@seams/wallet-server 0.6.0 → 0.6.1

package/dist/esm/router/express.js

@@ -7904,6 +7904,9 @@ function isEmailOtpWalletRegistrationActivateSuccessV2(result) {
 function isPasskeyWalletRegistrationActivateSuccessV2(result) {
 	return result.authMethod.kind === "passkey";
 }
+function isPasskeyWalletRegistrationNearProvisioningSuccessV2(result) {
+	return result.authMethod.kind === "passkey";
+}
 function walletRegistrationRoutePolicyServices(input) {
 	const service = input.services.walletRegistration;
 	return {
@@ -9477,13 +9480,62 @@ async function handleRouterApiWalletRegistrationRespond(input) {
 	if (!session) return routeError(500, "internal", "wallet registration respond requires session signing");
 	const parsed = parseWalletRegistrationRespondRequest(input.body);
 	if (!parsed.ok) return routeError(400, parsed.code, parsed.message);
+	const serverTiming = [];
 	const result = await input.services.walletRegistration.respondWalletRegistration({
 		...parsed.value,
 		verifier: session,
 		...registrationUserAgentFromHeaders(input.headers) ? { userAgent: registrationUserAgentFromHeaders(input.headers) } : {}
-	}, traceContext.value ?? void 0);
+	}, traceContext.value ?? void 0, serverTiming);
+	return routeJson(result.ok ? 200 : 400, result, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
+}
+async function handleRouterApiWalletRegistrationNearAdmission(input) {
+	const traceContext = parseRegistrationTraceContext(input.headers);
+	if (!traceContext.ok) return routeError(400, "invalid_trace_id", traceContext.message);
+	if (!isPlainObject$1(input.body)) return routeError(400, "invalid_body", "JSON body required");
+	const session = input.services.session;
+	if (!session) return routeError(500, "internal", "NEAR admission requires setup verification");
+	const body = input.body;
+	const registrationCeremonyId = String(body.registrationCeremonyId || "").trim();
+	const signedSetup = String(body.signedSetup || "").trim();
+	if (!registrationCeremonyId || !signedSetup) return routeError(400, "invalid_body", "registrationCeremonyId and signedSetup are required");
+	const authority = parseWalletRegistrationAuthorityProof(body);
+	if (!authority.ok) return routeError(400, authority.code, authority.message);
+	const result = await input.services.walletRegistration.authorizeWalletRegistrationNearAdmission({
+		registrationCeremonyId,
+		signedSetup,
+		authority: authority.value,
+		verifier: session,
+		...registrationUserAgentFromHeaders(input.headers) ? { userAgent: registrationUserAgentFromHeaders(input.headers) } : {}
+	});
 	return routeJson(result.ok ? 200 : 400, result);
 }
+function parseWalletRegistrationAuthorityProof(body) {
+	const hasWebAuthn = Object.prototype.hasOwnProperty.call(body, "webauthn_registration");
+	if (hasWebAuthn === Object.prototype.hasOwnProperty.call(body, "emailOtpRegistrationProof")) return {
+		ok: false,
+		code: "invalid_body",
+		message: "exactly one registration authority proof is required"
+	};
+	if (hasWebAuthn) return {
+		ok: true,
+		value: {
+			kind: "passkey",
+			webauthnRegistration: body.webauthn_registration
+		}
+	};
+	const proof = normalizeEmailOtpRegistrationProof(body.emailOtpRegistrationProof);
+	return proof ? {
+		ok: true,
+		value: {
+			kind: "email_otp",
+			emailOtpRegistrationProof: proof
+		}
+	} : {
+		ok: false,
+		code: "invalid_body",
+		message: "emailOtpRegistrationProof is invalid"
+	};
+}
 /**
 * Parses respond's public body. `signedSetup` stays an opaque string here —
 * the service verifies it; parsing its contents at the boundary would invite
@@ -9518,29 +9570,9 @@ function parseWalletRegistrationRespondRequest(body) {
 		code: "invalid_body",
 		message: "an Ed25519-only respond carries no ECDSA registration"
 	};
-	const hasWebAuthn = Object.prototype.hasOwnProperty.call(body, "webauthn_registration");
-	if (hasWebAuthn === Object.prototype.hasOwnProperty.call(body, "emailOtpRegistrationProof")) return {
-		ok: false,
-		code: "invalid_body",
-		message: "exactly one registration authority proof is required"
-	};
-	let authority;
-	if (hasWebAuthn) authority = {
-		kind: "passkey",
-		webauthnRegistration: body.webauthn_registration
-	};
-	else {
-		const proof = normalizeEmailOtpRegistrationProof(body.emailOtpRegistrationProof);
-		if (!proof) return {
-			ok: false,
-			code: "invalid_body",
-			message: "emailOtpRegistrationProof is invalid"
-		};
-		authority = {
-			kind: "email_otp",
-			emailOtpRegistrationProof: proof
-		};
-	}
+	const parsedAuthority = parseWalletRegistrationAuthorityProof(body);
+	if (!parsedAuthority.ok) return parsedAuthority;
+	const authority = parsedAuthority.value;
 	if (planKind === "near_ed25519") return {
 		ok: true,
 		value: {
@@ -9667,6 +9699,7 @@ async function handleRouterApiWalletRegistrationActivate(input) {
 	} catch {
 		return routeError(400, "invalid_body", "ECDSA activation facts are invalid");
 	}
+	const serverTiming = [];
 	const result = await input.services.walletRegistration.activateWalletRegistration({
 		registrationCeremonyId,
 		signedSetup,
@@ -9676,7 +9709,7 @@ async function handleRouterApiWalletRegistrationActivate(input) {
 		...body.emailOtpEnrollment ? { emailOtpEnrollment: body.emailOtpEnrollment } : {},
 		...body.walletCustodyCommit !== void 0 ? { walletCustodyCommit: body.walletCustodyCommit } : {},
 		verifier: session
-	}, traceContext.value ?? void 0);
+	}, traceContext.value ?? void 0, serverTiming);
 	if (!result.ok) return routeJson(400, result);
 	if (!isEmailOtpWalletRegistrationActivateSuccessV2(result) && !isPasskeyWalletRegistrationActivateSuccessV2(result)) return routeError(500, "internal", "Wallet registration activation returned an invalid authority");
 	const projectionError = await projectActivatedWallet({
@@ -9685,7 +9718,7 @@ async function handleRouterApiWalletRegistrationActivate(input) {
 		signedSetup
 	});
 	if (projectionError) return routeError(500, "internal", `Wallet was created but its Console projection failed: ${projectionError}`);
-	return routeJson(200, result);
+	return routeJson(200, result, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
 }
 /**
 * Refactor 94C. `POST /wallets/register/near-provisioning` — the non-blocking
@@ -9703,6 +9736,9 @@ async function handleRouterApiWalletRegistrationNearProvisioning(input) {
 	if (!registrationCeremonyId || !signedSetup || !idempotencyKey) return routeError(400, "invalid_body", "registrationCeremonyId, signedSetup and idempotencyKey are required");
 	const ed25519 = parseWalletRegistrationEd25519Finalize(body.ed25519);
 	if (!ed25519.ok) return routeError(400, ed25519.code, ed25519.message);
+	const sessionSeal = parseRegistrationPreparedSessionSeal(body.sessionSeal);
+	if (!sessionSeal.ok) return routeError(400, sessionSeal.code, sessionSeal.message);
+	const serverTiming = [];
 	const result = await input.services.walletRegistration.completeWalletRegistrationNearProvisioning({
 		authorization: registrationContinuationAuthorization(input.headers),
 		registrationCeremonyId,
@@ -9712,9 +9748,110 @@ async function handleRouterApiWalletRegistrationNearProvisioning(input) {
 		emailOtpEnrollment: body.emailOtpEnrollment,
 		...body.walletCustodyCommit !== void 0 ? { walletCustodyCommit: body.walletCustodyCommit } : {},
 		verifier: session
-	});
+	}, serverTiming);
 	if (!result.ok) return routeJson(400, result);
-	return routeJson(200, result);
+	if (sessionSeal.value) {
+		if (!isPasskeyWalletRegistrationNearProvisioningSuccessV2(result)) return routeError(400, "invalid_body", "Registration session sealing requires a passkey authority");
+		const sealStartedAt = Date.now();
+		const sealed = await applyRegistrationPreparedSessionSeal({
+			options: input.signingSessionSeal,
+			request: sessionSeal.value,
+			response: result
+		});
+		serverTiming.push(["near_finalize_session_seal", Math.max(0, Date.now() - sealStartedAt)]);
+		if (!sealed.ok) return routeJson(503, {
+			ok: false,
+			code: sealed.code,
+			message: sealed.message
+		}, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
+		return routeJson(200, {
+			...result,
+			sessionSeal: sealed.value
+		}, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
+	}
+	return routeJson(200, result, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
+}
+function parseRegistrationPreparedSessionSeal(raw) {
+	if (raw === void 0) return {
+		ok: true,
+		value: void 0
+	};
+	if (!isPlainObject$1(raw)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "sessionSeal must be an object"
+	};
+	if (Object.keys(raw).some((field) => ![
+		"thresholdSessionId",
+		"ciphertext",
+		"keyVersion"
+	].includes(field))) return {
+		ok: false,
+		code: "invalid_body",
+		message: "sessionSeal has unknown fields"
+	};
+	const thresholdSessionId = String(raw.thresholdSessionId || "").trim();
+	const ciphertext = String(raw.ciphertext || "").trim();
+	const keyVersion = String(raw.keyVersion || "").trim();
+	if (!thresholdSessionId || !ciphertext) return {
+		ok: false,
+		code: "invalid_body",
+		message: "sessionSeal thresholdSessionId and ciphertext are required"
+	};
+	return {
+		ok: true,
+		value: {
+			thresholdSessionId,
+			ciphertext,
+			...keyVersion ? { keyVersion } : {}
+		}
+	};
+}
+async function applyRegistrationPreparedSessionSeal(args) {
+	if (!args.options) return {
+		ok: false,
+		code: "signing_session_seal_unavailable",
+		message: "Signing-session sealing is unavailable"
+	};
+	const session = args.response.registrationEstablishedSession.session;
+	const tokens = session.tokens;
+	const ed25519 = tokens.kind === "near_ed25519" || tokens.kind === "near_ed25519_and_evm_family_ecdsa" ? tokens.ed25519 : null;
+	if (!ed25519 || String(ed25519.thresholdSessionId) !== args.request.thresholdSessionId) return {
+		ok: false,
+		code: "invalid_session_seal",
+		message: "Prepared seal does not match the established Ed25519 session"
+	};
+	const sealed = await args.options.service.applyServerSeal(args.request, {
+		userId: String(session.walletId),
+		session: {
+			kind: "exact_wallet_session_operation_credential",
+			curve: "ed25519",
+			thresholdSessionId: args.request.thresholdSessionId,
+			userId: String(session.walletId),
+			expiresAtMs: session.expiresAtMs
+		}
+	});
+	if (!sealed.ok) return sealed;
+	const keyVersion = String(sealed.keyVersion || "").trim();
+	if (!keyVersion) return {
+		ok: false,
+		code: "invalid_session_seal",
+		message: "Signing-session seal response is missing its key version"
+	};
+	return {
+		ok: true,
+		value: {
+			ciphertext: sealed.ciphertext,
+			keyVersion,
+			expiresAtMs: Math.min(sealed.expiresAtMs ?? session.expiresAtMs, session.expiresAtMs),
+			remainingUses: session.remainingUses
+		}
+	};
+}
+function ecdsaGatewayServerTimingHeaders(serverTiming) {
+	if (serverTiming.length === 0) return void 0;
+	const header = serverTiming.map(([name, durationMs]) => `${name};dur=${Math.max(0, durationMs).toFixed(1)}`).join(", ");
+	return { "Server-Timing": header };
 }
 async function handleRouterApiWalletAddSignerStart(input) {
 	if (!isPlainObject$1(input.body)) return routeError(400, "invalid_body", "JSON body required");
@@ -10622,6 +10759,10 @@ function createRouterApiRouteDefinitions(options = {}) {
 		plane: "public",
 		proof: "webauthn",
 		rationale: "Registration respond is authorized by the signed setup payload and the registration authority proof."
+	}, ROUTER_API_WALLET_REGISTRATION_SESSION_SERVICES), publicRoute("wallet_registration_near_admission", "POST", "/wallets/register/near-admission", "Authorize deferred NEAR registration while ECDSA respond runs", {
+		plane: "public",
+		proof: "webauthn",
+		rationale: "NEAR admission is authorized by the signed setup payload and the registration authority proof."
 	}, ROUTER_API_WALLET_REGISTRATION_SESSION_SERVICES), publicRoute("wallet_registration_activate", "POST", "/wallets/register/activate", "Activate and finalize one wallet ECDSA registration", {
 		plane: "public",
 		proof: "threshold_protocol_state",
@@ -10795,6 +10936,7 @@ function createRouterApiRouteDefinitions(options = {}) {
 const ROUTE_IDS = [
 	"wallet_registration_setup",
 	"wallet_registration_respond",
+	"wallet_registration_near_admission",
 	"wallet_registration_activate",
 	"wallet_registration_near_provisioning",
 	"wallet_add_signer_intent",
@@ -10850,9 +10992,64 @@ async function handleWalletRegistration(ctx) {
 			publishableKeyAuth: ctx.opts.publishableKeyAuth,
 			walletProjection: ctx.opts.walletProjection
 		},
-		sourceIp: resolveSourceIpFromFetchHeaders(ctx.request.headers) || void 0
+		sourceIp: resolveSourceIpFromFetchHeaders(ctx.request.headers) || void 0,
+		signingSessionSeal: ctx.opts.signingSessionSeal
 	};
-	return toFetchRouteResponse(route.id === "wallet_registration_setup" ? await handleRouterApiWalletRegistrationSetup(common) : route.id === "wallet_registration_respond" ? await handleRouterApiWalletRegistrationRespond(common) : route.id === "wallet_registration_activate" ? await handleRouterApiWalletRegistrationActivate(common) : route.id === "wallet_registration_near_provisioning" ? await handleRouterApiWalletRegistrationNearProvisioning(common) : route.id === "wallet_add_signer_intent" ? await handleRouterApiWalletAddSignerIntent(common) : route.id === "wallet_add_signer_start" ? await handleRouterApiWalletAddSignerStart(common) : route.id === "wallet_add_signer_ecdsa_derivation_respond" ? await handleRouterApiWalletAddSignerEcdsaDerivationRespond(common) : route.id === "wallet_add_signer_ecdsa_activation" ? await handleRouterApiWalletAddSignerEcdsaActivation(common) : route.id === "wallet_add_signer_finalize" ? await handleRouterApiWalletAddSignerFinalize(common) : route.id === "wallet_add_auth_method_intent" ? await handleRouterApiWalletAddAuthMethodIntent(common) : route.id === "wallet_add_auth_method_email_otp_challenge" ? await handleRouterApiWalletAddAuthMethodEmailOtpChallenge(common) : route.id === "wallet_add_auth_method_start" ? await handleRouterApiWalletAddAuthMethodStart(common) : route.id === "wallet_add_auth_method_finalize" ? await handleRouterApiWalletAddAuthMethodFinalize(common) : route.id === "wallet_revoke_auth_method" ? await handleRouterApiWalletRevokeAuthMethod(common) : route.id === "wallet_ecdsa_key_facts_inventory" ? await handleRouterApiWalletEcdsaKeyFactsInventory(common) : await handleRouterApiWalletNearImplicitAccountFund(common));
+	let response;
+	switch (route.id) {
+		case "wallet_registration_setup":
+			response = await handleRouterApiWalletRegistrationSetup(common);
+			break;
+		case "wallet_registration_respond":
+			response = await handleRouterApiWalletRegistrationRespond(common);
+			break;
+		case "wallet_registration_near_admission":
+			response = await handleRouterApiWalletRegistrationNearAdmission(common);
+			break;
+		case "wallet_registration_activate":
+			response = await handleRouterApiWalletRegistrationActivate(common);
+			break;
+		case "wallet_registration_near_provisioning":
+			response = await handleRouterApiWalletRegistrationNearProvisioning(common);
+			break;
+		case "wallet_add_signer_intent":
+			response = await handleRouterApiWalletAddSignerIntent(common);
+			break;
+		case "wallet_add_signer_start":
+			response = await handleRouterApiWalletAddSignerStart(common);
+			break;
+		case "wallet_add_signer_ecdsa_derivation_respond":
+			response = await handleRouterApiWalletAddSignerEcdsaDerivationRespond(common);
+			break;
+		case "wallet_add_signer_ecdsa_activation":
+			response = await handleRouterApiWalletAddSignerEcdsaActivation(common);
+			break;
+		case "wallet_add_signer_finalize":
+			response = await handleRouterApiWalletAddSignerFinalize(common);
+			break;
+		case "wallet_add_auth_method_intent":
+			response = await handleRouterApiWalletAddAuthMethodIntent(common);
+			break;
+		case "wallet_add_auth_method_email_otp_challenge":
+			response = await handleRouterApiWalletAddAuthMethodEmailOtpChallenge(common);
+			break;
+		case "wallet_add_auth_method_start":
+			response = await handleRouterApiWalletAddAuthMethodStart(common);
+			break;
+		case "wallet_add_auth_method_finalize":
+			response = await handleRouterApiWalletAddAuthMethodFinalize(common);
+			break;
+		case "wallet_revoke_auth_method":
+			response = await handleRouterApiWalletRevokeAuthMethod(common);
+			break;
+		case "wallet_ecdsa_key_facts_inventory":
+			response = await handleRouterApiWalletEcdsaKeyFactsInventory(common);
+			break;
+		default:
+			response = await handleRouterApiWalletNearImplicitAccountFund(common);
+			break;
+	}
+	return toFetchRouteResponse(response);
 }
 //#endregion
 //#region ../shared-ts/src/utils/errors.ts

package/dist/esm/router/framework/routeDefinitions.js

@@ -272,6 +272,10 @@ function createRouterApiRouteDefinitions(options = {}) {
 		plane: "public",
 		proof: "webauthn",
 		rationale: "Registration respond is authorized by the signed setup payload and the registration authority proof."
+	}, ROUTER_API_WALLET_REGISTRATION_SESSION_SERVICES), publicRoute("wallet_registration_near_admission", "POST", "/wallets/register/near-admission", "Authorize deferred NEAR registration while ECDSA respond runs", {
+		plane: "public",
+		proof: "webauthn",
+		rationale: "NEAR admission is authorized by the signed setup payload and the registration authority proof."
 	}, ROUTER_API_WALLET_REGISTRATION_SESSION_SERVICES), publicRoute("wallet_registration_activate", "POST", "/wallets/register/activate", "Activate and finalize one wallet ECDSA registration", {
 		plane: "public",
 		proof: "threshold_protocol_state",

package/dist/esm/router/transport/fetch/routes/walletRegistration.js

@@ -2,12 +2,13 @@ import { findRouteDefinitionById, matchesRouteDefinitionRequest } from "../../..
 import { readJson } from "../../../framework/http.js";
 import { resolveSourceIpFromFetchHeaders } from "../../../auth/routerApiKeyAuth.js";
 import { toFetchRouteResponse } from "../../../framework/routeResponses.js";
-import { handleRouterApiWalletAddAuthMethodEmailOtpChallenge, handleRouterApiWalletAddAuthMethodFinalize, handleRouterApiWalletAddAuthMethodIntent, handleRouterApiWalletAddAuthMethodStart, handleRouterApiWalletAddSignerEcdsaActivation, handleRouterApiWalletAddSignerEcdsaDerivationRespond, handleRouterApiWalletAddSignerFinalize, handleRouterApiWalletAddSignerIntent, handleRouterApiWalletAddSignerStart, handleRouterApiWalletEcdsaKeyFactsInventory, handleRouterApiWalletNearImplicitAccountFund, handleRouterApiWalletRegistrationActivate, handleRouterApiWalletRegistrationNearProvisioning, handleRouterApiWalletRegistrationRespond, handleRouterApiWalletRegistrationSetup, handleRouterApiWalletRevokeAuthMethod } from "../../../domains/walletRegistration/walletRegistrationRoutes.js";
+import { handleRouterApiWalletAddAuthMethodEmailOtpChallenge, handleRouterApiWalletAddAuthMethodFinalize, handleRouterApiWalletAddAuthMethodIntent, handleRouterApiWalletAddAuthMethodStart, handleRouterApiWalletAddSignerEcdsaActivation, handleRouterApiWalletAddSignerEcdsaDerivationRespond, handleRouterApiWalletAddSignerFinalize, handleRouterApiWalletAddSignerIntent, handleRouterApiWalletAddSignerStart, handleRouterApiWalletEcdsaKeyFactsInventory, handleRouterApiWalletNearImplicitAccountFund, handleRouterApiWalletRegistrationActivate, handleRouterApiWalletRegistrationNearAdmission, handleRouterApiWalletRegistrationNearProvisioning, handleRouterApiWalletRegistrationRespond, handleRouterApiWalletRegistrationSetup, handleRouterApiWalletRevokeAuthMethod } from "../../../domains/walletRegistration/walletRegistrationRoutes.js";
 import { routerApiWalletRegistrationRouteService } from "../../../framework/authServicePort.js";
 //#region src/router/transport/fetch/routes/walletRegistration.ts
 const ROUTE_IDS = [
 	"wallet_registration_setup",
 	"wallet_registration_respond",
+	"wallet_registration_near_admission",
 	"wallet_registration_activate",
 	"wallet_registration_near_provisioning",
 	"wallet_add_signer_intent",
@@ -63,9 +64,64 @@ async function handleWalletRegistration(ctx) {
 			publishableKeyAuth: ctx.opts.publishableKeyAuth,
 			walletProjection: ctx.opts.walletProjection
 		},
-		sourceIp: resolveSourceIpFromFetchHeaders(ctx.request.headers) || void 0
+		sourceIp: resolveSourceIpFromFetchHeaders(ctx.request.headers) || void 0,
+		signingSessionSeal: ctx.opts.signingSessionSeal
 	};
-	return toFetchRouteResponse(route.id === "wallet_registration_setup" ? await handleRouterApiWalletRegistrationSetup(common) : route.id === "wallet_registration_respond" ? await handleRouterApiWalletRegistrationRespond(common) : route.id === "wallet_registration_activate" ? await handleRouterApiWalletRegistrationActivate(common) : route.id === "wallet_registration_near_provisioning" ? await handleRouterApiWalletRegistrationNearProvisioning(common) : route.id === "wallet_add_signer_intent" ? await handleRouterApiWalletAddSignerIntent(common) : route.id === "wallet_add_signer_start" ? await handleRouterApiWalletAddSignerStart(common) : route.id === "wallet_add_signer_ecdsa_derivation_respond" ? await handleRouterApiWalletAddSignerEcdsaDerivationRespond(common) : route.id === "wallet_add_signer_ecdsa_activation" ? await handleRouterApiWalletAddSignerEcdsaActivation(common) : route.id === "wallet_add_signer_finalize" ? await handleRouterApiWalletAddSignerFinalize(common) : route.id === "wallet_add_auth_method_intent" ? await handleRouterApiWalletAddAuthMethodIntent(common) : route.id === "wallet_add_auth_method_email_otp_challenge" ? await handleRouterApiWalletAddAuthMethodEmailOtpChallenge(common) : route.id === "wallet_add_auth_method_start" ? await handleRouterApiWalletAddAuthMethodStart(common) : route.id === "wallet_add_auth_method_finalize" ? await handleRouterApiWalletAddAuthMethodFinalize(common) : route.id === "wallet_revoke_auth_method" ? await handleRouterApiWalletRevokeAuthMethod(common) : route.id === "wallet_ecdsa_key_facts_inventory" ? await handleRouterApiWalletEcdsaKeyFactsInventory(common) : await handleRouterApiWalletNearImplicitAccountFund(common));
+	let response;
+	switch (route.id) {
+		case "wallet_registration_setup":
+			response = await handleRouterApiWalletRegistrationSetup(common);
+			break;
+		case "wallet_registration_respond":
+			response = await handleRouterApiWalletRegistrationRespond(common);
+			break;
+		case "wallet_registration_near_admission":
+			response = await handleRouterApiWalletRegistrationNearAdmission(common);
+			break;
+		case "wallet_registration_activate":
+			response = await handleRouterApiWalletRegistrationActivate(common);
+			break;
+		case "wallet_registration_near_provisioning":
+			response = await handleRouterApiWalletRegistrationNearProvisioning(common);
+			break;
+		case "wallet_add_signer_intent":
+			response = await handleRouterApiWalletAddSignerIntent(common);
+			break;
+		case "wallet_add_signer_start":
+			response = await handleRouterApiWalletAddSignerStart(common);
+			break;
+		case "wallet_add_signer_ecdsa_derivation_respond":
+			response = await handleRouterApiWalletAddSignerEcdsaDerivationRespond(common);
+			break;
+		case "wallet_add_signer_ecdsa_activation":
+			response = await handleRouterApiWalletAddSignerEcdsaActivation(common);
+			break;
+		case "wallet_add_signer_finalize":
+			response = await handleRouterApiWalletAddSignerFinalize(common);
+			break;
+		case "wallet_add_auth_method_intent":
+			response = await handleRouterApiWalletAddAuthMethodIntent(common);
+			break;
+		case "wallet_add_auth_method_email_otp_challenge":
+			response = await handleRouterApiWalletAddAuthMethodEmailOtpChallenge(common);
+			break;
+		case "wallet_add_auth_method_start":
+			response = await handleRouterApiWalletAddAuthMethodStart(common);
+			break;
+		case "wallet_add_auth_method_finalize":
+			response = await handleRouterApiWalletAddAuthMethodFinalize(common);
+			break;
+		case "wallet_revoke_auth_method":
+			response = await handleRouterApiWalletRevokeAuthMethod(common);
+			break;
+		case "wallet_ecdsa_key_facts_inventory":
+			response = await handleRouterApiWalletEcdsaKeyFactsInventory(common);
+			break;
+		default:
+			response = await handleRouterApiWalletNearImplicitAccountFund(common);
+			break;
+	}
+	return toFetchRouteResponse(response);
 }
 //#endregion
 export { handleWalletRegistration };

package/dist/types/wallet-server/src/core/threeRouteRegistrationContracts.d.ts

@@ -294,6 +294,11 @@ export type WalletRegistrationRespondResponseV2 = ({
     ok: true;
     registrationCeremonyId: string;
 } & WalletRegistrationRespondSignerPlanV2) | WalletRegistrationRouteErrorV2;
+export type WalletRegistrationNearAdmissionResponseV2 = {
+    readonly ok: true;
+    readonly registrationCeremonyId: string;
+    readonly ed25519: RespondEd25519DeferredWorkV2;
+} | WalletRegistrationRouteErrorV2;
 /**
  * Route 3 — activate-and-finalize; the operation row is the replay record.
  *
@@ -414,16 +419,40 @@ export type WalletRegistrationNearProvisioningRequestV2 = {
         kind: 'near_ed25519';
     }>['ed25519'];
     emailOtpEnrollment?: NonNullable<WalletRegistrationFinalizeRequest['emailOtpEnrollment']>;
+    sessionSeal?: {
+        readonly thresholdSessionId: string;
+        readonly ciphertext: string;
+        readonly keyVersion?: string;
+    };
 };
-type WalletRegistrationNearProvisioningSuccessV2 = Extract<WalletRegistrationFinalizeResponse, {
+type WalletRegistrationNearProvisioningFinalizeSuccessV2 = Extract<WalletRegistrationFinalizeResponse, {
     ok: true;
     kind: 'near_ed25519';
-}> & {
+}>;
+type WalletRegistrationNearProvisioningSuccessBaseV2 = {
     registrationEstablishedSession: RegistrationEstablishedSessionResultV2;
     nearProvisioning: {
         status: 'near_ready';
     };
 };
+type WalletRegistrationNearProvisioningSuccessV2 = (Extract<WalletRegistrationNearProvisioningFinalizeSuccessV2, {
+    authMethod: {
+        kind: 'passkey';
+    };
+}> & WalletRegistrationNearProvisioningSuccessBaseV2 & {
+    sessionSeal?: {
+        readonly ciphertext: string;
+        readonly keyVersion: string;
+        readonly expiresAtMs: number;
+        readonly remainingUses: number;
+    };
+}) | (Extract<WalletRegistrationNearProvisioningFinalizeSuccessV2, {
+    authMethod: {
+        kind: 'email_otp';
+    };
+}> & WalletRegistrationNearProvisioningSuccessBaseV2 & {
+    sessionSeal?: never;
+});
 export type WalletRegistrationNearProvisioningResponseV2 = WalletRegistrationNearProvisioningSuccessV2 | (WalletRegistrationRouteErrorV2 & {
     /**
      * A retryable failure leaves the pending wallet intact and the call

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationService.d.ts

@@ -17,8 +17,8 @@ import { CloudflareD1RegistrationCeremonyIntentStore } from './d1RegistrationCer
 import type { InstalledLinkedDeviceEcdsaAuthorityProjectionV1, InstalledLinkedDeviceEd25519AuthorityProjectionV1 } from '../deviceLinking/d1LinkedDeviceAuthorityInstallService';
 import { type ThresholdEcdsaKeyInventoryDiagnostics, type ThresholdEcdsaKeyInventoryRecord } from '../../../../core/authService/thresholdEcdsaKeyInventory';
 import { type StoredWalletRegistrationEvmFamilyEcdsaPendingActivationBranch } from '../../../../core/RegistrationCeremonyStore';
-import type { WalletRegistrationNearProvisioningResponseV2, WalletRegistrationActivateResponseV2, WalletRegistrationRespondResponseV2, WalletRegistrationSetupResponseV2, WalletRegistrationSessionCommitReceiptV2 } from '../../../../core/threeRouteRegistrationContracts';
-import type { WalletRegistrationSetupInput, WalletRegistrationRespondInput, WalletRegistrationActivateInput, WalletRegistrationNearProvisioningInput } from '../../../domains/walletRegistration/walletRegistrationInputs';
+import type { WalletRegistrationNearProvisioningResponseV2, WalletRegistrationNearAdmissionResponseV2, WalletRegistrationActivateResponseV2, WalletRegistrationRespondResponseV2, WalletRegistrationSetupResponseV2, WalletRegistrationSessionCommitReceiptV2 } from '../../../../core/threeRouteRegistrationContracts';
+import type { WalletRegistrationSetupInput, WalletRegistrationRespondInput, WalletRegistrationActivateInput, WalletRegistrationNearProvisioningInput, WalletRegistrationNearAdmissionInput } from '../../../domains/walletRegistration/walletRegistrationInputs';
 import type { CloudflareD1WalletCustodyCommitStore } from '../passkeyCustody/d1WalletCustodyCommitStore';
 import { CloudflareD1EmailOtpRegistrationEnrollmentFinalizer } from '../emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer';
 import { CloudflareD1WalletAuthMethodService } from '../wallet/d1WalletAuthMethodService';
@@ -272,7 +272,8 @@ export declare class CloudflareD1WalletRegistrationService {
      * can invalidate the other.
      */
     setupWalletRegistration(input: WalletRegistrationSetupInput): Promise<WalletRegistrationSetupResponseV2>;
-    respondWalletRegistration(input: WalletRegistrationRespondInput, traceContext?: RouterAbTraceContextV1): Promise<WalletRegistrationRespondResponseV2>;
+    authorizeWalletRegistrationNearAdmission(input: WalletRegistrationNearAdmissionInput): Promise<WalletRegistrationNearAdmissionResponseV2>;
+    respondWalletRegistration(input: WalletRegistrationRespondInput, traceContext?: RouterAbTraceContextV1, timingSink?: Array<readonly [string, number]>): Promise<WalletRegistrationRespondResponseV2>;
     /**
      * The Ed25519 commit core, extracted so deferred provisioning reaches it
      * without going through the standalone finalize wrapper. The operation row
@@ -286,6 +287,7 @@ export declare class CloudflareD1WalletRegistrationService {
         readonly lifecycleId: string;
         readonly credential: string;
     }): Promise<VerifiedNearRegistrationContinuationV1 | null>;
+    private readNearRegistrationContinuationContext;
     private readCommittedRegistrationInstallation;
     private prepareNearProvisioningOperation;
     private commitDeferredEd25519Signer;
@@ -301,7 +303,7 @@ export declare class CloudflareD1WalletRegistrationService {
      * be destroyed because its signer ceremony needs another attempt.
      */
     private verifyNearProvisioningAuthority;
-    completeWalletRegistrationNearProvisioning(input: WalletRegistrationNearProvisioningInput): Promise<WalletRegistrationNearProvisioningResponseV2>;
+    completeWalletRegistrationNearProvisioning(input: WalletRegistrationNearProvisioningInput, timingSink?: Array<readonly [string, number]>): Promise<WalletRegistrationNearProvisioningResponseV2>;
     /**
      * Persists the Ed25519-only wallet in `near_pending`: wallet, profile, and
      * authentication state, and no signer record — the signer does not exist
@@ -355,7 +357,7 @@ export declare class CloudflareD1WalletRegistrationService {
      * before execution; an ambiguous outcome after the custody call stays
      * `uncertain` rather than being guessed either way.
      */
-    activateWalletRegistration(input: WalletRegistrationActivateInput, traceContext?: RouterAbTraceContextV1): Promise<WalletRegistrationActivateResponseV2>;
+    activateWalletRegistration(input: WalletRegistrationActivateInput, traceContext?: RouterAbTraceContextV1, serverTiming?: Array<readonly [string, number]>): Promise<WalletRegistrationActivateResponseV2>;
     /**
      * Router/SigningWorker activation followed by the blocking finalize
      * persistence, as one unit inside the operation row. The commit is told the

package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationInputs.d.ts

@@ -34,6 +34,13 @@ export type WalletRegistrationRespondInput = {
     readonly verifier: WalletRegistrationSetupVerifier;
     readonly userAgent?: string;
 };
+export type WalletRegistrationNearAdmissionInput = {
+    readonly registrationCeremonyId: string;
+    readonly signedSetup: unknown;
+    readonly authority: WalletRegistrationAuthorityInput;
+    readonly verifier: WalletRegistrationSetupVerifier;
+    readonly userAgent?: string;
+};
 export type WalletRegistrationActivateInput = {
     readonly registrationCeremonyId: string;
     readonly signedSetup: unknown;

package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationRoutes.d.ts

@@ -1,4 +1,4 @@
-import type { WalletRegistrationNearProvisioningResponseV2, WalletRegistrationActivateRouteResponseV2, WalletRegistrationRespondResponseV2, WalletRegistrationSetupResponseV2 } from '../../../core/threeRouteRegistrationContracts';
+import type { WalletRegistrationNearProvisioningResponseV2, WalletRegistrationNearAdmissionResponseV2, WalletRegistrationActivateRouteResponseV2, WalletRegistrationRespondResponseV2, WalletRegistrationSetupResponseV2 } from '../../../core/threeRouteRegistrationContracts';
 import type { RouterApiPublishableKeyAuthAdapter } from '../../framework/routerApi';
 import type { RouterApiAuthorizationSessionService, RouterApiWalletRegistrationRouteService } from '../../framework/authServicePort';
 import type { FundImplicitNearAccountResult } from '../../../core/types';
@@ -7,6 +7,7 @@ import type { NormalizedRouterLogger } from '../../framework/logger';
 import type { RouterApiKeyAuthAdapter, RouterApiProjectEnvironmentResolver, SessionAdapter, RouterApiWalletProjectionAdapter } from '../../framework/routerApi';
 import type { HeaderRecord, RouteResponse } from '../../framework/routeExecutionContext';
 import type { RouteDefinition } from '../../framework/routeDefinitions';
+import type { SigningSessionSealRoutesOptions } from '../../../threshold/session/signingSessionSeal/signingSessionSeal.types';
 import type { RouteErrorBody } from '../../framework/routeResponses';
 import type { RouterAbPublicKeysetV2 } from '../../../../../shared-ts/src/utils/routerAbPublicKeyset';
 type RouterApiWalletRegistrationServices = {
@@ -29,6 +30,7 @@ type RouterApiWalletRegistrationInput = {
     route: RouteDefinition;
     services: RouterApiWalletRegistrationServices;
     sourceIp?: string;
+    signingSessionSeal?: SigningSessionSealRoutesOptions | null;
 };
 export declare function handleRouterApiWalletAddSignerIntent(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<CreateAddSignerIntentResponse | RouteErrorBody>>;
 /**
@@ -48,6 +50,7 @@ export declare function handleRouterApiWalletRegistrationSetup(input: RouterApiW
  * derivation respond leg it replaces was.
  */
 export declare function handleRouterApiWalletRegistrationRespond(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<WalletRegistrationRespondResponseV2 | RouteErrorBody>>;
+export declare function handleRouterApiWalletRegistrationNearAdmission(input: RouterApiWalletRegistrationInput): Promise<RouteResponse<WalletRegistrationNearAdmissionResponseV2 | RouteErrorBody>>;
 /**
  * Refactor 94C. `POST /wallets/register/activate` — activation and
  * finalization behind one Gateway operation row.

package/dist/types/wallet-server/src/router/framework/authServicePort.d.ts

@@ -1,7 +1,7 @@
 import type { DigestB64u } from '../../../../shared-ts/src/utils/canonicalPrimitives';
 import type { AddAuthMethodIntentCallerV1, AddAuthMethodIntentGrant } from '../../../../shared-ts/src/utils/registrationIntent';
-import type { WalletRegistrationNearProvisioningResponseV2, WalletRegistrationActivateResponseV2, WalletRegistrationRespondResponseV2, WalletRegistrationSetupResponseV2 } from '../../core/threeRouteRegistrationContracts';
-import type { WalletRegistrationNearProvisioningInput, WalletRegistrationActivateInput, WalletRegistrationRespondInput, WalletRegistrationSetupInput } from '../domains/walletRegistration/walletRegistrationInputs';
+import type { WalletRegistrationNearProvisioningResponseV2, WalletRegistrationNearAdmissionResponseV2, WalletRegistrationActivateResponseV2, WalletRegistrationRespondResponseV2, WalletRegistrationSetupResponseV2 } from '../../core/threeRouteRegistrationContracts';
+import type { WalletRegistrationNearProvisioningInput, WalletRegistrationNearAdmissionInput, WalletRegistrationActivateInput, WalletRegistrationRespondInput, WalletRegistrationSetupInput } from '../domains/walletRegistration/walletRegistrationInputs';
 import type { WalletEmailOtpAction } from '../../../../shared-ts/src/utils/emailOtpDomain';
 import type { MpcMaterialActivationRef, OrgId, ProviderSubject, WalletAuthMethodId, WalletAuthorityId, WalletId, WebAuthnCredentialIdB64u, WebAuthnRpId } from '../../../../shared-ts/src/utils/domainIds';
 import type { ActiveWalletAuthorityV1, WalletAuthorityProvenanceV1 } from '../../../../shared-ts/src/authorization/walletAuthority';
@@ -1031,9 +1031,10 @@ export interface RouterApiWalletRegistrationService {
     listWalletEcdsaKeyFactsInventory(input: RouterApiMethodTypes['listWalletEcdsaKeyFactsInventory']['input']): Promise<RouterApiMethodTypes['listWalletEcdsaKeyFactsInventory']['result']>;
     readActiveEmailOtpEnrollment(input: RouterApiMethodTypes['readActiveEmailOtpEnrollment']['input']): Promise<RouterApiMethodTypes['readActiveEmailOtpEnrollment']['result']>;
     setupWalletRegistration(input: WalletRegistrationSetupInput): Promise<WalletRegistrationSetupResponseV2>;
-    respondWalletRegistration(input: WalletRegistrationRespondInput, traceContext?: RouterAbTraceContextV1): Promise<WalletRegistrationRespondResponseV2>;
-    activateWalletRegistration(input: WalletRegistrationActivateInput, traceContext?: RouterAbTraceContextV1): Promise<WalletRegistrationActivateResponseV2>;
-    completeWalletRegistrationNearProvisioning(input: WalletRegistrationNearProvisioningInput): Promise<WalletRegistrationNearProvisioningResponseV2>;
+    respondWalletRegistration(input: WalletRegistrationRespondInput, traceContext?: RouterAbTraceContextV1, serverTiming?: Array<readonly [string, number]>): Promise<WalletRegistrationRespondResponseV2>;
+    authorizeWalletRegistrationNearAdmission(input: WalletRegistrationNearAdmissionInput): Promise<WalletRegistrationNearAdmissionResponseV2>;
+    activateWalletRegistration(input: WalletRegistrationActivateInput, traceContext?: RouterAbTraceContextV1, serverTiming?: Array<readonly [string, number]>): Promise<WalletRegistrationActivateResponseV2>;
+    completeWalletRegistrationNearProvisioning(input: WalletRegistrationNearProvisioningInput, serverTiming?: Array<readonly [string, number]>): Promise<WalletRegistrationNearProvisioningResponseV2>;
     refreshEd25519YaoWalletSession(input: RouterAbEd25519YaoBudgetRefreshRequestV1): Promise<RouterAbEd25519YaoBudgetRefreshResponseV1>;
     provisionEd25519YaoWalletSession(input: RouterAbEd25519YaoVerifiedWalletUnlockRequestV1): Promise<RouterAbEd25519YaoVerifiedWalletUnlockResponseV1>;
     recordEcdsaPostRegistrationProof(input: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seams/wallet-server",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "type": "module",
   "description": "Seams server TypeScript SDK for NEAR and EVM-family wallets",
   "main": "./dist/esm/index.js",