@seams/wallet-server 0.8.0 → 0.9.0

package/dist/esm/router/express.js

@@ -992,15 +992,25 @@ function parseTargetEmail(raw, label) {
 }
 //#endregion
 //#region ../shared-ts/src/device-linking/activeWalletSession.ts
+const walletSessionHome = wireUnion("kind", [wireObject({ kind: wireLiteral("direct") }), wireObject({
+	kind: wireLiteral("regional"),
+	region: wireLiteral("US", "WEUR", "APAC", "OC")
+})]);
+function parseWalletSessionHome(raw) {
+	return walletSessionHome(raw, "Wallet Session home");
+}
 function walletSessionOperationCredentialV1() {
 	return wireObject({
 		kind: wireLiteral("opaque_wallet_session_operation_credential_v1"),
+		ownershipGeneration: parseNonNegativeSafeInteger,
+		home: parseWalletSessionHome,
 		token: (raw, label) => {
 			if (typeof raw !== "string" || raw.length > 8192) throw new Error(`${label} is invalid`);
 			return raw;
 		},
 		walletSessionId: keyLabeled(walletSessionId)
 	}, (credential, label) => {
+		if (credential.ownershipGeneration === 0) throw new Error(`${label} ownership generation must be positive`);
 		if (!/^wst_[A-Za-z0-9_-]{43}$/.test(credential.token)) throw new Error(`${label} opaque token is invalid`);
 	});
 }
@@ -1445,11 +1455,6 @@ function requireSignerRole(value, label) {
 		default: throw new Error(`${label} must be signer_a or signer_b`);
 	}
 }
-function requireLowerHex(value, label, byteLength) {
-	const hex = coerceNonEmptyString(value, label);
-	if (!new RegExp(`^[0-9a-f]{${byteLength * 2}}$`).test(hex)) throw new Error(`${label} must be ${byteLength} lowercase-hex bytes`);
-	return hex;
-}
 function requireRouterAbX25519PublicKey(value, label) {
 	const publicKey = coerceNonEmptyString(value, label);
 	if (!/^x25519:[0-9a-f]{64}$/.test(publicKey)) throw new Error(`${label} must use x25519:<64 lowercase hex chars> encoding`);
@@ -1504,26 +1509,6 @@ function parseSignerEnvelopeHpkeRotationPublicKeySet(value, label) {
 		previous_retire_at_ms: requirePositiveInteger(record.previous_retire_at_ms, `${label}.previous_retire_at_ms`)
 	};
 }
-function parseSignerPeerVerifyingKey(value, label) {
-	const record = requireRecord(value, label);
-	requireExactKeys$5(record, ["role", "verifying_key_hex"], label);
-	return {
-		role: requireSignerRole(record.role, `${label}.role`),
-		verifying_key_hex: requireLowerHex(record.verifying_key_hex, `${label}.verifying_key_hex`, 32)
-	};
-}
-function parseSignerPeerVerifyingKeySet(value, label) {
-	const record = requireRecord(value, label);
-	requireExactKeys$5(record, ["deriver_a", "deriver_b"], label);
-	const deriverA = parseSignerPeerVerifyingKey(record.deriver_a, `${label}.deriver_a`);
-	const deriverB = parseSignerPeerVerifyingKey(record.deriver_b, `${label}.deriver_b`);
-	if (deriverA.role !== "signer_a") throw new Error(`${label}.deriver_a.role must be signer_a`);
-	if (deriverB.role !== "signer_b") throw new Error(`${label}.deriver_b.role must be signer_b`);
-	return {
-		deriver_a: deriverA,
-		deriver_b: deriverB
-	};
-}
 function parsePublicHpkeKeyDescriptor(value, label) {
 	const record = requireRecord(value, label);
 	requireExactKeys$5(record, ["key_epoch", "public_key"], label);
@@ -1537,7 +1522,6 @@ function parseRouterAbPublicKeysetV2(value) {
 	requireExactKeys$5(record, [
 		"keyset_version",
 		"signer_envelope_hpke",
-		"signer_peer_verifying_keys",
 		"signing_worker_server_output_hpke"
 	], "Router A/B public keyset");
 	const keysetVersion = coerceNonEmptyString(record.keyset_version, "keyset_version");
@@ -1545,7 +1529,6 @@ function parseRouterAbPublicKeysetV2(value) {
 	return {
 		keyset_version: ROUTER_AB_PUBLIC_KEYSET_VERSION_V2,
 		signer_envelope_hpke: parseSignerEnvelopeHpkeRotationPublicKeySet(record.signer_envelope_hpke, "signer_envelope_hpke"),
-		signer_peer_verifying_keys: parseSignerPeerVerifyingKeySet(record.signer_peer_verifying_keys, "signer_peer_verifying_keys"),
 		signing_worker_server_output_hpke: parsePublicHpkeKeyDescriptor(record.signing_worker_server_output_hpke, "signing_worker_server_output_hpke")
 	};
 }
@@ -5335,6 +5318,7 @@ const CORS_ALLOW_HEADERS = [
 	"Content-Type",
 	WALLET_MANAGEMENT_PROTOCOL_HEADER,
 	"Authorization",
+	"X-Seams-Wallet-Region",
 	"X-Seams-Benchmark-Diagnostics",
 	LINKED_DEVICE_REQUEST_PROOF_HEADER_V1,
 	ROUTER_AB_ED25519_YAO_RECOVERY_CHALLENGE_ID_HEADER_V1,
@@ -5387,7 +5371,7 @@ function withCors(headers, opts, request) {
 	headers.set("Access-Control-Allow-Methods", CORS_ALLOW_METHODS);
 	headers.set("Access-Control-Allow-Headers", CORS_ALLOW_HEADERS);
 	if (allowedOrigin && request?.method === "OPTIONS") headers.set("Access-Control-Max-Age", String(CORS_PREFLIGHT_MAX_AGE_SECONDS));
-	if (headers.has("Server-Timing")) headers.set("Access-Control-Expose-Headers", "Server-Timing");
+	headers.set("Access-Control-Expose-Headers", "Server-Timing, X-Seams-Wallet-Region");
 	if (allowedOrigin && allowedOrigin !== "*") headers.set("Access-Control-Allow-Credentials", "true");
 }
 async function readJson(request) {
@@ -5497,7 +5481,7 @@ function routeAuthNotConfigured(message) {
 		message
 	};
 }
-async function resolvePublishableKeyApiCredentialAuth(input) {
+function parsePublishableKeyRequest(input) {
 	if (input.route.auth.plane !== "api_credentials") return routeAuthNotConfigured(input.routeAuthNotConfiguredMessage);
 	const publishableKey = extractBearerCredential(input.headers);
 	if (!publishableKey) return {
@@ -5520,23 +5504,42 @@ async function resolvePublishableKeyApiCredentialAuth(input) {
 		code: "forbidden",
 		message: `publishable_key_environment_mismatch: ${input.missingEnvironmentMessage}`
 	};
-	const authResult = await input.publishableKeyAuth.authenticate({
-		secret: publishableKey,
-		origin,
-		environmentId
+	return {
+		ok: true,
+		request: {
+			secret: publishableKey,
+			origin,
+			environmentId
+		}
+	};
+}
+async function resolveWalletRegistrationContext(input) {
+	const parsed = parsePublishableKeyRequest(input);
+	if (!parsed.ok) return parsed;
+	return input.registrationContext.resolve({
+		...parsed.request,
+		registration: input.registration
 	});
+}
+async function resolvePublishableKeyApiCredentialAuth(input) {
+	const parsed = parsePublishableKeyRequest(input);
+	if (!parsed.ok) return parsed;
+	const authResult = await input.publishableKeyAuth.authenticate(parsed.request);
 	if (!authResult.ok) return {
 		ok: false,
 		status: authResult.status,
 		code: authResult.status === 403 ? "forbidden" : "unauthorized",
 		message: `${authResult.code}: ${authResult.message}`
 	};
+	return publishableKeyRoutePrincipal(authResult.principal);
+}
+async function publishableKeyRoutePrincipal(principal) {
 	return {
 		ok: true,
 		principal: {
 			kind: "api_credentials",
 			credentialType: "publishable_key",
-			principal: authResult.principal
+			principal
 		}
 	};
 }
@@ -5937,6 +5940,9 @@ function walletSessionCapabilitySubjectsV1Equal(left, right) {
 	}
 	return true;
 }
+function walletSessionAuthorizationV2RecordsEqual(left, right) {
+	return left.kind === right.kind && left.tenantId === right.tenantId && left.principalId === right.principalId && left.walletId === right.walletId && left.authorityId === right.authorityId && left.walletAuthMethodId === right.walletAuthMethodId && left.authorityDigestB64u === right.authorityDigestB64u && left.authorityRevocationEpoch === right.authorityRevocationEpoch && left.mintId === right.mintId && left.authorizationId === right.authorizationId && left.walletSessionId === right.walletSessionId && left.quotaId === right.quotaId && walletSessionCapabilitySubjectsV1Equal(left.capabilitySubjects, right.capabilitySubjects) && left.createdAtMs === right.createdAtMs && left.expiresAtMs === right.expiresAtMs;
+}
 function parseAuthorizedOperationReplayResponse(value) {
 	if (!isAuthorizedOperationReplayResponseRecordV1(value)) throw new Error("authorized operation replay response must be an object");
 	const keys = Object.keys(value).sort();
@@ -6321,12 +6327,23 @@ async function validateRouterAbEd25519WalletSessionInputs(input) {
 	const token = extractBearerCredential(input.headers);
 	if (!token) return walletSessionFailure("wallet_session_missing");
 	const nowMs = input.nowMs || Date.now;
+	let read;
 	let resolution;
 	try {
-		resolution = await resolveWalletSessionOperationCredentialAdmission({
-			authorizationSessions,
+		read = await authorizationSessions.readEd25519WalletSessionSigningReadByOperationCredential({
+			tenantId: authorizationSessions.tenantId,
 			token,
 			nowMs: nowMs(),
+			materialActivation: input.materialActivation
+		});
+		if (!read) return {
+			ok: false,
+			code: "wallet_session_invalid",
+			message: walletSessionFailureMessage("wallet_session_invalid")
+		};
+		resolution = resolveWalletSessionOperationCredentialAdmissionFromContext({
+			context: read.context,
+			nowMs: nowMs(),
 			operation: {
 				keyFamily: "ed25519",
 				operationKind: input.operationKind
@@ -6335,18 +6352,14 @@ async function validateRouterAbEd25519WalletSessionInputs(input) {
 	} catch {
 		return walletSessionFailure("wallet_session_unavailable");
 	}
-	if (resolution.kind === "rejected") return walletSessionFailure("wallet_session_scope_mismatch");
-	if (resolution.kind === "not_found") return {
-		ok: false,
-		code: "wallet_session_invalid",
-		message: walletSessionFailureMessage("wallet_session_invalid")
-	};
-	if (resolution.admission.curve !== "ed25519") return walletSessionFailure("wallet_session_scope_mismatch");
+	if (resolution.kind === "rejected" || resolution.admission.curve !== "ed25519") return walletSessionFailure("wallet_session_scope_mismatch");
 	return {
 		ok: true,
 		kind: "wallet_session_operation_credential_v1",
 		admission: resolution.admission,
-		context: resolution.admission.context
+		context: resolution.admission.context,
+		signerRead: read.signerRead,
+		policyRead: read.policyRead
 	};
 }
 async function validateEcdsaPreprocessingSession(input) {
@@ -6666,6 +6679,123 @@ async function enforceRoutePolicy(input) {
 	};
 }
 //#endregion
+//#region src/router/domains/walletRegistration/registrationSessionSeal.ts
+/** Holds one request's computation until registration can publish its response. */
+var RegistrationPreparedSessionSeal = class {
+	constructor(request, service) {
+		this.request = request;
+		this.service = service;
+		this.prepared = null;
+	}
+	async prepare(session) {
+		await this.finish(session);
+	}
+	async finish(session) {
+		const tokens = session.tokens;
+		const ed25519 = tokens.kind === "near_ed25519" || tokens.kind === "near_ed25519_and_evm_family_ecdsa" ? tokens.ed25519 : null;
+		if (!ed25519 || String(ed25519.thresholdSessionId) !== this.request.thresholdSessionId) return {
+			ok: false,
+			code: "invalid_session_seal",
+			message: "Prepared seal does not match the established Ed25519 session"
+		};
+		if (this.prepared === null) this.prepared = {
+			walletId: String(session.walletId),
+			walletSessionId: String(session.walletSessionId),
+			expiresAtMs: session.expiresAtMs,
+			result: applyRegistrationSessionSeal(this.service, this.request, session)
+		};
+		if (this.prepared.walletId !== String(session.walletId) || this.prepared.walletSessionId !== String(session.walletSessionId) || this.prepared.expiresAtMs !== session.expiresAtMs) return {
+			ok: false,
+			code: "invalid_session_seal",
+			message: "Prepared seal does not match the committed Wallet Session"
+		};
+		const sealed = await this.prepared.result;
+		if (!sealed.ok) return sealed;
+		const keyVersion = String(sealed.keyVersion || "").trim();
+		if (!keyVersion) return {
+			ok: false,
+			code: "invalid_session_seal",
+			message: "Signing-session seal response is missing its key version"
+		};
+		const expiresAtMs = Math.min(sealed.expiresAtMs ?? session.expiresAtMs, session.expiresAtMs);
+		if (expiresAtMs <= Date.now()) return {
+			ok: false,
+			code: "expired",
+			message: "threshold session expired"
+		};
+		return {
+			ok: true,
+			value: {
+				ciphertext: sealed.ciphertext,
+				keyVersion,
+				expiresAtMs,
+				remainingUses: session.remainingUses
+			}
+		};
+	}
+};
+async function applyRegistrationSessionSeal(service, request, session) {
+	if (!service) return {
+		ok: false,
+		code: "signing_session_seal_unavailable",
+		message: "Signing-session sealing is unavailable"
+	};
+	try {
+		return await service.applyServerSeal(request, {
+			userId: String(session.walletId),
+			session: {
+				kind: "exact_wallet_session_operation_credential",
+				curve: "ed25519",
+				thresholdSessionId: request.thresholdSessionId,
+				userId: String(session.walletId),
+				expiresAtMs: session.expiresAtMs
+			}
+		});
+	} catch {
+		return {
+			ok: false,
+			code: "signing_session_seal_unavailable",
+			message: "Signing-session sealing failed"
+		};
+	}
+}
+function parseRegistrationPreparedSessionSeal(raw, service) {
+	if (raw === void 0) return {
+		ok: true,
+		value: null
+	};
+	if (!isPlainObject(raw)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "sessionSeal must be an object"
+	};
+	for (const field of Object.keys(raw)) if (![
+		"thresholdSessionId",
+		"ciphertext",
+		"keyVersion"
+	].includes(field)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "sessionSeal has unknown fields"
+	};
+	const thresholdSessionId = String(raw.thresholdSessionId || "").trim();
+	const ciphertext = String(raw.ciphertext || "").trim();
+	const keyVersion = String(raw.keyVersion || "").trim();
+	if (!thresholdSessionId || !ciphertext) return {
+		ok: false,
+		code: "invalid_body",
+		message: "sessionSeal thresholdSessionId and ciphertext are required"
+	};
+	return {
+		ok: true,
+		value: new RegistrationPreparedSessionSeal({
+			thresholdSessionId,
+			ciphertext,
+			...keyVersion ? { keyVersion } : {}
+		}, service)
+	};
+}
+//#endregion
 //#region src/router/framework/routeResponses.ts
 function routeJson(status, body, options) {
 	return {
@@ -7084,99 +7214,6 @@ function parsePasskeyCustodyEnvelopeRecord(raw, label = "walletCustodyEnvelope")
 	});
 }
 //#endregion
-//#region src/router/domains/walletRegistration/walletRegistrationSetupPayload.ts
-const WALLET_REGISTRATION_SETUP_CLAIM_KIND = "wallet_registration_setup_v1";
-/**
-* Verifies the payload and binds it to the ceremony the caller is driving.
-* A payload that verifies cryptographically but names a different ceremony,
-* wallet, or setup digest is rejected — signature validity alone is not
-* authorization for this request.
-*/
-/**
-* Verifies the payload's signature, ceremony binding, and expiry, and returns
-* its claims — without needing the ceremony row.
-*
-* Activate depends on this: a successful activation deletes the ceremony, so
-* an exact replay must be answerable from the operation row alone. The claims
-* are Gateway-signed, so the `setupDigestB64u` they carry is trustworthy
-* without recomputing it from storage.
-*/
-async function verifyWalletRegistrationSetupClaims(signer, token, expected) {
-	const value = normalizeOptionalTrimmedString(token);
-	if (!value) return {
-		ok: false,
-		code: "invalid_body",
-		message: "signedSetup is required"
-	};
-	const verified = await signer.verifyJwt(value);
-	if (!verified.valid) return {
-		ok: false,
-		code: "invalid_grant",
-		message: "signedSetup is not valid"
-	};
-	const claims = parseWalletRegistrationSetupClaims(verified.payload);
-	if (!claims) return {
-		ok: false,
-		code: "invalid_grant",
-		message: "signedSetup claims are not valid"
-	};
-	if (claims.registrationCeremonyId !== expected.registrationCeremonyId) return {
-		ok: false,
-		code: "invalid_grant",
-		message: "signedSetup belongs to a different registration ceremony"
-	};
-	if (claims.expiresAtMs <= expected.nowMs) return {
-		ok: false,
-		code: "invalid_grant",
-		message: "signedSetup has expired"
-	};
-	return {
-		ok: true,
-		claims
-	};
-}
-function parseWalletRegistrationSetupClaims(value) {
-	if (typeof value !== "object" || value === null) return null;
-	const record = value;
-	if (record.kind !== WALLET_REGISTRATION_SETUP_CLAIM_KIND) return null;
-	const registrationCeremonyId = normalizeOptionalTrimmedString(record.registrationCeremonyId);
-	const walletId = normalizeOptionalTrimmedString(record.walletId);
-	const orgId = normalizeOptionalTrimmedString(record.orgId);
-	const signingRootId = normalizeOptionalTrimmedString(record.signingRootId);
-	const signingRootVersion = normalizeOptionalTrimmedString(record.signingRootVersion);
-	const setupDigestB64u = normalizeOptionalTrimmedString(record.setupDigestB64u);
-	const expiresAtMs = Number(record.expiresAtMs);
-	const policy = parseWalletRegistrationSetupPolicy(record.policy);
-	if (!registrationCeremonyId || !walletId || !orgId || !signingRootId || !signingRootVersion || !setupDigestB64u || !policy || !Number.isSafeInteger(expiresAtMs)) return null;
-	return {
-		kind: WALLET_REGISTRATION_SETUP_CLAIM_KIND,
-		registrationCeremonyId,
-		walletId,
-		orgId,
-		signingRootId,
-		signingRootVersion,
-		policy,
-		setupDigestB64u,
-		expiresAtMs
-	};
-}
-function parseWalletRegistrationSetupPolicy(value) {
-	if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
-	const record = value;
-	switch (record.kind) {
-		case "runtime_policy_scope": try {
-			return {
-				kind: "runtime_policy_scope",
-				scope: normalizeRuntimePolicyScope(record.scope)
-			};
-		} catch {
-			return null;
-		}
-		case "signing_root_only": return record.scope === void 0 ? { kind: "signing_root_only" } : null;
-		default: return null;
-	}
-}
-//#endregion
 //#region ../shared-ts/src/utils/ecdsaKeyFactsInventory.ts
 function normalizeChainTarget(target) {
 	if (target.kind === "evm") return {
@@ -9204,8 +9241,27 @@ async function handleRouterApiWalletRegistrationSetup(input) {
 	if (!isPlainObject(input.body)) return routeError(400, "invalid_body", "JSON body required");
 	const origin = normalizeCorsOrigin(input.origin);
 	if (!origin) return routeError(403, "forbidden", "Origin header is required and must be a valid exact origin");
-	const publishableKeyAuth = input.services.publishableKeyAuth;
-	if (!publishableKeyAuth) return routeError(500, "route_auth_not_configured", "wallet registration setup requires publishable key auth on this server");
+	const registrationContext = input.services.registrationContext;
+	if (!registrationContext) return routeError(500, "route_auth_not_configured", "Wallet registration context is not configured");
+	const request = parseWalletRegistrationSetupRequest(input.body);
+	if (!request.ok) return routeError(400, request.code, request.message);
+	const context = await resolveWalletRegistrationContext({
+		registration: request.value,
+		environmentId: extractRouterApiEnvironmentId(input.headers) || void 0,
+		headers: input.headers,
+		missingEnvironmentMessage: "Environment header is required for wallet registration setup",
+		missingOriginMessage: "Origin header is required and must be a valid exact origin",
+		missingPublishableKeyMessage: "Missing publishable key",
+		origin,
+		registrationContext,
+		route: input.route,
+		routeAuthNotConfiguredMessage: "Wallet registration setup requires API credential auth policy"
+	});
+	if (!context.ok) {
+		if (context.status === 401) return routeError(401, "unauthorized", `${context.code}: ${context.message}`);
+		if (context.status === 403) return routeError(403, "forbidden", `${context.code}: ${context.message}`);
+		return routeError(context.status, "internal", `${context.code}: ${context.message}`);
+	}
 	const resolved = await enforceRoutePolicy({
 		headers: input.headers,
 		logger: input.logger,
@@ -9216,42 +9272,26 @@ async function handleRouterApiWalletRegistrationSetup(input) {
 		route: input.route,
 		services: walletRegistrationRoutePolicyServices(input),
 		sourceIp: input.sourceIp,
-		resolvers: { apiCredentials: async () => await resolvePublishableKeyApiCredentialAuth({
-			environmentId: extractRouterApiEnvironmentId(input.headers) || void 0,
-			headers: input.headers,
-			missingEnvironmentMessage: "Environment header is required for wallet registration setup",
-			missingOriginMessage: "Origin header is required and must be a valid exact origin",
-			missingPublishableKeyMessage: "Missing publishable key",
-			origin,
-			publishableKeyAuth,
-			route: input.route,
-			routeAuthNotConfiguredMessage: "Wallet registration setup requires API credential auth policy"
-		}) }
+		resolvers: { apiCredentials: publishableKeyRoutePrincipal.bind(void 0, context.principal) }
 	});
 	if (!resolved.ok) return routeJson(resolved.status, resolved.body);
-	if (resolved.context.principal.kind !== "api_credentials") return routeError(500, "internal", "wallet registration setup requires API credentials");
-	const principal = resolved.context.principal.principal;
-	const runtimePolicyScope = await resolveActiveRuntimePolicyScopeForEnvironment({
-		orgProjectEnv: input.services.orgProjectEnv || null,
+	const principal = context.principal;
+	const runtimePolicyScope = {
 		orgId: principal.orgId,
-		environmentId: principal.environmentId,
-		projectId: principal.projectId,
-		envId: principal.envId
-	});
+		projectId: context.environment.projectId,
+		envId: context.environment.key,
+		signingRootVersion: context.environment.signingRootVersion
+	};
 	const session = input.services.session;
 	if (!session) return routeError(500, "internal", "wallet registration setup requires session signing");
-	const request = parseWalletRegistrationSetupRequest(input.body);
-	if (!request.ok) return routeError(400, request.code, request.message);
 	return input.services.walletRegistration.setupWalletRegistration({
 		request: request.value,
 		orgId: principal.orgId,
 		expectedOrigin: origin,
 		signer: session,
-		...runtimePolicyScope ? { runtimePolicyScope } : {},
-		...runtimePolicyScope ? {
-			signingRootId: `${runtimePolicyScope.projectId}:${runtimePolicyScope.envId}`,
-			signingRootVersion: runtimePolicyScope.signingRootVersion
-		} : {}
+		runtimePolicyScope,
+		signingRootId: `${runtimePolicyScope.projectId}:${runtimePolicyScope.envId}`,
+		signingRootVersion: runtimePolicyScope.signingRootVersion
 	});
 }
 /**
@@ -9417,30 +9457,6 @@ function parseRegistrationRequestDigestB64u(raw) {
 		return null;
 	}
 }
-async function projectActivatedWallet(input) {
-	const walletProjection = input.services.walletProjection || null;
-	if (!walletProjection) return null;
-	const verifier = input.services.session;
-	if (!verifier) return "wallet projection requires setup verification";
-	const verified = await verifyWalletRegistrationSetupClaims(verifier, input.signedSetup, {
-		registrationCeremonyId: input.registrationCeremonyId,
-		nowMs: Date.now()
-	});
-	if (!verified.ok) return verified.message;
-	if (verified.claims.policy.kind !== "runtime_policy_scope") return "wallet projection requires an exact runtime policy scope";
-	if (verified.claims.policy.scope.orgId !== verified.claims.orgId) return "wallet projection scope does not match its organization";
-	try {
-		await walletProjection.recordCreatedWallet({
-			orgId: verified.claims.orgId,
-			runtimePolicyScope: verified.claims.policy.scope,
-			walletId: verified.claims.walletId,
-			occurredAt: (/* @__PURE__ */ new Date()).toISOString()
-		});
-		return null;
-	} catch (error) {
-		return error instanceof Error ? error.message : String(error);
-	}
-}
 /**
 * `POST /wallets/register/activate` — activation and finalization behind
 * one Gateway operation row.
@@ -9459,9 +9475,7 @@ async function handleRouterApiWalletRegistrationActivate(input) {
 	const idempotencyKey = String(body.idempotencyKey || "").trim();
 	if (!idempotencyKey) return routeError(400, "invalid_body", "idempotencyKey is required");
 	const planKind = String(body.kind || "").trim();
-	if (planKind !== "evm_family_ecdsa" && planKind !== "near_ed25519_and_evm_family_ecdsa" && planKind !== "near_ed25519") return routeError(400, "invalid_body", "kind must name the signer plan");
-	const ed25519Only = planKind === "near_ed25519";
-	if (ed25519Only && body.ecdsa !== void 0) return routeError(400, "invalid_body", "an Ed25519-only activate carries no ECDSA activation");
+	if (planKind !== "evm_family_ecdsa" && planKind !== "near_ed25519_and_evm_family_ecdsa") return routeError(400, "invalid_body", "activation requires an ECDSA signer plan");
 	const ecdsa = isPlainObject(body.ecdsa) ? body.ecdsa : null;
 	const unknownEcdsaField = ecdsa ? findUnknownField(ecdsa, [
 		"activationCorrelationId",
@@ -9469,9 +9483,9 @@ async function handleRouterApiWalletRegistrationActivate(input) {
 		"clientActivation"
 	]) : null;
 	if (unknownEcdsaField) return routeError(400, "invalid_body", `wallet registration ECDSA activation field ${unknownEcdsaField} is unsupported`);
-	if (!ed25519Only && (!ecdsa || typeof ecdsa.activationCorrelationId !== "string" || typeof ecdsa.activationRequestDigestB64u !== "string" || !isPlainObject(ecdsa.clientActivation))) return routeError(400, "invalid_body", "browser-verified clientActivation is required");
+	if (!ecdsa || typeof ecdsa.activationCorrelationId !== "string" || typeof ecdsa.activationRequestDigestB64u !== "string" || !isPlainObject(ecdsa.clientActivation)) return routeError(400, "invalid_body", "browser-verified clientActivation is required");
 	let parsedActivation;
-	if (ecdsa) try {
+	try {
 		const parsed = parseRouterAbEcdsaRegistrationActivationRequestV1({
 			registrationCeremonyId,
 			ecdsa: {
@@ -9494,25 +9508,17 @@ async function handleRouterApiWalletRegistrationActivate(input) {
 		signedSetup,
 		idempotencyKey,
 		planKind,
-		...parsedActivation ? { ecdsa: parsedActivation } : {},
+		ecdsa: parsedActivation,
 		...body.emailOtpEnrollment ? { emailOtpEnrollment: body.emailOtpEnrollment } : {},
 		...body.walletCustodyCommit !== void 0 ? { walletCustodyCommit: body.walletCustodyCommit } : {},
 		verifier: session
 	}, traceContext.value ?? void 0, serverTiming);
 	if (!result.ok) return routeJson(400, result);
 	if (!isEmailOtpWalletRegistrationActivateSuccessV2(result) && !isPasskeyWalletRegistrationActivateSuccessV2(result)) return routeError(500, "internal", "Wallet registration activation returned an invalid authority");
-	const projectionError = await projectActivatedWallet({
-		registrationCeremonyId,
-		services: input.services,
-		signedSetup
-	});
-	if (projectionError) return routeError(500, "internal", `Wallet was created but its Console projection failed: ${projectionError}`);
 	return routeJson(200, result, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
 }
 /**
-* `POST /wallets/register/near-provisioning` — the non-blocking completion
-* the client calls after activate, once its already-running Yao computation
-* produces an activation.
+* Commits a NEAR-only wallet or completes a mixed wallet's deferred signer.
 */
 async function handleRouterApiWalletRegistrationNearProvisioning(input) {
 	if (!isPlainObject(input.body)) return routeError(400, "invalid_body", "JSON body required");
@@ -9525,7 +9531,7 @@ async function handleRouterApiWalletRegistrationNearProvisioning(input) {
 	if (!registrationCeremonyId || !signedSetup || !idempotencyKey) return routeError(400, "invalid_body", "registrationCeremonyId, signedSetup and idempotencyKey are required");
 	const ed25519 = parseWalletRegistrationEd25519Finalize(body.ed25519);
 	if (!ed25519.ok) return routeError(400, ed25519.code, ed25519.message);
-	const sessionSeal = parseRegistrationPreparedSessionSeal(body.sessionSeal);
+	const sessionSeal = parseRegistrationPreparedSessionSeal(body.sessionSeal, input.signingSessionSeal?.service ?? null);
 	if (!sessionSeal.ok) return routeError(400, sessionSeal.code, sessionSeal.message);
 	const serverTiming = [];
 	const result = await input.services.walletRegistration.completeWalletRegistrationNearProvisioning({
@@ -9536,17 +9542,14 @@ async function handleRouterApiWalletRegistrationNearProvisioning(input) {
 		ed25519: ed25519.value,
 		emailOtpEnrollment: body.emailOtpEnrollment,
 		...body.walletCustodyCommit !== void 0 ? { walletCustodyCommit: body.walletCustodyCommit } : {},
-		verifier: session
-	}, serverTiming);
+		verifier: session,
+		onSessionCommitted: sessionSeal.value?.prepare.bind(sessionSeal.value)
+	}, serverTiming, input.waitUntil);
 	if (!result.ok) return routeJson(400, result);
 	if (sessionSeal.value) {
 		if (!isPasskeyWalletRegistrationNearProvisioningSuccessV2(result)) return routeError(400, "invalid_body", "Registration session sealing requires a passkey authority");
 		const sealStartedAt = Date.now();
-		const sealed = await applyRegistrationPreparedSessionSeal({
-			options: input.signingSessionSeal,
-			request: sessionSeal.value,
-			response: result
-		});
+		const sealed = await sessionSeal.value.finish(result.registrationEstablishedSession.session);
 		serverTiming.push(["near_finalize_session_seal", Math.max(0, Date.now() - sealStartedAt)]);
 		if (!sealed.ok) return routeJson(503, {
 			ok: false,
@@ -9560,87 +9563,10 @@ async function handleRouterApiWalletRegistrationNearProvisioning(input) {
 	}
 	return routeJson(200, result, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
 }
-function parseRegistrationPreparedSessionSeal(raw) {
-	if (raw === void 0) return {
-		ok: true,
-		value: void 0
-	};
-	if (!isPlainObject(raw)) return {
-		ok: false,
-		code: "invalid_body",
-		message: "sessionSeal must be an object"
-	};
-	if (Object.keys(raw).some((field) => ![
-		"thresholdSessionId",
-		"ciphertext",
-		"keyVersion"
-	].includes(field))) return {
-		ok: false,
-		code: "invalid_body",
-		message: "sessionSeal has unknown fields"
-	};
-	const thresholdSessionId = String(raw.thresholdSessionId || "").trim();
-	const ciphertext = String(raw.ciphertext || "").trim();
-	const keyVersion = String(raw.keyVersion || "").trim();
-	if (!thresholdSessionId || !ciphertext) return {
-		ok: false,
-		code: "invalid_body",
-		message: "sessionSeal thresholdSessionId and ciphertext are required"
-	};
-	return {
-		ok: true,
-		value: {
-			thresholdSessionId,
-			ciphertext,
-			...keyVersion ? { keyVersion } : {}
-		}
-	};
-}
-async function applyRegistrationPreparedSessionSeal(args) {
-	if (!args.options) return {
-		ok: false,
-		code: "signing_session_seal_unavailable",
-		message: "Signing-session sealing is unavailable"
-	};
-	const session = args.response.registrationEstablishedSession.session;
-	const tokens = session.tokens;
-	const ed25519 = tokens.kind === "near_ed25519" || tokens.kind === "near_ed25519_and_evm_family_ecdsa" ? tokens.ed25519 : null;
-	if (!ed25519 || String(ed25519.thresholdSessionId) !== args.request.thresholdSessionId) return {
-		ok: false,
-		code: "invalid_session_seal",
-		message: "Prepared seal does not match the established Ed25519 session"
-	};
-	const sealed = await args.options.service.applyServerSeal(args.request, {
-		userId: String(session.walletId),
-		session: {
-			kind: "exact_wallet_session_operation_credential",
-			curve: "ed25519",
-			thresholdSessionId: args.request.thresholdSessionId,
-			userId: String(session.walletId),
-			expiresAtMs: session.expiresAtMs
-		}
-	});
-	if (!sealed.ok) return sealed;
-	const keyVersion = String(sealed.keyVersion || "").trim();
-	if (!keyVersion) return {
-		ok: false,
-		code: "invalid_session_seal",
-		message: "Signing-session seal response is missing its key version"
-	};
-	return {
-		ok: true,
-		value: {
-			ciphertext: sealed.ciphertext,
-			keyVersion,
-			expiresAtMs: Math.min(sealed.expiresAtMs ?? session.expiresAtMs, session.expiresAtMs),
-			remainingUses: session.remainingUses
-		}
-	};
-}
-function ecdsaGatewayServerTimingHeaders(serverTiming) {
-	if (serverTiming.length === 0) return void 0;
-	const header = serverTiming.map(([name, durationMs]) => `${name};dur=${Math.max(0, durationMs).toFixed(1)}`).join(", ");
-	return { "Server-Timing": header };
+function ecdsaGatewayServerTimingHeaders(serverTiming) {
+	if (serverTiming.length === 0) return void 0;
+	const header = serverTiming.map(([name, durationMs]) => `${name};dur=${Math.max(0, durationMs).toFixed(1)}`).join(", ");
+	return { "Server-Timing": header };
 }
 async function handleRouterApiWalletAddSignerStart(input) {
 	if (!isPlainObject(input.body)) return routeError(400, "invalid_body", "JSON body required");
@@ -10699,7 +10625,7 @@ function resolveWalletRegistrationRoute(ctx) {
 async function handleWalletRegistration(ctx) {
 	const route = resolveWalletRegistrationRoute(ctx);
 	if (!route) return null;
-	if (ctx.request.headers.get("X-Seams-Wallet-Protocol") !== "2") return jsonFailure(409, "wallet_protocol_mismatch", "Your wallet application needs an update. Reload this page and try again. If the problem continues, ask the application developer to upgrade the Wallet SDK.");
+	if (ctx.request.headers.get("X-Seams-Wallet-Protocol") !== "3") return jsonFailure(409, "wallet_protocol_mismatch", "Your wallet application needs an update. Reload this page and try again. If the problem continues, ask the application developer to upgrade the Wallet SDK.");
 	const common = {
 		body: await readJson(ctx.request),
 		headers: Object.fromEntries(ctx.request.headers.entries()),
@@ -10719,10 +10645,11 @@ async function handleWalletRegistration(ctx) {
 			routerAbPublicKeyset: ctx.opts.routerAbPublicKeyset,
 			session: ctx.opts.session,
 			publishableKeyAuth: ctx.opts.publishableKeyAuth,
-			walletProjection: ctx.opts.walletProjection
+			registrationContext: ctx.opts.registrationContext
 		},
 		sourceIp: resolveSourceIpFromFetchHeaders(ctx.request.headers) || void 0,
-		signingSessionSeal: ctx.opts.signingSessionSeal
+		signingSessionSeal: ctx.opts.signingSessionSeal,
+		waitUntil: ctx.runtime.kind === "background" ? ctx.runtime.waitUntil : void 0
 	};
 	let response;
 	switch (route.id) {
@@ -13605,41 +13532,47 @@ function walletUnlockIssuanceRejectionStatus(rejection) {
 	}
 }
 //#endregion
-//#region ../shared-ts/src/utils/ecdsaServerTiming.ts
-const ECDSA_TIMING_METRICS = new Set([
-	"ecdsa_sign_authorize",
-	"ecdsa_sign_admit",
-	"ecdsa_sign_proxy",
-	"ecdsa_sign_complete",
-	"ecdsa_sign_total",
-	"ecdsa_presign_authenticate",
-	"ecdsa_presign_material",
-	"ecdsa_presign_admit",
-	"ecdsa_presign_proxy",
-	"ecdsa_presign_total",
-	"ecdsa_presign_sw_material",
-	"ecdsa_presign_sw_session",
-	"ecdsa_presign_sw_do_total",
-	"ecdsa_presign_sw_admit",
-	"ecdsa_presign_sw_total"
-]);
-function parseEcdsaServerTiming(header) {
-	const durations = /* @__PURE__ */ new Map();
-	if (!header) return durations;
-	for (const metric of header.split(",")) {
-		const [name, ...parameters] = metric.trim().split(";");
-		if (!ECDSA_TIMING_METRICS.has(name) || durations.has(name)) continue;
-		for (const parameter of parameters) {
-			const [key, rawValue] = parameter.trim().split("=");
-			if (key !== "dur" || !rawValue?.trim()) continue;
-			const duration = Number(rawValue);
-			if (Number.isFinite(duration) && duration >= 0) durations.set(name, duration);
-			break;
+//#region src/router/domains/signingOperations/signingPrepareSession.ts
+/** The session snapshot validated for this admission, before its quota claim. */
+function signingPrepareSessionResponse(signing, authorization) {
+	switch (authorization.kind) {
+		case "operation_step_up": return {
+			kind: "operation_step_up",
+			signing
+		};
+		case "wallet_session_operation_credential_v1": {
+			const { session, quota } = authorization.validated.admission.context.authorization;
+			return {
+				kind: "reusable_wallet_session",
+				signing,
+				session_status: {
+					ok: true,
+					status: "active",
+					walletSessionId: session.walletSessionId,
+					quotaId: session.quotaId,
+					remainingUses: quota.remainingUses,
+					expiresAtMs: quota.expiresAtMs,
+					quotaLifecycle: "active",
+					authorization: projectExactWalletSessionAuthorizationV1(session)
+				}
+			};
 		}
+		case "wallet_session_operation_credential_exhausted_candidate_v1": throw new Error("An exhausted Wallet Session cannot publish a fresh prepare response");
 	}
-	return durations;
 }
 //#endregion
+//#region ../shared-ts/src/utils/walletSessionFailure.ts
+const WALLET_SESSION_FAILURE_CODES = {
+	missing: "wallet_session_missing",
+	signatureInvalid: "wallet_session_signature_invalid",
+	claimsInvalid: "wallet_session_claims_invalid",
+	invalid: "wallet_session_invalid",
+	expired: "wallet_session_expired",
+	scopeMismatch: "wallet_session_scope_mismatch",
+	unavailable: "wallet_session_unavailable",
+	budgetExhausted: "wallet_budget_exhausted"
+};
+//#endregion
 //#region src/router/domains/signingOperations/routerAbNormalSigningAdmission.ts
 function routerAbOwnerOperationStepUpDecision(input) {
 	const reason = (() => {
@@ -13686,6 +13619,7 @@ async function evaluateRouterAbNormalSigningAdmission(input) {
 	};
 	if (input.curve === "ed25519") return await input.adapter.evaluatePolicy({
 		curve: "ed25519",
+		policyReadSource: input.policyReadSource,
 		authorityKind: "wallet_authority_v1",
 		authorityId: input.authorityId,
 		phase: input.phase,
@@ -14053,18 +13987,6 @@ function routerAbOperationStepUpClaimFailure(result) {
 	}
 }
 //#endregion
-//#region ../shared-ts/src/utils/walletSessionFailure.ts
-const WALLET_SESSION_FAILURE_CODES = {
-	missing: "wallet_session_missing",
-	signatureInvalid: "wallet_session_signature_invalid",
-	claimsInvalid: "wallet_session_claims_invalid",
-	invalid: "wallet_session_invalid",
-	expired: "wallet_session_expired",
-	scopeMismatch: "wallet_session_scope_mismatch",
-	unavailable: "wallet_session_unavailable",
-	budgetExhausted: "wallet_budget_exhausted"
-};
-//#endregion
 //#region src/core/ThresholdService/routerAb/internalServiceHttp.ts
 const ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1 = "x-router-ab-internal-service-auth";
 function normalizeRouterAbInternalServiceAuthSecret(input) {
@@ -15195,6 +15117,143 @@ async function authorizeRouterAbEcdsaDerivationNormalSigningRoute(input) {
 	};
 }
 //#endregion
+//#region src/router/domains/signingOperations/ecdsaSigningResponse.ts
+async function finishRouterAbEcdsaSigningResponse(input) {
+	const upstream = input.upstream;
+	const upstreamBodyText = await upstream.clone().text().catch(() => "");
+	input.timing.proxy = performance.now() - input.proxyStartedAt;
+	if (isRouterAbEcdsaOperationInProgressResponse({
+		status: upstream.status,
+		bodyText: upstreamBodyText
+	})) return upstream;
+	const completionStartedAt = performance.now();
+	await completeRouterAbEcdsaOperation({
+		authorizedOperations: input.authorizedOperations,
+		operation: input.operation,
+		result: upstream.ok ? "succeeded" : upstream.status < 500 ? "failed_before_side_effect" : "failed_after_side_effect",
+		response: {
+			status: upstream.status,
+			contentType: upstream.headers.get("content-type") || "application/json",
+			bodyText: upstreamBodyText
+		}
+	});
+	input.timing.complete = performance.now() - completionStartedAt;
+	return upstream;
+}
+function isRouterAbEcdsaOperationInProgressResponse(input) {
+	return input.status === 409 && input.bodyText.includes("ReplayedLocalRequest:") && input.bodyText.includes("SigningWorker ECDSA effect is already in progress");
+}
+//#endregion
+//#region src/router/domains/signingOperations/authorizedOperationWire.ts
+function buildAuthorizedOperationWire(input, commonAuthorizedOperation) {
+	const operation = input.operation;
+	switch (input.binding.kind) {
+		case "reusable_wallet_session":
+			if (operation.authorization.kind !== "authorization_grant" || operation.quota.kind !== "consume_reusable_wallet_session") throw new Error("Reusable Wallet Session authorized operation is invalid");
+			return {
+				binding: {
+					kind: "reusable_wallet_session",
+					authorization_id: operation.authorization.authorizationGrantRef.authorizationId,
+					wallet_session_id: input.binding.walletSessionId,
+					quota_id: input.binding.quotaId
+				},
+				authorized_operation: {
+					kind: "reusable_wallet_session_authorized_operation_v1",
+					...commonAuthorizedOperation
+				}
+			};
+		case "gateway_owner_wallet_session":
+			if (operation.authorization.kind !== "authorization_grant" || operation.quota.kind !== "consume_reusable_wallet_session") throw new Error("Gateway owner Wallet Session authorized operation is invalid");
+			return {
+				binding: {
+					kind: "gateway_owner_wallet_session",
+					ownership_generation: input.binding.ownershipGeneration,
+					subject_id: input.binding.subjectId,
+					account_id: input.binding.accountId,
+					authorization_id: input.binding.authorizationId,
+					wallet_session_id: input.binding.walletSessionId,
+					quota_id: input.binding.quotaId,
+					threshold_session_id: input.binding.thresholdSessionId,
+					org_id: input.binding.orgId,
+					project_id: input.binding.projectId,
+					environment: input.binding.environment,
+					project_environment_id: input.binding.projectEnvironmentId,
+					signing_worker_id: input.binding.signingWorkerId,
+					expires_at_ms: input.binding.expiresAtMs
+				},
+				authorized_operation: {
+					kind: "reusable_wallet_session_authorized_operation_v1",
+					...commonAuthorizedOperation
+				}
+			};
+		case "operation_step_up":
+			if (operation.authorization.kind !== "verified_step_up" || operation.quota.kind !== "quota_neutral") throw new Error("Verified step-up authorized operation is invalid");
+			return {
+				binding: {
+					kind: "operation_step_up",
+					ownership_generation: input.binding.ownershipGeneration,
+					authorization_session_id: input.binding.authorizationSessionId,
+					org_id: input.binding.orgId,
+					project_id: input.binding.projectId,
+					environment: input.binding.environment,
+					project_environment_id: input.binding.projectEnvironmentId,
+					subject_id: input.binding.subjectId,
+					account_id: input.binding.accountId
+				},
+				authorized_operation: {
+					kind: "verified_step_up_authorized_operation_v1",
+					authorization_session_id: input.binding.authorizationSessionId,
+					evidence_set_digest: operation.authorization.evidenceSetDigest,
+					...commonAuthorizedOperation
+				}
+			};
+		default: return assertNeverOperationBinding(input.binding);
+	}
+}
+function assertNeverOperationBinding(_binding) {
+	throw new Error("Unsupported authorized-operation binding");
+}
+//#endregion
+//#region ../shared-ts/src/utils/ecdsaServerTiming.ts
+const ECDSA_TIMING_METRICS = new Set([
+	"wallet_gateway_binding",
+	"wallet_gateway_total",
+	"wallet_console_binding_d1",
+	"wallet_console_binding_sql",
+	"ecdsa_sign_authorize",
+	"ecdsa_sign_admit",
+	"ecdsa_sign_proxy",
+	"ecdsa_sign_complete",
+	"ecdsa_sign_total",
+	"ecdsa_presign_authenticate",
+	"ecdsa_presign_material",
+	"ecdsa_presign_admit",
+	"ecdsa_presign_proxy",
+	"ecdsa_presign_total",
+	"ecdsa_presign_sw_material",
+	"ecdsa_presign_sw_session",
+	"ecdsa_presign_sw_do_response_headers",
+	"ecdsa_presign_sw_do_response_body",
+	"ecdsa_presign_sw_admit",
+	"ecdsa_presign_sw_total"
+]);
+function parseEcdsaServerTiming(header) {
+	const durations = /* @__PURE__ */ new Map();
+	if (!header) return durations;
+	for (const metric of header.split(",")) {
+		const [name, ...parameters] = metric.trim().split(";");
+		if (!ECDSA_TIMING_METRICS.has(name) || durations.has(name)) continue;
+		for (const parameter of parameters) {
+			const [key, rawValue] = parameter.trim().split("=");
+			if (key !== "dur" || !rawValue?.trim()) continue;
+			const duration = Number(rawValue);
+			if (Number.isFinite(duration) && duration >= 0) durations.set(name, duration);
+			break;
+		}
+	}
+	return durations;
+}
+//#endregion
 //#region src/router/domains/ecdsa/thresholdEcdsaRequestValidation.ts
 const POOL_FILL_INIT_KEYS = [
 	"presignSessionId",
@@ -15595,6 +15654,27 @@ function walletAuthorityForAuthMethod(authMethod, authSource) {
 	};
 }
 //#endregion
+//#region src/router/cloudflare/runtime/walletObjectAddresses.ts
+const WALLET_OBJECT_IDENTITY_HEADER = "x-seams-wallet-object-identity";
+function walletObjectIdentity(wallet, generation, tenant) {
+	const parsed = parseWalletId(wallet);
+	if (!parsed.ok || typeof generation !== "number" || !Number.isSafeInteger(generation) || generation < 1) throw new Error("Wallet object identity requires a wallet and ownership generation");
+	return {
+		walletId: parsed.value,
+		ownershipGeneration: generation,
+		orgId: tenantPart(tenant.orgId),
+		projectId: tenantPart(tenant.projectId),
+		envId: tenantPart(tenant.envId)
+	};
+}
+function walletObjectIdentityHeaders(identity) {
+	return { [WALLET_OBJECT_IDENTITY_HEADER]: JSON.stringify(identity) };
+}
+function tenantPart(value) {
+	if (typeof value !== "string" || !value || value.trim() !== value) throw new Error("Wallet object tenant is invalid");
+	return value;
+}
+//#endregion
 //#region src/router/transport/fetch/routes/normalSigningRouterProxy.ts
 async function proxyNormalSigningRequestToMpcRouter(input) {
 	const proxy = input.proxy;
@@ -15605,6 +15685,14 @@ async function proxyNormalSigningRequestToMpcRouter(input) {
 	}, { status: 501 });
 	try {
 		const headers = new Headers(input.request.headers);
+		const envelope = input.body?.authorized_operation;
+		if (!isPlainObject(envelope) || !isPlainObject(envelope.binding)) throw new Error("Signing requires an admitted wallet binding");
+		const identity = walletObjectIdentity(envelope.binding.account_id, envelope.binding.ownership_generation, {
+			orgId: envelope.binding.org_id,
+			projectId: envelope.binding.project_id,
+			envId: envelope.binding.project_environment_id
+		});
+		for (const [name, value] of Object.entries(walletObjectIdentityHeaders(identity))) headers.set(name, value);
 		if (input.body && parseNormalSigningSessionAdmission(input.body)) headers.delete("authorization");
 		headers.set(ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1, normalizeRouterAbInternalServiceAuthSecret(proxy.internalServiceAuthSecret));
 		const request = input.targetPath ? new Request(new URL(input.targetPath, input.request.url), input.request) : input.request;
@@ -15646,7 +15734,7 @@ function isNormalSigningReusableBindingRecord(value) {
 }
 function isNormalSigningGatewayOwnerBindingRecord(value) {
 	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
-	return Object.keys(value).sort().join("|") === "account_id|authorization_id|environment|expires_at_ms|kind|org_id|project_environment_id|project_id|quota_id|signing_worker_id|subject_id|threshold_session_id|wallet_session_id";
+	return Object.keys(value).sort().join("|") === "account_id|authorization_id|environment|expires_at_ms|kind|org_id|ownership_generation|project_environment_id|project_id|quota_id|signing_worker_id|subject_id|threshold_session_id|wallet_session_id";
 }
 function isNormalSigningReusableReceiptRecord(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -15655,7 +15743,7 @@ function isNormalSigningReusableBindingValues(record) {
 	return typeof record.authorization_id === "string" && record.authorization_id.trim().length > 0 && typeof record.wallet_session_id === "string" && record.wallet_session_id.trim().length > 0 && typeof record.quota_id === "string" && record.quota_id.trim().length > 0;
 }
 function isNormalSigningGatewayOwnerBindingValues(record) {
-	return typeof record.subject_id === "string" && record.subject_id.trim().length > 0 && typeof record.account_id === "string" && record.account_id.trim().length > 0 && typeof record.authorization_id === "string" && record.authorization_id.trim().length > 0 && typeof record.wallet_session_id === "string" && record.wallet_session_id.trim().length > 0 && typeof record.quota_id === "string" && record.quota_id.trim().length > 0 && typeof record.threshold_session_id === "string" && record.threshold_session_id.trim().length > 0 && typeof record.org_id === "string" && record.org_id.trim().length > 0 && typeof record.project_id === "string" && record.project_id.trim().length > 0 && typeof record.environment === "string" && record.environment.trim().length > 0 && typeof record.project_environment_id === "string" && record.project_environment_id.trim().length > 0 && typeof record.signing_worker_id === "string" && record.signing_worker_id.trim().length > 0 && typeof record.expires_at_ms === "number" && Number.isSafeInteger(record.expires_at_ms) && record.expires_at_ms > 0;
+	return record.kind === "gateway_owner_wallet_session" && typeof record.ownership_generation === "number" && Number.isSafeInteger(record.ownership_generation) && record.ownership_generation > 0 && typeof record.subject_id === "string" && record.subject_id.trim().length > 0 && typeof record.account_id === "string" && record.account_id.trim().length > 0 && typeof record.authorization_id === "string" && record.authorization_id.trim().length > 0 && typeof record.wallet_session_id === "string" && record.wallet_session_id.trim().length > 0 && typeof record.quota_id === "string" && record.quota_id.trim().length > 0 && typeof record.threshold_session_id === "string" && record.threshold_session_id.trim().length > 0 && typeof record.org_id === "string" && record.org_id.trim().length > 0 && typeof record.project_id === "string" && record.project_id.trim().length > 0 && typeof record.environment === "string" && record.environment.trim().length > 0 && typeof record.project_environment_id === "string" && record.project_environment_id.trim().length > 0 && typeof record.signing_worker_id === "string" && record.signing_worker_id.trim().length > 0 && typeof record.expires_at_ms === "number" && Number.isSafeInteger(record.expires_at_ms) && record.expires_at_ms > 0;
 }
 async function proxyOwnerLaneAdmittedNormalSigningRequest(input) {
 	const expectedMaterialActivation = routerAbMpcMaterialActivationRefFromWire(input.expectedMaterialActivation);
@@ -15720,6 +15808,7 @@ async function ecdsaOperationStepUpBinding(ctx, session, operation) {
 	const pinned = await readPinnedEcdsaStepUpWalletScope(ctx, session, operation);
 	return {
 		kind: "operation_step_up",
+		ownershipGeneration: pinned.ownershipGeneration,
 		authorizationSessionId: session.sessionId,
 		orgId: scope.orgId,
 		projectId: scope.projectId,
@@ -15739,7 +15828,10 @@ async function readPinnedEcdsaStepUpWalletScope(ctx, session, operation) {
 	const scope = session.runtimePolicyScope;
 	if (pinned.orgId !== scope.orgId || pinned.projectId !== scope.projectId) throw new Error("Step-up wallet scope differs from the Wallet Session scope");
 	return {
-		...pinned,
+		orgId: pinned.orgId,
+		projectId: pinned.projectId,
+		projectEnvironmentId: pinned.projectEnvironmentId,
+		ownershipGeneration: pinned.ownershipGeneration,
 		walletId: session.walletId
 	};
 }
@@ -15747,7 +15839,7 @@ function buildRouterAbEcdsaAuthorizedOperationWire(input) {
 	const operation = input.operation;
 	const operationRef = operation.operation.operation;
 	if (operationRef.capabilityKind !== "evm_ecdsa_mpc_signing" || operationRef.operationKind !== "evm.sign_transaction") throw new Error("ECDSA authorized operation capability or operation kind is invalid");
-	const commonAuthorizedOperation = {
+	return buildAuthorizedOperationWire(input, {
 		authorized_operation_id: operation.authorizedOperationId,
 		operation_id: operation.operation.operationId,
 		capability_kind: "evm_ecdsa_mpc_signing",
@@ -15756,66 +15848,7 @@ function buildRouterAbEcdsaAuthorizedOperationWire(input) {
 		intent_digest_b64u: operation.operation.digests.intentDigest,
 		display_digest_b64u: operation.operation.digests.displayDigest,
 		operation_fingerprint_digest: operation.operationFingerprintDigest
-	};
-	switch (input.binding.kind) {
-		case "reusable_wallet_session":
-			if (operation.authorization.kind !== "authorization_grant" || operation.quota.kind !== "consume_reusable_wallet_session") throw new Error("Reusable Wallet Session authorized operation is invalid");
-			return {
-				binding: {
-					kind: "reusable_wallet_session",
-					authorization_id: operation.authorization.authorizationGrantRef.authorizationId,
-					wallet_session_id: input.binding.walletSessionId,
-					quota_id: input.binding.quotaId
-				},
-				authorized_operation: {
-					kind: "reusable_wallet_session_authorized_operation_v1",
-					...commonAuthorizedOperation
-				}
-			};
-		case "gateway_owner_wallet_session":
-			if (operation.authorization.kind !== "authorization_grant" || operation.quota.kind !== "consume_reusable_wallet_session") throw new Error("Gateway owner Wallet Session authorized operation is invalid");
-			return {
-				binding: {
-					kind: "gateway_owner_wallet_session",
-					subject_id: input.binding.subjectId,
-					account_id: input.binding.accountId,
-					authorization_id: input.binding.authorizationId,
-					wallet_session_id: input.binding.walletSessionId,
-					quota_id: input.binding.quotaId,
-					threshold_session_id: input.binding.thresholdSessionId,
-					org_id: input.binding.orgId,
-					project_id: input.binding.projectId,
-					environment: input.binding.environment,
-					project_environment_id: input.binding.projectEnvironmentId,
-					signing_worker_id: input.binding.signingWorkerId,
-					expires_at_ms: input.binding.expiresAtMs
-				},
-				authorized_operation: {
-					kind: "reusable_wallet_session_authorized_operation_v1",
-					...commonAuthorizedOperation
-				}
-			};
-		case "operation_step_up":
-			if (operation.authorization.kind !== "verified_step_up" || operation.quota.kind !== "quota_neutral") throw new Error("Verified step-up authorized operation is invalid");
-			return {
-				binding: {
-					kind: "operation_step_up",
-					authorization_session_id: input.binding.authorizationSessionId,
-					org_id: input.binding.orgId,
-					project_id: input.binding.projectId,
-					environment: input.binding.environment,
-					project_environment_id: input.binding.projectEnvironmentId,
-					subject_id: input.binding.subjectId,
-					account_id: input.binding.accountId
-				},
-				authorized_operation: {
-					kind: "verified_step_up_authorized_operation_v1",
-					authorization_session_id: input.binding.authorizationSessionId,
-					evidence_set_digest: operation.authorization.evidenceSetDigest,
-					...commonAuthorizedOperation
-				}
-			};
-	}
+	});
 }
 function decideRouterAbEcdsaOperationStepUpExecution(input) {
 	if (input.admissionKind === "replayed") return {
@@ -15970,6 +16003,7 @@ async function executeRouterAbEcdsaDerivationNormalSigningRoute(input, timing) {
 			operation: authorizedOperation,
 			binding: {
 				kind: "gateway_owner_wallet_session",
+				ownershipGeneration: pinnedOwnerScope.ownershipGeneration,
 				subjectId: String(session.principalId),
 				accountId: String(session.walletId),
 				authorizationId: String(session.authorizationId),
@@ -16016,8 +16050,18 @@ async function executeRouterAbEcdsaDerivationNormalSigningRoute(input, timing) {
 		walletRegistration: input.ctx.service.walletRegistration,
 		body: admittedBody
 	});
+	if (input.phase === "prepare" && upstream.ok) {
+		const body = signingPrepareSessionResponse(await upstream.json(), authorization);
+		timing.proxy = performance.now() - proxyStartedAt;
+		const headers = new Headers(upstream.headers);
+		headers.delete("content-length");
+		headers.delete("content-encoding");
+		return new Response(JSON.stringify(body), {
+			status: upstream.status,
+			headers
+		});
+	}
 	return finishRouterAbEcdsaSigningResponse({
-		phase: input.phase,
 		upstream,
 		operation: authorizedOperation,
 		authorizedOperations: input.ctx.service.authorizedOperations,
@@ -16025,35 +16069,6 @@ async function executeRouterAbEcdsaDerivationNormalSigningRoute(input, timing) {
 		proxyStartedAt
 	});
 }
-async function finishRouterAbEcdsaSigningResponse(input) {
-	const upstream = input.upstream;
-	if (input.phase === "prepare" && upstream.ok) {
-		input.timing.proxy = performance.now() - input.proxyStartedAt;
-		return upstream;
-	}
-	const upstreamBodyText = await upstream.clone().text().catch(() => "");
-	input.timing.proxy = performance.now() - input.proxyStartedAt;
-	if (isRouterAbEcdsaOperationInProgressResponse({
-		status: upstream.status,
-		bodyText: upstreamBodyText
-	})) return upstream;
-	const completionStartedAt = performance.now();
-	await completeRouterAbEcdsaOperation({
-		authorizedOperations: input.authorizedOperations,
-		operation: input.operation,
-		result: upstream.ok ? "succeeded" : upstream.status < 500 ? "failed_before_side_effect" : "failed_after_side_effect",
-		response: {
-			status: upstream.status,
-			contentType: upstream.headers.get("content-type") || "application/json",
-			bodyText: upstreamBodyText
-		}
-	});
-	input.timing.complete = performance.now() - completionStartedAt;
-	return upstream;
-}
-function isRouterAbEcdsaOperationInProgressResponse(input) {
-	return input.status === 409 && input.bodyText.includes("ReplayedLocalRequest:") && input.bodyText.includes("SigningWorker ECDSA effect is already in progress");
-}
 function routerAbEcdsaReplayResponse(operation) {
 	const response = routerAbEcdsaReplayHttpResponse(operation);
 	if (response) return response;
@@ -16063,31 +16078,40 @@ function routerAbEcdsaReplayResponse(operation) {
 async function resolveV2EcdsaOperationStepUpAdmission(input) {
 	const token = extractBearerCredential(input.ctx.request.headers);
 	if (!token) return { kind: "not_found" };
-	let resolution;
+	let context;
 	try {
-		resolution = await resolveWalletSessionOperationCredentialAdmission({
-			authorizationSessions: input.ctx.service.authorizationSessions,
+		context = await input.ctx.service.authorizationSessions.readWalletSessionExactOperationContextByCredential({
+			tenantId: input.ctx.service.authorizationSessions.tenantId,
 			token,
-			nowMs: Date.now(),
-			operation: {
-				keyFamily: "ecdsa_secp256k1",
-				operationKind: input.operation.operation_kind
-			}
+			nowMs: Date.now()
 		});
 	} catch {
 		return { kind: "unavailable" };
 	}
-	if (resolution.kind === "not_found") return { kind: "not_found" };
-	if (resolution.kind === "rejected") return {
+	if (!context) return {
 		kind: "rejected",
-		message: "ECDSA operation step-up Wallet Session authorization is invalid"
+		message: "ECDSA operation step-up Wallet Session is unavailable"
 	};
-	if (resolution.admission.curve !== "ecdsa") return {
+	const session = context.session;
+	const admission = resolveWalletSessionAuthorizationV2Admission({
+		authorization: session,
+		authority: context.authority,
+		authMethod: context.authMethod,
+		retiredAtMs: context.retiredAtMs,
+		nowMs: Date.now(),
+		operation: {
+			tenantId: session.tenantId,
+			principalId: session.principalId,
+			walletId: session.walletId,
+			keyFamily: "ecdsa_secp256k1",
+			operationKind: input.operation.operation_kind
+		}
+	});
+	if (!admission.ok || admission.keyFamily !== "ecdsa_secp256k1") return {
 		kind: "rejected",
-		message: "ECDSA operation step-up Wallet Session family is invalid"
+		message: "ECDSA operation step-up Wallet Session authorization is invalid"
 	};
-	const session = resolution.admission.context.authorization.session;
-	const admittedSigner = resolution.admission.admission.signer;
+	const admittedSigner = admission.signer;
 	if (input.operation.wallet_id !== String(session.walletId) || input.operation.material_activation.material_owner !== String(session.walletId) || input.operation.expires_at_ms > session.expiresAtMs || input.operation.expires_at_ms <= Date.now()) return {
 		kind: "rejected",
 		message: "ECDSA operation step-up Wallet Session scope is invalid"
@@ -16103,13 +16127,13 @@ async function resolveV2EcdsaOperationStepUpAdmission(input) {
 		kind: "rejected",
 		message: "ECDSA operation step-up material is not uniquely active"
 	};
-	if (input.operation.signing_worker_id !== input.operation.normal_signing_scope.signing_worker.server_id || !sameRouterAbMpcMaterialActivationRef(input.operation.material_activation, input.operation.normal_signing_scope.material_activation) || !sameRouterAbMpcMaterialActivationRef(input.operation.material_activation, routerAbMpcMaterialActivationRefToWire(resolution.admission.admission.materialActivation))) return {
+	if (input.operation.signing_worker_id !== input.operation.normal_signing_scope.signing_worker.server_id || !sameRouterAbMpcMaterialActivationRef(input.operation.material_activation, input.operation.normal_signing_scope.material_activation) || !sameRouterAbMpcMaterialActivationRef(input.operation.material_activation, routerAbMpcMaterialActivationRefToWire(admission.materialActivation))) return {
 		kind: "rejected",
 		message: "ECDSA operation step-up material activation is invalid"
 	};
 	const activeMaterial = {
 		ok: true,
-		materialActivation: routerAbMpcMaterialActivationRefToWire(resolution.admission.admission.materialActivation),
+		materialActivation: routerAbMpcMaterialActivationRefToWire(admission.materialActivation),
 		keyHandle: signer.walletKey.keyHandle,
 		relayerKeyId: signer.walletKey.relayerKeyId,
 		participantIds: signer.walletKey.participantIds,
@@ -16118,13 +16142,13 @@ async function resolveV2EcdsaOperationStepUpAdmission(input) {
 	if (input.operation.operation_kind === "evm.sign_transaction") return {
 		kind: "admitted",
 		operationKind: "evm.sign_transaction",
-		admission: resolution.admission,
+		context,
 		activeMaterial
 	};
 	return {
 		kind: "admitted",
 		operationKind: "evm.export_key",
-		admission: resolution.admission,
+		context,
 		activeMaterial,
 		exportTopology: {
 			signer_set: signer.walletKey.publicCapability.signer_set,
@@ -16184,8 +16208,8 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 	let v2AuthorityRef;
 	if (v2Resolution.kind === "admitted") {
 		v2AuthorityRef = await walletAuthAuthorityRef({ authority });
-		const session = v2Resolution.admission.context.authorization.session;
-		const context = v2Resolution.admission.context;
+		const session = v2Resolution.context.session;
+		const context = v2Resolution.context;
 		if (authority.walletId !== String(session.walletId) || authority.bindingId !== context.authMethod.walletAuthMethodId || context.authMethod.walletAuthorityId !== context.authority.authorityId) return json$1({
 			ok: false,
 			code: "scope_mismatch",
@@ -16213,10 +16237,10 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 		ok: true,
 		authorizedOperations: proofAuthenticated.authorizedOperations,
 		session: {
-			tenantId: v2Resolution.admission.context.authorization.session.tenantId,
-			principalId: v2Resolution.admission.context.authorization.session.principalId,
-			sessionId: String(v2Resolution.admission.context.authorization.session.authorizationId),
-			walletId: String(v2Resolution.admission.context.authorization.session.walletId),
+			tenantId: v2Resolution.context.session.tenantId,
+			principalId: v2Resolution.context.session.principalId,
+			sessionId: String(v2Resolution.context.session.authorizationId),
+			walletId: String(v2Resolution.context.session.walletId),
 			runtimePolicyScope: activeMaterial.runtimePolicyScope,
 			laneAuthorization: {
 				kind: "authority_ref",
@@ -16262,7 +16286,7 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 			code: "wallet_session_unavailable",
 			message: "Wallet Session authorization is unavailable"
 		}, { status: 503 });
-		if (refreshedV2Resolution.kind !== "admitted" || !sameWalletSessionOperationCredentialAdmission(v2Resolution.admission, refreshedV2Resolution.admission)) return json$1({
+		if (refreshedV2Resolution.kind !== "admitted" || !walletSessionAuthorizationV2RecordsEqual(v2Resolution.context.session, refreshedV2Resolution.context.session)) return json$1({
 			ok: false,
 			code: "scope_mismatch",
 			message: "ECDSA operation step-up Wallet Session authorization changed"
@@ -16538,6 +16562,7 @@ async function authorizeEcdsaPoolFillOperationStepUp(input) {
 				materialExpiresAtMs: input.operation.expires_at_ms
 			},
 			ownerWalletScope,
+			ownershipGeneration: ownerWalletScope.ownershipGeneration,
 			routerAbEcdsaDerivationNormalSigning: {
 				kind: ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1,
 				scope: input.operation.normal_signing_scope
@@ -16617,6 +16642,7 @@ async function authorizeEcdsaPoolFill(input) {
 					thresholdExpiresAtMs: session.expiresAtMs,
 					authorization: { kind: "wallet_session" },
 					ownerWalletScope: validated.ownerWalletScope,
+					ownershipGeneration: validated.ownerWalletScope.ownershipGeneration,
 					routerAbEcdsaDerivationNormalSigning: normalSigning
 				}
 			};
@@ -16985,11 +17011,6 @@ async function admitStrictEcdsaExportOperationStepUp(input) {
 		case "wallet_session_quota_exhausted": return strictEcdsaExportFailure(409, result.kind, "Operation step-up authorization is invalid");
 	}
 }
-function sameWalletSessionOperationCredentialAdmission(left, right) {
-	const leftSession = left.context.authorization.session;
-	const rightSession = right.context.authorization.session;
-	return leftSession.tenantId === rightSession.tenantId && leftSession.principalId === rightSession.principalId && leftSession.walletId === rightSession.walletId && leftSession.authorityId === rightSession.authorityId && leftSession.walletAuthMethodId === rightSession.walletAuthMethodId && leftSession.authorityDigestB64u === rightSession.authorityDigestB64u && leftSession.authorityRevocationEpoch === rightSession.authorityRevocationEpoch && leftSession.authorizationId === rightSession.authorizationId && leftSession.walletSessionId === rightSession.walletSessionId && leftSession.quotaId === rightSession.quotaId && leftSession.expiresAtMs === rightSession.expiresAtMs && left.context.authority.authorityId === right.context.authority.authorityId && left.context.authority.authorityDigestB64u === right.context.authority.authorityDigestB64u && left.context.authMethod.walletAuthMethodId === right.context.authMethod.walletAuthMethodId && left.context.authMethod.walletAuthorityId === right.context.authMethod.walletAuthorityId && left.context.retiredAtMs === right.context.retiredAtMs && sameRouterAbMpcMaterialActivationRef(routerAbMpcMaterialActivationRefToWire(left.admission.materialActivation), routerAbMpcMaterialActivationRefToWire(right.admission.materialActivation));
-}
 async function authorizeStrictEcdsaV2ExportOperationStepUp(input) {
 	const operation = input.request.operation;
 	if (!operation) return strictEcdsaExportFailure(400, "invalid_body", "Operation step-up export requires operation preparation");
@@ -16999,8 +17020,8 @@ async function authorizeStrictEcdsaV2ExportOperationStepUp(input) {
 	});
 	if (resolution.kind === "unavailable") return strictEcdsaExportFailure(503, "wallet_session_unavailable", "Wallet Session authorization is unavailable");
 	if (resolution.kind !== "admitted") return strictEcdsaExportFailure(403, "scope_mismatch", "ECDSA export operation step-up Wallet Session authorization is invalid");
-	if (!sameWalletSessionOperationCredentialAdmission(input.authorization.v2Admission, resolution.admission)) return strictEcdsaExportFailure(403, "scope_mismatch", "ECDSA export operation step-up Wallet Session changed");
-	const session = resolution.admission.context.authorization.session;
+	if (!walletSessionAuthorizationV2RecordsEqual(input.authorization.v2Admission.context.authorization.session, resolution.context.session)) return strictEcdsaExportFailure(403, "scope_mismatch", "ECDSA export operation step-up Wallet Session changed");
+	const session = resolution.context.session;
 	const activeMaterial = resolution.activeMaterial;
 	if (input.request.authorization.kind !== "operation_step_up" || operation.operation_kind !== "evm.export_key" || operation.wallet_id !== String(session.walletId) || operation.wallet_id !== input.request.lifecycle.account_id || operation.material_activation.material_owner !== String(session.walletId) || operation.material_activation.signing_worker !== input.request.lifecycle.selected_server_id || operation.signing_worker_id !== input.request.lifecycle.selected_server_id || !sameRouterAbMpcMaterialActivationRef(operation.material_activation, input.request.material_activation) || operation.expires_at_ms < input.request.expires_at_ms || !strictEcdsaExportScopeMatchesRequest({
 		request: input.request,
@@ -17887,6 +17908,7 @@ async function handleHostedWalletSessionExchangeIssue(ctx) {
 		ok: true,
 		delivery: {
 			exchangeCode: delivery.exchangeCode,
+			home: delivery.home,
 			nonce: delivery.nonce,
 			appOrigin: delivery.appOrigin,
 			walletOrigin: delivery.walletOrigin,
@@ -19073,6 +19095,67 @@ async function handleSyncAccount(ctx) {
 	return null;
 }
 //#endregion
+//#region src/router/transport/fetch/routes/ed25519AuthorizedOperationRevalidation.ts
+function rejected(code, message, status) {
+	return {
+		ok: false,
+		response: json$1({
+			ok: false,
+			code,
+			message
+		}, { status })
+	};
+}
+function rejectedAdmission(kind) {
+	return kind === "authorization_grant_rejected" || kind === "verified_step_up_rejected" ? rejected(kind, "Ed25519 operation authorization is no longer active", 403) : rejected(kind, "Ed25519 operation admission failed", 409);
+}
+async function revalidateEd25519StepUpOperation(input) {
+	const stored = input.operation;
+	if (stored.authorization.kind !== "verified_step_up" || stored.quota.kind !== "quota_neutral") return rejected("verified_step_up_rejected", "Ed25519 operation step-up authorization has an invalid quota", 403);
+	const result = await input.ctx.service.authorizedOperations.admitAuthorizedOperation({ operation: {
+		tenantId: stored.tenantId,
+		authorizedOperationId: stored.authorizedOperationId,
+		auditEventId: stored.auditEventId,
+		operation: stored.operation,
+		authorization: stored.authorization,
+		quota: stored.quota,
+		claimedAtMs: Date.now()
+	} });
+	if (!("operation" in result)) return rejectedAdmission(result.kind);
+	if (result.operation.authorizedOperationId !== stored.authorizedOperationId) throw new Error("Ed25519 authorized operation changed during revalidation");
+	return {
+		ok: true,
+		operation: result.operation
+	};
+}
+/**
+* Finds the operation a reusable Wallet Session prepared and checks that its
+* grant is still active. A live operation returns the owner scope its
+* admission row pinned. A completed operation returns none: it replays its
+* stored response. The operation is read by its fingerprint, so a receipt
+* that names another operation ID has no stored operation.
+*/
+async function resolveEd25519WalletSessionOperation(input) {
+	const result = await input.ctx.service.authorizedOperations.resolveEd25519WalletSessionOperation({
+		tenantId: input.tenantId,
+		operationFingerprintDigest: input.operationFingerprintDigest,
+		walletId: input.walletId,
+		nowMs: Date.now()
+	});
+	if (result.kind === "authorized_operation_missing") return rejected("authorized_operation_missing", "Authorized operation is unavailable", 409);
+	if (!result.operation) return rejectedAdmission(result.kind);
+	const stored = result.operation;
+	if (stored.authorizedOperationId !== input.authorizedOperationId) return rejected("authorized_operation_missing", "Authorized operation is unavailable", 409);
+	if (stored.quota.kind !== "consume_reusable_wallet_session") return rejected("authorization_grant_rejected", "Ed25519 reusable operation authorization has an invalid quota", 403);
+	const operation = stored.operation.operation;
+	if (operation.capabilityKind !== "near_ed25519_mpc_signing" || operation.operationKind === "near.export_key") return rejected("authorization_grant_rejected", "Ed25519 reusable operation kind is invalid", 403);
+	return {
+		ok: true,
+		operation: stored,
+		ownerScope: result.ownerScope ?? null
+	};
+}
+//#endregion
 //#region src/router/domains/signingOperations/ed25519AuthorizedOperationReceipt.ts
 function requireEd25519OperationKind(value) {
 	if (value !== "near.sign_transaction" && value !== "near.sign_delegate_action" && value !== "near.sign_nep413_message") throw new Error("authorized_operation.operation_kind is invalid");
@@ -19446,151 +19529,56 @@ function parseRouterAbOperationStepUpOperation(value) {
 			message: "Router A/B step-up intent kind is invalid"
 		};
 	}
-	const operationId = parseCapabilityOperationId(intent.operation_id);
-	if (!operationId.ok) return {
-		ok: false,
-		message: operationId.error.message
-	};
-	return {
-		ok: true,
-		operationId: operationId.value,
-		operation: buildNearEd25519MpcOperationRef(operationKind)
-	};
-}
-function parseRouterAbEd25519NormalSigningOperationForAdmission(input) {
-	if (input.phase === "prepare") {
-		const requestedOperation = parseRouterAbOperationStepUpOperation(input.body.intent);
-		if (!requestedOperation.ok) return requestedOperation;
-		return {
-			ok: true,
-			operation: {
-				phase: "prepare",
-				operationKind: requestedOperation.operation.operationKind
-			}
-		};
-	}
-	try {
-		switch (input.authorizationKind) {
-			case "reusable_wallet_session": {
-				const receipt = parseEd25519ReusableAuthorizedOperationReceipt(input.body.authorized_operation);
-				return {
-					ok: true,
-					operation: {
-						phase: "finalize",
-						operationKind: receipt.operation_kind,
-						authorizationKind: "reusable_wallet_session",
-						receipt
-					}
-				};
-			}
-			case "operation_step_up": {
-				const receipt = parseEd25519VerifiedStepUpAuthorizedOperationReceipt(input.body.authorized_operation);
-				return {
-					ok: true,
-					operation: {
-						phase: "finalize",
-						operationKind: receipt.operation_kind,
-						authorizationKind: "operation_step_up",
-						receipt
-					}
-				};
-			}
-		}
-	} catch (error) {
-		return {
-			ok: false,
-			message: routerAbErrorMessage(error)
-		};
-	}
-}
-async function validateRouterAbEd25519V2FinalizeAuthorizedOperation(input) {
-	if (!input.authorizedOperations) return {
-		ok: false,
-		result: routerAbEd25519OwnerOperationFailureResult({
-			status: 501,
-			code: "not_configured",
-			message: "Reusable Wallet Session authorization is not configured",
-			phase: input.phase
-		})
-	};
-	let authorizedOperationId;
-	try {
-		authorizedOperationId = requireAuthorizationValue$2(parseAuthorizedOperationId(input.receipt.authorized_operation_id));
-		requireAuthorizationValue$2(parseCapabilityOperationId(input.receipt.operation_id));
-	} catch (error) {
-		return {
-			ok: false,
-			result: routerAbEd25519OwnerOperationFailureResult({
-				status: 400,
-				code: "invalid_authorized_operation",
-				message: routerAbErrorMessage(error),
-				phase: input.phase
-			})
-		};
-	}
-	let operation;
-	try {
-		operation = await input.authorizedOperations.readAuthorizedOperationById({
-			tenantId: input.authorizedOperations.tenantId,
-			authorizedOperationId
-		});
-	} catch (error) {
-		return {
-			ok: false,
-			result: routerAbEd25519OwnerOperationFailureResult({
-				status: 500,
-				code: "internal",
-				message: routerAbErrorMessage(error),
-				phase: input.phase
-			})
-		};
-	}
-	if (!operation) return {
-		ok: false,
-		result: routerAbEd25519OwnerOperationFailureResult({
-			status: 409,
-			code: "authorized_operation_missing",
-			message: "Authorized operation is unavailable",
-			phase: input.phase
-		})
-	};
-	const operationRef = operation.operation.operation;
-	if (operation.tenantId !== input.authorizedOperations.tenantId || operation.authorizedOperationId !== authorizedOperationId || operation.operation.operationId !== input.receipt.operation_id || operation.operationFingerprintDigest !== input.receipt.operation_fingerprint_digest || operation.operation.digests.laneDigest !== input.receipt.lane_digest_b64u || operation.operation.digests.intentDigest !== input.receipt.intent_digest_b64u || operation.operation.digests.displayDigest !== input.receipt.display_digest_b64u || operationRef.capabilityKind !== "near_ed25519_mpc_signing" || operationRef.operationKind !== input.receipt.operation_kind) return {
-		ok: false,
-		result: routerAbEd25519OwnerOperationFailureResult({
-			status: 400,
-			code: "invalid_authorized_operation",
-			message: "Ed25519 authorized operation does not match its receipt",
-			phase: input.phase
-		})
+	const operationId = parseCapabilityOperationId(intent.operation_id);
+	if (!operationId.ok) return {
+		ok: false,
+		message: operationId.error.message
+	};
+	return {
+		ok: true,
+		operationId: operationId.value,
+		operation: buildNearEd25519MpcOperationRef(operationKind)
 	};
-	switch (operationRef.operationKind) {
-		case "near.sign_transaction":
-		case "near.sign_delegate_action":
-		case "near.sign_nep413_message": return {
+}
+function parseRouterAbEd25519NormalSigningOperationForAdmission(input) {
+	if (input.phase === "prepare") {
+		const requestedOperation = parseRouterAbOperationStepUpOperation(input.body.intent);
+		if (!requestedOperation.ok) return requestedOperation;
+		return {
 			ok: true,
-			operationKind: operationRef.operationKind
+			operation: {
+				phase: "prepare",
+				operationKind: requestedOperation.operation.operationKind
+			}
 		};
 	}
-}
-async function authorizeRouterAbEd25519WalletSessionRequest(input) {
-	if (input.operation.phase === "finalize") {
-		const exactOperation = await validateRouterAbEd25519V2FinalizeAuthorizedOperation({
-			receipt: input.operation.receipt,
-			authorizedOperations: input.authorizedOperations,
-			phase: input.phase
-		});
-		if (!exactOperation.ok) return exactOperation;
-		if (exactOperation.operationKind !== input.admission.operationKind) return {
+	try {
+		switch (input.authorizationKind) {
+			case "reusable_wallet_session": return {
+				ok: true,
+				operation: {
+					phase: "finalize",
+					operationKind: parseEd25519ReusableAuthorizedOperationReceipt(input.body.authorized_operation).operation_kind,
+					authorizationKind: "reusable_wallet_session"
+				}
+			};
+			case "operation_step_up": return {
+				ok: true,
+				operation: {
+					phase: "finalize",
+					operationKind: parseEd25519VerifiedStepUpAuthorizedOperationReceipt(input.body.authorized_operation).operation_kind,
+					authorizationKind: "operation_step_up"
+				}
+			};
+		}
+	} catch (error) {
+		return {
 			ok: false,
-			result: routerAbEd25519OwnerOperationFailureResult({
-				status: 403,
-				code: "wallet_session_scope_mismatch",
-				message: "Exact Wallet Session operation does not match the authorized operation",
-				phase: input.phase
-			})
+			message: routerAbErrorMessage(error)
 		};
 	}
+}
+async function authorizeRouterAbEd25519WalletSessionRequest(input) {
 	const expectedMaterialActivation = routerAbMpcMaterialActivationRefFromWire(input.scope.material_activation);
 	const admittedMaterialActivation = routerAbMpcMaterialActivationRefToWire(input.admission.materialActivation);
 	const expiresAtMs = Number(input.body.expires_at_ms);
@@ -19623,7 +19611,8 @@ async function authorizeRouterAbEd25519WalletSessionRequest(input) {
 	};
 	const activeMaterial = await input.resolveEd25519MaterialActivation({
 		walletId: String(input.session.walletId),
-		materialActivation: admittedMaterialActivation
+		materialActivation: admittedMaterialActivation,
+		...input.signerRead ? { signerRead: input.signerRead } : {}
 	});
 	if (!activeMaterial.ok || !sameRouterAbMpcMaterialActivationRef(activeMaterial.materialActivation, admittedMaterialActivation) || activeMaterial.signingWorkerId !== input.scope.signing_worker_id || base64UrlEncode(Uint8Array.from(activeMaterial.exportIdentity.registered_public_key)) !== input.admission.signer.registeredPublicKeyB64u) return {
 		ok: false,
@@ -19644,6 +19633,7 @@ async function authorizeRouterAbEd25519WalletSessionRequest(input) {
 	const admissionDecision = await evaluateRouterAbNormalSigningAdmission({
 		adapter: input.admissionAdapter,
 		curve: "ed25519",
+		policyReadSource: input.policyReadSource,
 		authorizationKind: "wallet_session_operation_credential_v1",
 		phase: input.phase,
 		walletId: String(input.session.walletId),
@@ -19701,13 +19691,13 @@ async function resolveRouterAbEd25519ExhaustedCandidateAuthorization(input) {
 		phase: input.phase,
 		body: input.body,
 		scope: input.scope,
-		operation: input.operation,
 		session,
 		authorityId: String(candidate.authority.authorityId),
 		admission,
-		authorizedOperations: input.authorizedOperations,
 		admissionAdapter: input.admissionAdapter,
-		resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation
+		resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation,
+		signerRead: null,
+		policyReadSource: { kind: "database" }
 	});
 	if (!authorized.ok) return authorized;
 	return {
@@ -19770,7 +19760,8 @@ async function authorizeRouterAbEd25519NormalSigningRoute(input) {
 	const validated = await validateRouterAbEd25519WalletSessionInputs({
 		headers: input.headers,
 		authorizationSessions: input.authorizationSessions,
-		operationKind: operationForAdmission.operation.operationKind
+		operationKind: operationForAdmission.operation.operationKind,
+		materialActivation: scope.material_activation
 	});
 	if (!validated.ok) {
 		const operation = operationForAdmission.operation;
@@ -19781,7 +19772,6 @@ async function authorizeRouterAbEd25519NormalSigningRoute(input) {
 				scope,
 				phase: input.phase,
 				operation,
-				authorizedOperations: input.authorizedOperations,
 				authorizationSessions: input.authorizationSessions,
 				admissionAdapter: input.admissionAdapter,
 				resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation
@@ -19819,13 +19809,16 @@ async function authorizeRouterAbEd25519NormalSigningRoute(input) {
 		phase: input.phase,
 		body: input.body,
 		scope,
-		operation,
 		session: validated.admission.context.authorization.session,
 		authorityId: String(validated.admission.context.authority.authorityId),
 		admission: validated.admission.admission,
-		authorizedOperations: input.authorizedOperations,
 		admissionAdapter: input.admissionAdapter,
-		resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation
+		resolveEd25519MaterialActivation: input.resolveEd25519MaterialActivation,
+		signerRead: validated.signerRead,
+		policyReadSource: {
+			kind: "credential_snapshot",
+			policyRead: validated.policyRead
+		}
 	});
 	if (!authorized.ok) return authorized;
 	return {
@@ -20154,11 +20147,12 @@ function ed25519ReusableWalletSessionIdentity(authorization) {
 		quotaId: session.quotaId
 	};
 }
-function buildEd25519GatewayOwnerWalletSessionBinding(authorization, projectEnvironmentId) {
+function buildEd25519GatewayOwnerWalletSessionBinding(authorization, pinned) {
 	const session = ed25519ReusableWalletSession(authorization);
 	const runtimePolicyScope = authorization.activeMaterial.runtimePolicyScope;
 	return {
 		kind: "gateway_owner_wallet_session",
+		ownershipGeneration: pinned.ownershipGeneration,
 		subjectId: String(session.principalId),
 		accountId: String(session.walletId),
 		authorizationId: String(session.authorizationId),
@@ -20168,20 +20162,16 @@ function buildEd25519GatewayOwnerWalletSessionBinding(authorization, projectEnvi
 		orgId: runtimePolicyScope.orgId,
 		projectId: runtimePolicyScope.projectId,
 		environment: runtimePolicyScope.envId,
-		projectEnvironmentId,
+		projectEnvironmentId: pinned.projectEnvironmentId,
 		signingWorkerId: authorization.activeMaterial.signingWorkerId,
 		expiresAtMs: session.expiresAtMs
 	};
 }
-async function readPinnedEd25519WalletProjectEnvironmentId(ctx, authorization, operation) {
-	const session = ed25519ReusableWalletSession(authorization);
+/** The scope the operation's own admission pinned, checked against the active material. */
+function pinnedEd25519WalletScope(authorization, pinned) {
 	const scope = authorization.activeMaterial.runtimePolicyScope;
-	const pinned = await ctx.service.authorizedOperations.readPinnedOwnerWalletScope({
-		operation,
-		walletId: session.walletId
-	});
 	if (pinned.orgId !== scope.orgId || pinned.projectId !== scope.projectId) throw new Error("Pinned owner Wallet Session scope differs from active material");
-	return pinned.projectEnvironmentId;
+	return pinned;
 }
 /**
 * The Router binding for a verified step-up: the wallet it signs for and the
@@ -20197,6 +20187,7 @@ async function ed25519OperationStepUpBinding(ctx, session, operation) {
 	if (pinned.orgId !== scope.orgId || pinned.projectId !== scope.projectId) throw new Error("Step-up wallet scope differs from the Wallet Session scope");
 	return {
 		kind: "operation_step_up",
+		ownershipGeneration: pinned.ownershipGeneration,
 		authorizationSessionId: session.sessionId,
 		orgId: scope.orgId,
 		projectId: scope.projectId,
@@ -20211,7 +20202,7 @@ function buildRouterAbEd25519AuthorizedOperationWire(input) {
 	const operationRef = operation.operation.operation;
 	if (operationRef.capabilityKind !== "near_ed25519_mpc_signing") throw new Error("Ed25519 authorized operation capability is invalid");
 	const operationKind = requireEd25519OperationKind(operationRef.operationKind);
-	const commonAuthorizedOperation = {
+	return buildAuthorizedOperationWire(input, {
 		authorized_operation_id: operation.authorizedOperationId,
 		operation_id: operation.operation.operationId,
 		capability_kind: "near_ed25519_mpc_signing",
@@ -20220,66 +20211,7 @@ function buildRouterAbEd25519AuthorizedOperationWire(input) {
 		intent_digest_b64u: operation.operation.digests.intentDigest,
 		display_digest_b64u: operation.operation.digests.displayDigest,
 		operation_fingerprint_digest: operation.operationFingerprintDigest
-	};
-	switch (input.binding.kind) {
-		case "reusable_wallet_session":
-			if (operation.authorization.kind !== "authorization_grant" || operation.quota.kind !== "consume_reusable_wallet_session") throw new Error("Reusable Wallet Session authorized operation is invalid");
-			return {
-				binding: {
-					kind: "reusable_wallet_session",
-					authorization_id: operation.authorization.authorizationGrantRef.authorizationId,
-					wallet_session_id: input.binding.walletSessionId,
-					quota_id: input.binding.quotaId
-				},
-				authorized_operation: {
-					kind: "reusable_wallet_session_authorized_operation_v1",
-					...commonAuthorizedOperation
-				}
-			};
-		case "gateway_owner_wallet_session":
-			if (operation.authorization.kind !== "authorization_grant" || operation.quota.kind !== "consume_reusable_wallet_session") throw new Error("Gateway owner Wallet Session authorized operation is invalid");
-			return {
-				binding: {
-					kind: "gateway_owner_wallet_session",
-					subject_id: input.binding.subjectId,
-					account_id: input.binding.accountId,
-					authorization_id: input.binding.authorizationId,
-					wallet_session_id: input.binding.walletSessionId,
-					quota_id: input.binding.quotaId,
-					threshold_session_id: input.binding.thresholdSessionId,
-					org_id: input.binding.orgId,
-					project_id: input.binding.projectId,
-					environment: input.binding.environment,
-					project_environment_id: input.binding.projectEnvironmentId,
-					signing_worker_id: input.binding.signingWorkerId,
-					expires_at_ms: input.binding.expiresAtMs
-				},
-				authorized_operation: {
-					kind: "reusable_wallet_session_authorized_operation_v1",
-					...commonAuthorizedOperation
-				}
-			};
-		case "operation_step_up":
-			if (operation.authorization.kind !== "verified_step_up" || operation.quota.kind !== "quota_neutral") throw new Error("Verified step-up authorized operation is invalid");
-			return {
-				binding: {
-					kind: "operation_step_up",
-					authorization_session_id: input.binding.authorizationSessionId,
-					org_id: input.binding.orgId,
-					project_id: input.binding.projectId,
-					environment: input.binding.environment,
-					project_environment_id: input.binding.projectEnvironmentId,
-					subject_id: input.binding.subjectId,
-					account_id: input.binding.accountId
-				},
-				authorized_operation: {
-					kind: "verified_step_up_authorized_operation_v1",
-					authorization_session_id: input.binding.authorizationSessionId,
-					evidence_set_digest: operation.authorization.evidenceSetDigest,
-					...commonAuthorizedOperation
-				}
-			};
-	}
+	});
 }
 async function releaseEmailOtpFactorForWorker(input) {
 	const unsealed = await input.emailOtp.removeEmailOtpServerSeal({ wrappedCiphertext: input.request.enrollment.serverSealedFactorCiphertextB64u });
@@ -20438,21 +20370,24 @@ async function authorizeEd25519ReusableWalletSessionOperation(input) {
 			}
 		});
 		const authorizedOperationId = requireAuthorizationValue(parseAuthorizedOperationId(`ed25519-operation:${operation.operationId}:${scope.request_id}`));
-		const outcome = await input.ctx.service.authorizedOperations.admitAuthorizedOperation({ operation: {
-			tenantId: identity.tenantId,
-			authorizedOperationId,
-			auditEventId: requireAuthorizationValue(parseAuthorizationAuditEventId(`ed25519-operation-audit:${operation.operationId}`)),
-			operation: envelope,
-			authorization: {
-				kind: "authorization_grant",
-				authorizationGrantRef: buildAuthorizationGrantRef(identity.authorizationId)
-			},
-			quota: {
-				kind: "consume_reusable_wallet_session",
-				quotaId: identity.quotaId
+		const outcome = await input.ctx.service.authorizedOperations.admitEd25519WalletSessionOperation({
+			operation: {
+				tenantId: identity.tenantId,
+				authorizedOperationId,
+				auditEventId: requireAuthorizationValue(parseAuthorizationAuditEventId(`ed25519-operation-audit:${operation.operationId}`)),
+				operation: envelope,
+				authorization: {
+					kind: "authorization_grant",
+					authorizationGrantRef: buildAuthorizationGrantRef(identity.authorizationId)
+				},
+				quota: {
+					kind: "consume_reusable_wallet_session",
+					quotaId: identity.quotaId
+				},
+				claimedAtMs: nowMs
 			},
-			claimedAtMs: nowMs
-		} });
+			walletId: session.walletId
+		});
 		if (outcome.kind !== "claimed" && outcome.kind !== "operation_in_progress" && outcome.kind !== "replayed") {
 			const stepUpMaterial = await input.ctx.service.walletRegistration.resolveEd25519MaterialActivation({
 				walletId: scope.account_id,
@@ -20487,6 +20422,7 @@ async function authorizeEd25519ReusableWalletSessionOperation(input) {
 			admission: {
 				kind: "claimed",
 				operation: outcome.operation,
+				ownerScope: outcome.ownerScope,
 				receipt: {
 					kind: "reusable_wallet_session_authorized_operation_v1",
 					authorized_operation_id: outcome.operation.authorizedOperationId,
@@ -20511,101 +20447,6 @@ async function authorizeEd25519ReusableWalletSessionOperation(input) {
 		};
 	}
 }
-async function revalidateEd25519AuthorizedOperation(input) {
-	let admission;
-	if (input.operation.authorization.kind === "verified_step_up") {
-		if (input.operation.quota.kind !== "quota_neutral") return {
-			ok: false,
-			response: json$1({
-				ok: false,
-				code: "verified_step_up_rejected",
-				message: "Ed25519 operation step-up authorization has an invalid quota"
-			}, { status: 403 })
-		};
-		admission = {
-			tenantId: input.operation.tenantId,
-			authorizedOperationId: input.operation.authorizedOperationId,
-			auditEventId: input.operation.auditEventId,
-			operation: input.operation.operation,
-			authorization: input.operation.authorization,
-			quota: input.operation.quota,
-			claimedAtMs: Date.now()
-		};
-	} else {
-		if (input.operation.quota.kind !== "consume_reusable_wallet_session") return {
-			ok: false,
-			response: json$1({
-				ok: false,
-				code: "authorization_grant_rejected",
-				message: "Ed25519 reusable operation authorization has an invalid quota"
-			}, { status: 403 })
-		};
-		const operation = buildEd25519ReusableOperationEnvelope(input.operation);
-		if (!operation) return {
-			ok: false,
-			response: json$1({
-				ok: false,
-				code: "authorization_grant_rejected",
-				message: "Ed25519 reusable operation kind is invalid"
-			}, { status: 403 })
-		};
-		admission = {
-			tenantId: input.operation.tenantId,
-			authorizedOperationId: input.operation.authorizedOperationId,
-			auditEventId: input.operation.auditEventId,
-			operation,
-			authorization: input.operation.authorization,
-			quota: input.operation.quota,
-			claimedAtMs: Date.now()
-		};
-	}
-	const result = await input.ctx.service.authorizedOperations.admitAuthorizedOperation({ operation: admission });
-	switch (result.kind) {
-		case "claimed":
-		case "operation_in_progress":
-		case "replayed":
-			if (result.operation.authorizedOperationId !== input.operation.authorizedOperationId) throw new Error("Ed25519 authorized operation changed during revalidation");
-			return {
-				ok: true,
-				operation: result.operation
-			};
-		case "authorization_grant_rejected":
-		case "verified_step_up_rejected": return {
-			ok: false,
-			response: json$1({
-				ok: false,
-				code: result.kind,
-				message: "Ed25519 operation authorization is no longer active"
-			}, { status: 403 })
-		};
-		case "wallet_session_quota_exhausted":
-		case "material_mismatch": return {
-			ok: false,
-			response: json$1({
-				ok: false,
-				code: result.kind,
-				message: "Ed25519 operation admission failed"
-			}, { status: 409 })
-		};
-	}
-}
-function buildEd25519ReusableOperationEnvelope(operation) {
-	const operationRef = operation.operation.operation;
-	if (operationRef.capabilityKind !== "near_ed25519_mpc_signing") return null;
-	switch (operationRef.operationKind) {
-		case "near.sign_transaction":
-		case "near.sign_delegate_action":
-		case "near.sign_nep413_message": return buildCapabilityOperationEnvelope({
-			tenantId: operation.operation.tenantId,
-			principalId: operation.operation.principalId,
-			capabilityId: operation.operation.capabilityId,
-			operationId: operation.operation.operationId,
-			operation: buildNearEd25519MpcOperationRef(operationRef.operationKind),
-			digests: operation.operation.digests
-		});
-		case "near.export_key": return null;
-	}
-}
 async function validateEd25519ReusableAuthorizedOperation(input) {
 	try {
 		const receipt = parseEd25519ReusableAuthorizedOperationReceipt(input.body.authorized_operation);
@@ -20614,7 +20455,7 @@ async function validateEd25519ReusableAuthorizedOperation(input) {
 		const identity = ed25519ReusableWalletSessionIdentity(input.authorization);
 		const capabilityId = requireAuthorizationValue(parseCapabilityId(scope.material_activation.capability));
 		const operationId = requireAuthorizationValue(parseCapabilityOperationId(receipt.operation_id));
-		const fingerprint = await computeCapabilityOperationFingerprintDigest(buildCapabilityOperationEnvelope({
+		const envelope = buildCapabilityOperationEnvelope({
 			tenantId: identity.tenantId,
 			principalId: identity.principalId,
 			capabilityId,
@@ -20628,31 +20469,39 @@ async function validateEd25519ReusableAuthorizedOperation(input) {
 				intentDigest: parseDigestB64u(receipt.intent_digest_b64u),
 				displayDigest: parseDigestB64u(receipt.display_digest_b64u)
 			}
-		}));
+		});
+		const fingerprint = await computeCapabilityOperationFingerprintDigest(envelope);
 		if (fingerprint !== parseCapabilityOperationFingerprintDigest(receipt.operation_fingerprint_digest)) throw new Error("Ed25519 authorized operation fingerprint changed");
 		if (digestWireB64u((isPlainObject(input.body.prepare_binding) ? input.body.prepare_binding : null)?.intent_digest, "prepare_binding.intent_digest") !== receipt.intent_digest_b64u) throw new Error("Ed25519 authorized operation intent changed after prepare");
-		const operationResult = await input.ctx.service.authorizedOperations.readAuthorizedOperation({
-			tenantId: identity.tenantId,
-			operationFingerprintDigest: fingerprint
-		});
-		if (!operationResult) return {
-			ok: false,
-			response: json$1({
+		const authorizedOperationId = requireAuthorizationValue(parseAuthorizedOperationId(receipt.authorized_operation_id));
+		let resolved;
+		try {
+			resolved = await resolveEd25519WalletSessionOperation({
+				ctx: input.ctx,
+				tenantId: identity.tenantId,
+				authorizedOperationId,
+				operationFingerprintDigest: fingerprint,
+				walletId: ed25519ReusableWalletSession(input.authorization).walletId
+			});
+		} catch {
+			return {
 				ok: false,
-				code: "authorized_operation_missing",
-				message: "Authorized operation is unavailable"
-			}, { status: 409 })
-		};
-		if (operationResult.authorizedOperationId !== requireAuthorizationValue(parseAuthorizedOperationId(receipt.authorized_operation_id)) || operationResult.operationFingerprintDigest !== fingerprint) throw new Error("Ed25519 authorized operation identity changed after prepare");
-		const revalidated = await revalidateEd25519AuthorizedOperation({
-			ctx: input.ctx,
-			operation: operationResult
-		});
-		return revalidated.ok ? {
+				response: json$1({
+					ok: false,
+					code: "internal",
+					message: "Authorized operation lookup failed"
+				}, { status: 500 })
+			};
+		}
+		if (!resolved.ok) return resolved;
+		const operationResult = resolved.operation;
+		if (operationResult.tenantId !== identity.tenantId || operationResult.tenantId !== input.ctx.service.authorizedOperations.tenantId || operationResult.operationFingerprintDigest !== fingerprint || operationResult.operation.operationId !== operationId || operationResult.operation.digests.laneDigest !== envelope.digests.laneDigest || operationResult.operation.digests.intentDigest !== envelope.digests.intentDigest || operationResult.operation.digests.displayDigest !== envelope.digests.displayDigest || operationResult.operation.operation.capabilityKind !== "near_ed25519_mpc_signing" || operationResult.operation.operation.operationKind !== receipt.operation_kind) throw new Error("Ed25519 authorized operation identity changed after prepare");
+		return {
 			ok: true,
 			receipt,
-			operation: revalidated.operation
-		} : revalidated;
+			operation: operationResult,
+			ownerScope: resolved.ownerScope
+		};
 	} catch (error) {
 		return {
 			ok: false,
@@ -20718,7 +20567,7 @@ async function validateEd25519VerifiedStepUpAuthorizedOperation(input) {
 		};
 		if (operationResult.authorizedOperationId !== requireAuthorizationValue(parseAuthorizedOperationId(receipt.authorized_operation_id)) || operationResult.operationFingerprintDigest !== fingerprint) throw new Error("Operation step-up authorized operation identity changed after prepare");
 		if (operationResult.authorization.kind !== "verified_step_up" || operationResult.authorization.evidenceSetDigest !== parseDigestB64u(receipt.evidence_set_digest)) throw new Error("Operation step-up evidence changed after prepare");
-		const revalidated = await revalidateEd25519AuthorizedOperation({
+		const revalidated = await revalidateEd25519StepUpOperation({
 			ctx: input.ctx,
 			operation: operationResult
 		});
@@ -21181,13 +21030,15 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 					bodyText: upstreamBodyText
 				})
 			}));
-			return new Response(JSON.stringify({
+			const headers = new Headers(upstream.headers);
+			headers.delete("content-length");
+			return new Response(JSON.stringify(signingPrepareSessionResponse({
 				...upstreamBody,
 				authorized_operation: buildEd25519VerifiedStepUpAuthorizedOperationReceipt({ authorization })
-			}), {
+			}, authorization)), {
 				status: upstream.status,
 				statusText: upstream.statusText,
-				headers: new Headers(upstream.headers)
+				headers
 			});
 		}
 		if (authorization.phase !== "finalize") throw new Error("Operation step-up finalize authorization phase changed");
@@ -21261,7 +21112,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 				...input.body,
 				authorized_operation: buildRouterAbEd25519AuthorizedOperationWire({
 					operation: execution.operation,
-					binding: { ...buildEd25519GatewayOwnerWalletSessionBinding(authorization, await readPinnedEd25519WalletProjectEnvironmentId(input.ctx, authorization, execution.operation)) }
+					binding: buildEd25519GatewayOwnerWalletSessionBinding(authorization, pinnedEd25519WalletScope(authorization, authorized.admission.ownerScope))
 				})
 			}
 		});
@@ -21285,13 +21136,15 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 				bodyText: upstreamBodyText
 			})
 		}));
-		return new Response(JSON.stringify({
+		const headers = new Headers(upstream.headers);
+		headers.delete("content-length");
+		return new Response(JSON.stringify(signingPrepareSessionResponse({
 			...upstreamBody,
 			authorized_operation: authorized.admission.receipt
-		}), {
+		}, authorization)), {
 			status: upstream.status,
 			statusText: upstream.statusText,
-			headers: new Headers(upstream.headers)
+			headers
 		});
 	}
 	const validatedAuthorization = await validateEd25519ReusableAuthorizedOperation({
@@ -21302,6 +21155,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 	if (!validatedAuthorization.ok) return validatedAuthorization.response;
 	const replay = replayCompletedEd25519Operation(validatedAuthorization.operation);
 	if (replay) return replay;
+	if (!validatedAuthorization.ownerScope) throw new Error("Pinned owner Wallet Session scope is unavailable");
 	const upstream = await proxyEd25519OwnerLaneExecution({
 		ctx: input.ctx,
 		authorization,
@@ -21310,7 +21164,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 			...input.body,
 			authorized_operation: buildRouterAbEd25519AuthorizedOperationWire({
 				operation: validatedAuthorization.operation,
-				binding: { ...buildEd25519GatewayOwnerWalletSessionBinding(authorization, await readPinnedEd25519WalletProjectEnvironmentId(input.ctx, authorization, validatedAuthorization.operation)) }
+				binding: buildEd25519GatewayOwnerWalletSessionBinding(authorization, pinnedEd25519WalletScope(authorization, validatedAuthorization.ownerScope))
 			})
 		}
 	});
@@ -21442,7 +21296,7 @@ function parsePreflightRequest(raw) {
 	if (!isPlainObject(raw)) throw new Error("owner execution-lane preflight body is required");
 	const fields = Object.keys(raw).sort();
 	if (fields.length !== 2 || fields[0] !== "curve" || fields[1] !== "expectedMaterialActivation") throw new Error("owner execution-lane preflight body fields are invalid");
-	if (raw.curve !== "ed25519" && raw.curve !== "ecdsa_secp256k1") throw new Error("owner execution-lane preflight curve is invalid");
+	if (raw.curve !== "ecdsa_secp256k1") throw new Error("owner execution-lane preflight curve is invalid");
 	const materialActivation = parseMpcMaterialActivationRef(raw.expectedMaterialActivation);
 	if (!materialActivation.ok) throw new Error(materialActivation.error.message);
 	return {
@@ -21592,46 +21446,24 @@ async function handleOwnerWalletExecutionLanePreflight(ctx) {
 		}, { status: 400 });
 	}
 	const headers = Object.fromEntries(ctx.request.headers.entries());
-	let walletIdRaw;
-	let authorization;
-	if (request.curve === "ed25519") {
-		const validated = await validateRouterAbEd25519WalletSessionInputs({
-			headers,
-			authorizationSessions: ctx.service.authorizationSessions,
-			operationKind: NEAR_ED25519_MPC_OPERATION_KINDS.signTransaction
-		});
-		if (!validated.ok) return validationFailure(validated);
-		walletIdRaw = String(validated.admission.context.authorization.session.walletId);
-		authorization = {
-			kind: "wallet_auth_method",
-			walletAuthMethodId: validated.admission.context.authorization.session.walletAuthMethodId
-		};
-	} else {
-		const validated = await validateRouterAbEcdsaDerivationWalletSessionInputs({
-			materialActivation: routerAbMpcMaterialActivationRefToWire(request.expectedMaterialActivation),
-			headers,
-			authorizationSessions: ctx.service.authorizationSessions,
-			operationKind: EVM_ECDSA_MPC_OPERATION_KINDS.signTransaction
-		});
-		if (!validated.ok) return validationFailure(validated);
-		if (validated.kind === "wallet_session_operation_credential_exhausted_candidate_v1") return validationFailure(walletSessionFailure("wallet_session_unavailable"));
-		walletIdRaw = String(validated.admission.context.authorization.session.walletId);
-		authorization = {
-			kind: "wallet_auth_method",
-			walletAuthMethodId: validated.admission.context.authorization.session.walletAuthMethodId
-		};
-	}
-	const walletId = parseWalletId(walletIdRaw);
-	if (!walletId.ok) return validationFailure({
-		code: WALLET_SESSION_FAILURE_CODES.invalid,
-		message: "Wallet Session wallet identity is invalid"
+	const validated = await validateRouterAbEcdsaDerivationWalletSessionInputs({
+		materialActivation: routerAbMpcMaterialActivationRefToWire(request.expectedMaterialActivation),
+		headers,
+		authorizationSessions: ctx.service.authorizationSessions,
+		operationKind: EVM_ECDSA_MPC_OPERATION_KINDS.signTransaction
 	});
+	if (!validated.ok) return validationFailure(validated);
+	if (validated.kind === "wallet_session_operation_credential_exhausted_candidate_v1") return validationFailure(walletSessionFailure("wallet_session_unavailable"));
+	const session = validated.admission.context.authorization.session;
 	let resolved;
 	try {
 		resolved = await ctx.service.walletRegistration.resolveActiveOwnerWalletExecutionLane({
-			walletId: walletId.value,
+			walletId: session.walletId,
 			expectedMaterialActivation: request.expectedMaterialActivation,
-			authorization
+			authorization: {
+				kind: "wallet_auth_method",
+				walletAuthMethodId: session.walletAuthMethodId
+			}
 		});
 	} catch {
 		return json$1({
@@ -24834,6 +24666,12 @@ async function routerAbEd25519YaoTenantRootWireV1(root) {
 		custody_lineage_b64u: root.custodyLineageB64u
 	};
 }
+function routerAbEd25519YaoRegistrationSigningRootIdV1(admissionRequest) {
+	return {
+		signing_root_id: admissionRequest.application_binding.signing_root_id,
+		root_share_epoch: admissionRequest.scope.root_share_epoch
+	};
+}
 //#endregion
 //#region src/router/domains/ed25519Yao/registration/routerAbEd25519YaoHttpRegistrationBackend.ts
 const INTERNAL_AUTH_HEADER = "x-router-ab-internal-service-auth";
@@ -25041,6 +24879,7 @@ function registrationRouterExecuteRequest(input, tenantRoot) {
 		participant_ids: input.admissionRequest.participant_ids,
 		target: {
 			operation: "registration",
+			ownership_generation: input.ownershipGeneration,
 			binding: input.request.binding,
 			deriver_a_input: input.request.deriver_a_input,
 			deriver_b_input: input.request.deriver_b_input
@@ -25054,6 +24893,7 @@ function recoveryRouterExecuteRequest(input, tenantRoot, attempt) {
 		participant_ids: input.admissionRequest.participant_ids,
 		target: {
 			operation: "recovery",
+			ownership_generation: input.ownershipGeneration,
 			binding: input.request.binding,
 			attempt,
 			deriver_a_input: input.request.deriver_a_input,
@@ -25066,7 +24906,7 @@ async function routerExecuteRequest(input, resolveTenantRoot) {
 	switch (input.operation) {
 		case "registration": return registrationRouterExecuteRequest(input, await routerAbEd25519YaoTenantRootWireV1(await resolveTenantRoot({
 			operation: "registration",
-			admissionRequest: input.admissionRequest
+			...routerAbEd25519YaoRegistrationSigningRootIdV1(input.admissionRequest)
 		})));
 		case "export": return {
 			tenant_root: await routerAbEd25519YaoTenantRootWireV1(await resolveTenantRoot({
@@ -25077,6 +24917,7 @@ async function routerExecuteRequest(input, resolveTenantRoot) {
 			participant_ids: input.admissionRequest.participant_ids,
 			target: {
 				operation: "export",
+				ownership_generation: input.ownershipGeneration,
 				binding: input.request.binding,
 				deriver_a_input: input.request.deriver_a_input,
 				deriver_b_input: input.request.deriver_b_input
@@ -25273,11 +25114,12 @@ var RouterAbEd25519YaoHttpRegistrationBackend = class {
 			}
 		};
 	}
-	async executeExport(request, admissionRequest, traceContext) {
+	async executeExport(request, claim, traceContext) {
 		return await this.executeRouterRequest({
 			operation: "export",
 			request,
-			admissionRequest
+			admissionRequest: claim.admissionRequest,
+			ownershipGeneration: claim.ownershipGeneration
 		}, false, traceContext);
 	}
 	keyset() {
@@ -25344,34 +25186,37 @@ var RouterAbEd25519YaoHttpRegistrationBackend = class {
 			};
 		}
 	}
-	async execute(request, admissionRequest, traceContext) {
+	async execute(request, admissionRequest, ownershipGeneration, traceContext) {
 		return await this.executeRouterRequest({
 			operation: "registration",
 			request,
-			admissionRequest
+			admissionRequest,
+			ownershipGeneration
 		}, false, traceContext);
 	}
-	async resolveRegistrationDispatchRoot(admissionRequest) {
+	async resolveRegistrationDispatchRoot(signingRootId) {
 		return await routerAbEd25519YaoTenantRootWireV1(await this.config.resolveTenantRoot({
 			operation: "registration",
-			admissionRequest
+			...signingRootId
 		}));
 	}
-	async executePinnedRegistration(request, admissionRequest, dispatchRoot, traceContext) {
+	async executePinnedRegistration(request, authority, traceContext) {
 		const routerInput = {
 			operation: "registration",
 			request,
-			admissionRequest
+			admissionRequest: authority.admissionRequest,
+			ownershipGeneration: authority.ownershipGeneration
 		};
-		return await this.sendRouterRequest(routerInput, registrationRouterExecuteRequest(routerInput, dispatchRoot), traceContext.value, "exact", false);
+		return await this.sendRouterRequest(routerInput, registrationRouterExecuteRequest(routerInput, authority.dispatchRoot), traceContext.value, "exact", false);
 	}
 	async consumeRegistration(input) {
 		let response;
 		try {
-			response = await this.post(ROUTER_REGISTRATION_CONSUME_PATH, {
-				tenant_root: input.tenantRoot,
-				wallet_id: input.walletId,
-				lifecycle_id: input.lifecycleId,
+			response = await this.post(ROUTER_REGISTRATION_CONSUME_PATH, walletObjectIdentity(input.authority.admissionReceipt.binding.lifecycle.account_id, input.authority.ownershipGeneration, input.authority.dispatchRoot.identity), {
+				tenant_root: input.authority.dispatchRoot,
+				ownership_generation: input.authority.ownershipGeneration,
+				wallet_id: input.authority.admissionReceipt.binding.lifecycle.account_id,
+				lifecycle_id: input.authority.lifecycleId,
 				session_id: Array.from(input.sessionId),
 				consumer_binding: input.consumerBinding
 			}, createRouterAbTraceContextV1().value, "exact");
@@ -25393,13 +25238,14 @@ var RouterAbEd25519YaoHttpRegistrationBackend = class {
 			admissionRequest
 		}));
 	}
-	async executeRecovery(request, admissionRequest, dispatchRoot, attempt, replay, traceContext) {
+	async executeRecovery(request, claim, traceContext) {
 		const routerInput = {
 			operation: "recovery",
 			request,
-			admissionRequest
+			admissionRequest: claim.admissionRequest,
+			ownershipGeneration: claim.ownershipGeneration
 		};
-		return await this.sendRouterRequest(routerInput, recoveryRouterExecuteRequest(routerInput, dispatchRoot, attempt), (traceContext ?? createRouterAbTraceContextV1()).value, "replay", replay);
+		return await this.sendRouterRequest(routerInput, recoveryRouterExecuteRequest(routerInput, claim.dispatchRoot, claim.attempt), (traceContext ?? createRouterAbTraceContextV1()).value, "replay", claim.replay);
 	}
 	async executeRouterRequest(request, replay, traceContext) {
 		const traceId = (traceContext ?? createRouterAbTraceContextV1()).value;
@@ -25419,7 +25265,7 @@ var RouterAbEd25519YaoHttpRegistrationBackend = class {
 		const operation = request.operation;
 		const executeStartedAt = performance.now();
 		try {
-			const response = await this.post(ROUTER_EXECUTE_PATH, routerRequest, traceId, retryAfterTransportFailure, replay);
+			const response = await this.post(ROUTER_EXECUTE_PATH, walletObjectIdentity(request.admissionRequest.application_binding.wallet_id, request.ownershipGeneration, routerRequest.tenant_root.identity), routerRequest, traceId, retryAfterTransportFailure, replay);
 			this.lastRouterServerTiming = response.ok ? response.serverTiming : null;
 			const result = response.ok ? parseRouterExecuteResult(response.body, request.request) : response;
 			emitGatewaySpan(this.config.onSpan, "gateway.yao_execute", operation, traceId, executeStartedAt, result.ok ? "success" : "failure");
@@ -25429,10 +25275,11 @@ var RouterAbEd25519YaoHttpRegistrationBackend = class {
 			return unavailableFailure(error);
 		}
 	}
-	async activateRecovery(request, dispatchRoot, traceContext) {
-		const promoted = await this.post(ROUTER_RECOVERY_PROMOTE_PATH, {
+	async activateRecovery(request, dispatchRoot, ownershipGeneration, traceContext) {
+		const promoted = await this.post(ROUTER_RECOVERY_PROMOTE_PATH, walletObjectIdentity(request.binding.lifecycle.account_id, ownershipGeneration, dispatchRoot.identity), {
 			...request,
-			tenant_root: dispatchRoot
+			tenant_root: dispatchRoot,
+			ownership_generation: ownershipGeneration
 		}, (traceContext ?? createRouterAbTraceContextV1()).value);
 		if (!promoted.ok) return promoted;
 		if (!activeReceiptMatchesRecoveryActivation(parseActiveSigningWorkerReceipt(promoted.body, request.binding.session_id, request.public_receipt.transcript), request)) return internalFailure("recovery_promotion_mismatch", "Router promotion receipt does not match the verified recovery result");
@@ -25441,10 +25288,13 @@ var RouterAbEd25519YaoHttpRegistrationBackend = class {
 			body: request
 		};
 	}
-	async post(path, body, traceId, retryAfterTransportFailure = "none", replay = false) {
+	async post(path, identity, body, traceId, retryAfterTransportFailure = "none", replay = false) {
 		const init = {
 			method: "POST",
-			headers: this.headers(traceId),
+			headers: {
+				...this.headers(traceId),
+				...walletObjectIdentityHeaders(identity)
+			},
 			body: JSON.stringify(body)
 		};
 		return await this.request(this.config.routerUrl, path, replay ? requestInitWithReplayHeader(init) : init, retryAfterTransportFailure);
@@ -25484,7 +25334,6 @@ function parseRouterServerTiming(value) {
 	const metrics = value.split(",").map((metric) => metric.trim());
 	const allowedNames = new Set([
 		"yao_router_prepare_pair",
-		"yao_router_verify_readiness",
 		"yao_router_role_execution",
 		"yao_router_signing_worker_delivery"
 	]);
@@ -25631,7 +25480,7 @@ var RouterAbEd25519YaoRegistrationRouteExtension = class {
 			body: parsed.value
 		});
 		if (!authorization.ok) return routeFailureResponse$1(authorization);
-		const result = await this.service.execute(parsed.value, traceContext.value);
+		const result = await this.service.execute(parsed.value, authorization.ownershipGeneration, traceContext.value);
 		if (!result.ok) return routeFailureResponse$1(result);
 		return json$1(result.value, { status: result.status });
 	}
@@ -25662,11 +25511,17 @@ function resolveTraceContext$1(request) {
 		message: parsed.message
 	};
 }
-function recoveryAuthorizationBinding(authorization) {
-	if (authorization.kind === "wallet_recovery") return authorization;
+function recoveryAuthorizationBinding(admitted) {
+	const authorization = admitted.authorization;
+	if (authorization.kind === "wallet_recovery") return {
+		kind: "wallet_recovery",
+		walletId: authorization.walletId,
+		ownershipGeneration: admitted.ownershipGeneration
+	};
 	const session = authorization.kind === "wallet_session_v2" ? authorization.context.authorization.session : authorization.context.status.session;
 	return {
 		kind: "wallet_session_v2",
+		ownershipGeneration: admitted.ownershipGeneration,
 		tenantId: session.tenantId,
 		principalId: session.principalId,
 		walletId: session.walletId,
@@ -25959,7 +25814,7 @@ var RouterAbEd25519YaoRecoveryRouteExtension = class {
 			body: parsed.value
 		});
 		if (!authorization.ok) return routeFailureResponse(authorization);
-		const result = await this.service.admitRecovery(parsed.value, recoveryAuthorizationBinding(authorization.authorization), traceContext.value);
+		const result = await this.service.admitRecovery(parsed.value, recoveryAuthorizationBinding(authorization), traceContext.value);
 		if (!result.ok) return routeFailureResponse(result);
 		return json$1(result.value, { status: result.status });
 	}
@@ -25976,13 +25831,16 @@ var RouterAbEd25519YaoRecoveryRouteExtension = class {
 			code: parsed.code,
 			message: parsed.message
 		}, { status: 400 });
+		const ownership = this.service.recoveryOwnershipGeneration(parsed.value.binding);
+		if (!ownership.ok) return routeFailureResponse(ownership);
 		const authorization = await this.authorization.authorize({
 			kind: "execute",
+			ownershipGeneration: ownership.value,
 			request,
 			body: parsed.value
 		});
 		if (!authorization.ok) return routeFailureResponse(authorization);
-		const result = await this.service.executeRecovery(parsed.value, recoveryAuthorizationBinding(authorization.authorization), traceContext.value);
+		const result = await this.service.executeRecovery(parsed.value, recoveryAuthorizationBinding(authorization), traceContext.value);
 		if (!result.ok) return routeFailureResponse(result);
 		return json$1(result.value, { status: result.status });
 	}
@@ -25999,13 +25857,16 @@ var RouterAbEd25519YaoRecoveryRouteExtension = class {
 			code: parsed.code,
 			message: parsed.message
 		}, { status: 400 });
+		const ownership = this.service.recoveryOwnershipGeneration(parsed.value.binding);
+		if (!ownership.ok) return routeFailureResponse(ownership);
 		const authorization = await this.authorization.authorize({
 			kind: "activate",
+			ownershipGeneration: ownership.value,
 			request,
 			body: parsed.value
 		});
 		if (!authorization.ok) return routeFailureResponse(authorization);
-		const result = await this.service.activateRecovery(parsed.value, recoveryAuthorizationBinding(authorization.authorization), traceContext.value);
+		const result = await this.service.activateRecovery(parsed.value, recoveryAuthorizationBinding(authorization), traceContext.value);
 		if (!result.ok) return routeFailureResponse(result);
 		return json$1(result.value, { status: result.status });
 	}
@@ -26226,7 +26087,7 @@ var RouterAbEd25519YaoExportRouteExtension = class {
 				code: authorized.code,
 				message: authorized.message
 			}, { status: authorized.status });
-			const result = await this.service.admitExport(parsed.protocol, authorized.authorizationIdentity, authorized.admission, authorized.factorRelease ?? null, traceContext.value);
+			const result = await this.service.admitExport(parsed.protocol, authorized.authorizationIdentity, authorized.ownershipGeneration, authorized.admission, authorized.factorRelease ?? null, traceContext.value);
 			return result.ok ? json$1({
 				protocol: result.value,
 				...authorized.factorRelease ? { factorRelease: authorized.factorRelease } : {}
@@ -26341,17 +26202,26 @@ var RouterAbEd25519YaoProductRegistrationRuntime = class {
 	async bindVerifiedIntent(input) {
 		return await this.input.authorization.bindVerifiedIntent(input);
 	}
+	/** The registration service of this runtime resolves the tenant root when it executes. */
+	startRegistrationDispatchRoot() {
+		return null;
+	}
 	async bindAndAdmitVerifiedRegistration(input) {
-		const bound = await this.input.authorization.bindVerifiedIntent(input);
+		const bound = await this.input.authorization.bindAndAuthorizeAdmission(input);
 		if (!bound.ok) return bound;
-		return await this.input.registrationService.admit(bound.admissionRequest);
+		const admitted = await this.input.registrationService.admit(bound.admissionRequest);
+		if (!admitted.ok) return admitted;
+		return {
+			ok: true,
+			status: 200,
+			admissionRequest: bound.admissionRequest,
+			value: admitted.value,
+			companionWrite: "not_committed"
+		};
 	}
 	async consumeActivated(request) {
 		return await this.input.registrationService.consumeActivated(request);
 	}
-	async installRegistrationFinalizeCapability(input) {
-		return await this.input.capabilityInstaller.installRegistrationFinalizeCapability(input);
-	}
 	async installPersistedActiveCapability(input) {
 		return await this.input.capabilityInstaller.installPersistedActiveCapability(input);
 	}