@seams/wallet-server 0.10.2 → 0.11.0

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationSetupSupport.d.ts

@@ -48,6 +48,8 @@ type RegistrationIntentSignerBranches = {
     readonly evmFamilyEcdsa: RegistrationEvmFamilyEcdsaSignerPlan | null;
 };
 export declare function recordRegistrationServerTiming(sink: Array<readonly [string, number]>, name: string, startedAtMs: number): void;
+/** The `Server-Timing` header of a registration route's recorded waits. */
+export declare function registrationServerTimingHeaders(serverTiming: readonly (readonly [string, number])[]): Record<string, string> | undefined;
 export declare function recordRegistrationPromiseTiming<T>(args: {
     readonly sink: Array<readonly [string, number]>;
     readonly name: string;

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.d.ts

@@ -2,6 +2,7 @@ import { type PasskeyCredentialClaims } from '../../../../core/passkeyCredential
 import type { ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
 import { type ActiveWalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
 import { type RegistrationAuthority } from '../../../../../../shared-ts/src/utils/registrationAuthMethodInput';
+import type { Variant } from '../../../../../../shared-ts/src/utils/variant';
 import type { WalletRecord, WalletSignerRecord } from '../../../../core/WalletStore';
 import type { D1DatabaseLike, D1PreparedStatementLike, D1ResultLike } from '../../../../storage/tenantRoute';
 import type { D1EmailOtpRegistrationCommitPlan } from '../emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer';
@@ -41,11 +42,11 @@ export type HeldRegistrationPasskeyClaim = {
 export interface D1WalletRegistrationCommitStore {
     /**
      * Claims the authority's passkey through shared authority, unless `held`
-     * records that the same claim was already granted for this ceremony. With
-     * `founding`, it also reads that authority and auth method as stored, beside
-     * the claim, so the commit writes them without a read of its own.
+     * records that the same claim was already granted for this ceremony. Uses
+     * the founding snapshot when supplied; otherwise reads the named records
+     * beside the claim. The returned commit performs no additional read.
      */
-    reserveAuthority(authority: RegistrationAuthority, held: HeldRegistrationPasskeyClaim | null, founding: FoundingRecordIds | null): Promise<ReservedWalletRegistrationCommit>;
+    reserveAuthority(authority: RegistrationAuthority, held: HeldRegistrationPasskeyClaim | null, founding: RegistrationFoundingRead | null): Promise<ReservedWalletRegistrationCommit>;
     /**
      * Claims a verified passkey before finalization and records a granted
      * claim. A refusal records nothing, so finalization claims again and
@@ -62,6 +63,25 @@ export interface D1WalletRegistrationCommitStore {
     deleteHeldPasskeyClaim(registrationCeremonyId: string): Promise<void>;
 }
 type FoundingRecordIds = Pick<D1WalletRegistrationOperationPreparedV1, 'walletAuthorityId' | 'walletAuthMethodId'>;
+export type RegistrationFoundingRead = {
+    readonly kind: 'read';
+    readonly ids: FoundingRecordIds;
+    readonly records?: never;
+} | {
+    readonly kind: 'snapshot';
+    readonly records: StoredFoundingRecords;
+    readonly ids?: never;
+};
+export type RegistrationFoundingSnapshot = Variant<RegistrationFoundingRead, 'kind', 'snapshot'>;
+export declare function parseRegistrationFoundingRead(result: D1ResultLike<Record<string, unknown>>): RegistrationFoundingSnapshot | null;
+/** A registration's founding authority and auth method rows from one database snapshot. */
+type StoredFoundingRecords = FoundingRecordIds & {
+    readonly authorityRow: D1RegistrationRecordJsonRow | null;
+    readonly authMethodRow: D1RegistrationRecordJsonRow | null;
+};
+type D1RegistrationRecordJsonRow = {
+    readonly record_json?: unknown;
+};
 export declare class CloudflareD1WalletRegistrationCommitStore implements D1WalletRegistrationCommitStore {
     private readonly database;
     private readonly scope;
@@ -74,7 +94,7 @@ export declare class CloudflareD1WalletRegistrationCommitStore implements D1Wall
         readonly projectId: string;
         readonly envId: string;
     });
-    reserveAuthority(authority: RegistrationAuthority, held: HeldRegistrationPasskeyClaim | null, founding: FoundingRecordIds | null): Promise<ReservedWalletRegistrationCommit>;
+    reserveAuthority(authority: RegistrationAuthority, held: HeldRegistrationPasskeyClaim | null, founding: RegistrationFoundingRead | null): Promise<ReservedWalletRegistrationCommit>;
     claimPasskeyAhead(input: {
         readonly registrationCeremonyId: string;
         readonly authority: RegistrationAuthority;

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationRead.d.ts

@@ -40,6 +40,21 @@ export declare class D1WalletRegistrationRead {
     } | {
         ok: true;
         operation: import("../../../cloudflare-adaptor").VersionedJsonRecordReadResult<D1WalletRegistrationNearProvisioningSideEffectRecord>;
+        readFounding: () => {
+            readonly kind: "snapshot";
+            readonly records: {
+                readonly walletAuthMethodId: import("../../../../../../shared-ts/src/utils").WalletAuthMethodId;
+                readonly walletAuthorityId: import("../../../../../../shared-ts/src/utils").WalletAuthorityId;
+            } & {
+                readonly authorityRow: {
+                    readonly record_json?: unknown;
+                } | null;
+                readonly authMethodRow: {
+                    readonly record_json?: unknown;
+                } | null;
+            };
+            readonly ids?: never;
+        } | null;
         decision: import("../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision").RouterAbEd25519YaoLifecycleDecisionV1 | null;
         heldPasskeyClaim: import("./d1WalletRegistrationCommitStore").HeldRegistrationPasskeyClaim | null;
         readCeremony: () => Promise<import("../../../../core/RegistrationCeremonyStore").StoredWalletRegistrationCeremony | null>;

package/dist/types/wallet-server/src/router/cloudflare-adaptor.d.ts

@@ -42,7 +42,7 @@ export type { CloudflareTenantStorageRoute, CloudflareTenantTopology, D1BindingN
 export { StaticCloudflareTenantStorageRouteResolver, createCloudflareTenantStorageRoute, createSignerD1DoStorageTarget, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, } from '../storage/tenantRoute';
 export type { InMemoryRouterApiRuntimeSnapshotConsumer, RouterApiRuntimeSnapshotPublishedUpdate, } from './framework/runtimeSnapshotConsumer';
 export { createInMemoryRouterApiRuntimeSnapshotConsumer, validateRuntimeSnapshotExpectation, } from './framework/runtimeSnapshotConsumer';
-export { extractBearerCredential, extractRouterApiEnvironmentId, resolveSourceIpFromExpressRequest, resolveSourceIpFromFetchHeaders, } from './auth/routerApiKeyAuth';
+export { extractBearerCredential, extractRouterApiEnvironmentId, resolveSourceIpFromFetchHeaders, } from './auth/routerApiKeyAuth';
 export { createCloudflareRouter } from './cloudflare/runtime/createCloudflareRouter';
 export type { SelfHostedCloudflareSigningWorkerFactoryInput } from './cloudflare/runtime/createSelfHostedCloudflareSigningWorker';
 export { createSelfHostedCloudflareSigningRouter, createSelfHostedCloudflareSigningWorker, } from './cloudflare/runtime/createSelfHostedCloudflareSigningWorker';

package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationInputs.d.ts

@@ -21,6 +21,8 @@ export type WalletRegistrationSetupInput = {
     readonly runtimePolicyScope?: ThresholdRuntimePolicyScope;
     readonly signingRootId?: string;
     readonly signingRootVersion?: string;
+    /** Collects the `[name, ms]` waits of this setup for its `Server-Timing` header. */
+    readonly serverTiming?: Array<readonly [string, number]>;
 };
 export type WalletRegistrationRespondInput = {
     readonly registrationCeremonyId: string;

package/dist/types/wallet-server/src/router/framework/routeResponses.d.ts

@@ -1,4 +1,3 @@
-import type { Response as ExpressResponse } from 'express';
 import type { RouteResponse } from './routeExecutionContext';
 import type { RoutePolicyFailureCode } from './routeAuthPolicy';
 import type { RouteUsageData } from './routeMeteringPolicy';
@@ -12,6 +11,5 @@ export declare function routeJson<TBody>(status: number, body: TBody, options?:
     usage?: RouteUsageData;
 }): RouteResponse<TBody>;
 export declare function routeError(status: number, code: RouteErrorBody['code'], message: string): RouteResponse<RouteErrorBody>;
-export declare function sendExpressRouteResponse<TBody>(res: ExpressResponse, response: RouteResponse<TBody>): void;
 export declare function toFetchRouteResponse<TBody>(response: RouteResponse<TBody>): Response;
 //# sourceMappingURL=routeResponses.d.ts.map

package/dist/types/wallet-server/src/threshold/session/signingSessionSeal/index.d.ts

@@ -6,7 +6,7 @@ export type { CreateSigningSessionSealOptionsInput } from './options';
 export type { CreateSigningSessionSealRateLimitGuardOptions, InMemorySigningSessionSealRateLimiterOptions, SigningSessionSealRateLimitConsumeInput, SigningSessionSealRateLimitConsumeResult, SigningSessionSealRateLimiter, SigningSessionSealRateLimitRejectedEvent, } from './guards';
 export type { CreateSigningSessionSealRateLimitFromEnvInput, CreateRedisTcpSigningSessionSealRateLimiterOptions, CreateUpstashSigningSessionSealRateLimiterOptions, } from './guards/backends';
 export type { CreateSigningSessionSealIdempotencyFromEnvInput, CreateRedisTcpSigningSessionSealIdempotencyStoreOptions, CreateUpstashSigningSessionSealIdempotencyStoreOptions, } from './idempotencyBackends';
-export { signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode } from './transport/shared';
+export { signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode, } from './transport/shared';
 export { buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, resolveSigningSessionSealBasePath, parseSigningSessionSealApplyBody, parseSigningSessionSealRemoveBody, authorizeSigningSessionSealRequest, } from './transport/shared';
 export { createSigningSessionSealCipherAdapter, createPassthroughSigningSessionSealCipherAdapter, createSigningSessionSealShamir3PassCipherAdapter, encodeSigningSessionSealServerLockContext, } from './crypto/cipher';
 export { createSigningSessionSealService } from './service';
@@ -18,6 +18,5 @@ export { createInMemorySigningSessionSealRateLimiter, createSigningSessionSealRa
 export { createRedisTcpSigningSessionSealRateLimiter, createUpstashSigningSessionSealRateLimiter, resolveSigningSessionSealRateLimitFromEnv, } from './guards/backends';
 export { createRedisTcpSigningSessionSealIdempotencyStore, createUpstashSigningSessionSealIdempotencyStore, resolveSigningSessionSealIdempotencyFromEnv, } from './idempotencyBackends';
 export { composeSigningSessionSealGuards } from './guards';
-export { registerSigningSessionSealRoutes } from './transport/express';
 export { handleSigningSessionSealRoutes } from './transport/fetch';
 //# sourceMappingURL=index.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seams/wallet-server",
-  "version": "0.10.2",
+  "version": "0.11.0",
   "type": "module",
   "description": "Seams server TypeScript SDK for NEAR and EVM-family wallets",
   "main": "./dist/esm/index.js",
@@ -19,11 +19,6 @@
       "import": "./dist/esm/index.js",
       "default": "./dist/esm/index.js"
     },
-    "./router/express": {
-      "types": "./dist/types/wallet-server/src/router/express-adaptor.d.ts",
-      "import": "./dist/esm/router/express.js",
-      "default": "./dist/esm/router/express.js"
-    },
     "./router/cloudflare": {
       "types": "./dist/types/wallet-server/src/router/cloudflare-adaptor.d.ts",
       "import": "./dist/esm/router/cloudflare.js",
@@ -120,12 +115,10 @@
   "homepage": "https://github.com/seams-tech/seams-wallet#readme",
   "dependencies": {
     "@simplewebauthn/server": "^13.2.2",
-    "bs58": "^6.0.0",
-    "express": "^4.21.2"
+    "bs58": "^6.0.0"
   },
   "devDependencies": {
     "@near-js/types": "^2.4.0",
-    "@types/express": "^4.17.21",
     "@types/node": "^20.19.9",
     "rolldown": "^1.0.0-beta.27",
     "typescript": "^5.8.3"

package/src/README.md

@@ -76,7 +76,7 @@ Use fresh wallets when measuring this change.
 It does not authorize wallet ownership.
 
 ```ts
-import { createRouterApiRouter } from '@seams/wallet-server/router/express';
+import { createCloudflareRouter } from '@seams/wallet-server/router/cloudflare';
 import { createSigningSessionSealOptions } from '@seams/wallet-server';
 
 const signingSessionSeal = createSigningSessionSealOptions({
@@ -85,10 +85,12 @@ const signingSessionSeal = createSigningSessionSealOptions({
   acceptedWarmKeyVersions: ['signing-session-seal-production-r2'],
 });
 
-app.use('/', createRouterApiRouter(service, {
+const fetch = createCloudflareRouter(service, {
   threshold,
   signingSessionSeal,
-}));
+});
+
+export default { fetch };
 ```
 
 Store the random 32-byte root secret in a secrets manager. Retain accepted old

package/dist/esm/router/express-adaptor.js

@@ -1,84 +0,0 @@
-import { ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, parseRouterAbPublicKeysetV2 } from "../shared-ts/src/utils/routerAbPublicKeyset.js";
-import { defineRoute } from "./framework/routeDefinitions.js";
-import { InMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createRouterAbNormalSigningAdmissionAdapter } from "./domains/signingOperations/routerAbNormalSigningAdmissionCore.js";
-import { createRouterApiModule } from "./framework/modules.js";
-import { attachRouterApiRouteSurface, getRouterApiRouteSurface } from "./framework/routerApiRouteSurface.js";
-import { createFetchRouter } from "./transport/fetch/createFetchRouter.js";
-import { createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateV1 } from "./domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js";
-import { RouterAbEd25519YaoHttpRegistrationBackend, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv } from "./domains/ed25519Yao/registration/routerAbEd25519YaoHttpRegistrationBackend.js";
-import { createInMemoryRouterApiRuntimeSnapshotConsumer, validateRuntimeSnapshotExpectation } from "./framework/runtimeSnapshotConsumer.js";
-import express from "express";
-//#region src/router/express-adaptor.ts
-function appendExpressRequestHeaders(headers, req) {
-	for (const [name, value] of Object.entries(req.headers)) {
-		if (Array.isArray(value)) {
-			for (const item of value) headers.append(name, item);
-			continue;
-		}
-		if (typeof value === "string") headers.set(name, value);
-	}
-}
-function resolveExpressRequestUrl(req) {
-	const host = req.get("host") || "localhost";
-	return `${req.protocol || "http"}://${host}${req.originalUrl || req.url}`;
-}
-function encodeExpressRequestBody(req) {
-	const method = req.method.toUpperCase();
-	if (method === "GET" || method === "HEAD") return void 0;
-	if (req.body === void 0 || req.body === null) return void 0;
-	if (typeof req.body === "string" || req.body instanceof Uint8Array) return req.body;
-	return JSON.stringify(req.body);
-}
-function buildFetchRequestFromExpress(req) {
-	const headers = new Headers();
-	appendExpressRequestHeaders(headers, req);
-	const body = encodeExpressRequestBody(req);
-	if (body && !headers.has("content-type")) headers.set("content-type", "application/json; charset=utf-8");
-	return new Request(resolveExpressRequestUrl(req), {
-		method: req.method,
-		headers,
-		body
-	});
-}
-async function isFetchRouterNotFound(response) {
-	if (response.status !== 404) return false;
-	return await response.clone().text() === "Not Found";
-}
-async function sendFetchResponseToExpress(fetchResponse, res) {
-	fetchResponse.headers.forEach((value, name) => {
-		res.setHeader(name, value);
-	});
-	res.status(fetchResponse.status);
-	const body = Buffer.from(await fetchResponse.arrayBuffer());
-	if (body.length === 0) {
-		res.end();
-		return;
-	}
-	res.send(body);
-}
-function createFetchBackedExpressMiddleware(fetchHandler) {
-	return async function fetchBackedExpressMiddleware(req, res, next) {
-		try {
-			const fetchResponse = await fetchHandler(buildFetchRequestFromExpress(req));
-			if (await isFetchRouterNotFound(fetchResponse)) {
-				next();
-				return;
-			}
-			await sendFetchResponseToExpress(fetchResponse, res);
-		} catch (error) {
-			next(error);
-		}
-	};
-}
-function createRouterApiRouter(service, opts = {}) {
-	const fetchHandler = createFetchRouter(service, opts, { kind: "inline" });
-	const router = express.Router();
-	router.use(createFetchBackedExpressMiddleware(fetchHandler));
-	const surface = getRouterApiRouteSurface(fetchHandler);
-	if (!surface) return router;
-	return attachRouterApiRouteSurface(router, surface);
-}
-//#endregion
-export { InMemoryRouterAbNormalSigningAdmissionStore, ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, RouterAbEd25519YaoHttpRegistrationBackend, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterApiRuntimeSnapshotConsumer, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateV1, createRouterAbNormalSigningAdmissionAdapter, createRouterApiModule, createRouterApiRouter, defineRoute, parseRouterAbPublicKeysetV2, validateRuntimeSnapshotExpectation };
-
-//# sourceMappingURL=express-adaptor.js.map