@seams/wallet-server 0.10.2 → 0.12.0

package/dist/esm/threshold/session/signingSessionSeal/idempotencyBackends.js

@@ -1,6 +1,5 @@
 import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
-import { RedisTcpClient, UpstashRedisRestClient, redisDel, redisGetJson, redisSetJson } from "../../../core/ThresholdService/kv.js";
-import { createInMemorySigningSessionSealIdempotencyStore } from "./idempotency.js";
+import { UpstashRedisRestClient } from "../../../core/ThresholdService/kv.js";
 import { parseCurrentSigningSessionSealIdempotencyResultRecord, parseCurrentSigningSessionSealIdempotencyStoredEntry } from "./idempotencyRecords.js";
 //#region src/threshold/session/signingSessionSeal/idempotencyBackends.ts
 const DEFAULT_KEY_PREFIX = "threshold:signing-session-seal:idempotency:";
@@ -55,76 +54,10 @@ var UpstashSigningSessionSealIdempotencyStore = class {
 		}, ttlMs);
 	}
 };
-var RedisTcpSigningSessionSealIdempotencyStore = class {
-	constructor(options) {
-		this.client = new RedisTcpClient(options.redisUrl);
-		this.keyPrefix = normalizeOptionalTrimmedString(options.keyPrefix) || DEFAULT_KEY_PREFIX;
-		this.nowMs = options.nowMs || Date.now;
-	}
-	async get(input) {
-		const key = prefixedKey(this.keyPrefix, input.key);
-		if (!key) return null;
-		const entry = parseCurrentSigningSessionSealIdempotencyStoredEntry(await redisGetJson(this.client, key));
-		if (!entry) return null;
-		if (entry.expiresAtMs <= input.nowMs) {
-			try {
-				await redisDel(this.client, key);
-			} catch {}
-			return null;
-		}
-		return entry.result;
-	}
-	async set(input) {
-		const key = prefixedKey(this.keyPrefix, input.key);
-		if (!key) return;
-		const expiresAtMs = toPositiveInt(input.expiresAtMs);
-		if (expiresAtMs === void 0) return;
-		const normalizedResult = parseCurrentSigningSessionSealIdempotencyResultRecord(input.result);
-		if (!normalizedResult) return;
-		const ttlMs = ttlMsUntilExpiry(expiresAtMs, this.nowMs());
-		if (ttlMs <= 0) return;
-		await redisSetJson(this.client, key, {
-			result: normalizedResult,
-			expiresAtMs
-		}, ttlMs);
-	}
-};
 function createUpstashSigningSessionSealIdempotencyStore(options) {
 	return new UpstashSigningSessionSealIdempotencyStore(options);
 }
-function createRedisTcpSigningSessionSealIdempotencyStore(options) {
-	return new RedisTcpSigningSessionSealIdempotencyStore(options);
-}
-function resolveSigningSessionSealIdempotencyFromEnv(input) {
-	const idempotencyKind = normalizeOptionalTrimmedString(input.idempotencyKind || "").toLowerCase();
-	const upstashUrl = normalizeOptionalTrimmedString(input.upstashUrl || "");
-	const upstashToken = normalizeOptionalTrimmedString(input.upstashToken || "");
-	const redisUrl = normalizeOptionalTrimmedString(input.redisUrl || "");
-	const keyPrefix = normalizeOptionalTrimmedString(input.keyPrefix || "") || DEFAULT_KEY_PREFIX;
-	const ttlMs = toPositiveInt(input.ttlMs);
-	const selectedKind = idempotencyKind || (upstashUrl || upstashToken ? "upstash-redis-rest" : redisUrl ? "redis-tcp" : "in-memory");
-	let store;
-	if (selectedKind === "upstash-redis-rest") {
-		if (!upstashUrl || !upstashToken) throw new Error("Upstash signing session-seal idempotency requires both upstashUrl and upstashToken");
-		store = createUpstashSigningSessionSealIdempotencyStore({
-			url: upstashUrl,
-			token: upstashToken,
-			keyPrefix
-		});
-	} else if (selectedKind === "redis-tcp") {
-		if (!redisUrl) throw new Error("Redis TCP signing session-seal idempotency requires redisUrl");
-		store = createRedisTcpSigningSessionSealIdempotencyStore({
-			redisUrl,
-			keyPrefix
-		});
-	} else if (selectedKind === "in-memory") store = createInMemorySigningSessionSealIdempotencyStore();
-	else throw new Error(`Unsupported signing session-seal idempotency kind "${selectedKind}". Expected in-memory, upstash-redis-rest, or redis-tcp.`);
-	return {
-		store,
-		...ttlMs ? { ttlMs } : {}
-	};
-}
 //#endregion
-export { createRedisTcpSigningSessionSealIdempotencyStore, createUpstashSigningSessionSealIdempotencyStore, resolveSigningSessionSealIdempotencyFromEnv };
+export { createUpstashSigningSessionSealIdempotencyStore };
 
 //# sourceMappingURL=idempotencyBackends.js.map

package/dist/esm/threshold/session/signingSessionSeal/index.js

@@ -7,7 +7,6 @@ import { createSigningSessionSealService } from "./service.js";
 import { createSigningSessionSealRoutesOptions } from "./routesOptions.js";
 import { createSigningSessionSealOptions, parseSigningSessionSealRootConfig } from "./options.js";
 import { createInMemorySigningSessionSealIdempotencyStore } from "./idempotency.js";
-import { createRedisTcpSigningSessionSealRateLimiter, createUpstashSigningSessionSealRateLimiter, resolveSigningSessionSealRateLimitFromEnv } from "./guards/backends.js";
-import { createRedisTcpSigningSessionSealIdempotencyStore, createUpstashSigningSessionSealIdempotencyStore, resolveSigningSessionSealIdempotencyFromEnv } from "./idempotencyBackends.js";
-import { registerSigningSessionSealRoutes } from "./transport/express.js";
-export { authorizeSigningSessionSealRequest, buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, composeSigningSessionSealGuards, createInMemorySigningSessionSealIdempotencyStore, createInMemorySigningSessionSealRateLimiter, createPassthroughSigningSessionSealCipherAdapter, createRedisTcpSigningSessionSealIdempotencyStore, createRedisTcpSigningSessionSealRateLimiter, createSigningSessionSealAuditLogger, createSigningSessionSealCipherAdapter, createSigningSessionSealOptions, createSigningSessionSealRateLimitGuard, createSigningSessionSealRoutesOptions, createSigningSessionSealService, createSigningSessionSealShamir3PassCipherAdapter, createUpstashSigningSessionSealIdempotencyStore, createUpstashSigningSessionSealRateLimiter, encodeSigningSessionSealServerLockContext, handleSigningSessionSealRoutes, parseSigningSessionSealApplyBody, parseSigningSessionSealRemoveBody, parseSigningSessionSealRootConfig, registerSigningSessionSealRoutes, resolveSigningSessionSealBasePath, resolveSigningSessionSealIdempotencyFromEnv, resolveSigningSessionSealRateLimitFromEnv, signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode };
+import { createUpstashSigningSessionSealRateLimiter } from "./guards/backends.js";
+import { createUpstashSigningSessionSealIdempotencyStore } from "./idempotencyBackends.js";
+export { authorizeSigningSessionSealRequest, buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, composeSigningSessionSealGuards, createInMemorySigningSessionSealIdempotencyStore, createInMemorySigningSessionSealRateLimiter, createPassthroughSigningSessionSealCipherAdapter, createSigningSessionSealAuditLogger, createSigningSessionSealCipherAdapter, createSigningSessionSealOptions, createSigningSessionSealRateLimitGuard, createSigningSessionSealRoutesOptions, createSigningSessionSealService, createSigningSessionSealShamir3PassCipherAdapter, createUpstashSigningSessionSealIdempotencyStore, createUpstashSigningSessionSealRateLimiter, encodeSigningSessionSealServerLockContext, handleSigningSessionSealRoutes, parseSigningSessionSealApplyBody, parseSigningSessionSealRemoveBody, parseSigningSessionSealRootConfig, resolveSigningSessionSealBasePath, signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode };

package/dist/types/wallet-server/src/cloud-host.d.ts

@@ -6,6 +6,7 @@ export * from './core/logger';
 export * from './core/routerAbSigning/RouterAbEcdsaPresignRuntime';
 export * from './core/types';
 export * from './delegateAction';
+export { LocalRegistrationSetupAuthority } from './localRegistrationSetupAuthority';
 export * from './router/framework/apiCredentialPorts';
 export { createWalletRegistrationContextResolver, unavailableRegistrationContext, walletRegistrationContext, } from './router/auth/walletRegistrationContext';
 export { parseWalletRegistrationSetupRequest } from './router/domains/walletRegistration/walletRegistrationRoutes';

package/dist/types/wallet-server/src/core/ThresholdService/kv.d.ts

@@ -13,33 +13,4 @@ export declare class UpstashRedisRestClient {
     setJson(key: string, value: unknown, ttlMs?: number): Promise<void>;
     eval(script: string, keys: string[], args: string[]): Promise<unknown | null>;
 }
-export type RedisResp = {
-    type: 'simple';
-    value: string;
-} | {
-    type: 'error';
-    value: string;
-} | {
-    type: 'integer';
-    value: number;
-} | {
-    type: 'bulk';
-    value: string | null;
-};
-export declare class RedisTcpClient {
-    private readonly url;
-    private socket;
-    private buffer;
-    private pending;
-    private connecting;
-    constructor(redisUrl: string);
-    private ensureConnected;
-    private connect;
-    private drain;
-    private failAll;
-    send(args: string[]): Promise<RedisResp>;
-}
-export declare function redisGetJson(client: RedisTcpClient, key: string): Promise<unknown | null>;
-export declare function redisDel(client: RedisTcpClient, key: string): Promise<void>;
-export declare function redisSetJson(client: RedisTcpClient, key: string, value: unknown, ttlMs?: number): Promise<void>;
 //# sourceMappingURL=kv.d.ts.map

package/dist/types/wallet-server/src/localHostedWalletGatewayHandler.d.ts

@@ -6,7 +6,7 @@ export type LocalHostedWalletGatewayEnv = CloudflareD1GatewayBaseEnv & {
 /**
  * The local Gateway: the hosted Gateway handler plus the intended-suite
  * transport faults, which a request arms with local-only headers. The local
- * Worker and the local Node host both serve through this.
+ * Worker serves through this handler.
  */
 export declare function handleLocalHostedWalletGatewayRequestV1(request: Request, env: LocalHostedWalletGatewayEnv, ctx: CfExecutionContext, dependencies?: HostedWalletGatewayDependenciesV1): Promise<Response>;
 //# sourceMappingURL=localHostedWalletGatewayHandler.d.ts.map

package/dist/types/wallet-server/src/localIntendedYaoFault.d.ts

@@ -5,9 +5,13 @@ export declare const LOCAL_INTENDED_YAO_FAULT_TOKEN_HEADER_V1 = "x-seams-intende
  *   execute, and expects the Gateway to send the identical request again.
  * - `return_terminal_burned_once` has the Router end the first execute
  *   burned, and expects the Gateway to answer that failure without retrying.
+ * - `answer_retryable_while_running_once` lets the Router keep running the
+ *   first execute, and answers the Gateway at once that it failed
+ *   recoverably, as a Deriver that refused a late preparation does. The
+ *   Router's claim stays held until that run records its answer.
  */
-type LocalIntendedYaoFaultModeV1 = 'drop_router_response_once' | 'return_terminal_burned_once';
-type LocalIntendedYaoFaultProofV1 = 'exact_request_replayed' | 'terminal_failure_not_retried';
+type LocalIntendedYaoFaultModeV1 = 'drop_router_response_once' | 'return_terminal_burned_once' | 'answer_retryable_while_running_once';
+type LocalIntendedYaoFaultProofV1 = 'exact_request_replayed' | 'terminal_failure_not_retried' | 'execution_left_running';
 type LocalIntendedYaoFaultViolationV1 = 'fault_already_armed' | 'router_execute_not_observed' | 'router_first_response_failed' | 'router_retry_not_observed' | 'router_retry_body_changed' | 'router_retry_trace_changed' | 'router_retry_marked_as_replay' | 'router_retry_response_failed' | 'router_terminal_not_recorded' | 'unexpected_additional_execute';
 type LocalIntendedYaoFaultOutcomeV1 = {
     readonly kind: 'proved';
@@ -22,10 +26,16 @@ type LocalIntendedYaoFaultTokenV1 = {
 export declare function parseLocalIntendedYaoFaultModeV1(value: string | null): LocalIntendedYaoFaultModeV1 | null;
 export declare function parseLocalIntendedYaoFaultTokenV1(value: string | null): LocalIntendedYaoFaultTokenV1 | null;
 export declare function isLocalIntendedYaoFaultTokenV1(value: string | null): value is string;
+/** Reconstructs a local fault request from its persisted boundary value. */
+export declare function parseLocalIntendedKeptRouterRequestV1(value: unknown): Request;
 export declare class LocalIntendedYaoFaultControllerV1 {
     private readonly baseFetch;
+    /** Keeps a Router call alive after the Gateway answered without it. */
+    private readonly keepRunning;
     private state;
-    constructor(baseFetch: typeof globalThis.fetch);
+    constructor(baseFetch: typeof globalThis.fetch, 
+    /** Keeps a Router call alive after the Gateway answered without it. */
+    keepRunning: (running: Promise<unknown>) => void);
     arm(mode: LocalIntendedYaoFaultModeV1): void;
     fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
     consumeOutcome(): LocalIntendedYaoFaultOutcomeV1;

package/dist/types/wallet-server/src/localIntendedYaoRecoveryFault.d.ts

@@ -1,3 +1,4 @@
+import type { D1RegistrationCeremonyRecordStore } from './router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore';
 export declare const LOCAL_INTENDED_YAO_RECOVERY_FAULT_HEADER_V1 = "x-seams-intended-yao-recovery-fault-v1";
 export declare const LOCAL_INTENDED_YAO_RECOVERY_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-yao-recovery-fault-token-v1";
 /**
@@ -28,17 +29,18 @@ export declare class LocalIntendedYaoRecoveryFaultControllerV1 {
     private readonly baseFetch;
     private readonly mode;
     private readonly token;
+    private readonly storage;
     private executed;
     private failed;
     private kept;
-    constructor(baseFetch: typeof globalThis.fetch, mode: 'lose_router_recovery_replies' | 'withhold_router_recovery_execute', token: string);
+    constructor(baseFetch: typeof globalThis.fetch, mode: 'lose_router_recovery_replies' | 'withhold_router_recovery_execute', token: string, storage: D1RegistrationCeremonyRecordStore);
     fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
     outcome(): LocalIntendedYaoRecoveryFaultOutcomeV1;
 }
 /** Sends the execution kept under `token` to the Router, exactly. */
 export declare function releaseLocalIntendedYaoRecoveryExecuteV1(router: {
     fetch(request: Request): Promise<Response>;
-}, token: string): Promise<Response>;
+}, token: string, storage: D1RegistrationCeremonyRecordStore): Promise<Response>;
 export declare function requestWithoutLocalIntendedYaoRecoveryFaultHeadersV1(request: Request): Request;
 export declare function responseWithLocalIntendedYaoRecoveryFaultOutcomeV1(response: Response, outcome: LocalIntendedYaoRecoveryFaultOutcomeV1, token: string): Response;
 export {};

package/dist/types/wallet-server/src/localIntendedYaoSigningFault.d.ts

@@ -1,3 +1,4 @@
+import type { D1RegistrationCeremonyRecordStore } from './router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore';
 export declare const LOCAL_INTENDED_YAO_SIGNING_FAULT_HEADER_V1 = "x-seams-intended-yao-signing-fault-v1";
 export declare const LOCAL_INTENDED_YAO_SIGNING_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-yao-signing-fault-token-v1";
 export declare const ROUTER_AB_ED25519_SIGNING_FINALIZE_PATH_V1 = "/router-ab/ed25519/sign";
@@ -20,8 +21,9 @@ export declare class LocalIntendedYaoSigningFaultControllerV1 {
     private readonly baseFetch;
     private readonly mode;
     private readonly token;
+    private readonly storage;
     private kept;
-    constructor(baseFetch: typeof globalThis.fetch, mode: 'capture_signing_finalize' | 'withhold_signing_finalize', token: string);
+    constructor(baseFetch: typeof globalThis.fetch, mode: 'capture_signing_finalize' | 'withhold_signing_finalize', token: string, storage: D1RegistrationCeremonyRecordStore);
     fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
     private keep;
     outcome(): string;
@@ -29,7 +31,7 @@ export declare class LocalIntendedYaoSigningFaultControllerV1 {
 /** Sends the finalize kept under `token` to the Router again, exactly. */
 export declare function releaseLocalIntendedYaoSigningFinalizeV1(router: {
     fetch(request: Request): Promise<Response>;
-}, token: string): Promise<Response>;
+}, token: string, storage: D1RegistrationCeremonyRecordStore): Promise<Response>;
 export declare function requestWithoutLocalIntendedYaoSigningFaultHeadersV1(request: Request): Request;
 export declare function responseWithLocalIntendedYaoSigningFaultOutcomeV1(response: Response, outcome: string): Response;
 export {};

package/dist/types/wallet-server/src/router/auth/routerApiKeyAuth.d.ts

@@ -2,15 +2,7 @@ type HeaderBag = Headers | Record<string, unknown>;
 export declare function extractBearerCredential(headers: HeaderBag): string | null;
 export declare function normalizeSourceIp(raw: string | undefined): string | null;
 export declare function extractRouterApiEnvironmentId(headers: HeaderBag): string | null;
-export declare function resolveSourceIpFromExpressRequest(input: {
-    headers: Record<string, unknown>;
-    ip?: string | null;
-}): string | null;
 export declare function resolveSourceIpFromFetchHeaders(headers: HeaderBag): string | null;
-export declare function resolveRequestOriginRateLimitKeyFromExpressRequest(input: {
-    headers: Record<string, unknown>;
-    ip?: string | null;
-}): string;
 export declare function resolveRequestOriginRateLimitKeyFromFetchHeaders(headers: HeaderBag): string;
 export {};
 //# sourceMappingURL=routerApiKeyAuth.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecordStore.d.ts

@@ -40,6 +40,8 @@ export declare class D1RegistrationCeremonyRecordStore {
     constructor(options: D1RegistrationCeremonyRecordStoreOptions);
     get(scope: string, id: string): Promise<D1RegistrationCeremonyStoredRecord | null>;
     prepareGet(scope: string, id: string): D1PreparedStatementLike;
+    /** Load the ceremony's immutable founding identities and their current records together. */
+    prepareFoundingRecordsRead(id: string): D1PreparedStatementLike;
     parseGet(scope: string, id: string, row: StoredRow | null): Promise<D1RegistrationCeremonyStoredRecord | null>;
     putExact(mutation: D1RegistrationCeremonyRecordMutation): Promise<void>;
     insertOrRead(mutation: D1RegistrationCeremonyRecordMutation): Promise<D1RegistrationCeremonyStoredRecord>;

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.d.ts

@@ -32,6 +32,7 @@ export declare class CloudflareD1RegistrationCeremonyIntentStore {
     reserveSetupCeremony(proposed: StoredWalletRegistrationCeremony, ownershipGeneration: number): Promise<StoredWalletRegistrationCeremony>;
     getCeremony(registrationCeremonyId: string): Promise<StoredWalletRegistrationCeremony | null>;
     prepareCeremonyRead(registrationCeremonyId: string): D1PreparedStatementLike;
+    prepareFoundingRecordsRead(registrationCeremonyId: string): D1PreparedStatementLike;
     parseCeremonyRead(registrationCeremonyId: string, result: D1ResultLike<Record<string, unknown>>): Promise<StoredWalletRegistrationCeremony | null>;
     parseCeremonySnapshotRead(registrationCeremonyId: string, result: D1ResultLike<Record<string, unknown>>): Promise<D1WalletRegistrationEcdsaCeremonyClaimV1 | null>;
     getCeremonySnapshot(registrationCeremonyId: string): Promise<D1WalletRegistrationEcdsaCeremonyClaimV1 | null>;

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1RegistrationSetupSupport.d.ts

@@ -48,6 +48,8 @@ type RegistrationIntentSignerBranches = {
     readonly evmFamilyEcdsa: RegistrationEvmFamilyEcdsaSignerPlan | null;
 };
 export declare function recordRegistrationServerTiming(sink: Array<readonly [string, number]>, name: string, startedAtMs: number): void;
+/** The `Server-Timing` header of a registration route's recorded waits. */
+export declare function registrationServerTimingHeaders(serverTiming: readonly (readonly [string, number])[]): Record<string, string> | undefined;
 export declare function recordRegistrationPromiseTiming<T>(args: {
     readonly sink: Array<readonly [string, number]>;
     readonly name: string;

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.d.ts

@@ -2,6 +2,7 @@ import { type PasskeyCredentialClaims } from '../../../../core/passkeyCredential
 import type { ActiveWalletAuthorityV1 } from '../../../../../../shared-ts/src/authorization/walletAuthority';
 import { type ActiveWalletAuthMethodRecordV2 } from '../../../../../../shared-ts/src/utils/walletAuthMethodRecord';
 import { type RegistrationAuthority } from '../../../../../../shared-ts/src/utils/registrationAuthMethodInput';
+import type { Variant } from '../../../../../../shared-ts/src/utils/variant';
 import type { WalletRecord, WalletSignerRecord } from '../../../../core/WalletStore';
 import type { D1DatabaseLike, D1PreparedStatementLike, D1ResultLike } from '../../../../storage/tenantRoute';
 import type { D1EmailOtpRegistrationCommitPlan } from '../emailOtp/d1EmailOtpRegistrationEnrollmentFinalizer';
@@ -41,11 +42,11 @@ export type HeldRegistrationPasskeyClaim = {
 export interface D1WalletRegistrationCommitStore {
     /**
      * Claims the authority's passkey through shared authority, unless `held`
-     * records that the same claim was already granted for this ceremony. With
-     * `founding`, it also reads that authority and auth method as stored, beside
-     * the claim, so the commit writes them without a read of its own.
+     * records that the same claim was already granted for this ceremony. Uses
+     * the founding snapshot when supplied; otherwise reads the named records
+     * beside the claim. The returned commit performs no additional read.
      */
-    reserveAuthority(authority: RegistrationAuthority, held: HeldRegistrationPasskeyClaim | null, founding: FoundingRecordIds | null): Promise<ReservedWalletRegistrationCommit>;
+    reserveAuthority(authority: RegistrationAuthority, held: HeldRegistrationPasskeyClaim | null, founding: RegistrationFoundingRead | null): Promise<ReservedWalletRegistrationCommit>;
     /**
      * Claims a verified passkey before finalization and records a granted
      * claim. A refusal records nothing, so finalization claims again and
@@ -62,6 +63,25 @@ export interface D1WalletRegistrationCommitStore {
     deleteHeldPasskeyClaim(registrationCeremonyId: string): Promise<void>;
 }
 type FoundingRecordIds = Pick<D1WalletRegistrationOperationPreparedV1, 'walletAuthorityId' | 'walletAuthMethodId'>;
+export type RegistrationFoundingRead = {
+    readonly kind: 'read';
+    readonly ids: FoundingRecordIds;
+    readonly records?: never;
+} | {
+    readonly kind: 'snapshot';
+    readonly records: StoredFoundingRecords;
+    readonly ids?: never;
+};
+export type RegistrationFoundingSnapshot = Variant<RegistrationFoundingRead, 'kind', 'snapshot'>;
+export declare function parseRegistrationFoundingRead(result: D1ResultLike<Record<string, unknown>>): RegistrationFoundingSnapshot | null;
+/** A registration's founding authority and auth method rows from one database snapshot. */
+type StoredFoundingRecords = FoundingRecordIds & {
+    readonly authorityRow: D1RegistrationRecordJsonRow | null;
+    readonly authMethodRow: D1RegistrationRecordJsonRow | null;
+};
+type D1RegistrationRecordJsonRow = {
+    readonly record_json?: unknown;
+};
 export declare class CloudflareD1WalletRegistrationCommitStore implements D1WalletRegistrationCommitStore {
     private readonly database;
     private readonly scope;
@@ -74,7 +94,7 @@ export declare class CloudflareD1WalletRegistrationCommitStore implements D1Wall
         readonly projectId: string;
         readonly envId: string;
     });
-    reserveAuthority(authority: RegistrationAuthority, held: HeldRegistrationPasskeyClaim | null, founding: FoundingRecordIds | null): Promise<ReservedWalletRegistrationCommit>;
+    reserveAuthority(authority: RegistrationAuthority, held: HeldRegistrationPasskeyClaim | null, founding: RegistrationFoundingRead | null): Promise<ReservedWalletRegistrationCommit>;
     claimPasskeyAhead(input: {
         readonly registrationCeremonyId: string;
         readonly authority: RegistrationAuthority;

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationRead.d.ts

@@ -40,6 +40,21 @@ export declare class D1WalletRegistrationRead {
     } | {
         ok: true;
         operation: import("../../../cloudflare-adaptor").VersionedJsonRecordReadResult<D1WalletRegistrationNearProvisioningSideEffectRecord>;
+        readFounding: () => {
+            readonly kind: "snapshot";
+            readonly records: {
+                readonly walletAuthMethodId: import("../../../../../../shared-ts/src/utils").WalletAuthMethodId;
+                readonly walletAuthorityId: import("../../../../../../shared-ts/src/utils").WalletAuthorityId;
+            } & {
+                readonly authorityRow: {
+                    readonly record_json?: unknown;
+                } | null;
+                readonly authMethodRow: {
+                    readonly record_json?: unknown;
+                } | null;
+            };
+            readonly ids?: never;
+        } | null;
         decision: import("../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision").RouterAbEd25519YaoLifecycleDecisionV1 | null;
         heldPasskeyClaim: import("./d1WalletRegistrationCommitStore").HeldRegistrationPasskeyClaim | null;
         readCeremony: () => Promise<import("../../../../core/RegistrationCeremonyStore").StoredWalletRegistrationCeremony | null>;

package/dist/types/wallet-server/src/router/cloudflare-adaptor.d.ts

@@ -42,10 +42,8 @@ export type { CloudflareTenantStorageRoute, CloudflareTenantTopology, D1BindingN
 export { StaticCloudflareTenantStorageRouteResolver, createCloudflareTenantStorageRoute, createSignerD1DoStorageTarget, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, } from '../storage/tenantRoute';
 export type { InMemoryRouterApiRuntimeSnapshotConsumer, RouterApiRuntimeSnapshotPublishedUpdate, } from './framework/runtimeSnapshotConsumer';
 export { createInMemoryRouterApiRuntimeSnapshotConsumer, validateRuntimeSnapshotExpectation, } from './framework/runtimeSnapshotConsumer';
-export { extractBearerCredential, extractRouterApiEnvironmentId, resolveSourceIpFromExpressRequest, resolveSourceIpFromFetchHeaders, } from './auth/routerApiKeyAuth';
+export { extractBearerCredential, extractRouterApiEnvironmentId, resolveSourceIpFromFetchHeaders, } from './auth/routerApiKeyAuth';
 export { createCloudflareRouter } from './cloudflare/runtime/createCloudflareRouter';
-export type { SelfHostedCloudflareSigningWorkerFactoryInput } from './cloudflare/runtime/createSelfHostedCloudflareSigningWorker';
-export { createSelfHostedCloudflareSigningRouter, createSelfHostedCloudflareSigningWorker, } from './cloudflare/runtime/createSelfHostedCloudflareSigningWorker';
 export { CloudflareDurableObjectVersionedJsonRecordStore, CloudflareVersionedJsonRecordStoreError, createCloudflareDurableObjectVersionedJsonRecordStore, } from './cloudflare/durableObjects/versionedJsonRecordStore';
 export type { CloudflareVersionedJsonRecordStoreOptions } from './cloudflare/durableObjects/versionedJsonRecordStore';
 export type { VersionedJsonObject, VersionedJsonRecordPutResult, VersionedJsonRecordReadResult, VersionedJsonValue, } from './framework/versionedJsonRecordStore';

package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationInputs.d.ts

@@ -21,6 +21,8 @@ export type WalletRegistrationSetupInput = {
     readonly runtimePolicyScope?: ThresholdRuntimePolicyScope;
     readonly signingRootId?: string;
     readonly signingRootVersion?: string;
+    /** Collects the `[name, ms]` waits of this setup for its `Server-Timing` header. */
+    readonly serverTiming?: Array<readonly [string, number]>;
 };
 export type WalletRegistrationRespondInput = {
     readonly registrationCeremonyId: string;

package/dist/types/wallet-server/src/router/framework/routeResponses.d.ts

@@ -1,4 +1,3 @@
-import type { Response as ExpressResponse } from 'express';
 import type { RouteResponse } from './routeExecutionContext';
 import type { RoutePolicyFailureCode } from './routeAuthPolicy';
 import type { RouteUsageData } from './routeMeteringPolicy';
@@ -12,6 +11,5 @@ export declare function routeJson<TBody>(status: number, body: TBody, options?:
     usage?: RouteUsageData;
 }): RouteResponse<TBody>;
 export declare function routeError(status: number, code: RouteErrorBody['code'], message: string): RouteResponse<RouteErrorBody>;
-export declare function sendExpressRouteResponse<TBody>(res: ExpressResponse, response: RouteResponse<TBody>): void;
 export declare function toFetchRouteResponse<TBody>(response: RouteResponse<TBody>): Response;
 //# sourceMappingURL=routeResponses.d.ts.map

package/dist/types/wallet-server/src/threshold/session/signingSessionSeal/guards/backends.d.ts

@@ -1,23 +1,8 @@
-import type { CreateSigningSessionSealRateLimitGuardOptions, SigningSessionSealRateLimiter } from './index';
+import type { SigningSessionSealRateLimiter } from './index';
 export interface CreateUpstashSigningSessionSealRateLimiterOptions {
     url: string;
     token: string;
     keyPrefix?: string;
 }
-export interface CreateRedisTcpSigningSessionSealRateLimiterOptions {
-    redisUrl: string;
-    keyPrefix?: string;
-}
 export declare function createUpstashSigningSessionSealRateLimiter(options: CreateUpstashSigningSessionSealRateLimiterOptions): SigningSessionSealRateLimiter;
-export declare function createRedisTcpSigningSessionSealRateLimiter(options: CreateRedisTcpSigningSessionSealRateLimiterOptions): SigningSessionSealRateLimiter;
-export interface CreateSigningSessionSealRateLimitFromEnvInput {
-    limiterKind?: 'in-memory' | 'upstash-redis-rest' | 'redis-tcp' | null;
-    upstashUrl?: string | null;
-    upstashToken?: string | null;
-    redisUrl?: string | null;
-    keyPrefix?: string | null;
-    limit: number;
-    windowMs: number;
-}
-export declare function resolveSigningSessionSealRateLimitFromEnv(input: CreateSigningSessionSealRateLimitFromEnvInput): Pick<CreateSigningSessionSealRateLimitGuardOptions, 'limiter' | 'limit' | 'windowMs'>;
 //# sourceMappingURL=backends.d.ts.map

package/dist/types/wallet-server/src/threshold/session/signingSessionSeal/idempotencyBackends.d.ts

@@ -1,24 +1,9 @@
-import type { SigningSessionSealIdempotencyStore, SigningSessionSealServiceIdempotencyOptions } from './signingSessionSeal.types';
+import type { SigningSessionSealIdempotencyStore } from './signingSessionSeal.types';
 export interface CreateUpstashSigningSessionSealIdempotencyStoreOptions {
     url: string;
     token: string;
     keyPrefix?: string;
     nowMs?: () => number;
 }
-export interface CreateRedisTcpSigningSessionSealIdempotencyStoreOptions {
-    redisUrl: string;
-    keyPrefix?: string;
-    nowMs?: () => number;
-}
 export declare function createUpstashSigningSessionSealIdempotencyStore(options: CreateUpstashSigningSessionSealIdempotencyStoreOptions): SigningSessionSealIdempotencyStore;
-export declare function createRedisTcpSigningSessionSealIdempotencyStore(options: CreateRedisTcpSigningSessionSealIdempotencyStoreOptions): SigningSessionSealIdempotencyStore;
-export interface CreateSigningSessionSealIdempotencyFromEnvInput {
-    idempotencyKind?: string | null;
-    upstashUrl?: string | null;
-    upstashToken?: string | null;
-    redisUrl?: string | null;
-    keyPrefix?: string | null;
-    ttlMs?: number | null;
-}
-export declare function resolveSigningSessionSealIdempotencyFromEnv(input: CreateSigningSessionSealIdempotencyFromEnvInput): SigningSessionSealServiceIdempotencyOptions;
 //# sourceMappingURL=idempotencyBackends.d.ts.map

package/dist/types/wallet-server/src/threshold/session/signingSessionSeal/index.d.ts

@@ -4,9 +4,9 @@ export type { CreateSigningSessionSealAuditLoggerOptions } from './observability
 export type { CreateSigningSessionSealRoutesOptionsInput } from './routesOptions';
 export type { CreateSigningSessionSealOptionsInput } from './options';
 export type { CreateSigningSessionSealRateLimitGuardOptions, InMemorySigningSessionSealRateLimiterOptions, SigningSessionSealRateLimitConsumeInput, SigningSessionSealRateLimitConsumeResult, SigningSessionSealRateLimiter, SigningSessionSealRateLimitRejectedEvent, } from './guards';
-export type { CreateSigningSessionSealRateLimitFromEnvInput, CreateRedisTcpSigningSessionSealRateLimiterOptions, CreateUpstashSigningSessionSealRateLimiterOptions, } from './guards/backends';
-export type { CreateSigningSessionSealIdempotencyFromEnvInput, CreateRedisTcpSigningSessionSealIdempotencyStoreOptions, CreateUpstashSigningSessionSealIdempotencyStoreOptions, } from './idempotencyBackends';
-export { signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode } from './transport/shared';
+export type { CreateUpstashSigningSessionSealRateLimiterOptions, } from './guards/backends';
+export type { CreateUpstashSigningSessionSealIdempotencyStoreOptions, } from './idempotencyBackends';
+export { signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode, } from './transport/shared';
 export { buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, resolveSigningSessionSealBasePath, parseSigningSessionSealApplyBody, parseSigningSessionSealRemoveBody, authorizeSigningSessionSealRequest, } from './transport/shared';
 export { createSigningSessionSealCipherAdapter, createPassthroughSigningSessionSealCipherAdapter, createSigningSessionSealShamir3PassCipherAdapter, encodeSigningSessionSealServerLockContext, } from './crypto/cipher';
 export { createSigningSessionSealService } from './service';
@@ -15,9 +15,8 @@ export { createSigningSessionSealAuditLogger } from './observability/audit';
 export { createSigningSessionSealRoutesOptions } from './routesOptions';
 export { createSigningSessionSealOptions, parseSigningSessionSealRootConfig } from './options';
 export { createInMemorySigningSessionSealRateLimiter, createSigningSessionSealRateLimitGuard, } from './guards';
-export { createRedisTcpSigningSessionSealRateLimiter, createUpstashSigningSessionSealRateLimiter, resolveSigningSessionSealRateLimitFromEnv, } from './guards/backends';
-export { createRedisTcpSigningSessionSealIdempotencyStore, createUpstashSigningSessionSealIdempotencyStore, resolveSigningSessionSealIdempotencyFromEnv, } from './idempotencyBackends';
+export { createUpstashSigningSessionSealRateLimiter, } from './guards/backends';
+export { createUpstashSigningSessionSealIdempotencyStore, } from './idempotencyBackends';
 export { composeSigningSessionSealGuards } from './guards';
-export { registerSigningSessionSealRoutes } from './transport/express';
 export { handleSigningSessionSealRoutes } from './transport/fetch';
 //# sourceMappingURL=index.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seams/wallet-server",
-  "version": "0.10.2",
+  "version": "0.12.0",
   "type": "module",
   "description": "Seams server TypeScript SDK for NEAR and EVM-family wallets",
   "main": "./dist/esm/index.js",
@@ -19,11 +19,6 @@
       "import": "./dist/esm/index.js",
       "default": "./dist/esm/index.js"
     },
-    "./router/express": {
-      "types": "./dist/types/wallet-server/src/router/express-adaptor.d.ts",
-      "import": "./dist/esm/router/express.js",
-      "default": "./dist/esm/router/express.js"
-    },
     "./router/cloudflare": {
       "types": "./dist/types/wallet-server/src/router/cloudflare-adaptor.d.ts",
       "import": "./dist/esm/router/cloudflare.js",
@@ -120,12 +115,10 @@
   "homepage": "https://github.com/seams-tech/seams-wallet#readme",
   "dependencies": {
     "@simplewebauthn/server": "^13.2.2",
-    "bs58": "^6.0.0",
-    "express": "^4.21.2"
+    "bs58": "^6.0.0"
   },
   "devDependencies": {
     "@near-js/types": "^2.4.0",
-    "@types/express": "^4.17.21",
     "@types/node": "^20.19.9",
     "rolldown": "^1.0.0-beta.27",
     "typescript": "^5.8.3"

package/src/README.md

@@ -76,7 +76,7 @@ Use fresh wallets when measuring this change.
 It does not authorize wallet ownership.
 
 ```ts
-import { createRouterApiRouter } from '@seams/wallet-server/router/express';
+import { createCloudflareRouter } from '@seams/wallet-server/router/cloudflare';
 import { createSigningSessionSealOptions } from '@seams/wallet-server';
 
 const signingSessionSeal = createSigningSessionSealOptions({
@@ -85,10 +85,12 @@ const signingSessionSeal = createSigningSessionSealOptions({
   acceptedWarmKeyVersions: ['signing-session-seal-production-r2'],
 });
 
-app.use('/', createRouterApiRouter(service, {
+const fetch = createCloudflareRouter(service, {
   threshold,
   signingSessionSeal,
-}));
+});
+
+export default { fetch };
 ```
 
 Store the random 32-byte root secret in a secrets manager. Retain accepted old