@seams/wallet-server 0.10.1 → 0.11.0

package/dist/types/wallet-server/src/localIntendedYaoRecoveryFault.d.ts

@@ -1,3 +1,4 @@
+import type { D1RegistrationCeremonyRecordStore } from './router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore';
 export declare const LOCAL_INTENDED_YAO_RECOVERY_FAULT_HEADER_V1 = "x-seams-intended-yao-recovery-fault-v1";
 export declare const LOCAL_INTENDED_YAO_RECOVERY_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-yao-recovery-fault-token-v1";
 /**
@@ -28,17 +29,18 @@ export declare class LocalIntendedYaoRecoveryFaultControllerV1 {
     private readonly baseFetch;
     private readonly mode;
     private readonly token;
+    private readonly storage;
     private executed;
     private failed;
     private kept;
-    constructor(baseFetch: typeof globalThis.fetch, mode: 'lose_router_recovery_replies' | 'withhold_router_recovery_execute', token: string);
+    constructor(baseFetch: typeof globalThis.fetch, mode: 'lose_router_recovery_replies' | 'withhold_router_recovery_execute', token: string, storage: D1RegistrationCeremonyRecordStore);
     fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
     outcome(): LocalIntendedYaoRecoveryFaultOutcomeV1;
 }
 /** Sends the execution kept under `token` to the Router, exactly. */
 export declare function releaseLocalIntendedYaoRecoveryExecuteV1(router: {
     fetch(request: Request): Promise<Response>;
-}, token: string): Promise<Response>;
+}, token: string, storage: D1RegistrationCeremonyRecordStore): Promise<Response>;
 export declare function requestWithoutLocalIntendedYaoRecoveryFaultHeadersV1(request: Request): Request;
 export declare function responseWithLocalIntendedYaoRecoveryFaultOutcomeV1(response: Response, outcome: LocalIntendedYaoRecoveryFaultOutcomeV1, token: string): Response;
 export {};

package/dist/types/wallet-server/src/localIntendedYaoSigningFault.d.ts

@@ -1,3 +1,4 @@
+import type { D1RegistrationCeremonyRecordStore } from './router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore';
 export declare const LOCAL_INTENDED_YAO_SIGNING_FAULT_HEADER_V1 = "x-seams-intended-yao-signing-fault-v1";
 export declare const LOCAL_INTENDED_YAO_SIGNING_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-yao-signing-fault-token-v1";
 export declare const ROUTER_AB_ED25519_SIGNING_FINALIZE_PATH_V1 = "/router-ab/ed25519/sign";
@@ -20,8 +21,9 @@ export declare class LocalIntendedYaoSigningFaultControllerV1 {
     private readonly baseFetch;
     private readonly mode;
     private readonly token;
+    private readonly storage;
     private kept;
-    constructor(baseFetch: typeof globalThis.fetch, mode: 'capture_signing_finalize' | 'withhold_signing_finalize', token: string);
+    constructor(baseFetch: typeof globalThis.fetch, mode: 'capture_signing_finalize' | 'withhold_signing_finalize', token: string, storage: D1RegistrationCeremonyRecordStore);
     fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
     private keep;
     outcome(): string;
@@ -29,7 +31,7 @@ export declare class LocalIntendedYaoSigningFaultControllerV1 {
 /** Sends the finalize kept under `token` to the Router again, exactly. */
 export declare function releaseLocalIntendedYaoSigningFinalizeV1(router: {
     fetch(request: Request): Promise<Response>;
-}, token: string): Promise<Response>;
+}, token: string, storage: D1RegistrationCeremonyRecordStore): Promise<Response>;
 export declare function requestWithoutLocalIntendedYaoSigningFaultHeadersV1(request: Request): Request;
 export declare function responseWithLocalIntendedYaoSigningFaultOutcomeV1(response: Response, outcome: string): Response;
 export {};

package/dist/types/wallet-server/src/router/auth/routerApiKeyAuth.d.ts

@@ -2,15 +2,7 @@ type HeaderBag = Headers | Record<string, unknown>;
 export declare function extractBearerCredential(headers: HeaderBag): string | null;
 export declare function normalizeSourceIp(raw: string | undefined): string | null;
 export declare function extractRouterApiEnvironmentId(headers: HeaderBag): string | null;
-export declare function resolveSourceIpFromExpressRequest(input: {
-    headers: Record<string, unknown>;
-    ip?: string | null;
-}): string | null;
 export declare function resolveSourceIpFromFetchHeaders(headers: HeaderBag): string | null;
-export declare function resolveRequestOriginRateLimitKeyFromExpressRequest(input: {
-    headers: Record<string, unknown>;
-    ip?: string | null;
-}): string;
 export declare function resolveRequestOriginRateLimitKeyFromFetchHeaders(headers: HeaderBag): string;
 export {};
 //# sourceMappingURL=routerApiKeyAuth.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/ed25519Yao/d1Ed25519YaoProductRegistrationPartitionedStateStore.d.ts

@@ -1,7 +1,8 @@
-import { type CloudflareD1VersionedJsonRecordStoreOptions } from '../versionedJson/d1VersionedJsonRecordStore';
+import { type CloudflareD1VersionedJsonRecordStore, type CloudflareD1VersionedJsonRecordStoreOptions } from '../versionedJson/d1VersionedJsonRecordStore';
 import type { VersionedJsonObject } from '../../../framework/versionedJsonRecordStore';
 import { type RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1 } from '../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore';
 export type RouterAbEd25519YaoProductRegistrationPartitionedStateD1OptionsV1 = Omit<CloudflareD1VersionedJsonRecordStoreOptions<VersionedJsonObject>, 'encode' | 'parse'>;
 export declare function createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1(options: RouterAbEd25519YaoProductRegistrationPartitionedStateD1OptionsV1): RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1;
 export declare function evictWalletEd25519CapabilityCache(options: RouterAbEd25519YaoProductRegistrationPartitionedStateD1OptionsV1, walletId: string): Promise<void>;
+export declare function createD1Ed25519YaoLifecycleRecords(options: RouterAbEd25519YaoProductRegistrationPartitionedStateD1OptionsV1): CloudflareD1VersionedJsonRecordStore<VersionedJsonObject>;
 //# sourceMappingURL=d1Ed25519YaoProductRegistrationPartitionedStateStore.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.d.ts

@@ -40,6 +40,8 @@ export declare class D1RegistrationCeremonyRecordStore {
     constructor(options: D1RegistrationCeremonyRecordStoreOptions);
     get(scope: string, id: string): Promise<D1RegistrationCeremonyStoredRecord | null>;
     prepareGet(scope: string, id: string): D1PreparedStatementLike;
+    /** Load the ceremony's immutable founding identities and their current records together. */
+    prepareFoundingRecordsRead(id: string): D1PreparedStatementLike;
     parseGet(scope: string, id: string, row: StoredRow | null): Promise<D1RegistrationCeremonyStoredRecord | null>;
     putExact(mutation: D1RegistrationCeremonyRecordMutation): Promise<void>;
     insertOrRead(mutation: D1RegistrationCeremonyRecordMutation): Promise<D1RegistrationCeremonyStoredRecord>;

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.d.ts

@@ -32,6 +32,7 @@ export declare class CloudflareD1RegistrationCeremonyIntentStore {
     reserveSetupCeremony(proposed: StoredWalletRegistrationCeremony, ownershipGeneration: number): Promise<StoredWalletRegistrationCeremony>;
     getCeremony(registrationCeremonyId: string): Promise<StoredWalletRegistrationCeremony | null>;
     prepareCeremonyRead(registrationCeremonyId: string): D1PreparedStatementLike;
+    prepareFoundingRecordsRead(registrationCeremonyId: string): D1PreparedStatementLike;
     parseCeremonyRead(registrationCeremonyId: string, result: D1ResultLike<Record<string, unknown>>): Promise<StoredWalletRegistrationCeremony | null>;
     parseCeremonySnapshotRead(registrationCeremonyId: string, result: D1ResultLike<Record<string, unknown>>): Promise<D1WalletRegistrationEcdsaCeremonyClaimV1 | null>;
     getCeremonySnapshot(registrationCeremonyId: string): Promise<D1WalletRegistrationEcdsaCeremonyClaimV1 | null>;

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationSetupSupport.d.ts

@@ -48,6 +48,8 @@ type RegistrationIntentSignerBranches = {
     readonly evmFamilyEcdsa: RegistrationEvmFamilyEcdsaSignerPlan | null;
 };
 export declare function recordRegistrationServerTiming(sink: Array<readonly [string, number]>, name: string, startedAtMs: number): void;
+/** The `Server-Timing` header of a registration route's recorded waits. */
+export declare function registrationServerTimingHeaders(serverTiming: readonly (readonly [string, number])[]): Record<string, string> | undefined;
 export declare function recordRegistrationPromiseTiming<T>(args: {
     readonly sink: Array<readonly [string, number]>;
     readonly name: string;

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.d.ts

@@ -2,9 +2,11 @@ import { type PasskeyCredentialClaims } from '../../../../core/passkeyCredential
 import type { ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
 import { type ActiveWalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
 import { type RegistrationAuthority } from '../../../../../../shared-ts/src/utils/registrationAuthMethodInput';
+import type { Variant } from '../../../../../../shared-ts/src/utils/variant';
 import type { WalletRecord, WalletSignerRecord } from '../../../../core/WalletStore';
 import type { D1DatabaseLike, D1PreparedStatementLike, D1ResultLike } from '../../../../storage/tenantRoute';
 import type { D1EmailOtpRegistrationCommitPlan } from '../emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer';
+import type { D1WalletRegistrationOperationPreparedV1 } from './d1WalletRegistrationPreparation';
 export type D1RegistrationCommitBatch = (statements: readonly D1PreparedStatementLike[]) => Promise<readonly D1ResultLike[]>;
 type ReservedWalletRegistrationCommit = (input: D1WalletRegistrationCommitInput, executeBatch?: D1RegistrationCommitBatch) => Promise<void>;
 type D1WalletRegistrationCommitBase = {
@@ -40,9 +42,11 @@ export type HeldRegistrationPasskeyClaim = {
 export interface D1WalletRegistrationCommitStore {
     /**
      * Claims the authority's passkey through shared authority, unless `held`
-     * records that the same claim was already granted for this ceremony.
+     * records that the same claim was already granted for this ceremony. Uses
+     * the founding snapshot when supplied; otherwise reads the named records
+     * beside the claim. The returned commit performs no additional read.
      */
-    reserveAuthority(authority: RegistrationAuthority, held?: HeldRegistrationPasskeyClaim | null): Promise<ReservedWalletRegistrationCommit>;
+    reserveAuthority(authority: RegistrationAuthority, held: HeldRegistrationPasskeyClaim | null, founding: RegistrationFoundingRead | null): Promise<ReservedWalletRegistrationCommit>;
     /**
      * Claims a verified passkey before finalization and records a granted
      * claim. A refusal records nothing, so finalization claims again and
@@ -58,6 +62,26 @@ export interface D1WalletRegistrationCommitStore {
     /** Removes the record of a finalized ceremony. Shared authority keeps the claim. */
     deleteHeldPasskeyClaim(registrationCeremonyId: string): Promise<void>;
 }
+type FoundingRecordIds = Pick<D1WalletRegistrationOperationPreparedV1, 'walletAuthorityId' | 'walletAuthMethodId'>;
+export type RegistrationFoundingRead = {
+    readonly kind: 'read';
+    readonly ids: FoundingRecordIds;
+    readonly records?: never;
+} | {
+    readonly kind: 'snapshot';
+    readonly records: StoredFoundingRecords;
+    readonly ids?: never;
+};
+export type RegistrationFoundingSnapshot = Variant<RegistrationFoundingRead, 'kind', 'snapshot'>;
+export declare function parseRegistrationFoundingRead(result: D1ResultLike<Record<string, unknown>>): RegistrationFoundingSnapshot | null;
+/** A registration's founding authority and auth method rows from one database snapshot. */
+type StoredFoundingRecords = FoundingRecordIds & {
+    readonly authorityRow: D1RegistrationRecordJsonRow | null;
+    readonly authMethodRow: D1RegistrationRecordJsonRow | null;
+};
+type D1RegistrationRecordJsonRow = {
+    readonly record_json?: unknown;
+};
 export declare class CloudflareD1WalletRegistrationCommitStore implements D1WalletRegistrationCommitStore {
     private readonly database;
     private readonly scope;
@@ -70,7 +94,7 @@ export declare class CloudflareD1WalletRegistrationCommitStore implements D1Wall
         readonly projectId: string;
         readonly envId: string;
     });
-    reserveAuthority(authority: RegistrationAuthority, held?: HeldRegistrationPasskeyClaim | null): Promise<ReservedWalletRegistrationCommit>;
+    reserveAuthority(authority: RegistrationAuthority, held: HeldRegistrationPasskeyClaim | null, founding: RegistrationFoundingRead | null): Promise<ReservedWalletRegistrationCommit>;
     claimPasskeyAhead(input: {
         readonly registrationCeremonyId: string;
         readonly authority: RegistrationAuthority;

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationRead.d.ts

@@ -1,3 +1,4 @@
+import type { createD1Ed25519YaoLifecycleRecords } from '../ed25519Yao/d1Ed25519YaoProductRegistrationPartitionedStateStore';
 import type { D1DatabaseLike } from '../../../../storage/tenantRoute';
 import type { WalletRegistrationHomeAuthority } from '../../../domains/walletRegistration/walletRegistrationReservation';
 import type { CloudflareD1RegistrationCeremonyIntentStore } from './d1RegistrationCeremonyStore';
@@ -13,8 +14,9 @@ export declare class D1WalletRegistrationRead {
     readonly operations: D1WalletOperationStore<D1WalletRegistrationNearProvisioningSideEffectRecord>;
     private readonly getCeremonies;
     private readonly decisions;
+    private readonly yaoRecords;
     private readonly passkeyClaims;
-    constructor(database: D1DatabaseLike, authority: D1WalletExecutionAuthority | null, operations: D1WalletOperationStore<D1WalletRegistrationNearProvisioningSideEffectRecord>, getCeremonies: () => CloudflareD1RegistrationCeremonyIntentStore, decisions: CloudflareD1Ed25519YaoLifecycleDecisionStoreV1, passkeyClaims: Pick<D1WalletRegistrationCommitStore, 'prepareHeldPasskeyClaimRead' | 'parseHeldPasskeyClaimRead'>);
+    constructor(database: D1DatabaseLike, authority: D1WalletExecutionAuthority | null, operations: D1WalletOperationStore<D1WalletRegistrationNearProvisioningSideEffectRecord>, getCeremonies: () => CloudflareD1RegistrationCeremonyIntentStore, decisions: CloudflareD1Ed25519YaoLifecycleDecisionStoreV1, yaoRecords: ReturnType<typeof createD1Ed25519YaoLifecycleRecords>, passkeyClaims: Pick<D1WalletRegistrationCommitStore, 'prepareHeldPasskeyClaimRead' | 'parseHeldPasskeyClaimRead'>);
     readRespond(home: Parameters<WalletRegistrationHomeAuthority['admitHome']>[0]): Promise<{
         readonly ok: false;
         readonly code: string;
@@ -38,9 +40,26 @@ export declare class D1WalletRegistrationRead {
     } | {
         ok: true;
         operation: import("../../../cloudflare-adaptor").VersionedJsonRecordReadResult<D1WalletRegistrationNearProvisioningSideEffectRecord>;
+        readFounding: () => {
+            readonly kind: "snapshot";
+            readonly records: {
+                readonly walletAuthMethodId: import("../../../../../../shared-ts/src/utils").WalletAuthMethodId;
+                readonly walletAuthorityId: import("../../../../../../shared-ts/src/utils").WalletAuthorityId;
+            } & {
+                readonly authorityRow: {
+                    readonly record_json?: unknown;
+                } | null;
+                readonly authMethodRow: {
+                    readonly record_json?: unknown;
+                } | null;
+            };
+            readonly ids?: never;
+        } | null;
         decision: import("../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision").RouterAbEd25519YaoLifecycleDecisionV1 | null;
         heldPasskeyClaim: import("./d1WalletRegistrationCommitStore").HeldRegistrationPasskeyClaim | null;
         readCeremony: () => Promise<import("../../../../core/RegistrationCeremonyStore").StoredWalletRegistrationCeremony | null>;
+        readYaoAdmission: () => import("../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationExecutionRecord").RouterAbEd25519YaoRegistrationExecutionAuthorityV1 | null;
     }>;
+    private parseYaoAdmission;
 }
 //# sourceMappingURL=d1WalletRegistrationRead.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationService.d.ts

@@ -260,7 +260,13 @@ export declare class CloudflareD1WalletRegistrationService {
     provisionEd25519YaoWalletSession(request: RouterAbEd25519YaoVerifiedWalletUnlockRequestV1): Promise<RouterAbEd25519YaoVerifiedWalletUnlockResponseV1>;
     setupWalletRegistration(input: WalletRegistrationSetupInput): Promise<WalletRegistrationSetupResponseV2>;
     authorizeWalletRegistrationNearAdmission(input: WalletRegistrationNearAdmissionInput): Promise<WalletRegistrationNearAdmissionResponseV2>;
+    /**
+     * Respond replays exactly, so a transient D1 fault runs it again, as a client
+     * retry would. A fault that outlasts the retries reports `storage_unavailable`
+     * without the driver's text.
+     */
     respondWalletRegistration(input: WalletRegistrationRespondInput, traceContext?: RouterAbTraceContextV1, timingSink?: Array<readonly [string, number]>, waitUntil?: (promise: Promise<unknown>) => void): Promise<WalletRegistrationRespondResponseV2>;
+    private respondWalletRegistrationAttempt;
     /** For callers that must read the context before finalize tombstones it. */
     private registrationOwnerProofWithContext;
     authorizeNearRegistrationContinuation(input: {

package/dist/types/wallet-server/src/router/cloudflare-adaptor.d.ts

@@ -42,7 +42,7 @@ export type { CloudflareTenantStorageRoute, CloudflareTenantTopology, D1BindingN
 export { StaticCloudflareTenantStorageRouteResolver, createCloudflareTenantStorageRoute, createSignerD1DoStorageTarget, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, } from '../storage/tenantRoute';
 export type { InMemoryRouterApiRuntimeSnapshotConsumer, RouterApiRuntimeSnapshotPublishedUpdate, } from './framework/runtimeSnapshotConsumer';
 export { createInMemoryRouterApiRuntimeSnapshotConsumer, validateRuntimeSnapshotExpectation, } from './framework/runtimeSnapshotConsumer';
-export { extractBearerCredential, extractRouterApiEnvironmentId, resolveSourceIpFromExpressRequest, resolveSourceIpFromFetchHeaders, } from './auth/routerApiKeyAuth';
+export { extractBearerCredential, extractRouterApiEnvironmentId, resolveSourceIpFromFetchHeaders, } from './auth/routerApiKeyAuth';
 export { createCloudflareRouter } from './cloudflare/runtime/createCloudflareRouter';
 export type { SelfHostedCloudflareSigningWorkerFactoryInput } from './cloudflare/runtime/createSelfHostedCloudflareSigningWorker';
 export { createSelfHostedCloudflareSigningRouter, createSelfHostedCloudflareSigningWorker, } from './cloudflare/runtime/createSelfHostedCloudflareSigningWorker';

package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.d.ts

@@ -1,3 +1,4 @@
+import type { RouterAbEd25519YaoRegistrationExecutionAuthorityV1 } from '../registration/routerAbEd25519YaoRegistrationExecutionRecord';
 import { type AddSignerIntentV1, type WalletId } from '../../../../../../shared-ts/src/utils/registrationIntent';
 import { type RegistrationEd25519AuthorityScope } from '../../../../../../shared-ts/src/utils/registrationIds';
 import { type RegistrationNearEd25519SignerPlan } from '../../../../../../shared-ts/src/utils/registrationSignerPlan';
@@ -58,6 +59,14 @@ export type RouterAbEd25519YaoWalletSessionMintInputV1 = (RouterAbEd25519YaoWall
     readonly expiresAtMs: number;
     readonly remainingUses: number;
 });
+/** Admission is immutable. A finalization batch may supply it before consumption. */
+export type RouterAbEd25519YaoConsumptionAdmissionV1 = {
+    readonly kind: 'stored';
+    readonly authority?: never;
+} | {
+    readonly kind: 'snapshot';
+    readonly authority: RouterAbEd25519YaoRegistrationExecutionAuthorityV1 | null;
+};
 export type RouterAbEd25519YaoProductRegistrationRuntimeV1 = RouterAbEd25519YaoPersistedActiveCapabilityInstallerV1 & RouterAbEd25519YaoActiveCapabilityResolverV1 & RouterAbEd25519YaoActiveCapabilityRehydratorV1 & {
     readonly kind: 'router_ab_ed25519_yao_product_registration_runtime_v1';
     readonly signingWorkerId: string;
@@ -87,7 +96,7 @@ export type RouterAbEd25519YaoProductRegistrationRuntimeV1 = RouterAbEd25519YaoP
         readonly trace: RouterAbTraceContextV1;
     }): Promise<RouterAbEd25519YaoTimedRegistrationExecutionResultV1>;
     bindVerifiedIntent(input: RouterAbEd25519YaoVerifiedActivationIntentV1): Promise<RouterAbEd25519YaoRegistrationIntentBindingResult>;
-    consumeActivated(request: RouterAbEd25519YaoActivationConsumptionRequestV1): Promise<RouterAbEd25519YaoActivationConsumptionResultV1>;
+    consumeActivated(request: RouterAbEd25519YaoActivationConsumptionRequestV1, admission: RouterAbEd25519YaoConsumptionAdmissionV1): Promise<RouterAbEd25519YaoActivationConsumptionResultV1>;
 };
 /** A tenant-root read in flight, with the signing root ID that it was started for. */
 export type RouterAbEd25519YaoStartedDispatchRootV1 = {

package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.d.ts

@@ -118,7 +118,9 @@ export declare function createRouterAbEd25519YaoProductRegistrationPartitionedSt
  * The admitted authority a registration execute is checked against, from a
  * loaded ceremony state, or `null` when the lifecycle is not admitted.
  */
-export declare function routerAbEd25519YaoAdmittedRegistrationAuthorityV1(state: RouterAbEd25519YaoRegistrationCeremonySnapshotV1['state'], lifecycleId: string): RouterAbEd25519YaoRegistrationExecutionAuthorityV1 | null;
+export declare function routerAbEd25519YaoAdmittedRegistrationAuthorityV1(state: Pick<RouterAbEd25519YaoProductRegistrationCeremonyStateV1, 'registration' | 'authorization'>, lifecycleId: string): RouterAbEd25519YaoRegistrationExecutionAuthorityV1 | null;
+/** Parse an exact ceremony read for consumption; the Router owns its mutable claim. */
+export declare function parseRouterAbEd25519YaoRegistrationAdmissionReadV1(lifecycleId: string, result: VersionedJsonRecordReadResult<VersionedJsonObject>): RouterAbEd25519YaoRegistrationExecutionAuthorityV1 | null;
 export declare function encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1(record: RouterAbEd25519YaoProductRegistrationPartitionRecordV1): VersionedJsonObject;
 export declare function sameRouterAbEd25519YaoSharedStateCanonicalEncodingV1(left: RouterAbEd25519YaoSharedStateCanonicalEncodingV1, right: RouterAbEd25519YaoSharedStateCanonicalEncodingV1): boolean;
 export declare function parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1(input: unknown): RouterAbEd25519YaoProductRegistrationPartitionRecordV1 | null;

package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationInputs.d.ts

@@ -21,6 +21,8 @@ export type WalletRegistrationSetupInput = {
     readonly runtimePolicyScope?: ThresholdRuntimePolicyScope;
     readonly signingRootId?: string;
     readonly signingRootVersion?: string;
+    /** Collects the `[name, ms]` waits of this setup for its `Server-Timing` header. */
+    readonly serverTiming?: Array<readonly [string, number]>;
 };
 export type WalletRegistrationRespondInput = {
     readonly registrationCeremonyId: string;

package/dist/types/wallet-server/src/router/framework/routeResponses.d.ts

@@ -1,4 +1,3 @@
-import type { Response as ExpressResponse } from 'express';
 import type { RouteResponse } from './routeExecutionContext';
 import type { RoutePolicyFailureCode } from './routeAuthPolicy';
 import type { RouteUsageData } from './routeMeteringPolicy';
@@ -12,6 +11,5 @@ export declare function routeJson<TBody>(status: number, body: TBody, options?:
     usage?: RouteUsageData;
 }): RouteResponse<TBody>;
 export declare function routeError(status: number, code: RouteErrorBody['code'], message: string): RouteResponse<RouteErrorBody>;
-export declare function sendExpressRouteResponse<TBody>(res: ExpressResponse, response: RouteResponse<TBody>): void;
 export declare function toFetchRouteResponse<TBody>(response: RouteResponse<TBody>): Response;
 //# sourceMappingURL=routeResponses.d.ts.map

package/dist/types/wallet-server/src/threshold/session/signingSessionSeal/crypto/shamir3PassWasm.d.ts

@@ -1,3 +1,9 @@
+/**
+ * Starts the module and runs one lock round under a key derived from zero
+ * bytes, so the first seal in this isolate runs warm code. It uses no secret,
+ * and its result is discarded.
+ */
+export declare function warmSigningSessionSealRuntime(): Promise<void>;
 export declare function deriveSigningSessionSealLockKeyHandle(input: {
     readonly groupId: string;
     readonly rootSecret32: Uint8Array;

package/dist/types/wallet-server/src/threshold/session/signingSessionSeal/index.d.ts

@@ -6,7 +6,7 @@ export type { CreateSigningSessionSealOptionsInput } from './options';
 export type { CreateSigningSessionSealRateLimitGuardOptions, InMemorySigningSessionSealRateLimiterOptions, SigningSessionSealRateLimitConsumeInput, SigningSessionSealRateLimitConsumeResult, SigningSessionSealRateLimiter, SigningSessionSealRateLimitRejectedEvent, } from './guards';
 export type { CreateSigningSessionSealRateLimitFromEnvInput, CreateRedisTcpSigningSessionSealRateLimiterOptions, CreateUpstashSigningSessionSealRateLimiterOptions, } from './guards/backends';
 export type { CreateSigningSessionSealIdempotencyFromEnvInput, CreateRedisTcpSigningSessionSealIdempotencyStoreOptions, CreateUpstashSigningSessionSealIdempotencyStoreOptions, } from './idempotencyBackends';
-export { signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode } from './transport/shared';
+export { signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode, } from './transport/shared';
 export { buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, resolveSigningSessionSealBasePath, parseSigningSessionSealApplyBody, parseSigningSessionSealRemoveBody, authorizeSigningSessionSealRequest, } from './transport/shared';
 export { createSigningSessionSealCipherAdapter, createPassthroughSigningSessionSealCipherAdapter, createSigningSessionSealShamir3PassCipherAdapter, encodeSigningSessionSealServerLockContext, } from './crypto/cipher';
 export { createSigningSessionSealService } from './service';
@@ -18,6 +18,5 @@ export { createInMemorySigningSessionSealRateLimiter, createSigningSessionSealRa
 export { createRedisTcpSigningSessionSealRateLimiter, createUpstashSigningSessionSealRateLimiter, resolveSigningSessionSealRateLimitFromEnv, } from './guards/backends';
 export { createRedisTcpSigningSessionSealIdempotencyStore, createUpstashSigningSessionSealIdempotencyStore, resolveSigningSessionSealIdempotencyFromEnv, } from './idempotencyBackends';
 export { composeSigningSessionSealGuards } from './guards';
-export { registerSigningSessionSealRoutes } from './transport/express';
 export { handleSigningSessionSealRoutes } from './transport/fetch';
 //# sourceMappingURL=index.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seams/wallet-server",
-  "version": "0.10.1",
+  "version": "0.11.0",
   "type": "module",
   "description": "Seams server TypeScript SDK for NEAR and EVM-family wallets",
   "main": "./dist/esm/index.js",
@@ -19,11 +19,6 @@
       "import": "./dist/esm/index.js",
       "default": "./dist/esm/index.js"
     },
-    "./router/express": {
-      "types": "./dist/types/wallet-server/src/router/express-adaptor.d.ts",
-      "import": "./dist/esm/router/express.js",
-      "default": "./dist/esm/router/express.js"
-    },
     "./router/cloudflare": {
       "types": "./dist/types/wallet-server/src/router/cloudflare-adaptor.d.ts",
       "import": "./dist/esm/router/cloudflare.js",
@@ -120,12 +115,10 @@
   "homepage": "https://github.com/seams-tech/seams-wallet#readme",
   "dependencies": {
     "@simplewebauthn/server": "^13.2.2",
-    "bs58": "^6.0.0",
-    "express": "^4.21.2"
+    "bs58": "^6.0.0"
   },
   "devDependencies": {
     "@near-js/types": "^2.4.0",
-    "@types/express": "^4.17.21",
     "@types/node": "^20.19.9",
     "rolldown": "^1.0.0-beta.27",
     "typescript": "^5.8.3"

package/src/README.md

@@ -76,7 +76,7 @@ Use fresh wallets when measuring this change.
 It does not authorize wallet ownership.
 
 ```ts
-import { createRouterApiRouter } from '@seams/wallet-server/router/express';
+import { createCloudflareRouter } from '@seams/wallet-server/router/cloudflare';
 import { createSigningSessionSealOptions } from '@seams/wallet-server';
 
 const signingSessionSeal = createSigningSessionSealOptions({
@@ -85,10 +85,12 @@ const signingSessionSeal = createSigningSessionSealOptions({
   acceptedWarmKeyVersions: ['signing-session-seal-production-r2'],
 });
 
-app.use('/', createRouterApiRouter(service, {
+const fetch = createCloudflareRouter(service, {
   threshold,
   signingSessionSeal,
-}));
+});
+
+export default { fetch };
 ```
 
 Store the random 32-byte root secret in a secrets manager. Retain accepted old

package/dist/esm/router/express-adaptor.js

@@ -1,84 +0,0 @@
-import { ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, parseRouterAbPublicKeysetV2 } from "../shared-ts/src/utils/routerAbPublicKeyset.js";
-import { defineRoute } from "./framework/routeDefinitions.js";
-import { InMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createRouterAbNormalSigningAdmissionAdapter } from "./domains/signingOperations/routerAbNormalSigningAdmissionCore.js";
-import { createRouterApiModule } from "./framework/modules.js";
-import { attachRouterApiRouteSurface, getRouterApiRouteSurface } from "./framework/routerApiRouteSurface.js";
-import { createFetchRouter } from "./transport/fetch/createFetchRouter.js";
-import { createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateV1 } from "./domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js";
-import { RouterAbEd25519YaoHttpRegistrationBackend, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv } from "./domains/ed25519Yao/registration/routerAbEd25519YaoHttpRegistrationBackend.js";
-import { createInMemoryRouterApiRuntimeSnapshotConsumer, validateRuntimeSnapshotExpectation } from "./framework/runtimeSnapshotConsumer.js";
-import express from "express";
-//#region src/router/express-adaptor.ts
-function appendExpressRequestHeaders(headers, req) {
-	for (const [name, value] of Object.entries(req.headers)) {
-		if (Array.isArray(value)) {
-			for (const item of value) headers.append(name, item);
-			continue;
-		}
-		if (typeof value === "string") headers.set(name, value);
-	}
-}
-function resolveExpressRequestUrl(req) {
-	const host = req.get("host") || "localhost";
-	return `${req.protocol || "http"}://${host}${req.originalUrl || req.url}`;
-}
-function encodeExpressRequestBody(req) {
-	const method = req.method.toUpperCase();
-	if (method === "GET" || method === "HEAD") return void 0;
-	if (req.body === void 0 || req.body === null) return void 0;
-	if (typeof req.body === "string" || req.body instanceof Uint8Array) return req.body;
-	return JSON.stringify(req.body);
-}
-function buildFetchRequestFromExpress(req) {
-	const headers = new Headers();
-	appendExpressRequestHeaders(headers, req);
-	const body = encodeExpressRequestBody(req);
-	if (body && !headers.has("content-type")) headers.set("content-type", "application/json; charset=utf-8");
-	return new Request(resolveExpressRequestUrl(req), {
-		method: req.method,
-		headers,
-		body
-	});
-}
-async function isFetchRouterNotFound(response) {
-	if (response.status !== 404) return false;
-	return await response.clone().text() === "Not Found";
-}
-async function sendFetchResponseToExpress(fetchResponse, res) {
-	fetchResponse.headers.forEach((value, name) => {
-		res.setHeader(name, value);
-	});
-	res.status(fetchResponse.status);
-	const body = Buffer.from(await fetchResponse.arrayBuffer());
-	if (body.length === 0) {
-		res.end();
-		return;
-	}
-	res.send(body);
-}
-function createFetchBackedExpressMiddleware(fetchHandler) {
-	return async function fetchBackedExpressMiddleware(req, res, next) {
-		try {
-			const fetchResponse = await fetchHandler(buildFetchRequestFromExpress(req));
-			if (await isFetchRouterNotFound(fetchResponse)) {
-				next();
-				return;
-			}
-			await sendFetchResponseToExpress(fetchResponse, res);
-		} catch (error) {
-			next(error);
-		}
-	};
-}
-function createRouterApiRouter(service, opts = {}) {
-	const fetchHandler = createFetchRouter(service, opts, { kind: "inline" });
-	const router = express.Router();
-	router.use(createFetchBackedExpressMiddleware(fetchHandler));
-	const surface = getRouterApiRouteSurface(fetchHandler);
-	if (!surface) return router;
-	return attachRouterApiRouteSurface(router, surface);
-}
-//#endregion
-export { InMemoryRouterAbNormalSigningAdmissionStore, ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, RouterAbEd25519YaoHttpRegistrationBackend, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterApiRuntimeSnapshotConsumer, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateV1, createRouterAbNormalSigningAdmissionAdapter, createRouterApiModule, createRouterApiRouter, defineRoute, parseRouterAbPublicKeysetV2, validateRuntimeSnapshotExpectation };
-
-//# sourceMappingURL=express-adaptor.js.map