@seams/wallet-server 0.8.0 → 0.9.1

package/dist/esm/router/framework/http.js

@@ -12,6 +12,7 @@ const CORS_ALLOW_HEADERS = [
 	"Content-Type",
 	WALLET_MANAGEMENT_PROTOCOL_HEADER,
 	"Authorization",
+	"X-Seams-Wallet-Region",
 	"X-Seams-Benchmark-Diagnostics",
 	LINKED_DEVICE_REQUEST_PROOF_HEADER_V1,
 	ROUTER_AB_ED25519_YAO_RECOVERY_CHALLENGE_ID_HEADER_V1,
@@ -64,7 +65,7 @@ function withCors(headers, opts, request) {
 	headers.set("Access-Control-Allow-Methods", CORS_ALLOW_METHODS);
 	headers.set("Access-Control-Allow-Headers", CORS_ALLOW_HEADERS);
 	if (allowedOrigin && request?.method === "OPTIONS") headers.set("Access-Control-Max-Age", String(CORS_PREFLIGHT_MAX_AGE_SECONDS));
-	if (headers.has("Server-Timing")) headers.set("Access-Control-Expose-Headers", "Server-Timing");
+	headers.set("Access-Control-Expose-Headers", "Server-Timing, X-Seams-Wallet-Region");
 	if (allowedOrigin && allowedOrigin !== "*") headers.set("Access-Control-Allow-Credentials", "true");
 }
 function toResponse(out) {

package/dist/esm/router/transport/fetch/createFetchRouter.js

@@ -3,12 +3,12 @@ import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { routerAbEcdsaDerivationActiveStateId } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { findRouteDefinitionForRequest } from "../../framework/routeDefinitions.js";
+import { extractBearerCredential } from "../../auth/routerApiKeyAuth.js";
+import { resolveWalletSessionOperationCredentialAdmissionFromContext } from "../../auth/commonRouterUtils.js";
 import { getRouterApiRouteExtensionRoutes, getRouterApiRouteExtensionsForTransport } from "../../framework/routeExtensions.js";
 import { coerceRouterLogger } from "../../framework/logger.js";
 import { json, jsonFailure, withCors } from "../../framework/http.js";
 import { handleHealth, handleReady } from "./routes/health.js";
-import { extractBearerCredential } from "../../auth/routerApiKeyAuth.js";
-import { resolveWalletSessionOperationCredentialAdmissionFromContext } from "../../auth/commonRouterUtils.js";
 import { handleWalletRegistration } from "./routes/walletRegistration.js";
 import { handlePasskeyCustody, handleWalletCustodyCredentialLabel, handleWalletCustodyCredentialsList, handleWalletCustodyEmailOtpChallenge, handleWalletCustodyEnvelopeOwnershipUpgrade, handleWalletRecoveryBackupAcknowledge, handleWalletRecoveryEmailOtpRelease, handleWalletRecoveryEmailOtpVerify, handleWalletRecoveryFinalize, handleWalletRecoveryGoogleEmailOtpFinalize, handleWalletRecoveryGoogleVerify, handleWalletRecoveryPrepare, handleWalletRecoveryRead, handleWalletRecoveryRotate, handleWalletRecoveryStatus } from "./routes/passkeyCustody.js";
 import { handleThresholdEcdsa } from "./routes/thresholdEcdsa.js";

package/dist/esm/router/transport/fetch/routes/auth.js

@@ -1,6 +1,6 @@
-import { json, jsonFailure, readJson } from "../../../framework/http.js";
 import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
 import { resolveThresholdRuntimePolicyScope } from "../../../auth/commonRouterUtils.js";
+import { json, jsonFailure, readJson } from "../../../framework/http.js";
 import { parseAuthIdentityMutationRequest, parseAuthProviderActionPath, parseGoogleLoginVerifyRequest, parsePasskeyLoginOptionsRequest, parsePasskeyLoginVerifyRequest } from "../../../auth/authRequestValidation.js";
 //#region src/router/transport/fetch/routes/auth.ts
 function assertNeverAuthProviderAction(route) {

package/dist/esm/router/transport/fetch/routes/deviceLinking.js

@@ -1,10 +1,10 @@
 import { parseLinkDeviceSessionId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { requireRecord } from "../../../../shared-ts/src/utils/validation.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { sha256Bytes } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { isLinkSessionTerminalFailureV1 } from "../../../../shared-ts/src/device-linking/contracts.js";
-import { requireRecord } from "../../../../shared-ts/src/utils/validation.js";
 import { parseActiveWalletSessionV1 } from "../../../../shared-ts/src/device-linking/activeWalletSession.js";
+import { isLinkSessionTerminalFailureV1 } from "../../../../shared-ts/src/device-linking/contracts.js";
 import { parseLinkedDeviceEd25519ExportRootRecipientV1, parseLinkedDeviceEd25519ExportRootSubmissionV1 } from "../../../../shared-ts/src/device-linking/ed25519ExportRoot.js";
 import { parseRouterAbEd25519YaoRegistrationActivationExecuteRequestV1, sameRouterAbEd25519YaoActivationBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { parseLinkedDeviceEd25519SourcePreservingReservationV1, parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1 } from "../../../../shared-ts/src/device-linking/sourceContribution.js";
@@ -13,9 +13,9 @@ import { parseLocalAuthorityActivationFinalAckV1, parseLocalAuthorityInstallatio
 import { LINKED_DEVICE_REQUEST_PROOF_HEADER_V1, computeLinkedDevicePublicKeyDigestV1 } from "../../../../shared-ts/src/device-linking/requestProof.js";
 import { findRouteDefinitionById } from "../../../framework/routeDefinitions.js";
 import { normalizeCorsOrigin } from "../../../../core/SessionService.js";
-import { json, readJson } from "../../../framework/http.js";
 import { extractBearerCredential, extractRouterApiEnvironmentId } from "../../../auth/routerApiKeyAuth.js";
 import { resolvePublishableKeyApiCredentialAuth } from "../../../auth/routerApiCredentialAuth.js";
+import { json, readJson } from "../../../framework/http.js";
 import { authDeniedResponse, exportRootWriteResponse, invalidInputResponse, invalidStateResponse, methodNotAllowedResponse, notFoundResponse, notSupportedResponse, projectSession, sessionProjectionResponse, targetCredentialResultResponse } from "./deviceLinkingResponses.js";
 import { linkedDeviceBootstrapFailure } from "../../../../core/deviceLinking/linkedDeviceBootstrap.js";
 import { parseLinkedDeviceRequestProofV1 } from "../../../../core/deviceLinking/requestProof.js";

package/dist/esm/router/transport/fetch/routes/deviceLinkingOwnerAuthorization.js

@@ -1,11 +1,11 @@
 import { parseProviderSubject } from "../../../../shared-ts/src/utils/domainIds.js";
-import { sha256DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { buildDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
+import { sha256DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { buildEmailOtpWalletAuthAuthority, buildPasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseLinkedDeviceOwnerAuthorizationRequestV1 } from "../../../../shared-ts/src/device-linking/parsers.js";
 import { buildWalletSessionCapabilitySubjectsV1, walletSessionCapabilitySubjectsV1Equal } from "../../../../authorization/domain.js";
-import { json, jsonFailure, readJson } from "../../../framework/http.js";
 import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
+import { json, jsonFailure, readJson } from "../../../framework/http.js";
 import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 //#region src/router/transport/fetch/routes/deviceLinkingOwnerAuthorization.ts
 const LINKED_DEVICE_OWNER_AUTHORIZATION_PATH_V1 = "/wallet/device-linking/v1/owner-authorization";

package/dist/esm/router/transport/fetch/routes/ed25519AuthorizedOperationRevalidation.js

@@ -0,0 +1,65 @@
+import { json } from "../../../framework/http.js";
+//#region src/router/transport/fetch/routes/ed25519AuthorizedOperationRevalidation.ts
+function rejected(code, message, status) {
+	return {
+		ok: false,
+		response: json({
+			ok: false,
+			code,
+			message
+		}, { status })
+	};
+}
+function rejectedAdmission(kind) {
+	return kind === "authorization_grant_rejected" || kind === "verified_step_up_rejected" ? rejected(kind, "Ed25519 operation authorization is no longer active", 403) : rejected(kind, "Ed25519 operation admission failed", 409);
+}
+async function revalidateEd25519StepUpOperation(input) {
+	const stored = input.operation;
+	if (stored.authorization.kind !== "verified_step_up" || stored.quota.kind !== "quota_neutral") return rejected("verified_step_up_rejected", "Ed25519 operation step-up authorization has an invalid quota", 403);
+	const result = await input.ctx.service.authorizedOperations.admitAuthorizedOperation({ operation: {
+		tenantId: stored.tenantId,
+		authorizedOperationId: stored.authorizedOperationId,
+		auditEventId: stored.auditEventId,
+		operation: stored.operation,
+		authorization: stored.authorization,
+		quota: stored.quota,
+		claimedAtMs: Date.now()
+	} });
+	if (!("operation" in result)) return rejectedAdmission(result.kind);
+	if (result.operation.authorizedOperationId !== stored.authorizedOperationId) throw new Error("Ed25519 authorized operation changed during revalidation");
+	return {
+		ok: true,
+		operation: result.operation
+	};
+}
+/**
+* Finds the operation a reusable Wallet Session prepared and checks that its
+* grant is still active. A live operation returns the owner scope its
+* admission row pinned. A completed operation returns none: it replays its
+* stored response. The operation is read by its fingerprint, so a receipt
+* that names another operation ID has no stored operation.
+*/
+async function resolveEd25519WalletSessionOperation(input) {
+	const result = await input.ctx.service.authorizedOperations.resolveEd25519WalletSessionOperation({
+		tenantId: input.tenantId,
+		operationFingerprintDigest: input.operationFingerprintDigest,
+		walletId: input.walletId,
+		nowMs: Date.now()
+	});
+	if (result.kind === "authorized_operation_missing") return rejected("authorized_operation_missing", "Authorized operation is unavailable", 409);
+	if (!result.operation) return rejectedAdmission(result.kind);
+	const stored = result.operation;
+	if (stored.authorizedOperationId !== input.authorizedOperationId) return rejected("authorized_operation_missing", "Authorized operation is unavailable", 409);
+	if (stored.quota.kind !== "consume_reusable_wallet_session") return rejected("authorization_grant_rejected", "Ed25519 reusable operation authorization has an invalid quota", 403);
+	const operation = stored.operation.operation;
+	if (operation.capabilityKind !== "near_ed25519_mpc_signing" || operation.operationKind === "near.export_key") return rejected("authorization_grant_rejected", "Ed25519 reusable operation kind is invalid", 403);
+	return {
+		ok: true,
+		operation: stored,
+		ownerScope: result.ownerScope ?? null
+	};
+}
+//#endregion
+export { resolveEd25519WalletSessionOperation, revalidateEd25519StepUpOperation };
+
+//# sourceMappingURL=ed25519AuthorizedOperationRevalidation.js.map

package/dist/esm/router/transport/fetch/routes/normalSigningRouterProxy.js

@@ -1,7 +1,9 @@
+import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { walletObjectIdentity, walletObjectIdentityHeaders } from "../../../cloudflare/runtime/walletObjectAddresses.js";
 import { ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1, normalizeRouterAbInternalServiceAuthSecret } from "../../../../core/ThresholdService/routerAb/internalServiceHttp.js";
-import { json } from "../../../framework/http.js";
 import { prepareOwnerWalletExecution } from "../../../domains/signingOperations/walletExecutionAdmission.js";
+import { json } from "../../../framework/http.js";
 //#region src/router/transport/fetch/routes/normalSigningRouterProxy.ts
 async function proxyNormalSigningRequestToMpcRouter(input) {
 	const proxy = input.proxy;
@@ -12,6 +14,14 @@ async function proxyNormalSigningRequestToMpcRouter(input) {
 	}, { status: 501 });
 	try {
 		const headers = new Headers(input.request.headers);
+		const envelope = input.body?.authorized_operation;
+		if (!isPlainObject(envelope) || !isPlainObject(envelope.binding)) throw new Error("Signing requires an admitted wallet binding");
+		const identity = walletObjectIdentity(envelope.binding.account_id, envelope.binding.ownership_generation, {
+			orgId: envelope.binding.org_id,
+			projectId: envelope.binding.project_id,
+			envId: envelope.binding.project_environment_id
+		});
+		for (const [name, value] of Object.entries(walletObjectIdentityHeaders(identity))) headers.set(name, value);
 		if (input.body && parseNormalSigningSessionAdmission(input.body)) headers.delete("authorization");
 		headers.set(ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1, normalizeRouterAbInternalServiceAuthSecret(proxy.internalServiceAuthSecret));
 		const request = input.targetPath ? new Request(new URL(input.targetPath, input.request.url), input.request) : input.request;
@@ -53,7 +63,7 @@ function isNormalSigningReusableBindingRecord(value) {
 }
 function isNormalSigningGatewayOwnerBindingRecord(value) {
 	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
-	return Object.keys(value).sort().join("|") === "account_id|authorization_id|environment|expires_at_ms|kind|org_id|project_environment_id|project_id|quota_id|signing_worker_id|subject_id|threshold_session_id|wallet_session_id";
+	return Object.keys(value).sort().join("|") === "account_id|authorization_id|environment|expires_at_ms|kind|org_id|ownership_generation|project_environment_id|project_id|quota_id|signing_worker_id|subject_id|threshold_session_id|wallet_session_id";
 }
 function isNormalSigningReusableReceiptRecord(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -62,7 +72,7 @@ function isNormalSigningReusableBindingValues(record) {
 	return typeof record.authorization_id === "string" && record.authorization_id.trim().length > 0 && typeof record.wallet_session_id === "string" && record.wallet_session_id.trim().length > 0 && typeof record.quota_id === "string" && record.quota_id.trim().length > 0;
 }
 function isNormalSigningGatewayOwnerBindingValues(record) {
-	return typeof record.subject_id === "string" && record.subject_id.trim().length > 0 && typeof record.account_id === "string" && record.account_id.trim().length > 0 && typeof record.authorization_id === "string" && record.authorization_id.trim().length > 0 && typeof record.wallet_session_id === "string" && record.wallet_session_id.trim().length > 0 && typeof record.quota_id === "string" && record.quota_id.trim().length > 0 && typeof record.threshold_session_id === "string" && record.threshold_session_id.trim().length > 0 && typeof record.org_id === "string" && record.org_id.trim().length > 0 && typeof record.project_id === "string" && record.project_id.trim().length > 0 && typeof record.environment === "string" && record.environment.trim().length > 0 && typeof record.project_environment_id === "string" && record.project_environment_id.trim().length > 0 && typeof record.signing_worker_id === "string" && record.signing_worker_id.trim().length > 0 && typeof record.expires_at_ms === "number" && Number.isSafeInteger(record.expires_at_ms) && record.expires_at_ms > 0;
+	return record.kind === "gateway_owner_wallet_session" && typeof record.ownership_generation === "number" && Number.isSafeInteger(record.ownership_generation) && record.ownership_generation > 0 && typeof record.subject_id === "string" && record.subject_id.trim().length > 0 && typeof record.account_id === "string" && record.account_id.trim().length > 0 && typeof record.authorization_id === "string" && record.authorization_id.trim().length > 0 && typeof record.wallet_session_id === "string" && record.wallet_session_id.trim().length > 0 && typeof record.quota_id === "string" && record.quota_id.trim().length > 0 && typeof record.threshold_session_id === "string" && record.threshold_session_id.trim().length > 0 && typeof record.org_id === "string" && record.org_id.trim().length > 0 && typeof record.project_id === "string" && record.project_id.trim().length > 0 && typeof record.environment === "string" && record.environment.trim().length > 0 && typeof record.project_environment_id === "string" && record.project_environment_id.trim().length > 0 && typeof record.signing_worker_id === "string" && record.signing_worker_id.trim().length > 0 && typeof record.expires_at_ms === "number" && Number.isSafeInteger(record.expires_at_ms) && record.expires_at_ms > 0;
 }
 async function proxyOwnerLaneAdmittedNormalSigningRequest(input) {
 	const expectedMaterialActivation = routerAbMpcMaterialActivationRefFromWire(input.expectedMaterialActivation);

package/dist/esm/router/transport/fetch/routes/passkeyCustody.js

@@ -1,20 +1,20 @@
 import { parseEmailOtpChallengeId, parseOrgId, parseProviderSubject, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletRecoveryOperationId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { buildVaultOperationRef, parseAuthFactorId, parseAuthorizationAuditEventId, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parseDeviceId, parsePrincipalId, parseTenantId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
+import { isPlainObject, requireTrimmedString } from "../../../../shared-ts/src/utils/validation.js";
 import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
 import { sha256Utf8DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { buildCapabilityOperationEnvelope, computeCapabilityOperationFingerprintDigest } from "../../../../shared-ts/src/authorization/operationFingerprint.js";
-import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import { isPlainObject, requireTrimmedString } from "../../../../shared-ts/src/utils/validation.js";
 import { buildPasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseSessionOrigin, parseVerifiedOwnerProofId } from "../../../../authorization/domain.js";
 import { buildVerifiedWalletOperationEmailOtpFactorResult, buildVerifiedWalletOperationPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
 import { findRouteDefinitionById, matchesRouteDefinitionRequest } from "../../../framework/routeDefinitions.js";
-import { readJson } from "../../../framework/http.js";
 import { extractBearerCredential, resolveSourceIpFromFetchHeaders } from "../../../auth/routerApiKeyAuth.js";
 import { toFetchRouteResponse } from "../../../framework/routeResponses.js";
 import { parsePasskeyCustodyEnvelopeRecord } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
+import { readJson } from "../../../framework/http.js";
 import { isHostWithinRpId, originHostnameOrEmpty } from "../../../../core/authService/webauthnOidcHelpers.js";
 import { parseRecoveryCodeReservationId } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
 import { computeWalletCustodyAdminChallengeDigest } from "../../../../shared-ts/src/authorization/walletCustodyOperation.js";

package/dist/esm/router/transport/fetch/routes/sessions.js

@@ -1,17 +1,17 @@
 import { parseOrgId, parseProviderSubject, parseWalletAuthMethodId, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseMpcWalletSigningQuotaId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
 import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { base58Encode } from "../../../../shared-ts/src/utils/base58.js";
-import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
 import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1, parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1, parseRouterAbEcdsaPostRegistrationSessionActivationResponseV1, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { parseHostedWalletSeamsSessionExchangeCode, parseHostedWalletSeamsSessionExchangeNonce, parsePrimaryWalletSessionOperationCredentialToken, parseSessionOrigin, projectExactWalletSessionAuthorizationV1 } from "../../../../authorization/domain.js";
 import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
-import { json, readJson } from "../../../framework/http.js";
 import { extractBearerCredential, resolveSourceIpFromFetchHeaders } from "../../../auth/routerApiKeyAuth.js";
+import { json, readJson } from "../../../framework/http.js";
 import { routerApiEmailOtpRouteService } from "../../../framework/authServicePort.js";
 import { emailOtpStatusCode, hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_EXPORT_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
@@ -266,6 +266,7 @@ async function handleHostedWalletSessionExchangeIssue(ctx) {
 		ok: true,
 		delivery: {
 			exchangeCode: delivery.exchangeCode,
+			home: delivery.home,
 			nonce: delivery.nonce,
 			appOrigin: delivery.appOrigin,
 			walletOrigin: delivery.walletOrigin,

package/dist/esm/router/transport/fetch/routes/thresholdEcdsa.js

@@ -7,17 +7,21 @@ import "../../../../shared-ts/src/utils/encoders.js";
 import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1, ROUTER_AB_ECDSA_DERIVATION_REFRESH_PATH, computeRouterAbEcdsaOperationStepUpChallengeB64u, parseRouterAbEcdsaDerivationActivationRefreshCommitRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1, parseRouterAbEcdsaDerivationExplicitExportRequestV1, parseRouterAbEcdsaOperationStepUpAuthorizationRequestV1, parseRouterAbEcdsaPostRegistrationSessionActivationRequestV1, parseRouterAbEcdsaPrepareSourceV1, sameRouterAbEcdsaDerivationNormalSigningScopeV1, sameRouterAbEcdsaDerivationPublicCapabilityV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { buildWalletSessionCapabilitySubjectsV1, projectActiveWalletSession } from "../../../../authorization/domain.js";
+import { buildWalletSessionCapabilitySubjectsV1, projectActiveWalletSession, walletSessionAuthorizationV2RecordsEqual } from "../../../../authorization/domain.js";
 import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { WALLET_SESSION_FAILURE_CODES } from "../../../../shared-ts/src/utils/walletSessionFailure.js";
-import { json, readJson } from "../../../framework/http.js";
 import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
 import { walletSessionFailure, walletSessionFailureStatus } from "../../../auth/walletSessionFailure.js";
+import { resolveWalletSessionAuthorizationV2Admission } from "../../../domains/signingOperations/walletExecutionAdmission.js";
 import { resolveWalletSessionOperationCredentialAdmission, validateEcdsaPreprocessingSession } from "../../../auth/commonRouterUtils.js";
+import { json, readJson } from "../../../framework/http.js";
 import { thresholdEcdsaStatusCode } from "../../../../threshold/statusCodes.js";
-import { parseEcdsaServerTiming } from "../../../../shared-ts/src/utils/ecdsaServerTiming.js";
+import { signingPrepareSessionResponse } from "../../../domains/signingOperations/signingPrepareSession.js";
 import { authenticateRouterAbWalletOperationStepUpIdentity } from "../../../domains/signingOperations/routerAbOperationStepUp.js";
-import { admitRouterAbEcdsaReusableWalletSessionOperation, authenticateRouterAbEcdsaOperationStepUp, authorizeRouterAbEcdsaDerivationNormalSigningRoute, buildRouterAbEcdsaOwnerOperationStepUpPreparation, claimRouterAbEcdsaOperationStepUp, completeRouterAbEcdsaOperation, decideRouterAbEcdsaOwnerOperationAuthorization, resolveFreshRouterAbEcdsaMaterialActivation, routerAbEcdsaAtomicAuthorizationConfigured, routerAbEcdsaOperationInProgressResult, routerAbEcdsaOwnerOperationFailureResult, routerAbEcdsaReplayHttpResponse, routerAbEcdsaReplayUnavailableResult } from "../../../domains/signingOperations/routerAbEcdsaDerivationNormalSigningRoute.js";
+import { admitRouterAbEcdsaReusableWalletSessionOperation, authenticateRouterAbEcdsaOperationStepUp, authorizeRouterAbEcdsaDerivationNormalSigningRoute, buildRouterAbEcdsaOwnerOperationStepUpPreparation, claimRouterAbEcdsaOperationStepUp, decideRouterAbEcdsaOwnerOperationAuthorization, resolveFreshRouterAbEcdsaMaterialActivation, routerAbEcdsaAtomicAuthorizationConfigured, routerAbEcdsaOperationInProgressResult, routerAbEcdsaOwnerOperationFailureResult, routerAbEcdsaReplayHttpResponse, routerAbEcdsaReplayUnavailableResult } from "../../../domains/signingOperations/routerAbEcdsaDerivationNormalSigningRoute.js";
+import { finishRouterAbEcdsaSigningResponse } from "../../../domains/signingOperations/ecdsaSigningResponse.js";
+import { buildAuthorizedOperationWire } from "../../../domains/signingOperations/authorizedOperationWire.js";
+import { parseEcdsaServerTiming } from "../../../../shared-ts/src/utils/ecdsaServerTiming.js";
 import { parseRouterAbEcdsaDerivationPoolFillInitRouteRequest, parseRouterAbEcdsaDerivationPoolFillStepRouteRequest } from "../../../domains/ecdsa/thresholdEcdsaRequestValidation.js";
 import { verifyEcdsaOperationStepUpFactor } from "./ecdsaOperationStepUpFactor.js";
 import { resolveWalletAuthMethodIdForAuthority } from "../../../../core/signingLanes/WalletExecutionLaneProjection.js";
@@ -49,6 +53,7 @@ async function ecdsaOperationStepUpBinding(ctx, session, operation) {
 	const pinned = await readPinnedEcdsaStepUpWalletScope(ctx, session, operation);
 	return {
 		kind: "operation_step_up",
+		ownershipGeneration: pinned.ownershipGeneration,
 		authorizationSessionId: session.sessionId,
 		orgId: scope.orgId,
 		projectId: scope.projectId,
@@ -68,7 +73,10 @@ async function readPinnedEcdsaStepUpWalletScope(ctx, session, operation) {
 	const scope = session.runtimePolicyScope;
 	if (pinned.orgId !== scope.orgId || pinned.projectId !== scope.projectId) throw new Error("Step-up wallet scope differs from the Wallet Session scope");
 	return {
-		...pinned,
+		orgId: pinned.orgId,
+		projectId: pinned.projectId,
+		projectEnvironmentId: pinned.projectEnvironmentId,
+		ownershipGeneration: pinned.ownershipGeneration,
 		walletId: session.walletId
 	};
 }
@@ -76,7 +84,7 @@ function buildRouterAbEcdsaAuthorizedOperationWire(input) {
 	const operation = input.operation;
 	const operationRef = operation.operation.operation;
 	if (operationRef.capabilityKind !== "evm_ecdsa_mpc_signing" || operationRef.operationKind !== "evm.sign_transaction") throw new Error("ECDSA authorized operation capability or operation kind is invalid");
-	const commonAuthorizedOperation = {
+	return buildAuthorizedOperationWire(input, {
 		authorized_operation_id: operation.authorizedOperationId,
 		operation_id: operation.operation.operationId,
 		capability_kind: "evm_ecdsa_mpc_signing",
@@ -85,66 +93,7 @@ function buildRouterAbEcdsaAuthorizedOperationWire(input) {
 		intent_digest_b64u: operation.operation.digests.intentDigest,
 		display_digest_b64u: operation.operation.digests.displayDigest,
 		operation_fingerprint_digest: operation.operationFingerprintDigest
-	};
-	switch (input.binding.kind) {
-		case "reusable_wallet_session":
-			if (operation.authorization.kind !== "authorization_grant" || operation.quota.kind !== "consume_reusable_wallet_session") throw new Error("Reusable Wallet Session authorized operation is invalid");
-			return {
-				binding: {
-					kind: "reusable_wallet_session",
-					authorization_id: operation.authorization.authorizationGrantRef.authorizationId,
-					wallet_session_id: input.binding.walletSessionId,
-					quota_id: input.binding.quotaId
-				},
-				authorized_operation: {
-					kind: "reusable_wallet_session_authorized_operation_v1",
-					...commonAuthorizedOperation
-				}
-			};
-		case "gateway_owner_wallet_session":
-			if (operation.authorization.kind !== "authorization_grant" || operation.quota.kind !== "consume_reusable_wallet_session") throw new Error("Gateway owner Wallet Session authorized operation is invalid");
-			return {
-				binding: {
-					kind: "gateway_owner_wallet_session",
-					subject_id: input.binding.subjectId,
-					account_id: input.binding.accountId,
-					authorization_id: input.binding.authorizationId,
-					wallet_session_id: input.binding.walletSessionId,
-					quota_id: input.binding.quotaId,
-					threshold_session_id: input.binding.thresholdSessionId,
-					org_id: input.binding.orgId,
-					project_id: input.binding.projectId,
-					environment: input.binding.environment,
-					project_environment_id: input.binding.projectEnvironmentId,
-					signing_worker_id: input.binding.signingWorkerId,
-					expires_at_ms: input.binding.expiresAtMs
-				},
-				authorized_operation: {
-					kind: "reusable_wallet_session_authorized_operation_v1",
-					...commonAuthorizedOperation
-				}
-			};
-		case "operation_step_up":
-			if (operation.authorization.kind !== "verified_step_up" || operation.quota.kind !== "quota_neutral") throw new Error("Verified step-up authorized operation is invalid");
-			return {
-				binding: {
-					kind: "operation_step_up",
-					authorization_session_id: input.binding.authorizationSessionId,
-					org_id: input.binding.orgId,
-					project_id: input.binding.projectId,
-					environment: input.binding.environment,
-					project_environment_id: input.binding.projectEnvironmentId,
-					subject_id: input.binding.subjectId,
-					account_id: input.binding.accountId
-				},
-				authorized_operation: {
-					kind: "verified_step_up_authorized_operation_v1",
-					authorization_session_id: input.binding.authorizationSessionId,
-					evidence_set_digest: operation.authorization.evidenceSetDigest,
-					...commonAuthorizedOperation
-				}
-			};
-	}
+	});
 }
 function decideRouterAbEcdsaOperationStepUpExecution(input) {
 	if (input.admissionKind === "replayed") return {
@@ -299,6 +248,7 @@ async function executeRouterAbEcdsaDerivationNormalSigningRoute(input, timing) {
 			operation: authorizedOperation,
 			binding: {
 				kind: "gateway_owner_wallet_session",
+				ownershipGeneration: pinnedOwnerScope.ownershipGeneration,
 				subjectId: String(session.principalId),
 				accountId: String(session.walletId),
 				authorizationId: String(session.authorizationId),
@@ -345,8 +295,18 @@ async function executeRouterAbEcdsaDerivationNormalSigningRoute(input, timing) {
 		walletRegistration: input.ctx.service.walletRegistration,
 		body: admittedBody
 	});
+	if (input.phase === "prepare" && upstream.ok) {
+		const body = signingPrepareSessionResponse(await upstream.json(), authorization);
+		timing.proxy = performance.now() - proxyStartedAt;
+		const headers = new Headers(upstream.headers);
+		headers.delete("content-length");
+		headers.delete("content-encoding");
+		return new Response(JSON.stringify(body), {
+			status: upstream.status,
+			headers
+		});
+	}
 	return finishRouterAbEcdsaSigningResponse({
-		phase: input.phase,
 		upstream,
 		operation: authorizedOperation,
 		authorizedOperations: input.ctx.service.authorizedOperations,
@@ -354,35 +314,6 @@ async function executeRouterAbEcdsaDerivationNormalSigningRoute(input, timing) {
 		proxyStartedAt
 	});
 }
-async function finishRouterAbEcdsaSigningResponse(input) {
-	const upstream = input.upstream;
-	if (input.phase === "prepare" && upstream.ok) {
-		input.timing.proxy = performance.now() - input.proxyStartedAt;
-		return upstream;
-	}
-	const upstreamBodyText = await upstream.clone().text().catch(() => "");
-	input.timing.proxy = performance.now() - input.proxyStartedAt;
-	if (isRouterAbEcdsaOperationInProgressResponse({
-		status: upstream.status,
-		bodyText: upstreamBodyText
-	})) return upstream;
-	const completionStartedAt = performance.now();
-	await completeRouterAbEcdsaOperation({
-		authorizedOperations: input.authorizedOperations,
-		operation: input.operation,
-		result: upstream.ok ? "succeeded" : upstream.status < 500 ? "failed_before_side_effect" : "failed_after_side_effect",
-		response: {
-			status: upstream.status,
-			contentType: upstream.headers.get("content-type") || "application/json",
-			bodyText: upstreamBodyText
-		}
-	});
-	input.timing.complete = performance.now() - completionStartedAt;
-	return upstream;
-}
-function isRouterAbEcdsaOperationInProgressResponse(input) {
-	return input.status === 409 && input.bodyText.includes("ReplayedLocalRequest:") && input.bodyText.includes("SigningWorker ECDSA effect is already in progress");
-}
 function routerAbEcdsaReplayResponse(operation) {
 	const response = routerAbEcdsaReplayHttpResponse(operation);
 	if (response) return response;
@@ -392,31 +323,40 @@ function routerAbEcdsaReplayResponse(operation) {
 async function resolveV2EcdsaOperationStepUpAdmission(input) {
 	const token = extractBearerCredential(input.ctx.request.headers);
 	if (!token) return { kind: "not_found" };
-	let resolution;
+	let context;
 	try {
-		resolution = await resolveWalletSessionOperationCredentialAdmission({
-			authorizationSessions: input.ctx.service.authorizationSessions,
+		context = await input.ctx.service.authorizationSessions.readWalletSessionExactOperationContextByCredential({
+			tenantId: input.ctx.service.authorizationSessions.tenantId,
 			token,
-			nowMs: Date.now(),
-			operation: {
-				keyFamily: "ecdsa_secp256k1",
-				operationKind: input.operation.operation_kind
-			}
+			nowMs: Date.now()
 		});
 	} catch {
 		return { kind: "unavailable" };
 	}
-	if (resolution.kind === "not_found") return { kind: "not_found" };
-	if (resolution.kind === "rejected") return {
+	if (!context) return {
 		kind: "rejected",
-		message: "ECDSA operation step-up Wallet Session authorization is invalid"
+		message: "ECDSA operation step-up Wallet Session is unavailable"
 	};
-	if (resolution.admission.curve !== "ecdsa") return {
+	const session = context.session;
+	const admission = resolveWalletSessionAuthorizationV2Admission({
+		authorization: session,
+		authority: context.authority,
+		authMethod: context.authMethod,
+		retiredAtMs: context.retiredAtMs,
+		nowMs: Date.now(),
+		operation: {
+			tenantId: session.tenantId,
+			principalId: session.principalId,
+			walletId: session.walletId,
+			keyFamily: "ecdsa_secp256k1",
+			operationKind: input.operation.operation_kind
+		}
+	});
+	if (!admission.ok || admission.keyFamily !== "ecdsa_secp256k1") return {
 		kind: "rejected",
-		message: "ECDSA operation step-up Wallet Session family is invalid"
+		message: "ECDSA operation step-up Wallet Session authorization is invalid"
 	};
-	const session = resolution.admission.context.authorization.session;
-	const admittedSigner = resolution.admission.admission.signer;
+	const admittedSigner = admission.signer;
 	if (input.operation.wallet_id !== String(session.walletId) || input.operation.material_activation.material_owner !== String(session.walletId) || input.operation.expires_at_ms > session.expiresAtMs || input.operation.expires_at_ms <= Date.now()) return {
 		kind: "rejected",
 		message: "ECDSA operation step-up Wallet Session scope is invalid"
@@ -432,13 +372,13 @@ async function resolveV2EcdsaOperationStepUpAdmission(input) {
 		kind: "rejected",
 		message: "ECDSA operation step-up material is not uniquely active"
 	};
-	if (input.operation.signing_worker_id !== input.operation.normal_signing_scope.signing_worker.server_id || !sameRouterAbMpcMaterialActivationRef(input.operation.material_activation, input.operation.normal_signing_scope.material_activation) || !sameRouterAbMpcMaterialActivationRef(input.operation.material_activation, routerAbMpcMaterialActivationRefToWire(resolution.admission.admission.materialActivation))) return {
+	if (input.operation.signing_worker_id !== input.operation.normal_signing_scope.signing_worker.server_id || !sameRouterAbMpcMaterialActivationRef(input.operation.material_activation, input.operation.normal_signing_scope.material_activation) || !sameRouterAbMpcMaterialActivationRef(input.operation.material_activation, routerAbMpcMaterialActivationRefToWire(admission.materialActivation))) return {
 		kind: "rejected",
 		message: "ECDSA operation step-up material activation is invalid"
 	};
 	const activeMaterial = {
 		ok: true,
-		materialActivation: routerAbMpcMaterialActivationRefToWire(resolution.admission.admission.materialActivation),
+		materialActivation: routerAbMpcMaterialActivationRefToWire(admission.materialActivation),
 		keyHandle: signer.walletKey.keyHandle,
 		relayerKeyId: signer.walletKey.relayerKeyId,
 		participantIds: signer.walletKey.participantIds,
@@ -447,13 +387,13 @@ async function resolveV2EcdsaOperationStepUpAdmission(input) {
 	if (input.operation.operation_kind === "evm.sign_transaction") return {
 		kind: "admitted",
 		operationKind: "evm.sign_transaction",
-		admission: resolution.admission,
+		context,
 		activeMaterial
 	};
 	return {
 		kind: "admitted",
 		operationKind: "evm.export_key",
-		admission: resolution.admission,
+		context,
 		activeMaterial,
 		exportTopology: {
 			signer_set: signer.walletKey.publicCapability.signer_set,
@@ -513,8 +453,8 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 	let v2AuthorityRef;
 	if (v2Resolution.kind === "admitted") {
 		v2AuthorityRef = await walletAuthAuthorityRef({ authority });
-		const session = v2Resolution.admission.context.authorization.session;
-		const context = v2Resolution.admission.context;
+		const session = v2Resolution.context.session;
+		const context = v2Resolution.context;
 		if (authority.walletId !== String(session.walletId) || authority.bindingId !== context.authMethod.walletAuthMethodId || context.authMethod.walletAuthorityId !== context.authority.authorityId) return json({
 			ok: false,
 			code: "scope_mismatch",
@@ -542,10 +482,10 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 		ok: true,
 		authorizedOperations: proofAuthenticated.authorizedOperations,
 		session: {
-			tenantId: v2Resolution.admission.context.authorization.session.tenantId,
-			principalId: v2Resolution.admission.context.authorization.session.principalId,
-			sessionId: String(v2Resolution.admission.context.authorization.session.authorizationId),
-			walletId: String(v2Resolution.admission.context.authorization.session.walletId),
+			tenantId: v2Resolution.context.session.tenantId,
+			principalId: v2Resolution.context.session.principalId,
+			sessionId: String(v2Resolution.context.session.authorizationId),
+			walletId: String(v2Resolution.context.session.walletId),
 			runtimePolicyScope: activeMaterial.runtimePolicyScope,
 			laneAuthorization: {
 				kind: "authority_ref",
@@ -591,7 +531,7 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 			code: "wallet_session_unavailable",
 			message: "Wallet Session authorization is unavailable"
 		}, { status: 503 });
-		if (refreshedV2Resolution.kind !== "admitted" || !sameWalletSessionOperationCredentialAdmission(v2Resolution.admission, refreshedV2Resolution.admission)) return json({
+		if (refreshedV2Resolution.kind !== "admitted" || !walletSessionAuthorizationV2RecordsEqual(v2Resolution.context.session, refreshedV2Resolution.context.session)) return json({
 			ok: false,
 			code: "scope_mismatch",
 			message: "ECDSA operation step-up Wallet Session authorization changed"
@@ -867,6 +807,7 @@ async function authorizeEcdsaPoolFillOperationStepUp(input) {
 				materialExpiresAtMs: input.operation.expires_at_ms
 			},
 			ownerWalletScope,
+			ownershipGeneration: ownerWalletScope.ownershipGeneration,
 			routerAbEcdsaDerivationNormalSigning: {
 				kind: ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1,
 				scope: input.operation.normal_signing_scope
@@ -946,6 +887,7 @@ async function authorizeEcdsaPoolFill(input) {
 					thresholdExpiresAtMs: session.expiresAtMs,
 					authorization: { kind: "wallet_session" },
 					ownerWalletScope: validated.ownerWalletScope,
+					ownershipGeneration: validated.ownerWalletScope.ownershipGeneration,
 					routerAbEcdsaDerivationNormalSigning: normalSigning
 				}
 			};
@@ -1314,11 +1256,6 @@ async function admitStrictEcdsaExportOperationStepUp(input) {
 		case "wallet_session_quota_exhausted": return strictEcdsaExportFailure(409, result.kind, "Operation step-up authorization is invalid");
 	}
 }
-function sameWalletSessionOperationCredentialAdmission(left, right) {
-	const leftSession = left.context.authorization.session;
-	const rightSession = right.context.authorization.session;
-	return leftSession.tenantId === rightSession.tenantId && leftSession.principalId === rightSession.principalId && leftSession.walletId === rightSession.walletId && leftSession.authorityId === rightSession.authorityId && leftSession.walletAuthMethodId === rightSession.walletAuthMethodId && leftSession.authorityDigestB64u === rightSession.authorityDigestB64u && leftSession.authorityRevocationEpoch === rightSession.authorityRevocationEpoch && leftSession.authorizationId === rightSession.authorizationId && leftSession.walletSessionId === rightSession.walletSessionId && leftSession.quotaId === rightSession.quotaId && leftSession.expiresAtMs === rightSession.expiresAtMs && left.context.authority.authorityId === right.context.authority.authorityId && left.context.authority.authorityDigestB64u === right.context.authority.authorityDigestB64u && left.context.authMethod.walletAuthMethodId === right.context.authMethod.walletAuthMethodId && left.context.authMethod.walletAuthorityId === right.context.authMethod.walletAuthorityId && left.context.retiredAtMs === right.context.retiredAtMs && sameRouterAbMpcMaterialActivationRef(routerAbMpcMaterialActivationRefToWire(left.admission.materialActivation), routerAbMpcMaterialActivationRefToWire(right.admission.materialActivation));
-}
 async function authorizeStrictEcdsaV2ExportOperationStepUp(input) {
 	const operation = input.request.operation;
 	if (!operation) return strictEcdsaExportFailure(400, "invalid_body", "Operation step-up export requires operation preparation");
@@ -1328,8 +1265,8 @@ async function authorizeStrictEcdsaV2ExportOperationStepUp(input) {
 	});
 	if (resolution.kind === "unavailable") return strictEcdsaExportFailure(503, "wallet_session_unavailable", "Wallet Session authorization is unavailable");
 	if (resolution.kind !== "admitted") return strictEcdsaExportFailure(403, "scope_mismatch", "ECDSA export operation step-up Wallet Session authorization is invalid");
-	if (!sameWalletSessionOperationCredentialAdmission(input.authorization.v2Admission, resolution.admission)) return strictEcdsaExportFailure(403, "scope_mismatch", "ECDSA export operation step-up Wallet Session changed");
-	const session = resolution.admission.context.authorization.session;
+	if (!walletSessionAuthorizationV2RecordsEqual(input.authorization.v2Admission.context.authorization.session, resolution.context.session)) return strictEcdsaExportFailure(403, "scope_mismatch", "ECDSA export operation step-up Wallet Session changed");
+	const session = resolution.context.session;
 	const activeMaterial = resolution.activeMaterial;
 	if (input.request.authorization.kind !== "operation_step_up" || operation.operation_kind !== "evm.export_key" || operation.wallet_id !== String(session.walletId) || operation.wallet_id !== input.request.lifecycle.account_id || operation.material_activation.material_owner !== String(session.walletId) || operation.material_activation.signing_worker !== input.request.lifecycle.selected_server_id || operation.signing_worker_id !== input.request.lifecycle.selected_server_id || !sameRouterAbMpcMaterialActivationRef(operation.material_activation, input.request.material_activation) || operation.expires_at_ms < input.request.expires_at_ms || !strictEcdsaExportScopeMatchesRequest({
 		request: input.request,
@@ -1680,6 +1617,6 @@ async function handleThresholdEcdsa(ctx) {
 	return null;
 }
 //#endregion
-export { authorizeEcdsaPoolFill, finishRouterAbEcdsaSigningResponse, handleStrictEcdsaSessionActivation, handleThresholdEcdsa };
+export { authorizeEcdsaPoolFill, handleStrictEcdsaSessionActivation, handleThresholdEcdsa };
 
 //# sourceMappingURL=thresholdEcdsa.js.map