@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/router/domains/walletRegistration/walletRegistrationRoutes.js

@@ -1,11 +1,10 @@
 import { parseWalletAuthMethodId, parseWalletId, parseWebAuthnRpId } from "../../../shared-ts/src/utils/domainIds.js";
 import { EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS, parseWalletSessionId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
+import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
 import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
 import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { base58Encode } from "../../../shared-ts/src/utils/base58.js";
 import "../../../shared-ts/src/utils/encoders.js";
-import { deriveImplicitNearAccountIdFromEd25519PublicKey, parseImplicitNearAccountId } from "../../../shared-ts/src/utils/near.js";
-import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
 import { ecdsaClientRootPublicKey33B64uFromString } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
 import { parseRouterAbEcdsaRegistrationActivationRequestV1, parseRouterAbEcdsaRegistrationRequestV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
@@ -14,18 +13,20 @@ import { parseHostedWalletSessionOperationCredentialToken, parsePrimaryWalletSes
 import { normalizeCorsOrigin } from "../../../core/SessionService.js";
 import { thresholdEcdsaChainTargetFromValue } from "../../../core/thresholdEcdsaChainTarget.js";
 import { walletIdFromString } from "../../../shared-ts/src/utils/registrationIds.js";
-import { parseRouterAbTraceContextV1 } from "../../../shared-ts/src/utils/routerAbTraceContext.js";
+import { parseRegistrationSetupOperationId } from "../../../shared-ts/src/utils/registrationSetupOperation.js";
 import { extractBearerCredential, extractRouterApiEnvironmentId } from "../../auth/routerApiKeyAuth.js";
-import { resolvePublishableKeyApiCredentialAuth } from "../../auth/routerApiCredentialAuth.js";
+import { publishableKeyRoutePrincipal, resolvePublishableKeyApiCredentialAuth, resolveWalletRegistrationContext } from "../../auth/routerApiCredentialAuth.js";
 import { resolveActiveRuntimePolicyScopeForEnvironment, resolveWalletSessionAdministrationAdmission, resolveWalletSessionOperationCredentialAdmission, resolveWalletSessionOperationCredentialAdmissionFromContext } from "../../auth/commonRouterUtils.js";
 import { enforceRoutePolicy } from "../../framework/enforceRoutePolicy.js";
+import { parseRegistrationPreparedSessionSeal } from "./registrationSessionSeal.js";
 import { routeError, routeJson } from "../../framework/routeResponses.js";
 import { parsePasskeyCustodyEnvelopeRecord } from "../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../shared-ts/src/passkey-custody/index.js";
-import { verifyWalletRegistrationSetupClaims } from "./walletRegistrationSetupPayload.js";
 import { computeWalletEcdsaKeyFactsInventoryChallengeDigestB64u } from "../../../shared-ts/src/utils/ecdsaKeyFactsInventory.js";
+import { deriveImplicitNearAccountIdFromEd25519PublicKey, parseImplicitNearAccountId } from "../../../shared-ts/src/utils/near.js";
 import { normalizeRegistrationSignerPlan, registrationSignerSetSelectionFromPlan } from "../../../shared-ts/src/utils/registrationSignerPlan.js";
 import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, computeAddAuthMethodIntentDigestB64u, computeAddSignerIntentDigestB64u, normalizeAddAuthMethodIntentCaller } from "../../../shared-ts/src/utils/registrationIntent.js";
+import { parseRouterAbTraceContextV1 } from "../../../shared-ts/src/utils/routerAbTraceContext.js";
 //#region src/router/domains/walletRegistration/walletRegistrationRoutes.ts
 function parseRegistrationTraceContext(headers) {
 	const parsed = parseRouterAbTraceContextV1(headers["x-seams-trace-id"] ?? headers["X-Seams-Trace-Id"]);
@@ -326,6 +327,12 @@ function parseWalletRegistrationSetupWallet(raw) {
 	};
 }
 function parseWalletRegistrationSetupRequest(body) {
+	const registrationOperationId = parseRegistrationSetupOperationId(body.registrationOperationId);
+	if (!registrationOperationId) return {
+		ok: false,
+		code: "invalid_body",
+		message: "registrationOperationId is required"
+	};
 	const signerSelection = parseRegistrationSignerSet(body.signerSelection);
 	if (!signerSelection.ok) return signerSelection;
 	const authMethod = normalizeRegistrationAuthMethodInput(body.authMethod);
@@ -339,6 +346,7 @@ function parseWalletRegistrationSetupRequest(body) {
 	return {
 		ok: true,
 		value: {
+			registrationOperationId,
 			...wallet.value ? { wallet: wallet.value } : {},
 			signerSelection: signerSelection.value.selection,
 			authMethod
@@ -1556,20 +1564,31 @@ async function handleRouterApiWalletAddSignerIntent(input) {
 	});
 	return routeJson(result.ok ? 200 : 400, result);
 }
-/**
-* `POST /wallets/register/setup` — the single admitted entry point that
-* replaces the bootstrap grant, the intent, and start.
-*
-* Authentication is the same API-credential plane the intent route used, so
-* origin and environment binding are unchanged; what is gone is the stored
-* grant that used to sit between the check and its only reader.
-*/
 async function handleRouterApiWalletRegistrationSetup(input) {
 	if (!isPlainObject(input.body)) return routeError(400, "invalid_body", "JSON body required");
 	const origin = normalizeCorsOrigin(input.origin);
 	if (!origin) return routeError(403, "forbidden", "Origin header is required and must be a valid exact origin");
-	const publishableKeyAuth = input.services.publishableKeyAuth;
-	if (!publishableKeyAuth) return routeError(500, "route_auth_not_configured", "wallet registration setup requires publishable key auth on this server");
+	const registrationContext = input.services.registrationContext;
+	if (!registrationContext) return routeError(500, "route_auth_not_configured", "Wallet registration context is not configured");
+	const request = parseWalletRegistrationSetupRequest(input.body);
+	if (!request.ok) return routeError(400, request.code, request.message);
+	const context = await resolveWalletRegistrationContext({
+		registration: request.value,
+		environmentId: extractRouterApiEnvironmentId(input.headers) || void 0,
+		headers: input.headers,
+		missingEnvironmentMessage: "Environment header is required for wallet registration setup",
+		missingOriginMessage: "Origin header is required and must be a valid exact origin",
+		missingPublishableKeyMessage: "Missing publishable key",
+		origin,
+		registrationContext,
+		route: input.route,
+		routeAuthNotConfiguredMessage: "Wallet registration setup requires API credential auth policy"
+	});
+	if (!context.ok) {
+		if (context.status === 401) return routeError(401, "unauthorized", `${context.code}: ${context.message}`);
+		if (context.status === 403) return routeError(403, "forbidden", `${context.code}: ${context.message}`);
+		return routeError(context.status, "internal", `${context.code}: ${context.message}`);
+	}
 	const resolved = await enforceRoutePolicy({
 		headers: input.headers,
 		logger: input.logger,
@@ -1580,44 +1599,27 @@ async function handleRouterApiWalletRegistrationSetup(input) {
 		route: input.route,
 		services: walletRegistrationRoutePolicyServices(input),
 		sourceIp: input.sourceIp,
-		resolvers: { apiCredentials: async () => await resolvePublishableKeyApiCredentialAuth({
-			environmentId: extractRouterApiEnvironmentId(input.headers) || void 0,
-			headers: input.headers,
-			missingEnvironmentMessage: "Environment header is required for wallet registration setup",
-			missingOriginMessage: "Origin header is required and must be a valid exact origin",
-			missingPublishableKeyMessage: "Missing publishable key",
-			origin,
-			publishableKeyAuth,
-			route: input.route,
-			routeAuthNotConfiguredMessage: "Wallet registration setup requires API credential auth policy"
-		}) }
+		resolvers: { apiCredentials: publishableKeyRoutePrincipal.bind(void 0, context.principal) }
 	});
 	if (!resolved.ok) return routeJson(resolved.status, resolved.body);
-	if (resolved.context.principal.kind !== "api_credentials") return routeError(500, "internal", "wallet registration setup requires API credentials");
-	const principal = resolved.context.principal.principal;
-	const runtimePolicyScope = await resolveActiveRuntimePolicyScopeForEnvironment({
-		orgProjectEnv: input.services.orgProjectEnv || null,
+	const principal = context.principal;
+	const runtimePolicyScope = {
 		orgId: principal.orgId,
-		environmentId: principal.environmentId,
-		projectId: principal.projectId,
-		envId: principal.envId
-	});
+		projectId: context.environment.projectId,
+		envId: context.environment.key,
+		signingRootVersion: context.environment.signingRootVersion
+	};
 	const session = input.services.session;
 	if (!session) return routeError(500, "internal", "wallet registration setup requires session signing");
-	const request = parseWalletRegistrationSetupRequest(input.body);
-	if (!request.ok) return routeError(400, request.code, request.message);
-	const result = await input.services.walletRegistration.setupWalletRegistration({
+	return input.services.walletRegistration.setupWalletRegistration({
 		request: request.value,
 		orgId: principal.orgId,
 		expectedOrigin: origin,
 		signer: session,
-		...runtimePolicyScope ? { runtimePolicyScope } : {},
-		...runtimePolicyScope ? {
-			signingRootId: `${runtimePolicyScope.projectId}:${runtimePolicyScope.envId}`,
-			signingRootVersion: runtimePolicyScope.signingRootVersion
-		} : {}
+		runtimePolicyScope,
+		signingRootId: `${runtimePolicyScope.projectId}:${runtimePolicyScope.envId}`,
+		signingRootVersion: runtimePolicyScope.signingRootVersion
 	});
-	return routeJson(result.ok ? 200 : 400, result);
 }
 /**
 * `POST /wallets/register/respond` — the authenticated leg.
@@ -1782,30 +1784,6 @@ function parseRegistrationRequestDigestB64u(raw) {
 		return null;
 	}
 }
-async function projectActivatedWallet(input) {
-	const walletProjection = input.services.walletProjection || null;
-	if (!walletProjection) return null;
-	const verifier = input.services.session;
-	if (!verifier) return "wallet projection requires setup verification";
-	const verified = await verifyWalletRegistrationSetupClaims(verifier, input.signedSetup, {
-		registrationCeremonyId: input.registrationCeremonyId,
-		nowMs: Date.now()
-	});
-	if (!verified.ok) return verified.message;
-	if (verified.claims.policy.kind !== "runtime_policy_scope") return "wallet projection requires an exact runtime policy scope";
-	if (verified.claims.policy.scope.orgId !== verified.claims.orgId) return "wallet projection scope does not match its organization";
-	try {
-		await walletProjection.recordCreatedWallet({
-			orgId: verified.claims.orgId,
-			runtimePolicyScope: verified.claims.policy.scope,
-			walletId: verified.claims.walletId,
-			occurredAt: (/* @__PURE__ */ new Date()).toISOString()
-		});
-		return null;
-	} catch (error) {
-		return error instanceof Error ? error.message : String(error);
-	}
-}
 /**
 * `POST /wallets/register/activate` — activation and finalization behind
 * one Gateway operation row.
@@ -1824,9 +1802,7 @@ async function handleRouterApiWalletRegistrationActivate(input) {
 	const idempotencyKey = String(body.idempotencyKey || "").trim();
 	if (!idempotencyKey) return routeError(400, "invalid_body", "idempotencyKey is required");
 	const planKind = String(body.kind || "").trim();
-	if (planKind !== "evm_family_ecdsa" && planKind !== "near_ed25519_and_evm_family_ecdsa" && planKind !== "near_ed25519") return routeError(400, "invalid_body", "kind must name the signer plan");
-	const ed25519Only = planKind === "near_ed25519";
-	if (ed25519Only && body.ecdsa !== void 0) return routeError(400, "invalid_body", "an Ed25519-only activate carries no ECDSA activation");
+	if (planKind !== "evm_family_ecdsa" && planKind !== "near_ed25519_and_evm_family_ecdsa") return routeError(400, "invalid_body", "activation requires an ECDSA signer plan");
 	const ecdsa = isPlainObject(body.ecdsa) ? body.ecdsa : null;
 	const unknownEcdsaField = ecdsa ? findUnknownField(ecdsa, [
 		"activationCorrelationId",
@@ -1834,9 +1810,9 @@ async function handleRouterApiWalletRegistrationActivate(input) {
 		"clientActivation"
 	]) : null;
 	if (unknownEcdsaField) return routeError(400, "invalid_body", `wallet registration ECDSA activation field ${unknownEcdsaField} is unsupported`);
-	if (!ed25519Only && (!ecdsa || typeof ecdsa.activationCorrelationId !== "string" || typeof ecdsa.activationRequestDigestB64u !== "string" || !isPlainObject(ecdsa.clientActivation))) return routeError(400, "invalid_body", "browser-verified clientActivation is required");
+	if (!ecdsa || typeof ecdsa.activationCorrelationId !== "string" || typeof ecdsa.activationRequestDigestB64u !== "string" || !isPlainObject(ecdsa.clientActivation)) return routeError(400, "invalid_body", "browser-verified clientActivation is required");
 	let parsedActivation;
-	if (ecdsa) try {
+	try {
 		const parsed = parseRouterAbEcdsaRegistrationActivationRequestV1({
 			registrationCeremonyId,
 			ecdsa: {
@@ -1859,25 +1835,17 @@ async function handleRouterApiWalletRegistrationActivate(input) {
 		signedSetup,
 		idempotencyKey,
 		planKind,
-		...parsedActivation ? { ecdsa: parsedActivation } : {},
+		ecdsa: parsedActivation,
 		...body.emailOtpEnrollment ? { emailOtpEnrollment: body.emailOtpEnrollment } : {},
 		...body.walletCustodyCommit !== void 0 ? { walletCustodyCommit: body.walletCustodyCommit } : {},
 		verifier: session
 	}, traceContext.value ?? void 0, serverTiming);
 	if (!result.ok) return routeJson(400, result);
 	if (!isEmailOtpWalletRegistrationActivateSuccessV2(result) && !isPasskeyWalletRegistrationActivateSuccessV2(result)) return routeError(500, "internal", "Wallet registration activation returned an invalid authority");
-	const projectionError = await projectActivatedWallet({
-		registrationCeremonyId,
-		services: input.services,
-		signedSetup
-	});
-	if (projectionError) return routeError(500, "internal", `Wallet was created but its Console projection failed: ${projectionError}`);
 	return routeJson(200, result, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
 }
 /**
-* `POST /wallets/register/near-provisioning` — the non-blocking completion
-* the client calls after activate, once its already-running Yao computation
-* produces an activation.
+* Commits a NEAR-only wallet or completes a mixed wallet's deferred signer.
 */
 async function handleRouterApiWalletRegistrationNearProvisioning(input) {
 	if (!isPlainObject(input.body)) return routeError(400, "invalid_body", "JSON body required");
@@ -1890,7 +1858,7 @@ async function handleRouterApiWalletRegistrationNearProvisioning(input) {
 	if (!registrationCeremonyId || !signedSetup || !idempotencyKey) return routeError(400, "invalid_body", "registrationCeremonyId, signedSetup and idempotencyKey are required");
 	const ed25519 = parseWalletRegistrationEd25519Finalize(body.ed25519);
 	if (!ed25519.ok) return routeError(400, ed25519.code, ed25519.message);
-	const sessionSeal = parseRegistrationPreparedSessionSeal(body.sessionSeal);
+	const sessionSeal = parseRegistrationPreparedSessionSeal(body.sessionSeal, input.signingSessionSeal?.service ?? null);
 	if (!sessionSeal.ok) return routeError(400, sessionSeal.code, sessionSeal.message);
 	const serverTiming = [];
 	const result = await input.services.walletRegistration.completeWalletRegistrationNearProvisioning({
@@ -1901,17 +1869,14 @@ async function handleRouterApiWalletRegistrationNearProvisioning(input) {
 		ed25519: ed25519.value,
 		emailOtpEnrollment: body.emailOtpEnrollment,
 		...body.walletCustodyCommit !== void 0 ? { walletCustodyCommit: body.walletCustodyCommit } : {},
-		verifier: session
-	}, serverTiming);
+		verifier: session,
+		onSessionCommitted: sessionSeal.value?.prepare.bind(sessionSeal.value)
+	}, serverTiming, input.waitUntil);
 	if (!result.ok) return routeJson(400, result);
 	if (sessionSeal.value) {
 		if (!isPasskeyWalletRegistrationNearProvisioningSuccessV2(result)) return routeError(400, "invalid_body", "Registration session sealing requires a passkey authority");
 		const sealStartedAt = Date.now();
-		const sealed = await applyRegistrationPreparedSessionSeal({
-			options: input.signingSessionSeal,
-			request: sessionSeal.value,
-			response: result
-		});
+		const sealed = await sessionSeal.value.finish(result.registrationEstablishedSession.session);
 		serverTiming.push(["near_finalize_session_seal", Math.max(0, Date.now() - sealStartedAt)]);
 		if (!sealed.ok) return routeJson(503, {
 			ok: false,
@@ -1925,83 +1890,6 @@ async function handleRouterApiWalletRegistrationNearProvisioning(input) {
 	}
 	return routeJson(200, result, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
 }
-function parseRegistrationPreparedSessionSeal(raw) {
-	if (raw === void 0) return {
-		ok: true,
-		value: void 0
-	};
-	if (!isPlainObject(raw)) return {
-		ok: false,
-		code: "invalid_body",
-		message: "sessionSeal must be an object"
-	};
-	if (Object.keys(raw).some((field) => ![
-		"thresholdSessionId",
-		"ciphertext",
-		"keyVersion"
-	].includes(field))) return {
-		ok: false,
-		code: "invalid_body",
-		message: "sessionSeal has unknown fields"
-	};
-	const thresholdSessionId = String(raw.thresholdSessionId || "").trim();
-	const ciphertext = String(raw.ciphertext || "").trim();
-	const keyVersion = String(raw.keyVersion || "").trim();
-	if (!thresholdSessionId || !ciphertext) return {
-		ok: false,
-		code: "invalid_body",
-		message: "sessionSeal thresholdSessionId and ciphertext are required"
-	};
-	return {
-		ok: true,
-		value: {
-			thresholdSessionId,
-			ciphertext,
-			...keyVersion ? { keyVersion } : {}
-		}
-	};
-}
-async function applyRegistrationPreparedSessionSeal(args) {
-	if (!args.options) return {
-		ok: false,
-		code: "signing_session_seal_unavailable",
-		message: "Signing-session sealing is unavailable"
-	};
-	const session = args.response.registrationEstablishedSession.session;
-	const tokens = session.tokens;
-	const ed25519 = tokens.kind === "near_ed25519" || tokens.kind === "near_ed25519_and_evm_family_ecdsa" ? tokens.ed25519 : null;
-	if (!ed25519 || String(ed25519.thresholdSessionId) !== args.request.thresholdSessionId) return {
-		ok: false,
-		code: "invalid_session_seal",
-		message: "Prepared seal does not match the established Ed25519 session"
-	};
-	const sealed = await args.options.service.applyServerSeal(args.request, {
-		userId: String(session.walletId),
-		session: {
-			kind: "exact_wallet_session_operation_credential",
-			curve: "ed25519",
-			thresholdSessionId: args.request.thresholdSessionId,
-			userId: String(session.walletId),
-			expiresAtMs: session.expiresAtMs
-		}
-	});
-	if (!sealed.ok) return sealed;
-	const keyVersion = String(sealed.keyVersion || "").trim();
-	if (!keyVersion) return {
-		ok: false,
-		code: "invalid_session_seal",
-		message: "Signing-session seal response is missing its key version"
-	};
-	return {
-		ok: true,
-		value: {
-			ciphertext: sealed.ciphertext,
-			keyVersion,
-			expiresAtMs: Math.min(sealed.expiresAtMs ?? session.expiresAtMs, session.expiresAtMs),
-			remainingUses: session.remainingUses
-		}
-	};
-}
 function ecdsaGatewayServerTimingHeaders(serverTiming) {
 	if (serverTiming.length === 0) return void 0;
 	const header = serverTiming.map(([name, durationMs]) => `${name};dur=${Math.max(0, durationMs).toFixed(1)}`).join(", ");
@@ -2338,6 +2226,6 @@ function registrationContinuationAuthorization(headers) {
 	} : { kind: "registration_grant" };
 }
 //#endregion
-export { handleRouterApiWalletAddAuthMethodEmailOtpChallenge, handleRouterApiWalletAddAuthMethodFinalize, handleRouterApiWalletAddAuthMethodIntent, handleRouterApiWalletAddAuthMethodStart, handleRouterApiWalletAddSignerEcdsaActivation, handleRouterApiWalletAddSignerEcdsaDerivationRespond, handleRouterApiWalletAddSignerFinalize, handleRouterApiWalletAddSignerIntent, handleRouterApiWalletAddSignerStart, handleRouterApiWalletEcdsaKeyFactsInventory, handleRouterApiWalletNearImplicitAccountFund, handleRouterApiWalletRegistrationActivate, handleRouterApiWalletRegistrationNearAdmission, handleRouterApiWalletRegistrationNearProvisioning, handleRouterApiWalletRegistrationRespond, handleRouterApiWalletRegistrationSetup, handleRouterApiWalletRevokeAuthMethod };
+export { handleRouterApiWalletAddAuthMethodEmailOtpChallenge, handleRouterApiWalletAddAuthMethodFinalize, handleRouterApiWalletAddAuthMethodIntent, handleRouterApiWalletAddAuthMethodStart, handleRouterApiWalletAddSignerEcdsaActivation, handleRouterApiWalletAddSignerEcdsaDerivationRespond, handleRouterApiWalletAddSignerFinalize, handleRouterApiWalletAddSignerIntent, handleRouterApiWalletAddSignerStart, handleRouterApiWalletEcdsaKeyFactsInventory, handleRouterApiWalletNearImplicitAccountFund, handleRouterApiWalletRegistrationActivate, handleRouterApiWalletRegistrationNearAdmission, handleRouterApiWalletRegistrationNearProvisioning, handleRouterApiWalletRegistrationRespond, handleRouterApiWalletRegistrationSetup, handleRouterApiWalletRevokeAuthMethod, parseWalletRegistrationSetupRequest };
 
 //# sourceMappingURL=walletRegistrationRoutes.js.map

package/dist/esm/router/domains/walletRegistration/walletRegistrationSetupPayload.js

@@ -1,15 +1,14 @@
+import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
 import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../shared-ts/src/utils/digests.js";
 import "../../../shared-ts/src/utils/encoders.js";
-import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
-import "../../../shared-ts/src/utils/validation.js";
 import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
 //#region src/router/domains/walletRegistration/walletRegistrationSetupPayload.ts
 /**
 * The opaque payload `/wallets/register/setup` mints and routes 2 and 3 verify.
 *
-* Setup admits the application, allocates the wallet, and runs the Router
-* preparation in one request. Routes 2 and 3 then need to know that the
+* Setup admits the application, reserves the wallet, and persists the initial
+* preparation facts in one request. Routes 2 and 3 then need to know that the
 * ceremony they are being driven with is the one setup admitted, and with the
 * parameters setup admitted — without paying another storage round trip to
 * find out. The client carries this string and never parses it.

package/dist/esm/router/domains/walletUnlock/walletUnlockRouteHandlers.js

@@ -454,6 +454,20 @@ async function handleWalletUnlockChallengeRoute(input) {
 		orgId: body.orgId,
 		ttlMs: body.ttlMs
 	});
+	if (!result.ok && result.code === "wallet_home_unavailable") return {
+		status: 503,
+		body: {
+			...result,
+			unlockBackend
+		}
+	};
+	if (!result.ok && result.code === "wallet_home_conflict") return {
+		status: 409,
+		body: {
+			...result,
+			unlockBackend
+		}
+	};
 	return {
 		status: result.ok ? 200 : result.code === "internal" ? 500 : 400,
 		body: {