEd25519YaoRegistrationCapabilityRecordV1, buildWarmRecoveryBootstrapResponse, createRouterAbEd25519YaoRecoveryModule, recoveryAuthorityProjection, recoveryAuthorizationBinding, resolveRouterAbEd25519YaoActiveCapability };
 
 //# sourceMappingURL=routerAbEd25519YaoRecovery.js.map

package/dist/esm/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryRequestScopedCloudflare.js

@@ -1,4 +1,5 @@
 import { parseRouterAbEd25519YaoRecoveryActivationExecuteRequestV1, parseRouterAbEd25519YaoRecoveryActivationRequestV1, parseRouterAbEd25519YaoRecoveryAdmissionRequestV1, parseRouterAbEd25519YaoRecoveryStatusRequestV1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { publishWalletLifecycleHome } from "../../../../authorization/lifecycleRouting.js";
 import { ROUTER_AB_TRACE_ID_HEADER_V1, createRouterAbTraceContextV1, parseRouterAbTraceContextV1 } from "../../../../shared-ts/src/utils/routerAbTraceContext.js";
 import { json, readJson } from "../../../framework/http.js";
 import { InMemoryRouterAbEd25519YaoRecoveryService, buildWarmRecoveryBootstrapResponse, recoveryAuthorizationBinding } from "./routerAbEd25519YaoRecovery.js";
@@ -19,7 +20,14 @@ var RecoveryAdmissionRequestRun = class {
 			kind: "rejected",
 			value: authorized
 		};
-		const prepared = this.service(state).prepareAdmitRecovery(this.request, recoveryAuthorizationBinding(authorized.authorization), await this.context.input.backend.resolveRecoveryDispatchRoot(this.request), Date.now());
+		const prepared = this.service(state).prepareAdmitRecovery(this.request, recoveryAuthorizationBinding(authorized), await this.context.input.backend.resolveRecoveryDispatchRoot(this.request), Date.now());
+		if (prepared.kind !== "failed") {
+			const published = await publishWalletLifecycleHome(this.context.input.lifecycleRouting ?? null, "yao_recovery", this.request);
+			if (!published.ok) return {
+				kind: "rejected",
+				value: published
+			};
+		}
 		switch (prepared.kind) {
 			case "claimed": return {
 				kind: "claimed",
@@ -77,8 +85,15 @@ var RecoveryExecutionRequestRun = class {
 		this.request = request;
 	}
 	async prepare(state) {
+		const service = this.service(state);
+		const ownership = service.recoveryOwnershipGeneration(this.request.binding);
+		if (!ownership.ok) return {
+			kind: "rejected",
+			value: ownership
+		};
 		const authorized = await this.context.input.authorization.authorize({
 			kind: "execute",
+			ownershipGeneration: ownership.value,
 			request: this.context.input.request,
 			body: this.request
 		});
@@ -86,7 +101,7 @@ var RecoveryExecutionRequestRun = class {
 			kind: "rejected",
 			value: authorized
 		};
-		const prepared = this.service(state).prepareExecuteRecovery(this.request, recoveryAuthorizationBinding(authorized.authorization), Date.now());
+		const prepared = service.prepareExecuteRecovery(this.request, recoveryAuthorizationBinding(authorized), Date.now());
 		switch (prepared.kind) {
 			case "claimed": return {
 				kind: "claimed",
@@ -111,7 +126,7 @@ var RecoveryExecutionRequestRun = class {
 		try {
 			return {
 				kind: "response",
-				value: await this.context.input.backend.executeRecovery(this.request, claim.admissionRequest, claim.dispatchRoot, claim.attempt, claim.replay, this.context.trace)
+				value: await this.context.input.backend.executeRecovery(this.request, claim, this.context.trace)
 			};
 		} catch (error) {
 			return {
@@ -144,8 +159,15 @@ var RecoveryActivationRequestRun = class {
 		this.request = request;
 	}
 	async prepare(state) {
+		const service = this.service(state);
+		const ownership = service.recoveryOwnershipGeneration(this.request.binding);
+		if (!ownership.ok) return {
+			kind: "rejected",
+			value: ownership
+		};
 		const authorized = await this.context.input.authorization.authorize({
 			kind: "activate",
+			ownershipGeneration: ownership.value,
 			request: this.context.input.request,
 			body: this.request
 		});
@@ -153,7 +175,7 @@ var RecoveryActivationRequestRun = class {
 			kind: "rejected",
 			value: authorized
 		};
-		const prepared = this.service(state).prepareActivateRecovery(this.request, recoveryAuthorizationBinding(authorized.authorization));
+		const prepared = service.prepareActivateRecovery(this.request, recoveryAuthorizationBinding(authorized));
 		switch (prepared.kind) {
 			case "claimed": return {
 				kind: "claimed",
@@ -178,7 +200,7 @@ var RecoveryActivationRequestRun = class {
 		try {
 			return {
 				kind: "response",
-				value: await this.context.input.backend.activateRecovery(this.request, claim.dispatchRoot, this.context.trace)
+				value: await this.context.input.backend.activateRecovery(this.request, claim.dispatchRoot, claim.ownershipGeneration, this.context.trace)
 			};
 		} catch (error) {
 			return {

package/dist/esm/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryWalletSessionAuthorization.js

@@ -1,3 +1,4 @@
+import { parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { NEAR_ED25519_MPC_OPERATION_KINDS } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
@@ -344,6 +345,32 @@ async function authorizeRecoveryContinuation(input) {
 		}
 	};
 }
+async function authorizeRecoveryCredential(input, services) {
+	switch (input.kind) {
+		case "bootstrap": return await authorizeV2WarmBootstrap({
+			request: input,
+			services
+		});
+		case "admit":
+			if (String(input.request.headers.get("x-seams-wallet-recovery-challenge-id") || "").trim()) return await authorizePreparedRecovery({
+				request: input,
+				services
+			});
+			if (extractBearerCredential(input.request.headers)) return await authorizeV2RecoveryAdmission({
+				request: input,
+				services
+			});
+			return await authorizePreparedRecovery({
+				request: input,
+				services
+			});
+		case "execute":
+		case "activate": return await authorizeRecoveryContinuation({
+			request: input,
+			services
+		});
+	}
+}
 var RouterAbEd25519YaoRecoveryWalletSessionAuthorizationAdapter = class {
 	constructor(resolveServices) {
 		this.resolveServices = resolveServices;
@@ -359,30 +386,52 @@ var RouterAbEd25519YaoRecoveryWalletSessionAuthorizationAdapter = class {
 				message: "wallet recovery admission is unavailable"
 			});
 		}
-		switch (input.kind) {
-			case "bootstrap": return await authorizeV2WarmBootstrap({
-				request: input,
-				services
-			});
-			case "admit":
-				if (String(input.request.headers.get("x-seams-wallet-recovery-challenge-id") || "").trim()) return await authorizePreparedRecovery({
-					request: input,
-					services
-				});
-				if (extractBearerCredential(input.request.headers)) return await authorizeV2RecoveryAdmission({
-					request: input,
-					services
-				});
-				return await authorizePreparedRecovery({
-					request: input,
-					services
-				});
-			case "execute":
-			case "activate": return await authorizeRecoveryContinuation({
-				request: input,
-				services
+		const credential = await authorizeRecoveryCredential(input, services);
+		if (!credential.ok) return credential;
+		const authorization = credential.authorization;
+		if (input.kind === "execute" || input.kind === "activate") return {
+			ok: true,
+			ownershipGeneration: input.ownershipGeneration,
+			authorization
+		};
+		let walletIdentity;
+		switch (authorization.kind) {
+			case "wallet_recovery":
+				walletIdentity = authorization.walletId;
+				break;
+			case "wallet_session_v2":
+				walletIdentity = authorization.context.authorization.session.walletId;
+				break;
+			case "wallet_session_v2_exhausted_candidate":
+				walletIdentity = authorization.context.status.session.walletId;
+				break;
+		}
+		const walletId = parseWalletId(walletIdentity);
+		if (!walletId.ok) return authorizationFailure({
+			status: 403,
+			code: "wallet_recovery_scope_mismatch",
+			message: "Recovery wallet identity is invalid"
+		});
+		let home;
+		try {
+			home = await services.admitEstablishedHome({ walletId: walletId.value });
+		} catch {
+			return authorizationFailure({
+				status: 503,
+				code: "wallet_home_unavailable",
+				message: "Recovery wallet home is unavailable"
 			});
 		}
+		if (!home.ok) return authorizationFailure({
+			status: 409,
+			code: home.code,
+			message: home.message
+		});
+		return {
+			ok: true,
+			ownershipGeneration: home.ownershipGeneration,
+			authorization
+		};
 	}
 };
 //#endregion

package/dist/esm/router/domains/ed25519Yao/registration/routerAbEd25519YaoHttpRegistrationBackend.js

@@ -1,8 +1,9 @@
 import { requireRecord } from "../../../../shared-ts/src/utils/validation.js";
 import { deriveRouterAbEd25519YaoStableContextBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519YaoDigests.js";
 import { parseRouterAbEd25519YaoActivationKeysetV1, parseRouterAbEd25519YaoActivationResultV1, parseRouterAbEd25519YaoExportResultV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { walletObjectIdentity, walletObjectIdentityHeaders } from "../../../cloudflare/runtime/walletObjectAddresses.js";
 import { createRouterAbTraceContextV1 } from "../../../../shared-ts/src/utils/routerAbTraceContext.js";
-import { routerAbEd25519YaoTenantRootWireV1 } from "../routerAbEd25519YaoGatewayEnvelope.js";
+import { routerAbEd25519YaoRegistrationSigningRootIdV1, routerAbEd25519YaoTenantRootWireV1 } from "../routerAbEd25519YaoGatewayEnvelope.js";
 //#region src/router/domains/ed25519Yao/registration/routerAbEd25519YaoHttpRegistrationBackend.ts
 const INTERNAL_AUTH_HEADER = "x-router-ab-internal-service-auth";
 const TRACE_ID_HEADER = "x-seams-trace-id";
@@ -216,6 +217,7 @@ function registrationRouterExecuteRequest(input, tenantRoot) {
 		participant_ids: input.admissionRequest.participant_ids,
 		target: {
 			operation: "registration",
+			ownership_generation: input.ownershipGeneration,
 			binding: input.request.binding,
 			deriver_a_input: input.request.deriver_a_input,
 			deriver_b_input: input.request.deriver_b_input
@@ -229,6 +231,7 @@ function recoveryRouterExecuteRequest(input, tenantRoot, attempt) {
 		participant_ids: input.admissionRequest.participant_ids,
 		target: {
 			operation: "recovery",
+			ownership_generation: input.ownershipGeneration,
 			binding: input.request.binding,
 			attempt,
 			deriver_a_input: input.request.deriver_a_input,
@@ -241,7 +244,7 @@ async function routerExecuteRequest(input, resolveTenantRoot) {
 	switch (input.operation) {
 		case "registration": return registrationRouterExecuteRequest(input, await routerAbEd25519YaoTenantRootWireV1(await resolveTenantRoot({
 			operation: "registration",
-			admissionRequest: input.admissionRequest
+			...routerAbEd25519YaoRegistrationSigningRootIdV1(input.admissionRequest)
 		})));
 		case "export": return {
 			tenant_root: await routerAbEd25519YaoTenantRootWireV1(await resolveTenantRoot({
@@ -252,6 +255,7 @@ async function routerExecuteRequest(input, resolveTenantRoot) {
 			participant_ids: input.admissionRequest.participant_ids,
 			target: {
 				operation: "export",
+				ownership_generation: input.ownershipGeneration,
 				binding: input.request.binding,
 				deriver_a_input: input.request.deriver_a_input,
 				deriver_b_input: input.request.deriver_b_input
@@ -458,11 +462,12 @@ var RouterAbEd25519YaoHttpRegistrationBackend = class {
 			}
 		};
 	}
-	async executeExport(request, admissionRequest, traceContext) {
+	async executeExport(request, claim, traceContext) {
 		return await this.executeRouterRequest({
 			operation: "export",
 			request,
-			admissionRequest
+			admissionRequest: claim.admissionRequest,
+			ownershipGeneration: claim.ownershipGeneration
 		}, false, traceContext);
 	}
 	keyset() {
@@ -529,34 +534,37 @@ var RouterAbEd25519YaoHttpRegistrationBackend = class {
 			};
 		}
 	}
-	async execute(request, admissionRequest, traceContext) {
+	async execute(request, admissionRequest, ownershipGeneration, traceContext) {
 		return await this.executeRouterRequest({
 			operation: "registration",
 			request,
-			admissionRequest
+			admissionRequest,
+			ownershipGeneration
 		}, false, traceContext);
 	}
-	async resolveRegistrationDispatchRoot(admissionRequest) {
+	async resolveRegistrationDispatchRoot(signingRootId) {
 		return await routerAbEd25519YaoTenantRootWireV1(await this.config.resolveTenantRoot({
 			operation: "registration",
-			admissionRequest
+			...signingRootId
 		}));
 	}
-	async executePinnedRegistration(request, admissionRequest, dispatchRoot, traceContext) {
+	async executePinnedRegistration(request, authority, traceContext) {
 		const routerInput = {
 			operation: "registration",
 			request,
-			admissionRequest
+			admissionRequest: authority.admissionRequest,
+			ownershipGeneration: authority.ownershipGeneration
 		};
-		return await this.sendRouterRequest(routerInput, registrationRouterExecuteRequest(routerInput, dispatchRoot), traceContext.value, "exact", false);
+		return await this.sendRouterRequest(routerInput, registrationRouterExecuteRequest(routerInput, authority.dispatchRoot), traceContext.value, "exact", false);
 	}
 	async consumeRegistration(input) {
 		let response;
 		try {
-			response = await this.post(ROUTER_REGISTRATION_CONSUME_PATH, {
-				tenant_root: input.tenantRoot,
-				wallet_id: input.walletId,
-				lifecycle_id: input.lifecycleId,
+			response = await this.post(ROUTER_REGISTRATION_CONSUME_PATH, walletObjectIdentity(input.authority.admissionReceipt.binding.lifecycle.account_id, input.authority.ownershipGeneration, input.authority.dispatchRoot.identity), {
+				tenant_root: input.authority.dispatchRoot,
+				ownership_generation: input.authority.ownershipGeneration,
+				wallet_id: input.authority.admissionReceipt.binding.lifecycle.account_id,
+				lifecycle_id: input.authority.lifecycleId,
 				session_id: Array.from(input.sessionId),
 				consumer_binding: input.consumerBinding
 			}, createRouterAbTraceContextV1().value, "exact");
@@ -578,13 +586,14 @@ var RouterAbEd25519YaoHttpRegistrationBackend = class {
 			admissionRequest
 		}));
 	}
-	async executeRecovery(request, admissionRequest, dispatchRoot, attempt, replay, traceContext) {
+	async executeRecovery(request, claim, traceContext) {
 		const routerInput = {
 			operation: "recovery",
 			request,
-			admissionRequest
+			admissionRequest: claim.admissionRequest,
+			ownershipGeneration: claim.ownershipGeneration
 		};
-		return await this.sendRouterRequest(routerInput, recoveryRouterExecuteRequest(routerInput, dispatchRoot, attempt), (traceContext ?? createRouterAbTraceContextV1()).value, "replay", replay);
+		return await this.sendRouterRequest(routerInput, recoveryRouterExecuteRequest(routerInput, claim.dispatchRoot, claim.attempt), (traceContext ?? createRouterAbTraceContextV1()).value, "replay", claim.replay);
 	}
 	async executeRouterRequest(request, replay, traceContext) {
 		const traceId = (traceContext ?? createRouterAbTraceContextV1()).value;
@@ -604,7 +613,7 @@ var RouterAbEd25519YaoHttpRegistrationBackend = class {
 		const operation = request.operation;
 		const executeStartedAt = performance.now();
 		try {
-			const response = await this.post(ROUTER_EXECUTE_PATH, routerRequest, traceId, retryAfterTransportFailure, replay);
+			const response = await this.post(ROUTER_EXECUTE_PATH, walletObjectIdentity(request.admissionRequest.application_binding.wallet_id, request.ownershipGeneration, routerRequest.tenant_root.identity), routerRequest, traceId, retryAfterTransportFailure, replay);
 			this.lastRouterServerTiming = response.ok ? response.serverTiming : null;
 			const result = response.ok ? parseRouterExecuteResult(response.body, request.request) : response;
 			emitGatewaySpan(this.config.onSpan, "gateway.yao_execute", operation, traceId, executeStartedAt, result.ok ? "success" : "failure");
@@ -614,10 +623,11 @@ var RouterAbEd25519YaoHttpRegistrationBackend = class {
 			return unavailableFailure(error);
 		}
 	}
-	async activateRecovery(request, dispatchRoot, traceContext) {
-		const promoted = await this.post(ROUTER_RECOVERY_PROMOTE_PATH, {
+	async activateRecovery(request, dispatchRoot, ownershipGeneration, traceContext) {
+		const promoted = await this.post(ROUTER_RECOVERY_PROMOTE_PATH, walletObjectIdentity(request.binding.lifecycle.account_id, ownershipGeneration, dispatchRoot.identity), {
 			...request,
-			tenant_root: dispatchRoot
+			tenant_root: dispatchRoot,
+			ownership_generation: ownershipGeneration
 		}, (traceContext ?? createRouterAbTraceContextV1()).value);
 		if (!promoted.ok) return promoted;
 		if (!activeReceiptMatchesRecoveryActivation(parseActiveSigningWorkerReceipt(promoted.body, request.binding.session_id, request.public_receipt.transcript), request)) return internalFailure("recovery_promotion_mismatch", "Router promotion receipt does not match the verified recovery result");
@@ -626,10 +636,13 @@ var RouterAbEd25519YaoHttpRegistrationBackend = class {
 			body: request
 		};
 	}
-	async post(path, body, traceId, retryAfterTransportFailure = "none", replay = false) {
+	async post(path, identity, body, traceId, retryAfterTransportFailure = "none", replay = false) {
 		const init = {
 			method: "POST",
-			headers: this.headers(traceId),
+			headers: {
+				...this.headers(traceId),
+				...walletObjectIdentityHeaders(identity)
+			},
 			body: JSON.stringify(body)
 		};
 		return await this.request(this.config.routerUrl, path, replay ? requestInitWithReplayHeader(init) : init, retryAfterTransportFailure);
@@ -669,7 +682,6 @@ function parseRouterServerTiming(value) {
 	const metrics = value.split(",").map((metric) => metric.trim());
 	const allowedNames = new Set([
 		"yao_router_prepare_pair",
-		"yao_router_verify_readiness",
 		"yao_router_role_execution",
 		"yao_router_signing_worker_delivery"
 	]);