@seams/wallet-server 0.8.0 → 0.9.1

package/dist/esm/router/transport/fetch/routes/thresholdEd25519.js

@@ -1,11 +1,11 @@
 import { parseEmailOtpChallengeId, parseOrgId, parseProviderSubject, parseWalletId, parseWebAuthnCredentialIdB64u } from "../../../../shared-ts/src/utils/domainIds.js";
-import { buildAuthorizationGrantRef, buildNearEd25519MpcOperationRef, parseAuthFactorId, parseAuthorizationAuditEventId, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parsePrincipalId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { buildAuthorizationGrantRef, parseAuthFactorId, parseAuthorizationAuditEventId, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parsePrincipalId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { buildCapabilityOperationEnvelope, computeCapabilityOperationFingerprintDigest, parseCapabilityOperationFingerprintDigest, parseSigningOperationFingerprintDigest } from "../../../../shared-ts/src/authorization/operationFingerprint.js";
 import "../../../../shared-ts/src/utils/encoders.js";
-import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
 import { sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { isPasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { authorizedOperationReplayBodyInit, parseSessionOrigin, parseVerifiedOwnerProofId } from "../../../../authorization/domain.js";
@@ -13,15 +13,18 @@ import { buildVerifiedWalletOperationEmailOtpFactorResult, buildVerifiedWalletOp
 import { ROUTER_AB_ED25519_NORMAL_SIGNING_PATH, ROUTER_AB_ED25519_NORMAL_SIGNING_PREPARE_PATH, ROUTER_AB_ED25519_WALLET_SESSION_PATH } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 import { normalizeCorsOrigin } from "../../../../core/SessionService.js";
 import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
-import { json, readJson } from "../../../framework/http.js";
 import { resolveThresholdRuntimePolicyScope } from "../../../auth/commonRouterUtils.js";
+import { json, readJson } from "../../../framework/http.js";
 import { emailOtpStatusCode, hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { thresholdEd25519StatusCode } from "../../../../threshold/statusCodes.js";
+import { signingPrepareSessionResponse } from "../../../domains/signingOperations/signingPrepareSession.js";
 import { authenticateRouterAbWalletOperationStepUpIdentity } from "../../../domains/signingOperations/routerAbOperationStepUp.js";
 import { buildRouterAbEd25519PrivateSigningWorkerBody } from "../../../domains/signingOperations/routerAbPrivateSigningWorker.js";
+import { buildAuthorizedOperationWire } from "../../../domains/signingOperations/authorizedOperationWire.js";
 import { proxyNormalSigningRequestToMpcRouter, proxyOwnerLaneAdmittedNormalSigningRequest } from "./normalSigningRouterProxy.js";
 import { sealEmailOtpFactorSecretForWorker } from "../../../domains/emailOtp/emailOtpRouteHandlers.js";
+import { resolveEd25519WalletSessionOperation, revalidateEd25519StepUpOperation } from "./ed25519AuthorizedOperationRevalidation.js";
 import { parseEd25519ReusableAuthorizedOperationReceipt, parseEd25519VerifiedStepUpAuthorizedOperationReceipt, requireEd25519OperationKind } from "../../../domains/signingOperations/ed25519AuthorizedOperationReceipt.js";
 import { authorizeRouterAbEd25519NormalSigningRoute, buildRouterAbEd25519OwnerOperationStepUpPreparation, decideRouterAbEd25519OwnerOperationAuthorization, parseRouterAbEd25519OperationStepUpScope, parseRouterAbOperationStepUpOperation, routerAbEd25519OwnerOperationFailureResult } from "../../../domains/signingOperations/routerAbEd25519NormalSigningRoute.js";
 import { parseThresholdEd25519OperationStepUpGrantRequest, parseThresholdEd25519SessionRouteRequest } from "../../../domains/ed25519Yao/session/thresholdEd25519RequestValidation.js";
@@ -56,11 +59,12 @@ function ed25519ReusableWalletSessionIdentity(authorization) {
 		quotaId: session.quotaId
 	};
 }
-function buildEd25519GatewayOwnerWalletSessionBinding(authorization, projectEnvironmentId) {
+function buildEd25519GatewayOwnerWalletSessionBinding(authorization, pinned) {
 	const session = ed25519ReusableWalletSession(authorization);
 	const runtimePolicyScope = authorization.activeMaterial.runtimePolicyScope;
 	return {
 		kind: "gateway_owner_wallet_session",
+		ownershipGeneration: pinned.ownershipGeneration,
 		subjectId: String(session.principalId),
 		accountId: String(session.walletId),
 		authorizationId: String(session.authorizationId),
@@ -70,20 +74,16 @@ function buildEd25519GatewayOwnerWalletSessionBinding(authorization, projectEnvi
 		orgId: runtimePolicyScope.orgId,
 		projectId: runtimePolicyScope.projectId,
 		environment: runtimePolicyScope.envId,
-		projectEnvironmentId,
+		projectEnvironmentId: pinned.projectEnvironmentId,
 		signingWorkerId: authorization.activeMaterial.signingWorkerId,
 		expiresAtMs: session.expiresAtMs
 	};
 }
-async function readPinnedEd25519WalletProjectEnvironmentId(ctx, authorization, operation) {
-	const session = ed25519ReusableWalletSession(authorization);
+/** The scope the operation's own admission pinned, checked against the active material. */
+function pinnedEd25519WalletScope(authorization, pinned) {
 	const scope = authorization.activeMaterial.runtimePolicyScope;
-	const pinned = await ctx.service.authorizedOperations.readPinnedOwnerWalletScope({
-		operation,
-		walletId: session.walletId
-	});
 	if (pinned.orgId !== scope.orgId || pinned.projectId !== scope.projectId) throw new Error("Pinned owner Wallet Session scope differs from active material");
-	return pinned.projectEnvironmentId;
+	return pinned;
 }
 /**
 * The Router binding for a verified step-up: the wallet it signs for and the
@@ -99,6 +99,7 @@ async function ed25519OperationStepUpBinding(ctx, session, operation) {
 	if (pinned.orgId !== scope.orgId || pinned.projectId !== scope.projectId) throw new Error("Step-up wallet scope differs from the Wallet Session scope");
 	return {
 		kind: "operation_step_up",
+		ownershipGeneration: pinned.ownershipGeneration,
 		authorizationSessionId: session.sessionId,
 		orgId: scope.orgId,
 		projectId: scope.projectId,
@@ -113,7 +114,7 @@ function buildRouterAbEd25519AuthorizedOperationWire(input) {
 	const operationRef = operation.operation.operation;
 	if (operationRef.capabilityKind !== "near_ed25519_mpc_signing") throw new Error("Ed25519 authorized operation capability is invalid");
 	const operationKind = requireEd25519OperationKind(operationRef.operationKind);
-	const commonAuthorizedOperation = {
+	return buildAuthorizedOperationWire(input, {
 		authorized_operation_id: operation.authorizedOperationId,
 		operation_id: operation.operation.operationId,
 		capability_kind: "near_ed25519_mpc_signing",
@@ -122,66 +123,7 @@ function buildRouterAbEd25519AuthorizedOperationWire(input) {
 		intent_digest_b64u: operation.operation.digests.intentDigest,
 		display_digest_b64u: operation.operation.digests.displayDigest,
 		operation_fingerprint_digest: operation.operationFingerprintDigest
-	};
-	switch (input.binding.kind) {
-		case "reusable_wallet_session":
-			if (operation.authorization.kind !== "authorization_grant" || operation.quota.kind !== "consume_reusable_wallet_session") throw new Error("Reusable Wallet Session authorized operation is invalid");
-			return {
-				binding: {
-					kind: "reusable_wallet_session",
-					authorization_id: operation.authorization.authorizationGrantRef.authorizationId,
-					wallet_session_id: input.binding.walletSessionId,
-					quota_id: input.binding.quotaId
-				},
-				authorized_operation: {
-					kind: "reusable_wallet_session_authorized_operation_v1",
-					...commonAuthorizedOperation
-				}
-			};
-		case "gateway_owner_wallet_session":
-			if (operation.authorization.kind !== "authorization_grant" || operation.quota.kind !== "consume_reusable_wallet_session") throw new Error("Gateway owner Wallet Session authorized operation is invalid");
-			return {
-				binding: {
-					kind: "gateway_owner_wallet_session",
-					subject_id: input.binding.subjectId,
-					account_id: input.binding.accountId,
-					authorization_id: input.binding.authorizationId,
-					wallet_session_id: input.binding.walletSessionId,
-					quota_id: input.binding.quotaId,
-					threshold_session_id: input.binding.thresholdSessionId,
-					org_id: input.binding.orgId,
-					project_id: input.binding.projectId,
-					environment: input.binding.environment,
-					project_environment_id: input.binding.projectEnvironmentId,
-					signing_worker_id: input.binding.signingWorkerId,
-					expires_at_ms: input.binding.expiresAtMs
-				},
-				authorized_operation: {
-					kind: "reusable_wallet_session_authorized_operation_v1",
-					...commonAuthorizedOperation
-				}
-			};
-		case "operation_step_up":
-			if (operation.authorization.kind !== "verified_step_up" || operation.quota.kind !== "quota_neutral") throw new Error("Verified step-up authorized operation is invalid");
-			return {
-				binding: {
-					kind: "operation_step_up",
-					authorization_session_id: input.binding.authorizationSessionId,
-					org_id: input.binding.orgId,
-					project_id: input.binding.projectId,
-					environment: input.binding.environment,
-					project_environment_id: input.binding.projectEnvironmentId,
-					subject_id: input.binding.subjectId,
-					account_id: input.binding.accountId
-				},
-				authorized_operation: {
-					kind: "verified_step_up_authorized_operation_v1",
-					authorization_session_id: input.binding.authorizationSessionId,
-					evidence_set_digest: operation.authorization.evidenceSetDigest,
-					...commonAuthorizedOperation
-				}
-			};
-	}
+	});
 }
 async function releaseEmailOtpFactorForWorker(input) {
 	const unsealed = await input.emailOtp.removeEmailOtpServerSeal({ wrappedCiphertext: input.request.enrollment.serverSealedFactorCiphertextB64u });
@@ -340,21 +282,24 @@ async function authorizeEd25519ReusableWalletSessionOperation(input) {
 			}
 		});
 		const authorizedOperationId = requireAuthorizationValue(parseAuthorizedOperationId(`ed25519-operation:${operation.operationId}:${scope.request_id}`));
-		const outcome = await input.ctx.service.authorizedOperations.admitAuthorizedOperation({ operation: {
-			tenantId: identity.tenantId,
-			authorizedOperationId,
-			auditEventId: requireAuthorizationValue(parseAuthorizationAuditEventId(`ed25519-operation-audit:${operation.operationId}`)),
-			operation: envelope,
-			authorization: {
-				kind: "authorization_grant",
-				authorizationGrantRef: buildAuthorizationGrantRef(identity.authorizationId)
-			},
-			quota: {
-				kind: "consume_reusable_wallet_session",
-				quotaId: identity.quotaId
+		const outcome = await input.ctx.service.authorizedOperations.admitEd25519WalletSessionOperation({
+			operation: {
+				tenantId: identity.tenantId,
+				authorizedOperationId,
+				auditEventId: requireAuthorizationValue(parseAuthorizationAuditEventId(`ed25519-operation-audit:${operation.operationId}`)),
+				operation: envelope,
+				authorization: {
+					kind: "authorization_grant",
+					authorizationGrantRef: buildAuthorizationGrantRef(identity.authorizationId)
+				},
+				quota: {
+					kind: "consume_reusable_wallet_session",
+					quotaId: identity.quotaId
+				},
+				claimedAtMs: nowMs
 			},
-			claimedAtMs: nowMs
-		} });
+			walletId: session.walletId
+		});
 		if (outcome.kind !== "claimed" && outcome.kind !== "operation_in_progress" && outcome.kind !== "replayed") {
 			const stepUpMaterial = await input.ctx.service.walletRegistration.resolveEd25519MaterialActivation({
 				walletId: scope.account_id,
@@ -389,6 +334,7 @@ async function authorizeEd25519ReusableWalletSessionOperation(input) {
 			admission: {
 				kind: "claimed",
 				operation: outcome.operation,
+				ownerScope: outcome.ownerScope,
 				receipt: {
 					kind: "reusable_wallet_session_authorized_operation_v1",
 					authorized_operation_id: outcome.operation.authorizedOperationId,
@@ -413,101 +359,6 @@ async function authorizeEd25519ReusableWalletSessionOperation(input) {
 		};
 	}
 }
-async function revalidateEd25519AuthorizedOperation(input) {
-	let admission;
-	if (input.operation.authorization.kind === "verified_step_up") {
-		if (input.operation.quota.kind !== "quota_neutral") return {
-			ok: false,
-			response: json({
-				ok: false,
-				code: "verified_step_up_rejected",
-				message: "Ed25519 operation step-up authorization has an invalid quota"
-			}, { status: 403 })
-		};
-		admission = {
-			tenantId: input.operation.tenantId,
-			authorizedOperationId: input.operation.authorizedOperationId,
-			auditEventId: input.operation.auditEventId,
-			operation: input.operation.operation,
-			authorization: input.operation.authorization,
-			quota: input.operation.quota,
-			claimedAtMs: Date.now()
-		};
-	} else {
-		if (input.operation.quota.kind !== "consume_reusable_wallet_session") return {
-			ok: false,
-			response: json({
-				ok: false,
-				code: "authorization_grant_rejected",
-				message: "Ed25519 reusable operation authorization has an invalid quota"
-			}, { status: 403 })
-		};
-		const operation = buildEd25519ReusableOperationEnvelope(input.operation);
-		if (!operation) return {
-			ok: false,
-			response: json({
-				ok: false,
-				code: "authorization_grant_rejected",
-				message: "Ed25519 reusable operation kind is invalid"
-			}, { status: 403 })
-		};
-		admission = {
-			tenantId: input.operation.tenantId,
-			authorizedOperationId: input.operation.authorizedOperationId,
-			auditEventId: input.operation.auditEventId,
-			operation,
-			authorization: input.operation.authorization,
-			quota: input.operation.quota,
-			claimedAtMs: Date.now()
-		};
-	}
-	const result = await input.ctx.service.authorizedOperations.admitAuthorizedOperation({ operation: admission });
-	switch (result.kind) {
-		case "claimed":
-		case "operation_in_progress":
-		case "replayed":
-			if (result.operation.authorizedOperationId !== input.operation.authorizedOperationId) throw new Error("Ed25519 authorized operation changed during revalidation");
-			return {
-				ok: true,
-				operation: result.operation
-			};
-		case "authorization_grant_rejected":
-		case "verified_step_up_rejected": return {
-			ok: false,
-			response: json({
-				ok: false,
-				code: result.kind,
-				message: "Ed25519 operation authorization is no longer active"
-			}, { status: 403 })
-		};
-		case "wallet_session_quota_exhausted":
-		case "material_mismatch": return {
-			ok: false,
-			response: json({
-				ok: false,
-				code: result.kind,
-				message: "Ed25519 operation admission failed"
-			}, { status: 409 })
-		};
-	}
-}
-function buildEd25519ReusableOperationEnvelope(operation) {
-	const operationRef = operation.operation.operation;
-	if (operationRef.capabilityKind !== "near_ed25519_mpc_signing") return null;
-	switch (operationRef.operationKind) {
-		case "near.sign_transaction":
-		case "near.sign_delegate_action":
-		case "near.sign_nep413_message": return buildCapabilityOperationEnvelope({
-			tenantId: operation.operation.tenantId,
-			principalId: operation.operation.principalId,
-			capabilityId: operation.operation.capabilityId,
-			operationId: operation.operation.operationId,
-			operation: buildNearEd25519MpcOperationRef(operationRef.operationKind),
-			digests: operation.operation.digests
-		});
-		case "near.export_key": return null;
-	}
-}
 async function validateEd25519ReusableAuthorizedOperation(input) {
 	try {
 		const receipt = parseEd25519ReusableAuthorizedOperationReceipt(input.body.authorized_operation);
@@ -516,7 +367,7 @@ async function validateEd25519ReusableAuthorizedOperation(input) {
 		const identity = ed25519ReusableWalletSessionIdentity(input.authorization);
 		const capabilityId = requireAuthorizationValue(parseCapabilityId(scope.material_activation.capability));
 		const operationId = requireAuthorizationValue(parseCapabilityOperationId(receipt.operation_id));
-		const fingerprint = await computeCapabilityOperationFingerprintDigest(buildCapabilityOperationEnvelope({
+		const envelope = buildCapabilityOperationEnvelope({
 			tenantId: identity.tenantId,
 			principalId: identity.principalId,
 			capabilityId,
@@ -530,31 +381,39 @@ async function validateEd25519ReusableAuthorizedOperation(input) {
 				intentDigest: parseDigestB64u(receipt.intent_digest_b64u),
 				displayDigest: parseDigestB64u(receipt.display_digest_b64u)
 			}
-		}));
+		});
+		const fingerprint = await computeCapabilityOperationFingerprintDigest(envelope);
 		if (fingerprint !== parseCapabilityOperationFingerprintDigest(receipt.operation_fingerprint_digest)) throw new Error("Ed25519 authorized operation fingerprint changed");
 		if (digestWireB64u((isPlainObject(input.body.prepare_binding) ? input.body.prepare_binding : null)?.intent_digest, "prepare_binding.intent_digest") !== receipt.intent_digest_b64u) throw new Error("Ed25519 authorized operation intent changed after prepare");
-		const operationResult = await input.ctx.service.authorizedOperations.readAuthorizedOperation({
-			tenantId: identity.tenantId,
-			operationFingerprintDigest: fingerprint
-		});
-		if (!operationResult) return {
-			ok: false,
-			response: json({
+		const authorizedOperationId = requireAuthorizationValue(parseAuthorizedOperationId(receipt.authorized_operation_id));
+		let resolved;
+		try {
+			resolved = await resolveEd25519WalletSessionOperation({
+				ctx: input.ctx,
+				tenantId: identity.tenantId,
+				authorizedOperationId,
+				operationFingerprintDigest: fingerprint,
+				walletId: ed25519ReusableWalletSession(input.authorization).walletId
+			});
+		} catch {
+			return {
 				ok: false,
-				code: "authorized_operation_missing",
-				message: "Authorized operation is unavailable"
-			}, { status: 409 })
-		};
-		if (operationResult.authorizedOperationId !== requireAuthorizationValue(parseAuthorizedOperationId(receipt.authorized_operation_id)) || operationResult.operationFingerprintDigest !== fingerprint) throw new Error("Ed25519 authorized operation identity changed after prepare");
-		const revalidated = await revalidateEd25519AuthorizedOperation({
-			ctx: input.ctx,
-			operation: operationResult
-		});
-		return revalidated.ok ? {
+				response: json({
+					ok: false,
+					code: "internal",
+					message: "Authorized operation lookup failed"
+				}, { status: 500 })
+			};
+		}
+		if (!resolved.ok) return resolved;
+		const operationResult = resolved.operation;
+		if (operationResult.tenantId !== identity.tenantId || operationResult.tenantId !== input.ctx.service.authorizedOperations.tenantId || operationResult.operationFingerprintDigest !== fingerprint || operationResult.operation.operationId !== operationId || operationResult.operation.digests.laneDigest !== envelope.digests.laneDigest || operationResult.operation.digests.intentDigest !== envelope.digests.intentDigest || operationResult.operation.digests.displayDigest !== envelope.digests.displayDigest || operationResult.operation.operation.capabilityKind !== "near_ed25519_mpc_signing" || operationResult.operation.operation.operationKind !== receipt.operation_kind) throw new Error("Ed25519 authorized operation identity changed after prepare");
+		return {
 			ok: true,
 			receipt,
-			operation: revalidated.operation
-		} : revalidated;
+			operation: operationResult,
+			ownerScope: resolved.ownerScope
+		};
 	} catch (error) {
 		return {
 			ok: false,
@@ -620,7 +479,7 @@ async function validateEd25519VerifiedStepUpAuthorizedOperation(input) {
 		};
 		if (operationResult.authorizedOperationId !== requireAuthorizationValue(parseAuthorizedOperationId(receipt.authorized_operation_id)) || operationResult.operationFingerprintDigest !== fingerprint) throw new Error("Operation step-up authorized operation identity changed after prepare");
 		if (operationResult.authorization.kind !== "verified_step_up" || operationResult.authorization.evidenceSetDigest !== parseDigestB64u(receipt.evidence_set_digest)) throw new Error("Operation step-up evidence changed after prepare");
-		const revalidated = await revalidateEd25519AuthorizedOperation({
+		const revalidated = await revalidateEd25519StepUpOperation({
 			ctx: input.ctx,
 			operation: operationResult
 		});
@@ -1083,13 +942,15 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 					bodyText: upstreamBodyText
 				})
 			}));
-			return new Response(JSON.stringify({
+			const headers = new Headers(upstream.headers);
+			headers.delete("content-length");
+			return new Response(JSON.stringify(signingPrepareSessionResponse({
 				...upstreamBody,
 				authorized_operation: buildEd25519VerifiedStepUpAuthorizedOperationReceipt({ authorization })
-			}), {
+			}, authorization)), {
 				status: upstream.status,
 				statusText: upstream.statusText,
-				headers: new Headers(upstream.headers)
+				headers
 			});
 		}
 		if (authorization.phase !== "finalize") throw new Error("Operation step-up finalize authorization phase changed");
@@ -1163,7 +1024,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 				...input.body,
 				authorized_operation: buildRouterAbEd25519AuthorizedOperationWire({
 					operation: execution.operation,
-					binding: { ...buildEd25519GatewayOwnerWalletSessionBinding(authorization, await readPinnedEd25519WalletProjectEnvironmentId(input.ctx, authorization, execution.operation)) }
+					binding: buildEd25519GatewayOwnerWalletSessionBinding(authorization, pinnedEd25519WalletScope(authorization, authorized.admission.ownerScope))
 				})
 			}
 		});
@@ -1187,13 +1048,15 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 				bodyText: upstreamBodyText
 			})
 		}));
-		return new Response(JSON.stringify({
+		const headers = new Headers(upstream.headers);
+		headers.delete("content-length");
+		return new Response(JSON.stringify(signingPrepareSessionResponse({
 			...upstreamBody,
 			authorized_operation: authorized.admission.receipt
-		}), {
+		}, authorization)), {
 			status: upstream.status,
 			statusText: upstream.statusText,
-			headers: new Headers(upstream.headers)
+			headers
 		});
 	}
 	const validatedAuthorization = await validateEd25519ReusableAuthorizedOperation({
@@ -1204,6 +1067,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 	if (!validatedAuthorization.ok) return validatedAuthorization.response;
 	const replay = replayCompletedEd25519Operation(validatedAuthorization.operation);
 	if (replay) return replay;
+	if (!validatedAuthorization.ownerScope) throw new Error("Pinned owner Wallet Session scope is unavailable");
 	const upstream = await proxyEd25519OwnerLaneExecution({
 		ctx: input.ctx,
 		authorization,
@@ -1212,7 +1076,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 			...input.body,
 			authorized_operation: buildRouterAbEd25519AuthorizedOperationWire({
 				operation: validatedAuthorization.operation,
-				binding: { ...buildEd25519GatewayOwnerWalletSessionBinding(authorization, await readPinnedEd25519WalletProjectEnvironmentId(input.ctx, authorization, validatedAuthorization.operation)) }
+				binding: buildEd25519GatewayOwnerWalletSessionBinding(authorization, pinnedEd25519WalletScope(authorization, validatedAuthorization.ownerScope))
 			})
 		}
 	});

package/dist/esm/router/transport/fetch/routes/walletExecutionLanePreflight.js

@@ -1,18 +1,17 @@
-import { parseMpcMaterialActivationRef, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { parseMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/domainIds.js";
+import { EVM_ECDSA_MPC_OPERATION_KINDS } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
 import { routerAbMpcMaterialActivationRefToWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { WALLET_SESSION_FAILURE_CODES } from "../../../../shared-ts/src/utils/walletSessionFailure.js";
-import { json, readJson } from "../../../framework/http.js";
 import { walletSessionFailure, walletSessionFailureStatus } from "../../../auth/walletSessionFailure.js";
-import { validateRouterAbEcdsaDerivationWalletSessionInputs, validateRouterAbEd25519WalletSessionInputs } from "../../../auth/commonRouterUtils.js";
+import { validateRouterAbEcdsaDerivationWalletSessionInputs } from "../../../auth/commonRouterUtils.js";
+import { json, readJson } from "../../../framework/http.js";
 //#region src/router/transport/fetch/routes/walletExecutionLanePreflight.ts
 const OWNER_WALLET_EXECUTION_LANE_PREFLIGHT_PATH = "/wallet/execution-lane/owner";
 function parsePreflightRequest(raw) {
 	if (!isPlainObject(raw)) throw new Error("owner execution-lane preflight body is required");
 	const fields = Object.keys(raw).sort();
 	if (fields.length !== 2 || fields[0] !== "curve" || fields[1] !== "expectedMaterialActivation") throw new Error("owner execution-lane preflight body fields are invalid");
-	if (raw.curve !== "ed25519" && raw.curve !== "ecdsa_secp256k1") throw new Error("owner execution-lane preflight curve is invalid");
+	if (raw.curve !== "ecdsa_secp256k1") throw new Error("owner execution-lane preflight curve is invalid");
 	const materialActivation = parseMpcMaterialActivationRef(raw.expectedMaterialActivation);
 	if (!materialActivation.ok) throw new Error(materialActivation.error.message);
 	return {
@@ -162,46 +161,24 @@ async function handleOwnerWalletExecutionLanePreflight(ctx) {
 		}, { status: 400 });
 	}
 	const headers = Object.fromEntries(ctx.request.headers.entries());
-	let walletIdRaw;
-	let authorization;
-	if (request.curve === "ed25519") {
-		const validated = await validateRouterAbEd25519WalletSessionInputs({
-			headers,
-			authorizationSessions: ctx.service.authorizationSessions,
-			operationKind: NEAR_ED25519_MPC_OPERATION_KINDS.signTransaction
-		});
-		if (!validated.ok) return validationFailure(validated);
-		walletIdRaw = String(validated.admission.context.authorization.session.walletId);
-		authorization = {
-			kind: "wallet_auth_method",
-			walletAuthMethodId: validated.admission.context.authorization.session.walletAuthMethodId
-		};
-	} else {
-		const validated = await validateRouterAbEcdsaDerivationWalletSessionInputs({
-			materialActivation: routerAbMpcMaterialActivationRefToWire(request.expectedMaterialActivation),
-			headers,
-			authorizationSessions: ctx.service.authorizationSessions,
-			operationKind: EVM_ECDSA_MPC_OPERATION_KINDS.signTransaction
-		});
-		if (!validated.ok) return validationFailure(validated);
-		if (validated.kind === "wallet_session_operation_credential_exhausted_candidate_v1") return validationFailure(walletSessionFailure("wallet_session_unavailable"));
-		walletIdRaw = String(validated.admission.context.authorization.session.walletId);
-		authorization = {
-			kind: "wallet_auth_method",
-			walletAuthMethodId: validated.admission.context.authorization.session.walletAuthMethodId
-		};
-	}
-	const walletId = parseWalletId(walletIdRaw);
-	if (!walletId.ok) return validationFailure({
-		code: WALLET_SESSION_FAILURE_CODES.invalid,
-		message: "Wallet Session wallet identity is invalid"
+	const validated = await validateRouterAbEcdsaDerivationWalletSessionInputs({
+		materialActivation: routerAbMpcMaterialActivationRefToWire(request.expectedMaterialActivation),
+		headers,
+		authorizationSessions: ctx.service.authorizationSessions,
+		operationKind: EVM_ECDSA_MPC_OPERATION_KINDS.signTransaction
 	});
+	if (!validated.ok) return validationFailure(validated);
+	if (validated.kind === "wallet_session_operation_credential_exhausted_candidate_v1") return validationFailure(walletSessionFailure("wallet_session_unavailable"));
+	const session = validated.admission.context.authorization.session;
 	let resolved;
 	try {
 		resolved = await ctx.service.walletRegistration.resolveActiveOwnerWalletExecutionLane({
-			walletId: walletId.value,
+			walletId: session.walletId,
 			expectedMaterialActivation: request.expectedMaterialActivation,
-			authorization
+			authorization: {
+				kind: "wallet_auth_method",
+				walletAuthMethodId: session.walletAuthMethodId
+			}
 		});
 	} catch {
 		return json({

package/dist/esm/router/transport/fetch/routes/walletRegistration.js

@@ -1,9 +1,9 @@
 import { findRouteDefinitionById, matchesRouteDefinitionRequest } from "../../../framework/routeDefinitions.js";
-import "../../../../shared-ts/src/utils/walletManagementProtocol.js";
-import { jsonFailure, readJson } from "../../../framework/http.js";
 import { resolveSourceIpFromFetchHeaders } from "../../../auth/routerApiKeyAuth.js";
 import { toFetchRouteResponse } from "../../../framework/routeResponses.js";
 import { handleRouterApiWalletAddAuthMethodEmailOtpChallenge, handleRouterApiWalletAddAuthMethodFinalize, handleRouterApiWalletAddAuthMethodIntent, handleRouterApiWalletAddAuthMethodStart, handleRouterApiWalletAddSignerEcdsaActivation, handleRouterApiWalletAddSignerEcdsaDerivationRespond, handleRouterApiWalletAddSignerFinalize, handleRouterApiWalletAddSignerIntent, handleRouterApiWalletAddSignerStart, handleRouterApiWalletEcdsaKeyFactsInventory, handleRouterApiWalletNearImplicitAccountFund, handleRouterApiWalletRegistrationActivate, handleRouterApiWalletRegistrationNearAdmission, handleRouterApiWalletRegistrationNearProvisioning, handleRouterApiWalletRegistrationRespond, handleRouterApiWalletRegistrationSetup, handleRouterApiWalletRevokeAuthMethod } from "../../../domains/walletRegistration/walletRegistrationRoutes.js";
+import "../../../../shared-ts/src/utils/walletManagementProtocol.js";
+import { jsonFailure, readJson } from "../../../framework/http.js";
 import { routerApiWalletRegistrationRouteService } from "../../../framework/authServicePort.js";
 //#region src/router/transport/fetch/routes/walletRegistration.ts
 const ROUTE_IDS = [
@@ -44,7 +44,7 @@ function resolveWalletRegistrationRoute(ctx) {
 async function handleWalletRegistration(ctx) {
 	const route = resolveWalletRegistrationRoute(ctx);
 	if (!route) return null;
-	if (ctx.request.headers.get("X-Seams-Wallet-Protocol") !== "2") return jsonFailure(409, "wallet_protocol_mismatch", "Your wallet application needs an update. Reload this page and try again. If the problem continues, ask the application developer to upgrade the Wallet SDK.");
+	if (ctx.request.headers.get("X-Seams-Wallet-Protocol") !== "3") return jsonFailure(409, "wallet_protocol_mismatch", "Your wallet application needs an update. Reload this page and try again. If the problem continues, ask the application developer to upgrade the Wallet SDK.");
 	const common = {
 		body: await readJson(ctx.request),
 		headers: Object.fromEntries(ctx.request.headers.entries()),
@@ -64,10 +64,11 @@ async function handleWalletRegistration(ctx) {
 			routerAbPublicKeyset: ctx.opts.routerAbPublicKeyset,
 			session: ctx.opts.session,
 			publishableKeyAuth: ctx.opts.publishableKeyAuth,
-			walletProjection: ctx.opts.walletProjection
+			registrationContext: ctx.opts.registrationContext
 		},
 		sourceIp: resolveSourceIpFromFetchHeaders(ctx.request.headers) || void 0,
-		signingSessionSeal: ctx.opts.signingSessionSeal
+		signingSessionSeal: ctx.opts.signingSessionSeal,
+		waitUntil: ctx.runtime.kind === "background" ? ctx.runtime.waitUntil : void 0
 	};
 	let response;
 	switch (route.id) {

package/dist/esm/router/transport/fetch/routes/webauthnAuthenticators.js

@@ -1,5 +1,5 @@
-import { json, jsonFailure } from "../../../framework/http.js";
 import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
+import { json, jsonFailure } from "../../../framework/http.js";
 //#region src/router/transport/fetch/routes/webauthnAuthenticators.ts
 async function handleWebAuthnAuthenticators(ctx) {
 	if (ctx.method !== "GET") return null;

package/dist/esm/shared-ts/src/authorization/index.js

@@ -1,6 +1,6 @@
 import "./capabilityKinds.js";
-import "./operationFingerprint.js";
 import "./delegatedAuthority.js";
+import "./operationFingerprint.js";
 import "./walletAuthority.js";
 import "./walletCustodyOperation.js";
 import "./walletSessionIssuance.js";

package/dist/esm/shared-ts/src/authorization/walletAuthority.js

@@ -1,10 +1,10 @@
 import { parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseMpcMaterialActivationRef, parseWalletAuthorityId, parseWalletId, parseWalletRecoveryOperationId } from "../utils/domainIds.js";
 import { parseDeviceId } from "./capabilityKinds.js";
+import { requireRecord } from "../utils/validation.js";
+import { parseDelegatedWalletPermissionSetV1 } from "./delegatedAuthority.js";
 import { base64UrlEncode } from "../utils/base64.js";
 import { sha256Bytes } from "../utils/digests.js";
 import { parseDigestB64u } from "../utils/canonicalPrimitives.js";
-import { requireRecord } from "../utils/validation.js";
-import { parseDelegatedWalletPermissionSetV1 } from "./delegatedAuthority.js";
 import { buildExactAdministeredSignerManifestV1, parseExactAdministeredSignerManifestV1 } from "../device-linking/delegatedActivationPlan.js";
 import { concat, lp32, rawDigest, rawPublicKey, text, u32, u64 } from "../utils/digestEncoding.js";
 //#region ../shared-ts/src/authorization/walletAuthority.ts

package/dist/esm/shared-ts/src/device-linking/activeWalletSession.js

@@ -1,17 +1,27 @@
 import { requireRecord } from "../utils/validation.js";
 import { rejectUnknownFields } from "../utils/exactRecord.js";
-import { wireLiteral, wireObject } from "../utils/wireSchema.js";
+import { wireLiteral, wireObject, wireUnion } from "../utils/wireSchema.js";
 import { digest, keyLabeled, materialActivation, parseNonNegativeSafeInteger, parseUnixTime, quotaId, walletAuthMethodId, walletAuthorityId, walletId, walletSessionAuthorizationId, walletSessionId } from "./wireFields.js";
 //#region ../shared-ts/src/device-linking/activeWalletSession.ts
+const walletSessionHome = wireUnion("kind", [wireObject({ kind: wireLiteral("direct") }), wireObject({
+	kind: wireLiteral("regional"),
+	region: wireLiteral("US", "WEUR", "APAC", "OC")
+})]);
+function parseWalletSessionHome(raw) {
+	return walletSessionHome(raw, "Wallet Session home");
+}
 function walletSessionOperationCredentialV1() {
 	return wireObject({
 		kind: wireLiteral("opaque_wallet_session_operation_credential_v1"),
+		ownershipGeneration: parseNonNegativeSafeInteger,
+		home: parseWalletSessionHome,
 		token: (raw, label) => {
 			if (typeof raw !== "string" || raw.length > 8192) throw new Error(`${label} is invalid`);
 			return raw;
 		},
 		walletSessionId: keyLabeled(walletSessionId)
 	}, (credential, label) => {
+		if (credential.ownershipGeneration === 0) throw new Error(`${label} ownership generation must be positive`);
 		if (!/^wst_[A-Za-z0-9_-]{43}$/.test(credential.token)) throw new Error(`${label} opaque token is invalid`);
 	});
 }
@@ -69,6 +79,6 @@ function parseWalletCapabilitySubjectV1(raw, label) {
 	};
 }
 //#endregion
-export { parseActiveWalletSessionV1, parseWalletSessionOperationCredentialV1 };
+export { parseActiveWalletSessionV1, parseWalletSessionHome, parseWalletSessionOperationCredentialV1 };
 
 //# sourceMappingURL=activeWalletSession.js.map

package/dist/esm/shared-ts/src/device-linking/digests.js

@@ -1,6 +1,6 @@
+import { delegatedWalletPermissionNamesV1 } from "../authorization/delegatedAuthority.js";
 import { alphabetizeStringify } from "../utils/digests.js";
 import { sha256DigestB64u, sha256Utf8DigestB64u } from "../utils/canonicalPrimitives.js";
-import { delegatedWalletPermissionNamesV1 } from "../authorization/delegatedAuthority.js";
 import { concat, lp32, rawDigest, rawPublicKey, text, u32, u64 } from "../utils/digestEncoding.js";
 import "./committedSignerPackages.js";
 //#region ../shared-ts/src/device-linking/digests.ts