@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/router/cloudflare/runtime/walletRelocationPresign.js

@@ -0,0 +1,185 @@
+import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
+import { walletObjectIdentityHeaders, walletRelocationObjectIdentity } from "./walletObjectAddresses.js";
+import { ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1 } from "../../../core/ThresholdService/routerAb/internalServiceHttp.js";
+//#region src/router/cloudflare/runtime/walletRelocationPresign.ts
+function presignSourceOperation(operation) {
+	switch (operation) {
+		case "presign-inventory": return "inventory";
+		case "presign-fence": return "fence";
+		case "presign-freeze": return "freeze";
+		case "presign-export": return "export";
+		case "presign-import": return "import";
+		case "presign-verify": return "verify";
+		case "presign-status": return "status";
+		case "presign-cleanup": return "cleanup";
+		default: return null;
+	}
+}
+async function forwardPresignSource(input, operation, router, credential, directory) {
+	if (operation === "export" || operation === "import" || operation === "verify" || operation === "status" || operation === "cleanup") return forwardPresignTransfer(input, operation, router, credential, directory);
+	if (!isPlainObject(input) || Object.keys(input).length !== (operation === "inventory" ? 4 : 3) || !isPlainObject(input.wallet) || !isPlainObject(input.attempt)) return failure("invalid_input", 400);
+	const request = operation === "inventory" ? {
+		operation,
+		cursor: input.cursor,
+		limit: input.limit
+	} : {
+		operation,
+		session: input.session
+	};
+	try {
+		const authorized = await postDirectory(directory, "relocation-presign-source", {
+			wallet: input.wallet,
+			attempt: input.attempt,
+			request
+		});
+		if (!authorized.ok) return failure("source_command_denied", 409);
+		const result = await authorized.json();
+		if (!isPlainObject(result) || Object.keys(result).length !== 2 || result.ok !== true || !isPlainObject(result.command) || Object.keys(result.command).length !== 2 || result.command.operation !== operation || !isPlainObject(result.command.payload)) return failure("source_command_unavailable", 503);
+		const payload = result.command.payload;
+		const scope = operation === "inventory" ? payload.scope : payload.wallet_scope;
+		if (Object.keys(payload).length !== 4 || !isPlainObject(scope) || Object.keys(scope).length !== 4 || typeof scope.org_id !== "string" || scope.org_id !== input.wallet.organizationId || typeof scope.project_id !== "string" || scope.project_id !== input.wallet.projectId || typeof scope.project_environment_id !== "string" || scope.project_environment_id !== input.wallet.environmentId || typeof scope.wallet_id !== "string" || scope.wallet_id !== input.wallet.walletId || !isPlainObject(payload.request) || Object.keys(payload.request).length !== 3 || typeof payload.request.move_id !== "string" || payload.request.move_id !== input.attempt.moveId || !positiveInteger(payload.request.source_generation) || !positiveInteger(payload.request.invalidated_at_ms)) return failure("source_command_unavailable", 503);
+		let path;
+		if (operation === "inventory") {
+			if (!sameFields(payload.cursor, input.cursor) || payload.limit !== input.limit || !positiveInteger(payload.limit) || payload.limit > 128) return failure("source_command_unavailable", 503);
+			path = "/router-ab/signing-worker/wallet/linked-presign-inventory";
+		} else {
+			if (!isPlainObject(input.session) || Object.keys(input.session).length !== 2 || typeof input.session.presignSessionId !== "string" || !input.session.presignSessionId.trim() || typeof input.session.serverPresignatureId !== "string" || !input.session.serverPresignatureId.trim() || payload.presign_session_id !== input.session.presignSessionId || payload.server_presignature_id !== input.session.serverPresignatureId) return failure("source_command_unavailable", 503);
+			path = `/router-ab/signing-worker/linked-presign-session/${operation}`;
+		}
+		const response = await router.fetch(new Request(`https://mpc-router.router-ab.internal${path}`, {
+			method: "POST",
+			redirect: "manual",
+			headers: {
+				"content-type": "application/json",
+				[ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1]: credential,
+				...walletObjectIdentityHeaders(walletRelocationObjectIdentity(input.wallet, payload.request.source_generation))
+			},
+			body: JSON.stringify(payload)
+		}));
+		if (operation !== "freeze" || !response.ok) return response;
+		const raw = await response.clone().json();
+		if (!isPlainObject(raw) || Object.keys(raw).length !== 3 || !sameFields(raw.command, payload) || !positiveInteger(raw.record_count) || typeof raw.records_digest_hex !== "string" || !/^[a-f0-9]{64}$/u.test(raw.records_digest_hex)) return failure("source_receipt_unavailable", 503);
+		const receipt = {
+			command: payload,
+			record_count: raw.record_count,
+			records_digest_hex: raw.records_digest_hex
+		};
+		const recorded = await postDirectory(directory, "relocation-presign-receipt", {
+			wallet: input.wallet,
+			attempt: input.attempt,
+			receipt
+		});
+		if (!recorded.ok) return failure("source_receipt_unavailable", 503);
+		const confirmed = await recorded.json();
+		if (!isPlainObject(confirmed) || Object.keys(confirmed).length !== 2 || confirmed.ok !== true || !sameFields(confirmed.receipt, receipt)) return failure("source_receipt_unavailable", 503);
+		return response;
+	} catch {
+		return failure("source_command_unavailable", 503);
+	}
+}
+function positiveInteger(raw) {
+	return typeof raw === "number" && Number.isSafeInteger(raw) && raw > 0;
+}
+function sameFields(left, right) {
+	if (!isPlainObject(left) || !isPlainObject(right)) return left === right;
+	if (Object.keys(left).length !== Object.keys(right).length) return false;
+	for (const key of Object.keys(left)) if (!sameFields(left[key], right[key])) return false;
+	return true;
+}
+function postDirectory(directory, endpoint, body) {
+	const version = directory.CF_VERSION_METADATA.id;
+	if (typeof version !== "string" || !version) throw new Error("Runtime version is unavailable");
+	return directory.WALLET_CONSOLE.fetch(new Request(`https://wallet-placement.internal/internal/wallet-placement/v1/${endpoint}`, {
+		method: "POST",
+		headers: {
+			"content-type": "application/json",
+			"x-seams-writer-role": "walletRuntime",
+			"x-seams-writer-version": version,
+			"x-seams-writer-account": directory.SEAMS_D1_HOME_ACCOUNT_ID,
+			"x-seams-writer-database": directory.SEAMS_D1_HOME_DATABASE_ID
+		},
+		body: JSON.stringify(body)
+	}));
+}
+function failure(code, status) {
+	return Response.json({
+		ok: false,
+		code
+	}, {
+		status,
+		headers: { "Cache-Control": "no-store" }
+	});
+}
+async function forwardPresignTransfer(input, operation, router, credential, directory) {
+	if (!isPlainObject(input) || Object.keys(input).length !== (operation === "verify" || operation === "status" || operation === "cleanup" ? 3 : 4) || !isPlainObject(input.wallet) || !isPlainObject(input.attempt) || !isPlainObject(input.session) || Object.keys(input.session).length !== 2 || typeof input.session.presignSessionId !== "string" || !input.session.presignSessionId.trim() || typeof input.session.serverPresignatureId !== "string" || !input.session.serverPresignatureId.trim()) return failure("invalid_input", 400);
+	if (operation === "export" && !segmentIndex(input.segmentIndex)) return failure("invalid_input", 400);
+	const request = operation === "export" ? {
+		operation,
+		session: input.session,
+		segmentIndex: input.segmentIndex
+	} : {
+		operation,
+		session: input.session
+	};
+	try {
+		const authorized = await postDirectory(directory, "relocation-presign-transfer", {
+			wallet: input.wallet,
+			attempt: input.attempt,
+			request
+		});
+		if (!authorized.ok) return failure("source_command_denied", 409);
+		const result = await authorized.json();
+		if (!isPlainObject(result) || Object.keys(result).length !== 2 || result.ok !== true || !isPlainObject(result.command) || result.command.kind !== operation || Object.keys(result.command).length !== (operation === "export" ? 4 : operation === "import" || operation === "status" ? 3 : 2)) return failure("source_command_unavailable", 503);
+		const command = result.command;
+		const receipt = command.receipt;
+		if (!isPlainObject(receipt) || Object.keys(receipt).length !== 3 || !positiveInteger(receipt.record_count) || typeof receipt.records_digest_hex !== "string" || !/^[a-f0-9]{64}$/u.test(receipt.records_digest_hex) || !isPlainObject(receipt.command) || Object.keys(receipt.command).length !== 4) return failure("source_command_unavailable", 503);
+		const source = receipt.command;
+		const scope = source.wallet_scope;
+		const move = source.request;
+		if (!isPlainObject(scope) || Object.keys(scope).length !== 4 || scope.org_id !== input.wallet.organizationId || scope.project_id !== input.wallet.projectId || scope.project_environment_id !== input.wallet.environmentId || scope.wallet_id !== input.wallet.walletId || !isPlainObject(move) || Object.keys(move).length !== 3 || move.move_id !== input.attempt.moveId || !positiveInteger(move.source_generation) || !positiveInteger(move.invalidated_at_ms) || source.presign_session_id !== input.session.presignSessionId || source.server_presignature_id !== input.session.serverPresignatureId || operation !== "verify" && operation !== "cleanup" && command.chunk_bytes !== 4096) return failure("source_command_unavailable", 503);
+		let payload;
+		if (operation === "export") {
+			if (command.segment_index !== input.segmentIndex) return failure("source_command_unavailable", 503);
+			payload = {
+				receipt,
+				segment_index: command.segment_index,
+				chunk_bytes: 4096
+			};
+		} else if (operation === "import") {
+			const chunk = input.chunk;
+			if (!isPlainObject(chunk) || Object.keys(chunk).length !== 5 || !sameFields(chunk.receipt, receipt) || !segmentIndex(chunk.segment_index) || !positiveInteger(chunk.segment_count) || chunk.segment_count > 4294967295 || chunk.segment_index >= chunk.segment_count || chunk.chunk_bytes !== 4096 || typeof chunk.data_b64u !== "string" || chunk.data_b64u.length > 5462 || !/^[A-Za-z0-9_-]+$/u.test(chunk.data_b64u)) return failure("invalid_input", 400);
+			payload = {
+				kind: "import",
+				chunk
+			};
+		} else if (operation === "status") payload = {
+			kind: "status",
+			receipt,
+			chunk_bytes: 4096
+		};
+		else payload = {
+			kind: operation,
+			receipt
+		};
+		const path = operation === "export" ? "export" : "transfer";
+		return await router.fetch(new Request(`https://mpc-router.router-ab.internal/router-ab/signing-worker/linked-presign-session/${path}`, {
+			method: "POST",
+			redirect: "manual",
+			headers: {
+				"content-type": "application/json",
+				[ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1]: credential,
+				...walletObjectIdentityHeaders(walletRelocationObjectIdentity(input.wallet, move.source_generation + (operation === "export" || operation === "cleanup" ? 0 : 1)))
+			},
+			body: JSON.stringify(payload)
+		}));
+	} catch {
+		return failure("source_command_unavailable", 503);
+	}
+}
+function segmentIndex(raw) {
+	return typeof raw === "number" && Number.isInteger(raw) && raw >= 0 && raw <= 4294967295;
+}
+//#endregion
+export { forwardPresignSource, presignSourceOperation };
+
+//# sourceMappingURL=walletRelocationPresign.js.map

package/dist/esm/router/cloudflare/runtime/walletRelocationSource.js

@@ -0,0 +1,221 @@
+import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
+import { walletRelocationObjectIdentity } from "./walletObjectAddresses.js";
+//#region src/router/cloudflare/runtime/walletRelocationSource.ts
+async function authorizeRuntimeSource(input, operation, env) {
+	let fieldCount = 2;
+	if (operation === "router-export") fieldCount = 4;
+	else if (operation === "router-import") fieldCount = 3;
+	if (!isPlainObject(input) || Object.keys(input).length !== fieldCount || !isPlainObject(input.wallet) || !isPlainObject(input.attempt)) return {
+		ok: false,
+		code: "invalid_input"
+	};
+	const version = env.CF_VERSION_METADATA.id;
+	if (typeof version !== "string" || !version) return {
+		ok: false,
+		code: "source_command_unavailable"
+	};
+	const destination = operation === "router-status" || operation === "router-verify" || operation === "router-import" || operation === "router-activate";
+	const transfer = destination || operation === "router-export" || operation === "router-cleanup";
+	let endpoint = "relocation-runtime-source";
+	let commandBody = JSON.stringify({
+		wallet: input.wallet,
+		attempt: input.attempt,
+		operation
+	});
+	if (operation === "router-export") {
+		endpoint = "relocation-router-export";
+		commandBody = JSON.stringify({
+			wallet: input.wallet,
+			attempt: input.attempt,
+			recordIndex: input.recordIndex,
+			segmentIndex: input.segmentIndex
+		});
+	} else if (operation === "router-cleanup") {
+		endpoint = "relocation-router-cleanup";
+		commandBody = JSON.stringify({
+			wallet: input.wallet,
+			attempt: input.attempt
+		});
+	} else if (destination) {
+		endpoint = "relocation-router-destination";
+		let destinationOperation = "verify";
+		if (operation === "router-status") destinationOperation = "status";
+		else if (operation === "router-import") destinationOperation = "import";
+		else if (operation === "router-activate") destinationOperation = "activate";
+		commandBody = JSON.stringify({
+			wallet: input.wallet,
+			attempt: input.attempt,
+			operation: destinationOperation
+		});
+	}
+	let response;
+	let result;
+	try {
+		response = await env.WALLET_CONSOLE.fetch(new Request(`https://wallet-placement.internal/internal/wallet-placement/v1/${endpoint}`, {
+			method: "POST",
+			headers: {
+				"content-type": "application/json",
+				"x-seams-writer-role": "walletRuntime",
+				"x-seams-writer-version": version,
+				"x-seams-writer-account": env.SEAMS_D1_HOME_ACCOUNT_ID,
+				"x-seams-writer-database": env.SEAMS_D1_HOME_DATABASE_ID
+			},
+			body: commandBody
+		}));
+		if (!response.ok) return {
+			ok: false,
+			code: "source_command_denied"
+		};
+		result = await response.json();
+	} catch {
+		return {
+			ok: false,
+			code: "source_command_unavailable"
+		};
+	}
+	if (!isPlainObject(result) || result.ok !== true || !isPlainObject(result.command) || !transfer && (result.command.operation !== operation || !isPlainObject(result.command.payload))) return {
+		ok: false,
+		code: "source_command_unavailable"
+	};
+	const payload = transfer ? result.command : result.command.payload;
+	if (!isPlainObject(payload)) return {
+		ok: false,
+		code: "source_command_unavailable"
+	};
+	if (operation === "router-freeze" || transfer) {
+		let request = payload;
+		if (transfer) {
+			let receipt = payload.receipt;
+			if (operation === "router-cleanup") {
+				if (Object.keys(payload).length !== 2 || payload.kind !== "cleanup" || !isPlainObject(payload.activation) || Object.keys(payload.activation).length !== 2 || typeof payload.activation.destination_object !== "string" || payload.activation.destination_object.length === 0 || payload.activation.destination_object.length > 512) return {
+					ok: false,
+					code: "source_command_unavailable"
+				};
+				receipt = payload.activation.source;
+			}
+			if (!isPlainObject(receipt) || Object.keys(receipt).length !== 3 || !isPlainObject(receipt.request) || typeof receipt.records_digest_hex !== "string" || !/^[a-f0-9]{64}$/u.test(receipt.records_digest_hex) || typeof receipt.record_count !== "number" || !Number.isSafeInteger(receipt.record_count) || receipt.record_count < 0) return {
+				ok: false,
+				code: "source_command_unavailable"
+			};
+			if (operation === "router-export") {
+				if (Object.keys(payload).length !== 5 || payload.kind !== "export" || payload.record_index !== input.recordIndex || payload.segment_index !== input.segmentIndex || payload.chunk_bytes !== 4096 || typeof input.recordIndex !== "number" || !Number.isSafeInteger(input.recordIndex) || input.recordIndex < 0 || input.recordIndex >= receipt.record_count || typeof input.segmentIndex !== "number" || !Number.isSafeInteger(input.segmentIndex) || input.segmentIndex < 0 || input.segmentIndex > 4294967295) return {
+					ok: false,
+					code: "source_command_unavailable"
+				};
+			} else if (operation === "router-status" || operation === "router-import") {
+				if (Object.keys(payload).length !== 3 || payload.kind !== (operation === "router-status" ? "status" : "import") || payload.chunk_bytes !== 4096) return {
+					ok: false,
+					code: "source_command_unavailable"
+				};
+			} else if (operation !== "router-cleanup" && (Object.keys(payload).length !== 2 || payload.kind !== (operation === "router-activate" ? "activate" : "verify"))) return {
+				ok: false,
+				code: "source_command_unavailable"
+			};
+			request = receipt.request;
+		}
+		if (Object.keys(request).length !== 5 || !isPlainObject(request.owner) || Object.keys(request.owner).length !== 4 || request.owner.org_id !== input.wallet.organizationId || request.owner.project_id !== input.wallet.projectId || request.owner.env_id !== input.wallet.environmentId || request.owner.wallet_id !== input.wallet.walletId || request.move_id !== input.attempt.moveId || typeof request.request_digest_hex !== "string" || !/^[0-9a-f]{64}$/.test(request.request_digest_hex) || typeof request.source_generation !== "number" || !Number.isSafeInteger(request.source_generation) || request.source_generation < 1 || typeof request.destination_generation !== "number" || !Number.isSafeInteger(request.destination_generation) || request.destination_generation !== request.source_generation + 1) return {
+			ok: false,
+			code: "source_command_unavailable"
+		};
+		const generation = operation === "router-freeze" || operation === "router-export" || operation === "router-cleanup" ? request.source_generation : request.destination_generation;
+		const identity = walletRelocationObjectIdentity(input.wallet, generation);
+		if (operation === "router-import") return authorizeImportChunk(input.chunk, payload.receipt, identity);
+		return {
+			ok: true,
+			body: JSON.stringify(payload),
+			identity
+		};
+	}
+	const source = operation === "ed25519-capture" ? payload.source : payload;
+	if (operation === "ed25519-capture" && (payload.command !== "capture" || Object.keys(payload).length !== 2) || !isPlainObject(source) || Object.keys(source).length !== 2 || !isPlainObject(source.scope) || !isPlainObject(source.request) || Object.keys(source.scope).length !== 4 || Object.keys(source.request).length !== 3 || source.scope.org_id !== input.wallet.organizationId || source.scope.project_id !== input.wallet.projectId || source.scope.project_environment_id !== input.wallet.environmentId || source.scope.wallet_id !== input.wallet.walletId || source.request.move_id !== input.attempt.moveId || typeof source.request.source_generation !== "number" || !Number.isSafeInteger(source.request.source_generation) || source.request.source_generation < 1 || typeof source.request.invalidated_at_ms !== "number" || !Number.isSafeInteger(source.request.invalidated_at_ms) || source.request.invalidated_at_ms < 1) return {
+		ok: false,
+		code: "source_command_unavailable"
+	};
+	return {
+		ok: true,
+		body: JSON.stringify(payload),
+		identity: walletRelocationObjectIdentity(input.wallet, source.request.source_generation)
+	};
+}
+async function recordRuntimeRouterReceipt(operation, input, response, env) {
+	if (!response.ok) return response;
+	try {
+		const result = await response.clone().json();
+		if (!isPlainObject(input) || !isPlainObject(result)) return receiptUnavailable();
+		let receipt;
+		let endpoint;
+		if (operation === "router-freeze") {
+			if (result.state === "draining") return response;
+			if (result.state !== "frozen") return receiptUnavailable();
+			receipt = result.receipt;
+			endpoint = "relocation-router-receipt";
+		} else {
+			if (result.kind !== "activated") return receiptUnavailable();
+			receipt = result.activation;
+			endpoint = "relocation-router-activation";
+		}
+		if (!isPlainObject(receipt)) return receiptUnavailable();
+		const version = env.CF_VERSION_METADATA.id;
+		if (typeof version !== "string" || !version) return receiptUnavailable();
+		const recorded = await env.WALLET_CONSOLE.fetch(new Request(`https://wallet-placement.internal/internal/wallet-placement/v1/${endpoint}`, {
+			method: "POST",
+			headers: {
+				"content-type": "application/json",
+				"x-seams-writer-role": "walletRuntime",
+				"x-seams-writer-version": version,
+				"x-seams-writer-account": env.SEAMS_D1_HOME_ACCOUNT_ID,
+				"x-seams-writer-database": env.SEAMS_D1_HOME_DATABASE_ID
+			},
+			body: JSON.stringify({
+				wallet: input.wallet,
+				attempt: input.attempt,
+				receipt
+			})
+		}));
+		if (!recorded.ok) return receiptUnavailable();
+		const acknowledgement = await recorded.json();
+		if (!isPlainObject(acknowledgement) || acknowledgement.ok !== true || !isPlainObject(acknowledgement.receipt)) return receiptUnavailable();
+		if (!sameReceipt(receipt, acknowledgement.receipt)) return receiptUnavailable();
+		return response;
+	} catch {
+		return receiptUnavailable();
+	}
+}
+function sameReceipt(expected, actual) {
+	if (Object.keys(expected).length !== Object.keys(actual).length) return false;
+	for (const key of Object.keys(expected)) {
+		const left = expected[key];
+		const right = actual[key];
+		if (isPlainObject(left) && isPlainObject(right)) {
+			if (!sameReceipt(left, right)) return false;
+		} else if (left !== right) return false;
+	}
+	return true;
+}
+function receiptUnavailable() {
+	return Response.json({
+		ok: false,
+		code: "router_receipt_unavailable"
+	}, {
+		status: 503,
+		headers: { "Cache-Control": "no-store" }
+	});
+}
+function authorizeImportChunk(chunk, receipt, identity) {
+	if (!isPlainObject(receipt) || !isPlainObject(chunk) || Object.keys(chunk).length !== 6 || !isPlainObject(chunk.receipt) || !sameReceipt(receipt, chunk.receipt) || typeof chunk.record_index !== "number" || !Number.isSafeInteger(chunk.record_index) || chunk.record_index < 0 || typeof receipt.record_count !== "number" || chunk.record_index >= receipt.record_count || typeof chunk.segment_index !== "number" || !Number.isSafeInteger(chunk.segment_index) || chunk.segment_index < 0 || typeof chunk.segment_count !== "number" || !Number.isSafeInteger(chunk.segment_count) || chunk.segment_count < 1 || chunk.segment_count > 4294967295 || chunk.segment_index >= chunk.segment_count || chunk.chunk_bytes !== 4096 || typeof chunk.data_b64u !== "string" || chunk.data_b64u.length > 5462 || !/^[A-Za-z0-9_-]+$/u.test(chunk.data_b64u)) return {
+		ok: false,
+		code: "invalid_input"
+	};
+	return {
+		ok: true,
+		body: JSON.stringify({
+			kind: "import",
+			chunk
+		}),
+		identity
+	};
+}
+//#endregion
+export { authorizeRuntimeSource, recordRuntimeRouterReceipt };
+
+//# sourceMappingURL=walletRelocationSource.js.map

package/dist/esm/router/cloudflare/runtime/walletRuntimeOps.js

@@ -270,13 +270,19 @@ function parseWalletRuntimeWalletIdentityRequest(value) {
 	const wallets = [];
 	for (const rawWallet of rawWallets) {
 		const wallet = inspectRawObject(rawWallet);
-		if (!wallet || !hasExactKeys(wallet, ["walletId", "projectId"])) return null;
+		if (!wallet || !hasExactKeys(wallet, [
+			"walletId",
+			"projectId",
+			"envId"
+		])) return null;
 		const walletId = parseNonEmptyText(readRawField(wallet, "walletId"));
 		const projectId = parseNonEmptyText(readRawField(wallet, "projectId"));
-		if (!walletId || !projectId) return null;
+		const envId = parseNonEmptyText(readRawField(wallet, "envId"));
+		if (!walletId || !projectId || !envId) return null;
 		wallets.push({
 			walletId,
-			projectId
+			projectId,
+			envId
 		});
 	}
 	return {
@@ -294,15 +300,21 @@ function parseWalletRuntimeWalletIdentitiesResult(value) {
 		const identity = inspectRawObject(rawIdentity);
 		if (!identity || !hasExactKeys(identity, [
 			"walletId",
+			"projectId",
+			"envId",
 			"nearAccountId",
 			"evmAddress"
 		])) return null;
 		const walletId = parseNonEmptyText(readRawField(identity, "walletId"));
+		const projectId = parseNonEmptyText(readRawField(identity, "projectId"));
+		const envId = parseNonEmptyText(readRawField(identity, "envId"));
 		const nearAccountId = parseNonEmptyText(readRawField(identity, "nearAccountId"));
 		const evmAddress = parseEvmAddress(readRawField(identity, "evmAddress"));
-		if (!walletId || !nearAccountId || !evmAddress) return null;
+		if (!walletId || !projectId || !envId || !nearAccountId || !evmAddress) return null;
 		identities.push({
 			walletId,
+			projectId,
+			envId,
 			nearAccountId,
 			evmAddress
 		});

package/dist/esm/router/cloudflare/signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.js

@@ -1,7 +1,8 @@
-import { mpcMaterialActivationRefsEqual } from "../../../shared-ts/src/utils/domainIds.js";
+import { mpcMaterialActivationRefsEqual, parseWalletId } from "../../../shared-ts/src/utils/domainIds.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseLinkedDeviceEcdsaSourceContributionBindingV1, parseLinkedDeviceEcdsaSourcePreservingActivationReceiptV1 } from "../../../shared-ts/src/device-linking/sourceContribution.js";
+import { walletObjectIdentity, walletObjectIdentityFromWireScope, walletObjectIdentityHeaders } from "../runtime/walletObjectAddresses.js";
 import { routerAbEd25519YaoTenantRootWireV1 } from "../../domains/ed25519Yao/routerAbEd25519YaoGatewayEnvelope.js";
 import { createOrdinaryInactiveSignerMaterialReservationServiceV1, parseOrdinaryEcdsaSignerMaterialDeactivationResultV1, parseOrdinaryEcdsaSignerMaterialWorkerReservationV1, parseOrdinaryEd25519SignerMaterialDeactivationResultV1, parseOrdinaryEd25519SignerMaterialWorkerReservationV1, validateOrdinaryInactiveSignerMaterialDeactivationRequestV1, validateOrdinaryInactiveSignerMaterialReservationRequestV1 } from "../../../core/signingMaterial/ordinaryInactiveSignerMaterialReservation.js";
 //#region src/router/cloudflare/signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.ts
@@ -24,6 +25,10 @@ function signingWorkerWalletScopeWireV1(tenant, walletId) {
 }
 function createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1(input) {
 	return { executeEd25519SourcePreservingV1: async (request) => {
+		const walletId = parseWalletId(request.applicationBinding.wallet_id);
+		if (!walletId.ok) throw new Error(walletId.error.message);
+		const admitted = await input.admitEstablishedHome({ walletId: walletId.value });
+		if (!admitted.ok) throw new Error(admitted.message);
 		const tenantRootWire = await routerAbEd25519YaoTenantRootWireV1(await input.resolveTenantRoot(request));
 		return await postRouterJsonRequestV1(input, CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, {
 			source_binding: request.sourceBinding,
@@ -33,12 +38,13 @@ function createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1(inp
 				participant_ids: request.participantIds,
 				target: {
 					operation: "registration",
+					ownership_generation: admitted.ownershipGeneration,
 					binding: request.targetRequest.binding,
 					deriver_a_input: request.targetRequest.deriver_a_input,
 					deriver_b_input: request.targetRequest.deriver_b_input
 				}
 			}
-		}, "Ed25519 source-preserving Router execution", "replay");
+		}, "Ed25519 source-preserving Router execution", walletObjectIdentity(request.applicationBinding.wallet_id, admitted.ownershipGeneration, tenantRootWire.identity), "replay");
 	} };
 }
 function createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1(input) {
@@ -59,6 +65,7 @@ function createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1(inpu
 }
 function ecdsaReservationRequestToWireV1(request, tenant) {
 	return {
+		ownership_generation: request.ownershipGeneration,
 		scope: signingWorkerWalletScopeWireV1(tenant, String(request.plannedActivationRef.materialOwner)),
 		source_derivation: {
 			application_binding_digest_b64u: request.preparation.sourceDerivation.applicationBindingDigestB64u,
@@ -87,6 +94,7 @@ function ed25519ReservationFromSourceContributionV1(request) {
 }
 function ed25519ActivationRequestToWireV1(input, tenant) {
 	return {
+		ownership_generation: input.ownershipGeneration,
 		scope: signingWorkerWalletScopeWireV1(tenant, input.sourceContribution.targetBinding.lifecycle.account_id),
 		binding: input.sourceContribution.targetBinding,
 		reservation_id: input.reservationId
@@ -95,6 +103,7 @@ function ed25519ActivationRequestToWireV1(input, tenant) {
 function ecdsaActivationRequestToWireV1(input, tenant) {
 	const materialActivation = input.preparation.sourceContribution.binding.target.activation;
 	return {
+		ownership_generation: input.ownershipGeneration,
 		scope: signingWorkerWalletScopeWireV1(tenant, String(materialActivation.materialOwner)),
 		material_activation: routerAbMpcMaterialActivationRefToWire(materialActivation),
 		reservation_id: input.reservationId
@@ -218,6 +227,7 @@ async function postSigningWorkerJsonRequestV1(input, path, body, operation) {
 		method: "POST",
 		headers: {
 			"content-type": "application/json",
+			...walletObjectIdentityHeaders(walletObjectIdentityFromWireScope(body.scope, body.ownership_generation)),
 			"x-router-ab-internal-service-auth": input.internalServiceAuthSecret
 		},
 		body: JSON.stringify(body)
@@ -229,11 +239,12 @@ async function postSigningWorkerJsonRequestV1(input, path, body, operation) {
 		throw new Error(`${operation} returned invalid JSON`);
 	}
 }
-async function postRouterJsonRequestV1(input, path, body, operation, retryAfterTransportFailure = "none") {
+async function postRouterJsonRequestV1(input, path, body, operation, identity, retryAfterTransportFailure = "none") {
 	const send = async (replay) => await input.fetch(new Request(`https://mpc-router.router-ab.internal${path}`, {
 		method: "POST",
 		headers: {
 			"content-type": "application/json",
+			...walletObjectIdentityHeaders(identity),
 			"x-router-ab-internal-service-auth": input.internalServiceAuthSecret,
 			...replay ? { [ROUTER_AB_YAO_REPLAY_HEADER_V1]: "1" } : {}
 		},
@@ -258,18 +269,20 @@ async function postRouterJsonRequestV1(input, path, body, operation, retryAfterT
 }
 function createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1(input) {
 	return {
-		deactivateInactiveEd25519SignerMaterialV1: async ({ materialActivation }) => await postDeactivationRequestV1(input, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, materialActivation, "ed25519", signingWorkerWalletScopeWireV1(input.tenant, String(materialActivation.materialOwner))),
-		deactivateInactiveEcdsaSignerMaterialV1: async ({ materialActivation }) => await postDeactivationRequestV1(input, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, materialActivation, "ecdsa_secp256k1", signingWorkerWalletScopeWireV1(input.tenant, String(materialActivation.materialOwner)))
+		deactivateInactiveEd25519SignerMaterialV1: async ({ materialActivation }) => await postDeactivationRequestV1(input, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, materialActivation, "ed25519", signingWorkerWalletScopeWireV1(input.tenant, String(materialActivation.materialOwner)), await establishedGeneration(input.admitEstablishedHome, String(materialActivation.materialOwner))),
+		deactivateInactiveEcdsaSignerMaterialV1: async ({ materialActivation }) => await postDeactivationRequestV1(input, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, materialActivation, "ecdsa_secp256k1", signingWorkerWalletScopeWireV1(input.tenant, String(materialActivation.materialOwner)), await establishedGeneration(input.admitEstablishedHome, String(materialActivation.materialOwner)))
 	};
 }
-async function postDeactivationRequestV1(input, path, materialActivation, keyFamily, scope) {
+async function postDeactivationRequestV1(input, path, materialActivation, keyFamily, scope, ownershipGeneration) {
 	const response = await input.fetch(new Request(`https://signing-worker.router-ab.internal${path}`, {
 		method: "POST",
 		headers: {
 			"content-type": "application/json",
+			...walletObjectIdentityHeaders(walletObjectIdentityFromWireScope(scope, ownershipGeneration)),
 			"x-router-ab-internal-service-auth": input.internalServiceAuthSecret
 		},
 		body: JSON.stringify({
+			ownership_generation: ownershipGeneration,
 			scope,
 			material_activation: routerAbMpcMaterialActivationRefToWire(materialActivation)
 		})
@@ -486,7 +499,8 @@ var CloudflareOrdinaryInactiveSignerMaterialActivationWorkerV1 = class {
 			if (!mpcMaterialActivationRefsEqual(input.materialActivation, prepared.sourceContribution.targetMaterialActivation)) throw new Error("ordinary Ed25519 activation reference does not match preparation");
 			await this.endpoint.activateInactiveEd25519SignerMaterialV1({
 				sourceContribution: prepared.sourceContribution,
-				reservationId: input.reservationId
+				reservationId: input.reservationId,
+				ownershipGeneration: input.ownershipGeneration
 			});
 			return;
 		}
@@ -494,10 +508,18 @@ var CloudflareOrdinaryInactiveSignerMaterialActivationWorkerV1 = class {
 		if (!mpcMaterialActivationRefsEqual(input.materialActivation, prepared.sourceContribution.binding.target.activation)) throw new Error("ordinary ECDSA activation reference does not match preparation");
 		await this.endpoint.activateInactiveEcdsaSignerMaterialV1({
 			preparation: prepared,
-			reservationId: input.reservationId
+			reservationId: input.reservationId,
+			ownershipGeneration: input.ownershipGeneration
 		});
 	}
 };
+async function establishedGeneration(admit, walletId) {
+	const parsed = parseWalletId(walletId);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	const admitted = await admit({ walletId: parsed.value });
+	if (!admitted.ok) throw new Error(admitted.message);
+	return admitted.ownershipGeneration;
+}
 //#endregion
 export { CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1 };