@seams/wallet-server 0.10.2 → 0.11.0

package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js

@@ -7,8 +7,8 @@ import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRan
 import { ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 import { computeAddSignerNearEd25519SigningKeyId, computeRegistrationNearEd25519SigningKeyId } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { registrationNearEd25519BranchKey } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
-import "../../../../shared-ts/src/threshold/sessionPolicy.js";
 import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
+import "../../../../shared-ts/src/threshold/sessionPolicy.js";
 import { createRouterApiModule } from "../../../framework/modules.js";
 import { InMemoryRouterAbEd25519YaoRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule } from "../registration/routerAbEd25519YaoRegistration.js";
 import { InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationStateV1 } from "../registration/routerAbEd25519YaoRegistrationIntentAuthorization.js";

package/dist/esm/router/domains/walletRegistration/walletRegistrationRoutes.js

@@ -14,6 +14,13 @@ import { parseHostedWalletSessionOperationCredentialToken, parsePrimaryWalletSes
 import { normalizeCorsOrigin } from "../../../core/SessionService.js";
 import { thresholdEcdsaChainTargetFromValue } from "../../../core/thresholdEcdsaChainTarget.js";
 import { walletIdFromString } from "../../../shared-ts/src/utils/registrationIds.js";
+import { deriveImplicitNearAccountIdFromEd25519PublicKey, parseImplicitNearAccountId } from "../../../shared-ts/src/utils/near.js";
+import { normalizeRegistrationSignerPlan, registrationSignerSetSelectionFromPlan } from "../../../shared-ts/src/utils/registrationSignerPlan.js";
+import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, computeAddAuthMethodIntentDigestB64u, computeAddSignerIntentDigestB64u, normalizeAddAuthMethodIntentCaller } from "../../../shared-ts/src/utils/registrationIntent.js";
+import { parsePasskeyCustodyEnvelopeRecord } from "../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
+import "../../../shared-ts/src/passkey-custody/index.js";
+import { parseRouterAbTraceContextV1 } from "../../../shared-ts/src/utils/routerAbTraceContext.js";
+import { recordRegistrationServerTiming, registrationServerTimingHeaders } from "../../cloudflare/d1/registration/d1RegistrationSetupSupport.js";
 import { parseRegistrationSetupOperationId } from "../../../shared-ts/src/utils/registrationSetupOperation.js";
 import { extractBearerCredential, extractRouterApiEnvironmentId } from "../../auth/routerApiKeyAuth.js";
 import { publishableKeyRoutePrincipal, resolvePublishableKeyApiCredentialAuth, resolveWalletRegistrationContext } from "../../auth/routerApiCredentialAuth.js";
@@ -21,13 +28,7 @@ import { resolveActiveRuntimePolicyScopeForEnvironment, resolveWalletSessionAdmi
 import { enforceRoutePolicy } from "../../framework/enforceRoutePolicy.js";
 import { parseRegistrationPreparedSessionSeal } from "./registrationSessionSeal.js";
 import { routeError, routeJson } from "../../framework/routeResponses.js";
-import { parsePasskeyCustodyEnvelopeRecord } from "../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
-import "../../../shared-ts/src/passkey-custody/index.js";
 import { computeWalletEcdsaKeyFactsInventoryChallengeDigestB64u } from "../../../shared-ts/src/utils/ecdsaKeyFactsInventory.js";
-import { deriveImplicitNearAccountIdFromEd25519PublicKey, parseImplicitNearAccountId } from "../../../shared-ts/src/utils/near.js";
-import { normalizeRegistrationSignerPlan, registrationSignerSetSelectionFromPlan } from "../../../shared-ts/src/utils/registrationSignerPlan.js";
-import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, computeAddAuthMethodIntentDigestB64u, computeAddSignerIntentDigestB64u, normalizeAddAuthMethodIntentCaller } from "../../../shared-ts/src/utils/registrationIntent.js";
-import { parseRouterAbTraceContextV1 } from "../../../shared-ts/src/utils/routerAbTraceContext.js";
 //#region src/router/domains/walletRegistration/walletRegistrationRoutes.ts
 function parseRegistrationTraceContext(headers) {
 	const parsed = parseRouterAbTraceContextV1(headers["x-seams-trace-id"] ?? headers["X-Seams-Trace-Id"]);
@@ -1573,6 +1574,8 @@ async function handleRouterApiWalletRegistrationSetup(input) {
 	if (!registrationContext) return routeError(500, "route_auth_not_configured", "Wallet registration context is not configured");
 	const request = parseWalletRegistrationSetupRequest(input.body);
 	if (!request.ok) return routeError(400, request.code, request.message);
+	const serverTiming = [];
+	const contextStartedAtMs = Date.now();
 	const context = await resolveWalletRegistrationContext({
 		registration: request.value,
 		environmentId: extractRouterApiEnvironmentId(input.headers) || void 0,
@@ -1585,11 +1588,13 @@ async function handleRouterApiWalletRegistrationSetup(input) {
 		route: input.route,
 		routeAuthNotConfiguredMessage: "Wallet registration setup requires API credential auth policy"
 	});
+	recordRegistrationServerTiming(serverTiming, "setup_context", contextStartedAtMs);
 	if (!context.ok) {
 		if (context.status === 401) return routeError(401, "unauthorized", `${context.code}: ${context.message}`);
 		if (context.status === 403) return routeError(403, "forbidden", `${context.code}: ${context.message}`);
 		return routeError(context.status, "internal", `${context.code}: ${context.message}`);
 	}
+	const policyStartedAtMs = Date.now();
 	const resolved = await enforceRoutePolicy({
 		headers: input.headers,
 		logger: input.logger,
@@ -1602,23 +1607,29 @@ async function handleRouterApiWalletRegistrationSetup(input) {
 		sourceIp: input.sourceIp,
 		resolvers: { apiCredentials: publishableKeyRoutePrincipal.bind(void 0, context.principal) }
 	});
+	recordRegistrationServerTiming(serverTiming, "setup_route_policy", policyStartedAtMs);
 	if (!resolved.ok) return routeJson(resolved.status, resolved.body);
 	const principal = context.principal;
-	if (input.services.registrationSetupRateLimit) try {
-		if (!(await input.services.registrationSetupRateLimit({
-			apiKeyId: principal.apiKeyId,
-			orgId: principal.orgId,
-			projectId: context.environment.projectId,
-			envId: context.environment.key,
-			sourceIp: input.sourceIp || "unknown"
-		})).allowed) return routeJson(429, {
-			ok: false,
-			code: "rate_limited",
-			message: "Too many registration attempts. Wait one minute and try again.",
-			retryAfterMs: 6e4
-		});
-	} catch {
-		return routeError(503, "internal", "Registration setup rate limit is unavailable");
+	if (input.services.registrationSetupRateLimit) {
+		const limitStartedAtMs = Date.now();
+		try {
+			const limit = await input.services.registrationSetupRateLimit({
+				apiKeyId: principal.apiKeyId,
+				orgId: principal.orgId,
+				projectId: context.environment.projectId,
+				envId: context.environment.key,
+				sourceIp: input.sourceIp || "unknown"
+			});
+			recordRegistrationServerTiming(serverTiming, "setup_rate_limit", limitStartedAtMs);
+			if (!limit.allowed) return routeJson(429, {
+				ok: false,
+				code: "rate_limited",
+				message: "Too many registration attempts. Wait one minute and try again.",
+				retryAfterMs: 6e4
+			});
+		} catch {
+			return routeError(503, "internal", "Registration setup rate limit is unavailable");
+		}
 	}
 	const runtimePolicyScope = {
 		orgId: principal.orgId,
@@ -1635,7 +1646,8 @@ async function handleRouterApiWalletRegistrationSetup(input) {
 		signer: session,
 		runtimePolicyScope,
 		signingRootId: `${runtimePolicyScope.projectId}:${runtimePolicyScope.envId}`,
-		signingRootVersion: runtimePolicyScope.signingRootVersion
+		signingRootVersion: runtimePolicyScope.signingRootVersion,
+		serverTiming
 	});
 }
 /**
@@ -1659,7 +1671,7 @@ async function handleRouterApiWalletRegistrationRespond(input) {
 		verifier: session,
 		...registrationUserAgentFromHeaders(input.headers) ? { userAgent: registrationUserAgentFromHeaders(input.headers) } : {}
 	}, traceContext.value ?? void 0, serverTiming, input.waitUntil);
-	return routeJson(result.ok ? 200 : result.code === "storage_unavailable" ? 503 : 400, result, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
+	return routeJson(result.ok ? 200 : result.code === "storage_unavailable" ? 503 : 400, result, { headers: registrationServerTimingHeaders(serverTiming) });
 }
 async function handleRouterApiWalletRegistrationNearAdmission(input) {
 	const traceContext = parseRegistrationTraceContext(input.headers);
@@ -1882,7 +1894,7 @@ async function handleRouterApiWalletRegistrationActivate(input) {
 	}, traceContext.value ?? void 0, serverTiming);
 	if (!result.ok) return routeJson(400, result);
 	if (!isEmailOtpWalletRegistrationActivateSuccessV2(result) && !isPasskeyWalletRegistrationActivateSuccessV2(result)) return routeError(500, "internal", "Wallet registration activation returned an invalid authority");
-	return routeJson(200, result, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
+	return routeJson(200, result, { headers: registrationServerTimingHeaders(serverTiming) });
 }
 /**
 * Commits a NEAR-only wallet or completes a mixed wallet's deferred signer.
@@ -1922,18 +1934,13 @@ async function handleRouterApiWalletRegistrationNearProvisioning(input) {
 			ok: false,
 			code: sealed.code,
 			message: sealed.message
-		}, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
+		}, { headers: registrationServerTimingHeaders(serverTiming) });
 		return routeJson(200, {
 			...result,
 			sessionSeal: sealed.value
-		}, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
+		}, { headers: registrationServerTimingHeaders(serverTiming) });
 	}
-	return routeJson(200, result, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
-}
-function ecdsaGatewayServerTimingHeaders(serverTiming) {
-	if (serverTiming.length === 0) return void 0;
-	const header = serverTiming.map(([name, durationMs]) => `${name};dur=${Math.max(0, durationMs).toFixed(1)}`).join(", ");
-	return { "Server-Timing": header };
+	return routeJson(200, result, { headers: registrationServerTimingHeaders(serverTiming) });
 }
 async function handleRouterApiWalletAddSignerStart(input) {
 	if (!isPlainObject(input.body)) return routeError(400, "invalid_body", "JSON body required");

package/dist/esm/router/framework/registrationSetupDispatch.js

@@ -1,3 +1,4 @@
+import { recordRegistrationServerTiming, registrationServerTimingHeaders } from "../cloudflare/d1/registration/d1RegistrationSetupSupport.js";
 //#region src/router/framework/registrationSetupDispatch.ts
 /** A transient storage fault outlived its retries. The same request can succeed later. */
 const SETUP_STORAGE_UNAVAILABLE = {
@@ -9,17 +10,23 @@ const SETUP_INTERNAL_FAILURE = {
 	message: "Wallet registration setup failed"
 };
 async function dispatchWalletRegistrationSetup(context, input) {
+	const serverTiming = input.serverTiming ?? [];
+	const dispatchStartedAtMs = Date.now();
 	const forwarded = await context.dispatcher?.dispatch(input);
 	if (forwarded) return forwarded;
+	recordRegistrationServerTiming(serverTiming, "setup_dispatch", dispatchStartedAtMs);
 	const result = await context.local.setupWalletRegistration(input);
+	const headers = registrationServerTimingHeaders(serverTiming);
 	if (result.ok) return {
 		status: 200,
-		body: result
+		body: result,
+		...headers ? { headers } : {}
 	};
 	const serverFailure = result.code === "storage_unavailable" ? SETUP_STORAGE_UNAVAILABLE : result.code === "internal" ? SETUP_INTERNAL_FAILURE : null;
 	if (!serverFailure) return {
 		status: 400,
-		body: result
+		body: result,
+		...headers ? { headers } : {}
 	};
 	console.error("[wallet-registration] setup failed", {
 		code: result.code,
@@ -31,7 +38,8 @@ async function dispatchWalletRegistrationSetup(context, input) {
 			ok: false,
 			code: result.code,
 			message: serverFailure.message
-		}
+		},
+		...headers ? { headers } : {}
 	};
 }
 //#endregion

package/dist/esm/router/framework/routeResponses.js

@@ -14,10 +14,6 @@ function routeError(status, code, message) {
 		message
 	});
 }
-function sendExpressRouteResponse(res, response) {
-	for (const [name, value] of Object.entries(response.headers || {})) res.set(name, value);
-	res.status(response.status).json(response.body);
-}
 function toFetchRouteResponse(response) {
 	return new Response(JSON.stringify(response.body), {
 		status: response.status,
@@ -28,6 +24,6 @@ function toFetchRouteResponse(response) {
 	});
 }
 //#endregion
-export { routeError, routeJson, sendExpressRouteResponse, toFetchRouteResponse };
+export { routeError, routeJson, toFetchRouteResponse };
 
 //# sourceMappingURL=routeResponses.js.map

package/dist/esm/router/transport/fetch/routes/deviceLinkingOwnerAuthorization.js

@@ -4,9 +4,9 @@ import { sha256DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimi
 import { buildEmailOtpWalletAuthAuthority, buildPasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseLinkedDeviceOwnerAuthorizationRequestV1 } from "../../../../shared-ts/src/device-linking/parsers.js";
 import { buildWalletSessionCapabilitySubjectsV1, walletSessionCapabilitySubjectsV1Equal } from "../../../../authorization/domain.js";
+import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
 import { json, jsonFailure, readJson } from "../../../framework/http.js";
-import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 //#region src/router/transport/fetch/routes/deviceLinkingOwnerAuthorization.ts
 const LINKED_DEVICE_OWNER_AUTHORIZATION_PATH_V1 = "/wallet/device-linking/v1/owner-authorization";
 /**

package/dist/esm/router/transport/fetch/routes/passkeyCustody.js

@@ -10,10 +10,10 @@ import { buildPasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../.
 import { parseSessionOrigin, parseVerifiedOwnerProofId } from "../../../../authorization/domain.js";
 import { buildVerifiedWalletOperationEmailOtpFactorResult, buildVerifiedWalletOperationPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
 import { findRouteDefinitionById, matchesRouteDefinitionRequest } from "../../../framework/routeDefinitions.js";
-import { extractBearerCredential, resolveSourceIpFromFetchHeaders } from "../../../auth/routerApiKeyAuth.js";
-import { toFetchRouteResponse } from "../../../framework/routeResponses.js";
 import { parsePasskeyCustodyEnvelopeRecord } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
+import { extractBearerCredential, resolveSourceIpFromFetchHeaders } from "../../../auth/routerApiKeyAuth.js";
+import { toFetchRouteResponse } from "../../../framework/routeResponses.js";
 import { readJson } from "../../../framework/http.js";
 import { isHostWithinRpId, originHostnameOrEmpty } from "../../../../core/authService/webauthnOidcHelpers.js";
 import { parseRecoveryCodeReservationId } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";

package/dist/esm/router/transport/fetch/routes/thresholdEd25519.js

@@ -890,7 +890,34 @@ async function proxyEd25519OwnerLaneExecution(input) {
 	});
 }
 async function handleRouterAbEd25519NormalSigningRoute(input) {
-	const authorization = await authorizeRouterAbEd25519NormalSigningRoute({
+	const startedAt = performance.now();
+	const timing = {
+		authorize: null,
+		admit: null,
+		proxy: null,
+		complete: null,
+		total: null
+	};
+	const response = await executeRouterAbEd25519NormalSigningRoute(input, timing);
+	timing.total = performance.now() - startedAt;
+	const headers = new Headers(response.headers);
+	for (const [stage, duration] of Object.entries(timing)) if (duration !== null) headers.append("Server-Timing", `ed25519_sign_${stage};dur=${Math.max(0, duration).toFixed(1)}`);
+	return new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers
+	});
+}
+async function timeEd25519SigningStage(timing, stage, pending) {
+	const startedAt = performance.now();
+	try {
+		return await pending;
+	} finally {
+		timing[stage] = performance.now() - startedAt;
+	}
+}
+async function executeRouterAbEd25519NormalSigningRoute(input, timing) {
+	const authorization = await timeEd25519SigningStage(timing, "authorize", authorizeRouterAbEd25519NormalSigningRoute({
 		body: input.body,
 		rawBody: input.body,
 		headers: Object.fromEntries(input.ctx.request.headers.entries()),
@@ -900,7 +927,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 		admissionAdapter: input.ctx.opts.routerAbNormalSigningAdmission,
 		resolveEd25519MaterialActivation: input.ctx.service.walletRegistration.resolveEd25519MaterialActivation.bind(input.ctx.service.walletRegistration),
 		phase: input.phase
-	});
+	}));
 	if (!authorization.ok) return json(authorization.result.body, { status: authorization.result.status });
 	if (authorization.kind === "operation_step_up") {
 		if (input.phase === "prepare") {
@@ -910,7 +937,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 				operation: authorization.operation
 			});
 			if (execution.kind !== "execute") return execution.response;
-			const upstream = await proxyEd25519OwnerLaneExecution({
+			const upstream = await timeEd25519SigningStage(timing, "proxy", proxyEd25519OwnerLaneExecution({
 				ctx: input.ctx,
 				authorization,
 				authorizedOperation: execution.operation,
@@ -921,7 +948,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 						binding: await ed25519OperationStepUpBinding(input.ctx, authorization.session, execution.operation)
 					})
 				}
-			});
+			}));
 			const upstreamBodyText = await upstream.clone().text().catch(() => "");
 			let upstreamBody = null;
 			try {
@@ -933,7 +960,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 				status: upstream.status,
 				bodyText: upstreamBodyText
 			})) return upstream;
-			if (!upstream.ok || !isPlainObject(upstreamBody)) return requireCompletedEd25519OperationResponse(await completeEd25519Operation({
+			if (!upstream.ok || !isPlainObject(upstreamBody)) return requireCompletedEd25519OperationResponse(await timeEd25519SigningStage(timing, "complete", completeEd25519Operation({
 				ctx: input.ctx,
 				operation: execution.operation,
 				result: upstream.status < 500 ? "failed_before_side_effect" : "failed_after_side_effect",
@@ -941,7 +968,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 					response: upstream,
 					bodyText: upstreamBodyText
 				})
-			}));
+			})));
 			const headers = new Headers(upstream.headers);
 			headers.delete("content-length");
 			return new Response(JSON.stringify(signingPrepareSessionResponse({
@@ -954,15 +981,15 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 			});
 		}
 		if (authorization.phase !== "finalize") throw new Error("Operation step-up finalize authorization phase changed");
-		const validatedAuthorization = await validateEd25519VerifiedStepUpAuthorizedOperation({
+		const validatedAuthorization = await timeEd25519SigningStage(timing, "admit", validateEd25519VerifiedStepUpAuthorizedOperation({
 			ctx: input.ctx,
 			body: input.body,
 			authorization
-		});
+		}));
 		if (!validatedAuthorization.ok) return validatedAuthorization.response;
 		const replay = replayCompletedEd25519Operation(validatedAuthorization.operation);
 		if (replay) return replay;
-		const upstream = await proxyEd25519OwnerLaneExecution({
+		const upstream = await timeEd25519SigningStage(timing, "proxy", proxyEd25519OwnerLaneExecution({
 			ctx: input.ctx,
 			authorization,
 			authorizedOperation: validatedAuthorization.operation,
@@ -973,13 +1000,13 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 					binding: await ed25519OperationStepUpBinding(input.ctx, authorization.session, validatedAuthorization.operation)
 				})
 			}
-		});
+		}));
 		const upstreamBodyText = await upstream.clone().text().catch(() => "");
 		if (isRouterAbEd25519OperationInProgressResponse({
 			status: upstream.status,
 			bodyText: upstreamBodyText
 		})) return upstream;
-		return requireCompletedEd25519OperationResponse(await completeEd25519Operation({
+		return requireCompletedEd25519OperationResponse(await timeEd25519SigningStage(timing, "complete", completeEd25519Operation({
 			ctx: input.ctx,
 			operation: validatedAuthorization.operation,
 			result: upstream.ok ? "succeeded" : upstream.status < 500 ? "failed_before_side_effect" : "failed_after_side_effect",
@@ -987,14 +1014,14 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 				response: upstream,
 				bodyText: upstreamBodyText
 			})
-		}));
+		})));
 	}
 	if (input.phase === "prepare") {
-		const authorized = await authorizeEd25519ReusableWalletSessionOperation({
+		const authorized = await timeEd25519SigningStage(timing, "admit", authorizeEd25519ReusableWalletSessionOperation({
 			ctx: input.ctx,
 			body: input.body,
 			authorization
-		});
+		}));
 		if (!authorized.ok) return authorized.response;
 		const execution = decideEd25519NormalSigningExecution({
 			phase: "prepare",
@@ -1016,7 +1043,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 				}
 			}
 		}, { status: 403 });
-		const upstream = await proxyEd25519OwnerLaneExecution({
+		const upstream = await timeEd25519SigningStage(timing, "proxy", proxyEd25519OwnerLaneExecution({
 			ctx: input.ctx,
 			authorization,
 			authorizedOperation: execution.operation,
@@ -1027,7 +1054,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 					binding: buildEd25519GatewayOwnerWalletSessionBinding(authorization, pinnedEd25519WalletScope(authorization, authorized.admission.ownerScope))
 				})
 			}
-		});
+		}));
 		const upstreamBodyText = await upstream.clone().text().catch(() => "");
 		let upstreamBody = null;
 		try {
@@ -1039,7 +1066,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 			status: upstream.status,
 			bodyText: upstreamBodyText
 		})) return upstream;
-		if (!upstream.ok || !isPlainObject(upstreamBody)) return requireCompletedEd25519OperationResponse(await completeEd25519Operation({
+		if (!upstream.ok || !isPlainObject(upstreamBody)) return requireCompletedEd25519OperationResponse(await timeEd25519SigningStage(timing, "complete", completeEd25519Operation({
 			ctx: input.ctx,
 			operation: execution.operation,
 			result: upstream.status < 500 ? "failed_before_side_effect" : "failed_after_side_effect",
@@ -1047,7 +1074,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 				response: upstream,
 				bodyText: upstreamBodyText
 			})
-		}));
+		})));
 		const headers = new Headers(upstream.headers);
 		headers.delete("content-length");
 		return new Response(JSON.stringify(signingPrepareSessionResponse({
@@ -1059,16 +1086,16 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 			headers
 		});
 	}
-	const validatedAuthorization = await validateEd25519ReusableAuthorizedOperation({
+	const validatedAuthorization = await timeEd25519SigningStage(timing, "admit", validateEd25519ReusableAuthorizedOperation({
 		ctx: input.ctx,
 		body: input.body,
 		authorization
-	});
+	}));
 	if (!validatedAuthorization.ok) return validatedAuthorization.response;
 	const replay = replayCompletedEd25519Operation(validatedAuthorization.operation);
 	if (replay) return replay;
 	if (!validatedAuthorization.ownerScope) throw new Error("Pinned owner Wallet Session scope is unavailable");
-	const upstream = await proxyEd25519OwnerLaneExecution({
+	const upstream = await timeEd25519SigningStage(timing, "proxy", proxyEd25519OwnerLaneExecution({
 		ctx: input.ctx,
 		authorization,
 		authorizedOperation: validatedAuthorization.operation,
@@ -1079,13 +1106,13 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 				binding: buildEd25519GatewayOwnerWalletSessionBinding(authorization, pinnedEd25519WalletScope(authorization, validatedAuthorization.ownerScope))
 			})
 		}
-	});
+	}));
 	const upstreamBodyText = await upstream.clone().text().catch(() => "");
 	if (isRouterAbEd25519OperationInProgressResponse({
 		status: upstream.status,
 		bodyText: upstreamBodyText
 	})) return upstream;
-	return requireCompletedEd25519OperationResponse(await completeEd25519Operation({
+	return requireCompletedEd25519OperationResponse(await timeEd25519SigningStage(timing, "complete", completeEd25519Operation({
 		ctx: input.ctx,
 		operation: validatedAuthorization.operation,
 		result: upstream.ok ? "succeeded" : upstream.status < 500 ? "failed_before_side_effect" : "failed_after_side_effect",
@@ -1093,7 +1120,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 			response: upstream,
 			bodyText: upstreamBodyText
 		})
-	}));
+	})));
 }
 async function handleThresholdEd25519(ctx) {
 	if (ctx.method === "GET" && ctx.pathname === "/router-ab/ed25519/healthz") {

package/dist/esm/shared-ts/src/utils/validation.js

@@ -44,7 +44,11 @@ function requireArray(value, label) {
 	if (!Array.isArray(value)) throw new Error(`${label} must be an array`);
 	return value;
 }
+function assertString(val, name = "value") {
+	if (typeof val !== "string") throw new Error(`Invalid ${name}: expected string`);
+	return val;
+}
 //#endregion
-export { asRecord, coerceNonEmptyString, isFunction, isObject, isPlainObject, requireArray, requireCanonicalString, requireNonEmptyString, requireRecord, requireRecordCopy, requireRecordOrArray, requireTrimmedString };
+export { asRecord, assertString, coerceNonEmptyString, isFunction, isObject, isPlainObject, requireArray, requireCanonicalString, requireNonEmptyString, requireRecord, requireRecordCopy, requireRecordOrArray, requireTrimmedString };
 
 //# sourceMappingURL=validation.js.map

package/dist/esm/threshold/session/signingSessionSeal/index.js

@@ -9,5 +9,4 @@ import { createSigningSessionSealOptions, parseSigningSessionSealRootConfig } fr
 import { createInMemorySigningSessionSealIdempotencyStore } from "./idempotency.js";
 import { createRedisTcpSigningSessionSealRateLimiter, createUpstashSigningSessionSealRateLimiter, resolveSigningSessionSealRateLimitFromEnv } from "./guards/backends.js";
 import { createRedisTcpSigningSessionSealIdempotencyStore, createUpstashSigningSessionSealIdempotencyStore, resolveSigningSessionSealIdempotencyFromEnv } from "./idempotencyBackends.js";
-import { registerSigningSessionSealRoutes } from "./transport/express.js";
-export { authorizeSigningSessionSealRequest, buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, composeSigningSessionSealGuards, createInMemorySigningSessionSealIdempotencyStore, createInMemorySigningSessionSealRateLimiter, createPassthroughSigningSessionSealCipherAdapter, createRedisTcpSigningSessionSealIdempotencyStore, createRedisTcpSigningSessionSealRateLimiter, createSigningSessionSealAuditLogger, createSigningSessionSealCipherAdapter, createSigningSessionSealOptions, createSigningSessionSealRateLimitGuard, createSigningSessionSealRoutesOptions, createSigningSessionSealService, createSigningSessionSealShamir3PassCipherAdapter, createUpstashSigningSessionSealIdempotencyStore, createUpstashSigningSessionSealRateLimiter, encodeSigningSessionSealServerLockContext, handleSigningSessionSealRoutes, parseSigningSessionSealApplyBody, parseSigningSessionSealRemoveBody, parseSigningSessionSealRootConfig, registerSigningSessionSealRoutes, resolveSigningSessionSealBasePath, resolveSigningSessionSealIdempotencyFromEnv, resolveSigningSessionSealRateLimitFromEnv, signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode };
+export { authorizeSigningSessionSealRequest, buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, composeSigningSessionSealGuards, createInMemorySigningSessionSealIdempotencyStore, createInMemorySigningSessionSealRateLimiter, createPassthroughSigningSessionSealCipherAdapter, createRedisTcpSigningSessionSealIdempotencyStore, createRedisTcpSigningSessionSealRateLimiter, createSigningSessionSealAuditLogger, createSigningSessionSealCipherAdapter, createSigningSessionSealOptions, createSigningSessionSealRateLimitGuard, createSigningSessionSealRoutesOptions, createSigningSessionSealService, createSigningSessionSealShamir3PassCipherAdapter, createUpstashSigningSessionSealIdempotencyStore, createUpstashSigningSessionSealRateLimiter, encodeSigningSessionSealServerLockContext, handleSigningSessionSealRoutes, parseSigningSessionSealApplyBody, parseSigningSessionSealRemoveBody, parseSigningSessionSealRootConfig, resolveSigningSessionSealBasePath, resolveSigningSessionSealIdempotencyFromEnv, resolveSigningSessionSealRateLimitFromEnv, signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode };

package/dist/types/wallet-server/src/cloud-host.d.ts

@@ -6,6 +6,7 @@ export * from './core/logger';
 export * from './core/routerAbSigning/RouterAbEcdsaPresignRuntime';
 export * from './core/types';
 export * from './delegateAction';
+export { LocalRegistrationSetupAuthority } from './localRegistrationSetupAuthority';
 export * from './router/framework/apiCredentialPorts';
 export { createWalletRegistrationContextResolver, unavailableRegistrationContext, walletRegistrationContext, } from './router/auth/walletRegistrationContext';
 export { parseWalletRegistrationSetupRequest } from './router/domains/walletRegistration/walletRegistrationRoutes';

package/dist/types/wallet-server/src/localHostedWalletGatewayHandler.d.ts

@@ -6,7 +6,7 @@ export type LocalHostedWalletGatewayEnv = CloudflareD1GatewayBaseEnv & {
 /**
  * The local Gateway: the hosted Gateway handler plus the intended-suite
  * transport faults, which a request arms with local-only headers. The local
- * Worker and the local Node host both serve through this.
+ * Worker serves through this handler.
  */
 export declare function handleLocalHostedWalletGatewayRequestV1(request: Request, env: LocalHostedWalletGatewayEnv, ctx: CfExecutionContext, dependencies?: HostedWalletGatewayDependenciesV1): Promise<Response>;
 //# sourceMappingURL=localHostedWalletGatewayHandler.d.ts.map

package/dist/types/wallet-server/src/localIntendedYaoFault.d.ts

@@ -5,9 +5,13 @@ export declare const LOCAL_INTENDED_YAO_FAULT_TOKEN_HEADER_V1 = "x-seams-intende
  *   execute, and expects the Gateway to send the identical request again.
  * - `return_terminal_burned_once` has the Router end the first execute
  *   burned, and expects the Gateway to answer that failure without retrying.
+ * - `answer_retryable_while_running_once` lets the Router keep running the
+ *   first execute, and answers the Gateway at once that it failed
+ *   recoverably, as a Deriver that refused a late preparation does. The
+ *   Router's claim stays held until that run records its answer.
  */
-type LocalIntendedYaoFaultModeV1 = 'drop_router_response_once' | 'return_terminal_burned_once';
-type LocalIntendedYaoFaultProofV1 = 'exact_request_replayed' | 'terminal_failure_not_retried';
+type LocalIntendedYaoFaultModeV1 = 'drop_router_response_once' | 'return_terminal_burned_once' | 'answer_retryable_while_running_once';
+type LocalIntendedYaoFaultProofV1 = 'exact_request_replayed' | 'terminal_failure_not_retried' | 'execution_left_running';
 type LocalIntendedYaoFaultViolationV1 = 'fault_already_armed' | 'router_execute_not_observed' | 'router_first_response_failed' | 'router_retry_not_observed' | 'router_retry_body_changed' | 'router_retry_trace_changed' | 'router_retry_marked_as_replay' | 'router_retry_response_failed' | 'router_terminal_not_recorded' | 'unexpected_additional_execute';
 type LocalIntendedYaoFaultOutcomeV1 = {
     readonly kind: 'proved';
@@ -22,10 +26,16 @@ type LocalIntendedYaoFaultTokenV1 = {
 export declare function parseLocalIntendedYaoFaultModeV1(value: string | null): LocalIntendedYaoFaultModeV1 | null;
 export declare function parseLocalIntendedYaoFaultTokenV1(value: string | null): LocalIntendedYaoFaultTokenV1 | null;
 export declare function isLocalIntendedYaoFaultTokenV1(value: string | null): value is string;
+/** Reconstructs a local fault request from its persisted boundary value. */
+export declare function parseLocalIntendedKeptRouterRequestV1(value: unknown): Request;
 export declare class LocalIntendedYaoFaultControllerV1 {
     private readonly baseFetch;
+    /** Keeps a Router call alive after the Gateway answered without it. */
+    private readonly keepRunning;
     private state;
-    constructor(baseFetch: typeof globalThis.fetch);
+    constructor(baseFetch: typeof globalThis.fetch, 
+    /** Keeps a Router call alive after the Gateway answered without it. */
+    keepRunning: (running: Promise<unknown>) => void);
     arm(mode: LocalIntendedYaoFaultModeV1): void;
     fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
     consumeOutcome(): LocalIntendedYaoFaultOutcomeV1;

package/dist/types/wallet-server/src/localIntendedYaoRecoveryFault.d.ts

@@ -1,3 +1,4 @@
+import type { D1RegistrationCeremonyRecordStore } from './router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore';
 export declare const LOCAL_INTENDED_YAO_RECOVERY_FAULT_HEADER_V1 = "x-seams-intended-yao-recovery-fault-v1";
 export declare const LOCAL_INTENDED_YAO_RECOVERY_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-yao-recovery-fault-token-v1";
 /**
@@ -28,17 +29,18 @@ export declare class LocalIntendedYaoRecoveryFaultControllerV1 {
     private readonly baseFetch;
     private readonly mode;
     private readonly token;
+    private readonly storage;
     private executed;
     private failed;
     private kept;
-    constructor(baseFetch: typeof globalThis.fetch, mode: 'lose_router_recovery_replies' | 'withhold_router_recovery_execute', token: string);
+    constructor(baseFetch: typeof globalThis.fetch, mode: 'lose_router_recovery_replies' | 'withhold_router_recovery_execute', token: string, storage: D1RegistrationCeremonyRecordStore);
     fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
     outcome(): LocalIntendedYaoRecoveryFaultOutcomeV1;
 }
 /** Sends the execution kept under `token` to the Router, exactly. */
 export declare function releaseLocalIntendedYaoRecoveryExecuteV1(router: {
     fetch(request: Request): Promise<Response>;
-}, token: string): Promise<Response>;
+}, token: string, storage: D1RegistrationCeremonyRecordStore): Promise<Response>;
 export declare function requestWithoutLocalIntendedYaoRecoveryFaultHeadersV1(request: Request): Request;
 export declare function responseWithLocalIntendedYaoRecoveryFaultOutcomeV1(response: Response, outcome: LocalIntendedYaoRecoveryFaultOutcomeV1, token: string): Response;
 export {};

package/dist/types/wallet-server/src/localIntendedYaoSigningFault.d.ts

@@ -1,3 +1,4 @@
+import type { D1RegistrationCeremonyRecordStore } from './router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore';
 export declare const LOCAL_INTENDED_YAO_SIGNING_FAULT_HEADER_V1 = "x-seams-intended-yao-signing-fault-v1";
 export declare const LOCAL_INTENDED_YAO_SIGNING_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-yao-signing-fault-token-v1";
 export declare const ROUTER_AB_ED25519_SIGNING_FINALIZE_PATH_V1 = "/router-ab/ed25519/sign";
@@ -20,8 +21,9 @@ export declare class LocalIntendedYaoSigningFaultControllerV1 {
     private readonly baseFetch;
     private readonly mode;
     private readonly token;
+    private readonly storage;
     private kept;
-    constructor(baseFetch: typeof globalThis.fetch, mode: 'capture_signing_finalize' | 'withhold_signing_finalize', token: string);
+    constructor(baseFetch: typeof globalThis.fetch, mode: 'capture_signing_finalize' | 'withhold_signing_finalize', token: string, storage: D1RegistrationCeremonyRecordStore);
     fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
     private keep;
     outcome(): string;
@@ -29,7 +31,7 @@ export declare class LocalIntendedYaoSigningFaultControllerV1 {
 /** Sends the finalize kept under `token` to the Router again, exactly. */
 export declare function releaseLocalIntendedYaoSigningFinalizeV1(router: {
     fetch(request: Request): Promise<Response>;
-}, token: string): Promise<Response>;
+}, token: string, storage: D1RegistrationCeremonyRecordStore): Promise<Response>;
 export declare function requestWithoutLocalIntendedYaoSigningFaultHeadersV1(request: Request): Request;
 export declare function responseWithLocalIntendedYaoSigningFaultOutcomeV1(response: Response, outcome: string): Response;
 export {};

package/dist/types/wallet-server/src/router/auth/routerApiKeyAuth.d.ts

@@ -2,15 +2,7 @@ type HeaderBag = Headers | Record<string, unknown>;
 export declare function extractBearerCredential(headers: HeaderBag): string | null;
 export declare function normalizeSourceIp(raw: string | undefined): string | null;
 export declare function extractRouterApiEnvironmentId(headers: HeaderBag): string | null;
-export declare function resolveSourceIpFromExpressRequest(input: {
-    headers: Record<string, unknown>;
-    ip?: string | null;
-}): string | null;
 export declare function resolveSourceIpFromFetchHeaders(headers: HeaderBag): string | null;
-export declare function resolveRequestOriginRateLimitKeyFromExpressRequest(input: {
-    headers: Record<string, unknown>;
-    ip?: string | null;
-}): string;
 export declare function resolveRequestOriginRateLimitKeyFromFetchHeaders(headers: HeaderBag): string;
 export {};
 //# sourceMappingURL=routerApiKeyAuth.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.d.ts

@@ -40,6 +40,8 @@ export declare class D1RegistrationCeremonyRecordStore {
     constructor(options: D1RegistrationCeremonyRecordStoreOptions);
     get(scope: string, id: string): Promise<D1RegistrationCeremonyStoredRecord | null>;
     prepareGet(scope: string, id: string): D1PreparedStatementLike;
+    /** Load the ceremony's immutable founding identities and their current records together. */
+    prepareFoundingRecordsRead(id: string): D1PreparedStatementLike;
     parseGet(scope: string, id: string, row: StoredRow | null): Promise<D1RegistrationCeremonyStoredRecord | null>;
     putExact(mutation: D1RegistrationCeremonyRecordMutation): Promise<void>;
     insertOrRead(mutation: D1RegistrationCeremonyRecordMutation): Promise<D1RegistrationCeremonyStoredRecord>;

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.d.ts

@@ -32,6 +32,7 @@ export declare class CloudflareD1RegistrationCeremonyIntentStore {
     reserveSetupCeremony(proposed: StoredWalletRegistrationCeremony, ownershipGeneration: number): Promise<StoredWalletRegistrationCeremony>;
     getCeremony(registrationCeremonyId: string): Promise<StoredWalletRegistrationCeremony | null>;
     prepareCeremonyRead(registrationCeremonyId: string): D1PreparedStatementLike;
+    prepareFoundingRecordsRead(registrationCeremonyId: string): D1PreparedStatementLike;
     parseCeremonyRead(registrationCeremonyId: string, result: D1ResultLike<Record<string, unknown>>): Promise<StoredWalletRegistrationCeremony | null>;
     parseCeremonySnapshotRead(registrationCeremonyId: string, result: D1ResultLike<Record<string, unknown>>): Promise<D1WalletRegistrationEcdsaCeremonyClaimV1 | null>;
     getCeremonySnapshot(registrationCeremonyId: string): Promise<D1WalletRegistrationEcdsaCeremonyClaimV1 | null>;