@waiaas/daemon 2.4.0 → 2.5.0-rc.1

package/dist/api/routes/admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../../src/api/routes/admin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,WAAW,EAAkB,MAAM,mBAAmB,CAAC;AAEhE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,KAAK,EAAE,QAAQ,IAAI,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAKjE,OAAO,KAAK,EAAyE,YAAY,EAAE,iBAAiB,EAAgB,MAAM,cAAc,CAAC;AAEzJ,OAAO,KAAK,EAAE,gBAAgB,EAAc,MAAM,gDAAgD,CAAC;AAInG,OAAO,KAAK,KAAK,MAAM,MAAM,yCAAyC,CAAC;AACvE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AACvF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AAE9E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAExE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8CAA8C,CAAC;AAChF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uDAAuD,CAAC;AA8BjG,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,qBAAqB,CAAC,OAAO,MAAM,CAAC,CAAC;IACzC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,kBAAkB,EAAE,MAAM,eAAe,CAAC;IAC1C,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAClE,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,kBAAkB,CAAC,EAAE,YAAY,CAAC,eAAe,CAAC,CAAC;IACnD,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,iBAAiB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;IACpD,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,WAAW,CAAC,EAAE,YAAY,CAAC;IAC3B,YAAY,CAAC,EAAE;QAAE,yBAAyB,EAAE,OAAO,CAAC;QAAC,wBAAwB,EAAE,MAAM,CAAA;KAAE,CAAC;IACxF,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IAChD,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;IACrC,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mBAAmB,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;CAClD;AAkmBD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,cAAc,GAAG,WAAW,CA0wC7D"}
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../../src/api/routes/admin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,WAAW,EAAkB,MAAM,mBAAmB,CAAC;AAEhE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,KAAK,EAAE,QAAQ,IAAI,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGjE,OAAO,KAAK,EAAyE,YAAY,EAAE,iBAAiB,EAAgB,MAAM,cAAc,CAAC;AAEzJ,OAAO,KAAK,EAAE,gBAAgB,EAAc,MAAM,gDAAgD,CAAC;AAInG,OAAO,KAAK,KAAK,MAAM,MAAM,yCAAyC,CAAC;AACvE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAC;AACvF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AAE9E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAExE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8CAA8C,CAAC;AAChF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yDAAyD,CAAC;AACtG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uDAAuD,CAAC;AA+BjG,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,qBAAqB,CAAC,OAAO,MAAM,CAAC,CAAC;IACzC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,kBAAkB,EAAE,MAAM,eAAe,CAAC;IAC1C,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IAClE,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,kBAAkB,CAAC,EAAE,YAAY,CAAC,eAAe,CAAC,CAAC;IACnD,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,iBAAiB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;IACpD,WAAW,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IACjC,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,WAAW,CAAC,EAAE,YAAY,CAAC;IAC3B,YAAY,CAAC,EAAE;QAAE,yBAAyB,EAAE,OAAO,CAAC;QAAC,wBAAwB,EAAE,MAAM,CAAA;KAAE,CAAC;IACxF,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IAChD,gBAAgB,CAAC,EAAE,iBAAiB,CAAC;IACrC,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mBAAmB,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;CAClD;AAkhBD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,cAAc,GAAG,WAAW,CA+xC7D"}

package/dist/api/routes/admin.js

@@ -26,10 +26,8 @@
  * @see docs/36-killswitch-evm-freeze.md
  */
 import { OpenAPIHono, createRoute, z } from '@hono/zod-openapi';
-import { sql, desc, eq, and, count as drizzleCount } from 'drizzle-orm';
+import { sql, desc, eq, and, isNull, gt, count as drizzleCount } from 'drizzle-orm';
 import { createHash } from 'node:crypto';
-import { writeFile, rename, mkdir } from 'node:fs/promises';
-import { join, dirname } from 'node:path';
 import { WAIaaSError, getDefaultNetwork, getNetworksForEnvironment } from '@waiaas/core';
 import { CurrencyCodeSchema, formatRatePreview } from '@waiaas/core';
 import { wallets, sessions, sessionWallets, notificationLogs, policies, transactions } from '../../infrastructure/database/schema.js';
@@ -37,7 +35,7 @@ import { generateId } from '../../infrastructure/database/id.js';
 import { buildConnectInfoPrompt } from './connect-info.js';
 import { getSettingDefinition } from '../../infrastructure/settings/index.js';
 import { resolveRpcUrl } from '../../infrastructure/adapter-pool.js';
-import { AdminStatusResponseSchema, KillSwitchResponseSchema, KillSwitchActivateResponseSchema, KillSwitchEscalateResponseSchema, RecoverResponseSchema, KillSwitchRecoverRequestSchema, ShutdownResponseSchema, RotateSecretResponseSchema, NotificationStatusResponseSchema, NotificationTestRequestSchema, NotificationTestResponseSchema, NotificationLogResponseSchema, SettingsResponseSchema, SettingsUpdateRequestSchema, SettingsUpdateResponseSchema, TestRpcRequestSchema, TestRpcResponseSchema, OracleStatusResponseSchema, AgentPromptRequestSchema, AgentPromptResponseSchema, buildErrorResponses, openApiValidationHook, } from './openapi-schemas.js';
+import { AdminStatusResponseSchema, KillSwitchResponseSchema, KillSwitchActivateResponseSchema, KillSwitchEscalateResponseSchema, RecoverResponseSchema, KillSwitchRecoverRequestSchema, ShutdownResponseSchema, RotateSecretResponseSchema, NotificationStatusResponseSchema, NotificationTestRequestSchema, NotificationTestResponseSchema, NotificationLogResponseSchema, SettingsResponseSchema, SettingsUpdateRequestSchema, SettingsUpdateResponseSchema, TestRpcRequestSchema, TestRpcResponseSchema, OracleStatusResponseSchema, AgentPromptRequestSchema, AgentPromptResponseSchema, SessionReissueResponseSchema, buildErrorResponses, openApiValidationHook, } from './openapi-schemas.js';
 // ---------------------------------------------------------------------------
 // Route definitions
 // ---------------------------------------------------------------------------
@@ -435,82 +433,6 @@ const adminWalletBalanceRoute = createRoute({
     },
 });
 // ---------------------------------------------------------------------------
-// Bulk session/MCP token route definitions
-// ---------------------------------------------------------------------------
-const BulkResultItemSchema = z.object({
-    walletId: z.string().uuid(),
-    walletName: z.string().nullable(),
-    sessionId: z.string().uuid().optional(),
-    token: z.string().optional(),
-    tokenPath: z.string().optional(),
-    error: z.string().optional(),
-});
-const adminBulkSessionsRoute = createRoute({
-    method: 'post',
-    path: '/admin/sessions/bulk',
-    tags: ['Admin'],
-    summary: 'Create sessions for multiple wallets at once',
-    request: {
-        body: {
-            content: {
-                'application/json': {
-                    schema: z.object({
-                        walletIds: z.array(z.string().uuid()).min(1).max(50),
-                        ttl: z.number().int().min(300).optional(),
-                    }),
-                },
-            },
-        },
-    },
-    responses: {
-        200: {
-            description: 'Bulk session creation results',
-            content: {
-                'application/json': {
-                    schema: z.object({
-                        results: z.array(BulkResultItemSchema),
-                        created: z.number().int(),
-                        failed: z.number().int(),
-                    }),
-                },
-            },
-        },
-    },
-});
-const adminBulkMcpTokensRoute = createRoute({
-    method: 'post',
-    path: '/admin/mcp/tokens/bulk',
-    tags: ['Admin'],
-    summary: 'Create MCP tokens for multiple wallets at once',
-    request: {
-        body: {
-            content: {
-                'application/json': {
-                    schema: z.object({
-                        walletIds: z.array(z.string().uuid()).min(1).max(50),
-                        ttl: z.number().int().min(300).optional(),
-                    }),
-                },
-            },
-        },
-    },
-    responses: {
-        200: {
-            description: 'Bulk MCP token creation results',
-            content: {
-                'application/json': {
-                    schema: z.object({
-                        results: z.array(BulkResultItemSchema),
-                        created: z.number().int(),
-                        failed: z.number().int(),
-                        claudeDesktopConfig: z.record(z.unknown()),
-                    }),
-                },
-            },
-        },
-    },
-});
-// ---------------------------------------------------------------------------
 // Telegram Users route definitions
 // ---------------------------------------------------------------------------
 const TelegramUserSchema = z.object({
@@ -1393,132 +1315,6 @@ export function adminRoutes(deps) {
         return c.json({ success: true }, 200);
     });
     // ---------------------------------------------------------------------------
-    // POST /admin/sessions/bulk — Bulk create sessions
-    // ---------------------------------------------------------------------------
-    router.openapi(adminBulkSessionsRoute, async (c) => {
-        if (!deps.jwtSecretManager || !deps.daemonConfig) {
-            throw new WAIaaSError('ADAPTER_NOT_AVAILABLE', { message: 'JWT signing not available' });
-        }
-        const { walletIds, ttl: reqTtl } = c.req.valid('json');
-        const config = deps.daemonConfig;
-        const nowSec = Math.floor(Date.now() / 1000);
-        const ttl = reqTtl ?? config.security.session_ttl;
-        const expiresAt = nowSec + ttl;
-        const absoluteExpiresAt = nowSec + config.security.session_absolute_lifetime;
-        const results = [];
-        for (const walletId of walletIds) {
-            try {
-                const wallet = deps.db.select().from(wallets).where(eq(wallets.id, walletId)).get();
-                if (!wallet) {
-                    results.push({ walletId, walletName: null, error: 'Wallet not found' });
-                    continue;
-                }
-                if (wallet.status === 'TERMINATED') {
-                    results.push({ walletId, walletName: wallet.name, error: 'Wallet terminated' });
-                    continue;
-                }
-                const sessionId = generateId();
-                const jwtPayload = { sub: sessionId, wlt: walletId, iat: nowSec, exp: expiresAt };
-                const token = await deps.jwtSecretManager.signToken(jwtPayload);
-                const tokenHash = createHash('sha256').update(token).digest('hex');
-                deps.db.insert(sessions).values({
-                    id: sessionId, tokenHash,
-                    expiresAt: new Date(expiresAt * 1000),
-                    absoluteExpiresAt: new Date(absoluteExpiresAt * 1000),
-                    createdAt: new Date(nowSec * 1000),
-                    renewalCount: 0, maxRenewals: config.security.session_max_renewals,
-                    constraints: null, source: 'api',
-                }).run();
-                deps.db.insert(sessionWallets).values({
-                    sessionId, walletId, isDefault: true, createdAt: new Date(nowSec * 1000),
-                }).run();
-                void deps.notificationService?.notify('SESSION_CREATED', walletId, { sessionId });
-                results.push({ walletId, walletName: wallet.name, sessionId, token });
-            }
-            catch (err) {
-                const msg = err instanceof Error ? err.message : String(err);
-                results.push({ walletId, walletName: null, error: msg });
-            }
-        }
-        const created = results.filter((r) => !r.error).length;
-        return c.json({ results, created, failed: results.length - created }, 200);
-    });
-    // ---------------------------------------------------------------------------
-    // POST /admin/mcp/tokens/bulk — Bulk create MCP tokens
-    // ---------------------------------------------------------------------------
-    router.openapi(adminBulkMcpTokensRoute, async (c) => {
-        if (!deps.jwtSecretManager || !deps.daemonConfig || !deps.dataDir) {
-            throw new WAIaaSError('ADAPTER_NOT_AVAILABLE', { message: 'JWT signing not available' });
-        }
-        const { walletIds, ttl: reqTtl } = c.req.valid('json');
-        const config = deps.daemonConfig;
-        const nowSec = Math.floor(Date.now() / 1000);
-        const ttl = reqTtl ?? config.security.session_ttl;
-        const expiresAt = nowSec + ttl;
-        const absoluteExpiresAt = nowSec + config.security.session_absolute_lifetime;
-        const baseUrl = `http://127.0.0.1:${config.daemon.port}`;
-        const results = [];
-        const claudeDesktopConfig = {};
-        const toSlug = (name) => {
-            const slug = name.toLowerCase().replace(/[^a-z0-9-]/g, '-').replace(/-{2,}/g, '-').replace(/^-|-$/g, '');
-            return slug || 'wallet';
-        };
-        for (const walletId of walletIds) {
-            try {
-                const wallet = deps.db.select().from(wallets).where(eq(wallets.id, walletId)).get();
-                if (!wallet) {
-                    results.push({ walletId, walletName: null, error: 'Wallet not found' });
-                    continue;
-                }
-                if (wallet.status === 'TERMINATED') {
-                    results.push({ walletId, walletName: wallet.name, error: 'Wallet terminated' });
-                    continue;
-                }
-                const sessionId = generateId();
-                const jwtPayload = { sub: sessionId, wlt: walletId, iat: nowSec, exp: expiresAt };
-                const token = await deps.jwtSecretManager.signToken(jwtPayload);
-                const tokenHash = createHash('sha256').update(token).digest('hex');
-                deps.db.insert(sessions).values({
-                    id: sessionId, tokenHash,
-                    expiresAt: new Date(expiresAt * 1000),
-                    absoluteExpiresAt: new Date(absoluteExpiresAt * 1000),
-                    createdAt: new Date(nowSec * 1000),
-                    renewalCount: 0, maxRenewals: config.security.session_max_renewals,
-                    constraints: null, source: 'mcp',
-                }).run();
-                deps.db.insert(sessionWallets).values({
-                    sessionId, walletId, isDefault: true, createdAt: new Date(nowSec * 1000),
-                }).run();
-                // Write token file
-                const tokenPath = join(deps.dataDir, 'mcp-tokens', walletId);
-                const tmpPath = `${tokenPath}.tmp`;
-                await mkdir(dirname(tokenPath), { recursive: true });
-                await writeFile(tmpPath, token, 'utf-8');
-                await rename(tmpPath, tokenPath);
-                // Claude Desktop config snippet
-                const slug = toSlug(wallet.name);
-                claudeDesktopConfig[`waiaas-${slug}`] = {
-                    command: 'npx',
-                    args: ['@waiaas/mcp'],
-                    env: {
-                        WAIAAS_DATA_DIR: deps.dataDir,
-                        WAIAAS_BASE_URL: baseUrl,
-                        WAIAAS_WALLET_ID: walletId,
-                        WAIAAS_WALLET_NAME: wallet.name,
-                    },
-                };
-                void deps.notificationService?.notify('SESSION_CREATED', walletId, { sessionId });
-                results.push({ walletId, walletName: wallet.name, sessionId, tokenPath });
-            }
-            catch (err) {
-                const msg = err instanceof Error ? err.message : String(err);
-                results.push({ walletId, walletName: null, error: msg });
-            }
-        }
-        const created = results.filter((r) => !r.error).length;
-        return c.json({ results, created, failed: results.length - created, claudeDesktopConfig }, 200);
-    });
-    // ---------------------------------------------------------------------------
     // POST /admin/agent-prompt — Generate agent connection prompt
     // ---------------------------------------------------------------------------
     const agentPromptRoute = createRoute({
@@ -1566,36 +1362,83 @@ export function adminRoutes(deps) {
                 .map((w) => ({ id: w.id, name: w.name, chain: w.chain, environment: w.environment, publicKey: w.publicKey, defaultNetwork: w.defaultNetwork }));
         }
         if (targetWallets.length === 0) {
-            return c.json({ prompt: '', walletCount: 0, sessionsCreated: 0, expiresAt }, 201);
+            return c.json({ prompt: '', walletCount: 0, sessionsCreated: 0, sessionReused: false, expiresAt }, 201);
         }
-        // Create a single multi-wallet session (one sessionId, one token)
+        // Try to reuse an existing valid session covering all target wallets
         const defaultWallet = targetWallets[0];
-        const sessionId = generateId();
-        const jwtPayload = { sub: sessionId, wlt: defaultWallet.id, iat: nowSec, exp: expiresAt };
-        const token = await deps.jwtSecretManager.signToken(jwtPayload);
-        const tokenHash = createHash('sha256').update(token).digest('hex');
-        deps.db.insert(sessions).values({
-            id: sessionId,
-            tokenHash,
-            expiresAt: new Date(expiresAt * 1000),
-            absoluteExpiresAt: new Date(absoluteExpiresAt * 1000),
-            createdAt: new Date(nowSec * 1000),
-            renewalCount: 0,
-            maxRenewals: config.security.session_max_renewals,
-            constraints: null,
-            source: 'api',
-        }).run();
-        // Insert N rows into session_wallets (first wallet is default)
-        for (let i = 0; i < targetWallets.length; i++) {
-            const w = targetWallets[i];
-            deps.db.insert(sessionWallets).values({
-                sessionId,
-                walletId: w.id,
-                isDefault: i === 0,
+        const targetWalletIds = targetWallets.map((w) => w.id);
+        const minRemainingTtl = Math.max(Math.floor(ttl * 0.1), 3600); // 10% of TTL or 1 hour
+        const minExpiresAt = new Date((nowSec + minRemainingTtl) * 1000);
+        let sessionId;
+        let sessionReused = false;
+        let sessionsCreated = 1;
+        let actualExpiresAt = expiresAt;
+        // Find active sessions that cover all target wallets with sufficient TTL
+        const candidateSessions = deps.db
+            .select({
+            id: sessions.id,
+            expiresAt: sessions.expiresAt,
+        })
+            .from(sessions)
+            .where(and(isNull(sessions.revokedAt), gt(sessions.expiresAt, minExpiresAt)))
+            .all();
+        let reusableSessionId = null;
+        let reusableExpiresAt = 0;
+        for (const candidate of candidateSessions) {
+            // Count how many of our target wallets are linked to this session
+            const linkedCount = deps.db
+                .select({ cnt: drizzleCount() })
+                .from(sessionWallets)
+                .where(and(eq(sessionWallets.sessionId, candidate.id), sql `${sessionWallets.walletId} IN (${sql.join(targetWalletIds.map((id) => sql `${id}`), sql `, `)})`))
+                .get();
+            if (linkedCount && linkedCount.cnt === targetWalletIds.length) {
+                reusableSessionId = candidate.id;
+                reusableExpiresAt = candidate.expiresAt instanceof Date
+                    ? Math.floor(candidate.expiresAt.getTime() / 1000)
+                    : candidate.expiresAt;
+                break;
+            }
+        }
+        if (reusableSessionId) {
+            // Reuse existing session — re-sign JWT with existing session ID
+            sessionId = reusableSessionId;
+            sessionReused = true;
+            sessionsCreated = 0;
+            actualExpiresAt = reusableExpiresAt;
+        }
+        else {
+            // Create a new multi-wallet session
+            sessionId = generateId();
+            deps.db.insert(sessions).values({
+                id: sessionId,
+                tokenHash: '',
+                expiresAt: new Date(expiresAt * 1000),
+                absoluteExpiresAt: new Date(absoluteExpiresAt * 1000),
                 createdAt: new Date(nowSec * 1000),
+                renewalCount: 0,
+                maxRenewals: config.security.session_max_renewals,
+                constraints: null,
+                source: 'api',
             }).run();
+            // Insert N rows into session_wallets (first wallet is default)
+            for (let i = 0; i < targetWallets.length; i++) {
+                const w = targetWallets[i];
+                deps.db.insert(sessionWallets).values({
+                    sessionId,
+                    walletId: w.id,
+                    isDefault: i === 0,
+                    createdAt: new Date(nowSec * 1000),
+                }).run();
+            }
+            void deps.notificationService?.notify('SESSION_CREATED', defaultWallet.id, { sessionId });
+        }
+        // Sign JWT (new or re-signed for reused session)
+        const jwtPayload = { sub: sessionId, wlt: defaultWallet.id, iat: nowSec, exp: actualExpiresAt };
+        const token = await deps.jwtSecretManager.signToken(jwtPayload);
+        if (!sessionReused) {
+            const tokenHash = createHash('sha256').update(token).digest('hex');
+            deps.db.update(sessions).set({ tokenHash }).where(eq(sessions.id, sessionId)).run();
         }
-        void deps.notificationService?.notify('SESSION_CREATED', defaultWallet.id, { sessionId });
         // Query per-wallet policies for prompt builder
         const promptWallets = targetWallets.map((w) => {
             const walletPolicies = deps.db
@@ -1603,12 +1446,15 @@ export function adminRoutes(deps) {
                 .from(policies)
                 .where(and(eq(policies.walletId, w.id), eq(policies.enabled, true)))
                 .all();
+            const networks = getNetworksForEnvironment(w.chain, w.environment);
             return {
+                id: w.id,
                 name: w.name,
                 chain: w.chain,
                 environment: w.environment,
                 address: w.publicKey,
                 defaultNetwork: w.defaultNetwork,
+                networks: networks.map((n) => n),
                 policies: walletPolicies,
             };
         });
@@ -1653,10 +1499,77 @@ export function adminRoutes(deps) {
         return c.json({
             prompt: fullPrompt,
             walletCount: targetWallets.length,
-            sessionsCreated: 1,
-            expiresAt,
+            sessionsCreated,
+            sessionReused,
+            expiresAt: actualExpiresAt,
         }, 201);
     });
+    // ---------------------------------------------------------------------------
+    // POST /admin/sessions/:id/reissue — Reissue session token
+    // ---------------------------------------------------------------------------
+    const sessionReissueRoute = createRoute({
+        method: 'post',
+        path: '/admin/sessions/{id}/reissue',
+        tags: ['Admin'],
+        summary: 'Reissue session token (re-sign JWT for existing session)',
+        request: {
+            params: z.object({ id: z.string().uuid() }),
+        },
+        responses: {
+            200: {
+                description: 'Token reissued',
+                content: { 'application/json': { schema: SessionReissueResponseSchema } },
+            },
+            ...buildErrorResponses(['SESSION_NOT_FOUND', 'SESSION_REVOKED']),
+        },
+    });
+    router.openapi(sessionReissueRoute, async (c) => {
+        if (!deps.jwtSecretManager) {
+            throw new WAIaaSError('ADAPTER_NOT_AVAILABLE', { message: 'JWT signing not available' });
+        }
+        const { id: sessionId } = c.req.valid('param');
+        const nowSec = Math.floor(Date.now() / 1000);
+        // Find session
+        const session = deps.db
+            .select()
+            .from(sessions)
+            .where(eq(sessions.id, sessionId))
+            .get();
+        if (!session) {
+            throw new WAIaaSError('SESSION_NOT_FOUND');
+        }
+        if (session.revokedAt) {
+            throw new WAIaaSError('SESSION_REVOKED');
+        }
+        const expiresAtSec = session.expiresAt instanceof Date
+            ? Math.floor(session.expiresAt.getTime() / 1000)
+            : session.expiresAt;
+        if (expiresAtSec <= nowSec) {
+            throw new WAIaaSError('SESSION_NOT_FOUND', { message: 'Session expired' });
+        }
+        // Get default wallet for JWT
+        const defaultSw = deps.db
+            .select({ walletId: sessionWallets.walletId })
+            .from(sessionWallets)
+            .where(and(eq(sessionWallets.sessionId, sessionId), eq(sessionWallets.isDefault, true)))
+            .get();
+        const defaultWalletId = defaultSw?.walletId ?? '';
+        // Re-sign JWT
+        const jwtPayload = { sub: sessionId, wlt: defaultWalletId, iat: nowSec, exp: expiresAtSec };
+        const token = await deps.jwtSecretManager.signToken(jwtPayload);
+        // Increment token_issued_count
+        const newCount = (session.tokenIssuedCount ?? 1) + 1;
+        deps.db.update(sessions)
+            .set({ tokenIssuedCount: newCount })
+            .where(eq(sessions.id, sessionId))
+            .run();
+        return c.json({
+            token,
+            sessionId,
+            tokenIssuedCount: newCount,
+            expiresAt: expiresAtSec,
+        }, 200);
+    });
     return router;
 }
 //# sourceMappingURL=admin.js.map