@seams/wallet-server 0.6.0 → 0.6.2

package/dist/esm/router/cloudflare.js

@@ -8091,6 +8091,10 @@ function createRouterApiRouteDefinitions(options = {}) {
 		plane: "public",
 		proof: "webauthn",
 		rationale: "Registration respond is authorized by the signed setup payload and the registration authority proof."
+	}, ROUTER_API_WALLET_REGISTRATION_SESSION_SERVICES), publicRoute("wallet_registration_near_admission", "POST", "/wallets/register/near-admission", "Authorize deferred NEAR registration while ECDSA respond runs", {
+		plane: "public",
+		proof: "webauthn",
+		rationale: "NEAR admission is authorized by the signed setup payload and the registration authority proof."
 	}, ROUTER_API_WALLET_REGISTRATION_SESSION_SERVICES), publicRoute("wallet_registration_activate", "POST", "/wallets/register/activate", "Activate and finalize one wallet ECDSA registration", {
 		plane: "public",
 		proof: "threshold_protocol_state",
@@ -11110,6 +11114,9 @@ function isEmailOtpWalletRegistrationActivateSuccessV2(result) {
 function isPasskeyWalletRegistrationActivateSuccessV2(result) {
 	return result.authMethod.kind === "passkey";
 }
+function isPasskeyWalletRegistrationNearProvisioningSuccessV2(result) {
+	return result.authMethod.kind === "passkey";
+}
 function walletRegistrationRoutePolicyServices(input) {
 	const service = input.services.walletRegistration;
 	return {
@@ -12683,13 +12690,62 @@ async function handleRouterApiWalletRegistrationRespond(input) {
 	if (!session) return routeError(500, "internal", "wallet registration respond requires session signing");
 	const parsed = parseWalletRegistrationRespondRequest(input.body);
 	if (!parsed.ok) return routeError(400, parsed.code, parsed.message);
+	const serverTiming = [];
 	const result = await input.services.walletRegistration.respondWalletRegistration({
 		...parsed.value,
 		verifier: session,
 		...registrationUserAgentFromHeaders(input.headers) ? { userAgent: registrationUserAgentFromHeaders(input.headers) } : {}
-	}, traceContext.value ?? void 0);
+	}, traceContext.value ?? void 0, serverTiming);
+	return routeJson(result.ok ? 200 : 400, result, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
+}
+async function handleRouterApiWalletRegistrationNearAdmission(input) {
+	const traceContext = parseRegistrationTraceContext(input.headers);
+	if (!traceContext.ok) return routeError(400, "invalid_trace_id", traceContext.message);
+	if (!isPlainObject$1(input.body)) return routeError(400, "invalid_body", "JSON body required");
+	const session = input.services.session;
+	if (!session) return routeError(500, "internal", "NEAR admission requires setup verification");
+	const body = input.body;
+	const registrationCeremonyId = String(body.registrationCeremonyId || "").trim();
+	const signedSetup = String(body.signedSetup || "").trim();
+	if (!registrationCeremonyId || !signedSetup) return routeError(400, "invalid_body", "registrationCeremonyId and signedSetup are required");
+	const authority = parseWalletRegistrationAuthorityProof(body);
+	if (!authority.ok) return routeError(400, authority.code, authority.message);
+	const result = await input.services.walletRegistration.authorizeWalletRegistrationNearAdmission({
+		registrationCeremonyId,
+		signedSetup,
+		authority: authority.value,
+		verifier: session,
+		...registrationUserAgentFromHeaders(input.headers) ? { userAgent: registrationUserAgentFromHeaders(input.headers) } : {}
+	});
 	return routeJson(result.ok ? 200 : 400, result);
 }
+function parseWalletRegistrationAuthorityProof(body) {
+	const hasWebAuthn = Object.prototype.hasOwnProperty.call(body, "webauthn_registration");
+	if (hasWebAuthn === Object.prototype.hasOwnProperty.call(body, "emailOtpRegistrationProof")) return {
+		ok: false,
+		code: "invalid_body",
+		message: "exactly one registration authority proof is required"
+	};
+	if (hasWebAuthn) return {
+		ok: true,
+		value: {
+			kind: "passkey",
+			webauthnRegistration: body.webauthn_registration
+		}
+	};
+	const proof = normalizeEmailOtpRegistrationProof(body.emailOtpRegistrationProof);
+	return proof ? {
+		ok: true,
+		value: {
+			kind: "email_otp",
+			emailOtpRegistrationProof: proof
+		}
+	} : {
+		ok: false,
+		code: "invalid_body",
+		message: "emailOtpRegistrationProof is invalid"
+	};
+}
 /**
 * Parses respond's public body. `signedSetup` stays an opaque string here —
 * the service verifies it; parsing its contents at the boundary would invite
@@ -12724,29 +12780,9 @@ function parseWalletRegistrationRespondRequest(body) {
 		code: "invalid_body",
 		message: "an Ed25519-only respond carries no ECDSA registration"
 	};
-	const hasWebAuthn = Object.prototype.hasOwnProperty.call(body, "webauthn_registration");
-	if (hasWebAuthn === Object.prototype.hasOwnProperty.call(body, "emailOtpRegistrationProof")) return {
-		ok: false,
-		code: "invalid_body",
-		message: "exactly one registration authority proof is required"
-	};
-	let authority;
-	if (hasWebAuthn) authority = {
-		kind: "passkey",
-		webauthnRegistration: body.webauthn_registration
-	};
-	else {
-		const proof = normalizeEmailOtpRegistrationProof(body.emailOtpRegistrationProof);
-		if (!proof) return {
-			ok: false,
-			code: "invalid_body",
-			message: "emailOtpRegistrationProof is invalid"
-		};
-		authority = {
-			kind: "email_otp",
-			emailOtpRegistrationProof: proof
-		};
-	}
+	const parsedAuthority = parseWalletRegistrationAuthorityProof(body);
+	if (!parsedAuthority.ok) return parsedAuthority;
+	const authority = parsedAuthority.value;
 	if (planKind === "near_ed25519") return {
 		ok: true,
 		value: {
@@ -12873,6 +12909,7 @@ async function handleRouterApiWalletRegistrationActivate(input) {
 	} catch {
 		return routeError(400, "invalid_body", "ECDSA activation facts are invalid");
 	}
+	const serverTiming = [];
 	const result = await input.services.walletRegistration.activateWalletRegistration({
 		registrationCeremonyId,
 		signedSetup,
@@ -12882,7 +12919,7 @@ async function handleRouterApiWalletRegistrationActivate(input) {
 		...body.emailOtpEnrollment ? { emailOtpEnrollment: body.emailOtpEnrollment } : {},
 		...body.walletCustodyCommit !== void 0 ? { walletCustodyCommit: body.walletCustodyCommit } : {},
 		verifier: session
-	}, traceContext.value ?? void 0);
+	}, traceContext.value ?? void 0, serverTiming);
 	if (!result.ok) return routeJson(400, result);
 	if (!isEmailOtpWalletRegistrationActivateSuccessV2(result) && !isPasskeyWalletRegistrationActivateSuccessV2(result)) return routeError(500, "internal", "Wallet registration activation returned an invalid authority");
 	const projectionError = await projectActivatedWallet({
@@ -12891,7 +12928,7 @@ async function handleRouterApiWalletRegistrationActivate(input) {
 		signedSetup
 	});
 	if (projectionError) return routeError(500, "internal", `Wallet was created but its Console projection failed: ${projectionError}`);
-	return routeJson(200, result);
+	return routeJson(200, result, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
 }
 /**
 * Refactor 94C. `POST /wallets/register/near-provisioning` — the non-blocking
@@ -12909,6 +12946,9 @@ async function handleRouterApiWalletRegistrationNearProvisioning(input) {
 	if (!registrationCeremonyId || !signedSetup || !idempotencyKey) return routeError(400, "invalid_body", "registrationCeremonyId, signedSetup and idempotencyKey are required");
 	const ed25519 = parseWalletRegistrationEd25519Finalize(body.ed25519);
 	if (!ed25519.ok) return routeError(400, ed25519.code, ed25519.message);
+	const sessionSeal = parseRegistrationPreparedSessionSeal(body.sessionSeal);
+	if (!sessionSeal.ok) return routeError(400, sessionSeal.code, sessionSeal.message);
+	const serverTiming = [];
 	const result = await input.services.walletRegistration.completeWalletRegistrationNearProvisioning({
 		authorization: registrationContinuationAuthorization(input.headers),
 		registrationCeremonyId,
@@ -12918,9 +12958,110 @@ async function handleRouterApiWalletRegistrationNearProvisioning(input) {
 		emailOtpEnrollment: body.emailOtpEnrollment,
 		...body.walletCustodyCommit !== void 0 ? { walletCustodyCommit: body.walletCustodyCommit } : {},
 		verifier: session
-	});
+	}, serverTiming);
 	if (!result.ok) return routeJson(400, result);
-	return routeJson(200, result);
+	if (sessionSeal.value) {
+		if (!isPasskeyWalletRegistrationNearProvisioningSuccessV2(result)) return routeError(400, "invalid_body", "Registration session sealing requires a passkey authority");
+		const sealStartedAt = Date.now();
+		const sealed = await applyRegistrationPreparedSessionSeal({
+			options: input.signingSessionSeal,
+			request: sessionSeal.value,
+			response: result
+		});
+		serverTiming.push(["near_finalize_session_seal", Math.max(0, Date.now() - sealStartedAt)]);
+		if (!sealed.ok) return routeJson(503, {
+			ok: false,
+			code: sealed.code,
+			message: sealed.message
+		}, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
+		return routeJson(200, {
+			...result,
+			sessionSeal: sealed.value
+		}, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
+	}
+	return routeJson(200, result, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
+}
+function parseRegistrationPreparedSessionSeal(raw) {
+	if (raw === void 0) return {
+		ok: true,
+		value: void 0
+	};
+	if (!isPlainObject$1(raw)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "sessionSeal must be an object"
+	};
+	if (Object.keys(raw).some((field) => ![
+		"thresholdSessionId",
+		"ciphertext",
+		"keyVersion"
+	].includes(field))) return {
+		ok: false,
+		code: "invalid_body",
+		message: "sessionSeal has unknown fields"
+	};
+	const thresholdSessionId = String(raw.thresholdSessionId || "").trim();
+	const ciphertext = String(raw.ciphertext || "").trim();
+	const keyVersion = String(raw.keyVersion || "").trim();
+	if (!thresholdSessionId || !ciphertext) return {
+		ok: false,
+		code: "invalid_body",
+		message: "sessionSeal thresholdSessionId and ciphertext are required"
+	};
+	return {
+		ok: true,
+		value: {
+			thresholdSessionId,
+			ciphertext,
+			...keyVersion ? { keyVersion } : {}
+		}
+	};
+}
+async function applyRegistrationPreparedSessionSeal(args) {
+	if (!args.options) return {
+		ok: false,
+		code: "signing_session_seal_unavailable",
+		message: "Signing-session sealing is unavailable"
+	};
+	const session = args.response.registrationEstablishedSession.session;
+	const tokens = session.tokens;
+	const ed25519 = tokens.kind === "near_ed25519" || tokens.kind === "near_ed25519_and_evm_family_ecdsa" ? tokens.ed25519 : null;
+	if (!ed25519 || String(ed25519.thresholdSessionId) !== args.request.thresholdSessionId) return {
+		ok: false,
+		code: "invalid_session_seal",
+		message: "Prepared seal does not match the established Ed25519 session"
+	};
+	const sealed = await args.options.service.applyServerSeal(args.request, {
+		userId: String(session.walletId),
+		session: {
+			kind: "exact_wallet_session_operation_credential",
+			curve: "ed25519",
+			thresholdSessionId: args.request.thresholdSessionId,
+			userId: String(session.walletId),
+			expiresAtMs: session.expiresAtMs
+		}
+	});
+	if (!sealed.ok) return sealed;
+	const keyVersion = String(sealed.keyVersion || "").trim();
+	if (!keyVersion) return {
+		ok: false,
+		code: "invalid_session_seal",
+		message: "Signing-session seal response is missing its key version"
+	};
+	return {
+		ok: true,
+		value: {
+			ciphertext: sealed.ciphertext,
+			keyVersion,
+			expiresAtMs: Math.min(sealed.expiresAtMs ?? session.expiresAtMs, session.expiresAtMs),
+			remainingUses: session.remainingUses
+		}
+	};
+}
+function ecdsaGatewayServerTimingHeaders(serverTiming) {
+	if (serverTiming.length === 0) return void 0;
+	const header = serverTiming.map(([name, durationMs]) => `${name};dur=${Math.max(0, durationMs).toFixed(1)}`).join(", ");
+	return { "Server-Timing": header };
 }
 async function handleRouterApiWalletAddSignerStart(input) {
 	if (!isPlainObject$1(input.body)) return routeError(400, "invalid_body", "JSON body required");
@@ -13279,6 +13420,7 @@ function routerApiEmailOtpRouteService(service) {
 const ROUTE_IDS = [
 	"wallet_registration_setup",
 	"wallet_registration_respond",
+	"wallet_registration_near_admission",
 	"wallet_registration_activate",
 	"wallet_registration_near_provisioning",
 	"wallet_add_signer_intent",
@@ -13334,9 +13476,64 @@ async function handleWalletRegistration(ctx) {
 			publishableKeyAuth: ctx.opts.publishableKeyAuth,
 			walletProjection: ctx.opts.walletProjection
 		},
-		sourceIp: resolveSourceIpFromFetchHeaders(ctx.request.headers) || void 0
+		sourceIp: resolveSourceIpFromFetchHeaders(ctx.request.headers) || void 0,
+		signingSessionSeal: ctx.opts.signingSessionSeal
 	};
-	return toFetchRouteResponse(route.id === "wallet_registration_setup" ? await handleRouterApiWalletRegistrationSetup(common) : route.id === "wallet_registration_respond" ? await handleRouterApiWalletRegistrationRespond(common) : route.id === "wallet_registration_activate" ? await handleRouterApiWalletRegistrationActivate(common) : route.id === "wallet_registration_near_provisioning" ? await handleRouterApiWalletRegistrationNearProvisioning(common) : route.id === "wallet_add_signer_intent" ? await handleRouterApiWalletAddSignerIntent(common) : route.id === "wallet_add_signer_start" ? await handleRouterApiWalletAddSignerStart(common) : route.id === "wallet_add_signer_ecdsa_derivation_respond" ? await handleRouterApiWalletAddSignerEcdsaDerivationRespond(common) : route.id === "wallet_add_signer_ecdsa_activation" ? await handleRouterApiWalletAddSignerEcdsaActivation(common) : route.id === "wallet_add_signer_finalize" ? await handleRouterApiWalletAddSignerFinalize(common) : route.id === "wallet_add_auth_method_intent" ? await handleRouterApiWalletAddAuthMethodIntent(common) : route.id === "wallet_add_auth_method_email_otp_challenge" ? await handleRouterApiWalletAddAuthMethodEmailOtpChallenge(common) : route.id === "wallet_add_auth_method_start" ? await handleRouterApiWalletAddAuthMethodStart(common) : route.id === "wallet_add_auth_method_finalize" ? await handleRouterApiWalletAddAuthMethodFinalize(common) : route.id === "wallet_revoke_auth_method" ? await handleRouterApiWalletRevokeAuthMethod(common) : route.id === "wallet_ecdsa_key_facts_inventory" ? await handleRouterApiWalletEcdsaKeyFactsInventory(common) : await handleRouterApiWalletNearImplicitAccountFund(common));
+	let response;
+	switch (route.id) {
+		case "wallet_registration_setup":
+			response = await handleRouterApiWalletRegistrationSetup(common);
+			break;
+		case "wallet_registration_respond":
+			response = await handleRouterApiWalletRegistrationRespond(common);
+			break;
+		case "wallet_registration_near_admission":
+			response = await handleRouterApiWalletRegistrationNearAdmission(common);
+			break;
+		case "wallet_registration_activate":
+			response = await handleRouterApiWalletRegistrationActivate(common);
+			break;
+		case "wallet_registration_near_provisioning":
+			response = await handleRouterApiWalletRegistrationNearProvisioning(common);
+			break;
+		case "wallet_add_signer_intent":
+			response = await handleRouterApiWalletAddSignerIntent(common);
+			break;
+		case "wallet_add_signer_start":
+			response = await handleRouterApiWalletAddSignerStart(common);
+			break;
+		case "wallet_add_signer_ecdsa_derivation_respond":
+			response = await handleRouterApiWalletAddSignerEcdsaDerivationRespond(common);
+			break;
+		case "wallet_add_signer_ecdsa_activation":
+			response = await handleRouterApiWalletAddSignerEcdsaActivation(common);
+			break;
+		case "wallet_add_signer_finalize":
+			response = await handleRouterApiWalletAddSignerFinalize(common);
+			break;
+		case "wallet_add_auth_method_intent":
+			response = await handleRouterApiWalletAddAuthMethodIntent(common);
+			break;
+		case "wallet_add_auth_method_email_otp_challenge":
+			response = await handleRouterApiWalletAddAuthMethodEmailOtpChallenge(common);
+			break;
+		case "wallet_add_auth_method_start":
+			response = await handleRouterApiWalletAddAuthMethodStart(common);
+			break;
+		case "wallet_add_auth_method_finalize":
+			response = await handleRouterApiWalletAddAuthMethodFinalize(common);
+			break;
+		case "wallet_revoke_auth_method":
+			response = await handleRouterApiWalletRevokeAuthMethod(common);
+			break;
+		case "wallet_ecdsa_key_facts_inventory":
+			response = await handleRouterApiWalletEcdsaKeyFactsInventory(common);
+			break;
+		default:
+			response = await handleRouterApiWalletNearImplicitAccountFund(common);
+			break;
+	}
+	return toFetchRouteResponse(response);
 }
 //#endregion
 //#region ../shared-ts/src/utils/errors.ts

package/dist/esm/router/domains/walletRegistration/walletRegistrationRoutes.js

@@ -55,6 +55,9 @@ function isEmailOtpWalletRegistrationActivateSuccessV2(result) {
 function isPasskeyWalletRegistrationActivateSuccessV2(result) {
 	return result.authMethod.kind === "passkey";
 }
+function isPasskeyWalletRegistrationNearProvisioningSuccessV2(result) {
+	return result.authMethod.kind === "passkey";
+}
 function walletRegistrationRoutePolicyServices(input) {
 	const service = input.services.walletRegistration;
 	return {
@@ -1628,13 +1631,62 @@ async function handleRouterApiWalletRegistrationRespond(input) {
 	if (!session) return routeError(500, "internal", "wallet registration respond requires session signing");
 	const parsed = parseWalletRegistrationRespondRequest(input.body);
 	if (!parsed.ok) return routeError(400, parsed.code, parsed.message);
+	const serverTiming = [];
 	const result = await input.services.walletRegistration.respondWalletRegistration({
 		...parsed.value,
 		verifier: session,
 		...registrationUserAgentFromHeaders(input.headers) ? { userAgent: registrationUserAgentFromHeaders(input.headers) } : {}
-	}, traceContext.value ?? void 0);
+	}, traceContext.value ?? void 0, serverTiming);
+	return routeJson(result.ok ? 200 : 400, result, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
+}
+async function handleRouterApiWalletRegistrationNearAdmission(input) {
+	const traceContext = parseRegistrationTraceContext(input.headers);
+	if (!traceContext.ok) return routeError(400, "invalid_trace_id", traceContext.message);
+	if (!isPlainObject(input.body)) return routeError(400, "invalid_body", "JSON body required");
+	const session = input.services.session;
+	if (!session) return routeError(500, "internal", "NEAR admission requires setup verification");
+	const body = input.body;
+	const registrationCeremonyId = String(body.registrationCeremonyId || "").trim();
+	const signedSetup = String(body.signedSetup || "").trim();
+	if (!registrationCeremonyId || !signedSetup) return routeError(400, "invalid_body", "registrationCeremonyId and signedSetup are required");
+	const authority = parseWalletRegistrationAuthorityProof(body);
+	if (!authority.ok) return routeError(400, authority.code, authority.message);
+	const result = await input.services.walletRegistration.authorizeWalletRegistrationNearAdmission({
+		registrationCeremonyId,
+		signedSetup,
+		authority: authority.value,
+		verifier: session,
+		...registrationUserAgentFromHeaders(input.headers) ? { userAgent: registrationUserAgentFromHeaders(input.headers) } : {}
+	});
 	return routeJson(result.ok ? 200 : 400, result);
 }
+function parseWalletRegistrationAuthorityProof(body) {
+	const hasWebAuthn = Object.prototype.hasOwnProperty.call(body, "webauthn_registration");
+	if (hasWebAuthn === Object.prototype.hasOwnProperty.call(body, "emailOtpRegistrationProof")) return {
+		ok: false,
+		code: "invalid_body",
+		message: "exactly one registration authority proof is required"
+	};
+	if (hasWebAuthn) return {
+		ok: true,
+		value: {
+			kind: "passkey",
+			webauthnRegistration: body.webauthn_registration
+		}
+	};
+	const proof = normalizeEmailOtpRegistrationProof(body.emailOtpRegistrationProof);
+	return proof ? {
+		ok: true,
+		value: {
+			kind: "email_otp",
+			emailOtpRegistrationProof: proof
+		}
+	} : {
+		ok: false,
+		code: "invalid_body",
+		message: "emailOtpRegistrationProof is invalid"
+	};
+}
 /**
 * Parses respond's public body. `signedSetup` stays an opaque string here —
 * the service verifies it; parsing its contents at the boundary would invite
@@ -1669,29 +1721,9 @@ function parseWalletRegistrationRespondRequest(body) {
 		code: "invalid_body",
 		message: "an Ed25519-only respond carries no ECDSA registration"
 	};
-	const hasWebAuthn = Object.prototype.hasOwnProperty.call(body, "webauthn_registration");
-	if (hasWebAuthn === Object.prototype.hasOwnProperty.call(body, "emailOtpRegistrationProof")) return {
-		ok: false,
-		code: "invalid_body",
-		message: "exactly one registration authority proof is required"
-	};
-	let authority;
-	if (hasWebAuthn) authority = {
-		kind: "passkey",
-		webauthnRegistration: body.webauthn_registration
-	};
-	else {
-		const proof = normalizeEmailOtpRegistrationProof(body.emailOtpRegistrationProof);
-		if (!proof) return {
-			ok: false,
-			code: "invalid_body",
-			message: "emailOtpRegistrationProof is invalid"
-		};
-		authority = {
-			kind: "email_otp",
-			emailOtpRegistrationProof: proof
-		};
-	}
+	const parsedAuthority = parseWalletRegistrationAuthorityProof(body);
+	if (!parsedAuthority.ok) return parsedAuthority;
+	const authority = parsedAuthority.value;
 	if (planKind === "near_ed25519") return {
 		ok: true,
 		value: {
@@ -1818,6 +1850,7 @@ async function handleRouterApiWalletRegistrationActivate(input) {
 	} catch {
 		return routeError(400, "invalid_body", "ECDSA activation facts are invalid");
 	}
+	const serverTiming = [];
 	const result = await input.services.walletRegistration.activateWalletRegistration({
 		registrationCeremonyId,
 		signedSetup,
@@ -1827,7 +1860,7 @@ async function handleRouterApiWalletRegistrationActivate(input) {
 		...body.emailOtpEnrollment ? { emailOtpEnrollment: body.emailOtpEnrollment } : {},
 		...body.walletCustodyCommit !== void 0 ? { walletCustodyCommit: body.walletCustodyCommit } : {},
 		verifier: session
-	}, traceContext.value ?? void 0);
+	}, traceContext.value ?? void 0, serverTiming);
 	if (!result.ok) return routeJson(400, result);
 	if (!isEmailOtpWalletRegistrationActivateSuccessV2(result) && !isPasskeyWalletRegistrationActivateSuccessV2(result)) return routeError(500, "internal", "Wallet registration activation returned an invalid authority");
 	const projectionError = await projectActivatedWallet({
@@ -1836,7 +1869,7 @@ async function handleRouterApiWalletRegistrationActivate(input) {
 		signedSetup
 	});
 	if (projectionError) return routeError(500, "internal", `Wallet was created but its Console projection failed: ${projectionError}`);
-	return routeJson(200, result);
+	return routeJson(200, result, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
 }
 /**
 * Refactor 94C. `POST /wallets/register/near-provisioning` — the non-blocking
@@ -1854,6 +1887,9 @@ async function handleRouterApiWalletRegistrationNearProvisioning(input) {
 	if (!registrationCeremonyId || !signedSetup || !idempotencyKey) return routeError(400, "invalid_body", "registrationCeremonyId, signedSetup and idempotencyKey are required");
 	const ed25519 = parseWalletRegistrationEd25519Finalize(body.ed25519);
 	if (!ed25519.ok) return routeError(400, ed25519.code, ed25519.message);
+	const sessionSeal = parseRegistrationPreparedSessionSeal(body.sessionSeal);
+	if (!sessionSeal.ok) return routeError(400, sessionSeal.code, sessionSeal.message);
+	const serverTiming = [];
 	const result = await input.services.walletRegistration.completeWalletRegistrationNearProvisioning({
 		authorization: registrationContinuationAuthorization(input.headers),
 		registrationCeremonyId,
@@ -1863,9 +1899,110 @@ async function handleRouterApiWalletRegistrationNearProvisioning(input) {
 		emailOtpEnrollment: body.emailOtpEnrollment,
 		...body.walletCustodyCommit !== void 0 ? { walletCustodyCommit: body.walletCustodyCommit } : {},
 		verifier: session
-	});
+	}, serverTiming);
 	if (!result.ok) return routeJson(400, result);
-	return routeJson(200, result);
+	if (sessionSeal.value) {
+		if (!isPasskeyWalletRegistrationNearProvisioningSuccessV2(result)) return routeError(400, "invalid_body", "Registration session sealing requires a passkey authority");
+		const sealStartedAt = Date.now();
+		const sealed = await applyRegistrationPreparedSessionSeal({
+			options: input.signingSessionSeal,
+			request: sessionSeal.value,
+			response: result
+		});
+		serverTiming.push(["near_finalize_session_seal", Math.max(0, Date.now() - sealStartedAt)]);
+		if (!sealed.ok) return routeJson(503, {
+			ok: false,
+			code: sealed.code,
+			message: sealed.message
+		}, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
+		return routeJson(200, {
+			...result,
+			sessionSeal: sealed.value
+		}, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
+	}
+	return routeJson(200, result, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
+}
+function parseRegistrationPreparedSessionSeal(raw) {
+	if (raw === void 0) return {
+		ok: true,
+		value: void 0
+	};
+	if (!isPlainObject(raw)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "sessionSeal must be an object"
+	};
+	if (Object.keys(raw).some((field) => ![
+		"thresholdSessionId",
+		"ciphertext",
+		"keyVersion"
+	].includes(field))) return {
+		ok: false,
+		code: "invalid_body",
+		message: "sessionSeal has unknown fields"
+	};
+	const thresholdSessionId = String(raw.thresholdSessionId || "").trim();
+	const ciphertext = String(raw.ciphertext || "").trim();
+	const keyVersion = String(raw.keyVersion || "").trim();
+	if (!thresholdSessionId || !ciphertext) return {
+		ok: false,
+		code: "invalid_body",
+		message: "sessionSeal thresholdSessionId and ciphertext are required"
+	};
+	return {
+		ok: true,
+		value: {
+			thresholdSessionId,
+			ciphertext,
+			...keyVersion ? { keyVersion } : {}
+		}
+	};
+}
+async function applyRegistrationPreparedSessionSeal(args) {
+	if (!args.options) return {
+		ok: false,
+		code: "signing_session_seal_unavailable",
+		message: "Signing-session sealing is unavailable"
+	};
+	const session = args.response.registrationEstablishedSession.session;
+	const tokens = session.tokens;
+	const ed25519 = tokens.kind === "near_ed25519" || tokens.kind === "near_ed25519_and_evm_family_ecdsa" ? tokens.ed25519 : null;
+	if (!ed25519 || String(ed25519.thresholdSessionId) !== args.request.thresholdSessionId) return {
+		ok: false,
+		code: "invalid_session_seal",
+		message: "Prepared seal does not match the established Ed25519 session"
+	};
+	const sealed = await args.options.service.applyServerSeal(args.request, {
+		userId: String(session.walletId),
+		session: {
+			kind: "exact_wallet_session_operation_credential",
+			curve: "ed25519",
+			thresholdSessionId: args.request.thresholdSessionId,
+			userId: String(session.walletId),
+			expiresAtMs: session.expiresAtMs
+		}
+	});
+	if (!sealed.ok) return sealed;
+	const keyVersion = String(sealed.keyVersion || "").trim();
+	if (!keyVersion) return {
+		ok: false,
+		code: "invalid_session_seal",
+		message: "Signing-session seal response is missing its key version"
+	};
+	return {
+		ok: true,
+		value: {
+			ciphertext: sealed.ciphertext,
+			keyVersion,
+			expiresAtMs: Math.min(sealed.expiresAtMs ?? session.expiresAtMs, session.expiresAtMs),
+			remainingUses: session.remainingUses
+		}
+	};
+}
+function ecdsaGatewayServerTimingHeaders(serverTiming) {
+	if (serverTiming.length === 0) return void 0;
+	const header = serverTiming.map(([name, durationMs]) => `${name};dur=${Math.max(0, durationMs).toFixed(1)}`).join(", ");
+	return { "Server-Timing": header };
 }
 async function handleRouterApiWalletAddSignerStart(input) {
 	if (!isPlainObject(input.body)) return routeError(400, "invalid_body", "JSON body required");
@@ -2205,6 +2342,6 @@ function registrationContinuationAuthorization(headers) {
 	} : { kind: "registration_grant" };
 }
 //#endregion
-export { handleRouterApiWalletAddAuthMethodEmailOtpChallenge, handleRouterApiWalletAddAuthMethodFinalize, handleRouterApiWalletAddAuthMethodIntent, handleRouterApiWalletAddAuthMethodStart, handleRouterApiWalletAddSignerEcdsaActivation, handleRouterApiWalletAddSignerEcdsaDerivationRespond, handleRouterApiWalletAddSignerFinalize, handleRouterApiWalletAddSignerIntent, handleRouterApiWalletAddSignerStart, handleRouterApiWalletEcdsaKeyFactsInventory, handleRouterApiWalletNearImplicitAccountFund, handleRouterApiWalletRegistrationActivate, handleRouterApiWalletRegistrationNearProvisioning, handleRouterApiWalletRegistrationRespond, handleRouterApiWalletRegistrationSetup, handleRouterApiWalletRevokeAuthMethod };
+export { handleRouterApiWalletAddAuthMethodEmailOtpChallenge, handleRouterApiWalletAddAuthMethodFinalize, handleRouterApiWalletAddAuthMethodIntent, handleRouterApiWalletAddAuthMethodStart, handleRouterApiWalletAddSignerEcdsaActivation, handleRouterApiWalletAddSignerEcdsaDerivationRespond, handleRouterApiWalletAddSignerFinalize, handleRouterApiWalletAddSignerIntent, handleRouterApiWalletAddSignerStart, handleRouterApiWalletEcdsaKeyFactsInventory, handleRouterApiWalletNearImplicitAccountFund, handleRouterApiWalletRegistrationActivate, handleRouterApiWalletRegistrationNearAdmission, handleRouterApiWalletRegistrationNearProvisioning, handleRouterApiWalletRegistrationRespond, handleRouterApiWalletRegistrationSetup, handleRouterApiWalletRevokeAuthMethod };
 
 //# sourceMappingURL=walletRegistrationRoutes.js.map