@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/router/transport/fetch/routes/deviceLinkingResponses.js

@@ -0,0 +1,130 @@
+import { assertNeverLinkSessionStateV1 } from "../../../../shared-ts/src/device-linking/contracts.js";
+import { json } from "../../../framework/http.js";
+//#region src/router/transport/fetch/routes/deviceLinkingResponses.ts
+function projectLinkSessionStateV1(state) {
+	switch (state.state) {
+		case "displaying_qr": return { state: "displaying_qr" };
+		case "claimed":
+		case "awaiting_target_factor":
+		case "awaiting_source_contribution":
+		case "provisioning": return {
+			state: state.state,
+			deviceId: state.deviceId
+		};
+		case "authority_pending_local_install": return {
+			state: "authority_pending_local_install",
+			deviceId: state.deviceId,
+			authorityId: state.authorityId,
+			packageSetDigestB64u: state.packageSetDigestB64u
+		};
+		case "active": return {
+			state: "active",
+			deviceId: state.deviceId,
+			authorityId: state.authorityId,
+			activatedAtMs: state.activatedAtMs
+		};
+		case "failed_before_commit": return {
+			state: "failed_before_commit",
+			error: state.error
+		};
+		case "cancelled": return {
+			state: "cancelled",
+			cancelledAtMs: state.cancelledAtMs
+		};
+		case "expired": return {
+			state: "expired",
+			expiredAtMs: state.expiredAtMs
+		};
+		default: return assertNeverLinkSessionStateV1(state);
+	}
+}
+function projectSession(record) {
+	return {
+		kind: "linked_device_session_projection_v1",
+		linkSessionId: record.linkSessionId,
+		qrPayload: record.qrPayload,
+		revision: record.revision,
+		createdAtMs: record.createdAtMs,
+		updatedAtMs: record.updatedAtMs,
+		state: projectLinkSessionStateV1(record.state)
+	};
+}
+function invalidStateResponse(record) {
+	return json({
+		ok: false,
+		outcome: "invalid_state",
+		state: record.state.state,
+		session: projectSession(record)
+	}, { status: 409 });
+}
+function sessionProjectionResponse(record, outcome) {
+	return json({
+		ok: true,
+		outcome,
+		session: projectSession(record)
+	}, { status: 200 });
+}
+function targetCredentialResultResponse(record, outcome, targetCredential) {
+	return json({
+		ok: true,
+		outcome,
+		targetCredential,
+		session: projectSession(record)
+	}, { status: 200 });
+}
+function exportRootWriteResponse(result) {
+	return result.outcome === "conflict" ? json({
+		ok: false,
+		code: result.reason ?? "conflict",
+		message: "export-root relay conflict"
+	}, { status: 409 }) : json({
+		ok: true,
+		outcome: result.outcome
+	}, { status: 200 });
+}
+function invalidInputResponse(message) {
+	return json({
+		ok: false,
+		outcome: "invalid_input",
+		code: "invalid_input",
+		message
+	}, { status: 400 });
+}
+function notSupportedResponse(message = "Device linking is not configured") {
+	return json({
+		ok: false,
+		code: "not_supported",
+		message
+	}, { status: 501 });
+}
+function notFoundResponse() {
+	return json({
+		ok: false,
+		code: "not_found",
+		message: "Linked-device session not found"
+	}, { status: 404 });
+}
+function methodNotAllowedResponse() {
+	return json({
+		ok: false,
+		code: "method_not_allowed",
+		message: "Method is not allowed"
+	}, { status: 405 });
+}
+function authDeniedResponse(result) {
+	if (result.code === "unavailable") return json({
+		ok: false,
+		code: result.code,
+		message: result.message
+	}, { status: 503 });
+	return json({
+		ok: false,
+		outcome: "unauthorized",
+		code: result.code,
+		message: result.message
+	}, { status: result.code === "expired" ? 410 : 401 });
+}
+//#endregion
+export { authDeniedResponse, exportRootWriteResponse, invalidInputResponse, invalidStateResponse, methodNotAllowedResponse, notFoundResponse, notSupportedResponse, projectSession, sessionProjectionResponse, targetCredentialResultResponse };
+
+//# sourceMappingURL=deviceLinkingResponses.js.map

package/dist/esm/router/transport/fetch/routes/ecdsaOperationStepUpFactor.js

@@ -0,0 +1,171 @@
+import { parseEmailOtpChallengeId, parseOrgId, parseProviderSubject } from "../../../../shared-ts/src/utils/domainIds.js";
+import { parseAuthFactorId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
+import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import "../../../../shared-ts/src/utils/encoders.js";
+import { buildVerifiedWalletOperationEmailOtpFactorResult, buildVerifiedWalletOperationPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
+import { json } from "../../../framework/http.js";
+import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
+//#region src/router/transport/fetch/routes/ecdsaOperationStepUpFactor.ts
+async function verifyEcdsaOperationStepUpFactor(input) {
+	const proof = input.proof;
+	switch (proof.kind) {
+		case "passkey": {
+			if (input.authSource.kind !== "passkey" || proof.authority.factor.credentialIdB64u !== input.authSource.credentialIdB64u) return {
+				ok: false,
+				response: json({
+					ok: false,
+					code: "scope_mismatch",
+					message: "Passkey authority changed"
+				}, { status: 403 })
+			};
+			const credential = proof.webauthn_authentication;
+			if (String(credential.rawId || credential.id).trim() !== input.authSource.credentialIdB64u) return {
+				ok: false,
+				response: json({
+					ok: false,
+					code: "unauthorized",
+					message: "Passkey credential changed"
+				}, { status: 401 })
+			};
+			const verified = await input.webAuthn.verifyWebAuthnAuthenticationLite({
+				userId: input.walletId,
+				rpId: proof.authority.verifier.rpId,
+				expectedChallenge: input.expectedChallenge,
+				expected_origin: input.requestOrigin,
+				webauthn_authentication: credential
+			});
+			if (!verified.success || !verified.verified) return {
+				ok: false,
+				response: json({
+					ok: false,
+					code: verified.code || "not_verified",
+					message: verified.message || "WebAuthn authentication verification failed"
+				}, { status: 401 })
+			};
+			const assertionDigest = parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(credential))));
+			const verifiedAtMs = Date.now();
+			if (input.expiresAtMs <= verifiedAtMs) return expiredStepUpFactor();
+			const factorId = parseAuthFactorId(`passkey:${input.authSource.credentialIdB64u}`);
+			if (!factorId.ok) throw new Error(factorId.error.message);
+			return {
+				ok: true,
+				factor: buildVerifiedWalletOperationPasskeyFactorResult({
+					tenantId: input.operation.tenantId,
+					principalId: input.operation.principalId,
+					walletId: input.walletId,
+					requestOrigin: input.requestOrigin,
+					audience: input.requestOrigin,
+					factorId: factorId.value,
+					authorityRef: input.authorityRef,
+					operation: input.operation,
+					credentialIdB64u: proof.authority.factor.credentialIdB64u,
+					assertionDigest,
+					verifiedAtMs,
+					expiresAtMs: input.expiresAtMs
+				}),
+				unseal: { kind: "not_requested" }
+			};
+		}
+		case "email_otp": {
+			const isExport = input.operation.operation.operationKind === "evm.export_key";
+			const emailOtpOperation = isExport ? WALLET_EMAIL_OTP_EXPORT_OPERATION : WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION;
+			const operationBinding = await hashEmailOtpOperationBinding({
+				walletId: input.walletId,
+				providerUserId: proof.authority.factor.providerUserId,
+				orgId: input.operation.tenantId,
+				operation: emailOtpOperation,
+				requestOrigin: input.requestOrigin,
+				audience: input.requestOrigin,
+				authorityRef: input.authorityRef,
+				...isExport ? {} : { operationFingerprintDigest: input.operation.digests.laneDigest }
+			});
+			const verified = await input.emailOtp.verifyEmailOtpChallenge({
+				userId: proof.authority.factor.providerUserId,
+				walletId: input.walletId,
+				orgId: input.operation.tenantId,
+				challengeId: proof.challenge_id,
+				otpCode: proof.otp_code,
+				otpChannel: EMAIL_OTP_CHANNEL,
+				ownerProofBindingDigest: operationBinding,
+				operation: emailOtpOperation
+			});
+			if (!verified.ok) return {
+				ok: false,
+				response: json(verified, { status: verified.code === "invalid_body" ? 400 : 401 })
+			};
+			let verifiedChallengeId = verified.challengeId;
+			if (!isExport) {
+				const orgId = parseOrgId(input.operation.tenantId);
+				const providerSubject = parseProviderSubject(proof.authority.factor.providerUserId);
+				if (!orgId.ok) throw new Error(orgId.error.message);
+				if (!providerSubject.ok) throw new Error(providerSubject.error.message);
+				const consumed = await input.emailOtp.consumeEmailOtpGrant({
+					subject: {
+						kind: "provider_identity",
+						orgId: orgId.value,
+						providerSubject: providerSubject.value,
+						walletId: input.walletId
+					},
+					loginGrant: verified.loginGrant,
+					otpChannel: EMAIL_OTP_CHANNEL
+				});
+				if (!consumed.ok) return {
+					ok: false,
+					response: json(consumed, { status: consumed.code === "invalid_body" ? 400 : 401 })
+				};
+				verifiedChallengeId = consumed.challengeId;
+			}
+			const verificationReceiptDigest = parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
+				challengeId: verifiedChallengeId,
+				operationFingerprint: input.expectedChallenge
+			}))));
+			const verifiedAtMs = Date.now();
+			const expiresAtMs = Math.min(input.expiresAtMs, verified.grantExpiresAtMs);
+			if (expiresAtMs <= verifiedAtMs) return expiredStepUpFactor();
+			const factorId = parseAuthFactorId(`email_otp:${proof.authority.factor.provider}:${proof.authority.factor.providerUserId}`);
+			const challengeId = parseEmailOtpChallengeId(verifiedChallengeId);
+			if (!factorId.ok) throw new Error(factorId.error.message);
+			if (!challengeId.ok) throw new Error(challengeId.error.message);
+			return {
+				ok: true,
+				factor: buildVerifiedWalletOperationEmailOtpFactorResult({
+					tenantId: input.operation.tenantId,
+					principalId: input.operation.principalId,
+					walletId: input.walletId,
+					requestOrigin: input.requestOrigin,
+					audience: input.requestOrigin,
+					factorId: factorId.value,
+					authorityRef: input.authorityRef,
+					operation: input.operation,
+					challengeId: challengeId.value,
+					verificationReceiptDigest,
+					verifiedAtMs,
+					expiresAtMs
+				}),
+				unseal: isExport ? {
+					kind: "email_otp_grant",
+					grant: verified.loginGrant,
+					challenge_id: verified.challengeId
+				} : { kind: "not_requested" }
+			};
+		}
+		default: throw new Error("Unsupported ECDSA operation step-up proof");
+	}
+}
+function expiredStepUpFactor() {
+	return {
+		ok: false,
+		response: json({
+			ok: false,
+			code: "verified_step_up_rejected",
+			message: "Operation step-up authorization expired"
+		}, { status: 403 })
+	};
+}
+//#endregion
+export { verifyEcdsaOperationStepUpFactor };
+
+//# sourceMappingURL=ecdsaOperationStepUpFactor.js.map

package/dist/esm/router/transport/fetch/routes/ed25519AuthorizedOperationRevalidation.js

@@ -0,0 +1,65 @@
+import { json } from "../../../framework/http.js";
+//#region src/router/transport/fetch/routes/ed25519AuthorizedOperationRevalidation.ts
+function rejected(code, message, status) {
+	return {
+		ok: false,
+		response: json({
+			ok: false,
+			code,
+			message
+		}, { status })
+	};
+}
+function rejectedAdmission(kind) {
+	return kind === "authorization_grant_rejected" || kind === "verified_step_up_rejected" ? rejected(kind, "Ed25519 operation authorization is no longer active", 403) : rejected(kind, "Ed25519 operation admission failed", 409);
+}
+async function revalidateEd25519StepUpOperation(input) {
+	const stored = input.operation;
+	if (stored.authorization.kind !== "verified_step_up" || stored.quota.kind !== "quota_neutral") return rejected("verified_step_up_rejected", "Ed25519 operation step-up authorization has an invalid quota", 403);
+	const result = await input.ctx.service.authorizedOperations.admitAuthorizedOperation({ operation: {
+		tenantId: stored.tenantId,
+		authorizedOperationId: stored.authorizedOperationId,
+		auditEventId: stored.auditEventId,
+		operation: stored.operation,
+		authorization: stored.authorization,
+		quota: stored.quota,
+		claimedAtMs: Date.now()
+	} });
+	if (!("operation" in result)) return rejectedAdmission(result.kind);
+	if (result.operation.authorizedOperationId !== stored.authorizedOperationId) throw new Error("Ed25519 authorized operation changed during revalidation");
+	return {
+		ok: true,
+		operation: result.operation
+	};
+}
+/**
+* Finds the operation a reusable Wallet Session prepared and checks that its
+* grant is still active. A live operation returns the owner scope its
+* admission row pinned. A completed operation returns none: it replays its
+* stored response. The operation is read by its fingerprint, so a receipt
+* that names another operation ID has no stored operation.
+*/
+async function resolveEd25519WalletSessionOperation(input) {
+	const result = await input.ctx.service.authorizedOperations.resolveEd25519WalletSessionOperation({
+		tenantId: input.tenantId,
+		operationFingerprintDigest: input.operationFingerprintDigest,
+		walletId: input.walletId,
+		nowMs: Date.now()
+	});
+	if (result.kind === "authorized_operation_missing") return rejected("authorized_operation_missing", "Authorized operation is unavailable", 409);
+	if (!result.operation) return rejectedAdmission(result.kind);
+	const stored = result.operation;
+	if (stored.authorizedOperationId !== input.authorizedOperationId) return rejected("authorized_operation_missing", "Authorized operation is unavailable", 409);
+	if (stored.quota.kind !== "consume_reusable_wallet_session") return rejected("authorization_grant_rejected", "Ed25519 reusable operation authorization has an invalid quota", 403);
+	const operation = stored.operation.operation;
+	if (operation.capabilityKind !== "near_ed25519_mpc_signing" || operation.operationKind === "near.export_key") return rejected("authorization_grant_rejected", "Ed25519 reusable operation kind is invalid", 403);
+	return {
+		ok: true,
+		operation: stored,
+		ownerScope: result.ownerScope ?? null
+	};
+}
+//#endregion
+export { resolveEd25519WalletSessionOperation, revalidateEd25519StepUpOperation };
+
+//# sourceMappingURL=ed25519AuthorizedOperationRevalidation.js.map

package/dist/esm/router/transport/fetch/routes/normalSigningRouterProxy.js

@@ -1,7 +1,9 @@
+import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { walletObjectIdentity, walletObjectIdentityHeaders } from "../../../cloudflare/runtime/walletObjectAddresses.js";
 import { ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1, normalizeRouterAbInternalServiceAuthSecret } from "../../../../core/ThresholdService/routerAb/internalServiceHttp.js";
-import { json } from "../../../framework/http.js";
 import { prepareOwnerWalletExecution } from "../../../domains/signingOperations/walletExecutionAdmission.js";
+import { json } from "../../../framework/http.js";
 //#region src/router/transport/fetch/routes/normalSigningRouterProxy.ts
 async function proxyNormalSigningRequestToMpcRouter(input) {
 	const proxy = input.proxy;
@@ -12,6 +14,14 @@ async function proxyNormalSigningRequestToMpcRouter(input) {
 	}, { status: 501 });
 	try {
 		const headers = new Headers(input.request.headers);
+		const envelope = input.body?.authorized_operation;
+		if (!isPlainObject(envelope) || !isPlainObject(envelope.binding)) throw new Error("Signing requires an admitted wallet binding");
+		const identity = walletObjectIdentity(envelope.binding.account_id, envelope.binding.ownership_generation, {
+			orgId: envelope.binding.org_id,
+			projectId: envelope.binding.project_id,
+			envId: envelope.binding.project_environment_id
+		});
+		for (const [name, value] of Object.entries(walletObjectIdentityHeaders(identity))) headers.set(name, value);
 		if (input.body && parseNormalSigningSessionAdmission(input.body)) headers.delete("authorization");
 		headers.set(ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1, normalizeRouterAbInternalServiceAuthSecret(proxy.internalServiceAuthSecret));
 		const request = input.targetPath ? new Request(new URL(input.targetPath, input.request.url), input.request) : input.request;
@@ -53,7 +63,7 @@ function isNormalSigningReusableBindingRecord(value) {
 }
 function isNormalSigningGatewayOwnerBindingRecord(value) {
 	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
-	return Object.keys(value).sort().join("|") === "account_id|authorization_id|environment|expires_at_ms|kind|org_id|project_environment_id|project_id|quota_id|signing_worker_id|subject_id|threshold_session_id|wallet_session_id";
+	return Object.keys(value).sort().join("|") === "account_id|authorization_id|environment|expires_at_ms|kind|org_id|ownership_generation|project_environment_id|project_id|quota_id|signing_worker_id|subject_id|threshold_session_id|wallet_session_id";
 }
 function isNormalSigningReusableReceiptRecord(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -62,7 +72,7 @@ function isNormalSigningReusableBindingValues(record) {
 	return typeof record.authorization_id === "string" && record.authorization_id.trim().length > 0 && typeof record.wallet_session_id === "string" && record.wallet_session_id.trim().length > 0 && typeof record.quota_id === "string" && record.quota_id.trim().length > 0;
 }
 function isNormalSigningGatewayOwnerBindingValues(record) {
-	return typeof record.subject_id === "string" && record.subject_id.trim().length > 0 && typeof record.account_id === "string" && record.account_id.trim().length > 0 && typeof record.authorization_id === "string" && record.authorization_id.trim().length > 0 && typeof record.wallet_session_id === "string" && record.wallet_session_id.trim().length > 0 && typeof record.quota_id === "string" && record.quota_id.trim().length > 0 && typeof record.threshold_session_id === "string" && record.threshold_session_id.trim().length > 0 && typeof record.org_id === "string" && record.org_id.trim().length > 0 && typeof record.project_id === "string" && record.project_id.trim().length > 0 && typeof record.environment === "string" && record.environment.trim().length > 0 && typeof record.project_environment_id === "string" && record.project_environment_id.trim().length > 0 && typeof record.signing_worker_id === "string" && record.signing_worker_id.trim().length > 0 && typeof record.expires_at_ms === "number" && Number.isSafeInteger(record.expires_at_ms) && record.expires_at_ms > 0;
+	return record.kind === "gateway_owner_wallet_session" && typeof record.ownership_generation === "number" && Number.isSafeInteger(record.ownership_generation) && record.ownership_generation > 0 && typeof record.subject_id === "string" && record.subject_id.trim().length > 0 && typeof record.account_id === "string" && record.account_id.trim().length > 0 && typeof record.authorization_id === "string" && record.authorization_id.trim().length > 0 && typeof record.wallet_session_id === "string" && record.wallet_session_id.trim().length > 0 && typeof record.quota_id === "string" && record.quota_id.trim().length > 0 && typeof record.threshold_session_id === "string" && record.threshold_session_id.trim().length > 0 && typeof record.org_id === "string" && record.org_id.trim().length > 0 && typeof record.project_id === "string" && record.project_id.trim().length > 0 && typeof record.environment === "string" && record.environment.trim().length > 0 && typeof record.project_environment_id === "string" && record.project_environment_id.trim().length > 0 && typeof record.signing_worker_id === "string" && record.signing_worker_id.trim().length > 0 && typeof record.expires_at_ms === "number" && Number.isSafeInteger(record.expires_at_ms) && record.expires_at_ms > 0;
 }
 async function proxyOwnerLaneAdmittedNormalSigningRequest(input) {
 	const expectedMaterialActivation = routerAbMpcMaterialActivationRefFromWire(input.expectedMaterialActivation);

package/dist/esm/router/transport/fetch/routes/passkeyCustody.js

@@ -1,20 +1,20 @@
 import { parseEmailOtpChallengeId, parseOrgId, parseProviderSubject, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletRecoveryOperationId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { buildVaultOperationRef, parseAuthFactorId, parseAuthorizationAuditEventId, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parseDeviceId, parsePrincipalId, parseTenantId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
+import { isPlainObject, requireTrimmedString } from "../../../../shared-ts/src/utils/validation.js";
 import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
 import { sha256Utf8DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { buildCapabilityOperationEnvelope, computeCapabilityOperationFingerprintDigest } from "../../../../shared-ts/src/authorization/operationFingerprint.js";
-import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import { isPlainObject, requireTrimmedString } from "../../../../shared-ts/src/utils/validation.js";
 import { buildPasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseSessionOrigin, parseVerifiedOwnerProofId } from "../../../../authorization/domain.js";
 import { buildVerifiedWalletOperationEmailOtpFactorResult, buildVerifiedWalletOperationPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
 import { findRouteDefinitionById, matchesRouteDefinitionRequest } from "../../../framework/routeDefinitions.js";
-import { readJson } from "../../../framework/http.js";
 import { extractBearerCredential, resolveSourceIpFromFetchHeaders } from "../../../auth/routerApiKeyAuth.js";
 import { toFetchRouteResponse } from "../../../framework/routeResponses.js";
 import { parsePasskeyCustodyEnvelopeRecord } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
+import { readJson } from "../../../framework/http.js";
 import { isHostWithinRpId, originHostnameOrEmpty } from "../../../../core/authService/webauthnOidcHelpers.js";
 import { parseRecoveryCodeReservationId } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
 import { computeWalletCustodyAdminChallengeDigest } from "../../../../shared-ts/src/authorization/walletCustodyOperation.js";
@@ -652,6 +652,7 @@ async function handleWalletRecoveryPrepare(ctx) {
 			case "refused": return toFetchRouteResponse(refusedSpend());
 			case "reserved":
 			case "consumed": return routeErrorResponse(401, "recovery_code_used", "that recovery code has already been used");
+			case "routing_unavailable": return routeErrorResponse(503, "wallet_home_unavailable", "Wallet recovery routing is temporarily unavailable");
 			case "manifest_unavailable":
 			case "registration_unavailable": return routeErrorResponse(409, "recovery_preparation_conflict", "wallet recovery could not be prepared");
 		}

package/dist/esm/router/transport/fetch/routes/sessions.js

@@ -1,17 +1,17 @@
 import { parseOrgId, parseProviderSubject, parseWalletAuthMethodId, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseMpcWalletSigningQuotaId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
 import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { base58Encode } from "../../../../shared-ts/src/utils/base58.js";
-import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
 import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1, parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1, parseRouterAbEcdsaPostRegistrationSessionActivationResponseV1, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { parseHostedWalletSeamsSessionExchangeCode, parseHostedWalletSeamsSessionExchangeNonce, parsePrimaryWalletSessionOperationCredentialToken, parseSessionOrigin, projectExactWalletSessionAuthorizationV1 } from "../../../../authorization/domain.js";
 import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
-import { json, readJson } from "../../../framework/http.js";
 import { extractBearerCredential, resolveSourceIpFromFetchHeaders } from "../../../auth/routerApiKeyAuth.js";
+import { json, readJson } from "../../../framework/http.js";
 import { routerApiEmailOtpRouteService } from "../../../framework/authServicePort.js";
 import { emailOtpStatusCode, hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_EXPORT_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
@@ -266,6 +266,7 @@ async function handleHostedWalletSessionExchangeIssue(ctx) {
 		ok: true,
 		delivery: {
 			exchangeCode: delivery.exchangeCode,
+			home: delivery.home,
 			nonce: delivery.nonce,
 			appOrigin: delivery.appOrigin,
 			walletOrigin: delivery.walletOrigin,

package/dist/esm/router/transport/fetch/routes/syncAccount.js

@@ -13,7 +13,12 @@ import { issueSyncAccountBootstrapV1 } from "./syncAccountBootstrap.js";
 //#region src/router/transport/fetch/routes/syncAccount.ts
 function syncAccountResponseStatus(result) {
 	if (result.ok && result.verified) return 200;
-	switch (result.code) {
+	return syncAccountFailureStatus(result.code);
+}
+function syncAccountFailureStatus(code) {
+	switch (code) {
+		case "wallet_home_unavailable": return 503;
+		case "wallet_home_conflict": return 409;
 		case "internal": return 500;
 		case "ed25519_not_provisioned": return 409;
 		default: return 400;
@@ -43,7 +48,7 @@ async function handleSyncAccount(ctx) {
 		const parsed = parseSyncAccountOptionsRequest(await readJson(ctx.request));
 		if (!parsed.ok) return json(parsed.body, { status: parsed.status });
 		const result = await ctx.service.webAuthn.createWebAuthnSyncAccountOptions(parsed.request);
-		return json(result, { status: result.ok ? 200 : result.code === "internal" ? 500 : 400 });
+		return json(result, { status: result.ok ? 200 : syncAccountFailureStatus(result.code) });
 	}
 	if (ctx.pathname === "/sync-account/verify") {
 		const parsed = parseSyncAccountVerifyRequest({