@seams/wallet-server 0.53.0 → 0.54.0

package/README.md

@@ -4,17 +4,17 @@ This package owns the reusable signer server surface: route adapters,
 WebAuthn verification policy, threshold signing services, signer storage
 adapters, and server wasm bindings.
 
-The package version is `@seams/wallet-server@0.53.0`. Pair it with
-`@seams/wallet@0.53.0` and matching hosted assets. Use `@seams/wallet-cli@0.29.0`.
+The package version is `@seams/wallet-server@0.54.0`. Pair it with
+`@seams/wallet@0.54.0` and matching hosted assets. Use `@seams/wallet-cli@0.29.0`.
 The wallet iframe protocol is **23.0.0**.
 
 ```sh
-pnpm add @seams/wallet-server@0.53.0
+pnpm add @seams/wallet-server@0.54.0
 ```
 
 ## Google BYO authentication
 
-Version 0.53.0 verifies a configured application's signed session assertion or the app's Google ID token or exchanges it for a browser-bound handoff.
+Version 0.54.0 verifies a configured application's signed session assertion or the app's Google ID token or exchanges it for a browser-bound handoff.
 An environment-specific Google client configuration and an owner-approved wallet association are required.
 Apply the packaged signer migrations before enabling the feature.
 External sessions grant settings reads and remain separate from owner and signing credentials.

package/artifact-manifest.json

@@ -3,17 +3,17 @@
   "walletSecurityPolicy": "scoped_seals_and_owner_proofs_v1",
   "package": {
     "name": "@seams/wallet-server",
-    "version": "0.53.0"
+    "version": "0.54.0"
   },
   "workers": {
     "router": {
       "entry": "cloudflare-router-ab/build/router/worker/shim.mjs",
-      "fingerprint": "545a63bcf00b849d9c09549aa139c8cce7ec9e2b608251dd9b0a259a3af03dcc",
+      "fingerprint": "22e885129a9dbc5ad00599cc4dc3b4ce71a833fa3fa26993530200abda4a47d1",
       "files": [
         {
           "path": "cloudflare-router-ab/build/router/build-stamp.json",
           "bytes": 119,
-          "sha256": "850505578f1b6a618d7da3e744505278b94a7b2d899c67ba95f295cdc00b9424"
+          "sha256": "8a75df14351fb43abefdd49c9660727594a5b751ad61d8916aabffe8492f78ff"
         },
         {
           "path": "cloudflare-router-ab/build/router/index.js",
@@ -39,12 +39,12 @@
     },
     "deriver-a": {
       "entry": "cloudflare-router-ab/build/deriver-a/worker/shim.mjs",
-      "fingerprint": "c615c1214f9dccc5f8faef33d87ad50b9c2da58815d3c9ff1c0ded140c352b80",
+      "fingerprint": "bdd26687d013f61d6e6638fe29b0d457813fd4ee7bc731c6a9f2d4ba1b0faa28",
       "files": [
         {
           "path": "cloudflare-router-ab/build/deriver-a/build-stamp.json",
           "bytes": 122,
-          "sha256": "141ea2882e6d4e711ae554df0405b667c7f2ce2d9dcf2e80f39be34827440f5d"
+          "sha256": "06905532466e1015afdd6c5ae77945cc5fd117548e10769f3c26027d82d94a0c"
         },
         {
           "path": "cloudflare-router-ab/build/deriver-a/index.js",
@@ -70,12 +70,12 @@
     },
     "deriver-b": {
       "entry": "cloudflare-router-ab/build/deriver-b/worker/shim.mjs",
-      "fingerprint": "68478b8ffa6cad1ca6d87594ee4913c26d70e0b1a1fde9c17f690a289ff7a929",
+      "fingerprint": "d998751bf0efb8861236a8b8f6b0314dd8d41eaaca2f542497085e9d8b62e504",
       "files": [
         {
           "path": "cloudflare-router-ab/build/deriver-b/build-stamp.json",
           "bytes": 122,
-          "sha256": "8a8c263d9c26677c1009d5d4280aab6c50ab514872355cc3a994f5d8a9a56e28"
+          "sha256": "fdec4e26b25e217da83b6f6c82c014d4689a95dbb47fd14333cd01f4f870e97b"
         },
         {
           "path": "cloudflare-router-ab/build/deriver-b/index.js",
@@ -101,12 +101,12 @@
     },
     "signing-worker": {
       "entry": "cloudflare-router-ab/build/signing-worker/worker/shim.mjs",
-      "fingerprint": "65e15e1eaa5974a72bc1315d7fd5464c50839f81cf61694bc85ec803039c6057",
+      "fingerprint": "2d666492dbaa78826cedd663257c2eab86fe23ec5552a1b59b683717aebfbe3e",
       "files": [
         {
           "path": "cloudflare-router-ab/build/signing-worker/build-stamp.json",
           "bytes": 127,
-          "sha256": "c093ee338224ddc793eae6dbec9e8fde4d6cbb0e94ad9b241b20cd070a08060f"
+          "sha256": "1ace62b6964ee4b8b9ac30bb49f315890e2742be54e14c1b8ee78237f3e808c3"
         },
         {
           "path": "cloudflare-router-ab/build/signing-worker/index.js",
@@ -132,12 +132,12 @@
     },
     "tenant-root-control-plane": {
       "entry": "cloudflare-router-ab/build/tenant-root-control-plane/worker/shim.mjs",
-      "fingerprint": "9ad9ae1d8d3d969c8bc9c19566b30d9179c5a3dfb453fd493fa84622c6a7070e",
+      "fingerprint": "9fa94f9d652e8e36e68f318ff2a44be844ff398f6317d80467d0e0fa836d522f",
       "files": [
         {
           "path": "cloudflare-router-ab/build/tenant-root-control-plane/build-stamp.json",
           "bytes": 139,
-          "sha256": "12e3bdfda49b0076134fb773b9300b3fad6e13653a470130967e3f30f818c92c"
+          "sha256": "2e7804f6e031ad965621682f581c0540069c2a25a182dd763c80d7f4d75dd98a"
         },
         {
           "path": "cloudflare-router-ab/build/tenant-root-control-plane/index.js",

package/cloudflare-router-ab/build/deriver-a/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-a-entrypoint","started_at_ms":1794064320525}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-a-entrypoint","started_at_ms":1794125422353}

package/cloudflare-router-ab/build/deriver-b/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-b-entrypoint","started_at_ms":1794064470181}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-deriver-b-entrypoint","started_at_ms":1794125619132}

package/cloudflare-router-ab/build/router/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-router-entrypoint","started_at_ms":1794064608782}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-router-entrypoint","started_at_ms":1794125797895}

package/cloudflare-router-ab/build/signing-worker/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":true,"features":"strict-worker-signing-worker-entrypoint","started_at_ms":1794064086560}
+{"profile":"release","wallet_objects":true,"features":"strict-worker-signing-worker-entrypoint","started_at_ms":1794125116180}

package/cloudflare-router-ab/build/tenant-root-control-plane/build-stamp.json

@@ -1 +1 @@
-{"profile":"release","wallet_objects":false,"features":"strict-worker-tenant-root-control-plane-entrypoint","started_at_ms":1794064771371}
+{"profile":"release","wallet_objects":false,"features":"strict-worker-tenant-root-control-plane-entrypoint","started_at_ms":1794126001644}

package/dist/esm/hosted-wallet-gateway.js

@@ -44,6 +44,7 @@ import { handleRouterAbEd25519YaoRecoveryRequestScopedCloudflareV1 } from "./rou
 import { RouterAbEd25519YaoRecoveryWalletSessionAuthorizationAdapter } from "./router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryWalletSessionAuthorization.js";
 import "./cloud-host.js";
 import { WalletAuthorizationRelocationRoutes } from "./router/cloudflare/runtime/walletAuthorizationRelocationRoutes.js";
+import { createSpeakToSignVerifyRouteExtensions, readSpeakToSignVerifyConfig } from "./router/domains/speakToSign/speakToSignVerify.js";
 //#region src/hosted-wallet-gateway.ts
 function readStagingHostedWalletOrigins(env) {
 	return readEnvironmentCsv(requireEnvironmentString(env, "HOSTED_WALLET_ORIGINS"));
@@ -390,19 +391,27 @@ async function createHostedWalletGatewayCompositionV1(env, dependencies = {}, ba
 			registrationContext: dependencies.registrationContext,
 			signerDatabase: env.SIGNER_DB,
 			signerStorageNamespace: scope.namespace,
-			routeExtensions: [new WalletAuthorizationRelocationRoutes({
-				database: env.SIGNER_DB,
-				scope,
-				directory: env.WALLET_CONSOLE
-			}), new WalletPlacementRoutes({
-				emailOtp: service.relocationEmailOtp,
-				database: env.SIGNER_DB,
-				scope,
-				tenantId: tenantId.value,
-				allowedOrigins: readStagingHostedWalletOrigins(env).map(parseSessionOrigin),
-				authorizationSessions: service.authorizationSessions,
-				directory: env.WALLET_CONSOLE
-			})],
+			routeExtensions: [
+				new WalletAuthorizationRelocationRoutes({
+					database: env.SIGNER_DB,
+					scope,
+					directory: env.WALLET_CONSOLE
+				}),
+				new WalletPlacementRoutes({
+					emailOtp: service.relocationEmailOtp,
+					database: env.SIGNER_DB,
+					scope,
+					tenantId: tenantId.value,
+					allowedOrigins: readStagingHostedWalletOrigins(env).map(parseSessionOrigin),
+					authorizationSessions: service.authorizationSessions,
+					directory: env.WALLET_CONSOLE
+				}),
+				...createSpeakToSignVerifyRouteExtensions(readSpeakToSignVerifyConfig((name) => readEnvironmentString(env, name)), {
+					authorizationSessions: service.authorizationSessions,
+					walletRegistration: service.walletRegistration,
+					fetch: globalThis.fetch.bind(globalThis)
+				})
+			],
 			router: {
 				healthz: true,
 				readyz: true,

package/dist/esm/router/domains/speakToSign/speakToSignVerify.js

@@ -0,0 +1,254 @@
+import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
+import { NEAR_ED25519_MPC_OPERATION_KINDS } from "../../../shared-ts/src/authorization/capabilityKinds.js";
+import { routerAbMpcMaterialActivationRefToWire } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { hasExactKeys } from "../../../shared-ts/src/utils/exactKeys.js";
+import { extractBearerCredential } from "../../auth/routerApiKeyAuth.js";
+import { defineRoute } from "../../framework/routeDefinitions.js";
+import { resolveWalletSessionOperationCredentialAdmissionFromContext } from "../../auth/commonRouterUtils.js";
+//#region src/router/domains/speakToSign/speakToSignVerify.ts
+const SPEAK_TO_SIGN_VERIFY_PATH = "/speak-to-sign/v1/verify";
+/** 8 s of 16 kHz PCM16 is 256,000 bytes, about 341 KB in base64, with room for the fields. */
+const SPEAK_TO_SIGN_VERIFY_MAX_BODY_BYTES = 400 * 1024;
+/** The verifier calls two remote models; the whole flow has a 10 s budget. */
+const OUTLAYER_TIMEOUT_MS = 2e4;
+const OUTLAYER_RESOURCE_LIMITS = Object.freeze({
+	max_instructions: 1e10,
+	max_memory_mb: 128,
+	max_execution_seconds: 15
+});
+const ENV_NAMES = [
+	"SPEAK_TO_SIGN_OUTLAYER_BASE_URL",
+	"SPEAK_TO_SIGN_OUTLAYER_PROJECT",
+	"SPEAK_TO_SIGN_OUTLAYER_VERSION_KEY",
+	"SPEAK_TO_SIGN_OUTLAYER_PAYMENT_KEY",
+	"SPEAK_TO_SIGN_OUTLAYER_SECRETS_PROFILE",
+	"SPEAK_TO_SIGN_OUTLAYER_SECRETS_ACCOUNT_ID"
+];
+/** Null when no Speak-to-Sign variable is set. A partial set is a deployment error. */
+function readSpeakToSignVerifyConfig(read) {
+	const values = ENV_NAMES.map((name) => read(name)?.trim() || "");
+	if (values.every((value) => value === "")) return null;
+	const missing = ENV_NAMES.filter((_, index) => values[index] === "");
+	if (missing.length > 0) throw new Error(`Speak-to-Sign verify needs ${missing.join(", ")}`);
+	const [outlayerBaseUrl, project, versionKey, paymentKey, profile, accountId] = values;
+	return {
+		outlayerBaseUrl,
+		project,
+		versionKey,
+		paymentKey,
+		secretsRef: {
+			profile,
+			accountId
+		}
+	};
+}
+function createSpeakToSignVerifyRouteExtensions(config, dependencies) {
+	if (!config) return [];
+	return [new SpeakToSignVerifyRoutes(resolveConfig(config), dependencies)];
+}
+function resolveConfig(config) {
+	let base;
+	try {
+		base = new URL(config.outlayerBaseUrl);
+	} catch {
+		throw new Error("Speak-to-Sign OutLayer base URL is invalid");
+	}
+	if (base.protocol !== "https:" || base.username || base.password || base.search || base.hash) throw new Error("Speak-to-Sign OutLayer base URL must be a plain HTTPS URL");
+	if (!/^[a-z0-9._-]+\/[A-Za-z0-9._-]+$/.test(config.project)) throw new Error("Speak-to-Sign OutLayer project must be owner/project");
+	for (const [label, value] of [
+		["version key", config.versionKey],
+		["payment key", config.paymentKey],
+		["secrets profile", config.secretsRef.profile],
+		["secrets account", config.secretsRef.accountId]
+	]) if (!value || value.trim() !== value) throw new Error(`Speak-to-Sign OutLayer ${label} is required`);
+	return {
+		callUrl: `${base.origin}${base.pathname.replace(/\/+$/, "")}/call/${config.project}`,
+		versionKey: config.versionKey,
+		paymentKey: config.paymentKey,
+		secretsRef: {
+			profile: config.secretsRef.profile,
+			account_id: config.secretsRef.accountId
+		}
+	};
+}
+var SpeakToSignVerifyRoutes = class {
+	kind = "fetch_route_extension";
+	id = "speak_to_sign_verify";
+	routes = [defineRoute({
+		id: "speak_to_sign_verify",
+		surface: "relay",
+		method: "POST",
+		path: SPEAK_TO_SIGN_VERIFY_PATH,
+		auth: {
+			plane: "public",
+			rationale: "The handler requires an active Wallet Session operation credential."
+		},
+		metering: { kind: "none" },
+		summary: "Run the pinned OutLayer voice verifier for a spoken payment"
+	})];
+	now;
+	constructor(config, dependencies) {
+		this.config = config;
+		this.dependencies = dependencies;
+		this.now = dependencies.now ?? Date.now;
+	}
+	async handleFetchRoute(input) {
+		const startedAtMs = this.now();
+		const subject = await this.authenticate(input.request, startedAtMs);
+		if (!subject) return failure(401, "unauthorized");
+		const { walletId } = subject;
+		if (this.dependencies.rateLimit) {
+			if (!(await this.dependencies.rateLimit({ walletId })).allowed) return failure(429, "rate_limited");
+		}
+		const body = await readBoundedText(input.request, SPEAK_TO_SIGN_VERIFY_MAX_BODY_BYTES);
+		if (body === "too_large") return failure(413, "body_too_large");
+		const verifierInput = parseVerifyBody(body);
+		if (verifierInput === null) return failure(400, "invalid_body");
+		const owner = await this.sessionNearAccount(subject);
+		if (owner === null) return failure(403, "owner_unavailable");
+		if (verifierInput.owner !== owner) return failure(403, "owner_mismatch");
+		return await this.callVerifier(verifierInput, input.logger, startedAtMs);
+	}
+	async authenticate(request, nowMs) {
+		const token = extractBearerCredential(request.headers);
+		if (!token) return null;
+		const sessions = this.dependencies.authorizationSessions;
+		const context = await sessions.readWalletSessionAuthorizationV2ByOperationCredential({
+			tenantId: sessions.tenantId,
+			token,
+			nowMs
+		});
+		if (!context) return null;
+		if (resolveWalletSessionOperationCredentialAdmissionFromContext({
+			context,
+			nowMs,
+			operation: {
+				keyFamily: "ed25519",
+				operationKind: NEAR_ED25519_MPC_OPERATION_KINDS.signTransaction
+			}
+		}).kind !== "admitted") return null;
+		return {
+			walletId: context.authorization.session.walletId,
+			ed25519: context.authority.signerActivations.ed25519?.materialActivation ?? null
+		};
+	}
+	/** The NEAR account of the session's Ed25519 signer, or null when the wallet has none. */
+	async sessionNearAccount(subject) {
+		if (!subject.ed25519) return null;
+		const resolved = await this.dependencies.walletRegistration.resolveEd25519MaterialActivation({
+			walletId: String(subject.walletId),
+			materialActivation: routerAbMpcMaterialActivationRefToWire(subject.ed25519)
+		});
+		return resolved.ok ? resolved.nearAccountId : null;
+	}
+	async callVerifier(verifierInput, logger, startedAtMs) {
+		const outlayerStartedAtMs = this.now();
+		let response;
+		try {
+			response = await this.dependencies.fetch(this.config.callUrl, {
+				method: "POST",
+				headers: {
+					"content-type": "application/json",
+					"x-payment-key": this.config.paymentKey
+				},
+				body: JSON.stringify({
+					input: verifierInput,
+					async: false,
+					version_key: this.config.versionKey,
+					secrets_ref: this.config.secretsRef,
+					resource_limits: OUTLAYER_RESOURCE_LIMITS
+				}),
+				signal: AbortSignal.timeout(OUTLAYER_TIMEOUT_MS)
+			});
+		} catch (error) {
+			const timedOut = error instanceof DOMException && error.name === "TimeoutError";
+			logger.warn("[speak-to-sign] OutLayer call failed", { timedOut });
+			return failure(timedOut ? 504 : 502, timedOut ? "verifier_timeout" : "verifier_unreachable");
+		}
+		const outlayerMs = this.now() - outlayerStartedAtMs;
+		if (!response.ok) {
+			logger.warn("[speak-to-sign] OutLayer refused the call", { status: response.status });
+			return failure(...outlayerStatusFailure(response.status));
+		}
+		const output = readOutlayerOutput(await response.text());
+		if (output === null) {
+			logger.warn("[speak-to-sign] OutLayer returned no verifier output");
+			return failure(502, "verifier_failed");
+		}
+		return Response.json({
+			ok: true,
+			output,
+			timing: {
+				outlayerMs,
+				serverMs: this.now() - startedAtMs
+			}
+		}, { headers: { "cache-control": "no-store" } });
+	}
+};
+/** Body: `{ input }`, where `input` is the verifier input object. The server does not read it. */
+function parseVerifyBody(text) {
+	let raw;
+	try {
+		raw = JSON.parse(text);
+	} catch {
+		return null;
+	}
+	if (!hasExactKeys(raw, ["input"]) || !isPlainObject(raw.input)) return null;
+	return raw.input;
+}
+/** The verifier's own output, unchanged, or null when the run did not complete. */
+function readOutlayerOutput(text) {
+	let raw;
+	try {
+		raw = JSON.parse(text);
+	} catch {
+		return null;
+	}
+	if (!isPlainObject(raw) || raw.error != null) return null;
+	if (typeof raw.status === "string" && raw.status !== "completed") return null;
+	return raw.output ?? null;
+}
+function outlayerStatusFailure(status) {
+	if (status === 401 || status === 402 || status === 403) return [503, "verifier_payment_unavailable"];
+	if (status === 429) return [503, "verifier_busy"];
+	if (status >= 400 && status < 500) return [502, "verifier_rejected_request"];
+	return [502, "verifier_failed"];
+}
+async function readBoundedText(request, maximumBytes) {
+	const declared = Number(request.headers.get("content-length") ?? "0");
+	if (Number.isFinite(declared) && declared > maximumBytes) return "too_large";
+	if (!request.body) return "";
+	const reader = request.body.getReader();
+	const chunks = [];
+	let length = 0;
+	for (;;) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		length += value.length;
+		if (length > maximumBytes) {
+			await reader.cancel();
+			return "too_large";
+		}
+		chunks.push(value);
+	}
+	const bytes = new Uint8Array(length);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.length;
+	}
+	return new TextDecoder().decode(bytes);
+}
+function failure(status, code) {
+	return Response.json({
+		ok: false,
+		code
+	}, {
+		status,
+		headers: { "cache-control": "no-store" }
+	});
+}
+//#endregion
+export { SPEAK_TO_SIGN_VERIFY_MAX_BODY_BYTES, SPEAK_TO_SIGN_VERIFY_PATH, createSpeakToSignVerifyRouteExtensions, readSpeakToSignVerifyConfig };
+
+//# sourceMappingURL=speakToSignVerify.js.map

package/dist/types/wallet-server/src/hosted-wallet-gateway.d.ts

@@ -74,6 +74,12 @@ export interface CloudflareD1GatewayBaseEnv extends Readonly<Record<string, unkn
     readonly EMAIL_OTP_LOCKOUT_TTL_MS?: string;
     readonly EMAIL_OTP_GOOGLE_REGISTRATION_ATTEMPT_RATE_LIMIT_MAX?: string;
     readonly EMAIL_OTP_GOOGLE_REGISTRATION_ATTEMPT_RATE_LIMIT_WINDOW_MS?: string;
+    readonly SPEAK_TO_SIGN_OUTLAYER_BASE_URL?: string;
+    readonly SPEAK_TO_SIGN_OUTLAYER_PROJECT?: string;
+    readonly SPEAK_TO_SIGN_OUTLAYER_VERSION_KEY?: string;
+    readonly SPEAK_TO_SIGN_OUTLAYER_PAYMENT_KEY?: string;
+    readonly SPEAK_TO_SIGN_OUTLAYER_SECRETS_PROFILE?: string;
+    readonly SPEAK_TO_SIGN_OUTLAYER_SECRETS_ACCOUNT_ID?: string;
 }
 export declare function readStagingHostedWalletOrigins(env: Pick<CloudflareD1GatewayBaseEnv, 'HOSTED_WALLET_ORIGINS'>): string[];
 export interface CloudflareD1GatewayEnv extends CloudflareD1GatewayBaseEnv {

package/dist/types/wallet-server/src/router/domains/speakToSign/speakToSignVerify.d.ts

@@ -0,0 +1,40 @@
+import type { WalletId } from '../../../../../shared-ts/src/utils/domainIds';
+import type { RouterApiAuthorizationSessionService, RouterApiWalletRegistrationService } from '../../framework/authServicePort';
+import type { RouterApiRouteExtension } from '../../framework/routeExtensions';
+export declare const SPEAK_TO_SIGN_VERIFY_PATH = "/speak-to-sign/v1/verify";
+/** 8 s of 16 kHz PCM16 is 256,000 bytes, about 341 KB in base64, with room for the fields. */
+export declare const SPEAK_TO_SIGN_VERIFY_MAX_BODY_BYTES: number;
+/** The route exists only when the server configuration holds every field. */
+export type SpeakToSignVerifyConfig = Readonly<{
+    /** For example `https://api.outlayer.fastnear.com`. */
+    outlayerBaseUrl: string;
+    /** `owner/project`, for example `seams-v1.testnet/voice-verifier`. */
+    project: string;
+    /** The WASM hash of the pinned verifier version. */
+    versionKey: string;
+    /** The OutLayer payment key. It goes only into the X-Payment-Key header. */
+    paymentKey: string;
+    secretsRef: Readonly<{
+        profile: string;
+        accountId: string;
+    }>;
+}>;
+export type SpeakToSignVerifyRateLimit = (input: {
+    readonly walletId: WalletId;
+}) => Promise<{
+    readonly allowed: boolean;
+}>;
+export type SpeakToSignVerifyDependencies = Readonly<{
+    authorizationSessions: Pick<RouterApiAuthorizationSessionService, 'tenantId' | 'readWalletSessionAuthorizationV2ByOperationCredential'>;
+    /** Resolves the NEAR account of the session's Ed25519 signer for the owner check. */
+    walletRegistration: Pick<RouterApiWalletRegistrationService, 'resolveEd25519MaterialActivation'>;
+    fetch: typeof fetch;
+    rateLimit?: SpeakToSignVerifyRateLimit;
+    now?: () => number;
+}>;
+declare const ENV_NAMES: readonly ['SPEAK_TO_SIGN_OUTLAYER_BASE_URL', 'SPEAK_TO_SIGN_OUTLAYER_PROJECT', 'SPEAK_TO_SIGN_OUTLAYER_VERSION_KEY', 'SPEAK_TO_SIGN_OUTLAYER_PAYMENT_KEY', 'SPEAK_TO_SIGN_OUTLAYER_SECRETS_PROFILE', 'SPEAK_TO_SIGN_OUTLAYER_SECRETS_ACCOUNT_ID'];
+/** Null when no Speak-to-Sign variable is set. A partial set is a deployment error. */
+export declare function readSpeakToSignVerifyConfig(read: (name: (typeof ENV_NAMES)[number]) => string | undefined): SpeakToSignVerifyConfig | null;
+export declare function createSpeakToSignVerifyRouteExtensions(config: SpeakToSignVerifyConfig | null, dependencies: SpeakToSignVerifyDependencies): readonly RouterApiRouteExtension[];
+export {};
+//# sourceMappingURL=speakToSignVerify.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seams/wallet-server",
-  "version": "0.53.0",
+  "version": "0.54.0",
   "type": "module",
   "description": "Seams server TypeScript SDK for NEAR and EVM-family wallets",
   "main": "./dist/esm/index.js",