@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/core/nearKeys.js

@@ -1,5 +1,4 @@
 import { ensureEd25519Prefix } from "../shared-ts/src/utils/near.js";
-import "../shared-ts/src/utils/validation.js";
 import bs58 from "bs58";
 //#region src/core/nearKeys.ts
 function stripEd25519Prefix(value) {

package/dist/esm/core/nearRelayerAccountProvisioning.js

@@ -1,18 +1,18 @@
+import { coerceNonEmptyString, requireRecordOrArray } from "../shared-ts/src/utils/validation.js";
 import { base64UrlDecode, base64UrlEncode } from "../shared-ts/src/utils/base64.js";
 import { sha256Bytes } from "../shared-ts/src/utils/digests.js";
 import { base58Encode } from "../shared-ts/src/utils/base58.js";
 import "../shared-ts/src/utils/encoders.js";
-import { deriveImplicitNearAccountIdFromEd25519PublicKey, parseImplicitNearAccountId, parseNamedNearAccountId } from "../shared-ts/src/utils/near.js";
-import { coerceNonEmptyString, requireRecordOrArray } from "../shared-ts/src/utils/validation.js";
 import { failure } from "../shared-ts/src/utils/failure.js";
 import { ActionType, validateActionArgsWasm } from "../shared-ts/src/near/actions.js";
+import { deriveImplicitNearAccountIdFromEd25519PublicKey, parseImplicitNearAccountId, parseNamedNearAccountId } from "../shared-ts/src/utils/near.js";
 import { errorMessage } from "../shared-ts/src/utils/errors.js";
+import { threshold_ed25519_build_near_tx_unsigned_borsh, threshold_ed25519_decode_signed_near_tx_borsh, threshold_ed25519_finalize_near_tx_from_signature } from "../wasm/near_signer/pkg/wasm_signer_worker.js";
 import { toPublicKeyStringFromSecretKey } from "./nearKeys.js";
-import { SignedTransaction } from "../shared-ts/src/near/nearClient.js";
-import { MinimalNearClient, NearRpcError } from "./rpcClients/near/NearClient.js";
 import { requireFinalizeNearTxFromSignatureOutput, requireSingleUnsignedNearTxBorshOutput, signNearDigestWithSecretKey } from "./authService/nearPrivateKeySigning.js";
-import { threshold_ed25519_build_near_tx_unsigned_borsh, threshold_ed25519_decode_signed_near_tx_borsh, threshold_ed25519_finalize_near_tx_from_signature } from "../wasm/near_signer/pkg/wasm_signer_worker.js";
 import { ensureNearSignerWasm } from "./nearSignerWasmRuntime.js";
+import { SignedTransaction } from "../shared-ts/src/near/nearClient.js";
+import { MinimalNearClient, NearRpcError } from "./rpcClients/near/NearClient.js";
 //#region src/core/nearRelayerAccountProvisioning.ts
 /**
 * A plain funding transfer only has to be executed before the client can read
@@ -73,8 +73,7 @@ function requireDecodedSponsoredNearAccountCreation(value, signedTransactionBors
 					permission: "FullAccess"
 				}
 			} }
-		],
-		signedTransactionBorshB64u
+		]
 	};
 }
 function parsePositiveYocto(value, label) {
@@ -310,11 +309,9 @@ async function prepareSponsoredNearAccountCreationWithRelayer(input) {
 			}
 		};
 	} catch (error) {
-		const message = errorMessage(error) || "Failed to prepare NEAR account creation";
 		return {
 			ok: false,
-			error: message,
-			message
+			message: errorMessage(error) || "Failed to prepare NEAR account creation"
 		};
 	}
 }

package/dist/esm/core/passkeyCredentialClaims.js

@@ -0,0 +1,8 @@
+//#region src/core/passkeyCredentialClaims.ts
+async function reservePasskeyCredential(claims, input) {
+	if (claims && !await claims.claim(input)) throw new Error("Passkey credential belongs to another wallet or home");
+}
+//#endregion
+export { reservePasskeyCredential };
+
+//# sourceMappingURL=passkeyCredentialClaims.js.map

package/dist/esm/core/routerAbSigning/RouterAbEcdsaPresignRuntime.js

@@ -1,12 +1,9 @@
-import { coerceThresholdNodeRole, parseThresholdEd25519ParticipantIds2p } from "../ThresholdService/config.js";
+import { parseThresholdEd25519ParticipantIds2p } from "../ThresholdService/config.js";
 import { exportRouterAbLinkedDeviceEcdsaShare, startRouterAbLinkedDeviceEcdsaPresignSession, stepRouterAbLinkedDeviceEcdsaPresignSession } from "../ThresholdService/routerAb/ecdsaDerivationPresignBridge.js";
 import { RouterAbEcdsaDerivationPoolFillHandlers } from "../ThresholdService/routerAb/ecdsaDerivationPoolFillHandlers.js";
 //#region src/core/routerAbSigning/RouterAbEcdsaPresignRuntime.ts
 function parseRouterAbEcdsaPresignRuntimeConfig(input) {
-	return {
-		nodeRole: coerceThresholdNodeRole(input.THRESHOLD_NODE_ROLE),
-		participantIds: parseThresholdEd25519ParticipantIds2p(input)
-	};
+	return { participantIds: parseThresholdEd25519ParticipantIds2p(input) };
 }
 function routerAbEcdsaPresignGlobalFetch(input, init) {
 	return globalThis.fetch(input, init);
@@ -24,7 +21,6 @@ var RouterAbEcdsaPresignRuntime = class {
 	constructor(input) {
 		this.signingWorkerTransport = resolveSigningWorkerTransport(input.signingWorkerTransport);
 		this.handlers = new RouterAbEcdsaDerivationPoolFillHandlers({
-			nodeRole: input.config.nodeRole,
 			participantIds2p: input.config.participantIds.participantIds2p,
 			ensureReady: input.ensureReady,
 			signingWorkerTransport: this.signingWorkerTransport
@@ -44,6 +40,8 @@ var RouterAbEcdsaPresignRuntime = class {
 		return await startRouterAbLinkedDeviceEcdsaPresignSession({
 			signingWorkerBaseUrl: transport.signingWorkerBaseUrl,
 			request: input.request,
+			walletScope: input.walletScope,
+			ownershipGeneration: input.ownershipGeneration,
 			materialSource: input.materialSource,
 			presignSessionId: input.presignSessionId,
 			expiresAtMs: input.expiresAtMs,
@@ -56,6 +54,8 @@ var RouterAbEcdsaPresignRuntime = class {
 		return await stepRouterAbLinkedDeviceEcdsaPresignSession({
 			signingWorkerBaseUrl: transport.signingWorkerBaseUrl,
 			request: input.request,
+			walletScope: input.walletScope,
+			ownershipGeneration: input.ownershipGeneration,
 			materialSource: input.materialSource,
 			presignSessionId: input.presignSessionId,
 			requestedStage: input.requestedStage,

package/dist/esm/core/routerAbSigning/RouterAbNormalSigningRuntime.js

@@ -1,35 +1,7 @@
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
 import { MAX_WALLET_SESSION_REMAINING_USES, MAX_WALLET_SESSION_TTL_MS } from "../../shared-ts/src/threshold/sessionPolicy.js";
-import { parseRouterAbNormalSigningServerPolicy, validateRouterAbNormalSigningServerPolicy } from "../ThresholdService/routerAbNormalSigningPolicy.js";
+import { validateRouterAbNormalSigningServerPolicy } from "../ThresholdService/routerAbNormalSigningPolicy.js";
 //#region src/core/routerAbSigning/RouterAbNormalSigningRuntime.ts
-function requireRouterAbConfiguredSigningWorkerPrivateTransport(transport) {
-	if (transport.kind !== "configured") throw new Error("InvalidLocalServiceConfig: ROUTER_AB_SIGNING_WORKER_URL and ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET are required for Router A/B ECDSA presign");
-	return transport;
-}
-function parseSigningWorkerTransport(config) {
-	const signingWorkerBaseUrl = normalizeOptionalTrimmedString(config.ROUTER_AB_SIGNING_WORKER_URL);
-	const secret = normalizeOptionalTrimmedString(config.ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET);
-	const fetchImpl = typeof config.routerAbSigningWorkerFetch === "function" ? config.routerAbSigningWorkerFetch : void 0;
-	if (!signingWorkerBaseUrl && !secret) return { kind: "unconfigured" };
-	if (!signingWorkerBaseUrl) throw new Error("ROUTER_AB_SIGNING_WORKER_URL is required when Router A/B internal service auth is configured");
-	if (!secret) throw new Error("ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET is required when Router A/B SigningWorker URL is configured");
-	return {
-		kind: "configured",
-		signingWorkerBaseUrl,
-		auth: {
-			kind: "internal_service_auth_secret",
-			secret
-		},
-		...fetchImpl ? { fetchImpl } : {}
-	};
-}
-function parseRouterAbNormalSigningRuntimeConfig(config) {
-	return {
-		policy: parseRouterAbNormalSigningServerPolicy(config),
-		signingWorkerTransport: parseSigningWorkerTransport(config)
-	};
-}
 var RouterAbNormalSigningRuntime = class {
 	constructor(input) {
 		this.walletSessionStore = input.walletSessionStore;
@@ -96,6 +68,6 @@ var RouterAbNormalSigningRuntime = class {
 	}
 };
 //#endregion
-export { RouterAbNormalSigningRuntime, parseRouterAbNormalSigningRuntimeConfig, requireRouterAbConfiguredSigningWorkerPrivateTransport };
+export { RouterAbNormalSigningRuntime };
 
 //# sourceMappingURL=RouterAbNormalSigningRuntime.js.map

package/dist/esm/core/signingLanes/WalletExecutionLaneProjection.js

@@ -2,8 +2,8 @@ import { mpcMaterialActivationRefsEqual, parseEmailOtpProviderUserId, parseLaneS
 import { base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify } from "../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u, sha256Utf8DigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
-import { base58Encode } from "../../shared-ts/src/utils/base58.js";
 import { parseEd25519PublicKeyB64u, parseKeyCreationSignerSlot, parseSecp256k1CompressedPublicKeyB64u } from "../../shared-ts/src/passkey-custody/primitives.js";
+import { base58Encode } from "../../shared-ts/src/utils/base58.js";
 import { routerAbMpcMaterialActivationRefFromWire, sameRouterAbMpcMaterialActivationRef } from "../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { deriveEvmFamilySigningKeySlotId } from "../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
 import { walletAuthAuthorityRef } from "../../shared-ts/src/utils/walletAuthAuthority.js";

package/dist/esm/core/signingMaterial/ordinaryInactiveSignerMaterialReservation.js

@@ -85,6 +85,7 @@ var OrdinaryInactiveSignerMaterialReservationServiceV1 = class {
 	}
 };
 function validateOrdinaryInactiveSignerMaterialReservationRequestV1(request) {
+	if (!Number.isSafeInteger(request.ownershipGeneration) || request.ownershipGeneration < 1) throw new Error("ordinary signer material ownership generation is invalid");
 	switch (request.kind) {
 		case "ordinary_ed25519_signer_material_reservation_request_v1": {
 			if (request.preparation.kind !== "ordinary_ed25519_signer_material_reservation_preparation_v1") throw new Error("ordinary Ed25519 reservation preparation kind is invalid");

package/dist/esm/core/thresholdEcdsaChainTarget.js

@@ -32,10 +32,7 @@ function thresholdEcdsaChainTargetFromValue(value) {
 	}
 	return null;
 }
-function thresholdEcdsaChainTargetsEqual(left, right) {
-	return thresholdEcdsaChainTargetKey(left) === thresholdEcdsaChainTargetKey(right);
-}
 //#endregion
-export { thresholdEcdsaChainTargetFromValue, thresholdEcdsaChainTargetKey, thresholdEcdsaChainTargetsEqual };
+export { thresholdEcdsaChainTargetFromValue, thresholdEcdsaChainTargetKey };
 
 //# sourceMappingURL=thresholdEcdsaChainTarget.js.map

package/dist/esm/hosted-wallet-gateway.js

@@ -1,10 +1,13 @@
 import { parseWalletId } from "./shared-ts/src/utils/domainIds.js";
+import { parseTenantId } from "./shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "./shared-ts/src/utils/base64.js";
 import { parseRouterAbPublicKeysetV2 } from "./shared-ts/src/utils/routerAbPublicKeyset.js";
 import { ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_STATUS_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1 } from "./shared-ts/src/utils/routerAbEd25519Yao.js";
+import { parseSessionOrigin } from "./authorization/domain.js";
 import { parseD1JsonColumn } from "./storage/d1Sql.js";
 import { D1WalletStore } from "./core/d1WalletStore.js";
 import { D1WalletAuthMethodStore } from "./core/d1WalletAuthMethodStore.js";
+import { WALLET_OBJECT_ADDRESSES_HEADER, WALLET_OBJECT_IDENTITY_HEADER, walletObjectIdentity, walletObjectIdentityHeaders } from "./router/cloudflare/runtime/walletObjectAddresses.js";
 import { RouterAbEcdsaPresignRuntime } from "./core/routerAbSigning/RouterAbEcdsaPresignRuntime.js";
 import { buildTenantRootIdentityFromAuthenticatedDeploymentV1, decodeTenantRootIdentityWireV1 } from "./shared-ts/src/tenant-root/tenantRootIdentity.js";
 import "./shared-ts/src/tenant-root/index.js";
@@ -14,8 +17,10 @@ import { createCloudflareWalletGatewayRouterV1 } from "./router/cloudflare/runti
 import { createWalletRuntimeOpsHandler } from "./router/cloudflare/runtime/walletRuntimeOpsHandler.js";
 import { handleWalletControlRequest } from "./router/cloudflare/runtime/walletControlOps.js";
 import { resolveRuntimeTenantRootLineage } from "./router/cloudflare/runtime/walletConsoleTenantRootLineage.js";
+import { D1WalletObjectAddresses } from "./router/cloudflare/d1/walletObjectAddresses.js";
 import { ROUTER_AB_MPC_ROUTER_ORIGIN, ROUTER_AB_SIGNING_WORKER_ORIGIN, createRouterAbServiceBindingFetch } from "./router/cloudflare/runtime/routerAbServiceBindings.js";
 import { readEnvironmentCsv, readEnvironmentString, requireEnvironmentString } from "./router/cloudflare/runtime/environment.js";
+import { admitD1EstablishedWalletHome } from "./router/cloudflare/d1/registration/d1WalletExecutionAuthority.js";
 import { createD1LinkedDeviceSourceContributionPreparationPlannerV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceSourceContributionPreparationPlanner.js";
 import { readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.js";
 import { RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter } from "./router/domains/ed25519Yao/export/routerAbEd25519YaoExport.js";
@@ -32,10 +37,12 @@ import { createD1LinkedDeviceOwnerSourceChildReaderV1 } from "./router/cloudflar
 import { createCloudflareD1RouterApiAuthService } from "./router/cloudflare/d1/auth/d1RouterApiAuthService.js";
 import { loadCloudflareSignerWasmModule } from "./router/cloudflare/runtime/cloudflareSignerWasm.js";
 import { createEd25519SessionAdapter } from "./router/cloudflare/runtime/ed25519SessionAdapter.js";
+import { WalletPlacementRoutes } from "./router/cloudflare/runtime/walletPlacementRoutes.js";
 import { handleRouterAbEd25519YaoExportRequestScopedCloudflareV1 } from "./router/domains/ed25519Yao/export/routerAbEd25519YaoExportRequestScopedCloudflare.js";
 import { handleRouterAbEd25519YaoRecoveryRequestScopedCloudflareV1 } from "./router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryRequestScopedCloudflare.js";
 import { RouterAbEd25519YaoRecoveryWalletSessionAuthorizationAdapter } from "./router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryWalletSessionAuthorization.js";
 import "./cloud-host.js";
+import { WalletAuthorizationRelocationRoutes } from "./router/cloudflare/runtime/walletAuthorizationRelocationRoutes.js";
 //#region src/hosted-wallet-gateway.ts
 function readStagingHostedWalletOrigins(env) {
 	return readEnvironmentCsv(requireEnvironmentString(env, "HOSTED_WALLET_ORIGINS"));
@@ -43,6 +50,17 @@ function readStagingHostedWalletOrigins(env) {
 const RELAY_SIGNER_READY_TABLES = Object.freeze([
 	"wallets",
 	"wallet_auth_methods",
+	"wallet_relocation_challenges",
+	"wallet_relocation_approvals",
+	"wallet_relocation_session_fences",
+	"wallet_relocation_authorization_fences",
+	"wallet_relocation_authorization_snapshots",
+	"wallet_relocation_authorization_chunks",
+	"wallet_relocation_authorization_intakes",
+	"wallet_relocation_authorization_intake_chunks",
+	"wallet_relocation_authorization_imports",
+	"wallet_relocation_authorization_import_context",
+	"wallet_relocation_authorization_import_receipts",
 	"authorization_wallet_session_quotas",
 	"wallet_session_authorizations_v2",
 	"wallet_session_hosted_credentials_v2",
@@ -58,13 +76,6 @@ const RELAY_SIGNER_READY_TABLES = Object.freeze([
 	"router_ab_normal_signing_admission_records",
 	"registration_ceremony_records",
 	"registration_ceremony_cas_guard",
-	"lane_enrollments",
-	"lane_protocol_operations",
-	"lane_product_epochs",
-	"lane_receipts",
-	"lane_effect_journal",
-	"lane_locks",
-	"lane_cas_guard",
 	"linked_device_sessions",
 	"linked_device_session_cas_guard",
 	"linked_device_session_transcripts",
@@ -141,14 +152,14 @@ async function resolveStagingDeploymentTenantRoot(scope, tenantRootCustodyLineag
 }
 async function resolveStagingRegistrationTenantRoot(context, input) {
 	switch (input.operation) {
-		case "registration": return await resolveStagingDeploymentTenantRoot(context.scope, context.tenantRootCustodyLineage, input.admissionRequest.application_binding, input.admissionRequest.scope.root_share_epoch);
+		case "registration": return await resolveStagingDeploymentTenantRoot(context.scope, context.tenantRootCustodyLineage, input, input.root_share_epoch);
 		case "recovery":
 		case "export": throw new Error("Ed25519 active-material tenant-root resolver is unavailable");
 	}
 }
 async function resolveStagingTenantRoot(context, input) {
 	switch (input.operation) {
-		case "registration": return await resolveStagingDeploymentTenantRoot(context.scope, context.tenantRootCustodyLineage, input.admissionRequest.application_binding, input.admissionRequest.scope.root_share_epoch);
+		case "registration": return await resolveStagingDeploymentTenantRoot(context.scope, context.tenantRootCustodyLineage, input, input.root_share_epoch);
 		case "recovery": return await context.resolveActiveTenantRoot({
 			walletId: input.admissionRequest.application_binding.wallet_id,
 			materialActivation: input.admissionRequest.active_material_activation
@@ -181,7 +192,7 @@ function createStagingLinkedDeviceTenantRootResolver(scope, tenantRootCustodyLin
 		tenantRootCustodyLineage
 	});
 }
-async function createStagingRouterApiAuthComposition(env, scope, yaoRuntime, tenantRootCustodyLineage, dependencies) {
+async function createStagingRouterApiAuthComposition(env, scope, yaoRuntime, tenantRootCustodyLineage, dependencies, startRegistrationWallets) {
 	const ecdsaCeremonyTokenIssuer = createStagingEcdsaCeremonyTokenIssuer(env);
 	const topology = requireStagingEcdsaRegistrationTopology(env);
 	const tokenScope = {
@@ -190,12 +201,14 @@ async function createStagingRouterApiAuthComposition(env, scope, yaoRuntime, ten
 		environment: scope.envId
 	};
 	const ecdsaStrictRegistration = createRouterAbEcdsaStrictRegistrationPort({
+		internalServiceAuthSecret: requireEnvironmentString(env, "ROUTER_AB_GATEWAY_TO_ROUTER_AUTH_SECRET"),
 		router: env.MPC_ROUTER,
 		tokenIssuer: ecdsaCeremonyTokenIssuer,
 		tokenScope,
 		topology
 	});
 	const ecdsaStrictPostRegistration = createRouterAbEcdsaStrictPostRegistrationPort({
+		internalServiceAuthSecret: requireEnvironmentString(env, "ROUTER_AB_GATEWAY_TO_ROUTER_AUTH_SECRET"),
 		router: env.MPC_ROUTER,
 		tokenIssuer: ecdsaCeremonyTokenIssuer,
 		tokenScope,
@@ -204,6 +217,18 @@ async function createStagingRouterApiAuthComposition(env, scope, yaoRuntime, ten
 	return {
 		service: createCloudflareD1RouterApiAuthService({
 			database: env.SIGNER_DB,
+			identityStore: dependencies.identityStore,
+			googleRegistrationAttempts: dependencies.googleRegistrationAttempts,
+			sessionRouting: dependencies.sessionRouting,
+			recoveryRouting: dependencies.recoveryRouting,
+			lifecycleRouting: dependencies.lifecycleRouting,
+			registrationAuthority: dependencies.registrationAuthority,
+			startRegistrationWallets,
+			credentialClaims: dependencies.credentialClaims,
+			syncChallenges: dependencies.syncChallenges,
+			linkedDeviceProofNonces: dependencies.linkedDeviceProofNonces,
+			linkedDeviceBootstrap: dependencies.linkedDeviceBootstrap,
+			registrationSetupDispatcher: dependencies.registrationSetupDispatcher,
 			namespace: scope.namespace,
 			orgId: scope.orgId,
 			projectId: scope.projectId,
@@ -217,7 +242,6 @@ async function createStagingRouterApiAuthComposition(env, scope, yaoRuntime, ten
 			implicitNearAccountTestFundingEnabled: readEnvironmentString(env, "ENABLE_IMPLICIT_NEAR_ACCOUNT_TEST_FUNDING"),
 			googleOidcClientId: readEnvironmentString(env, "GOOGLE_OIDC_CLIENT_ID"),
 			githubOAuth: stagingGithubOAuthConfig(env),
-			accountIdDerivationSecret: requireEnvironmentString(env, "ACCOUNT_ID_DERIVATION_SECRET"),
 			emailOtpServerSeal: stagingEmailOtpServerSealConfig(env),
 			emailOtpDeliveryMode: readEnvironmentString(env, "EMAIL_OTP_DELIVERY_MODE"),
 			emailOtpRuntimeProfile: readEnvironmentString(env, "EMAIL_OTP_RUNTIME_PROFILE"),
@@ -259,7 +283,9 @@ async function resolveStagingActiveTenantRootFromLoader(context, input) {
 }
 async function resolveStagingRecoveryAuthorizationServices(context) {
 	const { service } = await loadStagingRouterApiAuthComposition(context);
+	const authority = service.walletExecution;
 	return {
+		admitEstablishedHome: authority.admitEstablishedHome.bind(authority),
 		authorizationSessions: service.authorizationSessions,
 		preparedRecoveryAdmission: service.passkeyCustody,
 		resolveEd25519MaterialActivation: service.walletRegistration.resolveEd25519MaterialActivation.bind(service.walletRegistration)
@@ -327,12 +353,14 @@ function stagingLinkedDeviceSessionComposition(env, scope, tenantRootCustodyLine
 				tenant: scope
 			}),
 			deactivationEndpoint: createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1({
+				admitEstablishedHome: admitD1EstablishedWalletHome.bind(void 0, env.SIGNER_DB, scope),
 				fetch: serviceFetch,
 				internalServiceAuthSecret,
 				tenant: scope
 			})
 		},
 		sourceContributionRouter: createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1({
+			admitEstablishedHome: admitD1EstablishedWalletHome.bind(void 0, env.SIGNER_DB, scope),
 			fetch: serviceFetch,
 			internalServiceAuthSecret: requireEnvironmentString(env, "ROUTER_AB_GATEWAY_TO_ROUTER_AUTH_SECRET"),
 			resolveTenantRoot: createStagingLinkedDeviceTenantRootResolver(scope, tenantRootCustodyLineage)
@@ -346,18 +374,34 @@ function stagingLinkedDeviceSessionComposition(env, scope, tenantRootCustodyLine
 * stay on the Wallet Console deployment until policy/sponsorship resolution
 * operations join the binding.
 */
-async function createHostedWalletGatewayCompositionV1(env, dependencies = {}) {
+async function createHostedWalletGatewayCompositionV1(env, dependencies = {}, background = null) {
 	const scope = stagingTenantScope(env);
 	const session = stagingSessionAdapter(env);
 	const tenantRootCustodyLineage = createStagingTenantRootCustodyLineage(createWalletConsoleOpsClient(env.WALLET_CONSOLE));
 	const yaoRuntime = createStagingYaoRequestScopedRuntime(env, createStagingRegistrationTenantRootResolver(scope, tenantRootCustodyLineage));
-	const { service, ecdsaStrictPostRegistration } = await createStagingRouterApiAuthComposition(env, scope, yaoRuntime, tenantRootCustodyLineage, dependencies);
+	const { service, ecdsaStrictPostRegistration } = await createStagingRouterApiAuthComposition(env, scope, yaoRuntime, tenantRootCustodyLineage, dependencies, background ? scheduleRegistrationRouterStartup.bind(void 0, env, background) : void 0);
+	const tenantId = parseTenantId(scope.orgId);
+	if (!tenantId.ok) throw new Error("Wallet placement authorization tenant is invalid");
 	return {
 		handler: createCloudflareWalletGatewayRouterV1({
 			service,
 			walletConsole: env.WALLET_CONSOLE,
+			registrationContext: dependencies.registrationContext,
 			signerDatabase: env.SIGNER_DB,
 			signerStorageNamespace: scope.namespace,
+			routeExtensions: [new WalletAuthorizationRelocationRoutes({
+				database: env.SIGNER_DB,
+				scope,
+				directory: env.WALLET_CONSOLE
+			}), new WalletPlacementRoutes({
+				emailOtp: service.relocationEmailOtp,
+				database: env.SIGNER_DB,
+				scope,
+				tenantId: tenantId.value,
+				allowedOrigins: readStagingHostedWalletOrigins(env).map(parseSessionOrigin),
+				authorizationSessions: service.authorizationSessions,
+				directory: env.WALLET_CONSOLE
+			})],
 			router: {
 				healthz: true,
 				readyz: true,
@@ -386,42 +430,51 @@ async function createHostedWalletGatewayCompositionV1(env, dependencies = {}) {
 		session
 	};
 }
-async function createSplitGatewayRouterHandler(env, dependencies = {}) {
-	return (await createHostedWalletGatewayCompositionV1(env, dependencies)).handler;
+async function createSplitGatewayRouterHandler(env, dependencies = {}, background = null) {
+	return (await createHostedWalletGatewayCompositionV1(env, dependencies, background)).handler;
 }
 async function handleSplitGatewayWalletRuntimeRequest(request, env, dependencies = {}) {
 	const controlResponse = await handleWalletControlRequest(request, env);
 	if (controlResponse) return controlResponse;
-	return await createWalletRuntimeOpsHandler(async () => {
-		const scope = stagingTenantScope(env);
-		const tenantRootCustodyLineage = createStagingTenantRootCustodyLineage(createWalletConsoleOpsClient(env.WALLET_CONSOLE));
-		const { service } = await createStagingRouterApiAuthComposition(env, scope, createStagingYaoRequestScopedRuntime(env, createStagingRegistrationTenantRootResolver(scope, tenantRootCustodyLineage)), tenantRootCustodyLineage, dependencies);
-		return {
-			executeSignedDelegate: service.executeSignedDelegate.bind(service),
-			getRelayerAccount: service.router.getRelayerAccount.bind(service.router),
-			getWalletIdentities: (input) => readWalletRuntimeIdentities(env, input)
-		};
-	})(request);
+	return await createWalletRuntimeOpsHandler(async () => ({
+		async executeSignedDelegate(input) {
+			return await (await resolveWalletExecutionService(env, dependencies)).executeSignedDelegate(input);
+		},
+		async getRelayerAccount() {
+			return (await resolveWalletExecutionService(env, dependencies)).router.getRelayerAccount();
+		},
+		getWalletIdentities: readWalletRuntimeIdentities.bind(void 0, env)
+	}))(request);
+}
+async function resolveWalletExecutionService(env, dependencies) {
+	const scope = stagingTenantScope(env);
+	const tenantRootCustodyLineage = createStagingTenantRootCustodyLineage(createWalletConsoleOpsClient(env.WALLET_CONSOLE));
+	const { service } = await createStagingRouterApiAuthComposition(env, scope, createStagingYaoRequestScopedRuntime(env, createStagingRegistrationTenantRootResolver(scope, tenantRootCustodyLineage)), tenantRootCustodyLineage, dependencies);
+	return service;
 }
 function isJsonRecord(value) {
 	return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
 async function readWalletRuntimeIdentities(env, input) {
-	const placeholders = input.wallets.map(() => "?").join(", ");
-	const rows = await env.SIGNER_DB.prepare(`SELECT project_id, wallet_id, signer_family, record_json
+	const selectors = input.wallets.map(() => "(project_id = ? AND env_id = ? AND wallet_id = ?)");
+	const rows = await env.SIGNER_DB.prepare(`SELECT project_id, env_id, wallet_id, signer_family, record_json
        FROM wallet_signers
-      WHERE namespace = ?
-        AND org_id = ?
-        AND wallet_id IN (${placeholders})`).bind(requireEnvironmentString(env, "SEAMS_TENANT_STORAGE_NAMESPACE"), input.orgId, ...input.wallets.map((wallet) => wallet.walletId)).all();
-	const requestedWallets = new Map(input.wallets.map((wallet) => [wallet.walletId, wallet]));
+      WHERE namespace = ? AND org_id = ?
+        AND (${selectors.join(" OR ")})`).bind(requireEnvironmentString(env, "SEAMS_TENANT_STORAGE_NAMESPACE"), input.orgId, ...input.wallets.flatMap((wallet) => [
+		wallet.projectId,
+		wallet.envId,
+		wallet.walletId
+	])).all();
 	const identities = /* @__PURE__ */ new Map();
 	for (const row of rows.results || []) {
-		const walletId = String(row.wallet_id || "").trim();
-		const requested = requestedWallets.get(walletId);
-		if (!requested || requested.projectId !== String(row.project_id || "").trim()) continue;
+		const key = JSON.stringify([
+			row.project_id,
+			row.env_id,
+			row.wallet_id
+		]);
 		const record = parseD1JsonColumn(row.record_json);
 		if (!isJsonRecord(record)) continue;
-		const current = identities.get(walletId) || {
+		const current = identities.get(key) || {
 			nearAccountId: "",
 			evmAddress: null
 		};
@@ -430,15 +483,30 @@ async function readWalletRuntimeIdentities(env, input) {
 			const address = String(record.walletKey.thresholdOwnerAddress || "").trim().toLowerCase();
 			if (/^0x[0-9a-f]{40}$/.test(address)) current.evmAddress = address;
 		}
-		identities.set(walletId, current);
+		identities.set(key, current);
+	}
+	const result = [];
+	for (const wallet of input.wallets) {
+		const identity = identities.get(JSON.stringify([
+			wallet.projectId,
+			wallet.envId,
+			wallet.walletId
+		]));
+		if (identity?.nearAccountId && identity.evmAddress) result.push({
+			walletId: wallet.walletId,
+			projectId: wallet.projectId,
+			envId: wallet.envId,
+			nearAccountId: identity.nearAccountId,
+			evmAddress: identity.evmAddress
+		});
 	}
-	return { identities: Array.from(identities.entries()).flatMap(([walletId, identity]) => identity.nearAccountId && identity.evmAddress ? [{
-		walletId,
-		nearAccountId: identity.nearAccountId,
-		evmAddress: identity.evmAddress
-	}] : []) };
+	return { identities: result };
 }
 async function handleSplitGatewayRequest(request, env, ctx, dependencies = {}) {
+	const headers = new Headers(request.headers);
+	headers.delete(WALLET_OBJECT_IDENTITY_HEADER);
+	headers.delete(WALLET_OBJECT_ADDRESSES_HEADER);
+	request = new Request(request, { headers });
 	if (request.method === "GET" && new URL(request.url).pathname === ROUTER_AB_CEREMONY_JWKS_PATH) return routerAbCeremonyJwksResponse(env);
 	const operation = yaoDirectOperationForRequest(request);
 	if (operation !== null) {
@@ -446,7 +514,7 @@ async function handleSplitGatewayRequest(request, env, ctx, dependencies = {}) {
 		withCors(response.headers, { corsOrigins: readEnvironmentCsv(env.RELAY_CORS_ORIGINS) }, request);
 		return response;
 	}
-	return await (await createSplitGatewayRouterHandler(env, dependencies))(request, env, ctx);
+	return await (await createSplitGatewayRouterHandler(env, dependencies, ctx))(request, env, ctx);
 }
 function requireStagingRouterAbPublicKeyset(env) {
 	const parsed = parseJsonValue(requireEnvironmentString(env, "ROUTER_AB_PUBLIC_KEYSET_JSON"));
@@ -512,14 +580,11 @@ function createStagingEcdsaPresignRuntime(env) {
 	const presignAuthSecret = requireEnvironmentString(env, "ROUTER_AB_GATEWAY_TO_SIGNING_WORKER_PRESIGN_AUTH_SECRET");
 	if (presignAuthSecret === requireEnvironmentString(env, "ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET") || presignAuthSecret === requireEnvironmentString(env, "ROUTER_AB_GATEWAY_TO_ROUTER_AUTH_SECRET")) throw new Error("Gateway-to-SigningWorker presign auth secret must be role-specific");
 	return new RouterAbEcdsaPresignRuntime({
-		config: {
-			nodeRole: "coordinator",
-			participantIds: {
-				clientParticipantId: 1,
-				relayerParticipantId: 2,
-				participantIds2p: [1, 2]
-			}
-		},
+		config: { participantIds: {
+			clientParticipantId: 1,
+			relayerParticipantId: 2,
+			participantIds2p: [1, 2]
+		} },
 		signingWorkerTransport: {
 			kind: "configured",
 			signingWorkerBaseUrl: ROUTER_AB_SIGNING_WORKER_ORIGIN,
@@ -614,6 +679,7 @@ async function handlePartitionedD1Operation(env, request, operation, tenantRootC
 		case "recovery_activate":
 		case "recovery_status": return await handleRouterAbEd25519YaoRecoveryRequestScopedCloudflareV1({
 			request,
+			lifecycleRouting: dependencies.lifecycleRouting,
 			...createStagingRecoveryRequestScopedDependencies(env, tenantRootCustodyLineage, dependencies)
 		});
 		case "export_admission":
@@ -622,6 +688,7 @@ async function handlePartitionedD1Operation(env, request, operation, tenantRootC
 			const { service } = await createStagingRouterApiAuthComposition(env, scope, createStagingYaoRequestScopedRuntime(env, createStagingRegistrationTenantRootResolver(scope, tenantRootCustodyLineage)), tenantRootCustodyLineage, dependencies);
 			return await handleRouterAbEd25519YaoExportRequestScopedCloudflareV1({
 				request,
+				lifecycleRouting: dependencies.lifecycleRouting,
 				...createStagingExportRequestScopedDependencies(env, service, tenantRootCustodyLineage)
 			});
 		}
@@ -650,6 +717,44 @@ function createStagingYaoRequestScopedRuntime(env, resolveTenantRoot) {
 		loadPersistedActiveCapability: loadStagingPersistedActiveCapability.bind(void 0, env)
 	});
 }
+async function scheduleRegistrationRouterStartup(env, background, registration) {
+	const tenant = stagingTenantScope(env);
+	const identity = walletObjectIdentity(registration.walletId, registration.ownershipGeneration, tenant);
+	await new D1WalletObjectAddresses(env.SIGNER_DB, tenant).initialize(identity, env.MPC_ROUTER, requireEnvironmentString(env, "ROUTER_AB_GATEWAY_TO_ROUTER_AUTH_SECRET"));
+	background.waitUntil(startRegistrationRouter(env, identity));
+}
+async function startRegistrationRouter(env, registration) {
+	const started = Date.now();
+	let outcome = "failure";
+	try {
+		const scope = stagingTenantScope(env);
+		const response = await env.MPC_ROUTER.fetch(`${ROUTER_AB_MPC_ROUTER_ORIGIN}/router-ab/router/wallet/start`, {
+			method: "POST",
+			headers: {
+				"content-type": "application/json",
+				...walletObjectIdentityHeaders(registration),
+				"x-router-ab-internal-service-auth": requireEnvironmentString(env, "ROUTER_AB_GATEWAY_TO_ROUTER_AUTH_SECRET")
+			},
+			body: JSON.stringify({
+				owner: {
+					org_id: scope.orgId,
+					project_id: scope.projectId,
+					env_id: scope.envId,
+					wallet_id: registration.walletId
+				},
+				ownership_generation: registration.ownershipGeneration
+			}),
+			signal: AbortSignal.timeout(3e3)
+		});
+		await response.arrayBuffer();
+		if (response.ok) outcome = "success";
+	} catch {}
+	console.log(JSON.stringify({
+		event: "registration_router_startup",
+		outcome,
+		duration_ms: Date.now() - started
+	}));
+}
 /**
 * Builds the recovery request-scoped dependencies from the environment alone.
 * This is new composition wiring over the existing authorization classes, not a
@@ -688,13 +793,14 @@ function createStagingRecoveryRequestScopedDependencies(env, tenantRootCustodyLi
 * Router API factor and owner-proof services.
 */
 function createStagingExportRequestScopedDependencies(env, service, tenantRootCustodyLineage) {
+	const authority = service.walletExecution;
 	const scope = stagingTenantScope(env);
 	const registrationTenantRootResolver = createStagingRegistrationTenantRootResolver(scope, tenantRootCustodyLineage);
 	const resolveActiveTenantRoot = resolveStagingActiveTenantRootFromService.bind(void 0, service);
 	return {
 		store: createStagingYaoPartitionedStateStore(env),
 		backend: createStagingEd25519YaoBackend(env, createStagingTenantRootResolver(scope, tenantRootCustodyLineage, resolveActiveTenantRoot)),
-		authorization: new RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter(service.webAuthn, service.emailOtp, service.walletAuthMethods, service.authorizedOperations, service.walletRegistration.resolveEd25519MaterialActivation.bind(service.walletRegistration)),
+		authorization: new RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter(service.webAuthn, service.emailOtp, service.walletAuthMethods, service.authorizedOperations, service.walletRegistration.resolveEd25519MaterialActivation.bind(service.walletRegistration), authority.admitEstablishedHome.bind(authority)),
 		capabilities: createStagingYaoRequestScopedRuntime(env, registrationTenantRootResolver)
 	};
 }
@@ -719,6 +825,6 @@ function stagingWalletStore(env) {
 	});
 }
 //#endregion
-export { createHostedWalletGatewayCompositionV1, createSplitGatewayRouterHandler, createStagingEd25519YaoBackend, createStagingExportRequestScopedDependencies, createStagingRecoveryRequestScopedDependencies, handleSplitGatewayRequest, handleSplitGatewayWalletRuntimeRequest, readStagingHostedWalletOrigins, stagingSigningSessionSealOptions };
+export { createHostedWalletGatewayCompositionV1, createSplitGatewayRouterHandler, createStagingEd25519YaoBackend, createStagingExportRequestScopedDependencies, createStagingRecoveryRequestScopedDependencies, handleSplitGatewayRequest, handleSplitGatewayWalletRuntimeRequest, readStagingHostedWalletOrigins, readWalletRuntimeIdentities, stagingSigningSessionSealOptions };
 
 //# sourceMappingURL=hosted-wallet-gateway.js.map