@seams/wallet-server 0.5.0

package/dist/esm/threshold/session/signingSessionSeal/guards/index.js

@@ -0,0 +1,121 @@
+//#region src/threshold/session/signingSessionSeal/guards/index.ts
+function composeSigningSessionSealGuards(...guards) {
+	const list = guards.filter(Boolean);
+	if (list.length === 0) return async () => ({ ok: true });
+	if (list.length === 1) {
+		const [single] = list;
+		return async (input) => await single(input);
+	}
+	return async (input) => {
+		for (const guard of list) {
+			const result = await guard(input);
+			if (!result.ok) return result;
+		}
+		return { ok: true };
+	};
+}
+var InMemorySigningSessionSealRateLimiter = class {
+	constructor(options = {}) {
+		this.buckets = /* @__PURE__ */ new Map();
+		const configuredMaxEntries = Number(options.maxEntries);
+		this.maxEntries = Number.isFinite(configuredMaxEntries) && configuredMaxEntries > 0 ? Math.floor(configuredMaxEntries) : 1e4;
+	}
+	trim(nowMs) {
+		if (this.buckets.size <= this.maxEntries) return;
+		for (const [key, bucket] of this.buckets) {
+			if (bucket.resetAtMs <= nowMs) this.buckets.delete(key);
+			if (this.buckets.size <= this.maxEntries) return;
+		}
+		while (this.buckets.size > this.maxEntries) {
+			const oldestKey = this.buckets.keys().next().value;
+			if (oldestKey === void 0) return;
+			this.buckets.delete(oldestKey);
+		}
+	}
+	consume(input) {
+		const nowMs = Math.floor(Number(input.nowMs) || 0);
+		const limit = Math.max(1, Math.floor(Number(input.limit) || 0));
+		const windowMs = Math.max(1, Math.floor(Number(input.windowMs) || 0));
+		const key = String(input.key || "").trim();
+		if (!key) return {
+			ok: false,
+			code: "invalid_rate_limit_key",
+			message: "Rate-limit key is required"
+		};
+		const existing = this.buckets.get(key);
+		const bucket = !existing || existing.resetAtMs <= nowMs ? {
+			count: 0,
+			resetAtMs: nowMs + windowMs
+		} : existing;
+		bucket.count += 1;
+		this.buckets.set(key, bucket);
+		this.trim(nowMs);
+		const remaining = Math.max(0, limit - bucket.count);
+		if (bucket.count > limit) {
+			const retryAfterMs = Math.max(0, bucket.resetAtMs - nowMs);
+			return {
+				ok: false,
+				code: "rate_limited",
+				message: "Rate limit exceeded",
+				remaining: 0,
+				resetAtMs: bucket.resetAtMs,
+				retryAfterMs
+			};
+		}
+		return {
+			ok: true,
+			remaining,
+			resetAtMs: bucket.resetAtMs
+		};
+	}
+};
+function coercePositiveInt(value, defaultValue) {
+	const parsed = Number(value);
+	if (!Number.isFinite(parsed) || parsed <= 0) return defaultValue;
+	return Math.floor(parsed);
+}
+function defaultKey(input) {
+	return `${input.auth.userId}:${input.thresholdSessionId}:${input.operation}`;
+}
+function createInMemorySigningSessionSealRateLimiter(options = {}) {
+	return new InMemorySigningSessionSealRateLimiter(options);
+}
+function createSigningSessionSealRateLimitGuard(options) {
+	const limit = coercePositiveInt(options.limit, 0);
+	const windowMs = coercePositiveInt(options.windowMs, 0);
+	if (limit <= 0) throw new Error("createSigningSessionSealRateLimitGuard requires limit > 0");
+	if (windowMs <= 0) throw new Error("createSigningSessionSealRateLimitGuard requires windowMs > 0");
+	const keyPrefix = String(options.keyPrefix || "signing-session-seal").trim();
+	const keyBy = options.keyBy || defaultKey;
+	const nowMs = options.nowMs || Date.now;
+	return async (input) => {
+		const scopedKey = String(keyBy(input) || "").trim();
+		const key = keyPrefix ? `${keyPrefix}:${scopedKey}` : scopedKey;
+		const consumed = await options.limiter.consume({
+			key,
+			limit,
+			windowMs,
+			nowMs: nowMs()
+		});
+		if (consumed.ok) return { ok: true };
+		if (options.onRejected) try {
+			await options.onRejected({
+				input,
+				key,
+				limit,
+				windowMs,
+				retryAfterMs: consumed.retryAfterMs,
+				resetAtMs: consumed.resetAtMs
+			});
+		} catch {}
+		return {
+			ok: false,
+			code: String(consumed.code || "rate_limited"),
+			message: String(consumed.message || "Too many requests")
+		};
+	};
+}
+//#endregion
+export { composeSigningSessionSealGuards, createInMemorySigningSessionSealRateLimiter, createSigningSessionSealRateLimitGuard };
+
+//# sourceMappingURL=index.js.map

package/dist/esm/threshold/session/signingSessionSeal/idempotency.js

@@ -0,0 +1,38 @@
+//#region src/threshold/session/signingSessionSeal/idempotency.ts
+function trimExpired(entries, nowMs) {
+	for (const [key, entry] of entries.entries()) {
+		if (entry.expiresAtMs > nowMs) continue;
+		entries.delete(key);
+	}
+}
+function createInMemorySigningSessionSealIdempotencyStore() {
+	const entries = /* @__PURE__ */ new Map();
+	return {
+		get: async (input) => {
+			trimExpired(entries, input.nowMs);
+			const key = String(input.key || "").trim();
+			if (!key) return null;
+			const entry = entries.get(key);
+			if (!entry) return null;
+			if (entry.expiresAtMs <= input.nowMs) {
+				entries.delete(key);
+				return null;
+			}
+			return entry.result;
+		},
+		set: async (input) => {
+			const key = String(input.key || "").trim();
+			if (!key) return;
+			const expiresAtMs = Number(input.expiresAtMs);
+			if (!Number.isFinite(expiresAtMs) || expiresAtMs <= 0) return;
+			entries.set(key, {
+				result: input.result,
+				expiresAtMs: Math.floor(expiresAtMs)
+			});
+		}
+	};
+}
+//#endregion
+export { createInMemorySigningSessionSealIdempotencyStore };
+
+//# sourceMappingURL=idempotency.js.map

package/dist/esm/threshold/session/signingSessionSeal/idempotencyBackends.js

@@ -0,0 +1,131 @@
+import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
+import "../../../shared-ts/src/utils/validation.js";
+import { RedisTcpClient, UpstashRedisRestClient, redisDel, redisGetJson, redisSetJson } from "../../../core/ThresholdService/kv.js";
+import { createInMemorySigningSessionSealIdempotencyStore } from "./idempotency.js";
+import { parseCurrentSigningSessionSealIdempotencyRouteResult, parseCurrentSigningSessionSealIdempotencyStoredEntry } from "./idempotencyRecords.js";
+//#region src/threshold/session/signingSessionSeal/idempotencyBackends.ts
+const DEFAULT_KEY_PREFIX = "threshold:signing-session-seal:idempotency:";
+function toPositiveInt(value) {
+	const parsed = Number(value);
+	if (!Number.isFinite(parsed) || parsed <= 0) return void 0;
+	return Math.floor(parsed);
+}
+function prefixedKey(prefix, keyRaw) {
+	const key = normalizeOptionalTrimmedString(keyRaw);
+	if (!key) return "";
+	return prefix ? `${prefix}${key}` : key;
+}
+function ttlMsUntilExpiry(expiresAtMs, nowMs) {
+	const ttlMs = Math.floor(expiresAtMs - nowMs);
+	return ttlMs > 0 ? ttlMs : 0;
+}
+var UpstashSigningSessionSealIdempotencyStore = class {
+	constructor(options) {
+		this.client = new UpstashRedisRestClient({
+			url: options.url,
+			token: options.token
+		});
+		this.keyPrefix = normalizeOptionalTrimmedString(options.keyPrefix) || DEFAULT_KEY_PREFIX;
+		this.nowMs = options.nowMs || Date.now;
+	}
+	async get(input) {
+		const key = prefixedKey(this.keyPrefix, input.key);
+		if (!key) return null;
+		const entry = parseCurrentSigningSessionSealIdempotencyStoredEntry(await this.client.getJson(key));
+		if (!entry) return null;
+		if (entry.expiresAtMs <= input.nowMs) {
+			try {
+				await this.client.del(key);
+			} catch {}
+			return null;
+		}
+		return entry.result;
+	}
+	async set(input) {
+		const key = prefixedKey(this.keyPrefix, input.key);
+		if (!key) return;
+		const expiresAtMs = toPositiveInt(input.expiresAtMs);
+		if (expiresAtMs === void 0) return;
+		const normalizedResult = parseCurrentSigningSessionSealIdempotencyRouteResult(input.result);
+		if (!normalizedResult) return;
+		const ttlMs = ttlMsUntilExpiry(expiresAtMs, this.nowMs());
+		if (ttlMs <= 0) return;
+		await this.client.setJson(key, {
+			result: normalizedResult,
+			expiresAtMs
+		}, ttlMs);
+	}
+};
+var RedisTcpSigningSessionSealIdempotencyStore = class {
+	constructor(options) {
+		this.client = new RedisTcpClient(options.redisUrl);
+		this.keyPrefix = normalizeOptionalTrimmedString(options.keyPrefix) || DEFAULT_KEY_PREFIX;
+		this.nowMs = options.nowMs || Date.now;
+	}
+	async get(input) {
+		const key = prefixedKey(this.keyPrefix, input.key);
+		if (!key) return null;
+		const entry = parseCurrentSigningSessionSealIdempotencyStoredEntry(await redisGetJson(this.client, key));
+		if (!entry) return null;
+		if (entry.expiresAtMs <= input.nowMs) {
+			try {
+				await redisDel(this.client, key);
+			} catch {}
+			return null;
+		}
+		return entry.result;
+	}
+	async set(input) {
+		const key = prefixedKey(this.keyPrefix, input.key);
+		if (!key) return;
+		const expiresAtMs = toPositiveInt(input.expiresAtMs);
+		if (expiresAtMs === void 0) return;
+		const normalizedResult = parseCurrentSigningSessionSealIdempotencyRouteResult(input.result);
+		if (!normalizedResult) return;
+		const ttlMs = ttlMsUntilExpiry(expiresAtMs, this.nowMs());
+		if (ttlMs <= 0) return;
+		await redisSetJson(this.client, key, {
+			result: normalizedResult,
+			expiresAtMs
+		}, ttlMs);
+	}
+};
+function createUpstashSigningSessionSealIdempotencyStore(options) {
+	return new UpstashSigningSessionSealIdempotencyStore(options);
+}
+function createRedisTcpSigningSessionSealIdempotencyStore(options) {
+	return new RedisTcpSigningSessionSealIdempotencyStore(options);
+}
+function resolveSigningSessionSealIdempotencyFromEnv(input) {
+	const idempotencyKind = normalizeOptionalTrimmedString(input.idempotencyKind || "").toLowerCase();
+	const upstashUrl = normalizeOptionalTrimmedString(input.upstashUrl || "");
+	const upstashToken = normalizeOptionalTrimmedString(input.upstashToken || "");
+	const redisUrl = normalizeOptionalTrimmedString(input.redisUrl || "");
+	const keyPrefix = normalizeOptionalTrimmedString(input.keyPrefix || "") || DEFAULT_KEY_PREFIX;
+	const ttlMs = toPositiveInt(input.ttlMs);
+	const selectedKind = idempotencyKind || (upstashUrl || upstashToken ? "upstash-redis-rest" : redisUrl ? "redis-tcp" : "in-memory");
+	let store;
+	if (selectedKind === "upstash-redis-rest") {
+		if (!upstashUrl || !upstashToken) throw new Error("Upstash signing session-seal idempotency requires both upstashUrl and upstashToken");
+		store = createUpstashSigningSessionSealIdempotencyStore({
+			url: upstashUrl,
+			token: upstashToken,
+			keyPrefix
+		});
+	} else if (selectedKind === "redis-tcp") {
+		if (!redisUrl) throw new Error("Redis TCP signing session-seal idempotency requires redisUrl");
+		store = createRedisTcpSigningSessionSealIdempotencyStore({
+			redisUrl,
+			keyPrefix
+		});
+	} else if (selectedKind === "in-memory") store = createInMemorySigningSessionSealIdempotencyStore();
+	else throw new Error(`Unsupported signing session-seal idempotency kind "${selectedKind}". Expected in-memory, upstash-redis-rest, or redis-tcp.`);
+	return {
+		store,
+		...ttlMs ? { ttlMs } : {}
+	};
+}
+//#endregion
+export { createRedisTcpSigningSessionSealIdempotencyStore, createUpstashSigningSessionSealIdempotencyStore, resolveSigningSessionSealIdempotencyFromEnv };
+
+//# sourceMappingURL=idempotencyBackends.js.map

package/dist/esm/threshold/session/signingSessionSeal/idempotencyRecords.js

@@ -0,0 +1,55 @@
+import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
+import "../../../shared-ts/src/utils/validation.js";
+//#region src/threshold/session/signingSessionSeal/idempotencyRecords.ts
+function toPositiveInt(value) {
+	const parsed = Number(value);
+	if (!Number.isFinite(parsed) || parsed <= 0) return null;
+	return Math.floor(parsed);
+}
+const parseCurrentSigningSessionSealIdempotencyRecord = parseCurrentSigningSessionSealIdempotencyResultRecord;
+function parseCurrentSigningSessionSealIdempotencyResultRecord(raw) {
+	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+	const obj = raw;
+	if (obj.ok === true) {
+		const ciphertext = normalizeOptionalTrimmedString(obj.ciphertext);
+		if (!ciphertext) return null;
+		const keyVersion = normalizeOptionalTrimmedString(obj.keyVersion);
+		const expiresAtMs = toPositiveInt(obj.expiresAtMs);
+		if ("keyVersion" in obj && obj.keyVersion != null && !keyVersion || "expiresAtMs" in obj && obj.expiresAtMs != null && expiresAtMs == null || "remainingUses" in obj) return null;
+		return {
+			ok: true,
+			ciphertext,
+			...keyVersion ? { keyVersion } : {},
+			...expiresAtMs != null ? { expiresAtMs } : {}
+		};
+	}
+	if (obj.ok === false) {
+		const code = normalizeOptionalTrimmedString(obj.code);
+		const message = normalizeOptionalTrimmedString(obj.message);
+		if (!code || !message) return null;
+		return {
+			ok: false,
+			code,
+			message
+		};
+	}
+	return null;
+}
+function parseCurrentSigningSessionSealIdempotencyStoredEntry(raw) {
+	if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+	const obj = raw;
+	const result = parseCurrentSigningSessionSealIdempotencyResultRecord(obj.result);
+	const expiresAtMs = toPositiveInt(obj.expiresAtMs);
+	if (!result || expiresAtMs == null) return null;
+	return {
+		result,
+		expiresAtMs
+	};
+}
+function parseCurrentSigningSessionSealIdempotencyRouteResult(raw) {
+	return parseCurrentSigningSessionSealIdempotencyResultRecord(raw);
+}
+//#endregion
+export { parseCurrentSigningSessionSealIdempotencyRecord, parseCurrentSigningSessionSealIdempotencyResultRecord, parseCurrentSigningSessionSealIdempotencyRouteResult, parseCurrentSigningSessionSealIdempotencyStoredEntry };
+
+//# sourceMappingURL=idempotencyRecords.js.map

package/dist/esm/threshold/session/signingSessionSeal/index.js

@@ -0,0 +1,13 @@
+import { authorizeSigningSessionSealRequest, buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, parseSigningSessionSealApplyBody, parseSigningSessionSealRemoveBody, resolveSigningSessionSealBasePath, signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode } from "./transport/shared.js";
+import { handleSigningSessionSealRoutes } from "./transport/fetch.js";
+import { createPassthroughSigningSessionSealCipherAdapter, createSigningSessionSealCipherAdapter, createSigningSessionSealShamir3PassCipherAdapter, encodeSigningSessionSealServerLockContext } from "./crypto/cipher.js";
+import { createSigningSessionSealAuditLogger } from "./observability/audit.js";
+import { composeSigningSessionSealGuards, createInMemorySigningSessionSealRateLimiter, createSigningSessionSealRateLimitGuard } from "./guards/index.js";
+import { createSigningSessionSealService } from "./service.js";
+import { createSigningSessionSealRoutesOptions } from "./routesOptions.js";
+import { createSigningSessionSealOptions, parseSigningSessionSealRootConfig } from "./options.js";
+import { createInMemorySigningSessionSealIdempotencyStore } from "./idempotency.js";
+import { createRedisTcpSigningSessionSealRateLimiter, createUpstashSigningSessionSealRateLimiter, resolveSigningSessionSealRateLimitFromEnv } from "./guards/backends.js";
+import { createRedisTcpSigningSessionSealIdempotencyStore, createUpstashSigningSessionSealIdempotencyStore, resolveSigningSessionSealIdempotencyFromEnv } from "./idempotencyBackends.js";
+import { registerSigningSessionSealRoutes } from "./transport/express.js";
+export { authorizeSigningSessionSealRequest, buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, composeSigningSessionSealGuards, createInMemorySigningSessionSealIdempotencyStore, createInMemorySigningSessionSealRateLimiter, createPassthroughSigningSessionSealCipherAdapter, createRedisTcpSigningSessionSealIdempotencyStore, createRedisTcpSigningSessionSealRateLimiter, createSigningSessionSealAuditLogger, createSigningSessionSealCipherAdapter, createSigningSessionSealOptions, createSigningSessionSealRateLimitGuard, createSigningSessionSealRoutesOptions, createSigningSessionSealService, createSigningSessionSealShamir3PassCipherAdapter, createUpstashSigningSessionSealIdempotencyStore, createUpstashSigningSessionSealRateLimiter, encodeSigningSessionSealServerLockContext, handleSigningSessionSealRoutes, parseSigningSessionSealApplyBody, parseSigningSessionSealRemoveBody, parseSigningSessionSealRootConfig, registerSigningSessionSealRoutes, resolveSigningSessionSealBasePath, resolveSigningSessionSealIdempotencyFromEnv, resolveSigningSessionSealRateLimitFromEnv, signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode };

package/dist/esm/threshold/session/signingSessionSeal/observability/audit.js

@@ -0,0 +1,38 @@
+//#region src/threshold/session/signingSessionSeal/observability/audit.ts
+function logAtLevel(logger, level, message, payload) {
+	if (level === "error") {
+		logger.error(message, payload);
+		return;
+	}
+	if (level === "warn") {
+		logger.warn(message, payload);
+		return;
+	}
+	logger.info(message, payload);
+}
+function buildPayload(event) {
+	return {
+		operation: event.operation,
+		thresholdSessionId: event.thresholdSessionId,
+		userId: event.userId,
+		ok: event.ok,
+		durationMs: event.durationMs,
+		...event.code ? { code: event.code } : {}
+	};
+}
+function createSigningSessionSealAuditLogger(options) {
+	const label = String(options.label || "[threshold-signing-session-seal] audit").trim() || "[threshold-signing-session-seal] audit";
+	const failureLevel = options.failureLevel || "warn";
+	return (event) => {
+		const payload = buildPayload(event);
+		if (event.ok) {
+			options.logger.info(label, payload);
+			return;
+		}
+		logAtLevel(options.logger, failureLevel, label, payload);
+	};
+}
+//#endregion
+export { createSigningSessionSealAuditLogger };
+
+//# sourceMappingURL=audit.js.map

package/dist/esm/threshold/session/signingSessionSeal/options.js

@@ -0,0 +1,54 @@
+import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
+import "../../../shared-ts/src/utils/encoders.js";
+import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
+import "../../../shared-ts/src/utils/validation.js";
+import { SIGNING_SESSION_SEAL_ALG, SIGNING_SESSION_SEAL_GROUP_ID } from "../../../shared-ts/src/utils/signingSessionSeal.js";
+import { parseSigningSessionSealKeyVersion } from "../../../core/keyMaterialBrands.js";
+import { createSigningSessionSealShamir3PassCipherAdapter } from "./crypto/cipher.js";
+import { createSigningSessionSealRoutesOptions } from "./routesOptions.js";
+//#region src/threshold/session/signingSessionSeal/options.ts
+function parseKeyVersion(value, label) {
+	const parsed = normalizeOptionalTrimmedString(value);
+	if (!parsed) throw new Error(`${label} is required`);
+	return parseSigningSessionSealKeyVersion(parsed);
+}
+function parseRootSecret32(value) {
+	const encoded = normalizeOptionalTrimmedString(value);
+	if (!encoded) throw new Error("SIGNING_SESSION_SEAL_ROOT_SECRET_B64U is required");
+	const rootSecret32 = base64UrlDecode(encoded);
+	if (rootSecret32.length !== 32) {
+		rootSecret32.fill(0);
+		throw new Error("SIGNING_SESSION_SEAL_ROOT_SECRET_B64U must decode to exactly 32 bytes");
+	}
+	return rootSecret32;
+}
+function parseSigningSessionSealRootConfig(input) {
+	const currentKeyVersion = parseKeyVersion(input.currentKeyVersion, "currentKeyVersion");
+	const acceptedWarmKeyVersions = (input.acceptedWarmKeyVersions ?? [currentKeyVersion]).map((value, index) => parseKeyVersion(value, `acceptedWarmKeyVersions[${index}]`));
+	return {
+		kind: "shamir3pass_root_v2",
+		rootSecret32: parseRootSecret32(input.rootSecretB64u),
+		currentKeyVersion,
+		acceptedWarmKeyVersions,
+		protocol: {
+			algorithm: SIGNING_SESSION_SEAL_ALG,
+			groupId: SIGNING_SESSION_SEAL_GROUP_ID
+		}
+	};
+}
+function createSigningSessionSealOptions(input) {
+	const config = parseSigningSessionSealRootConfig(input);
+	return createSigningSessionSealRoutesOptions({
+		cipher: createSigningSessionSealShamir3PassCipherAdapter({ config }),
+		capabilities: {
+			mode: "sealed_refresh_v1",
+			protocol: config.protocol,
+			currentKeyVersion: config.currentKeyVersion
+		},
+		logger: console
+	});
+}
+//#endregion
+export { createSigningSessionSealOptions, parseSigningSessionSealRootConfig };
+
+//# sourceMappingURL=options.js.map

package/dist/esm/threshold/session/signingSessionSeal/routesOptions.js

@@ -0,0 +1,45 @@
+import { createSigningSessionSealAuditLogger } from "./observability/audit.js";
+import { composeSigningSessionSealGuards, createSigningSessionSealRateLimitGuard } from "./guards/index.js";
+import { createSigningSessionSealService } from "./service.js";
+//#region src/threshold/session/signingSessionSeal/routesOptions.ts
+function buildAuditSink(input) {
+	if (input.audit) return input.audit;
+	if (!input.logger) return void 0;
+	if (input.auditLogger === null) return void 0;
+	const options = { logger: input.logger };
+	if (input.auditLogger?.label) options.label = input.auditLogger.label;
+	if (input.auditLogger?.failureLevel) options.failureLevel = input.auditLogger.failureLevel;
+	return createSigningSessionSealAuditLogger(options);
+}
+function buildGuard(input) {
+	const guardList = [];
+	if (input.guard) guardList.push(input.guard);
+	if (Array.isArray(input.guards)) guardList.push(...input.guards);
+	if (input.rateLimit) {
+		const rateLimitOptions = { ...input.rateLimit };
+		if (input.nowMs) rateLimitOptions.nowMs = input.nowMs;
+		guardList.push(createSigningSessionSealRateLimitGuard(rateLimitOptions));
+	}
+	const nonNullGuards = guardList.filter(Boolean);
+	if (nonNullGuards.length === 0) return void 0;
+	return composeSigningSessionSealGuards(...nonNullGuards);
+}
+function createSigningSessionSealRoutesOptions(input) {
+	const guard = buildGuard(input);
+	const audit = buildAuditSink(input);
+	const serviceOptions = { cipher: input.cipher };
+	if (input.idempotency) serviceOptions.idempotency = input.idempotency;
+	if (guard) serviceOptions.guard = guard;
+	if (audit) serviceOptions.audit = audit;
+	if (input.logger) serviceOptions.logger = input.logger;
+	if (input.nowMs) serviceOptions.nowMs = input.nowMs;
+	const options = { service: createSigningSessionSealService(serviceOptions) };
+	if (input.basePath) options.basePath = input.basePath;
+	if (input.authorize) options.authorize = input.authorize;
+	if (input.capabilities) options.capabilities = input.capabilities;
+	return options;
+}
+//#endregion
+export { createSigningSessionSealRoutesOptions };
+
+//# sourceMappingURL=routesOptions.js.map