@seams/wallet-server 0.8.0 → 0.9.0

package/dist/esm/router/domains/walletRegistration/registrationSessionSeal.js

@@ -0,0 +1,121 @@
+import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
+//#region src/router/domains/walletRegistration/registrationSessionSeal.ts
+/** Holds one request's computation until registration can publish its response. */
+var RegistrationPreparedSessionSeal = class {
+	constructor(request, service) {
+		this.request = request;
+		this.service = service;
+		this.prepared = null;
+	}
+	async prepare(session) {
+		await this.finish(session);
+	}
+	async finish(session) {
+		const tokens = session.tokens;
+		const ed25519 = tokens.kind === "near_ed25519" || tokens.kind === "near_ed25519_and_evm_family_ecdsa" ? tokens.ed25519 : null;
+		if (!ed25519 || String(ed25519.thresholdSessionId) !== this.request.thresholdSessionId) return {
+			ok: false,
+			code: "invalid_session_seal",
+			message: "Prepared seal does not match the established Ed25519 session"
+		};
+		if (this.prepared === null) this.prepared = {
+			walletId: String(session.walletId),
+			walletSessionId: String(session.walletSessionId),
+			expiresAtMs: session.expiresAtMs,
+			result: applyRegistrationSessionSeal(this.service, this.request, session)
+		};
+		if (this.prepared.walletId !== String(session.walletId) || this.prepared.walletSessionId !== String(session.walletSessionId) || this.prepared.expiresAtMs !== session.expiresAtMs) return {
+			ok: false,
+			code: "invalid_session_seal",
+			message: "Prepared seal does not match the committed Wallet Session"
+		};
+		const sealed = await this.prepared.result;
+		if (!sealed.ok) return sealed;
+		const keyVersion = String(sealed.keyVersion || "").trim();
+		if (!keyVersion) return {
+			ok: false,
+			code: "invalid_session_seal",
+			message: "Signing-session seal response is missing its key version"
+		};
+		const expiresAtMs = Math.min(sealed.expiresAtMs ?? session.expiresAtMs, session.expiresAtMs);
+		if (expiresAtMs <= Date.now()) return {
+			ok: false,
+			code: "expired",
+			message: "threshold session expired"
+		};
+		return {
+			ok: true,
+			value: {
+				ciphertext: sealed.ciphertext,
+				keyVersion,
+				expiresAtMs,
+				remainingUses: session.remainingUses
+			}
+		};
+	}
+};
+async function applyRegistrationSessionSeal(service, request, session) {
+	if (!service) return {
+		ok: false,
+		code: "signing_session_seal_unavailable",
+		message: "Signing-session sealing is unavailable"
+	};
+	try {
+		return await service.applyServerSeal(request, {
+			userId: String(session.walletId),
+			session: {
+				kind: "exact_wallet_session_operation_credential",
+				curve: "ed25519",
+				thresholdSessionId: request.thresholdSessionId,
+				userId: String(session.walletId),
+				expiresAtMs: session.expiresAtMs
+			}
+		});
+	} catch {
+		return {
+			ok: false,
+			code: "signing_session_seal_unavailable",
+			message: "Signing-session sealing failed"
+		};
+	}
+}
+function parseRegistrationPreparedSessionSeal(raw, service) {
+	if (raw === void 0) return {
+		ok: true,
+		value: null
+	};
+	if (!isPlainObject(raw)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "sessionSeal must be an object"
+	};
+	for (const field of Object.keys(raw)) if (![
+		"thresholdSessionId",
+		"ciphertext",
+		"keyVersion"
+	].includes(field)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "sessionSeal has unknown fields"
+	};
+	const thresholdSessionId = String(raw.thresholdSessionId || "").trim();
+	const ciphertext = String(raw.ciphertext || "").trim();
+	const keyVersion = String(raw.keyVersion || "").trim();
+	if (!thresholdSessionId || !ciphertext) return {
+		ok: false,
+		code: "invalid_body",
+		message: "sessionSeal thresholdSessionId and ciphertext are required"
+	};
+	return {
+		ok: true,
+		value: new RegistrationPreparedSessionSeal({
+			thresholdSessionId,
+			ciphertext,
+			...keyVersion ? { keyVersion } : {}
+		}, service)
+	};
+}
+//#endregion
+export { parseRegistrationPreparedSessionSeal };
+
+//# sourceMappingURL=registrationSessionSeal.js.map

package/dist/esm/router/domains/walletRegistration/walletRegistrationReservation.js

@@ -1,7 +1,7 @@
 import { parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId } from "../../../shared-ts/src/utils/domainIds.js";
 import { parseDeviceId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
-import { alphabetizeStringify, sha256HexUtf8 } from "../../../shared-ts/src/utils/digests.js";
 import { isPlainObject, requireCanonicalString } from "../../../shared-ts/src/utils/validation.js";
+import { alphabetizeStringify, sha256HexUtf8 } from "../../../shared-ts/src/utils/digests.js";
 import { secureRandomBase64Url } from "../../../shared-ts/src/utils/secureRandomId.js";
 import { createServerAllocatedWalletId } from "../../../shared-ts/src/utils/registrationIds.js";
 //#region src/router/domains/walletRegistration/walletRegistrationReservation.ts
@@ -48,13 +48,13 @@ async function walletRegistrationSetupRequestDigest(namespace, input) {
 		signerSelection: input.request.signerSelection
 	}));
 }
-async function completeRegistrationReservation(authority, input) {
+async function cancelRegistrationHome(authority, input) {
 	if (!authority) return {
 		ok: false,
 		code: "registration_authority_unavailable",
 		message: "Registration reservation authority is required"
 	};
-	return authority.complete(input);
+	return authority.cancel(input);
 }
 async function admitRegistrationReservationHome(authority, input) {
 	if (!authority) return {
@@ -65,6 +65,6 @@ async function admitRegistrationReservationHome(authority, input) {
 	return authority.admitHome(input);
 }
 //#endregion
-export { admitRegistrationReservationHome, completeRegistrationReservation, parseWalletRegistrationSetupReservation, proposeWalletRegistrationSetup, walletRegistrationSetupRequestDigest };
+export { admitRegistrationReservationHome, cancelRegistrationHome, parseWalletRegistrationSetupReservation, proposeWalletRegistrationSetup, walletRegistrationSetupRequestDigest };
 
 //# sourceMappingURL=walletRegistrationReservation.js.map

package/dist/esm/router/domains/walletRegistration/walletRegistrationRoutes.js

@@ -1,10 +1,10 @@
 import { parseWalletAuthMethodId, parseWalletId, parseWebAuthnRpId } from "../../../shared-ts/src/utils/domainIds.js";
 import { EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS, parseWalletSessionId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
+import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
 import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
 import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { base58Encode } from "../../../shared-ts/src/utils/base58.js";
 import "../../../shared-ts/src/utils/encoders.js";
-import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
 import { ecdsaClientRootPublicKey33B64uFromString } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
 import { parseRouterAbEcdsaRegistrationActivationRequestV1, parseRouterAbEcdsaRegistrationRequestV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
@@ -13,20 +13,20 @@ import { parseHostedWalletSessionOperationCredentialToken, parsePrimaryWalletSes
 import { normalizeCorsOrigin } from "../../../core/SessionService.js";
 import { thresholdEcdsaChainTargetFromValue } from "../../../core/thresholdEcdsaChainTarget.js";
 import { walletIdFromString } from "../../../shared-ts/src/utils/registrationIds.js";
-import { parseRouterAbTraceContextV1 } from "../../../shared-ts/src/utils/routerAbTraceContext.js";
 import { parseRegistrationSetupOperationId } from "../../../shared-ts/src/utils/registrationSetupOperation.js";
 import { extractBearerCredential, extractRouterApiEnvironmentId } from "../../auth/routerApiKeyAuth.js";
-import { resolvePublishableKeyApiCredentialAuth } from "../../auth/routerApiCredentialAuth.js";
+import { publishableKeyRoutePrincipal, resolvePublishableKeyApiCredentialAuth, resolveWalletRegistrationContext } from "../../auth/routerApiCredentialAuth.js";
 import { resolveActiveRuntimePolicyScopeForEnvironment, resolveWalletSessionAdministrationAdmission, resolveWalletSessionOperationCredentialAdmission, resolveWalletSessionOperationCredentialAdmissionFromContext } from "../../auth/commonRouterUtils.js";
 import { enforceRoutePolicy } from "../../framework/enforceRoutePolicy.js";
+import { parseRegistrationPreparedSessionSeal } from "./registrationSessionSeal.js";
 import { routeError, routeJson } from "../../framework/routeResponses.js";
 import { parsePasskeyCustodyEnvelopeRecord } from "../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../shared-ts/src/passkey-custody/index.js";
-import { verifyWalletRegistrationSetupClaims } from "./walletRegistrationSetupPayload.js";
 import { computeWalletEcdsaKeyFactsInventoryChallengeDigestB64u } from "../../../shared-ts/src/utils/ecdsaKeyFactsInventory.js";
 import { deriveImplicitNearAccountIdFromEd25519PublicKey, parseImplicitNearAccountId } from "../../../shared-ts/src/utils/near.js";
 import { normalizeRegistrationSignerPlan, registrationSignerSetSelectionFromPlan } from "../../../shared-ts/src/utils/registrationSignerPlan.js";
 import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, computeAddAuthMethodIntentDigestB64u, computeAddSignerIntentDigestB64u, normalizeAddAuthMethodIntentCaller } from "../../../shared-ts/src/utils/registrationIntent.js";
+import { parseRouterAbTraceContextV1 } from "../../../shared-ts/src/utils/routerAbTraceContext.js";
 //#region src/router/domains/walletRegistration/walletRegistrationRoutes.ts
 function parseRegistrationTraceContext(headers) {
 	const parsed = parseRouterAbTraceContextV1(headers["x-seams-trace-id"] ?? headers["X-Seams-Trace-Id"]);
@@ -1568,8 +1568,27 @@ async function handleRouterApiWalletRegistrationSetup(input) {
 	if (!isPlainObject(input.body)) return routeError(400, "invalid_body", "JSON body required");
 	const origin = normalizeCorsOrigin(input.origin);
 	if (!origin) return routeError(403, "forbidden", "Origin header is required and must be a valid exact origin");
-	const publishableKeyAuth = input.services.publishableKeyAuth;
-	if (!publishableKeyAuth) return routeError(500, "route_auth_not_configured", "wallet registration setup requires publishable key auth on this server");
+	const registrationContext = input.services.registrationContext;
+	if (!registrationContext) return routeError(500, "route_auth_not_configured", "Wallet registration context is not configured");
+	const request = parseWalletRegistrationSetupRequest(input.body);
+	if (!request.ok) return routeError(400, request.code, request.message);
+	const context = await resolveWalletRegistrationContext({
+		registration: request.value,
+		environmentId: extractRouterApiEnvironmentId(input.headers) || void 0,
+		headers: input.headers,
+		missingEnvironmentMessage: "Environment header is required for wallet registration setup",
+		missingOriginMessage: "Origin header is required and must be a valid exact origin",
+		missingPublishableKeyMessage: "Missing publishable key",
+		origin,
+		registrationContext,
+		route: input.route,
+		routeAuthNotConfiguredMessage: "Wallet registration setup requires API credential auth policy"
+	});
+	if (!context.ok) {
+		if (context.status === 401) return routeError(401, "unauthorized", `${context.code}: ${context.message}`);
+		if (context.status === 403) return routeError(403, "forbidden", `${context.code}: ${context.message}`);
+		return routeError(context.status, "internal", `${context.code}: ${context.message}`);
+	}
 	const resolved = await enforceRoutePolicy({
 		headers: input.headers,
 		logger: input.logger,
@@ -1580,42 +1599,26 @@ async function handleRouterApiWalletRegistrationSetup(input) {
 		route: input.route,
 		services: walletRegistrationRoutePolicyServices(input),
 		sourceIp: input.sourceIp,
-		resolvers: { apiCredentials: async () => await resolvePublishableKeyApiCredentialAuth({
-			environmentId: extractRouterApiEnvironmentId(input.headers) || void 0,
-			headers: input.headers,
-			missingEnvironmentMessage: "Environment header is required for wallet registration setup",
-			missingOriginMessage: "Origin header is required and must be a valid exact origin",
-			missingPublishableKeyMessage: "Missing publishable key",
-			origin,
-			publishableKeyAuth,
-			route: input.route,
-			routeAuthNotConfiguredMessage: "Wallet registration setup requires API credential auth policy"
-		}) }
+		resolvers: { apiCredentials: publishableKeyRoutePrincipal.bind(void 0, context.principal) }
 	});
 	if (!resolved.ok) return routeJson(resolved.status, resolved.body);
-	if (resolved.context.principal.kind !== "api_credentials") return routeError(500, "internal", "wallet registration setup requires API credentials");
-	const principal = resolved.context.principal.principal;
-	const runtimePolicyScope = await resolveActiveRuntimePolicyScopeForEnvironment({
-		orgProjectEnv: input.services.orgProjectEnv || null,
+	const principal = context.principal;
+	const runtimePolicyScope = {
 		orgId: principal.orgId,
-		environmentId: principal.environmentId,
-		projectId: principal.projectId,
-		envId: principal.envId
-	});
+		projectId: context.environment.projectId,
+		envId: context.environment.key,
+		signingRootVersion: context.environment.signingRootVersion
+	};
 	const session = input.services.session;
 	if (!session) return routeError(500, "internal", "wallet registration setup requires session signing");
-	const request = parseWalletRegistrationSetupRequest(input.body);
-	if (!request.ok) return routeError(400, request.code, request.message);
 	return input.services.walletRegistration.setupWalletRegistration({
 		request: request.value,
 		orgId: principal.orgId,
 		expectedOrigin: origin,
 		signer: session,
-		...runtimePolicyScope ? { runtimePolicyScope } : {},
-		...runtimePolicyScope ? {
-			signingRootId: `${runtimePolicyScope.projectId}:${runtimePolicyScope.envId}`,
-			signingRootVersion: runtimePolicyScope.signingRootVersion
-		} : {}
+		runtimePolicyScope,
+		signingRootId: `${runtimePolicyScope.projectId}:${runtimePolicyScope.envId}`,
+		signingRootVersion: runtimePolicyScope.signingRootVersion
 	});
 }
 /**
@@ -1781,30 +1784,6 @@ function parseRegistrationRequestDigestB64u(raw) {
 		return null;
 	}
 }
-async function projectActivatedWallet(input) {
-	const walletProjection = input.services.walletProjection || null;
-	if (!walletProjection) return null;
-	const verifier = input.services.session;
-	if (!verifier) return "wallet projection requires setup verification";
-	const verified = await verifyWalletRegistrationSetupClaims(verifier, input.signedSetup, {
-		registrationCeremonyId: input.registrationCeremonyId,
-		nowMs: Date.now()
-	});
-	if (!verified.ok) return verified.message;
-	if (verified.claims.policy.kind !== "runtime_policy_scope") return "wallet projection requires an exact runtime policy scope";
-	if (verified.claims.policy.scope.orgId !== verified.claims.orgId) return "wallet projection scope does not match its organization";
-	try {
-		await walletProjection.recordCreatedWallet({
-			orgId: verified.claims.orgId,
-			runtimePolicyScope: verified.claims.policy.scope,
-			walletId: verified.claims.walletId,
-			occurredAt: (/* @__PURE__ */ new Date()).toISOString()
-		});
-		return null;
-	} catch (error) {
-		return error instanceof Error ? error.message : String(error);
-	}
-}
 /**
 * `POST /wallets/register/activate` — activation and finalization behind
 * one Gateway operation row.
@@ -1823,9 +1802,7 @@ async function handleRouterApiWalletRegistrationActivate(input) {
 	const idempotencyKey = String(body.idempotencyKey || "").trim();
 	if (!idempotencyKey) return routeError(400, "invalid_body", "idempotencyKey is required");
 	const planKind = String(body.kind || "").trim();
-	if (planKind !== "evm_family_ecdsa" && planKind !== "near_ed25519_and_evm_family_ecdsa" && planKind !== "near_ed25519") return routeError(400, "invalid_body", "kind must name the signer plan");
-	const ed25519Only = planKind === "near_ed25519";
-	if (ed25519Only && body.ecdsa !== void 0) return routeError(400, "invalid_body", "an Ed25519-only activate carries no ECDSA activation");
+	if (planKind !== "evm_family_ecdsa" && planKind !== "near_ed25519_and_evm_family_ecdsa") return routeError(400, "invalid_body", "activation requires an ECDSA signer plan");
 	const ecdsa = isPlainObject(body.ecdsa) ? body.ecdsa : null;
 	const unknownEcdsaField = ecdsa ? findUnknownField(ecdsa, [
 		"activationCorrelationId",
@@ -1833,9 +1810,9 @@ async function handleRouterApiWalletRegistrationActivate(input) {
 		"clientActivation"
 	]) : null;
 	if (unknownEcdsaField) return routeError(400, "invalid_body", `wallet registration ECDSA activation field ${unknownEcdsaField} is unsupported`);
-	if (!ed25519Only && (!ecdsa || typeof ecdsa.activationCorrelationId !== "string" || typeof ecdsa.activationRequestDigestB64u !== "string" || !isPlainObject(ecdsa.clientActivation))) return routeError(400, "invalid_body", "browser-verified clientActivation is required");
+	if (!ecdsa || typeof ecdsa.activationCorrelationId !== "string" || typeof ecdsa.activationRequestDigestB64u !== "string" || !isPlainObject(ecdsa.clientActivation)) return routeError(400, "invalid_body", "browser-verified clientActivation is required");
 	let parsedActivation;
-	if (ecdsa) try {
+	try {
 		const parsed = parseRouterAbEcdsaRegistrationActivationRequestV1({
 			registrationCeremonyId,
 			ecdsa: {
@@ -1858,25 +1835,17 @@ async function handleRouterApiWalletRegistrationActivate(input) {
 		signedSetup,
 		idempotencyKey,
 		planKind,
-		...parsedActivation ? { ecdsa: parsedActivation } : {},
+		ecdsa: parsedActivation,
 		...body.emailOtpEnrollment ? { emailOtpEnrollment: body.emailOtpEnrollment } : {},
 		...body.walletCustodyCommit !== void 0 ? { walletCustodyCommit: body.walletCustodyCommit } : {},
 		verifier: session
 	}, traceContext.value ?? void 0, serverTiming);
 	if (!result.ok) return routeJson(400, result);
 	if (!isEmailOtpWalletRegistrationActivateSuccessV2(result) && !isPasskeyWalletRegistrationActivateSuccessV2(result)) return routeError(500, "internal", "Wallet registration activation returned an invalid authority");
-	const projectionError = await projectActivatedWallet({
-		registrationCeremonyId,
-		services: input.services,
-		signedSetup
-	});
-	if (projectionError) return routeError(500, "internal", `Wallet was created but its Console projection failed: ${projectionError}`);
 	return routeJson(200, result, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
 }
 /**
-* `POST /wallets/register/near-provisioning` — the non-blocking completion
-* the client calls after activate, once its already-running Yao computation
-* produces an activation.
+* Commits a NEAR-only wallet or completes a mixed wallet's deferred signer.
 */
 async function handleRouterApiWalletRegistrationNearProvisioning(input) {
 	if (!isPlainObject(input.body)) return routeError(400, "invalid_body", "JSON body required");
@@ -1889,7 +1858,7 @@ async function handleRouterApiWalletRegistrationNearProvisioning(input) {
 	if (!registrationCeremonyId || !signedSetup || !idempotencyKey) return routeError(400, "invalid_body", "registrationCeremonyId, signedSetup and idempotencyKey are required");
 	const ed25519 = parseWalletRegistrationEd25519Finalize(body.ed25519);
 	if (!ed25519.ok) return routeError(400, ed25519.code, ed25519.message);
-	const sessionSeal = parseRegistrationPreparedSessionSeal(body.sessionSeal);
+	const sessionSeal = parseRegistrationPreparedSessionSeal(body.sessionSeal, input.signingSessionSeal?.service ?? null);
 	if (!sessionSeal.ok) return routeError(400, sessionSeal.code, sessionSeal.message);
 	const serverTiming = [];
 	const result = await input.services.walletRegistration.completeWalletRegistrationNearProvisioning({
@@ -1900,17 +1869,14 @@ async function handleRouterApiWalletRegistrationNearProvisioning(input) {
 		ed25519: ed25519.value,
 		emailOtpEnrollment: body.emailOtpEnrollment,
 		...body.walletCustodyCommit !== void 0 ? { walletCustodyCommit: body.walletCustodyCommit } : {},
-		verifier: session
-	}, serverTiming);
+		verifier: session,
+		onSessionCommitted: sessionSeal.value?.prepare.bind(sessionSeal.value)
+	}, serverTiming, input.waitUntil);
 	if (!result.ok) return routeJson(400, result);
 	if (sessionSeal.value) {
 		if (!isPasskeyWalletRegistrationNearProvisioningSuccessV2(result)) return routeError(400, "invalid_body", "Registration session sealing requires a passkey authority");
 		const sealStartedAt = Date.now();
-		const sealed = await applyRegistrationPreparedSessionSeal({
-			options: input.signingSessionSeal,
-			request: sessionSeal.value,
-			response: result
-		});
+		const sealed = await sessionSeal.value.finish(result.registrationEstablishedSession.session);
 		serverTiming.push(["near_finalize_session_seal", Math.max(0, Date.now() - sealStartedAt)]);
 		if (!sealed.ok) return routeJson(503, {
 			ok: false,
@@ -1924,83 +1890,6 @@ async function handleRouterApiWalletRegistrationNearProvisioning(input) {
 	}
 	return routeJson(200, result, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
 }
-function parseRegistrationPreparedSessionSeal(raw) {
-	if (raw === void 0) return {
-		ok: true,
-		value: void 0
-	};
-	if (!isPlainObject(raw)) return {
-		ok: false,
-		code: "invalid_body",
-		message: "sessionSeal must be an object"
-	};
-	if (Object.keys(raw).some((field) => ![
-		"thresholdSessionId",
-		"ciphertext",
-		"keyVersion"
-	].includes(field))) return {
-		ok: false,
-		code: "invalid_body",
-		message: "sessionSeal has unknown fields"
-	};
-	const thresholdSessionId = String(raw.thresholdSessionId || "").trim();
-	const ciphertext = String(raw.ciphertext || "").trim();
-	const keyVersion = String(raw.keyVersion || "").trim();
-	if (!thresholdSessionId || !ciphertext) return {
-		ok: false,
-		code: "invalid_body",
-		message: "sessionSeal thresholdSessionId and ciphertext are required"
-	};
-	return {
-		ok: true,
-		value: {
-			thresholdSessionId,
-			ciphertext,
-			...keyVersion ? { keyVersion } : {}
-		}
-	};
-}
-async function applyRegistrationPreparedSessionSeal(args) {
-	if (!args.options) return {
-		ok: false,
-		code: "signing_session_seal_unavailable",
-		message: "Signing-session sealing is unavailable"
-	};
-	const session = args.response.registrationEstablishedSession.session;
-	const tokens = session.tokens;
-	const ed25519 = tokens.kind === "near_ed25519" || tokens.kind === "near_ed25519_and_evm_family_ecdsa" ? tokens.ed25519 : null;
-	if (!ed25519 || String(ed25519.thresholdSessionId) !== args.request.thresholdSessionId) return {
-		ok: false,
-		code: "invalid_session_seal",
-		message: "Prepared seal does not match the established Ed25519 session"
-	};
-	const sealed = await args.options.service.applyServerSeal(args.request, {
-		userId: String(session.walletId),
-		session: {
-			kind: "exact_wallet_session_operation_credential",
-			curve: "ed25519",
-			thresholdSessionId: args.request.thresholdSessionId,
-			userId: String(session.walletId),
-			expiresAtMs: session.expiresAtMs
-		}
-	});
-	if (!sealed.ok) return sealed;
-	const keyVersion = String(sealed.keyVersion || "").trim();
-	if (!keyVersion) return {
-		ok: false,
-		code: "invalid_session_seal",
-		message: "Signing-session seal response is missing its key version"
-	};
-	return {
-		ok: true,
-		value: {
-			ciphertext: sealed.ciphertext,
-			keyVersion,
-			expiresAtMs: Math.min(sealed.expiresAtMs ?? session.expiresAtMs, session.expiresAtMs),
-			remainingUses: session.remainingUses
-		}
-	};
-}
 function ecdsaGatewayServerTimingHeaders(serverTiming) {
 	if (serverTiming.length === 0) return void 0;
 	const header = serverTiming.map(([name, durationMs]) => `${name};dur=${Math.max(0, durationMs).toFixed(1)}`).join(", ");
@@ -2337,6 +2226,6 @@ function registrationContinuationAuthorization(headers) {
 	} : { kind: "registration_grant" };
 }
 //#endregion
-export { handleRouterApiWalletAddAuthMethodEmailOtpChallenge, handleRouterApiWalletAddAuthMethodFinalize, handleRouterApiWalletAddAuthMethodIntent, handleRouterApiWalletAddAuthMethodStart, handleRouterApiWalletAddSignerEcdsaActivation, handleRouterApiWalletAddSignerEcdsaDerivationRespond, handleRouterApiWalletAddSignerFinalize, handleRouterApiWalletAddSignerIntent, handleRouterApiWalletAddSignerStart, handleRouterApiWalletEcdsaKeyFactsInventory, handleRouterApiWalletNearImplicitAccountFund, handleRouterApiWalletRegistrationActivate, handleRouterApiWalletRegistrationNearAdmission, handleRouterApiWalletRegistrationNearProvisioning, handleRouterApiWalletRegistrationRespond, handleRouterApiWalletRegistrationSetup, handleRouterApiWalletRevokeAuthMethod };
+export { handleRouterApiWalletAddAuthMethodEmailOtpChallenge, handleRouterApiWalletAddAuthMethodFinalize, handleRouterApiWalletAddAuthMethodIntent, handleRouterApiWalletAddAuthMethodStart, handleRouterApiWalletAddSignerEcdsaActivation, handleRouterApiWalletAddSignerEcdsaDerivationRespond, handleRouterApiWalletAddSignerFinalize, handleRouterApiWalletAddSignerIntent, handleRouterApiWalletAddSignerStart, handleRouterApiWalletEcdsaKeyFactsInventory, handleRouterApiWalletNearImplicitAccountFund, handleRouterApiWalletRegistrationActivate, handleRouterApiWalletRegistrationNearAdmission, handleRouterApiWalletRegistrationNearProvisioning, handleRouterApiWalletRegistrationRespond, handleRouterApiWalletRegistrationSetup, handleRouterApiWalletRevokeAuthMethod, parseWalletRegistrationSetupRequest };
 
 //# sourceMappingURL=walletRegistrationRoutes.js.map

package/dist/esm/router/domains/walletRegistration/walletRegistrationSetupPayload.js

@@ -1,7 +1,7 @@
+import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
 import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../shared-ts/src/utils/digests.js";
 import "../../../shared-ts/src/utils/encoders.js";
-import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
 import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
 //#region src/router/domains/walletRegistration/walletRegistrationSetupPayload.ts
 /**