@seams/wallet-server 0.8.0 → 0.9.0

package/dist/esm/core/d1WalletStore.js

@@ -219,6 +219,16 @@ function parseWalletEd25519YaoActiveCapabilityRecord(raw) {
 		default: return null;
 	}
 }
+/** Where an Ed25519 signer row names the material activation it serves. */
+const ED25519_SIGNER_ACTIVATION_ID_PATH = "$.activeYaoCapability.admissionRequest.scope.material_activation.activation_id";
+/** The wallet's signer for one material activation, among the rows that name its id. */
+function selectWalletEd25519Signer(rows, walletId, materialActivation) {
+	const matches = rows.map((row) => parseWalletEd25519SignerRecord(parseD1JsonColumn(row.record_json))).filter((record) => record !== null && record.walletId === walletId && sameRouterAbMpcMaterialActivationRef(record.activeYaoCapability.admissionRequest.scope.material_activation, materialActivation));
+	if (matches.length === 0) return null;
+	const signerId = matches[0]?.signerId;
+	if (!signerId || matches.some((record) => record.signerId !== signerId)) throw new Error("Wallet has conflicting Ed25519 material activations");
+	return matches[0] ?? null;
+}
 function parseWalletEd25519SignerRecord(raw) {
 	if (!isPlainObject(raw) || raw.version !== "wallet_signer_ed25519_v1") return null;
 	const walletId = parseWalletId(raw.walletId);
@@ -579,7 +589,7 @@ var D1WalletStore = class {
 		await this.ensureSchema();
 		const walletId = normalizeOptionalTrimmedString(input.walletId);
 		if (!walletId) return null;
-		const matches = ((await this.database.prepare(`SELECT record_json
+		return selectWalletEd25519Signer((await this.database.prepare(`SELECT record_json
            FROM wallet_signers
           WHERE namespace = ?
             AND org_id = ?
@@ -587,15 +597,8 @@ var D1WalletStore = class {
             AND env_id = ?
             AND wallet_id = ?
             AND signer_family = 'ed25519'
-            AND json_extract(
-              record_json,
-              '$.activeYaoCapability.admissionRequest.scope.material_activation.activation_id'
-            ) = ?
-          LIMIT 4`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, walletId, input.materialActivation.activation_id).all()).results || []).map((row) => parseWalletEd25519SignerRecord(parseD1JsonColumn(row.record_json))).filter((record) => record !== null && record.walletId === walletId && sameRouterAbMpcMaterialActivationRef(record.activeYaoCapability.admissionRequest.scope.material_activation, input.materialActivation));
-		if (matches.length === 0) return null;
-		const signerId = matches[0]?.signerId;
-		if (!signerId || matches.some((record) => record.signerId !== signerId)) throw new Error("Wallet has conflicting Ed25519 material activations");
-		return matches[0] ?? null;
+            AND json_extract(record_json, '\$.activeYaoCapability.admissionRequest.scope.material_activation.activation_id') = ?
+          LIMIT 4`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, walletId, input.materialActivation.activation_id).all()).results || [], walletId, input.materialActivation);
 	}
 	async getEd25519SignerBySlot(input) {
 		await this.ensureSchema();
@@ -711,6 +714,6 @@ var D1WalletStore = class {
 	}
 };
 //#endregion
-export { D1WalletStore, WALLET_STORE_D1_SCHEMA_SQL, buildWalletEcdsaSignerRecord, ensureWalletStoreD1Schema, parseWalletEd25519SignerRecord, prepareD1WalletPutSignerStatement, prepareD1WalletPutSubjectStatement };
+export { D1WalletStore, ED25519_SIGNER_ACTIVATION_ID_PATH, WALLET_STORE_D1_SCHEMA_SQL, buildWalletEcdsaSignerRecord, ensureWalletStoreD1Schema, parseWalletEd25519SignerRecord, prepareD1WalletPutSignerStatement, prepareD1WalletPutSubjectStatement, selectWalletEd25519Signer };
 
 //# sourceMappingURL=d1WalletStore.js.map

package/dist/esm/core/deviceLinking/linkedDeviceEmailOtpGrant.js

@@ -1,9 +1,9 @@
 import { parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseVerifiedEmailAddress, parseWalletAuthMethodId, parseWalletId, parseWebAuthnCredentialIdB64u } from "../../shared-ts/src/utils/domainIds.js";
+import { requireRecord } from "../../shared-ts/src/utils/validation.js";
+import { rejectUnknownFields } from "../../shared-ts/src/utils/exactRecord.js";
 import { base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
 import { sha256BytesUtf8 } from "../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u, sha256Utf8DigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
-import { requireRecord } from "../../shared-ts/src/utils/validation.js";
-import { rejectUnknownFields } from "../../shared-ts/src/utils/exactRecord.js";
 import { parseUnixMs, requireParsed } from "../../shared-ts/src/passkey-custody/primitives.js";
 //#region src/core/deviceLinking/linkedDeviceEmailOtpGrant.ts
 /**

package/dist/esm/core/deviceLinking/linkedDeviceManagement.js

@@ -1,6 +1,6 @@
 import { parseLinkedDeviceId, parseVerifiedEmailAddress, parseWalletAuthorityId } from "../../shared-ts/src/utils/domainIds.js";
-import { base64UrlDecode, base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
 import { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, hasDelegatedWalletPermissionV1, sameDelegatedWalletAuthorityV1 } from "../../shared-ts/src/authorization/delegatedAuthority.js";
+import { base64UrlDecode, base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
 //#region src/core/deviceLinking/linkedDeviceManagement.ts
 const MAX_LINKED_DEVICE_LIST_LIMIT_V1 = 50;
 var LinkedDeviceListCursorError = class extends Error {

package/dist/esm/core/deviceLinking/linkedDeviceSessionRecord.js

@@ -1,9 +1,9 @@
 import { hasWhitespaceOrControlCharacters, parseLinkDeviceSessionId, parseVerifiedEmailAddress, parseWalletAuthMethodId, parseWalletAuthorityId } from "../../shared-ts/src/utils/domainIds.js";
 import { parseDeviceId } from "../../shared-ts/src/authorization/capabilityKinds.js";
-import { parseDigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
-import { assertNeverLinkSessionStateV1 } from "../../shared-ts/src/device-linking/contracts.js";
 import { requireRecordCopy } from "../../shared-ts/src/utils/validation.js";
 import { sameDelegatedWalletAuthorityV1 } from "../../shared-ts/src/authorization/delegatedAuthority.js";
+import { parseDigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
+import { assertNeverLinkSessionStateV1 } from "../../shared-ts/src/device-linking/contracts.js";
 import { parseExactAdministeredSignerManifestV1 } from "../../shared-ts/src/device-linking/delegatedActivationPlan.js";
 import { parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1 } from "../../shared-ts/src/device-linking/sourceContribution.js";
 import { parseLinkSessionStateV1, parseLinkedDeviceApprovalV1, parseLinkedDeviceSessionClaimV1, parseQrLinkedDeviceSessionPayloadV5 } from "../../shared-ts/src/device-linking/parsers.js";

package/dist/esm/core/emailOtpD1Statements.js

@@ -39,6 +39,7 @@ function challengeValues(record) {
 /** Statements on `email_otp_challenges`. */
 const emailOtpChallengeRows = {
 	insert: (prepare, record) => prepare(INSERT_CHALLENGE_SQL, challengeValues(record)),
+	insertIfAbsent: (prepare, record) => prepare(`${INSERT_CHALLENGE_SQL} ON CONFLICT(namespace, org_id, project_id, env_id, challenge_id) DO NOTHING`, challengeValues(record)),
 	delete: (prepare, challengeId) => prepare(`DELETE FROM email_otp_challenges
         WHERE namespace = ?
           AND org_id = ?

package/dist/esm/core/nearRelayerAccountProvisioning.js

@@ -1,8 +1,8 @@
+import { coerceNonEmptyString, requireRecordOrArray } from "../shared-ts/src/utils/validation.js";
 import { base64UrlDecode, base64UrlEncode } from "../shared-ts/src/utils/base64.js";
 import { sha256Bytes } from "../shared-ts/src/utils/digests.js";
 import { base58Encode } from "../shared-ts/src/utils/base58.js";
 import "../shared-ts/src/utils/encoders.js";
-import { coerceNonEmptyString, requireRecordOrArray } from "../shared-ts/src/utils/validation.js";
 import { failure } from "../shared-ts/src/utils/failure.js";
 import { ActionType, validateActionArgsWasm } from "../shared-ts/src/near/actions.js";
 import { deriveImplicitNearAccountIdFromEd25519PublicKey, parseImplicitNearAccountId, parseNamedNearAccountId } from "../shared-ts/src/utils/near.js";

package/dist/esm/core/routerAbSigning/RouterAbEcdsaPresignRuntime.js

@@ -40,6 +40,8 @@ var RouterAbEcdsaPresignRuntime = class {
 		return await startRouterAbLinkedDeviceEcdsaPresignSession({
 			signingWorkerBaseUrl: transport.signingWorkerBaseUrl,
 			request: input.request,
+			walletScope: input.walletScope,
+			ownershipGeneration: input.ownershipGeneration,
 			materialSource: input.materialSource,
 			presignSessionId: input.presignSessionId,
 			expiresAtMs: input.expiresAtMs,
@@ -52,6 +54,8 @@ var RouterAbEcdsaPresignRuntime = class {
 		return await stepRouterAbLinkedDeviceEcdsaPresignSession({
 			signingWorkerBaseUrl: transport.signingWorkerBaseUrl,
 			request: input.request,
+			walletScope: input.walletScope,
+			ownershipGeneration: input.ownershipGeneration,
 			materialSource: input.materialSource,
 			presignSessionId: input.presignSessionId,
 			requestedStage: input.requestedStage,

package/dist/esm/core/signingLanes/WalletExecutionLaneProjection.js

@@ -2,8 +2,8 @@ import { mpcMaterialActivationRefsEqual, parseEmailOtpProviderUserId, parseLaneS
 import { base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify } from "../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u, sha256Utf8DigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
-import { base58Encode } from "../../shared-ts/src/utils/base58.js";
 import { parseEd25519PublicKeyB64u, parseKeyCreationSignerSlot, parseSecp256k1CompressedPublicKeyB64u } from "../../shared-ts/src/passkey-custody/primitives.js";
+import { base58Encode } from "../../shared-ts/src/utils/base58.js";
 import { routerAbMpcMaterialActivationRefFromWire, sameRouterAbMpcMaterialActivationRef } from "../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { deriveEvmFamilySigningKeySlotId } from "../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
 import { walletAuthAuthorityRef } from "../../shared-ts/src/utils/walletAuthAuthority.js";

package/dist/esm/core/signingMaterial/ordinaryInactiveSignerMaterialReservation.js

@@ -85,6 +85,7 @@ var OrdinaryInactiveSignerMaterialReservationServiceV1 = class {
 	}
 };
 function validateOrdinaryInactiveSignerMaterialReservationRequestV1(request) {
+	if (!Number.isSafeInteger(request.ownershipGeneration) || request.ownershipGeneration < 1) throw new Error("ordinary signer material ownership generation is invalid");
 	switch (request.kind) {
 		case "ordinary_ed25519_signer_material_reservation_request_v1": {
 			if (request.preparation.kind !== "ordinary_ed25519_signer_material_reservation_preparation_v1") throw new Error("ordinary Ed25519 reservation preparation kind is invalid");

package/dist/esm/hosted-wallet-gateway.js

@@ -1,10 +1,13 @@
 import { parseWalletId } from "./shared-ts/src/utils/domainIds.js";
+import { parseTenantId } from "./shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "./shared-ts/src/utils/base64.js";
 import { parseRouterAbPublicKeysetV2 } from "./shared-ts/src/utils/routerAbPublicKeyset.js";
 import { ROUTER_AB_ED25519_YAO_EXPORT_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_EXPORT_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_STATUS_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1 } from "./shared-ts/src/utils/routerAbEd25519Yao.js";
+import { parseSessionOrigin } from "./authorization/domain.js";
 import { parseD1JsonColumn } from "./storage/d1Sql.js";
 import { D1WalletStore } from "./core/d1WalletStore.js";
 import { D1WalletAuthMethodStore } from "./core/d1WalletAuthMethodStore.js";
+import { WALLET_OBJECT_ADDRESSES_HEADER, WALLET_OBJECT_IDENTITY_HEADER, walletObjectIdentity, walletObjectIdentityHeaders } from "./router/cloudflare/runtime/walletObjectAddresses.js";
 import { RouterAbEcdsaPresignRuntime } from "./core/routerAbSigning/RouterAbEcdsaPresignRuntime.js";
 import { buildTenantRootIdentityFromAuthenticatedDeploymentV1, decodeTenantRootIdentityWireV1 } from "./shared-ts/src/tenant-root/tenantRootIdentity.js";
 import "./shared-ts/src/tenant-root/index.js";
@@ -14,8 +17,10 @@ import { createCloudflareWalletGatewayRouterV1 } from "./router/cloudflare/runti
 import { createWalletRuntimeOpsHandler } from "./router/cloudflare/runtime/walletRuntimeOpsHandler.js";
 import { handleWalletControlRequest } from "./router/cloudflare/runtime/walletControlOps.js";
 import { resolveRuntimeTenantRootLineage } from "./router/cloudflare/runtime/walletConsoleTenantRootLineage.js";
+import { D1WalletObjectAddresses } from "./router/cloudflare/d1/walletObjectAddresses.js";
 import { ROUTER_AB_MPC_ROUTER_ORIGIN, ROUTER_AB_SIGNING_WORKER_ORIGIN, createRouterAbServiceBindingFetch } from "./router/cloudflare/runtime/routerAbServiceBindings.js";
 import { readEnvironmentCsv, readEnvironmentString, requireEnvironmentString } from "./router/cloudflare/runtime/environment.js";
+import { admitD1EstablishedWalletHome } from "./router/cloudflare/d1/registration/d1WalletExecutionAuthority.js";
 import { createD1LinkedDeviceSourceContributionPreparationPlannerV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceSourceContributionPreparationPlanner.js";
 import { readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1 } from "./router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.js";
 import { RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter } from "./router/domains/ed25519Yao/export/routerAbEd25519YaoExport.js";
@@ -32,10 +37,12 @@ import { createD1LinkedDeviceOwnerSourceChildReaderV1 } from "./router/cloudflar
 import { createCloudflareD1RouterApiAuthService } from "./router/cloudflare/d1/auth/d1RouterApiAuthService.js";
 import { loadCloudflareSignerWasmModule } from "./router/cloudflare/runtime/cloudflareSignerWasm.js";
 import { createEd25519SessionAdapter } from "./router/cloudflare/runtime/ed25519SessionAdapter.js";
+import { WalletPlacementRoutes } from "./router/cloudflare/runtime/walletPlacementRoutes.js";
 import { handleRouterAbEd25519YaoExportRequestScopedCloudflareV1 } from "./router/domains/ed25519Yao/export/routerAbEd25519YaoExportRequestScopedCloudflare.js";
 import { handleRouterAbEd25519YaoRecoveryRequestScopedCloudflareV1 } from "./router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryRequestScopedCloudflare.js";
 import { RouterAbEd25519YaoRecoveryWalletSessionAuthorizationAdapter } from "./router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryWalletSessionAuthorization.js";
 import "./cloud-host.js";
+import { WalletAuthorizationRelocationRoutes } from "./router/cloudflare/runtime/walletAuthorizationRelocationRoutes.js";
 //#region src/hosted-wallet-gateway.ts
 function readStagingHostedWalletOrigins(env) {
 	return readEnvironmentCsv(requireEnvironmentString(env, "HOSTED_WALLET_ORIGINS"));
@@ -43,6 +50,17 @@ function readStagingHostedWalletOrigins(env) {
 const RELAY_SIGNER_READY_TABLES = Object.freeze([
 	"wallets",
 	"wallet_auth_methods",
+	"wallet_relocation_challenges",
+	"wallet_relocation_approvals",
+	"wallet_relocation_session_fences",
+	"wallet_relocation_authorization_fences",
+	"wallet_relocation_authorization_snapshots",
+	"wallet_relocation_authorization_chunks",
+	"wallet_relocation_authorization_intakes",
+	"wallet_relocation_authorization_intake_chunks",
+	"wallet_relocation_authorization_imports",
+	"wallet_relocation_authorization_import_context",
+	"wallet_relocation_authorization_import_receipts",
 	"authorization_wallet_session_quotas",
 	"wallet_session_authorizations_v2",
 	"wallet_session_hosted_credentials_v2",
@@ -134,14 +152,14 @@ async function resolveStagingDeploymentTenantRoot(scope, tenantRootCustodyLineag
 }
 async function resolveStagingRegistrationTenantRoot(context, input) {
 	switch (input.operation) {
-		case "registration": return await resolveStagingDeploymentTenantRoot(context.scope, context.tenantRootCustodyLineage, input.admissionRequest.application_binding, input.admissionRequest.scope.root_share_epoch);
+		case "registration": return await resolveStagingDeploymentTenantRoot(context.scope, context.tenantRootCustodyLineage, input, input.root_share_epoch);
 		case "recovery":
 		case "export": throw new Error("Ed25519 active-material tenant-root resolver is unavailable");
 	}
 }
 async function resolveStagingTenantRoot(context, input) {
 	switch (input.operation) {
-		case "registration": return await resolveStagingDeploymentTenantRoot(context.scope, context.tenantRootCustodyLineage, input.admissionRequest.application_binding, input.admissionRequest.scope.root_share_epoch);
+		case "registration": return await resolveStagingDeploymentTenantRoot(context.scope, context.tenantRootCustodyLineage, input, input.root_share_epoch);
 		case "recovery": return await context.resolveActiveTenantRoot({
 			walletId: input.admissionRequest.application_binding.wallet_id,
 			materialActivation: input.admissionRequest.active_material_activation
@@ -174,7 +192,7 @@ function createStagingLinkedDeviceTenantRootResolver(scope, tenantRootCustodyLin
 		tenantRootCustodyLineage
 	});
 }
-async function createStagingRouterApiAuthComposition(env, scope, yaoRuntime, tenantRootCustodyLineage, dependencies) {
+async function createStagingRouterApiAuthComposition(env, scope, yaoRuntime, tenantRootCustodyLineage, dependencies, startRegistrationWallets) {
 	const ecdsaCeremonyTokenIssuer = createStagingEcdsaCeremonyTokenIssuer(env);
 	const topology = requireStagingEcdsaRegistrationTopology(env);
 	const tokenScope = {
@@ -183,12 +201,14 @@ async function createStagingRouterApiAuthComposition(env, scope, yaoRuntime, ten
 		environment: scope.envId
 	};
 	const ecdsaStrictRegistration = createRouterAbEcdsaStrictRegistrationPort({
+		internalServiceAuthSecret: requireEnvironmentString(env, "ROUTER_AB_GATEWAY_TO_ROUTER_AUTH_SECRET"),
 		router: env.MPC_ROUTER,
 		tokenIssuer: ecdsaCeremonyTokenIssuer,
 		tokenScope,
 		topology
 	});
 	const ecdsaStrictPostRegistration = createRouterAbEcdsaStrictPostRegistrationPort({
+		internalServiceAuthSecret: requireEnvironmentString(env, "ROUTER_AB_GATEWAY_TO_ROUTER_AUTH_SECRET"),
 		router: env.MPC_ROUTER,
 		tokenIssuer: ecdsaCeremonyTokenIssuer,
 		tokenScope,
@@ -198,12 +218,12 @@ async function createStagingRouterApiAuthComposition(env, scope, yaoRuntime, ten
 		service: createCloudflareD1RouterApiAuthService({
 			database: env.SIGNER_DB,
 			identityStore: dependencies.identityStore,
-			emailOtpRateLimitCounter: dependencies.emailOtpRateLimitCounter,
 			googleRegistrationAttempts: dependencies.googleRegistrationAttempts,
 			sessionRouting: dependencies.sessionRouting,
 			recoveryRouting: dependencies.recoveryRouting,
 			lifecycleRouting: dependencies.lifecycleRouting,
 			registrationAuthority: dependencies.registrationAuthority,
+			startRegistrationWallets,
 			credentialClaims: dependencies.credentialClaims,
 			syncChallenges: dependencies.syncChallenges,
 			linkedDeviceProofNonces: dependencies.linkedDeviceProofNonces,
@@ -263,7 +283,9 @@ async function resolveStagingActiveTenantRootFromLoader(context, input) {
 }
 async function resolveStagingRecoveryAuthorizationServices(context) {
 	const { service } = await loadStagingRouterApiAuthComposition(context);
+	const authority = service.walletExecution;
 	return {
+		admitEstablishedHome: authority.admitEstablishedHome.bind(authority),
 		authorizationSessions: service.authorizationSessions,
 		preparedRecoveryAdmission: service.passkeyCustody,
 		resolveEd25519MaterialActivation: service.walletRegistration.resolveEd25519MaterialActivation.bind(service.walletRegistration)
@@ -331,12 +353,14 @@ function stagingLinkedDeviceSessionComposition(env, scope, tenantRootCustodyLine
 				tenant: scope
 			}),
 			deactivationEndpoint: createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1({
+				admitEstablishedHome: admitD1EstablishedWalletHome.bind(void 0, env.SIGNER_DB, scope),
 				fetch: serviceFetch,
 				internalServiceAuthSecret,
 				tenant: scope
 			})
 		},
 		sourceContributionRouter: createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1({
+			admitEstablishedHome: admitD1EstablishedWalletHome.bind(void 0, env.SIGNER_DB, scope),
 			fetch: serviceFetch,
 			internalServiceAuthSecret: requireEnvironmentString(env, "ROUTER_AB_GATEWAY_TO_ROUTER_AUTH_SECRET"),
 			resolveTenantRoot: createStagingLinkedDeviceTenantRootResolver(scope, tenantRootCustodyLineage)
@@ -350,18 +374,34 @@ function stagingLinkedDeviceSessionComposition(env, scope, tenantRootCustodyLine
 * stay on the Wallet Console deployment until policy/sponsorship resolution
 * operations join the binding.
 */
-async function createHostedWalletGatewayCompositionV1(env, dependencies = {}) {
+async function createHostedWalletGatewayCompositionV1(env, dependencies = {}, background = null) {
 	const scope = stagingTenantScope(env);
 	const session = stagingSessionAdapter(env);
 	const tenantRootCustodyLineage = createStagingTenantRootCustodyLineage(createWalletConsoleOpsClient(env.WALLET_CONSOLE));
 	const yaoRuntime = createStagingYaoRequestScopedRuntime(env, createStagingRegistrationTenantRootResolver(scope, tenantRootCustodyLineage));
-	const { service, ecdsaStrictPostRegistration } = await createStagingRouterApiAuthComposition(env, scope, yaoRuntime, tenantRootCustodyLineage, dependencies);
+	const { service, ecdsaStrictPostRegistration } = await createStagingRouterApiAuthComposition(env, scope, yaoRuntime, tenantRootCustodyLineage, dependencies, background ? scheduleRegistrationRouterStartup.bind(void 0, env, background) : void 0);
+	const tenantId = parseTenantId(scope.orgId);
+	if (!tenantId.ok) throw new Error("Wallet placement authorization tenant is invalid");
 	return {
 		handler: createCloudflareWalletGatewayRouterV1({
 			service,
 			walletConsole: env.WALLET_CONSOLE,
+			registrationContext: dependencies.registrationContext,
 			signerDatabase: env.SIGNER_DB,
 			signerStorageNamespace: scope.namespace,
+			routeExtensions: [new WalletAuthorizationRelocationRoutes({
+				database: env.SIGNER_DB,
+				scope,
+				directory: env.WALLET_CONSOLE
+			}), new WalletPlacementRoutes({
+				emailOtp: service.relocationEmailOtp,
+				database: env.SIGNER_DB,
+				scope,
+				tenantId: tenantId.value,
+				allowedOrigins: readStagingHostedWalletOrigins(env).map(parseSessionOrigin),
+				authorizationSessions: service.authorizationSessions,
+				directory: env.WALLET_CONSOLE
+			})],
 			router: {
 				healthz: true,
 				readyz: true,
@@ -390,8 +430,8 @@ async function createHostedWalletGatewayCompositionV1(env, dependencies = {}) {
 		session
 	};
 }
-async function createSplitGatewayRouterHandler(env, dependencies = {}) {
-	return (await createHostedWalletGatewayCompositionV1(env, dependencies)).handler;
+async function createSplitGatewayRouterHandler(env, dependencies = {}, background = null) {
+	return (await createHostedWalletGatewayCompositionV1(env, dependencies, background)).handler;
 }
 async function handleSplitGatewayWalletRuntimeRequest(request, env, dependencies = {}) {
 	const controlResponse = await handleWalletControlRequest(request, env);
@@ -463,6 +503,10 @@ async function readWalletRuntimeIdentities(env, input) {
 	return { identities: result };
 }
 async function handleSplitGatewayRequest(request, env, ctx, dependencies = {}) {
+	const headers = new Headers(request.headers);
+	headers.delete(WALLET_OBJECT_IDENTITY_HEADER);
+	headers.delete(WALLET_OBJECT_ADDRESSES_HEADER);
+	request = new Request(request, { headers });
 	if (request.method === "GET" && new URL(request.url).pathname === ROUTER_AB_CEREMONY_JWKS_PATH) return routerAbCeremonyJwksResponse(env);
 	const operation = yaoDirectOperationForRequest(request);
 	if (operation !== null) {
@@ -470,7 +514,7 @@ async function handleSplitGatewayRequest(request, env, ctx, dependencies = {}) {
 		withCors(response.headers, { corsOrigins: readEnvironmentCsv(env.RELAY_CORS_ORIGINS) }, request);
 		return response;
 	}
-	return await (await createSplitGatewayRouterHandler(env, dependencies))(request, env, ctx);
+	return await (await createSplitGatewayRouterHandler(env, dependencies, ctx))(request, env, ctx);
 }
 function requireStagingRouterAbPublicKeyset(env) {
 	const parsed = parseJsonValue(requireEnvironmentString(env, "ROUTER_AB_PUBLIC_KEYSET_JSON"));
@@ -673,6 +717,44 @@ function createStagingYaoRequestScopedRuntime(env, resolveTenantRoot) {
 		loadPersistedActiveCapability: loadStagingPersistedActiveCapability.bind(void 0, env)
 	});
 }
+async function scheduleRegistrationRouterStartup(env, background, registration) {
+	const tenant = stagingTenantScope(env);
+	const identity = walletObjectIdentity(registration.walletId, registration.ownershipGeneration, tenant);
+	await new D1WalletObjectAddresses(env.SIGNER_DB, tenant).initialize(identity, env.MPC_ROUTER, requireEnvironmentString(env, "ROUTER_AB_GATEWAY_TO_ROUTER_AUTH_SECRET"));
+	background.waitUntil(startRegistrationRouter(env, identity));
+}
+async function startRegistrationRouter(env, registration) {
+	const started = Date.now();
+	let outcome = "failure";
+	try {
+		const scope = stagingTenantScope(env);
+		const response = await env.MPC_ROUTER.fetch(`${ROUTER_AB_MPC_ROUTER_ORIGIN}/router-ab/router/wallet/start`, {
+			method: "POST",
+			headers: {
+				"content-type": "application/json",
+				...walletObjectIdentityHeaders(registration),
+				"x-router-ab-internal-service-auth": requireEnvironmentString(env, "ROUTER_AB_GATEWAY_TO_ROUTER_AUTH_SECRET")
+			},
+			body: JSON.stringify({
+				owner: {
+					org_id: scope.orgId,
+					project_id: scope.projectId,
+					env_id: scope.envId,
+					wallet_id: registration.walletId
+				},
+				ownership_generation: registration.ownershipGeneration
+			}),
+			signal: AbortSignal.timeout(3e3)
+		});
+		await response.arrayBuffer();
+		if (response.ok) outcome = "success";
+	} catch {}
+	console.log(JSON.stringify({
+		event: "registration_router_startup",
+		outcome,
+		duration_ms: Date.now() - started
+	}));
+}
 /**
 * Builds the recovery request-scoped dependencies from the environment alone.
 * This is new composition wiring over the existing authorization classes, not a
@@ -711,13 +793,14 @@ function createStagingRecoveryRequestScopedDependencies(env, tenantRootCustodyLi
 * Router API factor and owner-proof services.
 */
 function createStagingExportRequestScopedDependencies(env, service, tenantRootCustodyLineage) {
+	const authority = service.walletExecution;
 	const scope = stagingTenantScope(env);
 	const registrationTenantRootResolver = createStagingRegistrationTenantRootResolver(scope, tenantRootCustodyLineage);
 	const resolveActiveTenantRoot = resolveStagingActiveTenantRootFromService.bind(void 0, service);
 	return {
 		store: createStagingYaoPartitionedStateStore(env),
 		backend: createStagingEd25519YaoBackend(env, createStagingTenantRootResolver(scope, tenantRootCustodyLineage, resolveActiveTenantRoot)),
-		authorization: new RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter(service.webAuthn, service.emailOtp, service.walletAuthMethods, service.authorizedOperations, service.walletRegistration.resolveEd25519MaterialActivation.bind(service.walletRegistration)),
+		authorization: new RouterAbEd25519YaoExportOwnerProofAuthorizationAdapter(service.webAuthn, service.emailOtp, service.walletAuthMethods, service.authorizedOperations, service.walletRegistration.resolveEd25519MaterialActivation.bind(service.walletRegistration), authority.admitEstablishedHome.bind(authority)),
 		capabilities: createStagingYaoRequestScopedRuntime(env, registrationTenantRootResolver)
 	};
 }

package/dist/esm/localHostedWalletGatewayHandler.js

@@ -1,6 +1,7 @@
 import { requireCanonicalString } from "./shared-ts/src/utils/validation.js";
 import "./shared-ts/src/utils/routerAbEd25519Yao.js";
 import { WALLET_CONSOLE_OP_PATHS_V1 } from "./router/cloudflare/runtime/walletConsoleOps.js";
+import { WalletHomeCustodyBinding } from "./router/cloudflare/runtime/routerAbServiceBindings.js";
 import { createStaticWalletConsoleBindingV1, parseStaticWalletConsoleBindingConfigV1 } from "./router/cloudflare/runtime/staticWalletConsoleBinding.js";
 import { handleSplitGatewayRequest } from "./hosted-wallet-gateway.js";
 import { LocalRegistrationSetupAuthority } from "./localRegistrationSetupAuthority.js";
@@ -11,7 +12,7 @@ import { LOCAL_INTENDED_ECDSA_FINALIZE_FAULT_HEADER_V1, LOCAL_INTENDED_ECDSA_FIN
 import { LOCAL_INTENDED_YAO_FINALIZE_FAULT_HEADER_V1, LOCAL_INTENDED_YAO_FINALIZE_FAULT_TOKEN_HEADER_V1, LocalIntendedYaoFinalizeFaultDatabaseV1, parseLocalIntendedYaoFinalizeFaultModeV1, parseLocalIntendedYaoFinalizeFaultTokenV1, requestWithoutLocalIntendedYaoFinalizeFaultHeadersV1, responseWithLocalIntendedYaoFinalizeFaultOutcomeV1 } from "./localIntendedYaoFinalizeFault.js";
 import { LOCAL_INTENDED_YAO_RECOVERY_FAULT_HEADER_V1, LOCAL_INTENDED_YAO_RECOVERY_FAULT_TOKEN_HEADER_V1, LocalIntendedYaoRecoveryFaultControllerV1, parseLocalIntendedYaoRecoveryFaultModeV1, parseLocalIntendedYaoRecoveryFaultTokenV1, releaseLocalIntendedYaoRecoveryExecuteV1, requestWithoutLocalIntendedYaoRecoveryFaultHeadersV1, responseWithLocalIntendedYaoRecoveryFaultOutcomeV1 } from "./localIntendedYaoRecoveryFault.js";
 import { LOCAL_INTENDED_YAO_EXPORT_FAULT_HEADER_V1, LOCAL_INTENDED_YAO_EXPORT_FAULT_TOKEN_HEADER_V1, LocalIntendedYaoExportFaultDatabaseV1, parseLocalIntendedYaoExportFaultModeV1, parseLocalIntendedYaoExportFaultTokenV1, requestWithoutLocalIntendedYaoExportFaultHeadersV1, responseWithLocalIntendedYaoExportFaultOutcomeV1 } from "./localIntendedYaoExportFault.js";
-import { LOCAL_INTENDED_YAO_SIGNING_FAULT_HEADER_V1, LOCAL_INTENDED_YAO_SIGNING_FAULT_TOKEN_HEADER_V1, LocalIntendedYaoSigningFaultControllerV1, commandLocalIntendedSigningWorkerHoldV1, parseLocalIntendedYaoSigningFaultModeV1, parseLocalIntendedYaoSigningFaultTokenV1, releaseLocalIntendedYaoSigningFinalizeV1, requestWithoutLocalIntendedYaoSigningFaultHeadersV1, responseWithLocalIntendedYaoSigningFaultOutcomeV1 } from "./localIntendedYaoSigningFault.js";
+import { LOCAL_INTENDED_YAO_SIGNING_FAULT_HEADER_V1, LOCAL_INTENDED_YAO_SIGNING_FAULT_TOKEN_HEADER_V1, LocalIntendedYaoSigningFaultControllerV1, parseLocalIntendedYaoSigningFaultModeV1, parseLocalIntendedYaoSigningFaultTokenV1, releaseLocalIntendedYaoSigningFinalizeV1, requestWithoutLocalIntendedYaoSigningFaultHeadersV1, responseWithLocalIntendedYaoSigningFaultOutcomeV1 } from "./localIntendedYaoSigningFault.js";
 import { LOCAL_INTENDED_LINK_EXECUTE_FAULT_HEADER_V1, LOCAL_INTENDED_LINK_EXECUTE_FAULT_TOKEN_HEADER_V1, LocalIntendedLinkExecuteFaultControllerV1, parseLocalIntendedLinkExecuteFaultModeV1, parseLocalIntendedLinkExecuteFaultTokenV1, requestWithoutLocalIntendedLinkExecuteFaultHeadersV1, responseWithLocalIntendedLinkExecuteFaultOutcomeV1 } from "./localIntendedLinkExecuteFault.js";
 import { LINKED_DEVICE_REVOKE_PATH_PATTERN_V1, LOCAL_INTENDED_REVOKE_FAULT_HEADER_V1, LOCAL_INTENDED_REVOKE_FAULT_TOKEN_HEADER_V1, LocalIntendedRevokeFaultDatabaseV1, WALLET_REVOKE_AUTH_METHOD_PATH_PATTERN_V1, parseLocalIntendedRevokeFaultModeV1, parseLocalIntendedRevokeFaultTokenV1, requestWithoutLocalIntendedRevokeFaultHeadersV1, responseWithLocalIntendedRevokeFaultOutcomeV1 } from "./localIntendedRevokeFault.js";
 import { LOCAL_INTENDED_SESSION_ADMISSION_FAULT_HEADER_V1, LOCAL_INTENDED_SESSION_ADMISSION_FAULT_TOKEN_HEADER_V1, LocalIntendedSessionAdmissionFaultDatabaseV1, parseLocalIntendedSessionAdmissionFaultModeV1, parseLocalIntendedSessionAdmissionFaultTokenV1, requestWithoutLocalIntendedSessionAdmissionFaultHeadersV1, responseWithLocalIntendedSessionAdmissionFaultOutcomeV1 } from "./localIntendedSessionAdmissionFault.js";
@@ -104,18 +105,21 @@ async function handleEcdsaRespondFault(request, env, ctx, dependencies, fault, e
 */
 async function handleLocalHostedWalletGatewayRequestV1(request, env, ctx, dependencies) {
 	const config = parseStaticWalletConsoleBindingConfigV1(JSON.parse(env.WALLET_LOCAL_DEPLOYMENT_JSON));
+	const tenantScope = {
+		namespace: requireCanonicalString(env.SEAMS_TENANT_STORAGE_NAMESPACE, "Local namespace"),
+		orgId: config.deployment.orgId,
+		projectId: config.deployment.projectId,
+		envId: config.deployment.environmentKey
+	};
 	dependencies = {
 		emailOtpDeliveryProvider: dependencies?.emailOtpDeliveryProvider,
 		signerWasm: dependencies?.signerWasm,
-		registrationAuthority: new LocalRegistrationSetupAuthority(env.SIGNER_DB, {
-			namespace: requireCanonicalString(env.SEAMS_TENANT_STORAGE_NAMESPACE, "Local namespace"),
-			orgId: config.deployment.orgId,
-			projectId: config.deployment.projectId,
-			envId: config.deployment.environmentKey
-		})
+		registrationAuthority: new LocalRegistrationSetupAuthority(env.SIGNER_DB, tenantScope)
 	};
 	const gatewayEnv = {
 		...env,
+		MPC_ROUTER: new WalletHomeCustodyBinding(env.MPC_ROUTER, "US", env.SIGNER_DB, tenantScope.namespace, null),
+		SIGNING_WORKER: new WalletHomeCustodyBinding(env.SIGNING_WORKER, "US", env.SIGNER_DB, tenantScope.namespace, null),
 		WALLET_CONSOLE: createStaticWalletConsoleBindingV1(config)
 	};
 	const canceledPresign = await localPresignCancellationProbe(request, gatewayEnv, ctx, dependencies);
@@ -163,7 +167,7 @@ async function handleLocalHostedWalletGatewayRequestV1(request, env, ctx, depend
 	const token = parseLocalIntendedYaoFaultTokenV1(rawToken);
 	const url = new URL(request.url);
 	if (url.protocol !== "http:" || url.hostname !== "127.0.0.1" || url.pathname !== "/router-ab/ed25519/yao/registration/execute" || request.method !== "POST" || !mode || !token) return Response.json({ code: "invalid_intended_yao_fault" }, { status: 400 });
-	const controller = new LocalIntendedYaoFaultControllerV1(env.MPC_ROUTER.fetch.bind(env.MPC_ROUTER));
+	const controller = new LocalIntendedYaoFaultControllerV1(gatewayEnv.MPC_ROUTER.fetch.bind(gatewayEnv.MPC_ROUTER));
 	controller.arm(mode);
 	return responseWithLocalIntendedYaoFaultOutcomeV1(await handleSplitGatewayRequest(sanitizedRequest, {
 		...gatewayEnv,
@@ -262,7 +266,6 @@ async function handleYaoSigningFault(request, env, ctx, dependencies, rawMode, r
 	const url = new URL(request.url);
 	if (url.protocol !== "http:" || url.hostname !== "127.0.0.1" || url.pathname !== "/router-ab/ed25519/sign" || request.method !== "POST" || !mode || !token) return Response.json({ code: "invalid_intended_yao_signing_fault" }, { status: 400 });
 	if (mode === "release_signing_finalize") return await releaseLocalIntendedYaoSigningFinalizeV1(env.MPC_ROUTER, token);
-	if (mode === "arm_signing_worker_hold" || mode === "read_signing_worker_hold") return await commandLocalIntendedSigningWorkerHoldV1(env.SIGNING_WORKER, env.ROUTER_AB_GATEWAY_TO_SIGNING_WORKER_PRESIGN_AUTH_SECRET, mode, await request.json().catch(() => null));
 	const controller = new LocalIntendedYaoSigningFaultControllerV1(env.MPC_ROUTER.fetch.bind(env.MPC_ROUTER), mode, token);
 	return responseWithLocalIntendedYaoSigningFaultOutcomeV1(await handleSplitGatewayRequest(requestWithoutLocalIntendedYaoSigningFaultHeadersV1(request), {
 		...env,

package/dist/esm/localIntendedYaoSigningFault.js

@@ -4,16 +4,12 @@ const LOCAL_INTENDED_YAO_SIGNING_FAULT_HEADER_V1 = "x-seams-intended-yao-signing
 const LOCAL_INTENDED_YAO_SIGNING_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-yao-signing-fault-token-v1";
 const LOCAL_INTENDED_YAO_FAULT_PROOF_HEADER_V1 = "x-seams-intended-yao-fault-proof-v1";
 const ROUTER_AB_ED25519_SIGNING_FINALIZE_PATH_V1 = "/router-ab/ed25519/sign";
-const SIGNING_WORKER_LOCAL_INTENDED_HOLD_URL_V1 = "https://signing-worker.router-ab.internal/router-ab/signing-worker/local-intended/hold";
-const ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1 = "x-router-ab-internal-service-auth";
 const keptFinalizes = /* @__PURE__ */ new Map();
 function parseLocalIntendedYaoSigningFaultModeV1(value) {
 	switch (value) {
 		case "capture_signing_finalize":
 		case "withhold_signing_finalize":
-		case "release_signing_finalize":
-		case "arm_signing_worker_hold":
-		case "read_signing_worker_hold": return value;
+		case "release_signing_finalize": return value;
 		default: return null;
 	}
 }
@@ -82,30 +78,6 @@ async function releaseLocalIntendedYaoSigningFinalizeV1(router, token) {
 		original: kept.original
 	});
 }
-/**
-* Arms or reads the SigningWorker's hold on one wallet's next NEAR finalize,
-* with the Gateway's own SigningWorker credential, and answers with the
-* SigningWorker's reply.
-*/
-async function commandLocalIntendedSigningWorkerHoldV1(signingWorker, credential, mode, body) {
-	const walletId = body?.wallet_id;
-	if (!credential || typeof walletId !== "string" || walletId === "") return Response.json({ code: "invalid_intended_signing_worker_hold" }, { status: 400 });
-	const reply = await signingWorker.fetch(new Request(SIGNING_WORKER_LOCAL_INTENDED_HOLD_URL_V1, {
-		method: "POST",
-		headers: {
-			"content-type": "application/json",
-			[ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1]: credential
-		},
-		body: JSON.stringify({
-			command: mode === "arm_signing_worker_hold" ? "arm" : "read",
-			wallet_id: walletId
-		})
-	}));
-	return Response.json({
-		status: reply.status,
-		body: await reply.text()
-	});
-}
 function requestWithoutLocalIntendedYaoSigningFaultHeadersV1(request) {
 	const headers = new Headers(request.headers);
 	headers.delete(LOCAL_INTENDED_YAO_SIGNING_FAULT_HEADER_V1);
@@ -122,6 +94,6 @@ function responseWithLocalIntendedYaoSigningFaultOutcomeV1(response, outcome) {
 	});
 }
 //#endregion
-export { LOCAL_INTENDED_YAO_SIGNING_FAULT_HEADER_V1, LOCAL_INTENDED_YAO_SIGNING_FAULT_TOKEN_HEADER_V1, LocalIntendedYaoSigningFaultControllerV1, ROUTER_AB_ED25519_SIGNING_FINALIZE_PATH_V1, commandLocalIntendedSigningWorkerHoldV1, parseLocalIntendedYaoSigningFaultModeV1, parseLocalIntendedYaoSigningFaultTokenV1, releaseLocalIntendedYaoSigningFinalizeV1, requestWithoutLocalIntendedYaoSigningFaultHeadersV1, responseWithLocalIntendedYaoSigningFaultOutcomeV1 };
+export { LOCAL_INTENDED_YAO_SIGNING_FAULT_HEADER_V1, LOCAL_INTENDED_YAO_SIGNING_FAULT_TOKEN_HEADER_V1, LocalIntendedYaoSigningFaultControllerV1, ROUTER_AB_ED25519_SIGNING_FINALIZE_PATH_V1, parseLocalIntendedYaoSigningFaultModeV1, parseLocalIntendedYaoSigningFaultTokenV1, releaseLocalIntendedYaoSigningFinalizeV1, requestWithoutLocalIntendedYaoSigningFaultHeadersV1, responseWithLocalIntendedYaoSigningFaultOutcomeV1 };
 
 //# sourceMappingURL=localIntendedYaoSigningFault.js.map

package/dist/esm/localRegistrationSetupAuthority.js

@@ -1,6 +1,8 @@
 import { D1RegistrationCeremonyRecordStore } from "./router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.js";
 import { parseWalletRegistrationSetupReservation, proposeWalletRegistrationSetup, walletRegistrationSetupRequestDigest } from "./router/domains/walletRegistration/walletRegistrationReservation.js";
 //#region src/localRegistrationSetupAuthority.ts
+/** The standalone host never relocates a wallet, so every wallet keeps its first generation. */
+const LOCAL_OWNERSHIP_GENERATION = 1;
 var LocalRegistrationSetupAuthority = class {
 	constructor(database, scope) {
 		this.scope = scope;
@@ -48,6 +50,7 @@ var LocalRegistrationSetupAuthority = class {
 		return {
 			ok: true,
 			reservation,
+			ownershipGeneration: LOCAL_OWNERSHIP_GENERATION,
 			lifecycle: terminal?.value.outcome === "established" ? "established" : "reserved"
 		};
 	}
@@ -59,7 +62,11 @@ var LocalRegistrationSetupAuthority = class {
 			code: "wallet_home_unavailable",
 			message: "Registration home is unavailable"
 		};
-		return { ok: true };
+		return {
+			ok: true,
+			ownershipGeneration: LOCAL_OWNERSHIP_GENERATION,
+			purpose: terminal?.value.outcome === "established" ? "ordinary" : "registration"
+		};
 	}
 	async complete(input) {
 		const identity = await this.storage.get("setup-ceremony-index", input.ceremonyId);

package/dist/esm/router/auth/commonRouterUtils.js

@@ -109,12 +109,23 @@ async function validateRouterAbEd25519WalletSessionInputs(input) {
 	const token = extractBearerCredential(input.headers);
 	if (!token) return walletSessionFailure("wallet_session_missing");
 	const nowMs = input.nowMs || Date.now;
+	let read;
 	let resolution;
 	try {
-		resolution = await resolveWalletSessionOperationCredentialAdmission({
-			authorizationSessions,
+		read = await authorizationSessions.readEd25519WalletSessionSigningReadByOperationCredential({
+			tenantId: authorizationSessions.tenantId,
 			token,
 			nowMs: nowMs(),
+			materialActivation: input.materialActivation
+		});
+		if (!read) return {
+			ok: false,
+			code: "wallet_session_invalid",
+			message: walletSessionFailureMessage("wallet_session_invalid")
+		};
+		resolution = resolveWalletSessionOperationCredentialAdmissionFromContext({
+			context: read.context,
+			nowMs: nowMs(),
 			operation: {
 				keyFamily: "ed25519",
 				operationKind: input.operationKind
@@ -123,18 +134,14 @@ async function validateRouterAbEd25519WalletSessionInputs(input) {
 	} catch {
 		return walletSessionFailure("wallet_session_unavailable");
 	}
-	if (resolution.kind === "rejected") return walletSessionFailure("wallet_session_scope_mismatch");
-	if (resolution.kind === "not_found") return {
-		ok: false,
-		code: "wallet_session_invalid",
-		message: walletSessionFailureMessage("wallet_session_invalid")
-	};
-	if (resolution.admission.curve !== "ed25519") return walletSessionFailure("wallet_session_scope_mismatch");
+	if (resolution.kind === "rejected" || resolution.admission.curve !== "ed25519") return walletSessionFailure("wallet_session_scope_mismatch");
 	return {
 		ok: true,
 		kind: "wallet_session_operation_credential_v1",
 		admission: resolution.admission,
-		context: resolution.admission.context
+		context: resolution.admission.context,
+		signerRead: read.signerRead,
+		policyRead: read.policyRead
 	};
 }
 async function validateEcdsaPreprocessingSession(input) {