arc402-cli 1.8.7 → 1.8.9

package/dist/commands/wallet.js

@@ -1,37 +1,4 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -50,6 +17,8 @@ const format_1 = require("../utils/format");
 const abis_1 = require("../abis");
 const config_2 = require("../config");
 const walletconnect_1 = require("../walletconnect");
+const config_3 = require("../approval/config");
+const broker_1 = require("../approval/broker");
 const bundler_1 = require("../bundler");
 const walletconnect_session_1 = require("../walletconnect-session");
 const wallet_router_1 = require("../wallet-router");
@@ -60,6 +29,89 @@ const spinner_1 = require("../ui/spinner");
 const colors_1 = require("../ui/colors");
 const rpc_fallback_1 = require("../ui/rpc-fallback");
 const GUARDIAN_KEY_PATH = path_1.default.join(os_1.default.homedir(), ".arc402", "guardian.key");
+function requireApprovedWalletConnectSession(approval) {
+    if (approval.status !== "approved" || !approval.session || approval.session.kind !== "walletconnect") {
+        console.error(colors_1.c.failure + " " + colors_1.c.red(approval.error ?? "Approval transport failed."));
+        process.exit(1);
+    }
+    return approval.session;
+}
+async function requestWalletConnectApprovalSession(config, intent) {
+    return requireApprovedWalletConnectSession(await (0, broker_1.requestOwnerApproval)(intent, config));
+}
+const PASSKEY_GOVERNANCE_SELECTORS = new Set([
+    ethers_1.ethers.id("unfreeze()").slice(0, 10).toLowerCase(),
+    ethers_1.ethers.id("setGuardian(address)").slice(0, 10).toLowerCase(),
+    ethers_1.ethers.id("proposeRegistryUpdate(address)").slice(0, 10).toLowerCase(),
+    ethers_1.ethers.id("executeRegistryUpdate()").slice(0, 10).toLowerCase(),
+    ethers_1.ethers.id("cancelRegistryUpdate()").slice(0, 10).toLowerCase(),
+    ethers_1.ethers.id("setAuthorizedInterceptor(address)").slice(0, 10).toLowerCase(),
+    ethers_1.ethers.id("setVelocityLimit(uint256)").slice(0, 10).toLowerCase(),
+    ethers_1.ethers.id("authorizeMachineKey(address)").slice(0, 10).toLowerCase(),
+    ethers_1.ethers.id("revokeMachineKey(address)").slice(0, 10).toLowerCase(),
+]);
+function canUsePasskeyForWalletGovernance(config, walletAddress, tx) {
+    const approval = (0, config_3.getApprovalConfig)(config);
+    const selector = tx.data.slice(0, 10).toLowerCase();
+    return approval.defaultTransport === "telegram_passkey_link"
+        && tx.to.toLowerCase() === walletAddress.toLowerCase()
+        && PASSKEY_GOVERNANCE_SELECTORS.has(selector);
+}
+async function requestWalletGovernanceExecution(config, intent) {
+    const walletAddress = intent.walletAddress;
+    const tx = intent.txs[0];
+    if (!walletAddress || !tx || intent.txs.length !== 1) {
+        return {
+            kind: "walletconnect",
+            session: await requestWalletConnectApprovalSession(config, intent),
+        };
+    }
+    if (!canUsePasskeyForWalletGovernance(config, walletAddress, tx)) {
+        return {
+            kind: "walletconnect",
+            session: await requestWalletConnectApprovalSession(config, intent),
+        };
+    }
+    const provider = new ethers_1.ethers.JsonRpcProvider(config.rpcUrl);
+    const nonceReader = new ethers_1.ethers.Contract(bundler_1.DEFAULT_ENTRY_POINT, ["function getNonce(address sender, uint192 key) external view returns (uint256)"], provider);
+    const nonce = await nonceReader.getNonce(walletAddress, 0);
+    const bundler = new bundler_1.BundlerClient(process.env.BUNDLER_URL ?? bundler_1.DEFAULT_BUNDLER_URL, bundler_1.DEFAULT_ENTRY_POINT, intent.chainId);
+    const userOp = await (0, bundler_1.buildUserOp)(tx.data, walletAddress, nonce, config);
+    try {
+        const estimate = await bundler.estimateUserOperationGas(userOp);
+        userOp.callGasLimit = estimate.callGasLimit;
+        userOp.verificationGasLimit = estimate.verificationGasLimit;
+        userOp.preVerificationGas = estimate.preVerificationGas;
+    }
+    catch {
+        // keep conservative defaults if estimation is unavailable
+    }
+    const challenge = (0, bundler_1.getUserOperationHash)(userOp, bundler_1.DEFAULT_ENTRY_POINT, intent.chainId);
+    const approval = await (0, broker_1.requestOwnerApproval)({
+        ...intent,
+        signerMode: "passkey",
+        metadata: {
+            ...intent.metadata,
+            passkeyChallenge: challenge,
+        },
+    }, config);
+    if (approval.status !== "approved" || !approval.passkeyApproval?.signature) {
+        console.error(colors_1.c.failure + " " + colors_1.c.red(approval.error ?? "Passkey approval failed."));
+        process.exit(1);
+    }
+    userOp.signature = approval.passkeyApproval.signature;
+    const userOpHash = await bundler.sendUserOperation(userOp);
+    const receipt = await bundler.getUserOperationReceipt(userOpHash);
+    if (!receipt.success) {
+        console.error(colors_1.c.failure + " " + colors_1.c.red("UserOperation failed on-chain."));
+        process.exit(1);
+    }
+    return {
+        kind: "passkey",
+        userOpHash,
+        txHash: String(receipt.receipt.transactionHash),
+    };
+}
 function buildFreshConfigFromDefaults(existing, network, privateKey, ownerAddress) {
     const defaults = config_1.NETWORK_DEFAULTS[network];
     if (!defaults)
@@ -74,6 +126,7 @@ function buildFreshConfigFromDefaults(existing, network, privateKey, ownerAddres
         telegramBotToken: existing?.telegramBotToken,
         telegramChatId: existing?.telegramChatId,
         telegramThreadId: existing?.telegramThreadId,
+        approval: existing?.approval,
         deviceId: existing?.deviceId,
         chat: existing?.chat,
         policyEngineAddress: defaults.policyEngineAddress,
@@ -131,9 +184,7 @@ function parseAmount(raw) {
     return BigInt(raw);
 }
 function resolvePolicyEngineAddress(config) {
-    return (config.policyEngineAddress ??
-        config_1.NETWORK_DEFAULTS[config.network]?.policyEngineAddress ??
-        "0x9449B15268bE7042C0b473F3f711a41A29220866");
+    return (0, config_1.getCanonicalNetworkAddress)(config, "policyEngineAddress");
 }
 function getWalletAddressFromFactoryLogs(factoryInterface, logs) {
     for (const log of logs) {
@@ -158,6 +209,13 @@ function getWalletAddressFromFactoryLogs(factoryInterface, logs) {
     }
     return null;
 }
+async function assertAddressHasCode(provider, address, label) {
+    const code = await provider.getCode(address);
+    if (code !== "0x")
+        return;
+    throw new Error(`${label} ${address} has no contract code. ` +
+        `This usually means an owner EOA was saved instead of the deployed ARC402Wallet contract.`);
+}
 // Standard onboarding categories required for a newly deployed wallet.
 // These cover the full ARC-402 flow: spending, hiring, compute, research, protocol ops.
 const ONBOARDING_CATEGORIES = [
@@ -175,7 +233,6 @@ const ONBOARDING_CATEGORIES = [
  */
 async function runWalletOnboardingCeremony(walletAddress, ownerAddress, config, provider, sendTx) {
     const policyAddress = resolvePolicyEngineAddress(config);
-    const executeIface = new ethers_1.ethers.Interface(abis_1.ARC402_WALLET_EXECUTE_ABI);
     const govIface = new ethers_1.ethers.Interface(abis_1.POLICY_ENGINE_GOVERNANCE_ABI);
     const limitsIface = new ethers_1.ethers.Interface(abis_1.POLICY_ENGINE_LIMITS_ABI);
     const policyGov = new ethers_1.ethers.Contract(policyAddress, abis_1.POLICY_ENGINE_GOVERNANCE_ABI, provider);
@@ -198,15 +255,8 @@ async function runWalletOnboardingCeremony(walletAddress, ownerAddress, config,
     if (!alreadyRegistered) {
         const registerCalldata = govIface.encodeFunctionData("registerWallet", [walletAddress, ownerAddress]);
         await sendTx({
-            to: walletAddress,
-            data: executeIface.encodeFunctionData("executeContractCall", [{
-                    target: policyAddress,
-                    data: registerCalldata,
-                    value: 0n,
-                    minReturnValue: 0n,
-                    maxApprovalAmount: 0n,
-                    approvalToken: ethers_1.ethers.ZeroAddress,
-                }]),
+            to: policyAddress,
+            data: registerCalldata,
             value: "0x0",
         }, "registerWallet on PolicyEngine");
     }
@@ -254,11 +304,8 @@ async function runWalletOnboardingCeremony(walletAddress, ownerAddress, config,
  */
 async function runCompleteOnboardingCeremony(walletAddress, ownerAddress, config, provider, sendTx) {
     const policyAddress = resolvePolicyEngineAddress(config);
-    const agentRegistryAddress = config.agentRegistryV2Address ??
-        config_1.NETWORK_DEFAULTS[config.network]?.agentRegistryV2Address;
-    const handshakeAddress = config.handshakeAddress ??
-        config_1.NETWORK_DEFAULTS[config.network]?.handshakeAddress ??
-        "0x4F5A38Bb746d7E5d49d8fd26CA6beD141Ec2DDb3";
+    const agentRegistryAddress = (0, config_1.getCanonicalAgentRegistryAddress)(config);
+    const handshakeAddress = (0, config_1.getCanonicalNetworkAddress)(config, "handshakeAddress");
     // ── Step 2: Machine Key ────────────────────────────────────────────────────
     console.log("\n" + colors_1.c.dim("── Step 2: Machine Key ────────────────────────────────────────"));
     let machineKeyAddress;
@@ -486,11 +533,11 @@ async function runCompleteOnboardingCeremony(walletAddress, ownerAddress, config
             // Whitelist all contracts an agent will need for the full ARC-402 flow.
             const protocolContracts = [
                 { address: agentRegistryAddress ?? "", name: "AgentRegistry" },
-                { address: config.serviceAgreementAddress ?? config_1.NETWORK_DEFAULTS[config.network]?.serviceAgreementAddress ?? "0xC98B402CAB9156da68A87a69E3B4bf167A3CCcF6", name: "ServiceAgreement" },
-                { address: config.computeAgreementAddress ?? config_1.NETWORK_DEFAULTS[config.network]?.computeAgreementAddress ?? "0xf898A8A2cF9900A588B174d9f96349BBA95e57F3", name: "ComputeAgreement" },
-                { address: config.subscriptionAgreementAddress ?? config_1.NETWORK_DEFAULTS[config.network]?.subscriptionAgreementAddress ?? "0x809c1D997Eab3531Eb2d01FCD5120Ac786D850D6", name: "SubscriptionAgreement" },
-                { address: config.handshakeAddress ?? config_1.NETWORK_DEFAULTS[config.network]?.handshakeAddress ?? "0x4F5A38Bb746d7E5d49d8fd26CA6beD141Ec2DDb3", name: "Handshake" },
-                { address: config.sessionChannelsAddress ?? config_1.NETWORK_DEFAULTS[config.network]?.sessionChannelsAddress ?? "0x578f8d1bd82E8D6268E329d664d663B4d985BE61", name: "SessionChannels" },
+                { address: config_1.NETWORK_DEFAULTS[config.network]?.serviceAgreementAddress ?? "", name: "ServiceAgreement" },
+                { address: config_1.NETWORK_DEFAULTS[config.network]?.computeAgreementAddress ?? "", name: "ComputeAgreement" },
+                { address: config_1.NETWORK_DEFAULTS[config.network]?.subscriptionAgreementAddress ?? "", name: "SubscriptionAgreement" },
+                { address: config_1.NETWORK_DEFAULTS[config.network]?.handshakeAddress ?? "", name: "Handshake" },
+                { address: config_1.NETWORK_DEFAULTS[config.network]?.sessionChannelsAddress ?? "", name: "SessionChannels" },
             ].filter(c => c.address && c.address !== "");
             for (const contract of protocolContracts) {
                 const isWhitelisted = await peContract.isContractWhitelisted(walletAddress, contract.address).catch(() => false);
@@ -1002,7 +1049,7 @@ function registerWalletCommands(program) {
             console.log(colors_1.c.dim(` ◈ --force: cleared wallet config. Factory reset to ${config.walletFactoryAddress} (V6).`));
         }
         if (opts.dryRun) {
-            const factoryAddr = config.walletFactoryAddress ?? config_1.NETWORK_DEFAULTS[config.network]?.walletFactoryAddress ?? "(not configured)";
+            const factoryAddr = config_1.NETWORK_DEFAULTS[config.network]?.walletFactoryAddress ?? "(not configured)";
             const chainId = config.network === "base-mainnet" ? 8453 : 84532;
             console.log();
             console.log(" " + colors_1.c.dim("── Dry run: wallet deploy ──────────────────────────────────────"));
@@ -1100,6 +1147,7 @@ function registerWalletCommands(program) {
                 console.error("UserOperation failed on-chain.");
                 process.exit(1);
             }
+            await assertAddressHasCode(provider, senderAddress, "Deployed wallet");
             config.walletContractAddress = senderAddress;
             config.ownerAddress = ownerAddress;
             (0, config_1.saveConfig)(config);
@@ -1137,6 +1185,7 @@ function registerWalletCommands(program) {
                 console.error("Could not find WalletDeployed/WalletCreated event in receipt. Check the transaction on-chain.");
                 process.exit(1);
             }
+            await assertAddressHasCode(provider, walletAddress, "Deployed wallet");
             config.walletContractAddress = walletAddress;
             config.ownerAddress = account;
             (0, config_1.saveConfig)(config);
@@ -1229,6 +1278,7 @@ function registerWalletCommands(program) {
                     console.error("Could not find WalletDeployed/WalletCreated event in receipt. Check the transaction on-chain.");
                     process.exit(1);
                 }
+                await assertAddressHasCode(provider, deployedWallet, "Deployed wallet");
                 walletAddress = deployedWallet;
                 // ── Step 1 complete: save wallet + owner immediately ─────────────────
                 config.walletContractAddress = walletAddress;
@@ -1269,6 +1319,7 @@ function registerWalletCommands(program) {
                 deploySpinner.fail("Could not find WalletDeployed/WalletCreated event in receipt. Check the transaction on-chain.");
                 process.exit(1);
             }
+            await assertAddressHasCode(provider, walletAddress, "Deployed wallet");
             deploySpinner.succeed("Wallet deployed");
             // Generate guardian key (separate from hot key) and call setGuardian
             const guardianWallet = ethers_1.ethers.Wallet.createRandom();
@@ -1327,14 +1378,20 @@ function registerWalletCommands(program) {
         const policyAddress = resolvePolicyEngineAddress(config);
         const chainId = config.network === "base-mainnet" ? 8453 : 84532;
         const provider = new ethers_1.ethers.JsonRpcProvider(config.rpcUrl);
+        try {
+            await assertAddressHasCode(provider, walletAddress, "Configured walletContractAddress");
+        }
+        catch (error) {
+            console.error(colors_1.c.failure + " " + colors_1.c.red(error instanceof Error ? error.message : String(error)));
+            console.error(colors_1.c.dim("Tip: use the deployed wallet contract address, not the owner EOA, then rerun onboarding."));
+            process.exit(1);
+        }
         // Resolve protocol contracts to whitelist
-        const handshakeAddress = config.handshakeAddress ??
-            config_1.NETWORK_DEFAULTS[config.network]?.handshakeAddress ??
-            "0x4F5A38Bb746d7E5d49d8fd26CA6beD141Ec2DDb3";
+        const handshakeAddress = config_1.NETWORK_DEFAULTS[config.network]?.handshakeAddress ?? "";
         const protocolContracts = [
-            { address: config.serviceAgreementAddress ?? config_1.NETWORK_DEFAULTS[config.network]?.serviceAgreementAddress ?? "", name: "ServiceAgreement" },
-            { address: config.computeAgreementAddress ?? config_1.NETWORK_DEFAULTS[config.network]?.computeAgreementAddress ?? "", name: "ComputeAgreement" },
-            { address: config.subscriptionAgreementAddress ?? config_1.NETWORK_DEFAULTS[config.network]?.subscriptionAgreementAddress ?? "", name: "SubscriptionAgreement" },
+            { address: config_1.NETWORK_DEFAULTS[config.network]?.serviceAgreementAddress ?? "", name: "ServiceAgreement" },
+            { address: config_1.NETWORK_DEFAULTS[config.network]?.computeAgreementAddress ?? "", name: "ComputeAgreement" },
+            { address: config_1.NETWORK_DEFAULTS[config.network]?.subscriptionAgreementAddress ?? "", name: "SubscriptionAgreement" },
             { address: handshakeAddress, name: "Handshake" },
         ].filter(pc => pc.address && pc.address !== "");
         // Pre-check on-chain state to count pending txs and decide what to skip
@@ -1408,23 +1465,31 @@ function registerWalletCommands(program) {
             return;
         }
         console.log(" " + colors_1.c.dim(`◈ ${pendingTxCount} transaction(s) pending — your phone will need to approve each.`));
-        // Telegram notification before first tx
-        const telegramOpts = config.telegramBotToken && config.telegramChatId
-            ? { botToken: config.telegramBotToken, chatId: config.telegramChatId, threadId: config.telegramThreadId }
-            : undefined;
-        // Connect WalletConnect ONCE — reuse session for all txs
-        const { client, session, account } = await (0, walletconnect_1.connectPhoneWallet)(config.walletConnectProjectId, chainId, config, { telegramOpts, prompt: `Approve ${pendingTxCount} wallet onboarding transaction(s)`, hardware: !!opts.hardware });
+        const approval = await (0, broker_1.requestOwnerApproval)({
+            actionType: "wallet_onboard",
+            signerMode: "owner_wallet",
+            chainId,
+            walletAddress,
+            txs: Array.from({ length: pendingTxCount }, () => ({ to: walletAddress, data: "0x", value: "0x0" })),
+            ui: {
+                title: "Wallet onboarding",
+                summary: `Approve ${pendingTxCount} wallet onboarding transaction(s)`,
+                risk: "medium",
+            },
+            metadata: {
+                expectedApprovalCount: pendingTxCount,
+                sourceRuntime: "cli",
+                hardware: !!opts.hardware,
+            },
+        }, config);
+        if (approval.status !== "approved" || !approval.session || approval.session.kind !== "walletconnect") {
+            console.error(colors_1.c.failure + " " + colors_1.c.red(approval.error ?? "Approval transport failed."));
+            process.exit(1);
+        }
+        const { client, session, account } = approval.session;
         const networkName = chainId === 8453 ? "Base" : "Base Sepolia";
         const shortAddr = `${account.slice(0, 6)}...${account.slice(-5)}`;
         console.log("\n" + colors_1.c.success + colors_1.c.white(` Connected: ${shortAddr} on ${networkName}`));
-        if (telegramOpts) {
-            await (0, telegram_notify_1.sendTelegramMessage)({
-                botToken: telegramOpts.botToken,
-                chatId: telegramOpts.chatId,
-                threadId: telegramOpts.threadId,
-                text: `◈ arc402 wallet onboard: ${pendingTxCount} txs pending for ${shortAddr}`,
-            });
-        }
         const sendTx = async (call, description) => {
             const txSpin = (0, spinner_1.startSpinner)(description);
             const hash = await (0, walletconnect_1.sendTransactionWithSession)(client, session, account, chainId, call);
@@ -1432,24 +1497,22 @@ function registerWalletCommands(program) {
             txSpin.succeed(description);
             return hash;
         };
-        const executeIface = new ethers_1.ethers.Interface(abis_1.ARC402_WALLET_EXECUTE_ABI);
         const govIface = new ethers_1.ethers.Interface(abis_1.POLICY_ENGINE_GOVERNANCE_ABI);
         const limitsIface = new ethers_1.ethers.Interface(abis_1.POLICY_ENGINE_LIMITS_ABI);
         const ownerIface = new ethers_1.ethers.Interface(abis_1.ARC402_WALLET_OWNER_ABI);
+        const walletOwnerReader = new ethers_1.ethers.Contract(walletAddress, ["function owner() external view returns (address)"], provider);
+        const walletOwner = await walletOwnerReader.owner().catch(() => account);
+        if (walletOwner.toLowerCase() !== account.toLowerCase()) {
+            console.error(colors_1.c.failure + " " + colors_1.c.red(`Connected wallet ${account} is not the ARC402Wallet owner ${walletOwner}.`));
+            process.exit(1);
+        }
         console.log("\n" + colors_1.c.dim("── Onboarding ceremony ────────────────────────────────────────"));
         // 1. registerWallet
         if (needsRegister) {
-            const registerCalldata = govIface.encodeFunctionData("registerWallet", [walletAddress, account]);
+            const registerCalldata = govIface.encodeFunctionData("registerWallet", [walletAddress, walletOwner]);
             await sendTx({
-                to: walletAddress,
-                data: executeIface.encodeFunctionData("executeContractCall", [{
-                        target: policyAddress,
-                        data: registerCalldata,
-                        value: 0n,
-                        minReturnValue: 0n,
-                        maxApprovalAmount: 0n,
-                        approvalToken: ethers_1.ethers.ZeroAddress,
-                    }]),
+                to: policyAddress,
+                data: registerCalldata,
                 value: "0x0",
             }, "registerWallet on PolicyEngine");
         }
@@ -1574,15 +1637,33 @@ function registerWalletCommands(program) {
                 process.exit(1);
             }
             const provider = new ethers_1.ethers.JsonRpcProvider(config.rpcUrl);
-            const { txHash } = await (0, walletconnect_1.requestPhoneWalletSignature)(config.walletConnectProjectId, chainId, (account) => ({
+            const approval = await (0, broker_1.requestOwnerApproval)({
+                actionType: "spend_limit_set",
+                signerMode: "owner_wallet",
+                chainId,
+                walletAddress: walletAddr,
+                txs: [{
+                        to: policyAddress,
+                        data: policyInterface.encodeFunctionData("setCategoryLimitFor", [walletAddr, opts.category, amount]),
+                        value: "0x0",
+                    }],
+                ui: {
+                    title: "Set spend limit",
+                    summary: `Approve spend limit: ${opts.category} → ${opts.amount} ETH`,
+                    risk: "medium",
+                },
+                metadata: { sourceRuntime: "cli" },
+            }, config);
+            if (approval.status !== "approved" || !approval.session || approval.session.kind !== "walletconnect") {
+                console.error(colors_1.c.failure + " " + colors_1.c.red(approval.error ?? "Approval transport failed."));
+                process.exit(1);
+            }
+            const { client, session, account } = approval.session;
+            const txHash = await (0, walletconnect_1.sendTransactionWithSession)(client, session, account, chainId, {
                 to: policyAddress,
                 data: policyInterface.encodeFunctionData("setCategoryLimitFor", [walletAddr, opts.category, amount]),
                 value: "0x0",
-            }), `Approve spend limit: ${opts.category} → ${opts.amount} ETH`, config.telegramBotToken && config.telegramChatId ? {
-                botToken: config.telegramBotToken,
-                chatId: config.telegramChatId,
-                threadId: config.telegramThreadId,
-            } : undefined, config);
+            });
             console.log(`\nTransaction submitted: ${txHash}`);
             await provider.waitForTransaction(txHash);
             console.log(`Spend limit for ${opts.category} set to ${opts.amount} ETH`);
@@ -1625,15 +1706,33 @@ function registerWalletCommands(program) {
         const policyInterface = new ethers_1.ethers.Interface(abis_1.POLICY_ENGINE_LIMITS_ABI);
         if (config.walletConnectProjectId) {
             const provider = new ethers_1.ethers.JsonRpcProvider(config.rpcUrl);
-            const { txHash } = await (0, walletconnect_1.requestPhoneWalletSignature)(config.walletConnectProjectId, chainId, () => ({
+            const approval = await (0, broker_1.requestOwnerApproval)({
+                actionType: "policy_update",
+                signerMode: "owner_wallet",
+                chainId,
+                walletAddress: walletAddr,
+                txs: [{
+                        to: policyAddress,
+                        data: policyInterface.encodeFunctionData("setDailyLimitFor", [walletAddr, opts.category, amount]),
+                        value: "0x0",
+                    }],
+                ui: {
+                    title: "Set daily limit",
+                    summary: `Approve daily limit: ${opts.category} → ${opts.amount} ETH`,
+                    risk: "medium",
+                },
+                metadata: { sourceRuntime: "cli" },
+            }, config);
+            if (approval.status !== "approved" || !approval.session || approval.session.kind !== "walletconnect") {
+                console.error(colors_1.c.failure + " " + colors_1.c.red(approval.error ?? "Approval transport failed."));
+                process.exit(1);
+            }
+            const { client, session, account } = approval.session;
+            const txHash = await (0, walletconnect_1.sendTransactionWithSession)(client, session, account, chainId, {
                 to: policyAddress,
                 data: policyInterface.encodeFunctionData("setDailyLimitFor", [walletAddr, opts.category, amount]),
                 value: "0x0",
-            }), `Approve daily limit: ${opts.category} → ${opts.amount} ETH`, config.telegramBotToken && config.telegramChatId ? {
-                botToken: config.telegramBotToken,
-                chatId: config.telegramChatId,
-                threadId: config.telegramThreadId,
-            } : undefined, config);
+            });
             await provider.waitForTransaction(txHash);
             console.log(`Daily limit for ${opts.category} set to ${opts.amount} ETH (12/24h rolling window)`);
         }
@@ -1674,24 +1773,30 @@ function registerWalletCommands(program) {
         ];
         const policyInterface = new ethers_1.ethers.Interface(abis_1.POLICY_ENGINE_LIMITS_ABI);
         const provider = new ethers_1.ethers.JsonRpcProvider(config.rpcUrl);
-        const telegramOpts = config.telegramBotToken && config.telegramChatId ? {
-            botToken: config.telegramBotToken,
-            chatId: config.telegramChatId,
-            threadId: config.telegramThreadId,
-        } : undefined;
         console.log(colors_1.c.white("\n◈ Spend limit init — 1 connection, 5 approvals\n"));
         console.log(colors_1.c.dim("  Connect once — MetaMask will prompt 5 times in sequence."));
-        // Connect once, reuse session for all 5 txs
-        const { client, session, account } = await (0, walletconnect_1.connectPhoneWallet)(config.walletConnectProjectId, chainId, config, { telegramOpts, prompt: "Connect wallet for spend limit setup (5 approvals)" });
+        const approval = await (0, broker_1.requestOwnerApproval)({
+            actionType: "spend_limit_set",
+            signerMode: "owner_wallet",
+            chainId,
+            walletAddress: walletAddr,
+            txs: categories.map(() => ({ to: policyAddress, data: "0x", value: "0x0" })),
+            ui: {
+                title: "Initialize spend limits",
+                summary: "Connect wallet for spend limit setup (5 approvals)",
+                risk: "medium",
+            },
+            metadata: { expectedApprovalCount: categories.length, sourceRuntime: "cli" },
+        }, config);
+        if (approval.status !== "approved" || !approval.session || approval.session.kind !== "walletconnect") {
+            console.error(colors_1.c.failure + " " + colors_1.c.red(approval.error ?? "Approval transport failed."));
+            process.exit(1);
+        }
+        const { client, session, account } = approval.session;
         for (const cat of categories) {
             const amount = ethers_1.ethers.parseEther(cat.amount);
             const data = policyInterface.encodeFunctionData("setCategoryLimitFor", [walletAddr, cat.name, amount]);
             console.log(colors_1.c.dim(`\n  Setting ${cat.name} → ${cat.amount} ETH...`));
-            // Send Telegram notification for each
-            if (telegramOpts) {
-                const { sendTelegramMessage: sendTg } = await Promise.resolve().then(() => __importStar(require("../telegram-notify.js")));
-                await sendTg({ ...telegramOpts, text: `Approve spend limit: ${cat.name} → ${cat.amount} ETH` });
-            }
             const txHash = await (0, walletconnect_1.sendTransactionWithSession)(client, session, account, chainId, {
                 to: policyAddress,
                 data,
@@ -1736,14 +1841,33 @@ function registerWalletCommands(program) {
         console.log(`\nWallet:         ${config.walletContractAddress}`);
         console.log(`Current policy: ${currentPolicy}`);
         console.log(`New policy:     ${policyIdHex}`);
-        const telegramOpts = config.telegramBotToken && config.telegramChatId
-            ? { botToken: config.telegramBotToken, chatId: config.telegramChatId, threadId: config.telegramThreadId }
-            : undefined;
-        const { txHash } = await (0, walletconnect_1.requestPhoneWalletSignature)(config.walletConnectProjectId, chainId, () => ({
+        const approval = await (0, broker_1.requestOwnerApproval)({
+            actionType: "policy_update",
+            signerMode: "owner_wallet",
+            chainId,
+            walletAddress: config.walletContractAddress,
+            txs: [{
+                    to: config.walletContractAddress,
+                    data: ownerInterface.encodeFunctionData("updatePolicy", [policyIdHex]),
+                    value: "0x0",
+                }],
+            ui: {
+                title: "Update active policy",
+                summary: `Approve: update policy to ${policyIdHex}`,
+                risk: "medium",
+            },
+            metadata: { sourceRuntime: "cli" },
+        }, config);
+        if (approval.status !== "approved" || !approval.session || approval.session.kind !== "walletconnect") {
+            console.error(colors_1.c.failure + " " + colors_1.c.red(approval.error ?? "Approval transport failed."));
+            process.exit(1);
+        }
+        const { client, session, account } = approval.session;
+        const txHash = await (0, walletconnect_1.sendTransactionWithSession)(client, session, account, chainId, {
             to: config.walletContractAddress,
             data: ownerInterface.encodeFunctionData("updatePolicy", [policyIdHex]),
             value: "0x0",
-        }), `Approve: update policy to ${policyIdHex}`, telegramOpts, config);
+        });
         await provider.waitForTransaction(txHash);
         console.log("\n" + colors_1.c.success + colors_1.c.white(" Active policy updated"));
         console.log(" " + colors_1.c.dim("Tx:") + " " + colors_1.c.white(txHash));
@@ -1814,10 +1938,35 @@ function registerWalletCommands(program) {
         const chainId = config.network === "base-mainnet" ? 8453 : 84532;
         const provider = new ethers_1.ethers.JsonRpcProvider(config.rpcUrl);
         const walletInterface = new ethers_1.ethers.Interface(abis_1.ARC402_WALLET_GUARDIAN_ABI);
-        const telegramOpts = config.telegramBotToken && config.telegramChatId
-            ? { botToken: config.telegramBotToken, chatId: config.telegramChatId, threadId: config.telegramThreadId }
-            : undefined;
-        const { client, session, account } = await (0, walletconnect_1.connectPhoneWallet)(config.walletConnectProjectId, chainId, config, { telegramOpts, prompt: "Approve: unfreeze ARC402Wallet", hardware: !!opts.hardware });
+        const execution = await requestWalletGovernanceExecution(config, {
+            actionType: "custom_tx",
+            signerMode: "owner_wallet",
+            chainId,
+            walletAddress: config.walletContractAddress,
+            txs: [{
+                    to: config.walletContractAddress,
+                    data: walletInterface.encodeFunctionData("unfreeze", []),
+                    value: "0x0",
+                }],
+            ui: {
+                title: "Unfreeze wallet",
+                summary: "Approve: unfreeze ARC402Wallet",
+                risk: "high",
+            },
+            metadata: { sourceRuntime: "cli", hardware: !!opts.hardware },
+        });
+        if (execution.kind === "passkey") {
+            if (opts.json) {
+                console.log(JSON.stringify({ txHash: execution.txHash, walletAddress: config.walletContractAddress, userOpHash: execution.userOpHash }));
+            }
+            else {
+                console.log("\n" + colors_1.c.success + colors_1.c.white(` Wallet ${config.walletContractAddress} unfrozen`));
+                console.log(" " + colors_1.c.dim("Tx:") + " " + colors_1.c.white(execution.txHash));
+                console.log(" " + colors_1.c.dim("UserOp:") + " " + colors_1.c.white(execution.userOpHash));
+            }
+            return;
+        }
+        const { client, session, account } = execution.session;
         const networkName = chainId === 8453 ? "Base" : "Base Sepolia";
         const shortAddr = `${account.slice(0, 6)}...${account.slice(-5)}`;
         console.log("\n" + colors_1.c.success + colors_1.c.white(` Connected: ${shortAddr} on ${networkName}`));
@@ -1875,10 +2024,37 @@ function registerWalletCommands(program) {
         const walletInterface = new ethers_1.ethers.Interface(abis_1.ARC402_WALLET_GUARDIAN_ABI);
         console.log(`\nGuardian address: ${guardianWallet.address}`);
         console.log(`Wallet contract:  ${config.walletContractAddress}`);
-        const telegramOpts = config.telegramBotToken && config.telegramChatId
-            ? { botToken: config.telegramBotToken, chatId: config.telegramChatId, threadId: config.telegramThreadId }
-            : undefined;
-        const { client, session, account } = await (0, walletconnect_1.connectPhoneWallet)(config.walletConnectProjectId, chainId, config, { telegramOpts, prompt: `Approve: set guardian to ${guardianWallet.address}`, hardware: !!opts.hardware });
+        const execution = await requestWalletGovernanceExecution(config, {
+            actionType: "custom_tx",
+            signerMode: "owner_wallet",
+            chainId,
+            walletAddress: config.walletContractAddress,
+            txs: [{
+                    to: config.walletContractAddress,
+                    data: walletInterface.encodeFunctionData("setGuardian", [guardianWallet.address]),
+                    value: "0x0",
+                }],
+            ui: {
+                title: "Set guardian",
+                summary: `Approve: set guardian to ${guardianWallet.address}`,
+                risk: "high",
+            },
+            metadata: { sourceRuntime: "cli", hardware: !!opts.hardware },
+        });
+        if (execution.kind === "passkey") {
+            saveGuardianKey(guardianWallet.privateKey);
+            if (config.guardianPrivateKey)
+                delete config.guardianPrivateKey;
+            config.guardianAddress = guardianWallet.address;
+            (0, config_1.saveConfig)(config);
+            console.log("\n" + colors_1.c.success + colors_1.c.white(` Guardian set to: ${guardianWallet.address}`));
+            console.log(" " + colors_1.c.dim("Tx:") + " " + colors_1.c.white(execution.txHash));
+            console.log(" " + colors_1.c.dim("UserOp:") + " " + colors_1.c.white(execution.userOpHash));
+            console.log(" " + colors_1.c.dim("Guardian private key saved to ~/.arc402/guardian.key (chmod 400)."));
+            console.log(" " + colors_1.c.warning + " " + colors_1.c.yellow("The guardian key can freeze your wallet. Store it separately from your hot key."));
+            return;
+        }
+        const { client, session, account } = execution.session;
         const networkName = chainId === 8453 ? "Base" : "Base Sepolia";
         const shortAddr = `${account.slice(0, 6)}...${account.slice(-5)}`;
         console.log("\n" + colors_1.c.success + colors_1.c.white(` Connected: ${shortAddr} on ${networkName}`));
@@ -1974,10 +2150,36 @@ function registerWalletCommands(program) {
             console.log(`  Value: 0x0`);
             return;
         }
-        const telegramOpts = config.telegramBotToken && config.telegramChatId
-            ? { botToken: config.telegramBotToken, chatId: config.telegramChatId, threadId: config.telegramThreadId }
-            : undefined;
-        const { client, session, account } = await (0, walletconnect_1.connectPhoneWallet)(config.walletConnectProjectId, chainId, config, { telegramOpts, prompt: "Approve registry upgrade proposal on ARC402Wallet", hardware: !!opts.hardware });
+        const execution = await requestWalletGovernanceExecution(config, {
+            actionType: "custom_tx",
+            signerMode: "owner_wallet",
+            chainId,
+            walletAddress: config.walletContractAddress,
+            txs: [{ to: config.walletContractAddress, data: calldata, value: "0x0" }],
+            ui: {
+                title: "Propose registry upgrade",
+                summary: "Approve registry upgrade proposal on ARC402Wallet",
+                risk: "high",
+            },
+            metadata: {
+                sourceRuntime: "cli",
+                hardware: !!opts.hardware,
+            },
+        });
+        if (execution.kind === "passkey") {
+            const unlockAt = new Date(Date.now() + 2 * 24 * 60 * 60 * 1000);
+            console.log("\n" + colors_1.c.success + colors_1.c.white(" Registry upgrade proposed"));
+            console.log(" " + colors_1.c.dim("Tx:") + " " + colors_1.c.white(execution.txHash));
+            console.log(" " + colors_1.c.dim("UserOp:") + " " + colors_1.c.white(execution.userOpHash));
+            console.log(" " + colors_1.c.dim("Unlock at:") + " " + colors_1.c.white(unlockAt.toISOString()) + colors_1.c.dim(" (approximately)"));
+            console.log(`\nNext steps:`);
+            console.log(`  Wait 2 days, then run:`);
+            console.log(`  arc402 wallet execute-registry-upgrade`);
+            console.log(`\nTo cancel before execution:`);
+            console.log(`  arc402 wallet cancel-registry-upgrade`);
+            return;
+        }
+        const { client, session, account } = execution.session;
         const networkName = chainId === 8453 ? "Base" : "Base Sepolia";
         const shortAddr = `${account.slice(0, 6)}...${account.slice(-5)}`;
         console.log("\n" + colors_1.c.success + colors_1.c.white(` Connected: ${shortAddr} on ${networkName}`));
@@ -2043,15 +2245,39 @@ function registerWalletCommands(program) {
         }
         console.log(`Pending registry: ${pendingRegistry}`);
         console.log("Timelock elapsed — proceeding with executeRegistryUpdate()");
-        const telegramOpts = config.telegramBotToken && config.telegramChatId
-            ? { botToken: config.telegramBotToken, chatId: config.telegramChatId, threadId: config.telegramThreadId }
-            : undefined;
         const walletInterface = new ethers_1.ethers.Interface(abis_1.ARC402_WALLET_REGISTRY_ABI);
-        const { txHash } = await (0, walletconnect_1.requestPhoneWalletSignature)(config.walletConnectProjectId, chainId, () => ({
+        const txData = {
             to: config.walletContractAddress,
             data: walletInterface.encodeFunctionData("executeRegistryUpdate", []),
             value: "0x0",
-        }), "Approve registry upgrade execution on ARC402Wallet", telegramOpts, config);
+        };
+        const execution = await requestWalletGovernanceExecution(config, {
+            actionType: "custom_tx",
+            signerMode: "owner_wallet",
+            chainId,
+            walletAddress: config.walletContractAddress,
+            txs: [txData],
+            ui: {
+                title: "Execute registry upgrade",
+                summary: "Approve registry upgrade execution on ARC402Wallet",
+                risk: "high",
+            },
+            metadata: { sourceRuntime: "cli" },
+        });
+        if (execution.kind === "passkey") {
+            let confirmedRegistry = pendingRegistry;
+            try {
+                confirmedRegistry = await walletContract.registry();
+            }
+            catch { /* use pendingRegistry as fallback */ }
+            console.log("\n" + colors_1.c.success + colors_1.c.white(" Registry upgrade executed"));
+            console.log(" " + colors_1.c.dim("Tx:") + " " + colors_1.c.white(execution.txHash));
+            console.log(" " + colors_1.c.dim("UserOp:") + " " + colors_1.c.white(execution.userOpHash));
+            console.log(" " + colors_1.c.dim("New registry:") + " " + colors_1.c.white(confirmedRegistry));
+            return;
+        }
+        const { client, session, account } = execution.session;
+        const txHash = await (0, walletconnect_1.sendTransactionWithSession)(client, session, account, chainId, txData);
         // Wait for tx to confirm, then read back the active registry (J6-02)
         await provider.waitForTransaction(txHash);
         let confirmedRegistry = pendingRegistry;
@@ -2118,18 +2344,33 @@ function registerWalletCommands(program) {
         console.log(`\nWallet:       ${config.walletContractAddress}`);
         console.log(`PolicyEngine: ${policyAddress}`);
         console.log(`Whitelisting: ${checksumTarget}`);
-        const telegramOpts = config.telegramBotToken && config.telegramChatId
-            ? { botToken: config.telegramBotToken, chatId: config.telegramChatId, threadId: config.telegramThreadId }
-            : undefined;
         const policyIface = new ethers_1.ethers.Interface(peAbi);
-        const { txHash } = await (0, walletconnect_1.requestPhoneWalletSignature)(config.walletConnectProjectId, chainId, () => ({
+        const txData = {
             to: policyAddress,
             data: policyIface.encodeFunctionData("whitelistContract", [
                 config.walletContractAddress,
                 checksumTarget,
             ]),
             value: "0x0",
-        }), `Approve: whitelist ${checksumTarget} on PolicyEngine for your wallet`, telegramOpts, config);
+        };
+        const { client, session, account } = await requestWalletConnectApprovalSession(config, {
+            actionType: "policy_update",
+            signerMode: "owner_wallet",
+            chainId,
+            walletAddress: config.walletContractAddress,
+            txs: [txData],
+            ui: {
+                title: "Whitelist contract",
+                summary: `Approve: whitelist ${checksumTarget} on PolicyEngine for your wallet`,
+                risk: "high",
+            },
+            metadata: {
+                category: "policy",
+                sourceRuntime: "cli",
+                hardware: !!opts.hardware,
+            },
+        });
+        const txHash = await (0, walletconnect_1.sendTransactionWithSession)(client, session, account, chainId, txData);
         await provider.waitForTransaction(txHash);
         if (opts.json) {
             console.log(JSON.stringify({ ok: true, txHash, wallet: config.walletContractAddress, target: checksumTarget }));
@@ -2176,14 +2417,33 @@ function registerWalletCommands(program) {
         console.log(`\nWallet:              ${config.walletContractAddress}`);
         console.log(`Current interceptor: ${currentInterceptor}`);
         console.log(`New interceptor:     ${checksumAddress}`);
-        const telegramOpts = config.telegramBotToken && config.telegramChatId
-            ? { botToken: config.telegramBotToken, chatId: config.telegramChatId, threadId: config.telegramThreadId }
-            : undefined;
-        const { txHash } = await (0, walletconnect_1.requestPhoneWalletSignature)(config.walletConnectProjectId, chainId, () => ({
+        const txData = {
             to: config.walletContractAddress,
             data: ownerInterface.encodeFunctionData("setAuthorizedInterceptor", [checksumAddress]),
             value: "0x0",
-        }), `Approve: set X402 interceptor to ${checksumAddress}`, telegramOpts, config);
+        };
+        const execution = await requestWalletGovernanceExecution(config, {
+            actionType: "custom_tx",
+            signerMode: "owner_wallet",
+            chainId,
+            walletAddress: config.walletContractAddress,
+            txs: [txData],
+            ui: {
+                title: "Set X402 interceptor",
+                summary: `Approve: set X402 interceptor to ${checksumAddress}`,
+                risk: "high",
+            },
+            metadata: { sourceRuntime: "cli" },
+        });
+        if (execution.kind === "passkey") {
+            console.log("\n" + colors_1.c.success + colors_1.c.white(" X402 interceptor updated"));
+            console.log(" " + colors_1.c.dim("Tx:") + " " + colors_1.c.white(execution.txHash));
+            console.log(" " + colors_1.c.dim("UserOp:") + " " + colors_1.c.white(execution.userOpHash));
+            console.log(" " + colors_1.c.dim("Interceptor:") + " " + colors_1.c.white(checksumAddress));
+            return;
+        }
+        const { client, session, account } = execution.session;
+        const txHash = await (0, walletconnect_1.sendTransactionWithSession)(client, session, account, chainId, txData);
         await provider.waitForTransaction(txHash);
         console.log("\n" + colors_1.c.success + colors_1.c.white(" X402 interceptor updated"));
         console.log(" " + colors_1.c.dim("Tx:") + " " + colors_1.c.white(txHash));
@@ -2227,14 +2487,36 @@ function registerWalletCommands(program) {
         console.log(`\nWallet:         ${config.walletContractAddress}`);
         console.log(`Current limit:  ${currentLimit}`);
         console.log(`New limit:      ${limitEth} ETH (max ETH per rolling window)`);
-        const telegramOpts = config.telegramBotToken && config.telegramChatId
-            ? { botToken: config.telegramBotToken, chatId: config.telegramChatId, threadId: config.telegramThreadId }
-            : undefined;
-        const { txHash } = await (0, walletconnect_1.requestPhoneWalletSignature)(config.walletConnectProjectId, chainId, () => ({
+        const txData = {
             to: config.walletContractAddress,
             data: ownerInterface.encodeFunctionData("setVelocityLimit", [limitWei]),
             value: "0x0",
-        }), `Approve: set velocity limit to ${limitEth} ETH`, telegramOpts, config);
+        };
+        const execution = await requestWalletGovernanceExecution(config, {
+            actionType: "policy_update",
+            signerMode: "owner_wallet",
+            chainId,
+            walletAddress: config.walletContractAddress,
+            txs: [txData],
+            ui: {
+                title: "Set velocity limit",
+                summary: `Approve: set velocity limit to ${limitEth} ETH`,
+                risk: "high",
+            },
+            metadata: {
+                category: "policy",
+                sourceRuntime: "cli",
+            },
+        });
+        if (execution.kind === "passkey") {
+            console.log("\n" + colors_1.c.success + colors_1.c.white(" Velocity limit updated"));
+            console.log(" " + colors_1.c.dim("Tx:") + " " + colors_1.c.white(execution.txHash));
+            console.log(" " + colors_1.c.dim("UserOp:") + " " + colors_1.c.white(execution.userOpHash));
+            console.log(" " + colors_1.c.dim("New limit:") + " " + colors_1.c.white(`${limitEth} ETH per rolling window`));
+            return;
+        }
+        const { client, session, account } = execution.session;
+        const txHash = await (0, walletconnect_1.sendTransactionWithSession)(client, session, account, chainId, txData);
         await provider.waitForTransaction(txHash);
         console.log("\n" + colors_1.c.success + colors_1.c.white(" Velocity limit updated"));
         console.log(" " + colors_1.c.dim("Tx:") + " " + colors_1.c.white(txHash));
@@ -2242,9 +2524,8 @@ function registerWalletCommands(program) {
     });
     // ─── register-policy ───────────────────────────────────────────────────────
     //
-    // Calls registerWallet(walletAddress, ownerAddress) on PolicyEngine via
-    // executeContractCall on the ARC402Wallet. PolicyEngine requires msg.sender == wallet,
-    // so this must go through the wallet contract — not called directly by the owner key.
+    // Calls registerWallet(walletAddress, ownerAddress) directly on PolicyEngine
+    // from the owner wallet.
     wallet.command("register-policy")
         .description("Register this wallet on PolicyEngine (required before spend limits can be set)")
         .option("--hardware", "Hardware wallet mode: show raw wc: URI only")
@@ -2281,33 +2562,45 @@ function registerWalletCommands(program) {
                 }
             }
         }
+        const resolvedOwnerAddress = ownerAddress;
         // Encode registerWallet(wallet, owner) calldata — called on PolicyEngine
         const policyInterface = new ethers_1.ethers.Interface([
             "function registerWallet(address wallet, address owner) external",
         ]);
         const registerCalldata = policyInterface.encodeFunctionData("registerWallet", [
             config.walletContractAddress,
-            ownerAddress,
+            resolvedOwnerAddress,
         ]);
-        const executeInterface = new ethers_1.ethers.Interface(abis_1.ARC402_WALLET_EXECUTE_ABI);
         console.log(`\nWallet:       ${config.walletContractAddress}`);
         console.log(`PolicyEngine: ${policyAddress}`);
-        console.log(`Owner:        ${ownerAddress}`);
-        const telegramOpts = config.telegramBotToken && config.telegramChatId
-            ? { botToken: config.telegramBotToken, chatId: config.telegramChatId, threadId: config.telegramThreadId }
-            : undefined;
-        const { txHash } = await (0, walletconnect_1.requestPhoneWalletSignature)(config.walletConnectProjectId, chainId, () => ({
-            to: config.walletContractAddress,
-            data: executeInterface.encodeFunctionData("executeContractCall", [{
-                    target: policyAddress,
-                    data: registerCalldata,
-                    value: 0n,
-                    minReturnValue: 0n,
-                    maxApprovalAmount: 0n,
-                    approvalToken: ethers_1.ethers.ZeroAddress,
-                }]),
+        console.log(`Owner:        ${resolvedOwnerAddress}`);
+        const txData = {
+            to: policyAddress,
+            data: registerCalldata,
             value: "0x0",
-        }), `Approve: register wallet on PolicyEngine`, telegramOpts, config);
+        };
+        const { client, session, account } = await requestWalletConnectApprovalSession(config, {
+            actionType: "policy_update",
+            signerMode: "owner_wallet",
+            chainId,
+            walletAddress: config.walletContractAddress,
+            txs: [txData],
+            ui: {
+                title: "Register wallet on PolicyEngine",
+                summary: "Approve: register wallet on PolicyEngine",
+                risk: "high",
+            },
+            metadata: {
+                category: "policy",
+                sourceRuntime: "cli",
+                hardware: !!opts.hardware,
+            },
+        });
+        if (account.toLowerCase() !== resolvedOwnerAddress.toLowerCase()) {
+            console.error(`Connected wallet ${account} is not the wallet owner ${resolvedOwnerAddress}.`);
+            process.exit(1);
+        }
+        const txHash = await (0, walletconnect_1.sendTransactionWithSession)(client, session, account, chainId, txData);
         await provider.waitForTransaction(txHash);
         console.log("\n" + colors_1.c.success + colors_1.c.white(" Wallet registered on PolicyEngine"));
         console.log(" " + colors_1.c.dim("Tx:") + " " + colors_1.c.white(txHash));
@@ -2356,15 +2649,33 @@ function registerWalletCommands(program) {
         console.log(`  Pending address: ${pendingRegistry}`);
         console.log(`  Timelock:        ${timelockStatus}`);
         console.log(`\nCancelling pending registry upgrade to: ${pendingRegistry}`);
-        const telegramOpts = config.telegramBotToken && config.telegramChatId
-            ? { botToken: config.telegramBotToken, chatId: config.telegramChatId, threadId: config.telegramThreadId }
-            : undefined;
         const walletInterface = new ethers_1.ethers.Interface(abis_1.ARC402_WALLET_REGISTRY_ABI);
-        const { txHash } = await (0, walletconnect_1.requestPhoneWalletSignature)(config.walletConnectProjectId, chainId, () => ({
+        const txData = {
             to: config.walletContractAddress,
             data: walletInterface.encodeFunctionData("cancelRegistryUpdate", []),
             value: "0x0",
-        }), "Approve registry upgrade cancellation on ARC402Wallet", telegramOpts, config);
+        };
+        const execution = await requestWalletGovernanceExecution(config, {
+            actionType: "custom_tx",
+            signerMode: "owner_wallet",
+            chainId,
+            walletAddress: config.walletContractAddress,
+            txs: [txData],
+            ui: {
+                title: "Cancel registry upgrade",
+                summary: "Approve registry upgrade cancellation on ARC402Wallet",
+                risk: "high",
+            },
+            metadata: { sourceRuntime: "cli" },
+        });
+        if (execution.kind === "passkey") {
+            console.log("\n" + colors_1.c.success + colors_1.c.white(" Registry upgrade cancelled"));
+            console.log(" " + colors_1.c.dim("Tx:") + " " + colors_1.c.white(execution.txHash));
+            console.log(" " + colors_1.c.dim("UserOp:") + " " + colors_1.c.white(execution.userOpHash));
+            return;
+        }
+        const { client, session, account } = execution.session;
+        const txHash = await (0, walletconnect_1.sendTransactionWithSession)(client, session, account, chainId, txData);
         console.log("\n" + colors_1.c.success + colors_1.c.white(" Registry upgrade cancelled"));
         console.log(" " + colors_1.c.dim("Tx:") + " " + colors_1.c.white(txHash));
     });
@@ -2505,11 +2816,6 @@ function registerWalletCommands(program) {
             return;
         }
         // ── Step 6: connect WalletConnect once, send all transactions ─────────
-        const telegramOpts = config.telegramBotToken && config.telegramChatId
-            ? { botToken: config.telegramBotToken, chatId: config.telegramChatId, threadId: config.telegramThreadId }
-            : undefined;
-        console.log("\nConnecting wallet...");
-        const { client, session, account } = await (0, walletconnect_1.connectPhoneWallet)(config.walletConnectProjectId, chainId, config, { telegramOpts, prompt: "Approve governance setup transactions on ARC402Wallet" });
         const provider = new ethers_1.ethers.JsonRpcProvider(config.rpcUrl);
         const ownerInterface = new ethers_1.ethers.Interface(abis_1.ARC402_WALLET_OWNER_ABI);
         const guardianInterface = new ethers_1.ethers.Interface(abis_1.ARC402_WALLET_GUARDIAN_ABI);
@@ -2531,6 +2837,33 @@ function registerWalletCommands(program) {
             govAlreadyDefiEnabled = await policyGovContract.defiAccessEnabled(config.walletContractAddress);
         }
         catch { /* assume not enabled */ }
+        const expectedApprovalCount = (govAlreadyRegistered ? 0 : 1) +
+            (govAlreadyDefiEnabled ? 0 : 1) +
+            1 +
+            (guardianWallet ? 1 : 0) +
+            categories.length;
+        console.log("\nConnecting wallet...");
+        const { client, session, account } = await requestWalletConnectApprovalSession(config, {
+            actionType: "policy_update",
+            signerMode: "owner_wallet",
+            chainId,
+            walletAddress: config.walletContractAddress,
+            txs: Array.from({ length: expectedApprovalCount }, () => ({
+                to: config.walletContractAddress,
+                data: "0x",
+                value: "0x0",
+            })),
+            ui: {
+                title: "Governance setup",
+                summary: "Approve governance setup transactions on ARC402Wallet",
+                risk: "high",
+            },
+            metadata: {
+                category: "policy",
+                expectedApprovalCount,
+                sourceRuntime: "cli",
+            },
+        });
         if (!govAlreadyRegistered) {
             const registerCalldata = govInterface.encodeFunctionData("registerWallet", [config.walletContractAddress, account]);
             calls.push({
@@ -2665,19 +2998,37 @@ function registerWalletCommands(program) {
         }
         console.log(`\nWallet:      ${config.walletContractAddress}`);
         console.log(`Machine key: ${checksumKey}`);
-        const telegramOpts = config.telegramBotToken && config.telegramChatId
-            ? { botToken: config.telegramBotToken, chatId: config.telegramChatId, threadId: config.telegramThreadId }
-            : undefined;
         const walletInterface = new ethers_1.ethers.Interface(machineKeyAbi);
         const txData = {
             to: config.walletContractAddress,
             data: walletInterface.encodeFunctionData("authorizeMachineKey", [checksumKey]),
             value: "0x0",
         };
-        const { client, session, account } = await (0, walletconnect_1.connectPhoneWallet)(config.walletConnectProjectId, chainId, config, {
-            telegramOpts,
-            prompt: `Authorize machine key ${checksumKey} on ARC402Wallet — allows autonomous protocol ops`,
+        const execution = await requestWalletGovernanceExecution(config, {
+            actionType: "custom_tx",
+            signerMode: "owner_wallet",
+            chainId,
+            walletAddress: config.walletContractAddress,
+            txs: [txData],
+            ui: {
+                title: "Authorize machine key",
+                summary: `Authorize machine key ${checksumKey} on ARC402Wallet — allows autonomous protocol ops`,
+                risk: "high",
+            },
+            metadata: { sourceRuntime: "cli" },
         });
+        if (execution.kind === "passkey") {
+            const confirmed = await walletContract.authorizedMachineKeys(checksumKey);
+            console.log("\n" + colors_1.c.success + colors_1.c.white(` Machine key authorized: ${confirmed ? "YES" : "NO"}`));
+            (0, tree_1.renderTree)([
+                { label: "Wallet", value: config.walletContractAddress ?? "" },
+                { label: "Machine key", value: checksumKey },
+                { label: "Tx", value: execution.txHash },
+                { label: "UserOp", value: execution.userOpHash, last: true },
+            ]);
+            return;
+        }
+        const { client, session, account } = execution.session;
         console.log("\n" + colors_1.c.success + colors_1.c.white(` Connected: ${account}`));
         console.log(colors_1.c.dim("Sending authorizeMachineKey transaction..."));
         const hash = await (0, walletconnect_1.sendTransactionWithSession)(client, session, account, chainId, txData);
@@ -2738,18 +3089,40 @@ function registerWalletCommands(program) {
         }
         console.log(`\nWallet:      ${config.walletContractAddress}`);
         console.log(`Revoking:    ${checksumKey}`);
-        const telegramOpts = config.telegramBotToken && config.telegramChatId
-            ? { botToken: config.telegramBotToken, chatId: config.telegramChatId, threadId: config.telegramThreadId }
-            : undefined;
         const walletInterface = new ethers_1.ethers.Interface(abis_1.ARC402_WALLET_MACHINE_KEY_ABI);
-        const { client, session, account } = await (0, walletconnect_1.connectPhoneWallet)(config.walletConnectProjectId, chainId, config, { telegramOpts, prompt: `Revoke machine key ${checksumKey} on ARC402Wallet` });
-        console.log("\n" + colors_1.c.success + colors_1.c.white(` Connected: ${account}`));
-        console.log(colors_1.c.dim("Sending revokeMachineKey transaction..."));
-        const hash = await (0, walletconnect_1.sendTransactionWithSession)(client, session, account, chainId, {
+        const txData = {
             to: config.walletContractAddress,
             data: walletInterface.encodeFunctionData("revokeMachineKey", [checksumKey]),
             value: "0x0",
+        };
+        const execution = await requestWalletGovernanceExecution(config, {
+            actionType: "custom_tx",
+            signerMode: "owner_wallet",
+            chainId,
+            walletAddress: config.walletContractAddress,
+            txs: [txData],
+            ui: {
+                title: "Revoke machine key",
+                summary: `Revoke machine key ${checksumKey} on ARC402Wallet`,
+                risk: "high",
+            },
+            metadata: { sourceRuntime: "cli" },
         });
+        if (execution.kind === "passkey") {
+            const stillAuthorized = await walletContract.authorizedMachineKeys(checksumKey);
+            console.log("\n" + colors_1.c.success + colors_1.c.white(` Machine key revoked: ${stillAuthorized ? "NO (still authorized — check tx)" : "YES"}`));
+            (0, tree_1.renderTree)([
+                { label: "Wallet", value: config.walletContractAddress ?? "" },
+                { label: "Machine key", value: checksumKey },
+                { label: "Tx", value: execution.txHash },
+                { label: "UserOp", value: execution.userOpHash, last: true },
+            ]);
+            return;
+        }
+        const { client, session, account } = execution.session;
+        console.log("\n" + colors_1.c.success + colors_1.c.white(` Connected: ${account}`));
+        console.log(colors_1.c.dim("Sending revokeMachineKey transaction..."));
+        const hash = await (0, walletconnect_1.sendTransactionWithSession)(client, session, account, chainId, txData);
         console.log("\n" + colors_1.c.dim("Transaction submitted:") + " " + colors_1.c.white(hash));
         console.log(colors_1.c.dim("Waiting for confirmation..."));
         const receipt = await provider.waitForTransaction(hash, 1, 60000);
@@ -3248,7 +3621,7 @@ function registerWalletCommands(program) {
             console.error("walletConnectProjectId not set. Run `arc402 config set walletConnectProjectId <id>`.");
             process.exit(1);
         }
-        const migrationRegistryAddress = config.migrationRegistryAddress ?? "0x4821D8A590eD4DbEf114fCA3C2d9311e81D576DF";
+        const migrationRegistryAddress = (0, config_1.getCanonicalNetworkAddress)(config, "migrationRegistryAddress");
         let oldWallet;
         let newWallet;
         try {
@@ -3274,10 +3647,20 @@ function registerWalletCommands(program) {
             "function registerMigration(address oldWallet, address newWallet) external"
         ]);
         const callData = mrIface.encodeFunctionData("registerMigration", [oldWallet, newWallet]);
-        const telegramOpts = config.telegramBotToken && config.telegramChatId
-            ? { botToken: config.telegramBotToken, chatId: config.telegramChatId, threadId: config.telegramThreadId }
-            : undefined;
-        const { txHash } = await (0, walletconnect_1.requestPhoneWalletSignature)(config.walletConnectProjectId, chainId, () => ({ to: migrationRegistryAddress, data: callData, value: "0x0" }), `Approve: migrate wallet identity ${oldWallet.slice(0, 10)}... → ${newWallet.slice(0, 10)}...`, telegramOpts, config);
+        const txData = { to: migrationRegistryAddress, data: callData, value: "0x0" };
+        const { client, session, account } = await requestWalletConnectApprovalSession(config, {
+            actionType: "custom_tx",
+            signerMode: "owner_wallet",
+            chainId,
+            txs: [txData],
+            ui: {
+                title: "Register wallet migration",
+                summary: `Approve: migrate wallet identity ${oldWallet.slice(0, 10)}... → ${newWallet.slice(0, 10)}...`,
+                risk: "high",
+            },
+            metadata: { sourceRuntime: "cli" },
+        });
+        const txHash = await (0, walletconnect_1.sendTransactionWithSession)(client, session, account, chainId, txData);
         await provider.waitForTransaction(txHash);
         if (opts.json) {
             console.log(JSON.stringify({ ok: true, txHash, from: oldWallet, to: newWallet }));
@@ -3501,18 +3884,29 @@ function registerWalletCommands(program) {
         console.log(`\nWallet:   ${config.walletContractAddress}`);
         console.log(`pubKeyX:  ${pubKeyX}`);
         console.log(`pubKeyY:  ${pubKeyY}`);
-        const telegramOpts = config.telegramBotToken && config.telegramChatId
-            ? { botToken: config.telegramBotToken, chatId: config.telegramChatId, threadId: config.telegramThreadId }
-            : undefined;
         const txData = {
             to: config.walletContractAddress,
             data: walletInterface.encodeFunctionData("setPasskey", [pubKeyX, pubKeyY]),
             value: "0x0",
         };
-        const { client, session, account } = await (0, walletconnect_1.connectPhoneWallet)(config.walletConnectProjectId, chainId, config, {
-            telegramOpts,
-            prompt: `Activate passkey (Face ID) on ARC402Wallet — enables P256 governance signing`,
-        });
+        const approval = await (0, broker_1.requestOwnerApproval)({
+            actionType: "custom_tx",
+            signerMode: "owner_wallet",
+            chainId,
+            walletAddress: config.walletContractAddress,
+            txs: [txData],
+            ui: {
+                title: "Activate passkey",
+                summary: "Activate passkey (Face ID) on ARC402Wallet — enables P256 governance signing",
+                risk: "high",
+            },
+            metadata: { sourceRuntime: "cli" },
+        }, config);
+        if (approval.status !== "approved" || !approval.session || approval.session.kind !== "walletconnect") {
+            console.error(colors_1.c.failure + " " + colors_1.c.red(approval.error ?? "Approval transport failed."));
+            process.exit(1);
+        }
+        const { client, session, account } = approval.session;
         console.log("\n" + colors_1.c.success + colors_1.c.white(` Connected: ${account}`));
         console.log(colors_1.c.dim("Sending setPasskey transaction..."));
         const hash = await (0, walletconnect_1.sendTransactionWithSession)(client, session, account, chainId, txData);