@seams/wallet-server 0.8.0 → 0.9.1

package/dist/esm/router/domains/ed25519Yao/export/routerAbEd25519YaoExport.js

@@ -1,11 +1,11 @@
 import { parseEmailOtpChallengeId, parseThresholdEd25519SessionId, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseAuthFactorId, parseAuthorizationAuditEventId, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parsePrincipalId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { buildCapabilityOperationEnvelope } from "../../../../shared-ts/src/authorization/operationFingerprint.js";
 import "../../../../shared-ts/src/utils/encoders.js";
-import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
 import { sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { deriveRouterAbEd25519YaoExportAuthorizationDigestV1, deriveRouterAbEd25519YaoExportConfirmationDigestV1, deriveRouterAbEd25519YaoRuntimePolicyBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519YaoDigests.js";
 import { ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, parseRouterAbEd25519YaoExportAdmissionReceiptV1, parseRouterAbEd25519YaoExportAdmissionRequestV1, parseRouterAbEd25519YaoExportExecuteRequestV1, parseRouterAbEd25519YaoExportResultV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
@@ -182,14 +182,14 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 	recordAuthorizationUncertain(request) {
 		this.state.authorizationUncertainOwners.set(exportKey(request), request.scope.account_id);
 	}
-	async admitExport(request, authorizationIdentity, admission, factorRelease, traceContext) {
+	async admitExport(request, authorizationIdentity, ownershipGeneration, admission, factorRelease, traceContext) {
 		const admitted = await admission.admit();
 		if (!admitted.ok) return failure({
 			status: admitted.status === 503 ? 503 : 409,
 			code: "admission_failed",
 			message: admitted.message
 		});
-		const authorization = this.authorizeExport(request, exportKey(request), authorizationIdentity, factorRelease);
+		const authorization = this.authorizeExport(request, exportKey(request), authorizationIdentity, ownershipGeneration, factorRelease);
 		if (authorization.kind === "completed" && !authorization.value.ok) return failure({
 			status: authorization.value.status === 503 ? 503 : 409,
 			code: "admission_failed",
@@ -226,11 +226,11 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 	* admission. An export already here answers from its state instead, with
 	* the factor release it recorded.
 	*/
-	authorizeExport(request, authorizationFingerprint, authorizationIdentity, factorRelease) {
+	authorizeExport(request, authorizationFingerprint, authorizationIdentity, ownershipGeneration, factorRelease) {
 		const key = exportKey(request);
 		const existing = this.state.exports.get(key);
 		if (existing) {
-			if (!sameExportServerAuthorizationIdentityV1(existing.authorizationIdentity, authorizationIdentity)) return {
+			if (existing.ownershipGeneration !== ownershipGeneration || !sameExportServerAuthorizationIdentityV1(existing.authorizationIdentity, authorizationIdentity)) return {
 				kind: "completed",
 				value: authorizationConflict("export_authorization_conflict", "Export authorization owner changed for an existing request")
 			};
@@ -266,12 +266,18 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 			request,
 			authorizationFingerprint,
 			authorizationIdentity,
+			ownershipGeneration,
 			factorRelease
 		});
 		return { kind: "authorized" };
 	}
-	readAuthorizationIdentity(request) {
-		return this.state.exports.get(exportKey(request))?.authorizationIdentity ?? null;
+	readAdmissionAuthority(request) {
+		const current = this.state.exports.get(exportKey(request));
+		if (!current) return null;
+		return {
+			authorizationIdentity: current.authorizationIdentity,
+			ownershipGeneration: current.ownershipGeneration
+		};
 	}
 	async prepareAdmitExport(request, _authorizationIdentity) {
 		const key = exportKey(request);
@@ -351,6 +357,7 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 			request: current.request,
 			authorizationFingerprint: current.authorizationFingerprint,
 			authorizationIdentity: current.authorizationIdentity,
+			ownershipGeneration: current.ownershipGeneration,
 			factorRelease: current.factorRelease
 		});
 		return {
@@ -412,6 +419,7 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 			request: current.request,
 			authorizationFingerprint: current.authorizationFingerprint,
 			authorizationIdentity: current.authorizationIdentity,
+			ownershipGeneration: current.ownershipGeneration,
 			factorRelease: current.factorRelease,
 			receipt: parsed.value
 		});
@@ -436,7 +444,7 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 		try {
 			outcome = {
 				kind: "backend_response",
-				result: await this.backend.executeExport(request, preparation.claim.admissionRequest, traceContext)
+				result: await this.backend.executeExport(request, preparation.claim, traceContext)
 			};
 		} catch (error) {
 			return this.failUncertainExecution(preparation.claim, error);
@@ -470,6 +478,7 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 				request: current.request,
 				authorizationFingerprint: current.authorizationFingerprint,
 				authorizationIdentity: current.authorizationIdentity,
+				ownershipGeneration: current.ownershipGeneration,
 				factorRelease: current.factorRelease,
 				receipt: current.receipt,
 				executeFingerprint: canonicalFingerprint(request),
@@ -488,6 +497,7 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 					request: current.request,
 					authorizationFingerprint: current.authorizationFingerprint,
 					authorizationIdentity: current.authorizationIdentity,
+					ownershipGeneration: current.ownershipGeneration,
 					factorRelease: current.factorRelease,
 					receipt: current.receipt,
 					executeFingerprint
@@ -500,7 +510,8 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 						exportKey: found.key,
 						sessionId: session,
 						executeFingerprint,
-						admissionRequest: current.request
+						admissionRequest: current.request,
+						ownershipGeneration: current.ownershipGeneration
 					}
 				};
 			case "executing": return {
@@ -561,6 +572,7 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 			request: current.request,
 			authorizationFingerprint: current.authorizationFingerprint,
 			authorizationIdentity: current.authorizationIdentity,
+			ownershipGeneration: current.ownershipGeneration,
 			factorRelease: current.factorRelease,
 			receipt: current.receipt,
 			executeFingerprint: current.executeFingerprint,
@@ -598,6 +610,7 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 			request: current.request,
 			authorizationFingerprint: current.authorizationFingerprint,
 			authorizationIdentity: current.authorizationIdentity,
+			ownershipGeneration: current.ownershipGeneration,
 			factorRelease: current.factorRelease,
 			failure: rejected
 		});
@@ -608,6 +621,7 @@ var InMemoryRouterAbEd25519YaoExportService = class {
 			request: current.request,
 			authorizationFingerprint: current.authorizationFingerprint,
 			authorizationIdentity: current.authorizationIdentity,
+			ownershipGeneration: current.ownershipGeneration,
 			factorRelease: current.factorRelease,
 			receipt: current.receipt,
 			executeFingerprint: current.executeFingerprint,
@@ -810,6 +824,7 @@ async function authorizeExportAdmission(args) {
 		});
 		if (!checked.ok) return checked;
 		return await recordFreshExportProof({
+			walletId: walletId.value,
 			input: args.input,
 			authority,
 			authorizedOperations: args.authorizedOperations,
@@ -836,6 +851,7 @@ async function authorizeExportAdmission(args) {
 	});
 	if (!checked.ok) return checked;
 	const recorded = await recordFreshExportProof({
+		walletId: walletId.value,
 		input: args.input,
 		authority: authority.authority,
 		authorizedOperations: args.authorizedOperations,
@@ -847,18 +863,13 @@ async function authorizeExportAdmission(args) {
 	return {
 		ok: true,
 		admission: recorded.admission,
+		walletId: recorded.walletId,
 		factorRelease: checked.factorRelease
 	};
 }
 async function recordFreshExportProof(args) {
-	const walletId = parseWalletId(args.input.body.application_binding.wallet_id);
-	if (!walletId.ok) return authorizationFailure({
-		status: 403,
-		code: "invalid_body",
-		message: walletId.error.message
-	});
 	const authorizationIdentitySuffix = base64UrlEncode(Uint8Array.from(args.input.body.authorization.authorization_digest));
-	const principalId = parsePrincipalId(`ed25519-export:${walletId.value}`);
+	const principalId = parsePrincipalId(`ed25519-export:${args.walletId}`);
 	const capabilityId = parseCapabilityId(String(args.input.body.scope.material_activation.capability));
 	const operationId = parseCapabilityOperationId(`ed25519-export:${args.input.body.scope.lifecycle_id}:${authorizationIdentitySuffix}`);
 	const evidenceId = parseAuthorizationEvidenceId(`ed25519-export:evidence:${args.input.body.scope.lifecycle_id}:${authorizationIdentitySuffix}`);
@@ -931,7 +942,7 @@ async function recordFreshExportProof(args) {
 			factor = buildVerifiedWalletOperationPasskeyFactorResult({
 				tenantId: args.authorizedOperations.tenantId,
 				principalId: principalId.value,
-				walletId: walletId.value,
+				walletId: args.walletId,
 				requestOrigin,
 				audience: requestOrigin,
 				factorId: factorId.value,
@@ -948,7 +959,7 @@ async function recordFreshExportProof(args) {
 			factor = buildVerifiedWalletOperationEmailOtpFactorResult({
 				tenantId: args.authorizedOperations.tenantId,
 				principalId: principalId.value,
-				walletId: walletId.value,
+				walletId: args.walletId,
 				requestOrigin,
 				audience: requestOrigin,
 				factorId: factorId.value,
@@ -974,6 +985,7 @@ async function recordFreshExportProof(args) {
 	});
 	return {
 		ok: true,
+		walletId: args.walletId,
 		admission: new ExportOperationAdmission(args.authorizedOperations, {
 			tenantId: args.authorizedOperations.tenantId,
 			authorizedOperationId: authorizedOperationId.value,
@@ -1036,12 +1048,13 @@ function exportOwnerProofRejected(code) {
 	});
 }
 var RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter = class {
-	constructor(webAuthn, emailOtp, walletAuthMethods, authorizedOperations, resolveEd25519MaterialActivation) {
+	constructor(webAuthn, emailOtp, walletAuthMethods, authorizedOperations, resolveEd25519MaterialActivation, admitEstablishedHome) {
 		this.webAuthn = webAuthn;
 		this.emailOtp = emailOtp;
 		this.walletAuthMethods = walletAuthMethods;
 		this.authorizedOperations = authorizedOperations;
 		this.resolveEd25519MaterialActivation = resolveEd25519MaterialActivation;
+		this.admitEstablishedHome = admitEstablishedHome;
 	}
 	async authorizeAdmission(input) {
 		const activeIdentity = await resolveActiveExportAuthorizationIdentity({
@@ -1056,12 +1069,29 @@ var RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter = class {
 			walletAuthMethods: this.walletAuthMethods,
 			authorizedOperations: this.authorizedOperations
 		});
-		return checked.ok ? {
+		if (!checked.ok) return checked;
+		let home;
+		try {
+			home = await this.admitEstablishedHome({ walletId: checked.walletId });
+		} catch {
+			return authorizationFailure({
+				status: 503,
+				code: "wallet_home_unavailable",
+				message: "Export wallet home is unavailable"
+			});
+		}
+		if (!home.ok) return authorizationFailure({
+			status: 409,
+			code: home.code,
+			message: home.message
+		});
+		return {
 			ok: true,
 			authorizationIdentity: activeIdentity.authorizationIdentity,
+			ownershipGeneration: home.ownershipGeneration,
 			admission: checked.admission,
 			...checked.factorRelease ? { factorRelease: checked.factorRelease } : {}
-		} : checked;
+		};
 	}
 	authorizeExecution(input) {
 		const thresholdSessionId = parseThresholdEd25519SessionId(input.body.binding.ceremony.lifecycle.session_id);
@@ -1273,7 +1303,7 @@ var RouterAbEd25519YaoExportRouteExtension = class {
 				code: authorized.code,
 				message: authorized.message
 			}, { status: authorized.status });
-			const result = await this.service.admitExport(parsed.protocol, authorized.authorizationIdentity, authorized.admission, authorized.factorRelease ?? null, traceContext.value);
+			const result = await this.service.admitExport(parsed.protocol, authorized.authorizationIdentity, authorized.ownershipGeneration, authorized.admission, authorized.factorRelease ?? null, traceContext.value);
 			return result.ok ? json({
 				protocol: result.value,
 				...authorized.factorRelease ? { factorRelease: authorized.factorRelease } : {}

package/dist/esm/router/domains/ed25519Yao/export/routerAbEd25519YaoExportRequestScopedCloudflare.js

@@ -85,11 +85,11 @@ var ExportExecutionRequestRun = class {
 			};
 		}
 	}
-	async backend(_claim) {
+	async backend(claim) {
 		try {
 			return {
 				kind: "response",
-				value: await this.context.input.backend.executeExport(this.request, _claim.admissionRequest, this.context.trace)
+				value: await this.context.input.backend.executeExport(this.request, claim, this.context.trace)
 			};
 		} catch (error) {
 			return {
@@ -197,15 +197,16 @@ async function runAuthorization(context, parsed, expectedOrigin) {
 	let loaded = await context.input.store.load(lifecycleId);
 	const service = exportService(context, loaded.state);
 	if (service.authorizationIsUncertain(parsed.protocol)) return authorizationFailure(503, "export_authorization_uncertain", "Export authorization outcome is uncertain and cannot be retried");
-	const existingIdentity = service.readAuthorizationIdentity(parsed.protocol);
+	const existingAuthority = service.readAdmissionAuthority(parsed.protocol);
 	let verified;
-	if (existingIdentity) {
+	if (existingAuthority) {
 		if (parsed.protocol.authorization.expires_at_ms <= Date.now()) return authorizationFailure(403, "export_authorization_expired", "Ed25519 Yao export authorization is expired");
 		const resolved = await context.input.authorization.resolveAuthorizationIdentity(parsed.protocol);
 		if (!resolved.ok) return resolved;
-		if (!sameAuthorizationIdentity(resolved.authorizationIdentity, existingIdentity)) return authorizationFailure(409, "export_authorization_conflict", "Export authorization owner changed for an existing request");
+		if (!sameAuthorizationIdentity(resolved.authorizationIdentity, existingAuthority.authorizationIdentity)) return authorizationFailure(409, "export_authorization_conflict", "Export authorization owner changed for an existing request");
 		verified = {
-			identity: existingIdentity,
+			identity: existingAuthority.authorizationIdentity,
+			ownershipGeneration: existingAuthority.ownershipGeneration,
 			admission: null
 		};
 	} else {
@@ -223,15 +224,17 @@ async function runAuthorization(context, parsed, expectedOrigin) {
 		if (!authorized.ok) return authorized;
 		verified = {
 			identity: authorized.authorizationIdentity,
+			ownershipGeneration: authorized.ownershipGeneration,
 			admission: authorized.admission,
 			...authorized.factorRelease ? { factorRelease: authorized.factorRelease } : {}
 		};
 	}
 	const authorizationFingerprint = await authorizationFingerprintForIdentity(parsed, verified.identity);
 	for (let attempt = 1;; attempt += 1) {
-		const decision = exportService(context, loaded.state).authorizeExport(parsed.protocol, authorizationFingerprint, verified.identity, verified.factorRelease ?? null);
+		const decision = exportService(context, loaded.state).authorizeExport(parsed.protocol, authorizationFingerprint, verified.identity, verified.ownershipGeneration, verified.factorRelease ?? null);
 		if (decision.kind === "completed") return decision.value.ok ? authorizedRun({
 			identity: verified.identity,
+			ownershipGeneration: verified.ownershipGeneration,
 			admission: verified.admission,
 			...decision.value.factorRelease ? { factorRelease: decision.value.factorRelease } : {}
 		}) : decision.value;

package/dist/esm/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.js

@@ -36,11 +36,17 @@ function resolveTraceContext(request) {
 		message: parsed.message
 	};
 }
-function recoveryAuthorizationBinding(authorization) {
-	if (authorization.kind === "wallet_recovery") return authorization;
+function recoveryAuthorizationBinding(admitted) {
+	const authorization = admitted.authorization;
+	if (authorization.kind === "wallet_recovery") return {
+		kind: "wallet_recovery",
+		walletId: authorization.walletId,
+		ownershipGeneration: admitted.ownershipGeneration
+	};
 	const session = authorization.kind === "wallet_session_v2" ? authorization.context.authorization.session : authorization.context.status.session;
 	return {
 		kind: "wallet_session_v2",
+		ownershipGeneration: admitted.ownershipGeneration,
 		tenantId: session.tenantId,
 		principalId: session.principalId,
 		walletId: session.walletId,
@@ -160,7 +166,7 @@ function equalBytes(left, right) {
 	return true;
 }
 function sameRecoveryAuthorizationBindingV1(left, right) {
-	if (left.kind !== right.kind) return false;
+	if (left.kind !== right.kind || left.ownershipGeneration !== right.ownershipGeneration) return false;
 	switch (left.kind) {
 		case "wallet_recovery": return right.kind === "wallet_recovery" && left.walletId === right.walletId;
 		case "wallet_session_v2": return right.kind === "wallet_session_v2" && left.tenantId === right.tenantId && left.principalId === right.principalId && left.walletId === right.walletId && left.authorityId === right.authorityId && left.walletAuthMethodId === right.walletAuthMethodId && left.mintId === right.mintId && left.authorizationId === right.authorizationId && left.walletSessionId === right.walletSessionId && left.quotaId === right.quotaId;
@@ -649,6 +655,77 @@ function activationReplayResult(state, fingerprint) {
 		default: return assertNever(state);
 	}
 }
+function resolveRouterAbEd25519YaoActiveCapability(capabilities, input) {
+	const walletId = String(input.walletId || "").trim();
+	const nearEd25519SigningKeyId = String(input.nearEd25519SigningKeyId || "").trim();
+	const signingWorkerId = String(input.signingWorkerId || "").trim();
+	const firstParticipantId = input.participantIds?.[0];
+	const secondParticipantId = input.participantIds?.[1];
+	if (input.kind !== "router_ab_ed25519_yao_active_capability_lookup_v1" || !walletId || !nearEd25519SigningKeyId || !signingWorkerId || !Number.isSafeInteger(input.signerSlot) || input.signerSlot < 1 || !Array.isArray(input.participantIds) || input.participantIds.length !== 2 || !Number.isSafeInteger(firstParticipantId) || !Number.isSafeInteger(secondParticipantId) || Number(firstParticipantId) < 1 || Number(secondParticipantId) < 1 || firstParticipantId === secondParticipantId) return {
+		ok: false,
+		code: "invalid_lookup",
+		message: "active Ed25519 Yao capability lookup is invalid"
+	};
+	let matched = null;
+	for (const state of capabilities.values()) {
+		if (state.kind !== "active") continue;
+		const identity = state.identity;
+		if (identity.applicationBinding.wallet_id !== walletId || identity.applicationBinding.near_ed25519_signing_key_id !== nearEd25519SigningKeyId || identity.applicationBinding.key_creation_signer_slot !== input.signerSlot || identity.activationBinding.lifecycle.selected_server_id !== signingWorkerId || identity.participantIds[0] !== firstParticipantId || identity.participantIds[1] !== secondParticipantId) continue;
+		if (matched) return {
+			ok: false,
+			code: "capability_conflict",
+			message: "multiple active Ed25519 Yao capabilities match the wallet identity"
+		};
+		matched = identity;
+	}
+	if (!matched) return {
+		ok: false,
+		code: "unknown_capability",
+		message: "active Ed25519 Yao capability was not found"
+	};
+	const lifecycle = matched.activationBinding.lifecycle;
+	return {
+		ok: true,
+		capability: {
+			kind: "router_ab_ed25519_yao_active_capability_v1",
+			materialActivation: matched.activationBinding.material_activation,
+			activeCapabilityBinding: [...matched.capabilityBinding],
+			registeredPublicKey: [...matched.registeredPublicKey],
+			nearAccountId: matched.nearAccountId,
+			applicationBinding: {
+				wallet_id: matched.applicationBinding.wallet_id,
+				near_ed25519_signing_key_id: matched.applicationBinding.near_ed25519_signing_key_id,
+				signing_root_id: matched.applicationBinding.signing_root_id,
+				key_creation_signer_slot: matched.applicationBinding.key_creation_signer_slot
+			},
+			runtimePolicyScope: {
+				orgId: matched.runtimePolicyScope.orgId,
+				projectId: matched.runtimePolicyScope.projectId,
+				envId: matched.runtimePolicyScope.envId,
+				signingRootVersion: matched.runtimePolicyScope.signingRootVersion
+			},
+			participantIds: [matched.participantIds[0], matched.participantIds[1]],
+			lifecycle: {
+				lifecycleId: lifecycle.lifecycle_id,
+				rootShareEpoch: lifecycle.root_share_epoch,
+				accountId: lifecycle.account_id,
+				thresholdSessionId: requireThresholdEd25519SessionId(lifecycle.session_id, "active capability threshold session identity"),
+				signerSetId: lifecycle.signer_set_id,
+				signingWorkerId: lifecycle.selected_server_id
+			},
+			stateEpoch: matched.stateEpoch,
+			registrationContinuity: matched.persisted.version === "wallet_ed25519_yao_registration_capability_v1" ? {
+				kind: "registration",
+				admissionRequest: matched.persisted.admissionRequest,
+				admissionReceipt: matched.persisted.admissionReceipt,
+				activationTranscript: [...matched.persisted.activationResult.public_receipt.transcript]
+			} : {
+				kind: "recovery",
+				activationTranscript: [...matched.persisted.activationResult.public_receipt.transcript]
+			}
+		}
+	};
+}
 var InMemoryRouterAbEd25519YaoRecoveryService = class {
 	constructor(backend, state = new InMemoryRouterAbEd25519YaoRecoveryStateV1(), capabilityPersistence = new EphemeralRouterAbEd25519YaoCapabilityPersistenceV1()) {
 		this.backend = backend;
@@ -711,75 +788,7 @@ var InMemoryRouterAbEd25519YaoRecoveryService = class {
 		return capabilityInstallResult("installed", identity);
 	}
 	resolveActiveCapability(input) {
-		const walletId = String(input.walletId || "").trim();
-		const nearEd25519SigningKeyId = String(input.nearEd25519SigningKeyId || "").trim();
-		const signingWorkerId = String(input.signingWorkerId || "").trim();
-		const firstParticipantId = input.participantIds?.[0];
-		const secondParticipantId = input.participantIds?.[1];
-		if (input.kind !== "router_ab_ed25519_yao_active_capability_lookup_v1" || !walletId || !nearEd25519SigningKeyId || !signingWorkerId || !Number.isSafeInteger(input.signerSlot) || input.signerSlot < 1 || !Array.isArray(input.participantIds) || input.participantIds.length !== 2 || !Number.isSafeInteger(firstParticipantId) || !Number.isSafeInteger(secondParticipantId) || Number(firstParticipantId) < 1 || Number(secondParticipantId) < 1 || firstParticipantId === secondParticipantId) return {
-			ok: false,
-			code: "invalid_lookup",
-			message: "active Ed25519 Yao capability lookup is invalid"
-		};
-		let matched = null;
-		for (const state of this.capabilities.values()) {
-			if (state.kind !== "active") continue;
-			const identity = state.identity;
-			if (identity.applicationBinding.wallet_id !== walletId || identity.applicationBinding.near_ed25519_signing_key_id !== nearEd25519SigningKeyId || identity.applicationBinding.key_creation_signer_slot !== input.signerSlot || identity.activationBinding.lifecycle.selected_server_id !== signingWorkerId || identity.participantIds[0] !== firstParticipantId || identity.participantIds[1] !== secondParticipantId) continue;
-			if (matched) return {
-				ok: false,
-				code: "capability_conflict",
-				message: "multiple active Ed25519 Yao capabilities match the wallet identity"
-			};
-			matched = identity;
-		}
-		if (!matched) return {
-			ok: false,
-			code: "unknown_capability",
-			message: "active Ed25519 Yao capability was not found"
-		};
-		const lifecycle = matched.activationBinding.lifecycle;
-		return {
-			ok: true,
-			capability: {
-				kind: "router_ab_ed25519_yao_active_capability_v1",
-				materialActivation: matched.activationBinding.material_activation,
-				activeCapabilityBinding: [...matched.capabilityBinding],
-				registeredPublicKey: [...matched.registeredPublicKey],
-				nearAccountId: matched.nearAccountId,
-				applicationBinding: {
-					wallet_id: matched.applicationBinding.wallet_id,
-					near_ed25519_signing_key_id: matched.applicationBinding.near_ed25519_signing_key_id,
-					signing_root_id: matched.applicationBinding.signing_root_id,
-					key_creation_signer_slot: matched.applicationBinding.key_creation_signer_slot
-				},
-				runtimePolicyScope: {
-					orgId: matched.runtimePolicyScope.orgId,
-					projectId: matched.runtimePolicyScope.projectId,
-					envId: matched.runtimePolicyScope.envId,
-					signingRootVersion: matched.runtimePolicyScope.signingRootVersion
-				},
-				participantIds: [matched.participantIds[0], matched.participantIds[1]],
-				lifecycle: {
-					lifecycleId: lifecycle.lifecycle_id,
-					rootShareEpoch: lifecycle.root_share_epoch,
-					accountId: lifecycle.account_id,
-					thresholdSessionId: requireThresholdEd25519SessionId(lifecycle.session_id, "active capability threshold session identity"),
-					signerSetId: lifecycle.signer_set_id,
-					signingWorkerId: lifecycle.selected_server_id
-				},
-				stateEpoch: matched.stateEpoch,
-				registrationContinuity: matched.persisted.version === "wallet_ed25519_yao_registration_capability_v1" ? {
-					kind: "registration",
-					admissionRequest: matched.persisted.admissionRequest,
-					admissionReceipt: matched.persisted.admissionReceipt,
-					activationTranscript: [...matched.persisted.activationResult.public_receipt.transcript]
-				} : {
-					kind: "recovery",
-					activationTranscript: [...matched.persisted.activationResult.public_receipt.transcript]
-				}
-			}
-		};
+		return resolveRouterAbEd25519YaoActiveCapability(this.capabilities, input);
 	}
 	async admitRecovery(request, authorization, traceContext) {
 		const dispatchRoot = await this.backend.resolveRecoveryDispatchRoot(request);
@@ -998,7 +1007,7 @@ var InMemoryRouterAbEd25519YaoRecoveryService = class {
 				try {
 					outcome = {
 						kind: "backend_response",
-						result: await this.backend.executeRecovery(request, preparation.claim.admissionRequest, preparation.claim.dispatchRoot, preparation.claim.attempt, preparation.claim.replay, traceContext)
+						result: await this.backend.executeRecovery(request, preparation.claim, traceContext)
 					};
 				} catch (error) {
 					return this.failUncertainExecution(preparation.claim, error);
@@ -1011,6 +1020,19 @@ var InMemoryRouterAbEd25519YaoRecoveryService = class {
 			}
 		}
 	}
+	recoveryOwnershipGeneration(binding) {
+		const state = this.stateForSession(binding.session_id);
+		if (!state) return recoveryFailure({
+			status: 404,
+			code: "unknown_recovery",
+			message: "Recovery admission was not found"
+		});
+		return {
+			ok: true,
+			status: 200,
+			value: state.context.authorization.ownershipGeneration
+		};
+	}
 	prepareExecuteRecovery(request, authorization, nowMs) {
 		const parsed = parseRouterAbEd25519YaoRecoveryActivationExecuteRequestV1(request);
 		if (!parsed.ok) return {
@@ -1063,6 +1085,7 @@ var InMemoryRouterAbEd25519YaoRecoveryService = class {
 				kind: "claimed",
 				claim: {
 					kind: "router_ab_ed25519_yao_recovery_execute_claim_v1",
+					ownershipGeneration: claimed.context.authorization.ownershipGeneration,
 					lifecycleId: executionRequest.binding.lifecycle.lifecycle_id,
 					recoveryKey: claimed.context.recoveryKey,
 					sessionId,
@@ -1174,7 +1197,7 @@ var InMemoryRouterAbEd25519YaoRecoveryService = class {
 				try {
 					outcome = {
 						kind: "backend_response",
-						result: await this.backend.activateRecovery(request, preparation.claim.dispatchRoot, traceContext)
+						result: await this.backend.activateRecovery(request, preparation.claim.dispatchRoot, preparation.claim.ownershipGeneration, traceContext)
 					};
 				} catch (error) {
 					return this.activationUncertainFailure(error);
@@ -1438,6 +1461,7 @@ var InMemoryRouterAbEd25519YaoRecoveryService = class {
 	activationClaim(state, authorityProjection, disposition) {
 		return {
 			kind: "router_ab_ed25519_yao_recovery_activation_claim_v1",
+			ownershipGeneration: state.context.authorization.ownershipGeneration,
 			lifecycleId: state.context.admissionRequest.scope.lifecycle_id,
 			recoveryKey: state.context.recoveryKey,
 			sessionId: bytesToHex(state.admissionReceipt.binding.session_id),
@@ -1700,7 +1724,7 @@ var RouterAbEd25519YaoRecoveryRouteExtension = class {
 			body: parsed.value
 		});
 		if (!authorization.ok) return routeFailureResponse(authorization);
-		const result = await this.service.admitRecovery(parsed.value, recoveryAuthorizationBinding(authorization.authorization), traceContext.value);
+		const result = await this.service.admitRecovery(parsed.value, recoveryAuthorizationBinding(authorization), traceContext.value);
 		if (!result.ok) return routeFailureResponse(result);
 		return json(result.value, { status: result.status });
 	}
@@ -1717,13 +1741,16 @@ var RouterAbEd25519YaoRecoveryRouteExtension = class {
 			code: parsed.code,
 			message: parsed.message
 		}, { status: 400 });
+		const ownership = this.service.recoveryOwnershipGeneration(parsed.value.binding);
+		if (!ownership.ok) return routeFailureResponse(ownership);
 		const authorization = await this.authorization.authorize({
 			kind: "execute",
+			ownershipGeneration: ownership.value,
 			request,
 			body: parsed.value
 		});
 		if (!authorization.ok) return routeFailureResponse(authorization);
-		const result = await this.service.executeRecovery(parsed.value, recoveryAuthorizationBinding(authorization.authorization), traceContext.value);
+		const result = await this.service.executeRecovery(parsed.value, recoveryAuthorizationBinding(authorization), traceContext.value);
 		if (!result.ok) return routeFailureResponse(result);
 		return json(result.value, { status: result.status });
 	}
@@ -1740,13 +1767,16 @@ var RouterAbEd25519YaoRecoveryRouteExtension = class {
 			code: parsed.code,
 			message: parsed.message
 		}, { status: 400 });
+		const ownership = this.service.recoveryOwnershipGeneration(parsed.value.binding);
+		if (!ownership.ok) return routeFailureResponse(ownership);
 		const authorization = await this.authorization.authorize({
 			kind: "activate",
+			ownershipGeneration: ownership.value,
 			request,
 			body: parsed.value
 		});
 		if (!authorization.ok) return routeFailureResponse(authorization);
-		const result = await this.service.activateRecovery(parsed.value, recoveryAuthorizationBinding(authorization.authorization), traceContext.value);
+		const result = await this.service.activateRecovery(parsed.value, recoveryAuthorizationBinding(authorization), traceContext.value);
 		if (!result.ok) return routeFailureResponse(result);
 		return json(result.value, { status: result.status });
 	}
@@ -1758,6 +1788,6 @@ function createRouterAbEd25519YaoRecoveryModule(input) {
 	});
 }
 //#endregion
-export { InMemoryRouterAbEd25519YaoRecoveryService, InMemoryRouterAbEd25519YaoRecoveryStateV1, buildRouterAbEd25519YaoRegistrationCapabilityRecordV1, buildWarmRecoveryBootstrapResponse, createRouterAbEd25519YaoRecoveryModule, recoveryAuthorityProjection, recoveryAuthorizationBinding };
+export { InMemoryRouterAbEd25519YaoRecoveryService, InMemoryRouterAbEd25519YaoRecoveryStateV1, buildRouterAbEd25519YaoRegistrationCapabilityRecordV1, buildWarmRecoveryBootstrapResponse, createRouterAbEd25519YaoRecoveryModule, recoveryAuthorityProjection, recoveryAuthorizationBinding, resolveRouterAbEd25519YaoActiveCapability };
 
 //# sourceMappingURL=routerAbEd25519YaoRecovery.js.map

package/dist/esm/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryRequestScopedCloudflare.js

@@ -20,7 +20,7 @@ var RecoveryAdmissionRequestRun = class {
 			kind: "rejected",
 			value: authorized
 		};
-		const prepared = this.service(state).prepareAdmitRecovery(this.request, recoveryAuthorizationBinding(authorized.authorization), await this.context.input.backend.resolveRecoveryDispatchRoot(this.request), Date.now());
+		const prepared = this.service(state).prepareAdmitRecovery(this.request, recoveryAuthorizationBinding(authorized), await this.context.input.backend.resolveRecoveryDispatchRoot(this.request), Date.now());
 		if (prepared.kind !== "failed") {
 			const published = await publishWalletLifecycleHome(this.context.input.lifecycleRouting ?? null, "yao_recovery", this.request);
 			if (!published.ok) return {
@@ -85,8 +85,15 @@ var RecoveryExecutionRequestRun = class {
 		this.request = request;
 	}
 	async prepare(state) {
+		const service = this.service(state);
+		const ownership = service.recoveryOwnershipGeneration(this.request.binding);
+		if (!ownership.ok) return {
+			kind: "rejected",
+			value: ownership
+		};
 		const authorized = await this.context.input.authorization.authorize({
 			kind: "execute",
+			ownershipGeneration: ownership.value,
 			request: this.context.input.request,
 			body: this.request
 		});
@@ -94,7 +101,7 @@ var RecoveryExecutionRequestRun = class {
 			kind: "rejected",
 			value: authorized
 		};
-		const prepared = this.service(state).prepareExecuteRecovery(this.request, recoveryAuthorizationBinding(authorized.authorization), Date.now());
+		const prepared = service.prepareExecuteRecovery(this.request, recoveryAuthorizationBinding(authorized), Date.now());
 		switch (prepared.kind) {
 			case "claimed": return {
 				kind: "claimed",
@@ -119,7 +126,7 @@ var RecoveryExecutionRequestRun = class {
 		try {
 			return {
 				kind: "response",
-				value: await this.context.input.backend.executeRecovery(this.request, claim.admissionRequest, claim.dispatchRoot, claim.attempt, claim.replay, this.context.trace)
+				value: await this.context.input.backend.executeRecovery(this.request, claim, this.context.trace)
 			};
 		} catch (error) {
 			return {
@@ -152,8 +159,15 @@ var RecoveryActivationRequestRun = class {
 		this.request = request;
 	}
 	async prepare(state) {
+		const service = this.service(state);
+		const ownership = service.recoveryOwnershipGeneration(this.request.binding);
+		if (!ownership.ok) return {
+			kind: "rejected",
+			value: ownership
+		};
 		const authorized = await this.context.input.authorization.authorize({
 			kind: "activate",
+			ownershipGeneration: ownership.value,
 			request: this.context.input.request,
 			body: this.request
 		});
@@ -161,7 +175,7 @@ var RecoveryActivationRequestRun = class {
 			kind: "rejected",
 			value: authorized
 		};
-		const prepared = this.service(state).prepareActivateRecovery(this.request, recoveryAuthorizationBinding(authorized.authorization));
+		const prepared = service.prepareActivateRecovery(this.request, recoveryAuthorizationBinding(authorized));
 		switch (prepared.kind) {
 			case "claimed": return {
 				kind: "claimed",
@@ -186,7 +200,7 @@ var RecoveryActivationRequestRun = class {
 		try {
 			return {
 				kind: "response",
-				value: await this.context.input.backend.activateRecovery(this.request, claim.dispatchRoot, this.context.trace)
+				value: await this.context.input.backend.activateRecovery(this.request, claim.dispatchRoot, claim.ownershipGeneration, this.context.trace)
 			};
 		} catch (error) {
 			return {