@seams/wallet-server 0.10.2 → 0.12.0

package/dist/esm/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js

@@ -7,8 +7,8 @@ import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRan
 import { ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 import { computeAddSignerNearEd25519SigningKeyId, computeRegistrationNearEd25519SigningKeyId } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { registrationNearEd25519BranchKey } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
-import "../../../../shared-ts/src/threshold/sessionPolicy.js";
 import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
+import "../../../../shared-ts/src/threshold/sessionPolicy.js";
 import { createRouterApiModule } from "../../../framework/modules.js";
 import { InMemoryRouterAbEd25519YaoRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule } from "../registration/routerAbEd25519YaoRegistration.js";
 import { InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationStateV1 } from "../registration/routerAbEd25519YaoRegistrationIntentAuthorization.js";

package/dist/esm/router/domains/walletRegistration/walletRegistrationRoutes.js

@@ -14,6 +14,13 @@ import { parseHostedWalletSessionOperationCredentialToken, parsePrimaryWalletSes
 import { normalizeCorsOrigin } from "../../../core/SessionService.js";
 import { thresholdEcdsaChainTargetFromValue } from "../../../core/thresholdEcdsaChainTarget.js";
 import { walletIdFromString } from "../../../shared-ts/src/utils/registrationIds.js";
+import { deriveImplicitNearAccountIdFromEd25519PublicKey, parseImplicitNearAccountId } from "../../../shared-ts/src/utils/near.js";
+import { normalizeRegistrationSignerPlan, registrationSignerSetSelectionFromPlan } from "../../../shared-ts/src/utils/registrationSignerPlan.js";
+import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, computeAddAuthMethodIntentDigestB64u, computeAddSignerIntentDigestB64u, normalizeAddAuthMethodIntentCaller } from "../../../shared-ts/src/utils/registrationIntent.js";
+import { parsePasskeyCustodyEnvelopeRecord } from "../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
+import "../../../shared-ts/src/passkey-custody/index.js";
+import { parseRouterAbTraceContextV1 } from "../../../shared-ts/src/utils/routerAbTraceContext.js";
+import { recordRegistrationServerTiming, registrationServerTimingHeaders } from "../../cloudflare/d1/registration/d1RegistrationSetupSupport.js";
 import { parseRegistrationSetupOperationId } from "../../../shared-ts/src/utils/registrationSetupOperation.js";
 import { extractBearerCredential, extractRouterApiEnvironmentId } from "../../auth/routerApiKeyAuth.js";
 import { publishableKeyRoutePrincipal, resolvePublishableKeyApiCredentialAuth, resolveWalletRegistrationContext } from "../../auth/routerApiCredentialAuth.js";
@@ -21,13 +28,7 @@ import { resolveActiveRuntimePolicyScopeForEnvironment, resolveWalletSessionAdmi
 import { enforceRoutePolicy } from "../../framework/enforceRoutePolicy.js";
 import { parseRegistrationPreparedSessionSeal } from "./registrationSessionSeal.js";
 import { routeError, routeJson } from "../../framework/routeResponses.js";
-import { parsePasskeyCustodyEnvelopeRecord } from "../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
-import "../../../shared-ts/src/passkey-custody/index.js";
 import { computeWalletEcdsaKeyFactsInventoryChallengeDigestB64u } from "../../../shared-ts/src/utils/ecdsaKeyFactsInventory.js";
-import { deriveImplicitNearAccountIdFromEd25519PublicKey, parseImplicitNearAccountId } from "../../../shared-ts/src/utils/near.js";
-import { normalizeRegistrationSignerPlan, registrationSignerSetSelectionFromPlan } from "../../../shared-ts/src/utils/registrationSignerPlan.js";
-import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, computeAddAuthMethodIntentDigestB64u, computeAddSignerIntentDigestB64u, normalizeAddAuthMethodIntentCaller } from "../../../shared-ts/src/utils/registrationIntent.js";
-import { parseRouterAbTraceContextV1 } from "../../../shared-ts/src/utils/routerAbTraceContext.js";
 //#region src/router/domains/walletRegistration/walletRegistrationRoutes.ts
 function parseRegistrationTraceContext(headers) {
 	const parsed = parseRouterAbTraceContextV1(headers["x-seams-trace-id"] ?? headers["X-Seams-Trace-Id"]);
@@ -1573,6 +1574,8 @@ async function handleRouterApiWalletRegistrationSetup(input) {
 	if (!registrationContext) return routeError(500, "route_auth_not_configured", "Wallet registration context is not configured");
 	const request = parseWalletRegistrationSetupRequest(input.body);
 	if (!request.ok) return routeError(400, request.code, request.message);
+	const serverTiming = [];
+	const contextStartedAtMs = Date.now();
 	const context = await resolveWalletRegistrationContext({
 		registration: request.value,
 		environmentId: extractRouterApiEnvironmentId(input.headers) || void 0,
@@ -1585,11 +1588,13 @@ async function handleRouterApiWalletRegistrationSetup(input) {
 		route: input.route,
 		routeAuthNotConfiguredMessage: "Wallet registration setup requires API credential auth policy"
 	});
+	recordRegistrationServerTiming(serverTiming, "setup_context", contextStartedAtMs);
 	if (!context.ok) {
 		if (context.status === 401) return routeError(401, "unauthorized", `${context.code}: ${context.message}`);
 		if (context.status === 403) return routeError(403, "forbidden", `${context.code}: ${context.message}`);
 		return routeError(context.status, "internal", `${context.code}: ${context.message}`);
 	}
+	const policyStartedAtMs = Date.now();
 	const resolved = await enforceRoutePolicy({
 		headers: input.headers,
 		logger: input.logger,
@@ -1602,23 +1607,29 @@ async function handleRouterApiWalletRegistrationSetup(input) {
 		sourceIp: input.sourceIp,
 		resolvers: { apiCredentials: publishableKeyRoutePrincipal.bind(void 0, context.principal) }
 	});
+	recordRegistrationServerTiming(serverTiming, "setup_route_policy", policyStartedAtMs);
 	if (!resolved.ok) return routeJson(resolved.status, resolved.body);
 	const principal = context.principal;
-	if (input.services.registrationSetupRateLimit) try {
-		if (!(await input.services.registrationSetupRateLimit({
-			apiKeyId: principal.apiKeyId,
-			orgId: principal.orgId,
-			projectId: context.environment.projectId,
-			envId: context.environment.key,
-			sourceIp: input.sourceIp || "unknown"
-		})).allowed) return routeJson(429, {
-			ok: false,
-			code: "rate_limited",
-			message: "Too many registration attempts. Wait one minute and try again.",
-			retryAfterMs: 6e4
-		});
-	} catch {
-		return routeError(503, "internal", "Registration setup rate limit is unavailable");
+	if (input.services.registrationSetupRateLimit) {
+		const limitStartedAtMs = Date.now();
+		try {
+			const limit = await input.services.registrationSetupRateLimit({
+				apiKeyId: principal.apiKeyId,
+				orgId: principal.orgId,
+				projectId: context.environment.projectId,
+				envId: context.environment.key,
+				sourceIp: input.sourceIp || "unknown"
+			});
+			recordRegistrationServerTiming(serverTiming, "setup_rate_limit", limitStartedAtMs);
+			if (!limit.allowed) return routeJson(429, {
+				ok: false,
+				code: "rate_limited",
+				message: "Too many registration attempts. Wait one minute and try again.",
+				retryAfterMs: 6e4
+			});
+		} catch {
+			return routeError(503, "internal", "Registration setup rate limit is unavailable");
+		}
 	}
 	const runtimePolicyScope = {
 		orgId: principal.orgId,
@@ -1635,7 +1646,8 @@ async function handleRouterApiWalletRegistrationSetup(input) {
 		signer: session,
 		runtimePolicyScope,
 		signingRootId: `${runtimePolicyScope.projectId}:${runtimePolicyScope.envId}`,
-		signingRootVersion: runtimePolicyScope.signingRootVersion
+		signingRootVersion: runtimePolicyScope.signingRootVersion,
+		serverTiming
 	});
 }
 /**
@@ -1659,7 +1671,7 @@ async function handleRouterApiWalletRegistrationRespond(input) {
 		verifier: session,
 		...registrationUserAgentFromHeaders(input.headers) ? { userAgent: registrationUserAgentFromHeaders(input.headers) } : {}
 	}, traceContext.value ?? void 0, serverTiming, input.waitUntil);
-	return routeJson(result.ok ? 200 : result.code === "storage_unavailable" ? 503 : 400, result, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
+	return routeJson(result.ok ? 200 : result.code === "storage_unavailable" ? 503 : 400, result, { headers: registrationServerTimingHeaders(serverTiming) });
 }
 async function handleRouterApiWalletRegistrationNearAdmission(input) {
 	const traceContext = parseRegistrationTraceContext(input.headers);
@@ -1882,7 +1894,7 @@ async function handleRouterApiWalletRegistrationActivate(input) {
 	}, traceContext.value ?? void 0, serverTiming);
 	if (!result.ok) return routeJson(400, result);
 	if (!isEmailOtpWalletRegistrationActivateSuccessV2(result) && !isPasskeyWalletRegistrationActivateSuccessV2(result)) return routeError(500, "internal", "Wallet registration activation returned an invalid authority");
-	return routeJson(200, result, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
+	return routeJson(200, result, { headers: registrationServerTimingHeaders(serverTiming) });
 }
 /**
 * Commits a NEAR-only wallet or completes a mixed wallet's deferred signer.
@@ -1922,18 +1934,13 @@ async function handleRouterApiWalletRegistrationNearProvisioning(input) {
 			ok: false,
 			code: sealed.code,
 			message: sealed.message
-		}, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
+		}, { headers: registrationServerTimingHeaders(serverTiming) });
 		return routeJson(200, {
 			...result,
 			sessionSeal: sealed.value
-		}, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
+		}, { headers: registrationServerTimingHeaders(serverTiming) });
 	}
-	return routeJson(200, result, { headers: ecdsaGatewayServerTimingHeaders(serverTiming) });
-}
-function ecdsaGatewayServerTimingHeaders(serverTiming) {
-	if (serverTiming.length === 0) return void 0;
-	const header = serverTiming.map(([name, durationMs]) => `${name};dur=${Math.max(0, durationMs).toFixed(1)}`).join(", ");
-	return { "Server-Timing": header };
+	return routeJson(200, result, { headers: registrationServerTimingHeaders(serverTiming) });
 }
 async function handleRouterApiWalletAddSignerStart(input) {
 	if (!isPlainObject(input.body)) return routeError(400, "invalid_body", "JSON body required");

package/dist/esm/router/framework/registrationSetupDispatch.js

@@ -1,3 +1,4 @@
+import { recordRegistrationServerTiming, registrationServerTimingHeaders } from "../cloudflare/d1/registration/d1RegistrationSetupSupport.js";
 //#region src/router/framework/registrationSetupDispatch.ts
 /** A transient storage fault outlived its retries. The same request can succeed later. */
 const SETUP_STORAGE_UNAVAILABLE = {
@@ -9,17 +10,23 @@ const SETUP_INTERNAL_FAILURE = {
 	message: "Wallet registration setup failed"
 };
 async function dispatchWalletRegistrationSetup(context, input) {
+	const serverTiming = input.serverTiming ?? [];
+	const dispatchStartedAtMs = Date.now();
 	const forwarded = await context.dispatcher?.dispatch(input);
 	if (forwarded) return forwarded;
+	recordRegistrationServerTiming(serverTiming, "setup_dispatch", dispatchStartedAtMs);
 	const result = await context.local.setupWalletRegistration(input);
+	const headers = registrationServerTimingHeaders(serverTiming);
 	if (result.ok) return {
 		status: 200,
-		body: result
+		body: result,
+		...headers ? { headers } : {}
 	};
 	const serverFailure = result.code === "storage_unavailable" ? SETUP_STORAGE_UNAVAILABLE : result.code === "internal" ? SETUP_INTERNAL_FAILURE : null;
 	if (!serverFailure) return {
 		status: 400,
-		body: result
+		body: result,
+		...headers ? { headers } : {}
 	};
 	console.error("[wallet-registration] setup failed", {
 		code: result.code,
@@ -31,7 +38,8 @@ async function dispatchWalletRegistrationSetup(context, input) {
 			ok: false,
 			code: result.code,
 			message: serverFailure.message
-		}
+		},
+		...headers ? { headers } : {}
 	};
 }
 //#endregion

package/dist/esm/router/framework/routeResponses.js

@@ -14,10 +14,6 @@ function routeError(status, code, message) {
 		message
 	});
 }
-function sendExpressRouteResponse(res, response) {
-	for (const [name, value] of Object.entries(response.headers || {})) res.set(name, value);
-	res.status(response.status).json(response.body);
-}
 function toFetchRouteResponse(response) {
 	return new Response(JSON.stringify(response.body), {
 		status: response.status,
@@ -28,6 +24,6 @@ function toFetchRouteResponse(response) {
 	});
 }
 //#endregion
-export { routeError, routeJson, sendExpressRouteResponse, toFetchRouteResponse };
+export { routeError, routeJson, toFetchRouteResponse };
 
 //# sourceMappingURL=routeResponses.js.map

package/dist/esm/router/transport/fetch/routes/deviceLinkingOwnerAuthorization.js

@@ -4,9 +4,9 @@ import { sha256DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimi
 import { buildEmailOtpWalletAuthAuthority, buildPasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseLinkedDeviceOwnerAuthorizationRequestV1 } from "../../../../shared-ts/src/device-linking/parsers.js";
 import { buildWalletSessionCapabilitySubjectsV1, walletSessionCapabilitySubjectsV1Equal } from "../../../../authorization/domain.js";
+import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
 import { json, jsonFailure, readJson } from "../../../framework/http.js";
-import { thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 //#region src/router/transport/fetch/routes/deviceLinkingOwnerAuthorization.ts
 const LINKED_DEVICE_OWNER_AUTHORIZATION_PATH_V1 = "/wallet/device-linking/v1/owner-authorization";
 /**

package/dist/esm/router/transport/fetch/routes/passkeyCustody.js

@@ -10,10 +10,10 @@ import { buildPasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../.
 import { parseSessionOrigin, parseVerifiedOwnerProofId } from "../../../../authorization/domain.js";
 import { buildVerifiedWalletOperationEmailOtpFactorResult, buildVerifiedWalletOperationPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
 import { findRouteDefinitionById, matchesRouteDefinitionRequest } from "../../../framework/routeDefinitions.js";
-import { extractBearerCredential, resolveSourceIpFromFetchHeaders } from "../../../auth/routerApiKeyAuth.js";
-import { toFetchRouteResponse } from "../../../framework/routeResponses.js";
 import { parsePasskeyCustodyEnvelopeRecord } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
+import { extractBearerCredential, resolveSourceIpFromFetchHeaders } from "../../../auth/routerApiKeyAuth.js";
+import { toFetchRouteResponse } from "../../../framework/routeResponses.js";
 import { readJson } from "../../../framework/http.js";
 import { isHostWithinRpId, originHostnameOrEmpty } from "../../../../core/authService/webauthnOidcHelpers.js";
 import { parseRecoveryCodeReservationId } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";

package/dist/esm/router/transport/fetch/routes/thresholdEd25519.js

@@ -890,7 +890,34 @@ async function proxyEd25519OwnerLaneExecution(input) {
 	});
 }
 async function handleRouterAbEd25519NormalSigningRoute(input) {
-	const authorization = await authorizeRouterAbEd25519NormalSigningRoute({
+	const startedAt = performance.now();
+	const timing = {
+		authorize: null,
+		admit: null,
+		proxy: null,
+		complete: null,
+		total: null
+	};
+	const response = await executeRouterAbEd25519NormalSigningRoute(input, timing);
+	timing.total = performance.now() - startedAt;
+	const headers = new Headers(response.headers);
+	for (const [stage, duration] of Object.entries(timing)) if (duration !== null) headers.append("Server-Timing", `ed25519_sign_${stage};dur=${Math.max(0, duration).toFixed(1)}`);
+	return new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers
+	});
+}
+async function timeEd25519SigningStage(timing, stage, pending) {
+	const startedAt = performance.now();
+	try {
+		return await pending;
+	} finally {
+		timing[stage] = performance.now() - startedAt;
+	}
+}
+async function executeRouterAbEd25519NormalSigningRoute(input, timing) {
+	const authorization = await timeEd25519SigningStage(timing, "authorize", authorizeRouterAbEd25519NormalSigningRoute({
 		body: input.body,
 		rawBody: input.body,
 		headers: Object.fromEntries(input.ctx.request.headers.entries()),
@@ -900,7 +927,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 		admissionAdapter: input.ctx.opts.routerAbNormalSigningAdmission,
 		resolveEd25519MaterialActivation: input.ctx.service.walletRegistration.resolveEd25519MaterialActivation.bind(input.ctx.service.walletRegistration),
 		phase: input.phase
-	});
+	}));
 	if (!authorization.ok) return json(authorization.result.body, { status: authorization.result.status });
 	if (authorization.kind === "operation_step_up") {
 		if (input.phase === "prepare") {
@@ -910,7 +937,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 				operation: authorization.operation
 			});
 			if (execution.kind !== "execute") return execution.response;
-			const upstream = await proxyEd25519OwnerLaneExecution({
+			const upstream = await timeEd25519SigningStage(timing, "proxy", proxyEd25519OwnerLaneExecution({
 				ctx: input.ctx,
 				authorization,
 				authorizedOperation: execution.operation,
@@ -921,7 +948,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 						binding: await ed25519OperationStepUpBinding(input.ctx, authorization.session, execution.operation)
 					})
 				}
-			});
+			}));
 			const upstreamBodyText = await upstream.clone().text().catch(() => "");
 			let upstreamBody = null;
 			try {
@@ -933,7 +960,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 				status: upstream.status,
 				bodyText: upstreamBodyText
 			})) return upstream;
-			if (!upstream.ok || !isPlainObject(upstreamBody)) return requireCompletedEd25519OperationResponse(await completeEd25519Operation({
+			if (!upstream.ok || !isPlainObject(upstreamBody)) return requireCompletedEd25519OperationResponse(await timeEd25519SigningStage(timing, "complete", completeEd25519Operation({
 				ctx: input.ctx,
 				operation: execution.operation,
 				result: upstream.status < 500 ? "failed_before_side_effect" : "failed_after_side_effect",
@@ -941,7 +968,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 					response: upstream,
 					bodyText: upstreamBodyText
 				})
-			}));
+			})));
 			const headers = new Headers(upstream.headers);
 			headers.delete("content-length");
 			return new Response(JSON.stringify(signingPrepareSessionResponse({
@@ -954,15 +981,15 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 			});
 		}
 		if (authorization.phase !== "finalize") throw new Error("Operation step-up finalize authorization phase changed");
-		const validatedAuthorization = await validateEd25519VerifiedStepUpAuthorizedOperation({
+		const validatedAuthorization = await timeEd25519SigningStage(timing, "admit", validateEd25519VerifiedStepUpAuthorizedOperation({
 			ctx: input.ctx,
 			body: input.body,
 			authorization
-		});
+		}));
 		if (!validatedAuthorization.ok) return validatedAuthorization.response;
 		const replay = replayCompletedEd25519Operation(validatedAuthorization.operation);
 		if (replay) return replay;
-		const upstream = await proxyEd25519OwnerLaneExecution({
+		const upstream = await timeEd25519SigningStage(timing, "proxy", proxyEd25519OwnerLaneExecution({
 			ctx: input.ctx,
 			authorization,
 			authorizedOperation: validatedAuthorization.operation,
@@ -973,13 +1000,13 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 					binding: await ed25519OperationStepUpBinding(input.ctx, authorization.session, validatedAuthorization.operation)
 				})
 			}
-		});
+		}));
 		const upstreamBodyText = await upstream.clone().text().catch(() => "");
 		if (isRouterAbEd25519OperationInProgressResponse({
 			status: upstream.status,
 			bodyText: upstreamBodyText
 		})) return upstream;
-		return requireCompletedEd25519OperationResponse(await completeEd25519Operation({
+		return requireCompletedEd25519OperationResponse(await timeEd25519SigningStage(timing, "complete", completeEd25519Operation({
 			ctx: input.ctx,
 			operation: validatedAuthorization.operation,
 			result: upstream.ok ? "succeeded" : upstream.status < 500 ? "failed_before_side_effect" : "failed_after_side_effect",
@@ -987,14 +1014,14 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 				response: upstream,
 				bodyText: upstreamBodyText
 			})
-		}));
+		})));
 	}
 	if (input.phase === "prepare") {
-		const authorized = await authorizeEd25519ReusableWalletSessionOperation({
+		const authorized = await timeEd25519SigningStage(timing, "admit", authorizeEd25519ReusableWalletSessionOperation({
 			ctx: input.ctx,
 			body: input.body,
 			authorization
-		});
+		}));
 		if (!authorized.ok) return authorized.response;
 		const execution = decideEd25519NormalSigningExecution({
 			phase: "prepare",
@@ -1016,7 +1043,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 				}
 			}
 		}, { status: 403 });
-		const upstream = await proxyEd25519OwnerLaneExecution({
+		const upstream = await timeEd25519SigningStage(timing, "proxy", proxyEd25519OwnerLaneExecution({
 			ctx: input.ctx,
 			authorization,
 			authorizedOperation: execution.operation,
@@ -1027,7 +1054,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 					binding: buildEd25519GatewayOwnerWalletSessionBinding(authorization, pinnedEd25519WalletScope(authorization, authorized.admission.ownerScope))
 				})
 			}
-		});
+		}));
 		const upstreamBodyText = await upstream.clone().text().catch(() => "");
 		let upstreamBody = null;
 		try {
@@ -1039,7 +1066,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 			status: upstream.status,
 			bodyText: upstreamBodyText
 		})) return upstream;
-		if (!upstream.ok || !isPlainObject(upstreamBody)) return requireCompletedEd25519OperationResponse(await completeEd25519Operation({
+		if (!upstream.ok || !isPlainObject(upstreamBody)) return requireCompletedEd25519OperationResponse(await timeEd25519SigningStage(timing, "complete", completeEd25519Operation({
 			ctx: input.ctx,
 			operation: execution.operation,
 			result: upstream.status < 500 ? "failed_before_side_effect" : "failed_after_side_effect",
@@ -1047,7 +1074,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 				response: upstream,
 				bodyText: upstreamBodyText
 			})
-		}));
+		})));
 		const headers = new Headers(upstream.headers);
 		headers.delete("content-length");
 		return new Response(JSON.stringify(signingPrepareSessionResponse({
@@ -1059,16 +1086,16 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 			headers
 		});
 	}
-	const validatedAuthorization = await validateEd25519ReusableAuthorizedOperation({
+	const validatedAuthorization = await timeEd25519SigningStage(timing, "admit", validateEd25519ReusableAuthorizedOperation({
 		ctx: input.ctx,
 		body: input.body,
 		authorization
-	});
+	}));
 	if (!validatedAuthorization.ok) return validatedAuthorization.response;
 	const replay = replayCompletedEd25519Operation(validatedAuthorization.operation);
 	if (replay) return replay;
 	if (!validatedAuthorization.ownerScope) throw new Error("Pinned owner Wallet Session scope is unavailable");
-	const upstream = await proxyEd25519OwnerLaneExecution({
+	const upstream = await timeEd25519SigningStage(timing, "proxy", proxyEd25519OwnerLaneExecution({
 		ctx: input.ctx,
 		authorization,
 		authorizedOperation: validatedAuthorization.operation,
@@ -1079,13 +1106,13 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 				binding: buildEd25519GatewayOwnerWalletSessionBinding(authorization, pinnedEd25519WalletScope(authorization, validatedAuthorization.ownerScope))
 			})
 		}
-	});
+	}));
 	const upstreamBodyText = await upstream.clone().text().catch(() => "");
 	if (isRouterAbEd25519OperationInProgressResponse({
 		status: upstream.status,
 		bodyText: upstreamBodyText
 	})) return upstream;
-	return requireCompletedEd25519OperationResponse(await completeEd25519Operation({
+	return requireCompletedEd25519OperationResponse(await timeEd25519SigningStage(timing, "complete", completeEd25519Operation({
 		ctx: input.ctx,
 		operation: validatedAuthorization.operation,
 		result: upstream.ok ? "succeeded" : upstream.status < 500 ? "failed_before_side_effect" : "failed_after_side_effect",
@@ -1093,7 +1120,7 @@ async function handleRouterAbEd25519NormalSigningRoute(input) {
 			response: upstream,
 			bodyText: upstreamBodyText
 		})
-	}));
+	})));
 }
 async function handleThresholdEd25519(ctx) {
 	if (ctx.method === "GET" && ctx.pathname === "/router-ab/ed25519/healthz") {

package/dist/esm/shared-ts/src/utils/validation.js

@@ -44,7 +44,11 @@ function requireArray(value, label) {
 	if (!Array.isArray(value)) throw new Error(`${label} must be an array`);
 	return value;
 }
+function assertString(val, name = "value") {
+	if (typeof val !== "string") throw new Error(`Invalid ${name}: expected string`);
+	return val;
+}
 //#endregion
-export { asRecord, coerceNonEmptyString, isFunction, isObject, isPlainObject, requireArray, requireCanonicalString, requireNonEmptyString, requireRecord, requireRecordCopy, requireRecordOrArray, requireTrimmedString };
+export { asRecord, assertString, coerceNonEmptyString, isFunction, isObject, isPlainObject, requireArray, requireCanonicalString, requireNonEmptyString, requireRecord, requireRecordCopy, requireRecordOrArray, requireTrimmedString };
 
 //# sourceMappingURL=validation.js.map

package/dist/esm/threshold/session/signingSessionSeal/guards/backends.js

@@ -1,6 +1,5 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import { createInMemorySigningSessionSealRateLimiter } from "./index.js";
-import { RedisTcpClient, UpstashRedisRestClient } from "../../../../core/ThresholdService/kv.js";
+import { UpstashRedisRestClient } from "../../../../core/ThresholdService/kv.js";
 //#region src/threshold/session/signingSessionSeal/guards/backends.ts
 const WINDOW_COUNTER_LUA = `
 local key = KEYS[1]
@@ -87,105 +86,10 @@ var UpstashSigningSessionSealRateLimiter = class {
 		}
 	}
 };
-function redisRespToString(resp) {
-	if (resp.type === "error") return null;
-	if (resp.type === "bulk") return typeof resp.value === "string" ? resp.value : null;
-	if (resp.type === "integer") return String(resp.value);
-	if (resp.type === "simple") return resp.value;
-	return null;
-}
-var RedisTcpSigningSessionSealRateLimiter = class {
-	constructor(input) {
-		this.client = new RedisTcpClient(input.redisUrl);
-		this.keyPrefix = normalizeOptionalTrimmedString(input.keyPrefix);
-	}
-	withPrefix(key) {
-		return this.keyPrefix ? `${this.keyPrefix}${key}` : key;
-	}
-	async consume(input) {
-		const key = this.withPrefix(normalizeOptionalTrimmedString(input.key));
-		if (!key) return {
-			ok: false,
-			code: "invalid_rate_limit_key",
-			message: "Rate-limit key is required"
-		};
-		try {
-			const resp = await this.client.send([
-				"EVAL",
-				WINDOW_COUNTER_LUA,
-				"1",
-				key,
-				String(Math.max(1, Math.floor(Number(input.windowMs) || 0)))
-			]);
-			if (resp.type === "error") return {
-				ok: false,
-				code: "internal",
-				message: `Redis EVAL error: ${resp.value}`
-			};
-			const parsed = parseCounterWindow(redisRespToString(resp));
-			if (!parsed) return {
-				ok: false,
-				code: "internal",
-				message: "Invalid Redis rate-limit response"
-			};
-			return finalizeConsume({
-				count: parsed.count,
-				ttlMs: parsed.ttlMs,
-				limit: Math.max(1, Math.floor(Number(input.limit) || 0)),
-				nowMs: Math.floor(Number(input.nowMs) || 0)
-			});
-		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: error instanceof Error ? error.message : String(error || "Redis rate-limit failed")
-			};
-		}
-	}
-};
 function createUpstashSigningSessionSealRateLimiter(options) {
 	return new UpstashSigningSessionSealRateLimiter(options);
 }
-function createRedisTcpSigningSessionSealRateLimiter(options) {
-	return new RedisTcpSigningSessionSealRateLimiter(options);
-}
-function resolveSigningSessionSealRateLimitFromEnv(input) {
-	const limiterKind = normalizeOptionalTrimmedString(input.limiterKind || "").toLowerCase();
-	const upstashUrl = normalizeOptionalTrimmedString(input.upstashUrl || "");
-	const upstashToken = normalizeOptionalTrimmedString(input.upstashToken || "");
-	const redisUrl = normalizeOptionalTrimmedString(input.redisUrl || "");
-	const keyPrefix = normalizeOptionalTrimmedString(input.keyPrefix || "") || void 0;
-	const selectedKind = limiterKind || (upstashUrl || upstashToken ? "upstash-redis-rest" : redisUrl ? "redis-tcp" : "in-memory");
-	if (selectedKind === "upstash-redis-rest") {
-		if (!upstashUrl || !upstashToken) throw new Error("Upstash Signing-session seal rate limiter requires both upstashUrl and upstashToken");
-		return {
-			limiter: createUpstashSigningSessionSealRateLimiter({
-				url: upstashUrl,
-				token: upstashToken,
-				keyPrefix
-			}),
-			limit: input.limit,
-			windowMs: input.windowMs
-		};
-	}
-	if (selectedKind === "redis-tcp") {
-		if (!redisUrl) throw new Error("Redis TCP Signing-session seal rate limiter requires redisUrl");
-		return {
-			limiter: createRedisTcpSigningSessionSealRateLimiter({
-				redisUrl,
-				keyPrefix
-			}),
-			limit: input.limit,
-			windowMs: input.windowMs
-		};
-	}
-	return {
-		limiter: createInMemorySigningSessionSealRateLimiter(),
-		limit: input.limit,
-		windowMs: input.windowMs
-	};
-}
 //#endregion
-export { createRedisTcpSigningSessionSealRateLimiter, createUpstashSigningSessionSealRateLimiter, resolveSigningSessionSealRateLimitFromEnv };
+export { createUpstashSigningSessionSealRateLimiter };
 
 //# sourceMappingURL=backends.js.map