@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/router/express.js

@@ -90,6 +90,21 @@ function buildCorsOrigins(...inputs) {
 }
 //#endregion
 //#region ../shared-ts/src/device-linking/contracts.ts
+function isLinkSessionTerminalFailureV1(state) {
+	switch (state.state) {
+		case "failed_before_commit":
+		case "cancelled":
+		case "expired": return true;
+		case "displaying_qr":
+		case "claimed":
+		case "awaiting_target_factor":
+		case "awaiting_source_contribution":
+		case "provisioning":
+		case "authority_pending_local_install":
+		case "active": return false;
+		default: return assertNeverLinkSessionStateV1(state);
+	}
+}
 function assertNeverLinkSessionStateV1(value) {
 	throw new Error(`[LinkSessionStateV1] unsupported state: ${String(value)}`);
 }
@@ -398,112 +413,6 @@ function toRorOriginOrNull(value) {
 	}
 }
 //#endregion
-//#region ../shared-ts/src/utils/base58.ts
-/**
-* Encodes binary data to base58 string using Bitcoin's base58 alphabet.
-*
-* @param data - Binary data to encode (Uint8Array, ArrayBuffer, or number[])
-* @returns Base58-encoded string
-*/
-const base58Encode = (data) => {
-	if (data instanceof ArrayBuffer) return bs58.encode(new Uint8Array(data));
-	if (Array.isArray(data)) return bs58.encode(new Uint8Array(data));
-	return bs58.encode(data);
-};
-/**
-* Decodes a base58 string to binary data using Bitcoin's base58 alphabet.
-* Returns a Uint8Array containing the decoded bytes.
-*
-* @param base58String - Base58-encoded string to decode
-* @returns Uint8Array containing the decoded bytes
-* @throws Error if input contains invalid base58 characters
-*/
-const base58Decode = (base58String) => {
-	return bs58.decode(base58String);
-};
-//#endregion
-//#region ../shared-ts/src/utils/near.ts
-/**
-* NEAR-specific utility helpers.
-*
-* Keep chain-specific parsing and validation logic here so generic utility
-* modules (`validation`, `errors`, `encoders`, etc.) stay chain-agnostic.
-*/
-/**
-* Ensure a key string has the NEAR Ed25519 prefix (`ed25519:`).
-*
-* - Accepts either `ed25519:<base58>` or a bare `<base58>` string.
-* - Canonicalizes `ED25519:` -> `ed25519:`.
-* - If a different prefix is present (e.g. `secp256k1:`), returns the input unchanged.
-*/
-function ensureEd25519Prefix(value) {
-	const raw = String(value ?? "").trim();
-	if (!raw) return "";
-	if (/^[a-z0-9_]+:/i.test(raw)) {
-		if (/^ed25519:/i.test(raw)) return `ed25519:${raw.replace(/^ed25519:/i, "")}`;
-		return raw;
-	}
-	return `ed25519:${raw}`;
-}
-/**
-* Lightweight NEAR account ID validation used by server-side helpers.
-* - length: 2..64
-* - chars: lowercase letters, digits, `_`, `.`, `-`
-*/
-function isValidAccountId(accountId) {
-	if (typeof accountId !== "string") return false;
-	if (!accountId || accountId.length < 2 || accountId.length > 64) return false;
-	return /^[a-z0-9_.-]+$/.test(accountId);
-}
-function isImplicitNearAccountId(value) {
-	return typeof value === "string" && /^[0-9a-f]{64}$/.test(value);
-}
-function parseImplicitNearAccountId(raw) {
-	const value = typeof raw === "string" ? raw.trim() : "";
-	if (!value) return {
-		ok: false,
-		code: "missing",
-		message: "implicit NEAR account ID is required"
-	};
-	if (!isImplicitNearAccountId(value)) return {
-		ok: false,
-		code: "invalid",
-		message: "implicit NEAR account ID must be 64 lowercase hex characters"
-	};
-	return {
-		ok: true,
-		value
-	};
-}
-function parseNamedNearAccountId(raw) {
-	const value = typeof raw === "string" ? raw.trim() : "";
-	if (!value) return {
-		ok: false,
-		code: "missing",
-		message: "named NEAR account ID is required"
-	};
-	if (isImplicitNearAccountId(value) || !isValidAccountId(value) || !value.includes(".")) return {
-		ok: false,
-		code: "invalid",
-		message: "named NEAR account ID must be a valid named account containing a dot"
-	};
-	return {
-		ok: true,
-		value
-	};
-}
-function bytesToLowerHex(bytes) {
-	return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
-}
-function deriveImplicitNearAccountIdFromEd25519PublicKey(publicKey) {
-	const normalized = ensureEd25519Prefix(publicKey);
-	const encoded = normalized.startsWith("ed25519:") ? normalized.slice(8) : "";
-	if (!encoded) throw new Error("Ed25519 public key is required");
-	const decoded = base58Decode(encoded);
-	if (decoded.length !== 32) throw new Error("Ed25519 public key must decode to 32 bytes");
-	return bytesToLowerHex(decoded);
-}
-//#endregion
 //#region ../shared-ts/src/utils/validation.ts
 function requireTrimmedString(value, label, message = "is required") {
 	const parsed = normalizeOptionalTrimmedString(value);
@@ -1083,15 +992,25 @@ function parseTargetEmail(raw, label) {
 }
 //#endregion
 //#region ../shared-ts/src/device-linking/activeWalletSession.ts
+const walletSessionHome = wireUnion("kind", [wireObject({ kind: wireLiteral("direct") }), wireObject({
+	kind: wireLiteral("regional"),
+	region: wireLiteral("US", "WEUR", "APAC", "OC")
+})]);
+function parseWalletSessionHome(raw) {
+	return walletSessionHome(raw, "Wallet Session home");
+}
 function walletSessionOperationCredentialV1() {
 	return wireObject({
 		kind: wireLiteral("opaque_wallet_session_operation_credential_v1"),
+		ownershipGeneration: parseNonNegativeSafeInteger,
+		home: parseWalletSessionHome,
 		token: (raw, label) => {
 			if (typeof raw !== "string" || raw.length > 8192) throw new Error(`${label} is invalid`);
 			return raw;
 		},
 		walletSessionId: keyLabeled(walletSessionId)
 	}, (credential, label) => {
+		if (credential.ownershipGeneration === 0) throw new Error(`${label} ownership generation must be positive`);
 		if (!/^wst_[A-Za-z0-9_-]{43}$/.test(credential.token)) throw new Error(`${label} opaque token is invalid`);
 	});
 }
@@ -1536,11 +1455,6 @@ function requireSignerRole(value, label) {
 		default: throw new Error(`${label} must be signer_a or signer_b`);
 	}
 }
-function requireLowerHex(value, label, byteLength) {
-	const hex = coerceNonEmptyString(value, label);
-	if (!new RegExp(`^[0-9a-f]{${byteLength * 2}}$`).test(hex)) throw new Error(`${label} must be ${byteLength} lowercase-hex bytes`);
-	return hex;
-}
 function requireRouterAbX25519PublicKey(value, label) {
 	const publicKey = coerceNonEmptyString(value, label);
 	if (!/^x25519:[0-9a-f]{64}$/.test(publicKey)) throw new Error(`${label} must use x25519:<64 lowercase hex chars> encoding`);
@@ -1595,26 +1509,6 @@ function parseSignerEnvelopeHpkeRotationPublicKeySet(value, label) {
 		previous_retire_at_ms: requirePositiveInteger(record.previous_retire_at_ms, `${label}.previous_retire_at_ms`)
 	};
 }
-function parseSignerPeerVerifyingKey(value, label) {
-	const record = requireRecord(value, label);
-	requireExactKeys$5(record, ["role", "verifying_key_hex"], label);
-	return {
-		role: requireSignerRole(record.role, `${label}.role`),
-		verifying_key_hex: requireLowerHex(record.verifying_key_hex, `${label}.verifying_key_hex`, 32)
-	};
-}
-function parseSignerPeerVerifyingKeySet(value, label) {
-	const record = requireRecord(value, label);
-	requireExactKeys$5(record, ["deriver_a", "deriver_b"], label);
-	const deriverA = parseSignerPeerVerifyingKey(record.deriver_a, `${label}.deriver_a`);
-	const deriverB = parseSignerPeerVerifyingKey(record.deriver_b, `${label}.deriver_b`);
-	if (deriverA.role !== "signer_a") throw new Error(`${label}.deriver_a.role must be signer_a`);
-	if (deriverB.role !== "signer_b") throw new Error(`${label}.deriver_b.role must be signer_b`);
-	return {
-		deriver_a: deriverA,
-		deriver_b: deriverB
-	};
-}
 function parsePublicHpkeKeyDescriptor(value, label) {
 	const record = requireRecord(value, label);
 	requireExactKeys$5(record, ["key_epoch", "public_key"], label);
@@ -1628,7 +1522,6 @@ function parseRouterAbPublicKeysetV2(value) {
 	requireExactKeys$5(record, [
 		"keyset_version",
 		"signer_envelope_hpke",
-		"signer_peer_verifying_keys",
 		"signing_worker_server_output_hpke"
 	], "Router A/B public keyset");
 	const keysetVersion = coerceNonEmptyString(record.keyset_version, "keyset_version");
@@ -1636,7 +1529,6 @@ function parseRouterAbPublicKeysetV2(value) {
 	return {
 		keyset_version: ROUTER_AB_PUBLIC_KEYSET_VERSION_V2,
 		signer_envelope_hpke: parseSignerEnvelopeHpkeRotationPublicKeySet(record.signer_envelope_hpke, "signer_envelope_hpke"),
-		signer_peer_verifying_keys: parseSignerPeerVerifyingKeySet(record.signer_peer_verifying_keys, "signer_peer_verifying_keys"),
 		signing_worker_server_output_hpke: parsePublicHpkeKeyDescriptor(record.signing_worker_server_output_hpke, "signing_worker_server_output_hpke")
 	};
 }
@@ -5416,12 +5308,17 @@ function createRouterAbTraceContextV1() {
 	};
 }
 //#endregion
+//#region ../shared-ts/src/utils/walletManagementProtocol.ts
+const WALLET_MANAGEMENT_PROTOCOL_HEADER = "X-Seams-Wallet-Protocol";
+//#endregion
 //#region src/router/framework/http.ts
 const CORS_ALLOW_METHODS = "GET,POST,PUT,PATCH,DELETE,OPTIONS";
 const CORS_PREFLIGHT_MAX_AGE_SECONDS = 600;
 const CORS_ALLOW_HEADERS = [
 	"Content-Type",
+	WALLET_MANAGEMENT_PROTOCOL_HEADER,
 	"Authorization",
+	"X-Seams-Wallet-Region",
 	"X-Seams-Benchmark-Diagnostics",
 	LINKED_DEVICE_REQUEST_PROOF_HEADER_V1,
 	ROUTER_AB_ED25519_YAO_RECOVERY_CHALLENGE_ID_HEADER_V1,
@@ -5474,7 +5371,7 @@ function withCors(headers, opts, request) {
 	headers.set("Access-Control-Allow-Methods", CORS_ALLOW_METHODS);
 	headers.set("Access-Control-Allow-Headers", CORS_ALLOW_HEADERS);
 	if (allowedOrigin && request?.method === "OPTIONS") headers.set("Access-Control-Max-Age", String(CORS_PREFLIGHT_MAX_AGE_SECONDS));
-	if (headers.has("Server-Timing")) headers.set("Access-Control-Expose-Headers", "Server-Timing");
+	headers.set("Access-Control-Expose-Headers", "Server-Timing, X-Seams-Wallet-Region");
 	if (allowedOrigin && allowedOrigin !== "*") headers.set("Access-Control-Allow-Credentials", "true");
 }
 async function readJson(request) {
@@ -5529,6 +5426,11 @@ async function handleReady(ctx) {
 	}
 }
 //#endregion
+//#region ../shared-ts/src/utils/registrationSetupOperation.ts
+function parseRegistrationSetupOperationId(value) {
+	return typeof value === "string" && /^wreg_[A-Za-z0-9_-]{43}$/u.test(value) ? value : null;
+}
+//#endregion
 //#region src/router/auth/routerApiKeyAuth.ts
 function readHeader(headers, name) {
 	if (headers instanceof Headers) return String(headers.get(name) || "").trim();
@@ -5579,7 +5481,7 @@ function routeAuthNotConfigured(message) {
 		message
 	};
 }
-async function resolvePublishableKeyApiCredentialAuth(input) {
+function parsePublishableKeyRequest(input) {
 	if (input.route.auth.plane !== "api_credentials") return routeAuthNotConfigured(input.routeAuthNotConfiguredMessage);
 	const publishableKey = extractBearerCredential(input.headers);
 	if (!publishableKey) return {
@@ -5602,23 +5504,42 @@ async function resolvePublishableKeyApiCredentialAuth(input) {
 		code: "forbidden",
 		message: `publishable_key_environment_mismatch: ${input.missingEnvironmentMessage}`
 	};
-	const authResult = await input.publishableKeyAuth.authenticate({
-		secret: publishableKey,
-		origin,
-		environmentId
+	return {
+		ok: true,
+		request: {
+			secret: publishableKey,
+			origin,
+			environmentId
+		}
+	};
+}
+async function resolveWalletRegistrationContext(input) {
+	const parsed = parsePublishableKeyRequest(input);
+	if (!parsed.ok) return parsed;
+	return input.registrationContext.resolve({
+		...parsed.request,
+		registration: input.registration
 	});
+}
+async function resolvePublishableKeyApiCredentialAuth(input) {
+	const parsed = parsePublishableKeyRequest(input);
+	if (!parsed.ok) return parsed;
+	const authResult = await input.publishableKeyAuth.authenticate(parsed.request);
 	if (!authResult.ok) return {
 		ok: false,
 		status: authResult.status,
 		code: authResult.status === 403 ? "forbidden" : "unauthorized",
 		message: `${authResult.code}: ${authResult.message}`
 	};
+	return publishableKeyRoutePrincipal(authResult.principal);
+}
+async function publishableKeyRoutePrincipal(principal) {
 	return {
 		ok: true,
 		principal: {
 			kind: "api_credentials",
 			credentialType: "publishable_key",
-			principal: authResult.principal
+			principal
 		}
 	};
 }
@@ -5729,22 +5650,6 @@ function parseLaneParticipantBindingDigestB64u(raw) {
 	return parseDigest(raw, "participantBindingDigestB64u", brandParticipantDigest);
 }
 //#endregion
-//#region ../shared-ts/src/utils/registrationIds.ts
-function walletIdFromString(value) {
-	const parsed = parseWalletId(value);
-	if (!parsed.ok) throw new Error(parsed.error.message);
-	return parsed.value;
-}
-function nearEd25519SigningKeyIdFromString(value) {
-	const normalized = String(value || "").trim();
-	if (!normalized) throw new Error("nearEd25519SigningKeyId is required");
-	return normalized;
-}
-function parseNearEd25519SigningKeyId(value) {
-	if (typeof value !== "string") throw new Error("nearEd25519SigningKeyId must be a string");
-	return nearEd25519SigningKeyIdFromString(value);
-}
-//#endregion
 //#region ../shared-ts/src/signing-lanes/participantDigest.ts
 function u32(value) {
 	if (!Number.isInteger(value) || value < 0 || value > 4294967295) throw new Error("canonical u32 must be an integer between 0 and 4294967295");
@@ -5775,6 +5680,17 @@ function encodeLaneCanonicalU64V1(value) {
 	return output;
 }
 //#endregion
+//#region ../shared-ts/src/signing-lanes/execution.ts
+function buildPreparedOwnerWalletExecution(input) {
+	return {
+		kind: "prepared_owner_wallet_execution",
+		laneKind: input.lane.laneKind,
+		authorization: input.authorization,
+		materialActivation: input.materialActivation,
+		lane: input.lane
+	};
+}
+//#endregion
 //#region ../shared-ts/src/signing-lanes/ownerContinuity.ts
 const OWNER_LANE_PARTICIPANT_BINDING_DOMAIN_V1 = "seams/rotatable-signing-lanes/owner-lane-participant-continuity/v1";
 const OWNER_LANE_PARTICIPANT_CONTINUITY_FIELDS = [
@@ -5842,18 +5758,6 @@ function ownerLaneParticipantContinuityCanonicalBytesV1(input) {
 async function computeOwnerLaneParticipantBindingDigestV1(input) {
 	return requireParsed$2(parseLaneParticipantBindingDigestB64u(base64UrlEncode(await sha256Bytes(ownerLaneParticipantContinuityCanonicalBytesV1(input)))), "owner participant digest");
 }
-new TextEncoder();
-//#endregion
-//#region ../shared-ts/src/signing-lanes/execution.ts
-function buildPreparedOwnerWalletExecution(input) {
-	return {
-		kind: "prepared_owner_wallet_execution",
-		laneKind: input.lane.laneKind,
-		authorization: input.authorization,
-		materialActivation: input.materialActivation,
-		lane: input.lane
-	};
-}
 //#endregion
 //#region ../shared-ts/src/authorization/operationFingerprint.ts
 const CAPABILITY_OPERATION_FINGERPRINT_DOMAIN_V1 = "seams:authorization:capability-operation-fingerprint:v1";
@@ -5906,6 +5810,30 @@ function parseSigningOperationFingerprintDigest(value) {
 	return parseDigestB64u(value.slice(7));
 }
 //#endregion
+//#region ../shared-ts/src/utils/base58.ts
+/**
+* Encodes binary data to base58 string using Bitcoin's base58 alphabet.
+*
+* @param data - Binary data to encode (Uint8Array, ArrayBuffer, or number[])
+* @returns Base58-encoded string
+*/
+const base58Encode = (data) => {
+	if (data instanceof ArrayBuffer) return bs58.encode(new Uint8Array(data));
+	if (Array.isArray(data)) return bs58.encode(new Uint8Array(data));
+	return bs58.encode(data);
+};
+/**
+* Decodes a base58 string to binary data using Bitcoin's base58 alphabet.
+* Returns a Uint8Array containing the decoded bytes.
+*
+* @param base58String - Base58-encoded string to decode
+* @returns Uint8Array containing the decoded bytes
+* @throws Error if input contains invalid base58 characters
+*/
+const base58Decode = (base58String) => {
+	return bs58.decode(base58String);
+};
+//#endregion
 //#region src/authorization/domain.ts
 /**
 * The digest-free authorization projection published to the browser. It carries
@@ -6012,6 +5940,9 @@ function walletSessionCapabilitySubjectsV1Equal(left, right) {
 	}
 	return true;
 }
+function walletSessionAuthorizationV2RecordsEqual(left, right) {
+	return left.kind === right.kind && left.tenantId === right.tenantId && left.principalId === right.principalId && left.walletId === right.walletId && left.authorityId === right.authorityId && left.walletAuthMethodId === right.walletAuthMethodId && left.authorityDigestB64u === right.authorityDigestB64u && left.authorityRevocationEpoch === right.authorityRevocationEpoch && left.mintId === right.mintId && left.authorizationId === right.authorizationId && left.walletSessionId === right.walletSessionId && left.quotaId === right.quotaId && walletSessionCapabilitySubjectsV1Equal(left.capabilitySubjects, right.capabilitySubjects) && left.createdAtMs === right.createdAtMs && left.expiresAtMs === right.expiresAtMs;
+}
 function parseAuthorizedOperationReplayResponse(value) {
 	if (!isAuthorizedOperationReplayResponseRecordV1(value)) throw new Error("authorized operation replay response must be an object");
 	const keys = Object.keys(value).sort();
@@ -6144,8 +6075,7 @@ function resolveWalletSessionAuthorizationV2AdministrationAdmission(input) {
 			if (!subject || subject.authorityId !== input.authority.authorityId) return admissionRefused("capability_subject_mismatch");
 			return {
 				ok: true,
-				operationKind: "link_devices",
-				authorityId: input.authority.authorityId
+				operationKind: "link_devices"
 			};
 		}
 		default: return assertNeverWalletSessionAuthorizationV2AdministrationOperation(input.operation.kind);
@@ -6397,12 +6327,23 @@ async function validateRouterAbEd25519WalletSessionInputs(input) {
 	const token = extractBearerCredential(input.headers);
 	if (!token) return walletSessionFailure("wallet_session_missing");
 	const nowMs = input.nowMs || Date.now;
+	let read;
 	let resolution;
 	try {
-		resolution = await resolveWalletSessionOperationCredentialAdmission({
-			authorizationSessions,
+		read = await authorizationSessions.readEd25519WalletSessionSigningReadByOperationCredential({
+			tenantId: authorizationSessions.tenantId,
 			token,
 			nowMs: nowMs(),
+			materialActivation: input.materialActivation
+		});
+		if (!read) return {
+			ok: false,
+			code: "wallet_session_invalid",
+			message: walletSessionFailureMessage("wallet_session_invalid")
+		};
+		resolution = resolveWalletSessionOperationCredentialAdmissionFromContext({
+			context: read.context,
+			nowMs: nowMs(),
 			operation: {
 				keyFamily: "ed25519",
 				operationKind: input.operationKind
@@ -6411,18 +6352,14 @@ async function validateRouterAbEd25519WalletSessionInputs(input) {
 	} catch {
 		return walletSessionFailure("wallet_session_unavailable");
 	}
-	if (resolution.kind === "rejected") return walletSessionFailure("wallet_session_scope_mismatch");
-	if (resolution.kind === "not_found") return {
-		ok: false,
-		code: "wallet_session_invalid",
-		message: walletSessionFailureMessage("wallet_session_invalid")
-	};
-	if (resolution.admission.curve !== "ed25519") return walletSessionFailure("wallet_session_scope_mismatch");
+	if (resolution.kind === "rejected" || resolution.admission.curve !== "ed25519") return walletSessionFailure("wallet_session_scope_mismatch");
 	return {
 		ok: true,
 		kind: "wallet_session_operation_credential_v1",
 		admission: resolution.admission,
-		context: resolution.admission.context
+		context: resolution.admission.context,
+		signerRead: read.signerRead,
+		policyRead: read.policyRead
 	};
 }
 async function validateEcdsaPreprocessingSession(input) {
@@ -6742,36 +6679,169 @@ async function enforceRoutePolicy(input) {
 	};
 }
 //#endregion
-//#region src/router/framework/routeResponses.ts
-function routeJson(status, body, options) {
-	return {
-		status,
-		body,
-		...options?.headers ? { headers: options.headers } : {},
-		...options?.usage ? { usage: options.usage } : {}
-	};
-}
-function routeError(status, code, message) {
-	return routeJson(status, {
-		ok: false,
-		code,
-		message
-	});
-}
-function toFetchRouteResponse(response) {
-	return new Response(JSON.stringify(response.body), {
-		status: response.status,
-		headers: {
-			"Content-Type": "application/json; charset=utf-8",
-			...response.headers || {}
-		}
-	});
-}
-//#endregion
-//#region ../shared-ts/src/passkey-custody/custodySecretBinding.ts
-/** The only derivation scheme owner custody supports. */
-const WALLET_SEED_DERIVATION_SCHEME_V1 = "wallet_seed_parallel_hkdf_sha256_v1";
-function buildWalletCustodySeedBinding() {
+//#region src/router/domains/walletRegistration/registrationSessionSeal.ts
+/** Holds one request's computation until registration can publish its response. */
+var RegistrationPreparedSessionSeal = class {
+	constructor(request, service) {
+		this.request = request;
+		this.service = service;
+		this.prepared = null;
+	}
+	async prepare(session) {
+		await this.finish(session);
+	}
+	async finish(session) {
+		const tokens = session.tokens;
+		const ed25519 = tokens.kind === "near_ed25519" || tokens.kind === "near_ed25519_and_evm_family_ecdsa" ? tokens.ed25519 : null;
+		if (!ed25519 || String(ed25519.thresholdSessionId) !== this.request.thresholdSessionId) return {
+			ok: false,
+			code: "invalid_session_seal",
+			message: "Prepared seal does not match the established Ed25519 session"
+		};
+		if (this.prepared === null) this.prepared = {
+			walletId: String(session.walletId),
+			walletSessionId: String(session.walletSessionId),
+			expiresAtMs: session.expiresAtMs,
+			result: applyRegistrationSessionSeal(this.service, this.request, session)
+		};
+		if (this.prepared.walletId !== String(session.walletId) || this.prepared.walletSessionId !== String(session.walletSessionId) || this.prepared.expiresAtMs !== session.expiresAtMs) return {
+			ok: false,
+			code: "invalid_session_seal",
+			message: "Prepared seal does not match the committed Wallet Session"
+		};
+		const sealed = await this.prepared.result;
+		if (!sealed.ok) return sealed;
+		const keyVersion = String(sealed.keyVersion || "").trim();
+		if (!keyVersion) return {
+			ok: false,
+			code: "invalid_session_seal",
+			message: "Signing-session seal response is missing its key version"
+		};
+		const expiresAtMs = Math.min(sealed.expiresAtMs ?? session.expiresAtMs, session.expiresAtMs);
+		if (expiresAtMs <= Date.now()) return {
+			ok: false,
+			code: "expired",
+			message: "threshold session expired"
+		};
+		return {
+			ok: true,
+			value: {
+				ciphertext: sealed.ciphertext,
+				keyVersion,
+				expiresAtMs,
+				remainingUses: session.remainingUses
+			}
+		};
+	}
+};
+async function applyRegistrationSessionSeal(service, request, session) {
+	if (!service) return {
+		ok: false,
+		code: "signing_session_seal_unavailable",
+		message: "Signing-session sealing is unavailable"
+	};
+	try {
+		return await service.applyServerSeal(request, {
+			userId: String(session.walletId),
+			session: {
+				kind: "exact_wallet_session_operation_credential",
+				curve: "ed25519",
+				thresholdSessionId: request.thresholdSessionId,
+				userId: String(session.walletId),
+				expiresAtMs: session.expiresAtMs
+			}
+		});
+	} catch {
+		return {
+			ok: false,
+			code: "signing_session_seal_unavailable",
+			message: "Signing-session sealing failed"
+		};
+	}
+}
+function parseRegistrationPreparedSessionSeal(raw, service) {
+	if (raw === void 0) return {
+		ok: true,
+		value: null
+	};
+	if (!isPlainObject(raw)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "sessionSeal must be an object"
+	};
+	for (const field of Object.keys(raw)) if (![
+		"thresholdSessionId",
+		"ciphertext",
+		"keyVersion"
+	].includes(field)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "sessionSeal has unknown fields"
+	};
+	const thresholdSessionId = String(raw.thresholdSessionId || "").trim();
+	const ciphertext = String(raw.ciphertext || "").trim();
+	const keyVersion = String(raw.keyVersion || "").trim();
+	if (!thresholdSessionId || !ciphertext) return {
+		ok: false,
+		code: "invalid_body",
+		message: "sessionSeal thresholdSessionId and ciphertext are required"
+	};
+	return {
+		ok: true,
+		value: new RegistrationPreparedSessionSeal({
+			thresholdSessionId,
+			ciphertext,
+			...keyVersion ? { keyVersion } : {}
+		}, service)
+	};
+}
+//#endregion
+//#region src/router/framework/routeResponses.ts
+function routeJson(status, body, options) {
+	return {
+		status,
+		body,
+		...options?.headers ? { headers: options.headers } : {},
+		...options?.usage ? { usage: options.usage } : {}
+	};
+}
+function routeError(status, code, message) {
+	return routeJson(status, {
+		ok: false,
+		code,
+		message
+	});
+}
+function toFetchRouteResponse(response) {
+	return new Response(JSON.stringify(response.body), {
+		status: response.status,
+		headers: {
+			"Content-Type": "application/json; charset=utf-8",
+			...response.headers || {}
+		}
+	});
+}
+//#endregion
+//#region ../shared-ts/src/utils/registrationIds.ts
+function walletIdFromString(value) {
+	const parsed = parseWalletId(value);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+function nearEd25519SigningKeyIdFromString(value) {
+	const normalized = String(value || "").trim();
+	if (!normalized) throw new Error("nearEd25519SigningKeyId is required");
+	return normalized;
+}
+function parseNearEd25519SigningKeyId(value) {
+	if (typeof value !== "string") throw new Error("nearEd25519SigningKeyId must be a string");
+	return nearEd25519SigningKeyIdFromString(value);
+}
+//#endregion
+//#region ../shared-ts/src/passkey-custody/custodySecretBinding.ts
+/** The only derivation scheme owner custody supports. */
+const WALLET_SEED_DERIVATION_SCHEME_V1 = "wallet_seed_parallel_hkdf_sha256_v1";
+function buildWalletCustodySeedBinding() {
 	return {
 		kind: "wallet_custody_seed_v1",
 		derivationScheme: WALLET_SEED_DERIVATION_SCHEME_V1
@@ -7144,99 +7214,6 @@ function parsePasskeyCustodyEnvelopeRecord(raw, label = "walletCustodyEnvelope")
 	});
 }
 //#endregion
-//#region src/router/domains/walletRegistration/walletRegistrationSetupPayload.ts
-const WALLET_REGISTRATION_SETUP_CLAIM_KIND = "wallet_registration_setup_v1";
-/**
-* Verifies the payload and binds it to the ceremony the caller is driving.
-* A payload that verifies cryptographically but names a different ceremony,
-* wallet, or setup digest is rejected — signature validity alone is not
-* authorization for this request.
-*/
-/**
-* Verifies the payload's signature, ceremony binding, and expiry, and returns
-* its claims — without needing the ceremony row.
-*
-* Activate depends on this: a successful activation deletes the ceremony, so
-* an exact replay must be answerable from the operation row alone. The claims
-* are Gateway-signed, so the `setupDigestB64u` they carry is trustworthy
-* without recomputing it from storage.
-*/
-async function verifyWalletRegistrationSetupClaims(signer, token, expected) {
-	const value = normalizeOptionalTrimmedString(token);
-	if (!value) return {
-		ok: false,
-		code: "invalid_body",
-		message: "signedSetup is required"
-	};
-	const verified = await signer.verifyJwt(value);
-	if (!verified.valid) return {
-		ok: false,
-		code: "invalid_grant",
-		message: "signedSetup is not valid"
-	};
-	const claims = parseWalletRegistrationSetupClaims(verified.payload);
-	if (!claims) return {
-		ok: false,
-		code: "invalid_grant",
-		message: "signedSetup claims are not valid"
-	};
-	if (claims.registrationCeremonyId !== expected.registrationCeremonyId) return {
-		ok: false,
-		code: "invalid_grant",
-		message: "signedSetup belongs to a different registration ceremony"
-	};
-	if (claims.expiresAtMs <= expected.nowMs) return {
-		ok: false,
-		code: "invalid_grant",
-		message: "signedSetup has expired"
-	};
-	return {
-		ok: true,
-		claims
-	};
-}
-function parseWalletRegistrationSetupClaims(value) {
-	if (typeof value !== "object" || value === null) return null;
-	const record = value;
-	if (record.kind !== WALLET_REGISTRATION_SETUP_CLAIM_KIND) return null;
-	const registrationCeremonyId = normalizeOptionalTrimmedString(record.registrationCeremonyId);
-	const walletId = normalizeOptionalTrimmedString(record.walletId);
-	const orgId = normalizeOptionalTrimmedString(record.orgId);
-	const signingRootId = normalizeOptionalTrimmedString(record.signingRootId);
-	const signingRootVersion = normalizeOptionalTrimmedString(record.signingRootVersion);
-	const setupDigestB64u = normalizeOptionalTrimmedString(record.setupDigestB64u);
-	const expiresAtMs = Number(record.expiresAtMs);
-	const policy = parseWalletRegistrationSetupPolicy(record.policy);
-	if (!registrationCeremonyId || !walletId || !orgId || !signingRootId || !signingRootVersion || !setupDigestB64u || !policy || !Number.isSafeInteger(expiresAtMs)) return null;
-	return {
-		kind: WALLET_REGISTRATION_SETUP_CLAIM_KIND,
-		registrationCeremonyId,
-		walletId,
-		orgId,
-		signingRootId,
-		signingRootVersion,
-		policy,
-		setupDigestB64u,
-		expiresAtMs
-	};
-}
-function parseWalletRegistrationSetupPolicy(value) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
-	const record = value;
-	switch (record.kind) {
-		case "runtime_policy_scope": try {
-			return {
-				kind: "runtime_policy_scope",
-				scope: normalizeRuntimePolicyScope(record.scope)
-			};
-		} catch {
-			return null;
-		}
-		case "signing_root_only": return record.scope === void 0 ? { kind: "signing_root_only" } : null;
-		default: return null;
-	}
-}
-//#endregion
 //#region ../shared-ts/src/utils/ecdsaKeyFactsInventory.ts
 function normalizeChainTarget(target) {
 	if (target.kind === "evm") return {
@@ -7274,6 +7251,88 @@ async function computeWalletEcdsaKeyFactsInventoryChallengeDigestB64u(input) {
 	return base64UrlEncode(await sha256BytesUtf8(canonicalizeWalletEcdsaKeyFactsInventoryChallenge(input)));
 }
 //#endregion
+//#region ../shared-ts/src/utils/near.ts
+/**
+* NEAR-specific utility helpers.
+*
+* Keep chain-specific parsing and validation logic here so generic utility
+* modules (`validation`, `errors`, `encoders`, etc.) stay chain-agnostic.
+*/
+/**
+* Ensure a key string has the NEAR Ed25519 prefix (`ed25519:`).
+*
+* - Accepts either `ed25519:<base58>` or a bare `<base58>` string.
+* - Canonicalizes `ED25519:` -> `ed25519:`.
+* - If a different prefix is present (e.g. `secp256k1:`), returns the input unchanged.
+*/
+function ensureEd25519Prefix(value) {
+	const raw = String(value ?? "").trim();
+	if (!raw) return "";
+	if (/^[a-z0-9_]+:/i.test(raw)) {
+		if (/^ed25519:/i.test(raw)) return `ed25519:${raw.replace(/^ed25519:/i, "")}`;
+		return raw;
+	}
+	return `ed25519:${raw}`;
+}
+/**
+* Lightweight NEAR account ID validation used by server-side helpers.
+* - length: 2..64
+* - chars: lowercase letters, digits, `_`, `.`, `-`
+*/
+function isValidAccountId(accountId) {
+	if (typeof accountId !== "string") return false;
+	if (!accountId || accountId.length < 2 || accountId.length > 64) return false;
+	return /^[a-z0-9_.-]+$/.test(accountId);
+}
+function isImplicitNearAccountId(value) {
+	return typeof value === "string" && /^[0-9a-f]{64}$/.test(value);
+}
+function parseImplicitNearAccountId(raw) {
+	const value = typeof raw === "string" ? raw.trim() : "";
+	if (!value) return {
+		ok: false,
+		code: "missing",
+		message: "implicit NEAR account ID is required"
+	};
+	if (!isImplicitNearAccountId(value)) return {
+		ok: false,
+		code: "invalid",
+		message: "implicit NEAR account ID must be 64 lowercase hex characters"
+	};
+	return {
+		ok: true,
+		value
+	};
+}
+function parseNamedNearAccountId(raw) {
+	const value = typeof raw === "string" ? raw.trim() : "";
+	if (!value) return {
+		ok: false,
+		code: "missing",
+		message: "named NEAR account ID is required"
+	};
+	if (isImplicitNearAccountId(value) || !isValidAccountId(value) || !value.includes(".")) return {
+		ok: false,
+		code: "invalid",
+		message: "named NEAR account ID must be a valid named account containing a dot"
+	};
+	return {
+		ok: true,
+		value
+	};
+}
+function bytesToLowerHex(bytes) {
+	return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function deriveImplicitNearAccountIdFromEd25519PublicKey(publicKey) {
+	const normalized = ensureEd25519Prefix(publicKey);
+	const encoded = normalized.startsWith("ed25519:") ? normalized.slice(8) : "";
+	if (!encoded) throw new Error("Ed25519 public key is required");
+	const decoded = base58Decode(encoded);
+	if (decoded.length !== 32) throw new Error("Ed25519 public key must decode to 32 bytes");
+	return bytesToLowerHex(decoded);
+}
+//#endregion
 //#region ../shared-ts/src/utils/registrationSignerPlan.ts
 function normalizePositiveInteger(raw, fallback) {
 	const value = typeof raw === "number" ? raw : Number(raw);
@@ -7941,6 +8000,12 @@ function parseWalletRegistrationSetupWallet(raw) {
 	};
 }
 function parseWalletRegistrationSetupRequest(body) {
+	const registrationOperationId = parseRegistrationSetupOperationId(body.registrationOperationId);
+	if (!registrationOperationId) return {
+		ok: false,
+		code: "invalid_body",
+		message: "registrationOperationId is required"
+	};
 	const signerSelection = parseRegistrationSignerSet(body.signerSelection);
 	if (!signerSelection.ok) return signerSelection;
 	const authMethod = normalizeRegistrationAuthMethodInput(body.authMethod);
@@ -7954,6 +8019,7 @@ function parseWalletRegistrationSetupRequest(body) {
 	return {
 		ok: true,
 		value: {
+			registrationOperationId,
 			...wallet.value ? { wallet: wallet.value } : {},
 			signerSelection: signerSelection.value.selection,
 			authMethod
@@ -9171,20 +9237,31 @@ async function handleRouterApiWalletAddSignerIntent(input) {
 	});
 	return routeJson(result.ok ? 200 : 400, result);
 }
-/**
-* `POST /wallets/register/setup` — the single admitted entry point that
-* replaces the bootstrap grant, the intent, and start.
-*
-* Authentication is the same API-credential plane the intent route used, so
-* origin and environment binding are unchanged; what is gone is the stored
-* grant that used to sit between the check and its only reader.
-*/
 async function handleRouterApiWalletRegistrationSetup(input) {
 	if (!isPlainObject(input.body)) return routeError(400, "invalid_body", "JSON body required");
 	const origin = normalizeCorsOrigin(input.origin);
 	if (!origin) return routeError(403, "forbidden", "Origin header is required and must be a valid exact origin");
-	const publishableKeyAuth = input.services.publishableKeyAuth;
-	if (!publishableKeyAuth) return routeError(500, "route_auth_not_configured", "wallet registration setup requires publishable key auth on this server");
+	const registrationContext = input.services.registrationContext;
+	if (!registrationContext) return routeError(500, "route_auth_not_configured", "Wallet registration context is not configured");
+	const request = parseWalletRegistrationSetupRequest(input.body);
+	if (!request.ok) return routeError(400, request.code, request.message);
+	const context = await resolveWalletRegistrationContext({
+		registration: request.value,
+		environmentId: extractRouterApiEnvironmentId(input.headers) || void 0,
+		headers: input.headers,
+		missingEnvironmentMessage: "Environment header is required for wallet registration setup",
+		missingOriginMessage: "Origin header is required and must be a valid exact origin",
+		missingPublishableKeyMessage: "Missing publishable key",
+		origin,
+		registrationContext,
+		route: input.route,
+		routeAuthNotConfiguredMessage: "Wallet registration setup requires API credential auth policy"
+	});
+	if (!context.ok) {
+		if (context.status === 401) return routeError(401, "unauthorized", `${context.code}: ${context.message}`);
+		if (context.status === 403) return routeError(403, "forbidden", `${context.code}: ${context.message}`);
+		return routeError(context.status, "internal", `${context.code}: ${context.message}`);
+	}
 	const resolved = await enforceRoutePolicy({
 		headers: input.headers,
 		logger: input.logger,
@@ -9195,44 +9272,27 @@ async function handleRouterApiWalletRegistrationSetup(input) {
 		route: input.route,
 		services: walletRegistrationRoutePolicyServices(input),
 		sourceIp: input.sourceIp,
-		resolvers: { apiCredentials: async () => await resolvePublishableKeyApiCredentialAuth({
-			environmentId: extractRouterApiEnvironmentId(input.headers) || void 0,
-			headers: input.headers,
-			missingEnvironmentMessage: "Environment header is required for wallet registration setup",
-			missingOriginMessage: "Origin header is required and must be a valid exact origin",
-			missingPublishableKeyMessage: "Missing publishable key",
-			origin,
-			publishableKeyAuth,
-			route: input.route,
-			routeAuthNotConfiguredMessage: "Wallet registration setup requires API credential auth policy"
-		}) }
+		resolvers: { apiCredentials: publishableKeyRoutePrincipal.bind(void 0, context.principal) }
 	});
 	if (!resolved.ok) return routeJson(resolved.status, resolved.body);
-	if (resolved.context.principal.kind !== "api_credentials") return routeError(500, "internal", "wallet registration setup requires API credentials");
-	const principal = resolved.context.principal.principal;
-	const runtimePolicyScope = await resolveActiveRuntimePolicyScopeForEnvironment({
-		orgProjectEnv: input.services.orgProjectEnv || null,
+	const principal = context.principal;
+	const runtimePolicyScope = {
 		orgId: principal.orgId,
-		environmentId: principal.environmentId,
-		projectId: principal.projectId,
-		envId: principal.envId
-	});
+		projectId: context.environment.projectId,
+		envId: context.environment.key,
+		signingRootVersion: context.environment.signingRootVersion
+	};
 	const session = input.services.session;
 	if (!session) return routeError(500, "internal", "wallet registration setup requires session signing");
-	const request = parseWalletRegistrationSetupRequest(input.body);
-	if (!request.ok) return routeError(400, request.code, request.message);
-	const result = await input.services.walletRegistration.setupWalletRegistration({
+	return input.services.walletRegistration.setupWalletRegistration({
 		request: request.value,
 		orgId: principal.orgId,
 		expectedOrigin: origin,
 		signer: session,
-		...runtimePolicyScope ? { runtimePolicyScope } : {},
-		...runtimePolicyScope ? {
-			signingRootId: `${runtimePolicyScope.projectId}:${runtimePolicyScope.envId}`,
-			signingRootVersion: runtimePolicyScope.signingRootVersion
-		} : {}
+		runtimePolicyScope,
+		signingRootId: `${runtimePolicyScope.projectId}:${runtimePolicyScope.envId}`,
+		signingRootVersion: runtimePolicyScope.signingRootVersion
 	});
-	return routeJson(result.ok ? 200 : 400, result);
 }
 /**
 * `POST /wallets/register/respond` — the authenticated leg.
@@ -9397,30 +9457,6 @@ function parseRegistrationRequestDigestB64u(raw) {
 		return null;
 	}
 }
-async function projectActivatedWallet(input) {
-	const walletProjection = input.services.walletProjection || null;
-	if (!walletProjection) return null;
-	const verifier = input.services.session;
-	if (!verifier) return "wallet projection requires setup verification";
-	const verified = await verifyWalletRegistrationSetupClaims(verifier, input.signedSetup, {
-		registrationCeremonyId: input.registrationCeremonyId,
-		nowMs: Date.now()
-	});
-	if (!verified.ok) return verified.message;
-	if (verified.claims.policy.kind !== "runtime_policy_scope") return "wallet projection requires an exact runtime policy scope";
-	if (verified.claims.policy.scope.orgId !== verified.claims.orgId) return "wallet projection scope does not match its organization";
-	try {
-		await walletProjection.recordCreatedWallet({
-			orgId: verified.claims.orgId,
-			runtimePolicyScope: verified.claims.policy.scope,
-			walletId: verified.claims.walletId,
-			occurredAt: (/* @__PURE__ */ new Date()).toISOString()
-		});
-		return null;
-	} catch (error) {
-		return error instanceof Error ? error.message : String(error);
-	}
-}
 /**
 * `POST /wallets/register/activate` — activation and finalization behind
 * one Gateway operation row.
@@ -9439,9 +9475,7 @@ async function handleRouterApiWalletRegistrationActivate(input) {
 	const idempotencyKey = String(body.idempotencyKey || "").trim();
 	if (!idempotencyKey) return routeError(400, "invalid_body", "idempotencyKey is required");
 	const planKind = String(body.kind || "").trim();
-	if (planKind !== "evm_family_ecdsa" && planKind !== "near_ed25519_and_evm_family_ecdsa" && planKind !== "near_ed25519") return routeError(400, "invalid_body", "kind must name the signer plan");
-	const ed25519Only = planKind === "near_ed25519";
-	if (ed25519Only && body.ecdsa !== void 0) return routeError(400, "invalid_body", "an Ed25519-only activate carries no ECDSA activation");
+	if (planKind !== "evm_family_ecdsa" && planKind !== "near_ed25519_and_evm_family_ecdsa") return routeError(400, "invalid_body", "activation requires an ECDSA signer plan");
 	const ecdsa = isPlainObject(body.ecdsa) ? body.ecdsa : null;
 	const unknownEcdsaField = ecdsa ? findUnknownField(ecdsa, [
 		"activationCorrelationId",
@@ -9449,9 +9483,9 @@ async function handleRouterApiWalletRegistrationActivate(input) {
 		"clientActivation"
 	]) : null;
 	if (unknownEcdsaField) return routeError(400, "invalid_body", `wallet registration ECDSA activation field ${unknownEcdsaField} is unsupported`);
-	if (!ed25519Only && (!ecdsa || typeof ecdsa.activationCorrelationId !== "string" || typeof ecdsa.activationRequestDigestB64u !== "string" || !isPlainObject(ecdsa.clientActivation))) return routeError(400, "invalid_body", "browser-verified clientActivation is required");
+	if (!ecdsa || typeof ecdsa.activationCorrelationId !== "string" || typeof ecdsa.activationRequestDigestB64u !== "string" || !isPlainObject(ecdsa.clientActivation)) return routeError(400, "invalid_body", "browser-verified clientActivation is required");
 	let parsedActivation;
-	if (ecdsa) try {
+	try {
 		const parsed = parseRouterAbEcdsaRegistrationActivationRequestV1({
 			registrationCeremonyId,
 			ecdsa: {
@@ -9474,25 +9508,17 @@ async function handleRouterApiWalletRegistrationActivate(input) {
 		signedSetup,
 		idempotencyKey,
 		planKind,
-		...parsedActivation ? { ecdsa: parsedActivation } : {},
+		ecdsa: parsedActivation,
 		...body.emailOtpEnrollment ? { emailOtpEnrollment: body.emailOtpEnrollment } : {},
 		...body.walletCustodyCommit !== void 0 ? { walletCustodyCommit: body.walletCustodyCommit } : {},
 		verifier: session
 	}, traceContext.value ?? void 0, serverTiming);
 	if (!result.ok) return routeJson(400, result);
 	if (!isEmailOtpWalletRegistrationActivateSuccessV2(result) && !isPasskeyWalletRegistrationActivateSuccessV2(result)) return routeError(500, "internal", "Wallet registration activation returned an invalid authority");
-	const projectionError = await projectActivatedWallet({
-		registrationCeremonyId,
-		services: input.services,
-		signedSetup
-	});
-	if (projectionError) return routeError(500, "internal", `Wallet was created but its Console projection failed: ${projectionError}`);
 	return routeJson(200, result, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
 }
 /**
-* `POST /wallets/register/near-provisioning` — the non-blocking completion
-* the client calls after activate, once its already-running Yao computation
-* produces an activation.
+* Commits a NEAR-only wallet or completes a mixed wallet's deferred signer.
 */
 async function handleRouterApiWalletRegistrationNearProvisioning(input) {
 	if (!isPlainObject(input.body)) return routeError(400, "invalid_body", "JSON body required");
@@ -9505,7 +9531,7 @@ async function handleRouterApiWalletRegistrationNearProvisioning(input) {
 	if (!registrationCeremonyId || !signedSetup || !idempotencyKey) return routeError(400, "invalid_body", "registrationCeremonyId, signedSetup and idempotencyKey are required");
 	const ed25519 = parseWalletRegistrationEd25519Finalize(body.ed25519);
 	if (!ed25519.ok) return routeError(400, ed25519.code, ed25519.message);
-	const sessionSeal = parseRegistrationPreparedSessionSeal(body.sessionSeal);
+	const sessionSeal = parseRegistrationPreparedSessionSeal(body.sessionSeal, input.signingSessionSeal?.service ?? null);
 	if (!sessionSeal.ok) return routeError(400, sessionSeal.code, sessionSeal.message);
 	const serverTiming = [];
 	const result = await input.services.walletRegistration.completeWalletRegistrationNearProvisioning({
@@ -9516,17 +9542,14 @@ async function handleRouterApiWalletRegistrationNearProvisioning(input) {
 		ed25519: ed25519.value,
 		emailOtpEnrollment: body.emailOtpEnrollment,
 		...body.walletCustodyCommit !== void 0 ? { walletCustodyCommit: body.walletCustodyCommit } : {},
-		verifier: session
-	}, serverTiming);
+		verifier: session,
+		onSessionCommitted: sessionSeal.value?.prepare.bind(sessionSeal.value)
+	}, serverTiming, input.waitUntil);
 	if (!result.ok) return routeJson(400, result);
 	if (sessionSeal.value) {
 		if (!isPasskeyWalletRegistrationNearProvisioningSuccessV2(result)) return routeError(400, "invalid_body", "Registration session sealing requires a passkey authority");
 		const sealStartedAt = Date.now();
-		const sealed = await applyRegistrationPreparedSessionSeal({
-			options: input.signingSessionSeal,
-			request: sessionSeal.value,
-			response: result
-		});
+		const sealed = await sessionSeal.value.finish(result.registrationEstablishedSession.session);
 		serverTiming.push(["near_finalize_session_seal", Math.max(0, Date.now() - sealStartedAt)]);
 		if (!sealed.ok) return routeJson(503, {
 			ok: false,
@@ -9540,83 +9563,6 @@ async function handleRouterApiWalletRegistrationNearProvisioning(input) {
 	}
 	return routeJson(200, result, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
 }
-function parseRegistrationPreparedSessionSeal(raw) {
-	if (raw === void 0) return {
-		ok: true,
-		value: void 0
-	};
-	if (!isPlainObject(raw)) return {
-		ok: false,
-		code: "invalid_body",
-		message: "sessionSeal must be an object"
-	};
-	if (Object.keys(raw).some((field) => ![
-		"thresholdSessionId",
-		"ciphertext",
-		"keyVersion"
-	].includes(field))) return {
-		ok: false,
-		code: "invalid_body",
-		message: "sessionSeal has unknown fields"
-	};
-	const thresholdSessionId = String(raw.thresholdSessionId || "").trim();
-	const ciphertext = String(raw.ciphertext || "").trim();
-	const keyVersion = String(raw.keyVersion || "").trim();
-	if (!thresholdSessionId || !ciphertext) return {
-		ok: false,
-		code: "invalid_body",
-		message: "sessionSeal thresholdSessionId and ciphertext are required"
-	};
-	return {
-		ok: true,
-		value: {
-			thresholdSessionId,
-			ciphertext,
-			...keyVersion ? { keyVersion } : {}
-		}
-	};
-}
-async function applyRegistrationPreparedSessionSeal(args) {
-	if (!args.options) return {
-		ok: false,
-		code: "signing_session_seal_unavailable",
-		message: "Signing-session sealing is unavailable"
-	};
-	const session = args.response.registrationEstablishedSession.session;
-	const tokens = session.tokens;
-	const ed25519 = tokens.kind === "near_ed25519" || tokens.kind === "near_ed25519_and_evm_family_ecdsa" ? tokens.ed25519 : null;
-	if (!ed25519 || String(ed25519.thresholdSessionId) !== args.request.thresholdSessionId) return {
-		ok: false,
-		code: "invalid_session_seal",
-		message: "Prepared seal does not match the established Ed25519 session"
-	};
-	const sealed = await args.options.service.applyServerSeal(args.request, {
-		userId: String(session.walletId),
-		session: {
-			kind: "exact_wallet_session_operation_credential",
-			curve: "ed25519",
-			thresholdSessionId: args.request.thresholdSessionId,
-			userId: String(session.walletId),
-			expiresAtMs: session.expiresAtMs
-		}
-	});
-	if (!sealed.ok) return sealed;
-	const keyVersion = String(sealed.keyVersion || "").trim();
-	if (!keyVersion) return {
-		ok: false,
-		code: "invalid_session_seal",
-		message: "Signing-session seal response is missing its key version"
-	};
-	return {
-		ok: true,
-		value: {
-			ciphertext: sealed.ciphertext,
-			keyVersion,
-			expiresAtMs: Math.min(sealed.expiresAtMs ?? session.expiresAtMs, session.expiresAtMs),
-			remainingUses: session.remainingUses
-		}
-	};
-}
 function ecdsaGatewayServerTimingHeaders(serverTiming) {
 	if (serverTiming.length === 0) return void 0;
 	const header = serverTiming.map(([name, durationMs]) => `${name};dur=${Math.max(0, durationMs).toFixed(1)}`).join(", ");
@@ -10233,7 +10179,6 @@ const ROUTER_API_ECDSA_STRICT_LIFECYCLE_SERVICES = [
 	"session"
 ];
 const ROUTER_API_WEBAUTHN_AUTHENTICATOR_SERVICES = ["webAuthn", "session"];
-const ROUTER_API_NEAR_PUBLIC_KEY_SERVICES = ["nearFunding", "session"];
 const ROUTER_API_PASSKEY_CUSTODY_SERVICES = [
 	"passkeyCustody",
 	"walletAuthMethods",
@@ -10600,7 +10545,7 @@ function createRouterApiRouteDefinitions(options = {}) {
 	}, ROUTER_API_ED25519_WALLET_SESSION_SERVICES), sessionPrincipalRoute("router_ab_ed25519_sign_prepare", "POST", ROUTER_AB_ED25519_NORMAL_SIGNING_PREPARE_PATH, "Prepare Router A/B Ed25519 normal signing", ROUTER_API_NORMAL_SIGNING_PROXY_SERVICES), sessionPrincipalRoute("router_ab_ed25519_sign_finalize", "POST", ROUTER_AB_ED25519_NORMAL_SIGNING_PATH, "Finalize Router A/B Ed25519 normal signing", ROUTER_API_NORMAL_SIGNING_PROXY_SERVICES), publicRoute("router_ab_ecdsa_derivation_healthz", "GET", ROUTER_AB_ECDSA_DERIVATION_HEALTH_PATH, "Router A/B ECDSA derivation health probe", {
 		plane: "public",
 		rationale: "Router A/B health probes are intentionally public diagnostics."
-	}, ROUTER_API_THRESHOLD_RUNTIME_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_export", "POST", ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, "Export authorized Router A/B ECDSA derivation material", ROUTER_API_ECDSA_STRICT_LIFECYCLE_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_refresh", "POST", ROUTER_AB_ECDSA_DERIVATION_REFRESH_PATH, "Refresh Router A/B ECDSA derivation activation", ROUTER_API_ECDSA_STRICT_LIFECYCLE_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_session_activate", "POST", ROUTER_AB_ECDSA_DERIVATION_SESSION_ACTIVATION_PATH, "Activate Router A/B ECDSA normal-signing session", ROUTER_API_THRESHOLD_SESSION_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_sign_prepare", "POST", ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_PREPARE_PATH, "Prepare Router A/B ECDSA derivation normal signing", ROUTER_API_NORMAL_SIGNING_PROXY_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_sign_finalize", "POST", ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_PATH, "Finalize Router A/B ECDSA derivation normal signing", ROUTER_API_NORMAL_SIGNING_PROXY_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_presignature_pool_fill_init", "POST", ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_INIT_PATH, "Begin Router A/B ECDSA derivation presignature pool-fill session", ROUTER_API_THRESHOLD_SESSION_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_presignature_pool_fill_step", "POST", ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_STEP_PATH, "Continue Router A/B ECDSA derivation presignature pool-fill session", ROUTER_API_THRESHOLD_SESSION_SERVICES), sessionPrincipalRoute("webauthn_authenticators", "GET", "/webauthn/authenticators", "List registered WebAuthn authenticators", ROUTER_API_WEBAUTHN_AUTHENTICATOR_SERVICES), sessionPrincipalRoute("near_public_keys", "GET", "/near/public-keys", "List NEAR public keys for current session", ROUTER_API_NEAR_PUBLIC_KEY_SERVICES), publicRoute("wallet_unlock_challenge", "POST", "/wallet/unlock/challenge", "Create wallet unlock challenge", {
+	}, ROUTER_API_THRESHOLD_RUNTIME_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_export", "POST", ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, "Export authorized Router A/B ECDSA derivation material", ROUTER_API_ECDSA_STRICT_LIFECYCLE_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_refresh", "POST", ROUTER_AB_ECDSA_DERIVATION_REFRESH_PATH, "Refresh Router A/B ECDSA derivation activation", ROUTER_API_ECDSA_STRICT_LIFECYCLE_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_session_activate", "POST", ROUTER_AB_ECDSA_DERIVATION_SESSION_ACTIVATION_PATH, "Activate Router A/B ECDSA normal-signing session", ROUTER_API_THRESHOLD_SESSION_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_sign_prepare", "POST", ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_PREPARE_PATH, "Prepare Router A/B ECDSA derivation normal signing", ROUTER_API_NORMAL_SIGNING_PROXY_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_sign_finalize", "POST", ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_PATH, "Finalize Router A/B ECDSA derivation normal signing", ROUTER_API_NORMAL_SIGNING_PROXY_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_presignature_pool_fill_init", "POST", ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_INIT_PATH, "Begin Router A/B ECDSA derivation presignature pool-fill session", ROUTER_API_THRESHOLD_SESSION_SERVICES), sessionPrincipalRoute("router_ab_ecdsa_derivation_presignature_pool_fill_step", "POST", ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_FILL_STEP_PATH, "Continue Router A/B ECDSA derivation presignature pool-fill session", ROUTER_API_THRESHOLD_SESSION_SERVICES), sessionPrincipalRoute("webauthn_authenticators", "GET", "/webauthn/authenticators", "List registered WebAuthn authenticators", ROUTER_API_WEBAUTHN_AUTHENTICATOR_SERVICES), publicRoute("wallet_unlock_challenge", "POST", "/wallet/unlock/challenge", "Create wallet unlock challenge", {
 		plane: "public",
 		proof: "challenge_exchange",
 		rationale: "Wallet unlock challenge issuance is intentionally public."
@@ -10680,6 +10625,7 @@ function resolveWalletRegistrationRoute(ctx) {
 async function handleWalletRegistration(ctx) {
 	const route = resolveWalletRegistrationRoute(ctx);
 	if (!route) return null;
+	if (ctx.request.headers.get("X-Seams-Wallet-Protocol") !== "3") return jsonFailure(409, "wallet_protocol_mismatch", "Your wallet application needs an update. Reload this page and try again. If the problem continues, ask the application developer to upgrade the Wallet SDK.");
 	const common = {
 		body: await readJson(ctx.request),
 		headers: Object.fromEntries(ctx.request.headers.entries()),
@@ -10699,10 +10645,11 @@ async function handleWalletRegistration(ctx) {
 			routerAbPublicKeyset: ctx.opts.routerAbPublicKeyset,
 			session: ctx.opts.session,
 			publishableKeyAuth: ctx.opts.publishableKeyAuth,
-			walletProjection: ctx.opts.walletProjection
+			registrationContext: ctx.opts.registrationContext
 		},
 		sourceIp: resolveSourceIpFromFetchHeaders(ctx.request.headers) || void 0,
-		signingSessionSeal: ctx.opts.signingSessionSeal
+		signingSessionSeal: ctx.opts.signingSessionSeal,
+		waitUntil: ctx.runtime.kind === "background" ? ctx.runtime.waitUntil : void 0
 	};
 	let response;
 	switch (route.id) {
@@ -11748,6 +11695,7 @@ async function handleWalletRecoveryPrepare(ctx) {
 			case "refused": return toFetchRouteResponse(refusedSpend());
 			case "reserved":
 			case "consumed": return routeErrorResponse(401, "recovery_code_used", "that recovery code has already been used");
+			case "routing_unavailable": return routeErrorResponse(503, "wallet_home_unavailable", "Wallet recovery routing is temporarily unavailable");
 			case "manifest_unavailable":
 			case "registration_unavailable": return routeErrorResponse(409, "recovery_preparation_conflict", "wallet recovery could not be prepared");
 		}
@@ -12949,6 +12897,20 @@ async function handleWalletUnlockChallengeRoute(input) {
 		orgId: body.orgId,
 		ttlMs: body.ttlMs
 	});
+	if (!result.ok && result.code === "wallet_home_unavailable") return {
+		status: 503,
+		body: {
+			...result,
+			unlockBackend
+		}
+	};
+	if (!result.ok && result.code === "wallet_home_conflict") return {
+		status: 409,
+		body: {
+			...result,
+			unlockBackend
+		}
+	};
 	return {
 		status: result.ok ? 200 : result.code === "internal" ? 500 : 400,
 		body: {
@@ -13570,41 +13532,47 @@ function walletUnlockIssuanceRejectionStatus(rejection) {
 	}
 }
 //#endregion
-//#region ../shared-ts/src/utils/ecdsaServerTiming.ts
-const ECDSA_TIMING_METRICS = new Set([
-	"ecdsa_sign_authorize",
-	"ecdsa_sign_admit",
-	"ecdsa_sign_proxy",
-	"ecdsa_sign_complete",
-	"ecdsa_sign_total",
-	"ecdsa_presign_authenticate",
-	"ecdsa_presign_material",
-	"ecdsa_presign_admit",
-	"ecdsa_presign_proxy",
-	"ecdsa_presign_total",
-	"ecdsa_presign_sw_material",
-	"ecdsa_presign_sw_session",
-	"ecdsa_presign_sw_do_total",
-	"ecdsa_presign_sw_admit",
-	"ecdsa_presign_sw_total"
-]);
-function parseEcdsaServerTiming(header) {
-	const durations = /* @__PURE__ */ new Map();
-	if (!header) return durations;
-	for (const metric of header.split(",")) {
-		const [name, ...parameters] = metric.trim().split(";");
-		if (!ECDSA_TIMING_METRICS.has(name) || durations.has(name)) continue;
-		for (const parameter of parameters) {
-			const [key, rawValue] = parameter.trim().split("=");
-			if (key !== "dur" || !rawValue?.trim()) continue;
-			const duration = Number(rawValue);
-			if (Number.isFinite(duration) && duration >= 0) durations.set(name, duration);
-			break;
+//#region src/router/domains/signingOperations/signingPrepareSession.ts
+/** The session snapshot validated for this admission, before its quota claim. */
+function signingPrepareSessionResponse(signing, authorization) {
+	switch (authorization.kind) {
+		case "operation_step_up": return {
+			kind: "operation_step_up",
+			signing
+		};
+		case "wallet_session_operation_credential_v1": {
+			const { session, quota } = authorization.validated.admission.context.authorization;
+			return {
+				kind: "reusable_wallet_session",
+				signing,
+				session_status: {
+					ok: true,
+					status: "active",
+					walletSessionId: session.walletSessionId,
+					quotaId: session.quotaId,
+					remainingUses: quota.remainingUses,
+					expiresAtMs: quota.expiresAtMs,
+					quotaLifecycle: "active",
+					authorization: projectExactWalletSessionAuthorizationV1(session)
+				}
+			};
 		}
+		case "wallet_session_operation_credential_exhausted_candidate_v1": throw new Error("An exhausted Wallet Session cannot publish a fresh prepare response");
 	}
-	return durations;
 }
 //#endregion
+//#region ../shared-ts/src/utils/walletSessionFailure.ts
+const WALLET_SESSION_FAILURE_CODES = {
+	missing: "wallet_session_missing",
+	signatureInvalid: "wallet_session_signature_invalid",
+	claimsInvalid: "wallet_session_claims_invalid",
+	invalid: "wallet_session_invalid",
+	expired: "wallet_session_expired",
+	scopeMismatch: "wallet_session_scope_mismatch",
+	unavailable: "wallet_session_unavailable",
+	budgetExhausted: "wallet_budget_exhausted"
+};
+//#endregion
 //#region src/router/domains/signingOperations/routerAbNormalSigningAdmission.ts
 function routerAbOwnerOperationStepUpDecision(input) {
 	const reason = (() => {
@@ -13651,6 +13619,7 @@ async function evaluateRouterAbNormalSigningAdmission(input) {
 	};
 	if (input.curve === "ed25519") return await input.adapter.evaluatePolicy({
 		curve: "ed25519",
+		policyReadSource: input.policyReadSource,
 		authorityKind: "wallet_authority_v1",
 		authorityId: input.authorityId,
 		phase: input.phase,
@@ -14018,18 +13987,6 @@ function routerAbOperationStepUpClaimFailure(result) {
 	}
 }
 //#endregion
-//#region ../shared-ts/src/utils/walletSessionFailure.ts
-const WALLET_SESSION_FAILURE_CODES = {
-	missing: "wallet_session_missing",
-	signatureInvalid: "wallet_session_signature_invalid",
-	claimsInvalid: "wallet_session_claims_invalid",
-	invalid: "wallet_session_invalid",
-	expired: "wallet_session_expired",
-	scopeMismatch: "wallet_session_scope_mismatch",
-	unavailable: "wallet_session_unavailable",
-	budgetExhausted: "wallet_budget_exhausted"
-};
-//#endregion
 //#region src/core/ThresholdService/routerAb/internalServiceHttp.ts
 const ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1 = "x-router-ab-internal-service-auth";
 function normalizeRouterAbInternalServiceAuthSecret(input) {
@@ -14382,7 +14339,7 @@ async function buildRouterAbEd25519PrivateSigningWorkerBody(input) {
 	const scope = parseRouterAbEd25519NormalSigningScopeV2(input.body.scope);
 	const signingContext = privateSigningAuthorizationContext(scope, input.authorization);
 	const trustedSourceDigest = await privateSigningTrustedSourceDigest(input.headers);
-	const materialSource = input.materialSource ?? registrationMaterialSourceV1({
+	const materialSource = registrationMaterialSourceV1({
 		accountId: scope.account_id,
 		materialActivationId: scope.material_activation.activation_id,
 		signingWorkerId: scope.signing_worker_id
@@ -15160,78 +15117,215 @@ async function authorizeRouterAbEcdsaDerivationNormalSigningRoute(input) {
 	};
 }
 //#endregion
-//#region src/router/domains/ecdsa/thresholdEcdsaRequestValidation.ts
-const POOL_FILL_INIT_KEYS = [
-	"presignSessionId",
-	"firstMessageB64u",
-	"keyHandle",
-	"ecdsaThresholdKeyId",
-	"count",
-	"requestTag",
-	"poolFill",
-	"authorization",
-	"operation"
-];
-const POOL_FILL_STEP_KEYS = [
-	"presignSessionId",
-	"ceremonyExpiresAtMs",
-	"materialExpiresAtMs",
-	"stage",
-	"outgoingMessagesB64u",
-	"requestTag",
-	"authorization",
-	"operation"
-];
-const POOL_FILL_ENVELOPE_KEYS = [
-	"kind",
-	"scope",
-	"ceremonyExpiresAtMs",
-	"materialExpiresAtMs"
-];
-function parsePoolFillAuthorization(raw) {
-	const authorization = parseRouterAbNormalSigningAuthorization(raw.authorization);
-	switch (authorization.kind) {
-		case "reusable_wallet_session":
-			if (raw.operation !== void 0) throw new Error("Reusable Wallet Session pool fill must not carry operation");
-			return { authorization };
-		case "operation_step_up": return {
-			authorization,
-			operation: parseRouterAbEcdsaOperationStepUpPreparationV1(raw.operation)
-		};
-	}
-}
-function invalidThresholdEcdsaBody(message) {
-	return {
-		ok: false,
-		body: {
-			ok: false,
-			code: "invalid_body",
-			message
+//#region src/router/domains/signingOperations/ecdsaSigningResponse.ts
+async function finishRouterAbEcdsaSigningResponse(input) {
+	const upstream = input.upstream;
+	const upstreamBodyText = await upstream.clone().text().catch(() => "");
+	input.timing.proxy = performance.now() - input.proxyStartedAt;
+	if (isRouterAbEcdsaOperationInProgressResponse({
+		status: upstream.status,
+		bodyText: upstreamBodyText
+	})) return upstream;
+	const completionStartedAt = performance.now();
+	await completeRouterAbEcdsaOperation({
+		authorizedOperations: input.authorizedOperations,
+		operation: input.operation,
+		result: upstream.ok ? "succeeded" : upstream.status < 500 ? "failed_before_side_effect" : "failed_after_side_effect",
+		response: {
+			status: upstream.status,
+			contentType: upstream.headers.get("content-type") || "application/json",
+			bodyText: upstreamBodyText
 		}
-	};
-}
-function unexpectedThresholdEcdsaKey(record, allowedKeys) {
-	for (const key of Object.keys(record)) if (!allowedKeys.includes(key)) return key;
-	return null;
-}
-function optionalStringField$1(record, field) {
-	const value = record[field];
-	if (typeof value !== "string") return void 0;
-	return value.trim() || void 0;
-}
-function isStringValue(value) {
-	return typeof value === "string";
+	});
+	input.timing.complete = performance.now() - completionStartedAt;
+	return upstream;
 }
-function hasNonStringValue(values) {
-	return values.some((value) => !isStringValue(value));
+function isRouterAbEcdsaOperationInProgressResponse(input) {
+	return input.status === 409 && input.bodyText.includes("ReplayedLocalRequest:") && input.bodyText.includes("SigningWorker ECDSA effect is already in progress");
 }
-function parseRouterAbEcdsaDerivationPoolFillInitRouteRequest(raw) {
-	if (!isPlainObject(raw)) return invalidThresholdEcdsaBody("Expected JSON object body");
-	const unexpectedKey = unexpectedThresholdEcdsaKey(raw, POOL_FILL_INIT_KEYS);
-	if (unexpectedKey) return invalidThresholdEcdsaBody(`Unsupported threshold-ecdsa pool-fill init field: ${unexpectedKey}`);
-	if (!isPlainObject(raw.poolFill)) return invalidThresholdEcdsaBody("poolFill is required");
-	const unexpectedPoolFillKey = unexpectedThresholdEcdsaKey(raw.poolFill, POOL_FILL_ENVELOPE_KEYS);
-	if (unexpectedPoolFillKey) return invalidThresholdEcdsaBody(`Unsupported threshold-ecdsa poolFill field: ${unexpectedPoolFillKey}`);
+//#endregion
+//#region src/router/domains/signingOperations/authorizedOperationWire.ts
+function buildAuthorizedOperationWire(input, commonAuthorizedOperation) {
+	const operation = input.operation;
+	switch (input.binding.kind) {
+		case "reusable_wallet_session":
+			if (operation.authorization.kind !== "authorization_grant" || operation.quota.kind !== "consume_reusable_wallet_session") throw new Error("Reusable Wallet Session authorized operation is invalid");
+			return {
+				binding: {
+					kind: "reusable_wallet_session",
+					authorization_id: operation.authorization.authorizationGrantRef.authorizationId,
+					wallet_session_id: input.binding.walletSessionId,
+					quota_id: input.binding.quotaId
+				},
+				authorized_operation: {
+					kind: "reusable_wallet_session_authorized_operation_v1",
+					...commonAuthorizedOperation
+				}
+			};
+		case "gateway_owner_wallet_session":
+			if (operation.authorization.kind !== "authorization_grant" || operation.quota.kind !== "consume_reusable_wallet_session") throw new Error("Gateway owner Wallet Session authorized operation is invalid");
+			return {
+				binding: {
+					kind: "gateway_owner_wallet_session",
+					ownership_generation: input.binding.ownershipGeneration,
+					subject_id: input.binding.subjectId,
+					account_id: input.binding.accountId,
+					authorization_id: input.binding.authorizationId,
+					wallet_session_id: input.binding.walletSessionId,
+					quota_id: input.binding.quotaId,
+					threshold_session_id: input.binding.thresholdSessionId,
+					org_id: input.binding.orgId,
+					project_id: input.binding.projectId,
+					environment: input.binding.environment,
+					project_environment_id: input.binding.projectEnvironmentId,
+					signing_worker_id: input.binding.signingWorkerId,
+					expires_at_ms: input.binding.expiresAtMs
+				},
+				authorized_operation: {
+					kind: "reusable_wallet_session_authorized_operation_v1",
+					...commonAuthorizedOperation
+				}
+			};
+		case "operation_step_up":
+			if (operation.authorization.kind !== "verified_step_up" || operation.quota.kind !== "quota_neutral") throw new Error("Verified step-up authorized operation is invalid");
+			return {
+				binding: {
+					kind: "operation_step_up",
+					ownership_generation: input.binding.ownershipGeneration,
+					authorization_session_id: input.binding.authorizationSessionId,
+					org_id: input.binding.orgId,
+					project_id: input.binding.projectId,
+					environment: input.binding.environment,
+					project_environment_id: input.binding.projectEnvironmentId,
+					subject_id: input.binding.subjectId,
+					account_id: input.binding.accountId
+				},
+				authorized_operation: {
+					kind: "verified_step_up_authorized_operation_v1",
+					authorization_session_id: input.binding.authorizationSessionId,
+					evidence_set_digest: operation.authorization.evidenceSetDigest,
+					...commonAuthorizedOperation
+				}
+			};
+		default: return assertNeverOperationBinding(input.binding);
+	}
+}
+function assertNeverOperationBinding(_binding) {
+	throw new Error("Unsupported authorized-operation binding");
+}
+//#endregion
+//#region ../shared-ts/src/utils/ecdsaServerTiming.ts
+const ECDSA_TIMING_METRICS = new Set([
+	"wallet_gateway_binding",
+	"wallet_gateway_total",
+	"wallet_console_binding_d1",
+	"wallet_console_binding_sql",
+	"ecdsa_sign_authorize",
+	"ecdsa_sign_admit",
+	"ecdsa_sign_proxy",
+	"ecdsa_sign_complete",
+	"ecdsa_sign_total",
+	"ecdsa_presign_authenticate",
+	"ecdsa_presign_material",
+	"ecdsa_presign_admit",
+	"ecdsa_presign_proxy",
+	"ecdsa_presign_total",
+	"ecdsa_presign_sw_material",
+	"ecdsa_presign_sw_session",
+	"ecdsa_presign_sw_do_response_headers",
+	"ecdsa_presign_sw_do_response_body",
+	"ecdsa_presign_sw_admit",
+	"ecdsa_presign_sw_total"
+]);
+function parseEcdsaServerTiming(header) {
+	const durations = /* @__PURE__ */ new Map();
+	if (!header) return durations;
+	for (const metric of header.split(",")) {
+		const [name, ...parameters] = metric.trim().split(";");
+		if (!ECDSA_TIMING_METRICS.has(name) || durations.has(name)) continue;
+		for (const parameter of parameters) {
+			const [key, rawValue] = parameter.trim().split("=");
+			if (key !== "dur" || !rawValue?.trim()) continue;
+			const duration = Number(rawValue);
+			if (Number.isFinite(duration) && duration >= 0) durations.set(name, duration);
+			break;
+		}
+	}
+	return durations;
+}
+//#endregion
+//#region src/router/domains/ecdsa/thresholdEcdsaRequestValidation.ts
+const POOL_FILL_INIT_KEYS = [
+	"presignSessionId",
+	"firstMessageB64u",
+	"keyHandle",
+	"ecdsaThresholdKeyId",
+	"count",
+	"requestTag",
+	"poolFill",
+	"authorization",
+	"operation"
+];
+const POOL_FILL_STEP_KEYS = [
+	"presignSessionId",
+	"ceremonyExpiresAtMs",
+	"materialExpiresAtMs",
+	"stage",
+	"outgoingMessagesB64u",
+	"requestTag",
+	"authorization",
+	"operation"
+];
+const POOL_FILL_ENVELOPE_KEYS = [
+	"kind",
+	"scope",
+	"ceremonyExpiresAtMs",
+	"materialExpiresAtMs"
+];
+function parsePoolFillAuthorization(raw) {
+	const authorization = parseRouterAbNormalSigningAuthorization(raw.authorization);
+	switch (authorization.kind) {
+		case "reusable_wallet_session":
+			if (raw.operation !== void 0) throw new Error("Reusable Wallet Session pool fill must not carry operation");
+			return { authorization };
+		case "operation_step_up": return {
+			authorization,
+			operation: parseRouterAbEcdsaOperationStepUpPreparationV1(raw.operation)
+		};
+	}
+}
+function invalidThresholdEcdsaBody(message) {
+	return {
+		ok: false,
+		body: {
+			ok: false,
+			code: "invalid_body",
+			message
+		}
+	};
+}
+function unexpectedThresholdEcdsaKey(record, allowedKeys) {
+	for (const key of Object.keys(record)) if (!allowedKeys.includes(key)) return key;
+	return null;
+}
+function optionalStringField$1(record, field) {
+	const value = record[field];
+	if (typeof value !== "string") return void 0;
+	return value.trim() || void 0;
+}
+function isStringValue(value) {
+	return typeof value === "string";
+}
+function hasNonStringValue(values) {
+	return values.some((value) => !isStringValue(value));
+}
+function parseRouterAbEcdsaDerivationPoolFillInitRouteRequest(raw) {
+	if (!isPlainObject(raw)) return invalidThresholdEcdsaBody("Expected JSON object body");
+	const unexpectedKey = unexpectedThresholdEcdsaKey(raw, POOL_FILL_INIT_KEYS);
+	if (unexpectedKey) return invalidThresholdEcdsaBody(`Unsupported threshold-ecdsa pool-fill init field: ${unexpectedKey}`);
+	if (!isPlainObject(raw.poolFill)) return invalidThresholdEcdsaBody("poolFill is required");
+	const unexpectedPoolFillKey = unexpectedThresholdEcdsaKey(raw.poolFill, POOL_FILL_ENVELOPE_KEYS);
+	if (unexpectedPoolFillKey) return invalidThresholdEcdsaBody(`Unsupported threshold-ecdsa poolFill field: ${unexpectedPoolFillKey}`);
 	if (raw.poolFill.kind !== "router_ab_ecdsa_derivation_signing_worker_pool") return invalidThresholdEcdsaBody("poolFill.kind must be router_ab_ecdsa_derivation_signing_worker_pool");
 	const scope = parseRouterAbEcdsaDerivationNormalSigningScopeV1(raw.poolFill.scope);
 	if (!scope) return invalidThresholdEcdsaBody("poolFill.scope is invalid");
@@ -15296,6 +15390,164 @@ function parseRouterAbEcdsaDerivationPoolFillStepRouteRequest(raw) {
 	};
 }
 //#endregion
+//#region src/router/transport/fetch/routes/ecdsaOperationStepUpFactor.ts
+async function verifyEcdsaOperationStepUpFactor(input) {
+	const proof = input.proof;
+	switch (proof.kind) {
+		case "passkey": {
+			if (input.authSource.kind !== "passkey" || proof.authority.factor.credentialIdB64u !== input.authSource.credentialIdB64u) return {
+				ok: false,
+				response: json$1({
+					ok: false,
+					code: "scope_mismatch",
+					message: "Passkey authority changed"
+				}, { status: 403 })
+			};
+			const credential = proof.webauthn_authentication;
+			if (String(credential.rawId || credential.id).trim() !== input.authSource.credentialIdB64u) return {
+				ok: false,
+				response: json$1({
+					ok: false,
+					code: "unauthorized",
+					message: "Passkey credential changed"
+				}, { status: 401 })
+			};
+			const verified = await input.webAuthn.verifyWebAuthnAuthenticationLite({
+				userId: input.walletId,
+				rpId: proof.authority.verifier.rpId,
+				expectedChallenge: input.expectedChallenge,
+				expected_origin: input.requestOrigin,
+				webauthn_authentication: credential
+			});
+			if (!verified.success || !verified.verified) return {
+				ok: false,
+				response: json$1({
+					ok: false,
+					code: verified.code || "not_verified",
+					message: verified.message || "WebAuthn authentication verification failed"
+				}, { status: 401 })
+			};
+			const assertionDigest = parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(credential))));
+			const verifiedAtMs = Date.now();
+			if (input.expiresAtMs <= verifiedAtMs) return expiredStepUpFactor();
+			const factorId = parseAuthFactorId(`passkey:${input.authSource.credentialIdB64u}`);
+			if (!factorId.ok) throw new Error(factorId.error.message);
+			return {
+				ok: true,
+				factor: buildVerifiedWalletOperationPasskeyFactorResult({
+					tenantId: input.operation.tenantId,
+					principalId: input.operation.principalId,
+					walletId: input.walletId,
+					requestOrigin: input.requestOrigin,
+					audience: input.requestOrigin,
+					factorId: factorId.value,
+					authorityRef: input.authorityRef,
+					operation: input.operation,
+					credentialIdB64u: proof.authority.factor.credentialIdB64u,
+					assertionDigest,
+					verifiedAtMs,
+					expiresAtMs: input.expiresAtMs
+				}),
+				unseal: { kind: "not_requested" }
+			};
+		}
+		case "email_otp": {
+			const isExport = input.operation.operation.operationKind === "evm.export_key";
+			const emailOtpOperation = isExport ? WALLET_EMAIL_OTP_EXPORT_OPERATION : WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION;
+			const operationBinding = await hashEmailOtpOperationBinding({
+				walletId: input.walletId,
+				providerUserId: proof.authority.factor.providerUserId,
+				orgId: input.operation.tenantId,
+				operation: emailOtpOperation,
+				requestOrigin: input.requestOrigin,
+				audience: input.requestOrigin,
+				authorityRef: input.authorityRef,
+				...isExport ? {} : { operationFingerprintDigest: input.operation.digests.laneDigest }
+			});
+			const verified = await input.emailOtp.verifyEmailOtpChallenge({
+				userId: proof.authority.factor.providerUserId,
+				walletId: input.walletId,
+				orgId: input.operation.tenantId,
+				challengeId: proof.challenge_id,
+				otpCode: proof.otp_code,
+				otpChannel: EMAIL_OTP_CHANNEL,
+				ownerProofBindingDigest: operationBinding,
+				operation: emailOtpOperation
+			});
+			if (!verified.ok) return {
+				ok: false,
+				response: json$1(verified, { status: verified.code === "invalid_body" ? 400 : 401 })
+			};
+			let verifiedChallengeId = verified.challengeId;
+			if (!isExport) {
+				const orgId = parseOrgId(input.operation.tenantId);
+				const providerSubject = parseProviderSubject(proof.authority.factor.providerUserId);
+				if (!orgId.ok) throw new Error(orgId.error.message);
+				if (!providerSubject.ok) throw new Error(providerSubject.error.message);
+				const consumed = await input.emailOtp.consumeEmailOtpGrant({
+					subject: {
+						kind: "provider_identity",
+						orgId: orgId.value,
+						providerSubject: providerSubject.value,
+						walletId: input.walletId
+					},
+					loginGrant: verified.loginGrant,
+					otpChannel: EMAIL_OTP_CHANNEL
+				});
+				if (!consumed.ok) return {
+					ok: false,
+					response: json$1(consumed, { status: consumed.code === "invalid_body" ? 400 : 401 })
+				};
+				verifiedChallengeId = consumed.challengeId;
+			}
+			const verificationReceiptDigest = parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
+				challengeId: verifiedChallengeId,
+				operationFingerprint: input.expectedChallenge
+			}))));
+			const verifiedAtMs = Date.now();
+			const expiresAtMs = Math.min(input.expiresAtMs, verified.grantExpiresAtMs);
+			if (expiresAtMs <= verifiedAtMs) return expiredStepUpFactor();
+			const factorId = parseAuthFactorId(`email_otp:${proof.authority.factor.provider}:${proof.authority.factor.providerUserId}`);
+			const challengeId = parseEmailOtpChallengeId(verifiedChallengeId);
+			if (!factorId.ok) throw new Error(factorId.error.message);
+			if (!challengeId.ok) throw new Error(challengeId.error.message);
+			return {
+				ok: true,
+				factor: buildVerifiedWalletOperationEmailOtpFactorResult({
+					tenantId: input.operation.tenantId,
+					principalId: input.operation.principalId,
+					walletId: input.walletId,
+					requestOrigin: input.requestOrigin,
+					audience: input.requestOrigin,
+					factorId: factorId.value,
+					authorityRef: input.authorityRef,
+					operation: input.operation,
+					challengeId: challengeId.value,
+					verificationReceiptDigest,
+					verifiedAtMs,
+					expiresAtMs
+				}),
+				unseal: isExport ? {
+					kind: "email_otp_grant",
+					grant: verified.loginGrant,
+					challenge_id: verified.challengeId
+				} : { kind: "not_requested" }
+			};
+		}
+		default: throw new Error("Unsupported ECDSA operation step-up proof");
+	}
+}
+function expiredStepUpFactor() {
+	return {
+		ok: false,
+		response: json$1({
+			ok: false,
+			code: "verified_step_up_rejected",
+			message: "Operation step-up authorization expired"
+		}, { status: 403 })
+	};
+}
+//#endregion
 //#region ../shared-ts/src/signing-lanes/recordParsers.ts
 const WALLET_KEY_COMMON_FIELDS = [
 	"kind",
@@ -15402,6 +15654,27 @@ function walletAuthorityForAuthMethod(authMethod, authSource) {
 	};
 }
 //#endregion
+//#region src/router/cloudflare/runtime/walletObjectAddresses.ts
+const WALLET_OBJECT_IDENTITY_HEADER = "x-seams-wallet-object-identity";
+function walletObjectIdentity(wallet, generation, tenant) {
+	const parsed = parseWalletId(wallet);
+	if (!parsed.ok || typeof generation !== "number" || !Number.isSafeInteger(generation) || generation < 1) throw new Error("Wallet object identity requires a wallet and ownership generation");
+	return {
+		walletId: parsed.value,
+		ownershipGeneration: generation,
+		orgId: tenantPart(tenant.orgId),
+		projectId: tenantPart(tenant.projectId),
+		envId: tenantPart(tenant.envId)
+	};
+}
+function walletObjectIdentityHeaders(identity) {
+	return { [WALLET_OBJECT_IDENTITY_HEADER]: JSON.stringify(identity) };
+}
+function tenantPart(value) {
+	if (typeof value !== "string" || !value || value.trim() !== value) throw new Error("Wallet object tenant is invalid");
+	return value;
+}
+//#endregion
 //#region src/router/transport/fetch/routes/normalSigningRouterProxy.ts
 async function proxyNormalSigningRequestToMpcRouter(input) {
 	const proxy = input.proxy;
@@ -15412,6 +15685,14 @@ async function proxyNormalSigningRequestToMpcRouter(input) {
 	}, { status: 501 });
 	try {
 		const headers = new Headers(input.request.headers);
+		const envelope = input.body?.authorized_operation;
+		if (!isPlainObject(envelope) || !isPlainObject(envelope.binding)) throw new Error("Signing requires an admitted wallet binding");
+		const identity = walletObjectIdentity(envelope.binding.account_id, envelope.binding.ownership_generation, {
+			orgId: envelope.binding.org_id,
+			projectId: envelope.binding.project_id,
+			envId: envelope.binding.project_environment_id
+		});
+		for (const [name, value] of Object.entries(walletObjectIdentityHeaders(identity))) headers.set(name, value);
 		if (input.body && parseNormalSigningSessionAdmission(input.body)) headers.delete("authorization");
 		headers.set(ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1, normalizeRouterAbInternalServiceAuthSecret(proxy.internalServiceAuthSecret));
 		const request = input.targetPath ? new Request(new URL(input.targetPath, input.request.url), input.request) : input.request;
@@ -15453,7 +15734,7 @@ function isNormalSigningReusableBindingRecord(value) {
 }
 function isNormalSigningGatewayOwnerBindingRecord(value) {
 	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
-	return Object.keys(value).sort().join("|") === "account_id|authorization_id|environment|expires_at_ms|kind|org_id|project_environment_id|project_id|quota_id|signing_worker_id|subject_id|threshold_session_id|wallet_session_id";
+	return Object.keys(value).sort().join("|") === "account_id|authorization_id|environment|expires_at_ms|kind|org_id|ownership_generation|project_environment_id|project_id|quota_id|signing_worker_id|subject_id|threshold_session_id|wallet_session_id";
 }
 function isNormalSigningReusableReceiptRecord(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -15462,7 +15743,7 @@ function isNormalSigningReusableBindingValues(record) {
 	return typeof record.authorization_id === "string" && record.authorization_id.trim().length > 0 && typeof record.wallet_session_id === "string" && record.wallet_session_id.trim().length > 0 && typeof record.quota_id === "string" && record.quota_id.trim().length > 0;
 }
 function isNormalSigningGatewayOwnerBindingValues(record) {
-	return typeof record.subject_id === "string" && record.subject_id.trim().length > 0 && typeof record.account_id === "string" && record.account_id.trim().length > 0 && typeof record.authorization_id === "string" && record.authorization_id.trim().length > 0 && typeof record.wallet_session_id === "string" && record.wallet_session_id.trim().length > 0 && typeof record.quota_id === "string" && record.quota_id.trim().length > 0 && typeof record.threshold_session_id === "string" && record.threshold_session_id.trim().length > 0 && typeof record.org_id === "string" && record.org_id.trim().length > 0 && typeof record.project_id === "string" && record.project_id.trim().length > 0 && typeof record.environment === "string" && record.environment.trim().length > 0 && typeof record.project_environment_id === "string" && record.project_environment_id.trim().length > 0 && typeof record.signing_worker_id === "string" && record.signing_worker_id.trim().length > 0 && typeof record.expires_at_ms === "number" && Number.isSafeInteger(record.expires_at_ms) && record.expires_at_ms > 0;
+	return record.kind === "gateway_owner_wallet_session" && typeof record.ownership_generation === "number" && Number.isSafeInteger(record.ownership_generation) && record.ownership_generation > 0 && typeof record.subject_id === "string" && record.subject_id.trim().length > 0 && typeof record.account_id === "string" && record.account_id.trim().length > 0 && typeof record.authorization_id === "string" && record.authorization_id.trim().length > 0 && typeof record.wallet_session_id === "string" && record.wallet_session_id.trim().length > 0 && typeof record.quota_id === "string" && record.quota_id.trim().length > 0 && typeof record.threshold_session_id === "string" && record.threshold_session_id.trim().length > 0 && typeof record.org_id === "string" && record.org_id.trim().length > 0 && typeof record.project_id === "string" && record.project_id.trim().length > 0 && typeof record.environment === "string" && record.environment.trim().length > 0 && typeof record.project_environment_id === "string" && record.project_environment_id.trim().length > 0 && typeof record.signing_worker_id === "string" && record.signing_worker_id.trim().length > 0 && typeof record.expires_at_ms === "number" && Number.isSafeInteger(record.expires_at_ms) && record.expires_at_ms > 0;
 }
 async function proxyOwnerLaneAdmittedNormalSigningRequest(input) {
 	const expectedMaterialActivation = routerAbMpcMaterialActivationRefFromWire(input.expectedMaterialActivation);
@@ -15527,6 +15808,7 @@ async function ecdsaOperationStepUpBinding(ctx, session, operation) {
 	const pinned = await readPinnedEcdsaStepUpWalletScope(ctx, session, operation);
 	return {
 		kind: "operation_step_up",
+		ownershipGeneration: pinned.ownershipGeneration,
 		authorizationSessionId: session.sessionId,
 		orgId: scope.orgId,
 		projectId: scope.projectId,
@@ -15546,7 +15828,10 @@ async function readPinnedEcdsaStepUpWalletScope(ctx, session, operation) {
 	const scope = session.runtimePolicyScope;
 	if (pinned.orgId !== scope.orgId || pinned.projectId !== scope.projectId) throw new Error("Step-up wallet scope differs from the Wallet Session scope");
 	return {
-		...pinned,
+		orgId: pinned.orgId,
+		projectId: pinned.projectId,
+		projectEnvironmentId: pinned.projectEnvironmentId,
+		ownershipGeneration: pinned.ownershipGeneration,
 		walletId: session.walletId
 	};
 }
@@ -15554,7 +15839,7 @@ function buildRouterAbEcdsaAuthorizedOperationWire(input) {
 	const operation = input.operation;
 	const operationRef = operation.operation.operation;
 	if (operationRef.capabilityKind !== "evm_ecdsa_mpc_signing" || operationRef.operationKind !== "evm.sign_transaction") throw new Error("ECDSA authorized operation capability or operation kind is invalid");
-	const commonAuthorizedOperation = {
+	return buildAuthorizedOperationWire(input, {
 		authorized_operation_id: operation.authorizedOperationId,
 		operation_id: operation.operation.operationId,
 		capability_kind: "evm_ecdsa_mpc_signing",
@@ -15563,66 +15848,7 @@ function buildRouterAbEcdsaAuthorizedOperationWire(input) {
 		intent_digest_b64u: operation.operation.digests.intentDigest,
 		display_digest_b64u: operation.operation.digests.displayDigest,
 		operation_fingerprint_digest: operation.operationFingerprintDigest
-	};
-	switch (input.binding.kind) {
-		case "reusable_wallet_session":
-			if (operation.authorization.kind !== "authorization_grant" || operation.quota.kind !== "consume_reusable_wallet_session") throw new Error("Reusable Wallet Session authorized operation is invalid");
-			return {
-				binding: {
-					kind: "reusable_wallet_session",
-					authorization_id: operation.authorization.authorizationGrantRef.authorizationId,
-					wallet_session_id: input.binding.walletSessionId,
-					quota_id: input.binding.quotaId
-				},
-				authorized_operation: {
-					kind: "reusable_wallet_session_authorized_operation_v1",
-					...commonAuthorizedOperation
-				}
-			};
-		case "gateway_owner_wallet_session":
-			if (operation.authorization.kind !== "authorization_grant" || operation.quota.kind !== "consume_reusable_wallet_session") throw new Error("Gateway owner Wallet Session authorized operation is invalid");
-			return {
-				binding: {
-					kind: "gateway_owner_wallet_session",
-					subject_id: input.binding.subjectId,
-					account_id: input.binding.accountId,
-					authorization_id: input.binding.authorizationId,
-					wallet_session_id: input.binding.walletSessionId,
-					quota_id: input.binding.quotaId,
-					threshold_session_id: input.binding.thresholdSessionId,
-					org_id: input.binding.orgId,
-					project_id: input.binding.projectId,
-					environment: input.binding.environment,
-					project_environment_id: input.binding.projectEnvironmentId,
-					signing_worker_id: input.binding.signingWorkerId,
-					expires_at_ms: input.binding.expiresAtMs
-				},
-				authorized_operation: {
-					kind: "reusable_wallet_session_authorized_operation_v1",
-					...commonAuthorizedOperation
-				}
-			};
-		case "operation_step_up":
-			if (operation.authorization.kind !== "verified_step_up" || operation.quota.kind !== "quota_neutral") throw new Error("Verified step-up authorized operation is invalid");
-			return {
-				binding: {
-					kind: "operation_step_up",
-					authorization_session_id: input.binding.authorizationSessionId,
-					org_id: input.binding.orgId,
-					project_id: input.binding.projectId,
-					environment: input.binding.environment,
-					project_environment_id: input.binding.projectEnvironmentId,
-					subject_id: input.binding.subjectId,
-					account_id: input.binding.accountId
-				},
-				authorized_operation: {
-					kind: "verified_step_up_authorized_operation_v1",
-					authorization_session_id: input.binding.authorizationSessionId,
-					evidence_set_digest: operation.authorization.evidenceSetDigest,
-					...commonAuthorizedOperation
-				}
-			};
-	}
+	});
 }
 function decideRouterAbEcdsaOperationStepUpExecution(input) {
 	if (input.admissionKind === "replayed") return {
@@ -15777,6 +16003,7 @@ async function executeRouterAbEcdsaDerivationNormalSigningRoute(input, timing) {
 			operation: authorizedOperation,
 			binding: {
 				kind: "gateway_owner_wallet_session",
+				ownershipGeneration: pinnedOwnerScope.ownershipGeneration,
 				subjectId: String(session.principalId),
 				accountId: String(session.walletId),
 				authorizationId: String(session.authorizationId),
@@ -15823,8 +16050,18 @@ async function executeRouterAbEcdsaDerivationNormalSigningRoute(input, timing) {
 		walletRegistration: input.ctx.service.walletRegistration,
 		body: admittedBody
 	});
+	if (input.phase === "prepare" && upstream.ok) {
+		const body = signingPrepareSessionResponse(await upstream.json(), authorization);
+		timing.proxy = performance.now() - proxyStartedAt;
+		const headers = new Headers(upstream.headers);
+		headers.delete("content-length");
+		headers.delete("content-encoding");
+		return new Response(JSON.stringify(body), {
+			status: upstream.status,
+			headers
+		});
+	}
 	return finishRouterAbEcdsaSigningResponse({
-		phase: input.phase,
 		upstream,
 		operation: authorizedOperation,
 		authorizedOperations: input.ctx.service.authorizedOperations,
@@ -15832,35 +16069,6 @@ async function executeRouterAbEcdsaDerivationNormalSigningRoute(input, timing) {
 		proxyStartedAt
 	});
 }
-async function finishRouterAbEcdsaSigningResponse(input) {
-	const upstream = input.upstream;
-	if (input.phase === "prepare" && upstream.ok) {
-		input.timing.proxy = performance.now() - input.proxyStartedAt;
-		return upstream;
-	}
-	const upstreamBodyText = await upstream.clone().text().catch(() => "");
-	input.timing.proxy = performance.now() - input.proxyStartedAt;
-	if (isRouterAbEcdsaOperationInProgressResponse({
-		status: upstream.status,
-		bodyText: upstreamBodyText
-	})) return upstream;
-	const completionStartedAt = performance.now();
-	await completeRouterAbEcdsaOperation({
-		authorizedOperations: input.authorizedOperations,
-		operation: input.operation,
-		result: upstream.ok ? "succeeded" : upstream.status < 500 ? "failed_before_side_effect" : "failed_after_side_effect",
-		response: {
-			status: upstream.status,
-			contentType: upstream.headers.get("content-type") || "application/json",
-			bodyText: upstreamBodyText
-		}
-	});
-	input.timing.complete = performance.now() - completionStartedAt;
-	return upstream;
-}
-function isRouterAbEcdsaOperationInProgressResponse(input) {
-	return input.status === 409 && input.bodyText.includes("ReplayedLocalRequest:") && input.bodyText.includes("SigningWorker ECDSA effect is already in progress");
-}
 function routerAbEcdsaReplayResponse(operation) {
 	const response = routerAbEcdsaReplayHttpResponse(operation);
 	if (response) return response;
@@ -15870,31 +16078,40 @@ function routerAbEcdsaReplayResponse(operation) {
 async function resolveV2EcdsaOperationStepUpAdmission(input) {
 	const token = extractBearerCredential(input.ctx.request.headers);
 	if (!token) return { kind: "not_found" };
-	let resolution;
+	let context;
 	try {
-		resolution = await resolveWalletSessionOperationCredentialAdmission({
-			authorizationSessions: input.ctx.service.authorizationSessions,
+		context = await input.ctx.service.authorizationSessions.readWalletSessionExactOperationContextByCredential({
+			tenantId: input.ctx.service.authorizationSessions.tenantId,
 			token,
-			nowMs: Date.now(),
-			operation: {
-				keyFamily: "ecdsa_secp256k1",
-				operationKind: input.operation.operation_kind
-			}
+			nowMs: Date.now()
 		});
 	} catch {
 		return { kind: "unavailable" };
 	}
-	if (resolution.kind === "not_found") return { kind: "not_found" };
-	if (resolution.kind === "rejected") return {
+	if (!context) return {
 		kind: "rejected",
-		message: "ECDSA operation step-up Wallet Session authorization is invalid"
+		message: "ECDSA operation step-up Wallet Session is unavailable"
 	};
-	if (resolution.admission.curve !== "ecdsa") return {
+	const session = context.session;
+	const admission = resolveWalletSessionAuthorizationV2Admission({
+		authorization: session,
+		authority: context.authority,
+		authMethod: context.authMethod,
+		retiredAtMs: context.retiredAtMs,
+		nowMs: Date.now(),
+		operation: {
+			tenantId: session.tenantId,
+			principalId: session.principalId,
+			walletId: session.walletId,
+			keyFamily: "ecdsa_secp256k1",
+			operationKind: input.operation.operation_kind
+		}
+	});
+	if (!admission.ok || admission.keyFamily !== "ecdsa_secp256k1") return {
 		kind: "rejected",
-		message: "ECDSA operation step-up Wallet Session family is invalid"
+		message: "ECDSA operation step-up Wallet Session authorization is invalid"
 	};
-	const session = resolution.admission.context.authorization.session;
-	const admittedSigner = resolution.admission.admission.signer;
+	const admittedSigner = admission.signer;
 	if (input.operation.wallet_id !== String(session.walletId) || input.operation.material_activation.material_owner !== String(session.walletId) || input.operation.expires_at_ms > session.expiresAtMs || input.operation.expires_at_ms <= Date.now()) return {
 		kind: "rejected",
 		message: "ECDSA operation step-up Wallet Session scope is invalid"
@@ -15910,13 +16127,13 @@ async function resolveV2EcdsaOperationStepUpAdmission(input) {
 		kind: "rejected",
 		message: "ECDSA operation step-up material is not uniquely active"
 	};
-	if (input.operation.signing_worker_id !== input.operation.normal_signing_scope.signing_worker.server_id || !sameRouterAbMpcMaterialActivationRef(input.operation.material_activation, input.operation.normal_signing_scope.material_activation) || !sameRouterAbMpcMaterialActivationRef(input.operation.material_activation, routerAbMpcMaterialActivationRefToWire(resolution.admission.admission.materialActivation))) return {
+	if (input.operation.signing_worker_id !== input.operation.normal_signing_scope.signing_worker.server_id || !sameRouterAbMpcMaterialActivationRef(input.operation.material_activation, input.operation.normal_signing_scope.material_activation) || !sameRouterAbMpcMaterialActivationRef(input.operation.material_activation, routerAbMpcMaterialActivationRefToWire(admission.materialActivation))) return {
 		kind: "rejected",
 		message: "ECDSA operation step-up material activation is invalid"
 	};
 	const activeMaterial = {
 		ok: true,
-		materialActivation: routerAbMpcMaterialActivationRefToWire(resolution.admission.admission.materialActivation),
+		materialActivation: routerAbMpcMaterialActivationRefToWire(admission.materialActivation),
 		keyHandle: signer.walletKey.keyHandle,
 		relayerKeyId: signer.walletKey.relayerKeyId,
 		participantIds: signer.walletKey.participantIds,
@@ -15925,13 +16142,13 @@ async function resolveV2EcdsaOperationStepUpAdmission(input) {
 	if (input.operation.operation_kind === "evm.sign_transaction") return {
 		kind: "admitted",
 		operationKind: "evm.sign_transaction",
-		admission: resolution.admission,
+		context,
 		activeMaterial
 	};
 	return {
 		kind: "admitted",
 		operationKind: "evm.export_key",
-		admission: resolution.admission,
+		context,
 		activeMaterial,
 		exportTopology: {
 			signer_set: signer.walletKey.publicCapability.signer_set,
@@ -15991,8 +16208,8 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 	let v2AuthorityRef;
 	if (v2Resolution.kind === "admitted") {
 		v2AuthorityRef = await walletAuthAuthorityRef({ authority });
-		const session = v2Resolution.admission.context.authorization.session;
-		const context = v2Resolution.admission.context;
+		const session = v2Resolution.context.session;
+		const context = v2Resolution.context;
 		if (authority.walletId !== String(session.walletId) || authority.bindingId !== context.authMethod.walletAuthMethodId || context.authMethod.walletAuthorityId !== context.authority.authorityId) return json$1({
 			ok: false,
 			code: "scope_mismatch",
@@ -16020,10 +16237,10 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 		ok: true,
 		authorizedOperations: proofAuthenticated.authorizedOperations,
 		session: {
-			tenantId: v2Resolution.admission.context.authorization.session.tenantId,
-			principalId: v2Resolution.admission.context.authorization.session.principalId,
-			sessionId: String(v2Resolution.admission.context.authorization.session.authorizationId),
-			walletId: String(v2Resolution.admission.context.authorization.session.walletId),
+			tenantId: v2Resolution.context.session.tenantId,
+			principalId: v2Resolution.context.session.principalId,
+			sessionId: String(v2Resolution.context.session.authorizationId),
+			walletId: String(v2Resolution.context.session.walletId),
 			runtimePolicyScope: activeMaterial.runtimePolicyScope,
 			laneAuthorization: {
 				kind: "authority_ref",
@@ -16057,7 +16274,6 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 		}, { status: 400 });
 	}
 	const expectedChallenge = await computeRouterAbEcdsaOperationStepUpChallengeB64u(operation);
-	const nowMs = Date.now();
 	const requestId = operation.operation_id;
 	let freshMaterial;
 	if (v2Resolution.kind === "admitted") {
@@ -16070,7 +16286,7 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 			code: "wallet_session_unavailable",
 			message: "Wallet Session authorization is unavailable"
 		}, { status: 503 });
-		if (refreshedV2Resolution.kind !== "admitted" || !sameWalletSessionOperationCredentialAdmission(v2Resolution.admission, refreshedV2Resolution.admission)) return json$1({
+		if (refreshedV2Resolution.kind !== "admitted" || !walletSessionAuthorizationV2RecordsEqual(v2Resolution.context.session, refreshedV2Resolution.context.session)) return json$1({
 			ok: false,
 			code: "scope_mismatch",
 			message: "ECDSA operation step-up Wallet Session authorization changed"
@@ -16098,112 +16314,24 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 	const evidenceSetId = requireAuthorizationValue$1(parseAuthorizationEvidenceSetId(`ecdsa-step-up-evidence-set:${requestId}`));
 	const expiresAtMs = operation.expires_at_ms;
 	const requestOrigin = authenticated.requestOrigin;
-	let emailOtpUnseal;
-	let factor;
-	switch (proof.kind) {
-		case "passkey": {
-			if (authenticated.session.laneAuthorization.authSource.kind !== "passkey" || proof.authority.factor.credentialIdB64u !== authenticated.session.laneAuthorization.authSource.credentialIdB64u) return json$1({
-				ok: false,
-				code: "scope_mismatch",
-				message: "Passkey authority changed"
-			}, { status: 403 });
-			const credential = proof.webauthn_authentication;
-			if (String(credential.rawId || credential.id).trim() !== authenticated.session.laneAuthorization.authSource.credentialIdB64u) return json$1({
-				ok: false,
-				code: "unauthorized",
-				message: "Passkey credential changed"
-			}, { status: 401 });
-			const verified = await input.ctx.service.webAuthn.verifyWebAuthnAuthenticationLite({
-				userId: authenticated.session.walletId,
-				rpId: proof.authority.verifier.rpId,
-				expectedChallenge,
-				expected_origin: requestOrigin,
-				webauthn_authentication: credential
-			});
-			if (!verified.success || !verified.verified) return json$1({
-				ok: false,
-				code: verified.code || "not_verified",
-				message: verified.message || "WebAuthn authentication verification failed"
-			}, { status: 401 });
-			factor = buildVerifiedWalletOperationPasskeyFactorResult({
-				tenantId: authenticated.session.tenantId,
-				principalId: authenticated.session.principalId,
-				walletId: walletIdFromString(authenticated.session.walletId),
-				requestOrigin,
-				audience: requestOrigin,
-				factorId: requireAuthorizationValue$1(parseAuthFactorId(`passkey:${authenticated.session.laneAuthorization.authSource.credentialIdB64u}`)),
-				authorityRef: authenticated.authorityRef,
-				operation: envelope,
-				credentialIdB64u: proof.authority.factor.credentialIdB64u,
-				assertionDigest: parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(credential)))),
-				verifiedAtMs: nowMs,
-				expiresAtMs
-			});
-			break;
-		}
-		case "email_otp": {
-			const operationBinding = await hashEmailOtpOperationBinding({
-				walletId: authenticated.session.walletId,
-				providerUserId: proof.authority.factor.providerUserId,
-				orgId: authenticated.session.tenantId,
-				operation: operation.operation_kind === "evm.export_key" ? WALLET_EMAIL_OTP_EXPORT_OPERATION : WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION,
-				requestOrigin,
-				audience: requestOrigin,
-				authorityRef: authenticated.authorityRef,
-				...operation.operation_kind === "evm.sign_transaction" ? { operationFingerprintDigest: envelope.digests.laneDigest } : {}
-			});
-			const verified = await input.ctx.service.emailOtp.verifyEmailOtpChallenge({
-				userId: proof.authority.factor.providerUserId,
-				walletId: authenticated.session.walletId,
-				orgId: authenticated.session.tenantId,
-				challengeId: proof.challenge_id,
-				otpCode: proof.otp_code,
-				otpChannel: EMAIL_OTP_CHANNEL,
-				ownerProofBindingDigest: operationBinding,
-				operation: operation.operation_kind === "evm.export_key" ? WALLET_EMAIL_OTP_EXPORT_OPERATION : WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION
-			});
-			if (!verified.ok) return json$1(verified, { status: verified.code === "invalid_body" ? 400 : 401 });
-			const consumed = operation.operation_kind === "evm.export_key" ? null : await input.ctx.service.emailOtp.consumeEmailOtpGrant({
-				subject: {
-					kind: "provider_identity",
-					orgId: requireAuthorizationValue$1(parseOrgId(authenticated.session.tenantId)),
-					providerSubject: requireAuthorizationValue$1(parseProviderSubject(proof.authority.factor.providerUserId)),
-					walletId: walletIdFromString(authenticated.session.walletId)
-				},
-				loginGrant: verified.loginGrant,
-				otpChannel: EMAIL_OTP_CHANNEL
-			});
-			if (consumed && !consumed.ok) return json$1(consumed, { status: consumed.code === "invalid_body" ? 400 : 401 });
-			if (operation.operation_kind === "evm.export_key") emailOtpUnseal = {
-				grant: verified.loginGrant,
-				challengeId: verified.challengeId
-			};
-			const verifiedChallengeId = consumed?.ok ? consumed.challengeId : verified.challengeId;
-			factor = buildVerifiedWalletOperationEmailOtpFactorResult({
-				tenantId: authenticated.session.tenantId,
-				principalId: authenticated.session.principalId,
-				walletId: walletIdFromString(authenticated.session.walletId),
-				requestOrigin,
-				audience: requestOrigin,
-				factorId: requireAuthorizationValue$1(parseAuthFactorId(`email_otp:${proof.authority.factor.provider}:${proof.authority.factor.providerUserId}`)),
-				authorityRef: authenticated.authorityRef,
-				operation: envelope,
-				challengeId: requireAuthorizationValue$1(parseEmailOtpChallengeId(verifiedChallengeId)),
-				verificationReceiptDigest: parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
-					challengeId: verifiedChallengeId,
-					operationFingerprint: expectedChallenge
-				})))),
-				verifiedAtMs: nowMs,
-				expiresAtMs: Math.min(expiresAtMs, verified.grantExpiresAtMs)
-			});
-			break;
-		}
-	}
+	const verifiedFactor = await verifyEcdsaOperationStepUpFactor({
+		proof,
+		operation: envelope,
+		walletId: walletIdFromString(authenticated.session.walletId),
+		authorityRef: authenticated.authorityRef,
+		authSource: authenticated.session.laneAuthorization.authSource,
+		requestOrigin,
+		expectedChallenge,
+		expiresAtMs,
+		webAuthn: input.ctx.service.webAuthn,
+		emailOtp: input.ctx.service.emailOtp
+	});
+	if (!verifiedFactor.ok) return verifiedFactor.response;
 	const evidenceSet = await input.ctx.service.authorizedOperations.recordVerifiedWalletOperationFactorEvidenceSet({
 		operation: envelope,
 		evidenceId,
 		evidenceSetId,
-		factor
+		factor: verifiedFactor.factor
 	});
 	const authorizedOperationId = requireAuthorizationValue$1(parseAuthorizedOperationId(`ecdsa-step-up-authorized-operation:${operation.operation_id}`));
 	const atomicOperation = await input.ctx.service.authorizedOperations.admitAuthorizedOperation({
@@ -16217,7 +16345,7 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 				evidenceSetDigest: evidenceSet.evidenceSetDigest
 			},
 			quota: { kind: "quota_neutral" },
-			claimedAtMs: nowMs
+			claimedAtMs: Date.now()
 		},
 		material: {
 			walletId: walletIdFromString(authenticated.session.walletId),
@@ -16250,11 +16378,7 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 	const responseAuthorization = {
 		kind: "operation_step_up",
 		evidence_set_digest: evidenceSet.evidenceSetDigest,
-		unseal: emailOtpUnseal ? {
-			kind: "email_otp_grant",
-			grant: emailOtpUnseal.grant,
-			challenge_id: emailOtpUnseal.challengeId
-		} : { kind: "not_requested" }
+		unseal: verifiedFactor.unseal
 	};
 	if (operation.operation_kind === "evm.export_key") {
 		const exportTopology = v2Resolution.kind === "admitted" && v2Resolution.operationKind === "evm.export_key" ? v2Resolution.exportTopology : await resolveStrictEcdsaExportTopology({
@@ -16438,6 +16562,7 @@ async function authorizeEcdsaPoolFillOperationStepUp(input) {
 				materialExpiresAtMs: input.operation.expires_at_ms
 			},
 			ownerWalletScope,
+			ownershipGeneration: ownerWalletScope.ownershipGeneration,
 			routerAbEcdsaDerivationNormalSigning: {
 				kind: ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1,
 				scope: input.operation.normal_signing_scope
@@ -16517,6 +16642,7 @@ async function authorizeEcdsaPoolFill(input) {
 					thresholdExpiresAtMs: session.expiresAtMs,
 					authorization: { kind: "wallet_session" },
 					ownerWalletScope: validated.ownerWalletScope,
+					ownershipGeneration: validated.ownerWalletScope.ownershipGeneration,
 					routerAbEcdsaDerivationNormalSigning: normalSigning
 				}
 			};
@@ -16885,11 +17011,6 @@ async function admitStrictEcdsaExportOperationStepUp(input) {
 		case "wallet_session_quota_exhausted": return strictEcdsaExportFailure(409, result.kind, "Operation step-up authorization is invalid");
 	}
 }
-function sameWalletSessionOperationCredentialAdmission(left, right) {
-	const leftSession = left.context.authorization.session;
-	const rightSession = right.context.authorization.session;
-	return leftSession.tenantId === rightSession.tenantId && leftSession.principalId === rightSession.principalId && leftSession.walletId === rightSession.walletId && leftSession.authorityId === rightSession.authorityId && leftSession.walletAuthMethodId === rightSession.walletAuthMethodId && leftSession.authorityDigestB64u === rightSession.authorityDigestB64u && leftSession.authorityRevocationEpoch === rightSession.authorityRevocationEpoch && leftSession.authorizationId === rightSession.authorizationId && leftSession.walletSessionId === rightSession.walletSessionId && leftSession.quotaId === rightSession.quotaId && leftSession.expiresAtMs === rightSession.expiresAtMs && left.context.authority.authorityId === right.context.authority.authorityId && left.context.authority.authorityDigestB64u === right.context.authority.authorityDigestB64u && left.context.authMethod.walletAuthMethodId === right.context.authMethod.walletAuthMethodId && left.context.authMethod.walletAuthorityId === right.context.authMethod.walletAuthorityId && left.context.retiredAtMs === right.context.retiredAtMs && sameRouterAbMpcMaterialActivationRef(routerAbMpcMaterialActivationRefToWire(left.admission.materialActivation), routerAbMpcMaterialActivationRefToWire(right.admission.materialActivation));
-}
 async function authorizeStrictEcdsaV2ExportOperationStepUp(input) {
 	const operation = input.request.operation;
 	if (!operation) return strictEcdsaExportFailure(400, "invalid_body", "Operation step-up export requires operation preparation");
@@ -16899,8 +17020,8 @@ async function authorizeStrictEcdsaV2ExportOperationStepUp(input) {
 	});
 	if (resolution.kind === "unavailable") return strictEcdsaExportFailure(503, "wallet_session_unavailable", "Wallet Session authorization is unavailable");
 	if (resolution.kind !== "admitted") return strictEcdsaExportFailure(403, "scope_mismatch", "ECDSA export operation step-up Wallet Session authorization is invalid");
-	if (!sameWalletSessionOperationCredentialAdmission(input.authorization.v2Admission, resolution.admission)) return strictEcdsaExportFailure(403, "scope_mismatch", "ECDSA export operation step-up Wallet Session changed");
-	const session = resolution.admission.context.authorization.session;
+	if (!walletSessionAuthorizationV2RecordsEqual(input.authorization.v2Admission.context.authorization.session, resolution.context.session)) return strictEcdsaExportFailure(403, "scope_mismatch", "ECDSA export operation step-up Wallet Session changed");
+	const session = resolution.context.session;
 	const activeMaterial = resolution.activeMaterial;
 	if (input.request.authorization.kind !== "operation_step_up" || operation.operation_kind !== "evm.export_key" || operation.wallet_id !== String(session.walletId) || operation.wallet_id !== input.request.lifecycle.account_id || operation.material_activation.material_owner !== String(session.walletId) || operation.material_activation.signing_worker !== input.request.lifecycle.selected_server_id || operation.signing_worker_id !== input.request.lifecycle.selected_server_id || !sameRouterAbMpcMaterialActivationRef(operation.material_activation, input.request.material_activation) || operation.expires_at_ms < input.request.expires_at_ms || !strictEcdsaExportScopeMatchesRequest({
 		request: input.request,
@@ -17787,6 +17908,7 @@ async function handleHostedWalletSessionExchangeIssue(ctx) {
 		ok: true,
 		delivery: {
 			exchangeCode: delivery.exchangeCode,
+			home: delivery.home,
 			nonce: delivery.nonce,
 			appOrigin: delivery.appOrigin,
 			walletOrigin: delivery.walletOrigin,
@@ -18829,7 +18951,12 @@ function bootstrapError(code, message, status) {
 //#region src/router/transport/fetch/routes/syncAccount.ts
 function syncAccountResponseStatus(result) {
 	if (result.ok && result.verified) return 200;
-	switch (result.code) {
+	return syncAccountFailureStatus(result.code);
+}
+function syncAccountFailureStatus(code) {
+	switch (code) {
+		case "wallet_home_unavailable": return 503;
+		case "wallet_home_conflict": return 409;
 		case "internal": return 500;
 		case "ed25519_not_provisioned": return 409;
 		default: return 400;
@@ -18859,7 +18986,7 @@ async function handleSyncAccount(ctx) {
 		const parsed = parseSyncAccountOptionsRequest(await readJson(ctx.request));
 		if (!parsed.ok) return json$1(parsed.body, { status: parsed.status });
 		const result = await ctx.service.webAuthn.createWebAuthnSyncAccountOptions(parsed.request);
-		return json$1(result, { status: result.ok ? 200 : result.code === "internal" ? 500 : 400 });
+		return json$1(result, { status: result.ok ? 200 : syncAccountFailureStatus(result.code) });
 	}
 	if (ctx.pathname === "/sync-account/verify") {
 		const parsed = parseSyncAccountVerifyRequest({
@@ -18968,6 +19095,67 @@ async function handleSyncAccount(ctx) {
 	return null;
 }
 //#endregion
+//#region src/router/transport/fetch/routes/ed25519AuthorizedOperationRevalidation.ts
+function rejected(code, message, status) {
+	return {
+		ok: false,
+		response: json$1({
+			ok: false,
+			code,
+			message
+		}, { status })
+	};
+}
+function rejectedAdmission(kind) {
+	return kind === "authorization_grant_rejected" || kind === "verified_step_up_rejected" ? rejected(kind, "Ed25519 operation authorization is no longer active", 403) : rejected(kind, "Ed25519 operation admission failed", 409);
+}
+async function revalidateEd25519StepUpOperation(input) {
+	const stored = input.operation;
+	if (stored.authorization.kind !== "verified_step_up" || stored.quota.kind !== "quota_neutral") return rejected("verified_step_up_rejected", "Ed25519 operation step-up authorization has an invalid quota", 403);
+	const result = await input.ctx.service.authorizedOperations.admitAuthorizedOperation({ operation: {
+		tenantId: stored.tenantId,
+		authorizedOperationId: stored.authorizedOperationId,
+		auditEventId: stored.auditEventId,
+		operation: stored.operation,
+		authorization: stored.authorization,
+		quota: stored.quota,
+		claimedAtMs: Date.now()
+	} });
+	if (!("operation" in result)) return rejectedAdmission(result.kind);
+	if (result.operation.authorizedOperationId !== stored.authorizedOperationId) throw new Error("Ed25519 authorized operation changed during revalidation");
+	return {
+		ok: true,
+		operation: result.operation
+	};
+}
+/**
+* Finds the operation a reusable Wallet Session prepared and checks that its
+* grant is still active. A live operation returns the owner scope its
+* admission row pinned. A completed operation returns none: it replays its
+* stored response. The operation is read by its fingerprint, so a receipt
+* that names another operation ID has no stored operation.
+*/
+async function resolveEd25519WalletSessionOperation(input) {
+	const result = await input.ctx.service.authorizedOperations.resolveEd25519WalletSessionOperation({
+		tenantId: input.tenantId,
+		operationFingerprintDigest: input.operationFingerprintDigest,
+		walletId: input.walletId,
+		nowMs: Date.now()
+	});
+	if (result.kind === "authorized_operation_missing") return rejected("authorized_operation_missing", "Authorized operation is unavailable", 409);
+	if (!result.operation) return rejectedAdmission(result.kind);
+	const stored = result.operation;
+	if (stored.authorizedOperationId !== input.authorizedOperationId) return rejected("authorized_operation_missing", "Authorized operation is unavailable", 409);
+	if (stored.quota.kind !== "consume_reusable_wallet_session") return rejected("authorization_grant_rejected", "Ed25519 reusable operation authorization has an invalid quota", 403);
+	const operation = stored.operation.operation;
+	if (operation.capabilityKind !== "near_ed25519_mpc_signing" || operation.operationKind === "near.export_key") return rejected("authorization_grant_rejected", "Ed25519 reusable operation kind is invalid", 403);
+	return {
+		ok: true,
+		operation: stored,
+		ownerScope: result.ownerScope ?? null
+	};
+}
+//#endregion
 //#region src/router/domains/signingOperations/ed25519AuthorizedOperationReceipt.ts
 function requireEd25519OperationKind(value) {
 	if (value !== "near.sign_transaction" && value !== "near.sign_delegate_action" && value !== "near.sign_nep413_message") throw new Error("authorized_operation.operation_kind is invalid");
@@ -19366,30 +19554,22 @@ function parseRouterAbEd25519NormalSigningOperationForAdmission(input) {
 	}
 	try {
 		switch (input.authorizationKind) {
-			case "reusable_wallet_session": {
-				const receipt = parseEd25519ReusableAuthorizedOperationReceipt(input.body.authorized_operation);
-				return {
-					ok: true,
-					operation: {
-						phase: "finalize",
-						operationKind: receipt.operation_kind,
-						authorizationKind: "reusable_wallet_session",
-						receipt
-					}
-				};
-			}
-			case "operation_step_up": {
-				const receipt = parseEd25519VerifiedStepUpAuthorizedOperationReceipt(input.body.authorized_operation);
-				return {
-					ok: true,
-					operation: {
-						phase: "finalize",
-						operationKind: receipt.operation_kind,
-						authorizationKind: "operation_step_up",
-						receipt
-					}
-				};
-			}
+			case "reusable_wallet_session": return {
+				ok: true,
+				operation: {
+					phase: "finalize",
+					operationKind: parseEd25519ReusableAuthorizedOperationReceipt(input.body.authorized_operation).operation_kind,
+					authorizationKind: "reusable_wallet_session"
+				}
+			};
+			case "operation_step_up": return {
+				ok: true,
+				operation: {
+					phase: "finalize",
+					operationKind: parseEd25519VerifiedStepUpAuthorizedOperationReceipt(input.body.authorized_operation).operation_kind,
+					authorizationKind: "operation_step_up"
+				}
+			};
 		}
 	} catch (error) {
 		return {
@@ -19398,94 +19578,7 @@ function parseRouterAbEd25519NormalSigningOperationForAdmission(input) {
 		};
 	}
 }
-async function validateRouterAbEd25519V2FinalizeAuthorizedOperation(input) {
-	if (!input.authorizedOperations) return {
-		ok: false,
-		result: routerAbEd25519OwnerOperationFailureResult({
-			status: 501,
-			code: "not_configured",
-			message: "Reusable Wallet Session authorization is not configured",
-			phase: input.phase
-		})
-	};
-	let authorizedOperationId;
-	try {
-		authorizedOperationId = requireAuthorizationValue$2(parseAuthorizedOperationId(input.receipt.authorized_operation_id));
-		requireAuthorizationValue$2(parseCapabilityOperationId(input.receipt.operation_id));
-	} catch (error) {
-		return {
-			ok: false,
-			result: routerAbEd25519OwnerOperationFailureResult({
-				status: 400,
-				code: "invalid_authorized_operation",
-				message: routerAbErrorMessage(error),
-				phase: input.phase
-			})
-		};
-	}
-	let operation;
-	try {
-		operation = await input.authorizedOperations.readAuthorizedOperationById({
-			tenantId: input.authorizedOperations.tenantId,
-			authorizedOperationId
-		});
-	} catch (error) {
-		return {
-			ok: false,
-			result: routerAbEd25519OwnerOperationFailureResult({
-				status: 500,
-				code: "internal",
-				message: routerAbErrorMessage(error),
-				phase: input.phase
-			})
-		};
-	}
-	if (!operation) return {
-		ok: false,
-		result: routerAbEd25519OwnerOperationFailureResult({
-			status: 409,
-			code: "authorized_operation_missing",
-			message: "Authorized operation is unavailable",
-			phase: input.phase
-		})
-	};
-	const operationRef = operation.operation.operation;
-	if (operation.tenantId !== input.authorizedOperations.tenantId || operation.authorizedOperationId !== authorizedOperationId || operation.operation.operationId !== input.receipt.operation_id || operation.operationFingerprintDigest !== input.receipt.operation_fingerprint_digest || operation.operation.digests.laneDigest !== input.receipt.lane_digest_b64u || operation.operation.digests.intentDigest !== input.receipt.intent_digest_b64u || operation.operation.digests.displayDigest !== input.receipt.display_digest_b64u || operationRef.capabilityKind !== "near_ed25519_mpc_signing" || operationRef.operationKind !== input.receipt.operation_kind) return {
-		ok: false,
-		result: routerAbEd25519OwnerOperationFailureResult({
-			status: 400,
-			code: "invalid_authorized_operation",
-			message: "Ed25519 authorized operation does not match its receipt",
-			phase: input.phase
-		})
-	};
-	switch (operationRef.operationKind) {
-		case "near.sign_transaction":
-		case "near.sign_delegate_action":
-		case "near.sign_nep413_message": return {
-			ok: true,
-			operationKind: operationRef.operationKind
-		};
-	}
-}
 async function authorizeRouterAbEd25519WalletSessionRequest(input) {
-	if (input.operation.phase === "finalize") {
-		const exactOperation = await validateRouterAbEd25519V2FinalizeAuthorizedOperation({
-			receipt: input.operation.receipt,
-			authorizedOperations: input.authorizedOperations,
-			phase: input.phase
-		});
-		if (!exactOperation.ok) return exactOperation;
-		if (exactOperation.operationKind !== input.admission.operationKind) return {
-			ok: false,
-			result: routerAbEd25519OwnerOperationFailureResult({
-				status: 403,
-				code: "wallet_session_scope_mismatch",
-				message: "Exact Wallet Session operation does not match the authorized operation",
-				phase: input.phase
-			})
-		};
-	}
 	const expectedMaterialActivation = routerAbMpcMaterialActivationRefFromWire(input.scope.material_activation);
 	const admittedMaterialActivation = routerAbMpcMaterialActivationRefToWire(input.admission.materialActivation);
 	const expiresAtMs = Number(input.body.expires_at_ms);
@@ -19518,7 +19611,8 @@ async function authorizeRouterAbEd25519WalletSessionRequest(input) {
 	};
 	const activeMaterial = await input.resolveEd25519MaterialActivation({
 		walletId: String(input.session.walletId),
-		materialActivation: admittedMaterialActivation
+		materialActivation: admittedMaterialActivation,
+		...input.signerRead ? { signerRead: input.signerRead } : {}
 	});
 	if (!activeMaterial.ok || !sameRouterAbMpcMaterialActivationRef(activeMaterial.materialActivation, admittedMaterialActivation) || activeMaterial.signingWorkerId !== input.scope.signing_worker_id || base64UrlEncode(Uint8Array.from(activeMaterial.exportIdentity.registered_public_key)) !== input.admission.signer.registeredPublicKeyB64u) return {
 		ok: false,
@@ -19539,6 +19633,7 @@ async function authorizeRouterAbEd25519WalletSessionRequest(input) {
 	const admissionDecision = await evaluateRouterAbNormalSigningAdmission({
 		adapter: input.admissionAdapter,
 		curve: "ed25519",
+		policyReadSource: input.policyReadSource,
 		authorizationKind: "wallet_session_operation_credential_v1",
 		phase: input.phase,
 		walletId: String(input.session.walletId),
@@ -19596,13 +19691,13 @@ async function resolveRouterAbEd25519ExhaustedCandidateAuthorization(input) {
 		phase: input.phase,
 		body: input.body,
 		scope: input.scope,
-		operation: input.operation,
 		session,
 		authorityId: String(candidate.authority.authorityId),
 		admission,
-		authorizedOperations: input.authorizedOperations,
 		admissionAdapter: input.admissionAdapter,
-		resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation
+		resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation,
+		signerRead: null,
+		policyReadSource: { kind: "database" }
 	});
 	if (!authorized.ok) return authorized;
 	return {
@@ -19665,7 +19760,8 @@ async function authorizeRouterAbEd25519NormalSigningRoute(input) {
 	const validated = await validateRouterAbEd25519WalletSessionInputs({
 		headers: input.headers,
 		authorizationSessions: input.authorizationSessions,
-		operationKind: operationForAdmission.operation.operationKind
+		operationKind: operationForAdmission.operation.operationKind,
+		materialActivation: scope.material_activation
 	});
 	if (!validated.ok) {
 		const operation = operationForAdmission.operation;
@@ -19676,7 +19772,6 @@ async function authorizeRouterAbEd25519NormalSigningRoute(input) {
 				scope,
 				phase: input.phase,
 				operation,
-				authorizedOperations: input.authorizedOperations,
 				authorizationSessions: input.authorizationSessions,
 				admissionAdapter: input.admissionAdapter,
 				resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation
@@ -19714,13 +19809,16 @@ async function authorizeRouterAbEd25519NormalSigningRoute(input) {
 		phase: input.phase,
 		body: input.body,
 		scope,
-		operation,
 		session: validated.admission.context.authorization.session,
 		authorityId: String(validated.admission.context.authority.authorityId),
 		admission: validated.admission.admission,
-		authorizedOperations: input.authorizedOperations,
 		admissionAdapter: input.admissionAdapter,
-		resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation
+		resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation,
+		signerRead: validated.signerRead,
+		policyReadSource: {
+			kind: "credential_snapshot",
+			policyRead: validated.policyRead
+		}
 	});
 	if (!authorized.ok) return authorized;
 	return {
@@ -20049,11 +20147,12 @@ function ed25519ReusableWalletSessionIdentity(authorization) {
 		quotaId: session.quotaId
 	};
 }
-function buildEd25519GatewayOwnerWalletSessionBinding(authorization, projectEnvironmentId) {
+function buildEd25519GatewayOwnerWalletSessionBinding(authorization, pinned) {
 	const session = ed25519ReusableWalletSession(authorization);
 	const runtimePolicyScope = authorization.activeMaterial.runtimePolicyScope;
 	return {
 		kind: "gateway_owner_wallet_session",
+		ownershipGeneration: pinned.ownershipGeneration,
 		subjectId: String(session.principalId),
 		accountId: String(session.walletId),
 		authorizationId: String(session.authorizationId),
@@ -20063,20 +20162,16 @@ function buildEd25519GatewayOwnerWalletSessionBinding(authorization, projectEnvi
 		orgId: runtimePolicyScope.orgId,
 		projectId: runtimePolicyScope.projectId,
 		environment: runtimePolicyScope.envId,
-		projectEnvironmentId,
+		projectEnvironmentId: pinned.projectEnvironmentId,
 		signingWorkerId: authorization.activeMaterial.signingWorkerId,
 		expiresAtMs: session.expiresAtMs
 	};
 }
-async function readPinnedEd25519WalletProjectEnvironmentId(ctx, authorization, operation) {
-	const session = ed25519ReusableWalletSession(authorization);
+/** The scope the operation's own admission pinned, checked against the active material. */
+function pinnedEd25519WalletScope(authorization, pinned) {
 	const scope = authorization.activeMaterial.runtimePolicyScope;
-	const pinned = await ctx.service.authorizedOperations.readPinnedOwnerWalletScope({
-		operation,
-		walletId: session.walletId
-	});
 	if (pinned.orgId !== scope.orgId || pinned.projectId !== scope.projectId) throw new Error("Pinned owner Wallet Session scope differs from active material");
-	return pinned.projectEnvironmentId;
+	return pinned;
 }
 /**
 * The Router binding for a verified step-up: the wallet it signs for and the
@@ -20092,6 +20187,7 @@ async function ed25519OperationStepUpBinding(ctx, session, operation) {
 	if (pinned.orgId !== scope.orgId || pinned.projectId !== scope.projectId) throw new Error("Step-up wallet scope differs from the Wallet Session scope");
 	return {
 		kind: "operation_step_up",
+		ownershipGeneration: pinned.ownershipGeneration,
 		authorizationSessionId: session.sessionId,
 		orgId: scope.orgId,
 		projectId: scope.projectId,
@@ -20106,7 +20202,7 @@ function buildRouterAbEd25519AuthorizedOperationWire(input) {
 	const operationRef = operation.operation.operation;
 	if (operationRef.capabilityKind !== "near_ed25519_mpc_signing") throw new Error("Ed25519 authorized operation capability is invalid");
 	const operationKind = requireEd25519OperationKind(operationRef.operationKind);
-	const commonAuthorizedOperation = {
+	return buildAuthorizedOperationWire(input, {
 		authorized_operation_id: operation.authorizedOperationId,
 		operation_id: operation.operation.operationId,
 		capability_kind: "near_ed25519_mpc_signing",
@@ -20115,66 +20211,7 @@ function buildRouterAbEd25519AuthorizedOperationWire(input) {
 		intent_digest_b64u: operation.operation.digests.intentDigest,
 		display_digest_b64u: operation.operation.digests.displayDigest,
 		operation_fingerprint_digest: operation.operationFingerprintDigest
-	};
-	switch (input.binding.kind) {
-		case "reusable_wallet_session":
-			if (operation.authorization.kind !== "authorization_grant" || operation.quota.kind !== "consume_reusable_wallet_session") throw new Error("Reusable Wallet Session authorized operation is invalid");
-			return {
-				binding: {
-					kind: "reusable_wallet_session",
-					authorization_id: operation.authorization.authorizationGrantRef.authorizationId,
-					wallet_session_id: input.binding.walletSessionId,
-					quota_id: input.binding.quotaId
-				},
-				authorized_operation: {
-					kind: "reusable_wallet_session_authorized_operation_v1",
-					...commonAuthorizedOperation
-				}
-			};
-		case "gateway_owner_wallet_session":
-			if (operation.authorization.kind !== "authorization_grant" || operation.quota.kind !== "consume_reusable_wallet_session") throw new Error("Gateway owner Wallet Session authorized operation is invalid");
-			return {
-				binding: {
-					kind: "gateway_owner_wallet_session",
-					subject_id: input.binding.subjectId,
-					account_id: input.binding.accountId,
-					authorization_id: input.binding.authorizationId,
-					wallet_session_id: input.binding.walletSessionId,
-					quota_id: input.binding.quotaId,
-					threshold_session_id: input.binding.thresholdSessionId,
-					org_id: input.binding.orgId,
-					project_id: input.binding.projectId,
-					environment: input.binding.environment,
-					project_environment_id: input.binding.projectEnvironmentId,
-					signing_worker_id: input.binding.signingWorkerId,
-					expires_at_ms: input.binding.expiresAtMs
-				},
-				authorized_operation: {
-					kind: "reusable_wallet_session_authorized_operation_v1",
-					...commonAuthorizedOperation
-				}
-			};
-		case "operation_step_up":
-			if (operation.authorization.kind !== "verified_step_up" || operation.quota.kind !== "quota_neutral") throw new Error("Verified step-up authorized operation is invalid");
-			return {
-				binding: {
-					kind: "operation_step_up",
-					authorization_session_id: input.binding.authorizationSessionId,
-					org_id: input.binding.orgId,
-					project_id: input.binding.projectId,
-					environment: input.binding.environment,
-					project_environment_id: input.binding.projectEnvironmentId,
-					subject_id: input.binding.subjectId,
-					account_id: input.binding.accountId
-				},
-				authorized_operation: {
-					kind: "verified_step_up_authorized_operation_v1",
-					authorization_session_id: input.binding.authorizationSessionId,
-					evidence_set_digest: operation.authorization.evidenceSetDigest,
-					...commonAuthorizedOperation
-				}
-			};
-	}
+	});
 }
 async function releaseEmailOtpFactorForWorker(input) {
 	const unsealed = await input.emailOtp.removeEmailOtpServerSeal({ wrappedCiphertext: input.request.enrollment.serverSealedFactorCiphertextB64u });
@@ -20333,21 +20370,24 @@ async function authorizeEd25519ReusableWalletSessionOperation(input) {
 			}
 		});
 		const authorizedOperationId = requireAuthorizationValue(parseAuthorizedOperationId(`ed25519-operation:${operation.operationId}:${scope.request_id}`));
-		const outcome = await input.ctx.service.authorizedOperations.admitAuthorizedOperation({ operation: {
-			tenantId: identity.tenantId,
-			authorizedOperationId,
-			auditEventId: requireAuthorizationValue(parseAuthorizationAuditEventId(`ed25519-operation-audit:${operation.operationId}`)),
-			operation: envelope,
-			authorization: {
-				kind: "authorization_grant",
-				authorizationGrantRef: buildAuthorizationGrantRef(identity.authorizationId)
-			},
-			quota: {
-				kind: "consume_reusable_wallet_session",
-				quotaId: identity.quotaId
+		const outcome = await input.ctx.service.authorizedOperations.admitEd25519WalletSessionOperation({
+			operation: {
+				tenantId: identity.tenantId,
+				authorizedOperationId,
+				auditEventId: requireAuthorizationValue(parseAuthorizationAuditEventId(`ed25519-operation-audit:${operation.operationId}`)),
+				operation: envelope,
+				authorization: {
+					kind: "authorization_grant",
+					authorizationGrantRef: buildAuthorizationGrantRef(identity.authorizationId)
+				},
+				quota: {
+					kind: "consume_reusable_wallet_session",
+					quotaId: identity.quotaId
+				},
+				claimedAtMs: nowMs
 			},
-			claimedAtMs: nowMs
-		} });
+			walletId: session.walletId
+		});
 		if (outcome.kind !== "claimed" && outcome.kind !== "operation_in_progress" && outcome.kind !== "replayed") {
 			const stepUpMaterial = await input.ctx.service.walletRegistration.resolveEd25519MaterialActivation({
 				walletId: scope.account_id,
@@ -20382,125 +20422,31 @@ async function authorizeEd25519ReusableWalletSessionOperation(input) {
 			admission: {
 				kind: "claimed",
 				operation: outcome.operation,
+				ownerScope: outcome.ownerScope,
 				receipt: {
 					kind: "reusable_wallet_session_authorized_operation_v1",
 					authorized_operation_id: outcome.operation.authorizedOperationId,
 					operation_id: outcome.operation.operation.operationId,
 					capability_kind: "near_ed25519_mpc_signing",
-					operation_kind: requireEd25519OperationKind(outcome.operation.operation.operation.operationKind),
-					lane_digest_b64u: laneDigest,
-					intent_digest_b64u: intentDigest,
-					display_digest_b64u: displayDigest,
-					operation_fingerprint_digest: outcome.operation.operationFingerprintDigest
-				}
-			}
-		};
-	} catch (error) {
-		return {
-			ok: false,
-			response: json$1({
-				ok: false,
-				code: "invalid_body",
-				message: error instanceof Error ? error.message : "Ed25519 authorized operation is invalid"
-			}, { status: 400 })
-		};
-	}
-}
-async function revalidateEd25519AuthorizedOperation(input) {
-	let admission;
-	if (input.operation.authorization.kind === "verified_step_up") {
-		if (input.operation.quota.kind !== "quota_neutral") return {
-			ok: false,
-			response: json$1({
-				ok: false,
-				code: "verified_step_up_rejected",
-				message: "Ed25519 operation step-up authorization has an invalid quota"
-			}, { status: 403 })
-		};
-		admission = {
-			tenantId: input.operation.tenantId,
-			authorizedOperationId: input.operation.authorizedOperationId,
-			auditEventId: input.operation.auditEventId,
-			operation: input.operation.operation,
-			authorization: input.operation.authorization,
-			quota: input.operation.quota,
-			claimedAtMs: Date.now()
-		};
-	} else {
-		if (input.operation.quota.kind !== "consume_reusable_wallet_session") return {
-			ok: false,
-			response: json$1({
-				ok: false,
-				code: "authorization_grant_rejected",
-				message: "Ed25519 reusable operation authorization has an invalid quota"
-			}, { status: 403 })
-		};
-		const operation = buildEd25519ReusableOperationEnvelope(input.operation);
-		if (!operation) return {
-			ok: false,
-			response: json$1({
-				ok: false,
-				code: "authorization_grant_rejected",
-				message: "Ed25519 reusable operation kind is invalid"
-			}, { status: 403 })
-		};
-		admission = {
-			tenantId: input.operation.tenantId,
-			authorizedOperationId: input.operation.authorizedOperationId,
-			auditEventId: input.operation.auditEventId,
-			operation,
-			authorization: input.operation.authorization,
-			quota: input.operation.quota,
-			claimedAtMs: Date.now()
-		};
-	}
-	const result = await input.ctx.service.authorizedOperations.admitAuthorizedOperation({ operation: admission });
-	switch (result.kind) {
-		case "claimed":
-		case "operation_in_progress":
-		case "replayed":
-			if (result.operation.authorizedOperationId !== input.operation.authorizedOperationId) throw new Error("Ed25519 authorized operation changed during revalidation");
-			return {
-				ok: true,
-				operation: result.operation
-			};
-		case "authorization_grant_rejected":
-		case "verified_step_up_rejected": return {
-			ok: false,
-			response: json$1({
-				ok: false,
-				code: result.kind,
-				message: "Ed25519 operation authorization is no longer active"
-			}, { status: 403 })
+					operation_kind: requireEd25519OperationKind(outcome.operation.operation.operation.operationKind),
+					lane_digest_b64u: laneDigest,
+					intent_digest_b64u: intentDigest,
+					display_digest_b64u: displayDigest,
+					operation_fingerprint_digest: outcome.operation.operationFingerprintDigest
+				}
+			}
 		};
-		case "wallet_session_quota_exhausted":
-		case "material_mismatch": return {
+	} catch (error) {
+		return {
 			ok: false,
 			response: json$1({
 				ok: false,
-				code: result.kind,
-				message: "Ed25519 operation admission failed"
-			}, { status: 409 })
+				code: "invalid_body",
+				message: error instanceof Error ? error.message : "Ed25519 authorized operation is invalid"
+			}, { status: 400 })
 		};
 	}
 }
-function buildEd25519ReusableOperationEnvelope(operation) {
-	const operationRef = operation.operation.operation;
-	if (operationRef.capabilityKind !== "near_ed25519_mpc_signing") return null;
-	switch (operationRef.operationKind) {
-		case "near.sign_transaction":
-		case "near.sign_delegate_action":
-		case "near.sign_nep413_message": return buildCapabilityOperationEnvelope({
-			tenantId: operation.operation.tenantId,
-			principalId: operation.operation.principalId,
-			capabilityId: operation.operation.capabilityId,
-			operationId: operation.operation.operationId,
-			operation: buildNearEd25519MpcOperationRef(operationRef.operationKind),
-			digests: operation.operation.digests
-		});
-		case "near.export_key": return null;
-	}
-}
 async function validateEd25519ReusableAuthorizedOperation(input) {
 	try {
 		const receipt = parseEd25519ReusableAuthorizedOperationReceipt(input.body.authorized_operation);
@@ -20509,7 +20455,7 @@ async function validateEd25519ReusableAuthorizedOperation(input) {
 		const identity = ed25519ReusableWalletSessionIdentity(input.authorization);
 		const capabilityId = requireAuthorizationValue(parseCapabilityId(scope.material_activation.capability));
 		const operationId = requireAuthorizationValue(parseCapabilityOperationId(receipt.operation_id));
-		const fingerprint = await computeCapabilityOperationFingerprintDigest(buildCapabilityOperationEnvelope({
+		const envelope = buildCapabilityOperationEnvelope({
 			tenantId: identity.tenantId,
 			principalId: identity.principalId,
 			capabilityId,
@@ -20523,31 +20469,39 @@ async function validateEd25519ReusableAuthorizedOperation(input) {
 				intentDigest: parseDigestB64u(receipt.intent_digest_b64u),
 				displayDigest: parseDigestB64u(receipt.display_digest_b64u)
 			}
-		}));
+		});
+		const fingerprint = await computeCapabilityOperationFingerprintDigest(envelope);
 		if (fingerprint !== parseCapabilityOperationFingerprintDigest(receipt.operation_fingerprint_digest)) throw new Error("Ed25519 authorized operation fingerprint changed");
 		if (digestWireB64u((isPlainObject(input.body.prepare_binding) ? input.body.prepare_binding : null)?.intent_digest, "prepare_binding.intent_digest") !== receipt.intent_digest_b64u) throw new Error("Ed25519 authorized operation intent changed after prepare");
-		const operationResult = await input.ctx.service.authorizedOperations.readAuthorizedOperation({
-			tenantId: identity.tenantId,
-			operationFingerprintDigest: fingerprint
-		});
-		if (!operationResult) return {
-			ok: false,
-			response: json$1({
+		const authorizedOperationId = requireAuthorizationValue(parseAuthorizedOperationId(receipt.authorized_operation_id));
+		let resolved;
+		try {
+			resolved = await resolveEd25519WalletSessionOperation({
+				ctx: input.ctx,
+				tenantId: identity.tenantId,
+				authorizedOperationId,
+				operationFingerprintDigest: fingerprint,
+				walletId: ed25519ReusableWalletSession(input.authorization).walletId
+			});
+		} catch {
+			return {
 				ok: false,
-				code: "authorized_operation_missing",
-				message: "Authorized operation is unavailable"
-			}, { status: 409 })
-		};
-		if (operationResult.authorizedOperationId !== requireAuthorizationValue(parseAuthorizedOperationId(receipt.authorized_operation_id)) || operationResult.operationFingerprintDigest !== fingerprint) throw new Error("Ed25519 authorized operation identity changed after prepare");
-		const revalidated = await revalidateEd25519AuthorizedOperation({
-			ctx: input.ctx,
-			operation: operationResult
-		});
-		return revalidated.ok ? {
+				response: json$1({
+					ok: false,
+					code: "internal",
+					message: "Authorized operation lookup failed"
+				}, { status: 500 })
+			};
+		}
+		if (!resolved.ok) return resolved;
+		const operationResult = resolved.operation;
+		if (operationResult.tenantId !== identity.tenantId || operationResult.tenantId !== input.ctx.service.authorizedOperations.tenantId || operationResult.operationFingerprintDigest !== fingerprint || operationResult.operation.operationId !== operationId || operationResult.operation.digests.laneDigest !== envelope.digests.laneDigest || operationResult.operation.digests.intentDigest !== envelope.digests.intentDigest || operationResult.operation.digests.displayDigest !== envelope.digests.displayDigest || operationResult.operation.operation.capabilityKind !== "near_ed25519_mpc_signing" || operationResult.operation.operation.operationKind !== receipt.operation_kind) throw new Error("Ed25519 authorized operation identity changed after prepare");
+		return {
 			ok: true,
 			receipt,
-			operation: revalidated.operation
-		} : revalidated;
+			operation: operationResult,
+			ownerScope: resolved.ownerScope
+		};
 	} catch (error) {
 		return {
 			ok: false,
@@ -20613,7 +20567,7 @@ async function validateEd25519VerifiedStepUpAuthorizedOperation(input) {
 		};
 		if (operationResult.authorizedOperationId !== requireAuthorizationValue(parseAuthorizedOperationId(receipt.authorized_operation_id)) || operationResult.operationFingerprintDigest !== fingerprint) throw new Error("Operation step-up authorized operation identity changed after prepare");
 		if (operationResult.authorization.kind !== "verified_step_up" || operationResult.authorization.evidenceSetDigest !== parseDigestB64u(receipt.evidence_set_digest)) throw new Error("Operation step-up evidence changed after prepare");
-		const revalidated = await revalidateEd25519AuthorizedOperation({
+		const revalidated = await revalidateEd25519StepUpOperation({
 			ctx: input.ctx,
 			operation: operationResult
 		});
@@ -21076,13 +21030,15 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 					bodyText: upstreamBodyText
 				})
 			}));
-			return new Response(JSON.stringify({
+			const headers = new Headers(upstream.headers);
+			headers.delete("content-length");
+			return new Response(JSON.stringify(signingPrepareSessionResponse({
 				...upstreamBody,
 				authorized_operation: buildEd25519VerifiedStepUpAuthorizedOperationReceipt({ authorization })
-			}), {
+			}, authorization)), {
 				status: upstream.status,
 				statusText: upstream.statusText,
-				headers: new Headers(upstream.headers)
+				headers
 			});
 		}
 		if (authorization.phase !== "finalize") throw new Error("Operation step-up finalize authorization phase changed");
@@ -21156,7 +21112,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 				...input.body,
 				authorized_operation: buildRouterAbEd25519AuthorizedOperationWire({
 					operation: execution.operation,
-					binding: { ...buildEd25519GatewayOwnerWalletSessionBinding(authorization, await readPinnedEd25519WalletProjectEnvironmentId(input.ctx, authorization, execution.operation)) }
+					binding: buildEd25519GatewayOwnerWalletSessionBinding(authorization, pinnedEd25519WalletScope(authorization, authorized.admission.ownerScope))
 				})
 			}
 		});
@@ -21180,13 +21136,15 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 				bodyText: upstreamBodyText
 			})
 		}));
-		return new Response(JSON.stringify({
+		const headers = new Headers(upstream.headers);
+		headers.delete("content-length");
+		return new Response(JSON.stringify(signingPrepareSessionResponse({
 			...upstreamBody,
 			authorized_operation: authorized.admission.receipt
-		}), {
+		}, authorization)), {
 			status: upstream.status,
 			statusText: upstream.statusText,
-			headers: new Headers(upstream.headers)
+			headers
 		});
 	}
 	const validatedAuthorization = await validateEd25519ReusableAuthorizedOperation({
@@ -21197,6 +21155,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 	if (!validatedAuthorization.ok) return validatedAuthorization.response;
 	const replay = replayCompletedEd25519Operation(validatedAuthorization.operation);
 	if (replay) return replay;
+	if (!validatedAuthorization.ownerScope) throw new Error("Pinned owner Wallet Session scope is unavailable");
 	const upstream = await proxyEd25519OwnerLaneExecution({
 		ctx: input.ctx,
 		authorization,
@@ -21205,7 +21164,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 			...input.body,
 			authorized_operation: buildRouterAbEd25519AuthorizedOperationWire({
 				operation: validatedAuthorization.operation,
-				binding: { ...buildEd25519GatewayOwnerWalletSessionBinding(authorization, await readPinnedEd25519WalletProjectEnvironmentId(input.ctx, authorization, validatedAuthorization.operation)) }
+				binding: buildEd25519GatewayOwnerWalletSessionBinding(authorization, pinnedEd25519WalletScope(authorization, validatedAuthorization.ownerScope))
 			})
 		}
 	});
@@ -21337,7 +21296,7 @@ function parsePreflightRequest(raw) {
 	if (!isPlainObject(raw)) throw new Error("owner execution-lane preflight body is required");
 	const fields = Object.keys(raw).sort();
 	if (fields.length !== 2 || fields[0] !== "curve" || fields[1] !== "expectedMaterialActivation") throw new Error("owner execution-lane preflight body fields are invalid");
-	if (raw.curve !== "ed25519" && raw.curve !== "ecdsa_secp256k1") throw new Error("owner execution-lane preflight curve is invalid");
+	if (raw.curve !== "ecdsa_secp256k1") throw new Error("owner execution-lane preflight curve is invalid");
 	const materialActivation = parseMpcMaterialActivationRef(raw.expectedMaterialActivation);
 	if (!materialActivation.ok) throw new Error(materialActivation.error.message);
 	return {
@@ -21487,46 +21446,24 @@ async function handleOwnerWalletExecutionLanePreflight(ctx) {
 		}, { status: 400 });
 	}
 	const headers = Object.fromEntries(ctx.request.headers.entries());
-	let walletIdRaw;
-	let authorization;
-	if (request.curve === "ed25519") {
-		const validated = await validateRouterAbEd25519WalletSessionInputs({
-			headers,
-			authorizationSessions: ctx.service.authorizationSessions,
-			operationKind: NEAR_ED25519_MPC_OPERATION_KINDS.signTransaction
-		});
-		if (!validated.ok) return validationFailure(validated);
-		walletIdRaw = String(validated.admission.context.authorization.session.walletId);
-		authorization = {
-			kind: "wallet_auth_method",
-			walletAuthMethodId: validated.admission.context.authorization.session.walletAuthMethodId
-		};
-	} else {
-		const validated = await validateRouterAbEcdsaDerivationWalletSessionInputs({
-			materialActivation: routerAbMpcMaterialActivationRefToWire(request.expectedMaterialActivation),
-			headers,
-			authorizationSessions: ctx.service.authorizationSessions,
-			operationKind: EVM_ECDSA_MPC_OPERATION_KINDS.signTransaction
-		});
-		if (!validated.ok) return validationFailure(validated);
-		if (validated.kind === "wallet_session_operation_credential_exhausted_candidate_v1") return validationFailure(walletSessionFailure("wallet_session_unavailable"));
-		walletIdRaw = String(validated.admission.context.authorization.session.walletId);
-		authorization = {
-			kind: "wallet_auth_method",
-			walletAuthMethodId: validated.admission.context.authorization.session.walletAuthMethodId
-		};
-	}
-	const walletId = parseWalletId(walletIdRaw);
-	if (!walletId.ok) return validationFailure({
-		code: WALLET_SESSION_FAILURE_CODES.invalid,
-		message: "Wallet Session wallet identity is invalid"
+	const validated = await validateRouterAbEcdsaDerivationWalletSessionInputs({
+		materialActivation: routerAbMpcMaterialActivationRefToWire(request.expectedMaterialActivation),
+		headers,
+		authorizationSessions: ctx.service.authorizationSessions,
+		operationKind: EVM_ECDSA_MPC_OPERATION_KINDS.signTransaction
 	});
+	if (!validated.ok) return validationFailure(validated);
+	if (validated.kind === "wallet_session_operation_credential_exhausted_candidate_v1") return validationFailure(walletSessionFailure("wallet_session_unavailable"));
+	const session = validated.admission.context.authorization.session;
 	let resolved;
 	try {
 		resolved = await ctx.service.walletRegistration.resolveActiveOwnerWalletExecutionLane({
-			walletId: walletId.value,
+			walletId: session.walletId,
 			expectedMaterialActivation: request.expectedMaterialActivation,
-			authorization
+			authorization: {
+				kind: "wallet_auth_method",
+				walletAuthMethodId: session.walletAuthMethodId
+			}
 		});
 	} catch {
 		return json$1({
@@ -21652,23 +21589,15 @@ function parseOptionalPositiveInteger(raw, fieldName) {
 		value: Math.floor(value)
 	};
 }
-function parseAuthProviderAction(input) {
-	const provider = normalizeOptionalTrimmedString(input.provider);
-	const action = normalizeOptionalTrimmedString(input.action);
-	if (provider === "passkey" && action === "options") return { kind: "passkey_options" };
-	if (provider === "passkey" && action === "verify") return { kind: "passkey_verify" };
-	if (provider === "google" && action === "options") return { kind: "google_options" };
-	if (provider === "google" && action === "verify") return { kind: "google_verify" };
-	if (provider === "github" && action === "options") return { kind: "github_options" };
-	return null;
-}
 function parseAuthProviderActionPath(pathname) {
-	const parts = String(pathname || "").split("/").filter(Boolean);
-	if (parts.length !== 3 || parts[0] !== "auth") return null;
-	return parseAuthProviderAction({
-		provider: parts[1],
-		action: parts[2]
-	});
+	switch (pathname) {
+		case "/auth/passkey/options": return { kind: "passkey_options" };
+		case "/auth/passkey/verify": return { kind: "passkey_verify" };
+		case "/auth/google/options": return { kind: "google_options" };
+		case "/auth/google/verify": return { kind: "google_verify" };
+		case "/auth/github/options": return { kind: "github_options" };
+		default: return null;
+	}
 }
 function parsePasskeyLoginOptionsRequest(raw) {
 	const body = requireJsonObject(raw);
@@ -21963,6 +21892,8 @@ async function handleAuth(ctx) {
 			const parsed = parsePasskeyLoginOptionsRequest(await readJson(ctx.request));
 			if (!parsed.ok) return json$1(parsed.body, { status: parsed.status });
 			const result = await ctx.service.webAuthn.createWebAuthnLoginOptions(parsed.request);
+			if (result.code === "wallet_home_unavailable") return json$1(result, { status: 503 });
+			if (result.code === "wallet_home_conflict") return json$1(result, { status: 409 });
 			return json$1(result, { status: result.ok ? 200 : result.code === "internal" ? 500 : 400 });
 		}
 		case "passkey_verify": {
@@ -22015,28 +21946,6 @@ async function handleAuth(ctx) {
 	}
 }
 //#endregion
-//#region src/router/transport/fetch/routes/nearPublicKeys.ts
-async function handleNearPublicKeys(ctx) {
-	if (ctx.method !== "GET") return null;
-	if (ctx.pathname !== "/near/public-keys") return null;
-	try {
-		const token = extractBearerCredential(ctx.request.headers);
-		if (!token) return jsonFailure(401, "unauthorized", "No valid Wallet Session");
-		const nowMs = Date.now();
-		const exact = await ctx.service.authorizationSessions.readWalletSessionAuthorizationV2ByOperationCredential({
-			tenantId: ctx.service.authorizationSessions.tenantId,
-			token,
-			nowMs
-		});
-		if (!exact) return jsonFailure(401, "unauthorized", "No valid Wallet Session");
-		const result = await ctx.service.nearFunding.listNearPublicKeysForUser({ userId: String(exact.authorization.session.walletId) });
-		if (!result.ok) return json$1(result, { status: result.code === "not_supported" ? 501 : result.code === "invalid_args" ? 400 : 500 });
-		return json$1(result, { status: 200 });
-	} catch (e) {
-		return jsonFailure(500, "internal", e?.message || "Internal error");
-	}
-}
-//#endregion
 //#region src/router/framework/ror/normalize.ts
 function sanitizeRorOrigins(origins) {
 	const list = Array.isArray(origins) ? origins : [];
@@ -22078,77 +21987,208 @@ function normalizeWellKnownSigningSessionSealCapabilities(value) {
 		currentKeyVersion
 	};
 }
-function resolveWellKnownSigningSessionSealCapabilities(signingSessionSealOptionsRaw) {
-	if (!signingSessionSealOptionsRaw || typeof signingSessionSealOptionsRaw !== "object") return { mode: "none" };
-	return normalizeWellKnownSigningSessionSealCapabilities(signingSessionSealOptionsRaw.capabilities) || { mode: "none" };
+function resolveWellKnownSigningSessionSealCapabilities(signingSessionSealOptionsRaw) {
+	if (!signingSessionSealOptionsRaw || typeof signingSessionSealOptionsRaw !== "object") return { mode: "none" };
+	return normalizeWellKnownSigningSessionSealCapabilities(signingSessionSealOptionsRaw.capabilities) || { mode: "none" };
+}
+//#endregion
+//#region src/router/framework/ror/provider.ts
+function validateRouterApiRorOptions(ror) {
+	if (!ror || typeof ror !== "object") throw new Error("[router.ror] Invalid ROR options: expected object");
+	if (!ror.provider || typeof ror.provider.getAllowedOrigins !== "function") throw new Error("[router.ror] Invalid ROR options: provider.getAllowedOrigins is required");
+	const staticRpId = normalizeOptionalTrimmedString(ror.rpId).toLowerCase();
+	const hasStaticRpId = Boolean(staticRpId);
+	const hostMap = ror.rpIdByHost;
+	const hasHostMap = Boolean(hostMap && typeof hostMap === "object" && Object.keys(hostMap).length > 0);
+	if (hasStaticRpId === hasHostMap) throw new Error("[router.ror] Configure exactly one RP ID strategy: `rpId` or `rpIdByHost`");
+	if (hasHostMap) for (const [rawHost, rawRpId] of Object.entries(hostMap || {})) {
+		const host = normalizeRorHost(rawHost);
+		const rpId = normalizeOptionalTrimmedString(rawRpId).toLowerCase();
+		if (!host || !rpId) throw new Error("[router.ror] Invalid `rpIdByHost` entry: host and rpId must be non-empty strings");
+	}
+}
+function resolveRorRpId(input) {
+	const ror = input.ror;
+	if (!ror) return null;
+	const staticRpId = normalizeOptionalTrimmedString(ror.rpId).toLowerCase();
+	if (staticRpId) return staticRpId;
+	const hostMap = ror.rpIdByHost;
+	if (!hostMap || typeof hostMap !== "object") return null;
+	const host = normalizeRorHost(input.host);
+	if (!host) return null;
+	return normalizeOptionalTrimmedString(hostMap[host]).toLowerCase() || null;
+}
+//#endregion
+//#region src/router/transport/fetch/routes/wellKnown.ts
+async function handleWellKnown(ctx) {
+	if (ctx.method !== "GET") return null;
+	if (ctx.pathname === "/.well-known/router-ab/keyset" || ctx.pathname === `/.well-known/router-ab/keyset/` || ctx.pathname === "/router-ab/keyset" || ctx.pathname === `/router-ab/keyset/`) {
+		const keyset = ctx.opts.routerAbPublicKeyset;
+		if (!keyset) return json$1({
+			ok: false,
+			code: "router_ab_public_keyset_not_configured",
+			message: "Router A/B public keyset is not configured"
+		}, {
+			status: 404,
+			headers: { "Cache-Control": "max-age=60, stale-while-revalidate=600" }
+		});
+		return json$1(keyset, {
+			status: 200,
+			headers: { "Cache-Control": "max-age=60, stale-while-revalidate=600" }
+		});
+	}
+	if (ctx.pathname !== "/.well-known/webauthn" && ctx.pathname !== "/.well-known/webauthn/") return null;
+	let origins = [];
+	const signingSessionSeal = resolveWellKnownSigningSessionSealCapabilities(ctx.opts.signingSessionSeal);
+	try {
+		const host = normalizeRorHost(ctx.request.headers.get("x-forwarded-host") || ctx.request.headers.get("host") || ctx.url.hostname);
+		const rpId = resolveRorRpId({
+			ror: ctx.opts.ror,
+			host: host || void 0
+		});
+		origins = rpId && ctx.opts.ror ? sanitizeRorOrigins(await ctx.opts.ror.provider.getAllowedOrigins({
+			rpId,
+			...host ? { host } : {}
+		})) : [];
+	} catch {}
+	return json$1({
+		origins,
+		capabilities: { signingSessionSeal }
+	}, {
+		status: 200,
+		headers: { "Cache-Control": "max-age=60, stale-while-revalidate=600" }
+	});
+}
+//#endregion
+//#region src/router/transport/fetch/routes/deviceLinkingResponses.ts
+function projectLinkSessionStateV1(state) {
+	switch (state.state) {
+		case "displaying_qr": return { state: "displaying_qr" };
+		case "claimed":
+		case "awaiting_target_factor":
+		case "awaiting_source_contribution":
+		case "provisioning": return {
+			state: state.state,
+			deviceId: state.deviceId
+		};
+		case "authority_pending_local_install": return {
+			state: "authority_pending_local_install",
+			deviceId: state.deviceId,
+			authorityId: state.authorityId,
+			packageSetDigestB64u: state.packageSetDigestB64u
+		};
+		case "active": return {
+			state: "active",
+			deviceId: state.deviceId,
+			authorityId: state.authorityId,
+			activatedAtMs: state.activatedAtMs
+		};
+		case "failed_before_commit": return {
+			state: "failed_before_commit",
+			error: state.error
+		};
+		case "cancelled": return {
+			state: "cancelled",
+			cancelledAtMs: state.cancelledAtMs
+		};
+		case "expired": return {
+			state: "expired",
+			expiredAtMs: state.expiredAtMs
+		};
+		default: return assertNeverLinkSessionStateV1(state);
+	}
+}
+function projectSession(record) {
+	return {
+		kind: "linked_device_session_projection_v1",
+		linkSessionId: record.linkSessionId,
+		qrPayload: record.qrPayload,
+		revision: record.revision,
+		createdAtMs: record.createdAtMs,
+		updatedAtMs: record.updatedAtMs,
+		state: projectLinkSessionStateV1(record.state)
+	};
+}
+function invalidStateResponse(record) {
+	return json$1({
+		ok: false,
+		outcome: "invalid_state",
+		state: record.state.state,
+		session: projectSession(record)
+	}, { status: 409 });
+}
+function sessionProjectionResponse(record, outcome) {
+	return json$1({
+		ok: true,
+		outcome,
+		session: projectSession(record)
+	}, { status: 200 });
+}
+function targetCredentialResultResponse(record, outcome, targetCredential) {
+	return json$1({
+		ok: true,
+		outcome,
+		targetCredential,
+		session: projectSession(record)
+	}, { status: 200 });
+}
+function exportRootWriteResponse(result) {
+	return result.outcome === "conflict" ? json$1({
+		ok: false,
+		code: result.reason ?? "conflict",
+		message: "export-root relay conflict"
+	}, { status: 409 }) : json$1({
+		ok: true,
+		outcome: result.outcome
+	}, { status: 200 });
+}
+function invalidInputResponse(message) {
+	return json$1({
+		ok: false,
+		outcome: "invalid_input",
+		code: "invalid_input",
+		message
+	}, { status: 400 });
+}
+function notSupportedResponse(message = "Device linking is not configured") {
+	return json$1({
+		ok: false,
+		code: "not_supported",
+		message
+	}, { status: 501 });
 }
-//#endregion
-//#region src/router/framework/ror/provider.ts
-function validateRouterApiRorOptions(ror) {
-	if (!ror || typeof ror !== "object") throw new Error("[router.ror] Invalid ROR options: expected object");
-	if (!ror.provider || typeof ror.provider.getAllowedOrigins !== "function") throw new Error("[router.ror] Invalid ROR options: provider.getAllowedOrigins is required");
-	const staticRpId = normalizeOptionalTrimmedString(ror.rpId).toLowerCase();
-	const hasStaticRpId = Boolean(staticRpId);
-	const hostMap = ror.rpIdByHost;
-	const hasHostMap = Boolean(hostMap && typeof hostMap === "object" && Object.keys(hostMap).length > 0);
-	if (hasStaticRpId === hasHostMap) throw new Error("[router.ror] Configure exactly one RP ID strategy: `rpId` or `rpIdByHost`");
-	if (hasHostMap) for (const [rawHost, rawRpId] of Object.entries(hostMap || {})) {
-		const host = normalizeRorHost(rawHost);
-		const rpId = normalizeOptionalTrimmedString(rawRpId).toLowerCase();
-		if (!host || !rpId) throw new Error("[router.ror] Invalid `rpIdByHost` entry: host and rpId must be non-empty strings");
-	}
+function notFoundResponse() {
+	return json$1({
+		ok: false,
+		code: "not_found",
+		message: "Linked-device session not found"
+	}, { status: 404 });
 }
-function resolveRorRpId(input) {
-	const ror = input.ror;
-	if (!ror) return null;
-	const staticRpId = normalizeOptionalTrimmedString(ror.rpId).toLowerCase();
-	if (staticRpId) return staticRpId;
-	const hostMap = ror.rpIdByHost;
-	if (!hostMap || typeof hostMap !== "object") return null;
-	const host = normalizeRorHost(input.host);
-	if (!host) return null;
-	return normalizeOptionalTrimmedString(hostMap[host]).toLowerCase() || null;
+function methodNotAllowedResponse$2() {
+	return json$1({
+		ok: false,
+		code: "method_not_allowed",
+		message: "Method is not allowed"
+	}, { status: 405 });
 }
-//#endregion
-//#region src/router/transport/fetch/routes/wellKnown.ts
-async function handleWellKnown(ctx) {
-	if (ctx.method !== "GET") return null;
-	if (ctx.pathname === "/.well-known/router-ab/keyset" || ctx.pathname === `/.well-known/router-ab/keyset/` || ctx.pathname === "/router-ab/keyset" || ctx.pathname === `/router-ab/keyset/`) {
-		const keyset = ctx.opts.routerAbPublicKeyset;
-		if (!keyset) return json$1({
-			ok: false,
-			code: "router_ab_public_keyset_not_configured",
-			message: "Router A/B public keyset is not configured"
-		}, {
-			status: 404,
-			headers: { "Cache-Control": "max-age=60, stale-while-revalidate=600" }
-		});
-		return json$1(keyset, {
-			status: 200,
-			headers: { "Cache-Control": "max-age=60, stale-while-revalidate=600" }
-		});
-	}
-	if (ctx.pathname !== "/.well-known/webauthn" && ctx.pathname !== "/.well-known/webauthn/") return null;
-	let origins = [];
-	const signingSessionSeal = resolveWellKnownSigningSessionSealCapabilities(ctx.opts.signingSessionSeal);
-	try {
-		const host = normalizeRorHost(ctx.request.headers.get("x-forwarded-host") || ctx.request.headers.get("host") || ctx.url.hostname);
-		const rpId = resolveRorRpId({
-			ror: ctx.opts.ror,
-			host: host || void 0
-		});
-		origins = rpId && ctx.opts.ror ? sanitizeRorOrigins(await ctx.opts.ror.provider.getAllowedOrigins({
-			rpId,
-			...host ? { host } : {}
-		})) : [];
-	} catch {}
+function authDeniedResponse$2(result) {
+	if (result.code === "unavailable") return json$1({
+		ok: false,
+		code: result.code,
+		message: result.message
+	}, { status: 503 });
 	return json$1({
-		origins,
-		capabilities: { signingSessionSeal }
-	}, {
-		status: 200,
-		headers: { "Cache-Control": "max-age=60, stale-while-revalidate=600" }
-	});
+		ok: false,
+		outcome: "unauthorized",
+		code: result.code,
+		message: result.message
+	}, { status: result.code === "expired" ? 410 : 401 });
+}
+//#endregion
+//#region src/core/deviceLinking/linkedDeviceBootstrap.ts
+function linkedDeviceBootstrapFailure(error) {
+	if (error && typeof error === "object" && "code" in error && (error.code === "home_conflict" || error.code === "home_unavailable")) return error.code;
+	return null;
 }
 //#endregion
 //#region ../shared-ts/src/utils/exactKeys.ts
@@ -22272,6 +22312,11 @@ async function handleDeviceLinking(ctx) {
 			default: return assertNever$1(action);
 		}
 	} catch (error) {
+		const bootstrapFailure = linkedDeviceBootstrapFailure(error);
+		if (bootstrapFailure) return sessionResultResponse({
+			outcome: bootstrapFailure,
+			message: "Linked-device bootstrap authority failed"
+		});
 		if (error instanceof DeviceLinkingInputError) return invalidInputResponse(error.message);
 		return json$1({
 			ok: false,
@@ -22283,7 +22328,7 @@ async function handleDeviceLinking(ctx) {
 async function handleCreate(ctx, service, nowMs) {
 	if (ctx.method !== "POST") return methodNotAllowedResponse$2();
 	const bodyDigestB64u = await requestBodyDigest$1(ctx.request);
-	const rawBody = await readJsonBody(ctx.request);
+	const rawBody = await readJson(ctx.request);
 	const body = parseBoundary$1(() => parseCreateRequest(rawBody));
 	const keyDigest = await computeDevicePublicKeyDigestB64u(body.payload.devicePublicKeyB64u);
 	const proof = parseBoundary$1(() => parseRequestProofHeader(ctx.request));
@@ -22360,7 +22405,7 @@ async function handleApproval(ctx, service, rawLinkSessionId, nowMs) {
 		});
 		if (!session) return notFoundResponse();
 		const ownerMismatch = requireOwnerMatchesClaimedWallet(authentication.owner, session);
-		if (ownerMismatch) return ownerMismatch;
+		if (ownerMismatch) return authDeniedResponse$2(ownerMismatch);
 		if (authentication.owner.walletId !== approval.walletId) return authDeniedResponse$2({
 			kind: "denied",
 			code: "unauthorized",
@@ -22444,6 +22489,7 @@ async function handleCredential(ctx, service, rawLinkSessionId, nowMs) {
 async function handleSourceContributionPreparation(ctx, service, rawLinkSessionId, nowMs) {
 	const owner = await authenticateOwnerForSession(ctx, service, parseSessionId(rawLinkSessionId), nowMs);
 	if (owner.kind !== "authorized") return ownerSessionResponse(owner);
+	if (isLinkSessionTerminalFailureV1(owner.session.state)) return invalidStateResponse(owner.session);
 	if (ctx.method !== "GET") return methodNotAllowedResponse$2();
 	const preparation = owner.session.sourceContributionPreparation;
 	if (!preparation) return new Response(null, { status: 204 });
@@ -22494,10 +22540,6 @@ async function handleSourceContribution(ctx, service, rawLinkSessionId, nowMs) {
 	}));
 	return sessionProjectionResponse(committed.session, committed.kind === "replayed" ? "replayed" : recorded.outcome);
 }
-/**
-* A precommit failure's reason is a single token. The installer's message
-* keeps its words, joined, so the session still says what failed.
-*/
 function precommitFailureReasonV1(message) {
 	const token = message.trim().replace(/\s+/g, "_").replace(/[\u0000-\u001f\u007f]/g, "");
 	return token.length > 0 ? token : "authority_commit_failed";
@@ -22506,6 +22548,7 @@ async function handleSourceContributionExecute(ctx, service, rawLinkSessionId, n
 	if (ctx.method !== "POST") return methodNotAllowedResponse$2();
 	const owner = await authenticateOwnerForSession(ctx, service, parseSessionId(rawLinkSessionId), nowMs);
 	if (owner.kind !== "authorized") return ownerSessionResponse(owner);
+	if (isLinkSessionTerminalFailureV1(owner.session.state)) return invalidStateResponse(owner.session);
 	const router = service.sourceContributionRouter;
 	if (!router) return notSupportedResponse("Ed25519 source-preserving linking is not configured");
 	const preparation = requireEd25519SourceContributionPreparation(owner.session);
@@ -22578,8 +22621,6 @@ async function handleEmailOtpBaseFactor(ctx, service, rawLinkSessionId, nowMs) {
 	const authenticated = await authenticateOwnerForSession(ctx, service, parseSessionId(rawLinkSessionId), nowMs);
 	if (authenticated.kind !== "authorized") return ownerSessionResponse(authenticated);
 	const session = authenticated.session;
-	const ownerMismatch = requireOwnerMatchesClaimedWallet(authenticated.owner, session);
-	if (ownerMismatch) return ownerMismatch;
 	if (session.state.state !== "claimed" || session.qrPayload.targetFactor.kind !== "email_otp" || !session.claimTranscript) return invalidStateResponse(session);
 	const walletId = session.claimTranscript.value.walletId;
 	const request = parseBoundary$1(() => parseLinkedDeviceEmailOtpBaseFactorRequestV1(authenticated.body));
@@ -22607,8 +22648,6 @@ async function handleOwnerCancel(ctx, service, rawLinkSessionId, nowMs) {
 	if (authenticated.kind !== "authorized") return ownerSessionResponse(authenticated);
 	parseBoundary$1(() => parseOwnerCancelRequest(authenticated.body));
 	const session = authenticated.session;
-	const ownerMismatch = requireOwnerMatchesClaimedWallet(authenticated.owner, session);
-	if (ownerMismatch) return ownerMismatch;
 	if (session.state.state === "cancelled") return sessionProjectionResponse(session, "replayed");
 	return sessionResultResponse(await service.sessionService.cancelSessionV1({
 		linkSessionId,
@@ -22656,6 +22695,7 @@ async function handleExportRootRecipient(ctx, service, rawLinkSessionId, nowMs)
 	if (ctx.method === "GET") {
 		const owner = await authenticateOwnerForSession(ctx, service, sessionId, nowMs);
 		if (owner.kind !== "authorized") return ownerSessionResponse(owner);
+		if (isLinkSessionTerminalFailureV1(owner.session.state)) return invalidStateResponse(owner.session);
 		const transfer = await port.readTransferV1(sessionId);
 		return transfer ? json$1(transfer.recipient, { status: 200 }) : new Response(null, { status: 204 });
 	}
@@ -22663,8 +22703,14 @@ async function handleExportRootRecipient(ctx, service, rawLinkSessionId, nowMs)
 	const authenticated = await authenticateDeviceForSession(ctx, service, rawLinkSessionId, nowMs);
 	if (authenticated.kind === "denied") return authDeniedResponse$2(authenticated);
 	if (authenticated.kind === "not_found") return notFoundResponse();
+	if (isLinkSessionTerminalFailureV1(authenticated.session.state)) return invalidStateResponse(authenticated.session);
 	const recipient = parseBoundary$1(() => parseLinkedDeviceEd25519ExportRootRecipientV1(authenticated.body));
 	if (recipient.linkSessionId !== authenticated.linkSessionId) return invalidInputResponse("link session id does not match route");
+	const session = authenticated.session;
+	const preparation = await readTargetPreparation(service, session, requireApproval(session), { access: "replay_only" }, nowMs);
+	if (preparation.kind === "conflict") return invalidStateResponse(session);
+	const facts = preparation.ed25519ExportRoot;
+	if (!facts || recipient.walletId !== preparation.walletId || recipient.enrollmentId !== preparation.enrollmentId || recipient.deviceId !== preparation.deviceId || recipient.targetFactor.kind !== preparation.targetFactor.kind || recipient.walletKeyId !== facts.walletKeyId || recipient.revocationEpoch !== facts.revocationEpoch || recipient.applicationBindingDigestB64u !== facts.applicationBindingDigestB64u || recipient.registeredPublicKeyB64u !== facts.registeredPublicKeyB64u) return invalidInputResponse("export-root recipient does not match target preparation");
 	return exportRootWriteResponse(await port.registerRecipientV1({ recipient }));
 }
 async function handleExportRootPackage(ctx, service, rawLinkSessionId, nowMs) {
@@ -22675,12 +22721,14 @@ async function handleExportRootPackage(ctx, service, rawLinkSessionId, nowMs) {
 		const authenticated = await authenticateDeviceForSession(ctx, service, rawLinkSessionId, nowMs);
 		if (authenticated.kind === "denied") return authDeniedResponse$2(authenticated);
 		if (authenticated.kind === "not_found") return notFoundResponse();
+		if (isLinkSessionTerminalFailureV1(authenticated.session.state)) return invalidStateResponse(authenticated.session);
 		const transfer = await port.readTransferV1(sessionId);
 		return transfer?.state === "sealed" ? json$1(transfer.package, { status: 200 }) : new Response(null, { status: 204 });
 	}
 	if (ctx.method !== "POST") return methodNotAllowedResponse$2();
 	const owner = await authenticateOwnerForSession(ctx, service, sessionId, nowMs);
 	if (owner.kind !== "authorized") return ownerSessionResponse(owner);
+	if (isLinkSessionTerminalFailureV1(owner.session.state)) return invalidStateResponse(owner.session);
 	const submission = parseBoundary$1(() => parseLinkedDeviceEd25519ExportRootSubmissionV1(owner.body));
 	if (submission.linkSessionId !== sessionId) return invalidInputResponse("link session id does not match route");
 	return exportRootWriteResponse(await port.submitPackageV1({
@@ -22692,7 +22740,7 @@ async function handleReceipt(ctx, service, rawLinkSessionId, nowMs) {
 	if (!service.installationReceipt) return notSupportedResponse("Installation receipt is not configured");
 	if (ctx.method !== "POST") return methodNotAllowedResponse$2();
 	const linkSessionId = parseSessionId(rawLinkSessionId);
-	const rawBody = await readJsonBody(ctx.request.clone());
+	const rawBody = await readJson(ctx.request.clone());
 	if (isFinalActivationAcknowledgement(rawBody)) {
 		const acknowledgement = parseBoundary$1(() => parseLocalAuthorityActivationFinalAckV1(rawBody));
 		if (acknowledgement.linkSessionId !== linkSessionId) return invalidInputResponse("activation acknowledgement session does not match the route");
@@ -22878,6 +22926,8 @@ async function authenticateOwnerForSession(ctx, service, linkSessionId, nowMs) {
 	});
 	if (!session) return { kind: "not_found" };
 	validateOwnerRequestBinding(authentication.binding, ctx, bodyDigestB64u, nowMs);
+	const ownerMismatch = requireOwnerMatchesClaimedWallet(authentication.owner, session);
+	if (ownerMismatch) return ownerMismatch;
 	return {
 		kind: "authorized",
 		body: authentication.body,
@@ -23082,69 +23132,6 @@ async function authenticateTargetPasskeyOriginV1(ctx, routeId) {
 		expectedOrigin
 	};
 }
-function projectLinkSessionStateV1(state) {
-	switch (state.state) {
-		case "displaying_qr": return { state: "displaying_qr" };
-		case "claimed":
-		case "awaiting_target_factor":
-		case "awaiting_source_contribution":
-		case "provisioning": return {
-			state: state.state,
-			deviceId: state.deviceId
-		};
-		case "authority_pending_local_install": return {
-			state: "authority_pending_local_install",
-			deviceId: state.deviceId,
-			authorityId: state.authorityId,
-			packageSetDigestB64u: state.packageSetDigestB64u
-		};
-		case "active": return {
-			state: "active",
-			deviceId: state.deviceId,
-			authorityId: state.authorityId,
-			activatedAtMs: state.activatedAtMs
-		};
-		case "failed_before_commit": return {
-			state: "failed_before_commit",
-			error: state.error
-		};
-		case "cancelled": return {
-			state: "cancelled",
-			cancelledAtMs: state.cancelledAtMs
-		};
-		case "expired": return {
-			state: "expired",
-			expiredAtMs: state.expiredAtMs
-		};
-		default: return assertNeverLinkSessionStateV1(state);
-	}
-}
-function projectSession(record) {
-	return {
-		kind: "linked_device_session_projection_v1",
-		linkSessionId: record.linkSessionId,
-		qrPayload: record.qrPayload,
-		revision: record.revision,
-		createdAtMs: record.createdAtMs,
-		updatedAtMs: record.updatedAtMs,
-		state: projectLinkSessionStateV1(record.state)
-	};
-}
-function sessionProjectionResponse(record, outcome) {
-	return json$1({
-		ok: true,
-		outcome,
-		session: projectSession(record)
-	}, { status: 200 });
-}
-function targetCredentialResultResponse(record, outcome, targetCredential) {
-	return json$1({
-		ok: true,
-		outcome,
-		targetCredential,
-		session: projectSession(record)
-	}, { status: 200 });
-}
 function claimResultResponse(result) {
 	if (result.outcome !== "applied" && result.outcome !== "replayed") return sessionResultResponse(result);
 	const claim = result.record.claimTranscript?.value;
@@ -23173,6 +23160,16 @@ function approvalResultResponse(result) {
 }
 function sessionResultResponse(result) {
 	switch (result.outcome) {
+		case "home_conflict": return json$1({
+			ok: false,
+			code: "wallet_home_conflict",
+			message: result.message
+		}, { status: 409 });
+		case "home_unavailable": return json$1({
+			ok: false,
+			code: "wallet_home_unavailable",
+			message: result.message
+		}, { status: 503 });
 		case "applied":
 		case "replayed": return sessionProjectionResponse(result.record, result.outcome);
 		case "conflict": return json$1({
@@ -23213,49 +23210,19 @@ function sessionResultResponse(result) {
 		default: return assertNever$1(result);
 	}
 }
-function invalidStateResponse(record) {
-	return json$1({
-		ok: false,
-		outcome: "invalid_state",
-		state: record.state.state,
-		session: projectSession(record)
-	}, { status: 409 });
-}
-function exportRootWriteResponse(result) {
-	return result.outcome === "conflict" ? json$1({
-		ok: false,
-		code: result.reason ?? "conflict",
-		message: "export-root relay conflict"
-	}, { status: 409 }) : json$1({
-		ok: true,
-		outcome: result.outcome
-	}, { status: 200 });
-}
 function ownerSessionResponse(context) {
 	return context.kind === "denied" ? authDeniedResponse$2(context) : notFoundResponse();
 }
-/**
-* The one owner-to-session binding, shared by every owner route on a claimed
-* session. It runs before any state is disclosed: an authenticated owner of a
-* DIFFERENT wallet must get the same denial for every state, not a projection
-* or an invalid-state body. An unclaimed session has no wallet to bind to yet,
-* so the caller's state checks answer instead.
-*/
 function requireOwnerMatchesClaimedWallet(owner, session) {
 	const claimWalletId = session.claimTranscript?.value.walletId;
 	if (claimWalletId === void 0) return null;
 	if (owner.walletId === claimWalletId) return null;
-	return authDeniedResponse$2({
+	return {
 		kind: "denied",
 		code: "unauthorized",
 		message: "owner session does not match link wallet"
-	});
+	};
 }
-/**
-* Approval-time revalidation of the selected Email OTP base method. The same
-* eligibility question the dedicated base-factor route answers, asked once
-* more with the id the approval names, so the two paths cannot drift.
-*/
 async function requireSelectedEmailOtpBaseFactorV1(service, session, input) {
 	const provider = service.emailOtpTargetFactor;
 	if (!provider) return notSupportedResponse("Email OTP linking is not configured");
@@ -23274,43 +23241,6 @@ async function requireSelectedEmailOtpBaseFactorV1(service, session, input) {
 	});
 	return null;
 }
-function authDeniedResponse$2(result) {
-	return json$1({
-		ok: false,
-		outcome: "unauthorized",
-		code: result.code,
-		message: result.message
-	}, { status: result.code === "expired" ? 410 : 401 });
-}
-function invalidInputResponse(message) {
-	return json$1({
-		ok: false,
-		outcome: "invalid_input",
-		code: "invalid_input",
-		message
-	}, { status: 400 });
-}
-function notSupportedResponse(message = "Device linking is not configured") {
-	return json$1({
-		ok: false,
-		code: "not_supported",
-		message
-	}, { status: 501 });
-}
-function notFoundResponse() {
-	return json$1({
-		ok: false,
-		code: "not_found",
-		message: "Linked-device session not found"
-	}, { status: 404 });
-}
-function methodNotAllowedResponse$2() {
-	return json$1({
-		ok: false,
-		code: "method_not_allowed",
-		message: "Method is not allowed"
-	}, { status: 405 });
-}
 function parseCreateRequest(raw) {
 	const record = requireRecord(raw, "device-linking create request");
 	requireExactKeys$1(record, ["kind", "payload"]);
@@ -23375,9 +23305,6 @@ function parseB64uBytes(raw, field) {
 	if (bytes.length === 0 || base64UrlEncode(bytes) !== raw) throw new Error(`${field} is not canonical base64url`);
 	return bytes;
 }
-async function readJsonBody(request) {
-	return await readJson(request);
-}
 function parseBoundary$1(parse) {
 	try {
 		return parse();
@@ -23924,7 +23851,8 @@ function methodNotAllowedResponse() {
 	}, { status: 405 });
 }
 function authDeniedResponse(value) {
-	return jsonFailure(value.code === "expired" ? 401 : value.code === "invalid" ? 403 : 401, value.code, value.message);
+	if (value.code === "unavailable") return jsonFailure(503, value.code, value.message);
+	return jsonFailure(value.code === "invalid" ? 403 : 401, value.code, value.message);
 }
 //#endregion
 //#region src/threshold/session/signingSessionSeal/transport/fetch.ts
@@ -24330,7 +24258,6 @@ function createFetchRouter(service, opts, runtime) {
 		handleThresholdEcdsa,
 		handleExactWalletSigningSessionSeal,
 		handleWebAuthnAuthenticators,
-		handleNearPublicKeys,
 		handleExactWalletSessionStatus,
 		handleHostedWalletSessionExchangeIssue,
 		handleHostedWalletSessionExchangeRedeem,
@@ -24739,6 +24666,12 @@ async function routerAbEd25519YaoTenantRootWireV1(root) {
 		custody_lineage_b64u: root.custodyLineageB64u
 	};
 }
+function routerAbEd25519YaoRegistrationSigningRootIdV1(admissionRequest) {
+	return {
+		signing_root_id: admissionRequest.application_binding.signing_root_id,
+		root_share_epoch: admissionRequest.scope.root_share_epoch
+	};
+}
 //#endregion
 //#region src/router/domains/ed25519Yao/registration/routerAbEd25519YaoHttpRegistrationBackend.ts
 const INTERNAL_AUTH_HEADER = "x-router-ab-internal-service-auth";
@@ -24946,6 +24879,7 @@ function registrationRouterExecuteRequest(input, tenantRoot) {
 		participant_ids: input.admissionRequest.participant_ids,
 		target: {
 			operation: "registration",
+			ownership_generation: input.ownershipGeneration,
 			binding: input.request.binding,
 			deriver_a_input: input.request.deriver_a_input,
 			deriver_b_input: input.request.deriver_b_input
@@ -24959,6 +24893,7 @@ function recoveryRouterExecuteRequest(input, tenantRoot, attempt) {
 		participant_ids: input.admissionRequest.participant_ids,
 		target: {
 			operation: "recovery",
+			ownership_generation: input.ownershipGeneration,
 			binding: input.request.binding,
 			attempt,
 			deriver_a_input: input.request.deriver_a_input,
@@ -24971,7 +24906,7 @@ async function routerExecuteRequest(input, resolveTenantRoot) {
 	switch (input.operation) {
 		case "registration": return registrationRouterExecuteRequest(input, await routerAbEd25519YaoTenantRootWireV1(await resolveTenantRoot({
 			operation: "registration",
-			admissionRequest: input.admissionRequest
+			...routerAbEd25519YaoRegistrationSigningRootIdV1(input.admissionRequest)
 		})));
 		case "export": return {
 			tenant_root: await routerAbEd25519YaoTenantRootWireV1(await resolveTenantRoot({
@@ -24982,6 +24917,7 @@ async function routerExecuteRequest(input, resolveTenantRoot) {
 			participant_ids: input.admissionRequest.participant_ids,
 			target: {
 				operation: "export",
+				ownership_generation: input.ownershipGeneration,
 				binding: input.request.binding,
 				deriver_a_input: input.request.deriver_a_input,
 				deriver_b_input: input.request.deriver_b_input
@@ -25178,11 +25114,12 @@ var RouterAbEd25519YaoHttpRegistrationBackend = class {
 			}
 		};
 	}
-	async executeExport(request, admissionRequest, traceContext) {
+	async executeExport(request, claim, traceContext) {
 		return await this.executeRouterRequest({
 			operation: "export",
 			request,
-			admissionRequest
+			admissionRequest: claim.admissionRequest,
+			ownershipGeneration: claim.ownershipGeneration
 		}, false, traceContext);
 	}
 	keyset() {
@@ -25249,34 +25186,37 @@ var RouterAbEd25519YaoHttpRegistrationBackend = class {
 			};
 		}
 	}
-	async execute(request, admissionRequest, traceContext) {
+	async execute(request, admissionRequest, ownershipGeneration, traceContext) {
 		return await this.executeRouterRequest({
 			operation: "registration",
 			request,
-			admissionRequest
+			admissionRequest,
+			ownershipGeneration
 		}, false, traceContext);
 	}
-	async resolveRegistrationDispatchRoot(admissionRequest) {
+	async resolveRegistrationDispatchRoot(signingRootId) {
 		return await routerAbEd25519YaoTenantRootWireV1(await this.config.resolveTenantRoot({
 			operation: "registration",
-			admissionRequest
+			...signingRootId
 		}));
 	}
-	async executePinnedRegistration(request, admissionRequest, dispatchRoot, traceContext) {
+	async executePinnedRegistration(request, authority, traceContext) {
 		const routerInput = {
 			operation: "registration",
 			request,
-			admissionRequest
+			admissionRequest: authority.admissionRequest,
+			ownershipGeneration: authority.ownershipGeneration
 		};
-		return await this.sendRouterRequest(routerInput, registrationRouterExecuteRequest(routerInput, dispatchRoot), traceContext.value, "exact", false);
+		return await this.sendRouterRequest(routerInput, registrationRouterExecuteRequest(routerInput, authority.dispatchRoot), traceContext.value, "exact", false);
 	}
 	async consumeRegistration(input) {
 		let response;
 		try {
-			response = await this.post(ROUTER_REGISTRATION_CONSUME_PATH, {
-				tenant_root: input.tenantRoot,
-				wallet_id: input.walletId,
-				lifecycle_id: input.lifecycleId,
+			response = await this.post(ROUTER_REGISTRATION_CONSUME_PATH, walletObjectIdentity(input.authority.admissionReceipt.binding.lifecycle.account_id, input.authority.ownershipGeneration, input.authority.dispatchRoot.identity), {
+				tenant_root: input.authority.dispatchRoot,
+				ownership_generation: input.authority.ownershipGeneration,
+				wallet_id: input.authority.admissionReceipt.binding.lifecycle.account_id,
+				lifecycle_id: input.authority.lifecycleId,
 				session_id: Array.from(input.sessionId),
 				consumer_binding: input.consumerBinding
 			}, createRouterAbTraceContextV1().value, "exact");
@@ -25298,13 +25238,14 @@ var RouterAbEd25519YaoHttpRegistrationBackend = class {
 			admissionRequest
 		}));
 	}
-	async executeRecovery(request, admissionRequest, dispatchRoot, attempt, replay, traceContext) {
+	async executeRecovery(request, claim, traceContext) {
 		const routerInput = {
 			operation: "recovery",
 			request,
-			admissionRequest
+			admissionRequest: claim.admissionRequest,
+			ownershipGeneration: claim.ownershipGeneration
 		};
-		return await this.sendRouterRequest(routerInput, recoveryRouterExecuteRequest(routerInput, dispatchRoot, attempt), (traceContext ?? createRouterAbTraceContextV1()).value, "replay", replay);
+		return await this.sendRouterRequest(routerInput, recoveryRouterExecuteRequest(routerInput, claim.dispatchRoot, claim.attempt), (traceContext ?? createRouterAbTraceContextV1()).value, "replay", claim.replay);
 	}
 	async executeRouterRequest(request, replay, traceContext) {
 		const traceId = (traceContext ?? createRouterAbTraceContextV1()).value;
@@ -25324,7 +25265,7 @@ var RouterAbEd25519YaoHttpRegistrationBackend = class {
 		const operation = request.operation;
 		const executeStartedAt = performance.now();
 		try {
-			const response = await this.post(ROUTER_EXECUTE_PATH, routerRequest, traceId, retryAfterTransportFailure, replay);
+			const response = await this.post(ROUTER_EXECUTE_PATH, walletObjectIdentity(request.admissionRequest.application_binding.wallet_id, request.ownershipGeneration, routerRequest.tenant_root.identity), routerRequest, traceId, retryAfterTransportFailure, replay);
 			this.lastRouterServerTiming = response.ok ? response.serverTiming : null;
 			const result = response.ok ? parseRouterExecuteResult(response.body, request.request) : response;
 			emitGatewaySpan(this.config.onSpan, "gateway.yao_execute", operation, traceId, executeStartedAt, result.ok ? "success" : "failure");
@@ -25334,10 +25275,11 @@ var RouterAbEd25519YaoHttpRegistrationBackend = class {
 			return unavailableFailure(error);
 		}
 	}
-	async activateRecovery(request, dispatchRoot, traceContext) {
-		const promoted = await this.post(ROUTER_RECOVERY_PROMOTE_PATH, {
+	async activateRecovery(request, dispatchRoot, ownershipGeneration, traceContext) {
+		const promoted = await this.post(ROUTER_RECOVERY_PROMOTE_PATH, walletObjectIdentity(request.binding.lifecycle.account_id, ownershipGeneration, dispatchRoot.identity), {
 			...request,
-			tenant_root: dispatchRoot
+			tenant_root: dispatchRoot,
+			ownership_generation: ownershipGeneration
 		}, (traceContext ?? createRouterAbTraceContextV1()).value);
 		if (!promoted.ok) return promoted;
 		if (!activeReceiptMatchesRecoveryActivation(parseActiveSigningWorkerReceipt(promoted.body, request.binding.session_id, request.public_receipt.transcript), request)) return internalFailure("recovery_promotion_mismatch", "Router promotion receipt does not match the verified recovery result");
@@ -25346,10 +25288,13 @@ var RouterAbEd25519YaoHttpRegistrationBackend = class {
 			body: request
 		};
 	}
-	async post(path, body, traceId, retryAfterTransportFailure = "none", replay = false) {
+	async post(path, identity, body, traceId, retryAfterTransportFailure = "none", replay = false) {
 		const init = {
 			method: "POST",
-			headers: this.headers(traceId),
+			headers: {
+				...this.headers(traceId),
+				...walletObjectIdentityHeaders(identity)
+			},
 			body: JSON.stringify(body)
 		};
 		return await this.request(this.config.routerUrl, path, replay ? requestInitWithReplayHeader(init) : init, retryAfterTransportFailure);
@@ -25389,7 +25334,6 @@ function parseRouterServerTiming(value) {
 	const metrics = value.split(",").map((metric) => metric.trim());
 	const allowedNames = new Set([
 		"yao_router_prepare_pair",
-		"yao_router_verify_readiness",
 		"yao_router_role_execution",
 		"yao_router_signing_worker_delivery"
 	]);
@@ -25536,7 +25480,7 @@ var RouterAbEd25519YaoRegistrationRouteExtension = class {
 			body: parsed.value
 		});
 		if (!authorization.ok) return routeFailureResponse$1(authorization);
-		const result = await this.service.execute(parsed.value, traceContext.value);
+		const result = await this.service.execute(parsed.value, authorization.ownershipGeneration, traceContext.value);
 		if (!result.ok) return routeFailureResponse$1(result);
 		return json$1(result.value, { status: result.status });
 	}
@@ -25567,11 +25511,17 @@ function resolveTraceContext$1(request) {
 		message: parsed.message
 	};
 }
-function recoveryAuthorizationBinding(authorization) {
-	if (authorization.kind === "wallet_recovery") return authorization;
+function recoveryAuthorizationBinding(admitted) {
+	const authorization = admitted.authorization;
+	if (authorization.kind === "wallet_recovery") return {
+		kind: "wallet_recovery",
+		walletId: authorization.walletId,
+		ownershipGeneration: admitted.ownershipGeneration
+	};
 	const session = authorization.kind === "wallet_session_v2" ? authorization.context.authorization.session : authorization.context.status.session;
 	return {
 		kind: "wallet_session_v2",
+		ownershipGeneration: admitted.ownershipGeneration,
 		tenantId: session.tenantId,
 		principalId: session.principalId,
 		walletId: session.walletId,
@@ -25864,7 +25814,7 @@ var RouterAbEd25519YaoRecoveryRouteExtension = class {
 			body: parsed.value
 		});
 		if (!authorization.ok) return routeFailureResponse(authorization);
-		const result = await this.service.admitRecovery(parsed.value, recoveryAuthorizationBinding(authorization.authorization), traceContext.value);
+		const result = await this.service.admitRecovery(parsed.value, recoveryAuthorizationBinding(authorization), traceContext.value);
 		if (!result.ok) return routeFailureResponse(result);
 		return json$1(result.value, { status: result.status });
 	}
@@ -25881,13 +25831,16 @@ var RouterAbEd25519YaoRecoveryRouteExtension = class {
 			code: parsed.code,
 			message: parsed.message
 		}, { status: 400 });
+		const ownership = this.service.recoveryOwnershipGeneration(parsed.value.binding);
+		if (!ownership.ok) return routeFailureResponse(ownership);
 		const authorization = await this.authorization.authorize({
 			kind: "execute",
+			ownershipGeneration: ownership.value,
 			request,
 			body: parsed.value
 		});
 		if (!authorization.ok) return routeFailureResponse(authorization);
-		const result = await this.service.executeRecovery(parsed.value, recoveryAuthorizationBinding(authorization.authorization), traceContext.value);
+		const result = await this.service.executeRecovery(parsed.value, recoveryAuthorizationBinding(authorization), traceContext.value);
 		if (!result.ok) return routeFailureResponse(result);
 		return json$1(result.value, { status: result.status });
 	}
@@ -25904,13 +25857,16 @@ var RouterAbEd25519YaoRecoveryRouteExtension = class {
 			code: parsed.code,
 			message: parsed.message
 		}, { status: 400 });
+		const ownership = this.service.recoveryOwnershipGeneration(parsed.value.binding);
+		if (!ownership.ok) return routeFailureResponse(ownership);
 		const authorization = await this.authorization.authorize({
 			kind: "activate",
+			ownershipGeneration: ownership.value,
 			request,
 			body: parsed.value
 		});
 		if (!authorization.ok) return routeFailureResponse(authorization);
-		const result = await this.service.activateRecovery(parsed.value, recoveryAuthorizationBinding(authorization.authorization), traceContext.value);
+		const result = await this.service.activateRecovery(parsed.value, recoveryAuthorizationBinding(authorization), traceContext.value);
 		if (!result.ok) return routeFailureResponse(result);
 		return json$1(result.value, { status: result.status });
 	}
@@ -25938,8 +25894,8 @@ function resolveTraceContext(request) {
 var InMemoryRouterAbEd25519YaoExportStateV1 = class {
 	constructor() {
 		this.exports = /* @__PURE__ */ new Map();
-		this.authorizationNonces = /* @__PURE__ */ new Set();
-		this.authorizationUncertain = /* @__PURE__ */ new Set();
+		this.authorizationNonceOwners = /* @__PURE__ */ new Map();
+		this.authorizationUncertainOwners = /* @__PURE__ */ new Map();
 	}
 };
 const ROUTES = Object.freeze([defineRoute({
@@ -26131,7 +26087,7 @@ var RouterAbEd25519YaoExportRouteExtension = class {
 				code: authorized.code,
 				message: authorized.message
 			}, { status: authorized.status });
-			const result = await this.service.admitExport(parsed.protocol, authorized.authorizationIdentity, authorized.admission, authorized.factorRelease ?? null, traceContext.value);
+			const result = await this.service.admitExport(parsed.protocol, authorized.authorizationIdentity, authorized.ownershipGeneration, authorized.admission, authorized.factorRelease ?? null, traceContext.value);
 			return result.ok ? json$1({
 				protocol: result.value,
 				...authorized.factorRelease ? { factorRelease: authorized.factorRelease } : {}
@@ -26246,17 +26202,26 @@ var RouterAbEd25519YaoProductRegistrationRuntime = class {
 	async bindVerifiedIntent(input) {
 		return await this.input.authorization.bindVerifiedIntent(input);
 	}
+	/** The registration service of this runtime resolves the tenant root when it executes. */
+	startRegistrationDispatchRoot() {
+		return null;
+	}
 	async bindAndAdmitVerifiedRegistration(input) {
-		const bound = await this.input.authorization.bindVerifiedIntent(input);
+		const bound = await this.input.authorization.bindAndAuthorizeAdmission(input);
 		if (!bound.ok) return bound;
-		return await this.input.registrationService.admit(bound.admissionRequest);
+		const admitted = await this.input.registrationService.admit(bound.admissionRequest);
+		if (!admitted.ok) return admitted;
+		return {
+			ok: true,
+			status: 200,
+			admissionRequest: bound.admissionRequest,
+			value: admitted.value,
+			companionWrite: "not_committed"
+		};
 	}
 	async consumeActivated(request) {
 		return await this.input.registrationService.consumeActivated(request);
 	}
-	async installRegistrationFinalizeCapability(input) {
-		return await this.input.capabilityInstaller.installRegistrationFinalizeCapability(input);
-	}
 	async installPersistedActiveCapability(input) {
 		return await this.input.capabilityInstaller.installPersistedActiveCapability(input);
 	}