@seams/wallet-server 0.10.2 → 0.12.0

package/dist/esm/router/node/nodeHostedWalletGateway.js

@@ -1,64 +0,0 @@
-import { createStaticWalletConsoleBindingV1, parseStaticWalletConsoleBindingConfigV1 } from "../cloudflare/runtime/staticWalletConsoleBinding.js";
-import { handleSplitGatewayRequest } from "../../hosted-wallet-gateway.js";
-import { createSyncSqliteDatabase } from "../../storage/syncSqlite.js";
-import { NODE_HOP_BY_HOP_HEADERS_V1 } from "./nodeHttp.js";
-import { readFileSync } from "node:fs";
-//#region src/router/node/nodeHostedWalletGateway.ts
-function createNodeHostedWalletGatewayV1(options) {
-	const deploymentJson = options.vars.WALLET_LOCAL_DEPLOYMENT_JSON;
-	if (!deploymentJson) throw new Error("WALLET_LOCAL_DEPLOYMENT_JSON is required");
-	const env = {
-		...options.vars,
-		WALLET_LOCAL_DEPLOYMENT_JSON: deploymentJson,
-		ROUTER_AB_PREWARM_ENABLED: options.vars.ROUTER_AB_PREWARM_ENABLED ?? "false",
-		SIGNER_DB: createSyncSqliteDatabase(options.connection),
-		MPC_ROUTER: httpServiceBinding(options.routerUrl),
-		SIGNING_WORKER: httpServiceBinding(options.signingWorkerUrl),
-		WALLET_CONSOLE: createStaticWalletConsoleBindingV1(parseStaticWalletConsoleBindingConfigV1(JSON.parse(deploymentJson)))
-	};
-	const signerWasmBytes = readFileSync(options.signerWasmPath);
-	const dependencies = { signerWasm: async () => await WebAssembly.compile(signerWasmBytes) };
-	const handler = options.handler ?? handleSplitGatewayRequest;
-	const pending = /* @__PURE__ */ new Set();
-	const ctx = {
-		waitUntil(promise) {
-			const tracked = promise.catch((error) => options.onBackgroundError?.(error));
-			pending.add(tracked);
-			tracked.finally(() => pending.delete(tracked));
-		},
-		passThroughOnException() {}
-	};
-	return {
-		handle: async (request) => await handler(request, env, ctx, dependencies),
-		drain: async () => {
-			await Promise.all([...pending]);
-		}
-	};
-}
-/**
-* A Cloudflare service binding delivers to one Worker whatever URL the
-* caller used; the Gateway sends both its fixed internal origins and
-* forwarded public requests through them. On a VM each binding forwards the
-* path and query to its one configured base URL, and nowhere else.
-*/
-function httpServiceBinding(baseUrl) {
-	const base = new URL(baseUrl);
-	return { async fetch(input, init) {
-		const request = new Request(input, init);
-		const url = new URL(request.url);
-		const target = new URL(`${url.pathname}${url.search}`, base);
-		const body = request.method === "GET" || request.method === "HEAD" ? void 0 : await request.arrayBuffer();
-		const headers = new Headers(request.headers);
-		for (const name of NODE_HOP_BY_HOP_HEADERS_V1) headers.delete(name);
-		return await fetch(target, {
-			method: request.method,
-			headers,
-			body,
-			redirect: "manual"
-		});
-	} };
-}
-//#endregion
-export { createNodeHostedWalletGatewayV1 };
-
-//# sourceMappingURL=nodeHostedWalletGateway.js.map

package/dist/esm/router/node/nodeHostedWalletGatewayCheck.js

@@ -1,163 +0,0 @@
-import { parseStaticWalletConsoleBindingConfigV1 } from "../cloudflare/runtime/staticWalletConsoleBinding.js";
-import { nodeSqliteConnection } from "./nodeSqlite.js";
-import { inspectSignerSqlMigrationsV1 } from "./signerSqlMigrations.js";
-import { existsSync } from "node:fs";
-//#region src/router/node/nodeHostedWalletGatewayCheck.ts
-async function checkNodeHostedWalletGatewayV1(input) {
-	return [
-		configurationCheck(input),
-		signerWasmCheck(input.signerWasmPath),
-		storageCheck(input),
-		await peerCheck("router", input.routerUrl),
-		await peerCheck("signing_worker", input.signingWorkerUrl),
-		{
-			check: "peer_authentication",
-			status: "unverified",
-			detail: { reason: "the check sends no credential; a peer that refuses the Gateway's service credentials is found only by an authenticated call, such as the explicit smoke test" }
-		}
-	];
-}
-function configurationCheck(input) {
-	const missing = [
-		["WALLET_GATEWAY_VARS_FILE", input.varsPath],
-		["WALLET_GATEWAY_ROUTER_URL", input.routerUrl],
-		["WALLET_GATEWAY_SIGNING_WORKER_URL", input.signingWorkerUrl],
-		["WALLET_GATEWAY_SIGNER_WASM_PATH", input.signerWasmPath]
-	].filter(([, value]) => !value).map(([name]) => name);
-	if (missing.length > 0 || !input.varsPath) return {
-		check: "configuration",
-		status: "failed",
-		detail: { missing }
-	};
-	let vars;
-	try {
-		vars = input.readVars(input.varsPath);
-	} catch (error) {
-		return {
-			check: "configuration",
-			status: "failed",
-			detail: { error: error instanceof Error ? error.message : "the vars file cannot be read" }
-		};
-	}
-	const deploymentJson = vars.WALLET_LOCAL_DEPLOYMENT_JSON;
-	if (!deploymentJson) return {
-		check: "configuration",
-		status: "failed",
-		detail: { missing: ["WALLET_LOCAL_DEPLOYMENT_JSON"] }
-	};
-	try {
-		parseStaticWalletConsoleBindingConfigV1(JSON.parse(deploymentJson));
-	} catch {
-		return {
-			check: "configuration",
-			status: "failed",
-			detail: { error: "WALLET_LOCAL_DEPLOYMENT_JSON is not a valid deployment" }
-		};
-	}
-	return {
-		check: "configuration",
-		status: "passed",
-		detail: { keys: Object.keys(vars).length }
-	};
-}
-function signerWasmCheck(path) {
-	if (!path) return {
-		check: "artifact:signer_wasm",
-		status: "failed",
-		detail: { missing: true }
-	};
-	return existsSync(path) ? {
-		check: "artifact:signer_wasm",
-		status: "passed",
-		detail: { path }
-	} : {
-		check: "artifact:signer_wasm",
-		status: "failed",
-		detail: {
-			path,
-			state: "missing"
-		}
-	};
-}
-function storageCheck(input) {
-	const path = input.databasePath;
-	if (!existsSync(path)) return {
-		check: "storage:gateway_store",
-		status: "failed",
-		detail: {
-			path,
-			state: "missing",
-			action: "apply the schema with `migrate`"
-		}
-	};
-	const database = new input.DatabaseSync(path, { readOnly: true });
-	try {
-		const status = inspectSignerSqlMigrationsV1(nodeSqliteConnection(database), input.migrationsDir);
-		const current = status.pending.length === 0 && status.unknown.length === 0;
-		return {
-			check: "storage:gateway_store",
-			status: current ? "passed" : "failed",
-			detail: current ? {
-				path,
-				applied: status.applied.length
-			} : {
-				path,
-				applied: status.applied.length,
-				pending: status.pending,
-				unknown: status.unknown
-			}
-		};
-	} finally {
-		database.close();
-	}
-}
-/** The role a peer's health endpoint answers as. Sends no credential. */
-async function peerCheck(role, url) {
-	const check = `peer:${role}`;
-	if (!url) return {
-		check,
-		status: "failed",
-		detail: { missing: true }
-	};
-	let answered;
-	try {
-		const response = await fetch(new URL("/healthz", url), { signal: AbortSignal.timeout(5e3) });
-		if (response.status !== 200) return {
-			check,
-			status: "failed",
-			detail: {
-				url,
-				error: `answered HTTP ${response.status}`
-			}
-		};
-		const body = await response.json();
-		answered = body.role_label ?? body.role;
-	} catch (error) {
-		return {
-			check,
-			status: "failed",
-			detail: {
-				url,
-				state: "unreachable",
-				error: error instanceof Error ? error.message : "failed"
-			}
-		};
-	}
-	return answered === role ? {
-		check,
-		status: "passed",
-		detail: { url }
-	} : {
-		check,
-		status: "failed",
-		detail: {
-			url,
-			answered_as: answered ?? null,
-			action: "point this URL at the role it names"
-		}
-	};
-}
-//#endregion
-export { checkNodeHostedWalletGatewayV1 };
-
-//# sourceMappingURL=nodeHostedWalletGatewayCheck.js.map

package/dist/esm/router/node/nodeHostedWalletGatewayMain.js

@@ -1,120 +0,0 @@
-import { handleLocalHostedWalletGatewayRequestV1 } from "../../localHostedWalletGatewayHandler.js";
-import { listenNodeFetchHandler } from "./nodeHttp.js";
-import { createNodeHostedWalletGatewayV1 } from "./nodeHostedWalletGateway.js";
-import { loadNodeDatabaseSync, nodeSqliteConnection, openNodeSqliteFile } from "./nodeSqlite.js";
-import { applySignerSqlMigrationsV1, inspectSignerSqlMigrationsV1 } from "./signerSqlMigrations.js";
-import { checkNodeHostedWalletGatewayV1 } from "./nodeHostedWalletGatewayCheck.js";
-import { readFileSync } from "node:fs";
-//#region src/router/node/nodeHostedWalletGatewayMain.ts
-async function main(argv) {
-	const command = argv[0];
-	const databasePath = requireEnv("WALLET_GATEWAY_DATABASE_PATH");
-	const migrationsDir = requireEnv("WALLET_GATEWAY_MIGRATIONS_DIR");
-	const DatabaseSync = await loadNodeDatabaseSync();
-	if (command === "check") {
-		const checks = await checkNodeHostedWalletGatewayV1({
-			DatabaseSync,
-			databasePath,
-			migrationsDir,
-			varsPath: optionalEnv("WALLET_GATEWAY_VARS_FILE"),
-			readVars: readVarsFile,
-			routerUrl: optionalEnv("WALLET_GATEWAY_ROUTER_URL"),
-			signingWorkerUrl: optionalEnv("WALLET_GATEWAY_SIGNING_WORKER_URL"),
-			signerWasmPath: optionalEnv("WALLET_GATEWAY_SIGNER_WASM_PATH")
-		});
-		const ok = checks.every((check) => check.status !== "failed");
-		report({
-			kind: "wallet_gateway_check_v1",
-			ok,
-			checks
-		});
-		return ok ? 0 : 1;
-	}
-	const database = openNodeSqliteFile(DatabaseSync, databasePath);
-	const connection = nodeSqliteConnection(database);
-	if (command === "migrate") {
-		report({
-			kind: "wallet_gateway_migrate_v1",
-			...applySignerSqlMigrationsV1(connection, migrationsDir, Date.now())
-		});
-		database.close();
-		return 0;
-	}
-	if (command === "serve" || command === "serve-local") {
-		const status = inspectSignerSqlMigrationsV1(connection, migrationsDir);
-		if (status.pending.length > 0 || status.unknown.length > 0) throw new Error("shared store schema is not current; run `migrate` first");
-		const [host, port] = splitListen(requireEnv("WALLET_GATEWAY_LISTEN"));
-		const gateway = createNodeHostedWalletGatewayV1({
-			vars: readVarsFile(requireEnv("WALLET_GATEWAY_VARS_FILE")),
-			connection,
-			routerUrl: requireEnv("WALLET_GATEWAY_ROUTER_URL"),
-			signingWorkerUrl: requireEnv("WALLET_GATEWAY_SIGNING_WORKER_URL"),
-			signerWasmPath: requireEnv("WALLET_GATEWAY_SIGNER_WASM_PATH"),
-			...command === "serve-local" ? { handler: handleLocalHostedWalletGatewayRequestV1 } : {},
-			onBackgroundError: (error) => process.stderr.write(`gateway background task failed: ${describe(error)}\n`)
-		});
-		const server = await listenNodeFetchHandler({
-			host,
-			port,
-			handle: gateway.handle
-		});
-		report({
-			kind: "wallet_gateway_listening_v1",
-			address: server.address()
-		});
-		const stop = () => server.close(() => {
-			gateway.drain().finally(() => {
-				database.close();
-				process.exit(0);
-			});
-		});
-		process.once("SIGTERM", stop);
-		process.once("SIGINT", stop);
-		return await new Promise(() => void 0);
-	}
-	process.stderr.write("usage: wallet-gateway <migrate|check|serve|serve-local>\n");
-	return 2;
-}
-/** Reads `KEY='value'` / `KEY=value` lines; values are never logged. */
-function readVarsFile(path) {
-	const vars = {};
-	for (const rawLine of readFileSync(path, "utf8").split(/\r?\n/)) {
-		const line = rawLine.trim();
-		if (!line || line.startsWith("#")) continue;
-		const separator = line.indexOf("=");
-		if (separator <= 0) throw new Error(`invalid entry in ${path}`);
-		const key = line.slice(0, separator);
-		let value = line.slice(separator + 1);
-		if (value.length >= 2 && value.startsWith("'") && value.endsWith("'")) value = value.slice(1, -1);
-		if (key in vars) throw new Error(`duplicate ${key} in ${path}`);
-		vars[key] = value;
-	}
-	return vars;
-}
-function requireEnv(name) {
-	const value = process.env[name]?.trim();
-	if (!value) throw new Error(`${name} is required`);
-	return value;
-}
-function optionalEnv(name) {
-	return process.env[name]?.trim() || void 0;
-}
-function splitListen(value) {
-	const index = value.lastIndexOf(":");
-	const port = Number(value.slice(index + 1));
-	if (index <= 0 || !Number.isInteger(port)) throw new Error("WALLET_GATEWAY_LISTEN must be host:port");
-	return [value.slice(0, index), port];
-}
-function report(value) {
-	process.stdout.write(`${JSON.stringify(value)}\n`);
-}
-function describe(error) {
-	return error instanceof Error ? error.message : String(error);
-}
-main(process.argv.slice(2)).then((code) => process.exit(code), (error) => {
-	process.stderr.write(`${describe(error)}\n`);
-	process.exit(1);
-});
-//#endregion
-
-//# sourceMappingURL=nodeHostedWalletGatewayMain.js.map

package/dist/esm/router/node/nodeHttp.js

@@ -1,79 +0,0 @@
-import { createServer } from "node:http";
-//#region src/router/node/nodeHttp.ts
-const MAX_REQUEST_BODY_BYTES = 1024 * 1024;
-/**
-* Headers that describe one connection or one message's framing. A Worker's
-* runtime sets them for the bytes it actually sends; on Node they are never
-* copied from a Request or Response that another hop produced.
-*/
-const NODE_HOP_BY_HOP_HEADERS_V1 = [
-	"connection",
-	"content-length",
-	"expect",
-	"host",
-	"keep-alive",
-	"proxy-connection",
-	"te",
-	"trailer",
-	"transfer-encoding",
-	"upgrade"
-];
-function listenNodeFetchHandler(input) {
-	const server = createServer((incoming, outgoing) => {
-		forward(incoming, outgoing, input.handle);
-	});
-	return new Promise((resolve, reject) => {
-		server.once("error", reject);
-		server.listen(input.port, input.host, () => resolve(server));
-	});
-}
-async function forward(incoming, outgoing, handle) {
-	try {
-		if (Number(incoming.headers["content-length"]) > MAX_REQUEST_BODY_BYTES) {
-			rejectOversizedBody(incoming, outgoing);
-			return;
-		}
-		const chunks = [];
-		let bodyBytes = 0;
-		for await (const chunk of incoming.iterator({ destroyOnReturn: false })) {
-			bodyBytes += chunk.length;
-			if (bodyBytes > MAX_REQUEST_BODY_BYTES) {
-				rejectOversizedBody(incoming, outgoing);
-				return;
-			}
-			chunks.push(chunk);
-		}
-		const headers = new Headers();
-		for (const [name, value] of Object.entries(incoming.headers)) if (typeof value === "string") headers.set(name, value);
-		else if (Array.isArray(value)) for (const item of value) headers.append(name, item);
-		const method = incoming.method ?? "GET";
-		const response = await handle(new Request(`http://${incoming.headers.host ?? "localhost"}${incoming.url ?? "/"}`, {
-			method,
-			headers,
-			body: method === "GET" || method === "HEAD" ? void 0 : Buffer.concat(chunks)
-		}));
-		outgoing.statusCode = response.status;
-		response.headers.forEach((value, name) => {
-			if (name === "set-cookie" || NODE_HOP_BY_HOP_HEADERS_V1.includes(name)) return;
-			outgoing.setHeader(name, value);
-		});
-		const cookies = response.headers.getSetCookie();
-		if (cookies.length > 0) outgoing.setHeader("set-cookie", cookies);
-		outgoing.end(Buffer.from(await response.arrayBuffer()));
-	} catch {
-		outgoing.statusCode = 500;
-		outgoing.end("internal error");
-	}
-}
-function rejectOversizedBody(incoming, outgoing) {
-	incoming.pause();
-	outgoing.writeHead(413, {
-		connection: "close",
-		"content-type": "text/plain; charset=utf-8"
-	});
-	outgoing.end("request body too large");
-}
-//#endregion
-export { NODE_HOP_BY_HOP_HEADERS_V1, listenNodeFetchHandler };
-
-//# sourceMappingURL=nodeHttp.js.map

package/dist/esm/router/node/nodeSqlite.js

@@ -1,43 +0,0 @@
-//#region src/router/node/nodeSqlite.ts
-const BUSY_TIMEOUT_MS = 5e3;
-/** Loads `node:sqlite` at runtime so the package builds without its typings. */
-async function loadNodeDatabaseSync() {
-	const module = await import("node:sqlite");
-	if (typeof module.DatabaseSync !== "function") throw new Error("node:sqlite DatabaseSync is unavailable; use Node.js 22.13 or newer");
-	return module.DatabaseSync;
-}
-/**
-* Opens a SQLite file for one role-private store. Writers from separate
-* processes serialize on `BEGIN IMMEDIATE`; WAL lets readers proceed.
-*/
-function openNodeSqliteFile(DatabaseSync, path) {
-	const database = new DatabaseSync(path);
-	database.exec(`PRAGMA busy_timeout = ${BUSY_TIMEOUT_MS}; PRAGMA journal_mode = WAL; PRAGMA foreign_keys = ON;`);
-	return database;
-}
-function nodeSqliteConnection(database) {
-	let inTransaction = false;
-	return {
-		execute: (sql, params) => database.prepare(sql).all(...params),
-		executeScript: (sql) => database.exec(sql),
-		transaction: (body) => {
-			if (inTransaction) throw new Error("nested SQLite transactions are not supported");
-			database.exec("BEGIN IMMEDIATE");
-			inTransaction = true;
-			try {
-				const result = body();
-				database.exec("COMMIT");
-				return result;
-			} catch (error) {
-				database.exec("ROLLBACK");
-				throw error;
-			} finally {
-				inTransaction = false;
-			}
-		}
-	};
-}
-//#endregion
-export { loadNodeDatabaseSync, nodeSqliteConnection, openNodeSqliteFile };
-
-//# sourceMappingURL=nodeSqlite.js.map

package/dist/esm/router/node/signerSqlMigrations.js

@@ -1,48 +0,0 @@
-import { readFileSync, readdirSync } from "node:fs";
-import { join } from "node:path";
-//#region src/router/node/signerSqlMigrations.ts
-const LEDGER_TABLE = "seams_signer_sql_migrations";
-function migrationNames(directory) {
-	return readdirSync(directory).filter((name) => name.endsWith(".sql")).sort();
-}
-function appliedNames(connection) {
-	if (connection.execute("SELECT name FROM sqlite_master WHERE type = 'table' AND name = ?1", [LEDGER_TABLE]).length === 0) return [];
-	return connection.execute(`SELECT name FROM ${LEDGER_TABLE} ORDER BY name`, []).map((row) => String(row.name));
-}
-/** Read-only: compares the database ledger with the shipped migration chain. */
-function inspectSignerSqlMigrationsV1(connection, directory) {
-	const shipped = migrationNames(directory);
-	const applied = appliedNames(connection);
-	return {
-		applied,
-		pending: shipped.filter((name) => !applied.includes(name)),
-		unknown: applied.filter((name) => !shipped.includes(name))
-	};
-}
-/**
-* Applies pending migrations in order, each in one transaction together
-* with its ledger row, so an interrupted run resumes at the first missing
-* migration. Refuses a database that already carries migrations this
-* package does not know, or whose applied set is not a prefix of the chain.
-*/
-function applySignerSqlMigrationsV1(connection, directory, nowMs) {
-	const status = inspectSignerSqlMigrationsV1(connection, directory);
-	if (status.unknown.length > 0) throw new Error(`database has migrations this package does not ship: ${status.unknown.join(", ")}`);
-	const shipped = migrationNames(directory);
-	if (status.applied.some((name, index) => shipped[index] !== name)) throw new Error("applied migrations are not a prefix of the shipped migration chain");
-	connection.executeScript(`CREATE TABLE IF NOT EXISTS ${LEDGER_TABLE} (name TEXT PRIMARY KEY, applied_at_ms INTEGER NOT NULL)`);
-	const applied = [];
-	for (const name of status.pending) {
-		const sql = readFileSync(join(directory, name), "utf8");
-		connection.transaction(() => {
-			connection.executeScript(sql);
-			connection.execute(`INSERT INTO ${LEDGER_TABLE} (name, applied_at_ms) VALUES (?1, ?2)`, [name, nowMs]);
-		});
-		applied.push(name);
-	}
-	return { applied };
-}
-//#endregion
-export { applySignerSqlMigrationsV1, inspectSignerSqlMigrationsV1 };
-
-//# sourceMappingURL=signerSqlMigrations.js.map

package/dist/esm/storage/syncSqlite.js

@@ -1,79 +0,0 @@
-//#region src/storage/syncSqlite.ts
-/**
-* Presents a synchronous SQLite connection through the async SQL shape used
-* by the shared stores. `batch` is one SQLite transaction: a failing statement
-* rolls back every earlier statement, so guarded compare-and-set batches keep
-* the all-or-nothing semantics they have on D1.
-*/
-function createSyncSqliteDatabase(connection) {
-	return new SyncSqliteDatabase(connection);
-}
-var SyncSqliteDatabase = class {
-	constructor(connection) {
-		this.connection = connection;
-	}
-	prepare(query) {
-		return new SyncSqliteStatement(this.connection, query, []);
-	}
-	async batch(statements) {
-		const owned = statements.map((statement) => {
-			if (!(statement instanceof SyncSqliteStatement) || statement.connection !== this.connection) throw new Error("SQLite batch statements must be prepared by the same database");
-			return statement;
-		});
-		return this.connection.transaction(() => owned.map((statement) => statement.executeNow()));
-	}
-	async exec(query) {
-		this.connection.executeScript(query);
-		return { success: true };
-	}
-};
-var SyncSqliteStatement = class SyncSqliteStatement {
-	constructor(connection, query, values) {
-		this.connection = connection;
-		this.query = query;
-		this.values = values;
-	}
-	bind(...values) {
-		return new SyncSqliteStatement(this.connection, this.query, values.map(toSqliteValue));
-	}
-	async first(columnName) {
-		const row = this.connection.execute(this.query, this.values)[0];
-		if (!row) return null;
-		if (columnName === void 0) return row;
-		return row[columnName] ?? null;
-	}
-	async all() {
-		return this.executeNow();
-	}
-	async run() {
-		return this.executeNow();
-	}
-	/** Executes synchronously so a batch can run inside one host transaction. */
-	executeNow() {
-		const results = this.connection.execute(this.query, this.values);
-		const [counters] = this.connection.execute("SELECT changes() AS changes, last_insert_rowid() AS last_row_id", []);
-		return {
-			results,
-			success: true,
-			meta: {
-				changes: Number(counters?.changes ?? 0),
-				last_row_id: Number(counters?.last_row_id ?? 0)
-			}
-		};
-	}
-};
-function toSqliteValue(value) {
-	if (value === null || typeof value === "string") return value;
-	if (typeof value === "number") {
-		if (!Number.isFinite(value)) throw new Error("SQLite binding must be a finite number");
-		return value;
-	}
-	if (typeof value === "boolean") return value ? 1 : 0;
-	if (value instanceof Uint8Array) return value;
-	if (value instanceof ArrayBuffer) return new Uint8Array(value);
-	throw new Error(`unsupported SQLite binding type ${typeof value}`);
-}
-//#endregion
-export { createSyncSqliteDatabase };
-
-//# sourceMappingURL=syncSqlite.js.map

package/dist/esm/threshold/session/signingSessionSeal/transport/express.js

@@ -1,75 +0,0 @@
-import { failure } from "../../../../shared-ts/src/utils/failure.js";
-import { authorizeSigningSessionSealRequest, buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, parseSigningSessionSealApplyBody, parseSigningSessionSealRemoveBody, resolveSigningSessionSealBasePath, signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode } from "./shared.js";
-//#region src/threshold/session/signingSessionSeal/transport/express.ts
-function errMessage(error) {
-	return error instanceof Error ? error.message : String(error || "Internal error");
-}
-function registerSigningSessionSealRoutes(router, ctx) {
-	const options = ctx.options;
-	ctx.logger.info("[threshold-signing-session-seal] routes", { enabled: Boolean(options) });
-	if (!options) return;
-	const basePath = resolveSigningSessionSealBasePath(options.basePath);
-	const applyPath = buildSigningSessionSealApplyPath(basePath);
-	const removePath = buildSigningSessionSealRemovePath(basePath);
-	const handleSealRoute = (route, operation) => async (req, res) => {
-		const startedAtMs = Date.now();
-		try {
-			ctx.logger.info("[threshold-signing-session-seal] request", {
-				route,
-				operation
-			});
-			const parsed = operation === "apply-server-seal" ? parseSigningSessionSealApplyBody(req.body || {}) : parseSigningSessionSealRemoveBody(req.body || {});
-			if (!parsed.ok) {
-				ctx.logger.warn("[threshold-signing-session-seal] invalid_body", {
-					route,
-					operation,
-					code: parsed.code,
-					message: parsed.message,
-					durationMs: Math.max(0, Date.now() - startedAtMs)
-				});
-				res.status(400).json(failure(parsed.code, parsed.message));
-				return;
-			}
-			const authorized = await authorizeSigningSessionSealRequest({
-				options,
-				headers: req.headers || {},
-				thresholdSessionId: parsed.value.thresholdSessionId
-			});
-			if (!authorized.ok) {
-				ctx.logger.warn("[threshold-signing-session-seal] unauthorized", {
-					route,
-					operation,
-					code: authorized.code || "unauthorized",
-					message: authorized.message || "Unauthorized",
-					durationMs: Math.max(0, Date.now() - startedAtMs)
-				});
-				res.status(signingSessionSealAuthorizeStatusCode(authorized)).json(failure(authorized.code || "unauthorized", authorized.message || "Unauthorized"));
-				return;
-			}
-			const result = operation === "apply-server-seal" ? await options.service.applyServerSeal(parsed.value, authorized.auth) : await options.service.removeServerSeal(parsed.value, authorized.auth);
-			const status = signingSessionSealStatusCode(result);
-			res.status(status).json(result);
-			ctx.logger.info("[threshold-signing-session-seal] response", {
-				route,
-				status,
-				ok: result.ok,
-				durationMs: Math.max(0, Date.now() - startedAtMs),
-				userId: authorized.auth.userId
-			});
-		} catch (error) {
-			const message = errMessage(error);
-			ctx.logger.error("[threshold-signing-session-seal] error", {
-				route,
-				message,
-				durationMs: Math.max(0, Date.now() - startedAtMs)
-			});
-			res.status(500).json(failure("internal", message));
-		}
-	};
-	router.post(applyPath, handleSealRoute(applyPath, "apply-server-seal"));
-	router.post(removePath, handleSealRoute(removePath, "remove-server-seal"));
-}
-//#endregion
-export { registerSigningSessionSealRoutes };
-
-//# sourceMappingURL=express.js.map