@seams/wallet-server 0.6.2 → 0.7.3

package/dist/esm/router/transport/fetch/routes/auth.js

@@ -1,4 +1,4 @@
-import { json, readJson } from "../../../framework/http.js";
+import { json, jsonFailure, readJson } from "../../../framework/http.js";
 import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
 import { resolveThresholdRuntimePolicyScope } from "../../../auth/commonRouterUtils.js";
 import { parseAuthIdentityMutationRequest, parseAuthProviderActionPath, parseGoogleLoginVerifyRequest, parsePasskeyLoginOptionsRequest, parsePasskeyLoginVerifyRequest } from "../../../auth/authRequestValidation.js";
@@ -13,11 +13,7 @@ async function requireExactWalletSession(ctx) {
 	const token = extractBearerCredential(ctx.request.headers);
 	if (!token) return {
 		ok: false,
-		response: json({
-			ok: false,
-			code: "unauthorized",
-			message: "No valid Wallet Session"
-		}, { status: 401 })
+		response: jsonFailure(401, "unauthorized", "No valid Wallet Session")
 	};
 	try {
 		const context = await ctx.service.authorizationSessions.readWalletSessionAuthorizationV2ByOperationCredential({
@@ -27,11 +23,7 @@ async function requireExactWalletSession(ctx) {
 		});
 		if (!context) return {
 			ok: false,
-			response: json({
-				ok: false,
-				code: "unauthorized",
-				message: "No valid Wallet Session"
-			}, { status: 401 })
+			response: jsonFailure(401, "unauthorized", "No valid Wallet Session")
 		};
 		return {
 			ok: true,
@@ -40,11 +32,7 @@ async function requireExactWalletSession(ctx) {
 	} catch {
 		return {
 			ok: false,
-			response: json({
-				ok: false,
-				code: "wallet_session_unavailable",
-				message: "Wallet Session is unavailable"
-			}, { status: 503 })
+			response: jsonFailure(503, "wallet_session_unavailable", "Wallet Session is unavailable")
 		};
 	}
 }
@@ -57,19 +45,11 @@ async function requireExactPasskeyStepUp(input) {
 	const walletId = String(input.context.authorization.session.walletId);
 	if (String(result.userId).trim() !== walletId) return {
 		ok: false,
-		response: json({
-			ok: false,
-			code: "forbidden",
-			message: "Step-up user mismatch"
-		}, { status: 403 })
+		response: jsonFailure(403, "forbidden", "Step-up user mismatch")
 	};
 	if (result.walletAuthMethodId !== input.context.authMethod.walletAuthMethodId || result.walletAuthorityId !== input.context.authority.authorityId) return {
 		ok: false,
-		response: json({
-			ok: false,
-			code: "forbidden",
-			message: "Step-up authority mismatch"
-		}, { status: 403 })
+		response: jsonFailure(403, "forbidden", "Step-up authority mismatch")
 	};
 	return { ok: true };
 }
@@ -127,11 +107,7 @@ async function handleAuth(ctx) {
 			default: assertNeverAuthIdentityMutation(command);
 		}
 		const subject = command.request.subject;
-		if (subject.startsWith("near:")) return json({
-			ok: false,
-			code: "not_supported",
-			message: "near: subjects cannot be unlinked"
-		}, { status: 400 });
+		if (subject.startsWith("near:")) return jsonFailure(400, "not_supported", "near: subjects cannot be unlinked");
 		const out = await ctx.service.identity.unlinkIdentity({
 			userId: walletId,
 			subject
@@ -188,16 +164,8 @@ async function handleAuth(ctx) {
 				publishableKeyAuth: ctx.opts.publishableKeyAuth,
 				orgProjectEnv: ctx.opts.orgProjectEnv
 			});
-			if (!runtimePolicyScope.ok) return json({
-				ok: false,
-				code: runtimePolicyScope.code,
-				message: runtimePolicyScope.message
-			}, { status: runtimePolicyScope.status });
-			if (!runtimePolicyScope.scope) return json({
-				ok: false,
-				code: "runtime_policy_scope_unavailable",
-				message: "Google Email OTP requires an active managed runtime policy scope"
-			}, { status: 500 });
+			if (!runtimePolicyScope.ok) return jsonFailure(runtimePolicyScope.status, runtimePolicyScope.code, runtimePolicyScope.message);
+			if (!runtimePolicyScope.scope) return jsonFailure(500, "runtime_policy_scope_unavailable", "Google Email OTP requires an active managed runtime policy scope");
 			const result = await ctx.service.identity.verifyGoogleLogin(parsed.request);
 			if (!result.ok || !result.verified || !result.providerSubject) return json(result, { status: result.code === "internal" ? 500 : 400 });
 			const resolution = await ctx.service.identity.resolveGoogleEmailOtpSession({

package/dist/esm/router/transport/fetch/routes/deviceLinking.js

@@ -1,12 +1,15 @@
 import { parseLinkDeviceSessionId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { sha256Bytes } from "../../../../shared-ts/src/utils/digests.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { assertNeverLinkSessionStateV1 } from "../../../../shared-ts/src/device-linking/contracts.js";
+import { requireRecord } from "../../../../shared-ts/src/utils/validation.js";
+import { parseActiveWalletSessionV1 } from "../../../../shared-ts/src/device-linking/activeWalletSession.js";
 import { parseLinkedDeviceEd25519ExportRootRecipientV1, parseLinkedDeviceEd25519ExportRootSubmissionV1 } from "../../../../shared-ts/src/device-linking/ed25519ExportRoot.js";
 import { parseRouterAbEd25519YaoRegistrationActivationExecuteRequestV1, sameRouterAbEd25519YaoActivationBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { parseLinkedDeviceEd25519SourcePreservingReservationV1, parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1 } from "../../../../shared-ts/src/device-linking/sourceContribution.js";
-import { parseActiveWalletSessionV1, parseLinkedDeviceApprovalDeliveryV1, parseLinkedDeviceApprovalV1, parseLinkedDeviceEmailOtpBaseFactorRequestV1, parseLinkedDeviceEmailOtpChallengeResendRequestV1, parseLinkedDeviceEmailOtpChallengeResultV1, parseLinkedDeviceEmailOtpChallengeStartRequestV1, parseLinkedDeviceEmailOtpChallengeVerifyRequestV1, parseLinkedDeviceEmailOtpVerificationResultV1, parseLinkedDeviceSessionClaimRequestV1, parseLinkedDeviceSessionTransportRequestV1, parseLinkedDeviceTargetCredentialRegistrationV1, parseLinkedDeviceTargetPreparationRequestV1, parseLinkedDeviceTargetPreparationV1, parseLocalAuthorityActivationFinalAckV1, parseLocalAuthorityInstallationReceiptV1, parseQrLinkedDeviceSessionPayloadV5 } from "../../../../shared-ts/src/device-linking/parsers.js";
+import { parseLinkedDeviceApprovalDeliveryV1, parseLinkedDeviceApprovalV1, parseLinkedDeviceEmailOtpBaseFactorRequestV1, parseLinkedDeviceEmailOtpChallengeResendRequestV1, parseLinkedDeviceEmailOtpChallengeResultV1, parseLinkedDeviceEmailOtpChallengeStartRequestV1, parseLinkedDeviceEmailOtpChallengeVerifyRequestV1, parseLinkedDeviceEmailOtpVerificationResultV1, parseLinkedDeviceSessionClaimRequestV1, parseLinkedDeviceSessionTransportRequestV1, parseLinkedDeviceTargetCredentialRegistrationV1, parseLinkedDeviceTargetPreparationRequestV1, parseLinkedDeviceTargetPreparationV1, parseQrLinkedDeviceSessionPayloadV5 } from "../../../../shared-ts/src/device-linking/parsers.js";
+import { parseLocalAuthorityActivationFinalAckV1, parseLocalAuthorityInstallationReceiptV1 } from "../../../../shared-ts/src/device-linking/authorityActivation.js";
 import { LINKED_DEVICE_REQUEST_PROOF_HEADER_V1, computeLinkedDevicePublicKeyDigestV1 } from "../../../../shared-ts/src/device-linking/requestProof.js";
 import { findRouteDefinitionById } from "../../../framework/routeDefinitions.js";
 import { normalizeCorsOrigin } from "../../../../core/SessionService.js";
@@ -260,26 +263,25 @@ async function handleSourceContribution(ctx, service, rawLinkSessionId, nowMs) {
 		nowMs,
 		ed25519ExportRootPackage
 	});
-	if (committed.kind === "invalid_input") return sessionResultResponse(await service.sessionService.failBeforeCommitV1({
+	if (committed.kind === "invalid_input" || committed.kind === "conflict") return sessionResultResponse(await service.sessionService.failBeforeCommitV1({
 		linkSessionId,
 		expectedRevision: recorded.record.revision,
 		error: {
 			kind: "package_preparation_failed",
-			reason: committed.message
-		},
-		nowMs
-	}));
-	if (committed.kind === "conflict") return sessionResultResponse(await service.sessionService.failBeforeCommitV1({
-		linkSessionId,
-		expectedRevision: recorded.record.revision,
-		error: {
-			kind: "package_preparation_failed",
-			reason: committed.message
+			reason: precommitFailureReasonV1(committed.message)
 		},
 		nowMs
 	}));
 	return sessionProjectionResponse(committed.session, committed.kind === "replayed" ? "replayed" : recorded.outcome);
 }
+/**
+* A precommit failure's reason is a single token. The installer's message
+* keeps its words, joined, so the session still says what failed.
+*/
+function precommitFailureReasonV1(message) {
+	const token = message.trim().replace(/\s+/g, "_").replace(/[\u0000-\u001f\u007f]/g, "");
+	return token.length > 0 ? token : "authority_commit_failed";
+}
 async function handleSourceContributionExecute(ctx, service, rawLinkSessionId, nowMs) {
 	if (ctx.method !== "POST") return methodNotAllowedResponse();
 	const owner = await authenticateOwnerForSession(ctx, service, parseSessionId(rawLinkSessionId), nowMs);
@@ -1163,10 +1165,6 @@ function parseBoundary(parse) {
 		throw new DeviceLinkingInputError(errorMessage(error));
 	}
 }
-function requireRecord(raw, field) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error(`${field} must be an object`);
-	return raw;
-}
 function requireExactKeys(record, keys) {
 	const actual = Object.keys(record).sort();
 	const expected = [...keys].sort();
@@ -1191,6 +1189,6 @@ var DeviceLinkingInputError = class extends Error {
 	}
 };
 //#endregion
-export { DEVICE_LINKING_REQUEST_PROOF_HEADER_V1, handleDeviceLinking, targetCredentialResultResponse };
+export { handleDeviceLinking };
 
 //# sourceMappingURL=deviceLinking.js.map

package/dist/esm/router/transport/fetch/routes/deviceLinkingOwnerAuthorization.js

@@ -1,14 +1,12 @@
 import { parseProviderSubject } from "../../../../shared-ts/src/utils/domainIds.js";
-import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { sha256Bytes } from "../../../../shared-ts/src/utils/digests.js";
+import { sha256DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { buildDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { buildEmailOtpWalletAuthAuthority, buildPasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseLinkedDeviceOwnerAuthorizationRequestV1 } from "../../../../shared-ts/src/device-linking/parsers.js";
 import { buildWalletSessionCapabilitySubjectsV1, walletSessionCapabilitySubjectsV1Equal } from "../../../../authorization/domain.js";
-import { json, readJson } from "../../../framework/http.js";
-import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
 import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
+import { json, jsonFailure, readJson } from "../../../framework/http.js";
+import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
 //#region src/router/transport/fetch/routes/deviceLinkingOwnerAuthorization.ts
 const LINKED_DEVICE_OWNER_AUTHORIZATION_PATH_V1 = "/wallet/device-linking/v1/owner-authorization";
 /**
@@ -63,11 +61,7 @@ async function authenticateDeviceLinkingOwnerWalletSessionRequestV1(input) {
 async function handleDeviceLinkingOwnerAuthorization(ctx, service) {
 	if (ctx.pathname !== "/wallet/device-linking/v1/owner-authorization") return null;
 	if (ctx.method !== "POST") return methodNotAllowedResponse();
-	if (!service) return json({
-		ok: false,
-		code: "not_supported",
-		message: "Linked-device owner authorization is not configured"
-	}, { status: 501 });
+	if (!service) return jsonFailure(501, "not_supported", "Linked-device owner authorization is not configured");
 	const nowV1 = Date.now;
 	let body;
 	let rawBody;
@@ -77,11 +71,7 @@ async function handleDeviceLinkingOwnerAuthorization(ctx, service) {
 		rawBody = await readJson(ctx.request.clone());
 		body = parseLinkedDeviceOwnerAuthorizationRequestV1(rawBody);
 	} catch (error) {
-		return json({
-			ok: false,
-			code: "invalid_body",
-			message: error instanceof Error ? error.message : "Owner authorization body is invalid"
-		}, { status: 400 });
+		return jsonFailure(400, "invalid_body", error instanceof Error ? error.message : "Owner authorization body is invalid");
 	}
 	const validated = await authenticateDeviceLinkingOwnerWalletSessionRequestV1({
 		request: ctx.request,
@@ -101,11 +91,7 @@ async function handleDeviceLinkingOwnerAuthorization(ctx, service) {
 			owner: validated.owner
 		}), { status: 200 });
 	} catch (error) {
-		return json({
-			ok: false,
-			code: "internal",
-			message: error instanceof Error ? error.message : String(error)
-		}, { status: 500 });
+		return jsonFailure(500, "internal", error instanceof Error ? error.message : String(error));
 	}
 }
 async function validateOwnerWalletSessionV1(input) {
@@ -253,7 +239,7 @@ async function readClonedJson(request) {
 	}
 }
 async function requestBodyDigest(request) {
-	return parseDigestB64u(base64UrlEncode(await sha256Bytes(new Uint8Array(await request.clone().arrayBuffer()))));
+	return sha256DigestB64u(new Uint8Array(await request.clone().arrayBuffer()));
 }
 function denied(code, message) {
 	return {
@@ -269,12 +255,7 @@ function methodNotAllowedResponse() {
 	}, { status: 405 });
 }
 function authDeniedResponse(value) {
-	const status = value.code === "expired" ? 401 : value.code === "invalid" ? 403 : 401;
-	return json({
-		ok: false,
-		code: value.code,
-		message: value.message
-	}, { status });
+	return jsonFailure(value.code === "expired" ? 401 : value.code === "invalid" ? 403 : 401, value.code, value.message);
 }
 //#endregion
 export { LINKED_DEVICE_OWNER_AUTHORIZATION_PATH_V1, authenticateDeviceLinkingOwnerWalletSessionRequestV1, createDeviceLinkingOwnerRequestAuthenticatorV1, handleDeviceLinkingOwnerAuthorization };

package/dist/esm/router/transport/fetch/routes/deviceManagement.js

@@ -1,8 +1,8 @@
 import { parseWalletAuthMethodId, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { sha256Bytes } from "../../../../shared-ts/src/utils/digests.js";
-import { parseLinkedDeviceListRequestV1, parseLinkedDeviceRevokeRequestV1 } from "../../../../shared-ts/src/device-linking/parsers.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { parseLinkedDeviceListRequestV1, parseLinkedDeviceRevokeRequestV1 } from "../../../../shared-ts/src/device-linking/deviceManagement.js";
 import { json } from "../../../framework/http.js";
 import { LinkedDeviceListCursorError } from "../../../../core/deviceLinking/linkedDeviceManagement.js";
 //#region src/router/transport/fetch/routes/deviceManagement.ts
@@ -65,29 +65,20 @@ async function handleRevoke(ctx, service, nowMs) {
 	const request = parsedBody.request;
 	if (pathWalletAuthMethodId !== request.walletAuthMethodId) throw new DeviceManagementInputError("revoke path and body wallet auth method ids must agree");
 	if (authentication.owner.walletId !== request.walletId) return unauthorizedResponse();
-	const freshProof = await service.verifyFreshRevokeProofV1({
-		walletId: request.walletId,
-		targetWalletAuthMethodId: request.walletAuthMethodId,
+	if (request.requestedAtMs > nowMs) throw new DeviceManagementInputError("revoke request is from the future");
+	const outcome = await service.revokeLinkedDeviceWithFreshProofV1({
+		request,
+		owner: {
+			walletId: authentication.owner.walletId,
+			walletSessionId: authentication.owner.walletSessionId,
+			authorizationId: authentication.owner.authorizationId,
+			expiresAtMs: authentication.owner.expiresAtMs
+		},
 		proof: parsedBody.proof,
-		request: ctx.request,
-		method: ctx.method,
-		pathname: ctx.pathname,
-		bodyDigestB64u: body.digestB64u,
-		requestedAtMs: request.requestedAtMs
+		httpRequest: ctx.request
 	});
-	if (freshProof.kind !== "authorized") return authDeniedResponse(freshProof);
-	const source = {
-		walletId: authentication.owner.walletId,
-		walletSessionId: authentication.owner.walletSessionId,
-		authorizationId: authentication.owner.authorizationId,
-		expiresAtMs: authentication.owner.expiresAtMs,
-		freshProof: {
-			walletAuthMethodId: freshProof.walletAuthMethodId,
-			verifiedAtMs: freshProof.verifiedAtMs
-		}
-	};
-	if (request.requestedAtMs > nowMs) throw new DeviceManagementInputError("revoke request is from the future");
-	const result = await service.management.revokeLinkedDeviceV1(request, source);
+	if (outcome.kind === "denied") return authDeniedResponse(outcome);
+	const result = outcome.result;
 	switch (result.kind) {
 		case "revoked": return json({
 			ok: true,
@@ -284,6 +275,6 @@ var DeviceManagementInputError = class extends Error {
 	}
 };
 //#endregion
-export { LINKED_DEVICE_MANAGEMENT_BASE_V1, LINKED_DEVICE_MANAGEMENT_MAX_PAGE_SIZE_V1, handleDeviceManagement };
+export { LINKED_DEVICE_MANAGEMENT_BASE_V1, handleDeviceManagement };
 
 //# sourceMappingURL=deviceManagement.js.map

package/dist/esm/router/transport/fetch/routes/nearPublicKeys.js

@@ -1,4 +1,4 @@
-import { json } from "../../../framework/http.js";
+import { json, jsonFailure } from "../../../framework/http.js";
 import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
 //#region src/router/transport/fetch/routes/nearPublicKeys.ts
 async function handleNearPublicKeys(ctx) {
@@ -6,31 +6,19 @@ async function handleNearPublicKeys(ctx) {
 	if (ctx.pathname !== "/near/public-keys") return null;
 	try {
 		const token = extractBearerCredential(ctx.request.headers);
-		if (!token) return json({
-			ok: false,
-			code: "unauthorized",
-			message: "No valid Wallet Session"
-		}, { status: 401 });
+		if (!token) return jsonFailure(401, "unauthorized", "No valid Wallet Session");
 		const nowMs = Date.now();
 		const exact = await ctx.service.authorizationSessions.readWalletSessionAuthorizationV2ByOperationCredential({
 			tenantId: ctx.service.authorizationSessions.tenantId,
 			token,
 			nowMs
 		});
-		if (!exact) return json({
-			ok: false,
-			code: "unauthorized",
-			message: "No valid Wallet Session"
-		}, { status: 401 });
+		if (!exact) return jsonFailure(401, "unauthorized", "No valid Wallet Session");
 		const result = await ctx.service.nearFunding.listNearPublicKeysForUser({ userId: String(exact.authorization.session.walletId) });
 		if (!result.ok) return json(result, { status: result.code === "not_supported" ? 501 : result.code === "invalid_args" ? 400 : 500 });
 		return json(result, { status: 200 });
 	} catch (e) {
-		return json({
-			ok: false,
-			code: "internal",
-			message: e?.message || "Internal error"
-		}, { status: 500 });
+		return jsonFailure(500, "internal", e?.message || "Internal error");
 	}
 }
 //#endregion

package/dist/esm/router/transport/fetch/routes/normalSigningRouterProxy.js

@@ -3,7 +3,6 @@ import { ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1, normalizeRouterAbInternalSer
 import { json } from "../../../framework/http.js";
 import { prepareOwnerWalletExecution } from "../../../domains/signingOperations/walletExecutionAdmission.js";
 //#region src/router/transport/fetch/routes/normalSigningRouterProxy.ts
-const ROUTER_AB_ECDSA_DERIVATION_LINKED_DEVICE_SIGN_PATH = "/router-ab/ecdsa-derivation/linked-device/sign";
 async function proxyNormalSigningRequestToMpcRouter(input) {
 	const proxy = input.proxy;
 	if (!proxy) return json({
@@ -54,7 +53,7 @@ function isNormalSigningReusableBindingRecord(value) {
 }
 function isNormalSigningGatewayOwnerBindingRecord(value) {
 	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
-	return Object.keys(value).sort().join("|") === "account_id|authorization_id|environment|expires_at_ms|kind|org_id|project_id|quota_id|signing_worker_id|subject_id|threshold_session_id|wallet_session_id";
+	return Object.keys(value).sort().join("|") === "account_id|authorization_id|environment|expires_at_ms|kind|org_id|project_environment_id|project_id|quota_id|signing_worker_id|subject_id|threshold_session_id|wallet_session_id";
 }
 function isNormalSigningReusableReceiptRecord(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -63,7 +62,7 @@ function isNormalSigningReusableBindingValues(record) {
 	return typeof record.authorization_id === "string" && record.authorization_id.trim().length > 0 && typeof record.wallet_session_id === "string" && record.wallet_session_id.trim().length > 0 && typeof record.quota_id === "string" && record.quota_id.trim().length > 0;
 }
 function isNormalSigningGatewayOwnerBindingValues(record) {
-	return typeof record.subject_id === "string" && record.subject_id.trim().length > 0 && typeof record.account_id === "string" && record.account_id.trim().length > 0 && typeof record.authorization_id === "string" && record.authorization_id.trim().length > 0 && typeof record.wallet_session_id === "string" && record.wallet_session_id.trim().length > 0 && typeof record.quota_id === "string" && record.quota_id.trim().length > 0 && typeof record.threshold_session_id === "string" && record.threshold_session_id.trim().length > 0 && typeof record.org_id === "string" && record.org_id.trim().length > 0 && typeof record.project_id === "string" && record.project_id.trim().length > 0 && typeof record.environment === "string" && record.environment.trim().length > 0 && typeof record.signing_worker_id === "string" && record.signing_worker_id.trim().length > 0 && typeof record.expires_at_ms === "number" && Number.isSafeInteger(record.expires_at_ms) && record.expires_at_ms > 0;
+	return typeof record.subject_id === "string" && record.subject_id.trim().length > 0 && typeof record.account_id === "string" && record.account_id.trim().length > 0 && typeof record.authorization_id === "string" && record.authorization_id.trim().length > 0 && typeof record.wallet_session_id === "string" && record.wallet_session_id.trim().length > 0 && typeof record.quota_id === "string" && record.quota_id.trim().length > 0 && typeof record.threshold_session_id === "string" && record.threshold_session_id.trim().length > 0 && typeof record.org_id === "string" && record.org_id.trim().length > 0 && typeof record.project_id === "string" && record.project_id.trim().length > 0 && typeof record.environment === "string" && record.environment.trim().length > 0 && typeof record.project_environment_id === "string" && record.project_environment_id.trim().length > 0 && typeof record.signing_worker_id === "string" && record.signing_worker_id.trim().length > 0 && typeof record.expires_at_ms === "number" && Number.isSafeInteger(record.expires_at_ms) && record.expires_at_ms > 0;
 }
 async function proxyOwnerLaneAdmittedNormalSigningRequest(input) {
 	const expectedMaterialActivation = routerAbMpcMaterialActivationRefFromWire(input.expectedMaterialActivation);
@@ -100,19 +99,7 @@ async function proxyOwnerLaneAdmittedNormalSigningRequest(input) {
 		body: input.body
 	});
 }
-/** Forwards a Gateway-admitted rotatable lane source to the private Router. */
-async function proxyRotatableLaneAdmittedNormalSigningRequest(input) {
-	return await proxyNormalSigningRequestToMpcRouter({
-		request: input.request,
-		proxy: input.proxy,
-		body: {
-			...input.body,
-			material_source: input.materialSource
-		},
-		targetPath: input.targetPath
-	});
-}
 //#endregion
-export { ROUTER_AB_ECDSA_DERIVATION_LINKED_DEVICE_SIGN_PATH, proxyNormalSigningRequestToMpcRouter, proxyOwnerLaneAdmittedNormalSigningRequest, proxyRotatableLaneAdmittedNormalSigningRequest };
+export { proxyNormalSigningRequestToMpcRouter, proxyOwnerLaneAdmittedNormalSigningRequest };
 
 //# sourceMappingURL=normalSigningRouterProxy.js.map