@seams/wallet-server 0.11.0 → 0.13.0

package/dist/esm/router/cloudflare/d1/registration/walletRegistrationEstablishedSessionIssuer.js

@@ -49,9 +49,9 @@ function requireWalletSessionPrincipalId(value) {
 	if (!parsed.ok) throw new Error(`Wallet Session principal is invalid: ${parsed.error.message}`);
 	return parsed.value;
 }
-function publishCommittedRegistration(home, committed) {
-	if (!committed.registration) throw new Error("Registration publication requires a committed registration session");
-	return home.publishEstablished({
+function prepareCommittedRegistrationActivation(home, committed) {
+	if (!committed.registration) throw new Error("Registration activation requires a committed registration session");
+	return home.prepareEstablished({
 		registration: committed.registration,
 		session: committed.publication
 	});
@@ -346,13 +346,11 @@ async function issueDirectRegistrationEstablishedEcdsaSession(input) {
 		runtimePolicyScope: input.runtimePolicyScope,
 		keyHandle
 	});
-	const published = await publishCommittedRegistration(input.homeCompletion, committed);
-	if (!published.ok) throw new Error(published.message);
 	return directRegistrationResultFromIssue({
 		directIssue,
 		authorization,
 		tokens,
-		activation: published.activation
+		activation: prepareCommittedRegistrationActivation(input.homeCompletion, committed)
 	});
 }
 async function issueDirectRegistrationEstablishedEd25519Session(input) {
@@ -417,16 +415,13 @@ async function issueDirectRegistrationEstablishedEd25519Session(input) {
 		}).ed25519,
 		predecessor: input.predecessor
 	});
-	const [publication, preparation] = await Promise.allSettled([publishCommittedRegistration(input.homeCompletion, committed), input.onSessionCommitted?.(projectDirectRegistrationSession(authorization, tokens))]);
-	if (publication.status === "rejected") throw publication.reason;
-	if (preparation.status === "rejected") throw preparation.reason;
-	const published = publication.value;
-	if (!published.ok) throw new Error(published.message);
+	const activation = prepareCommittedRegistrationActivation(input.homeCompletion, committed);
+	await input.onSessionCommitted?.(projectDirectRegistrationSession(authorization, tokens));
 	return directRegistrationResultFromIssue({
 		directIssue,
 		authorization,
 		tokens,
-		activation: published.activation
+		activation
 	});
 }
 function projectCurrentNearRegistrationSession(authorization, tokens) {

package/dist/esm/router/cloudflare-adaptor.js

@@ -28,7 +28,6 @@ import { buildRouterAbEd25519YaoProductAdmissionRequestV1, createRouterAbEd25519
 import { RouterAbEd25519YaoHttpRegistrationBackend, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv } from "./domains/ed25519Yao/registration/routerAbEd25519YaoHttpRegistrationBackend.js";
 import { StaticCloudflareTenantStorageRouteResolver, createCloudflareTenantStorageRoute, createSignerD1DoStorageTarget, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings } from "../storage/tenantRoute.js";
 import { createInMemoryRouterApiRuntimeSnapshotConsumer, validateRuntimeSnapshotExpectation } from "./framework/runtimeSnapshotConsumer.js";
-import { createSelfHostedCloudflareSigningRouter, createSelfHostedCloudflareSigningWorker } from "./cloudflare/runtime/createSelfHostedCloudflareSigningWorker.js";
 import { CloudflareDurableObjectVersionedJsonRecordStore, CloudflareVersionedJsonRecordStoreError, createCloudflareDurableObjectVersionedJsonRecordStore } from "./cloudflare/durableObjects/versionedJsonRecordStore.js";
 import { CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, createCloudflareD1VersionedJsonRecordStore } from "./cloudflare/d1/versionedJson/d1VersionedJsonRecordStore.js";
 import { createRouterAbEd25519YaoCeremonyStateStoreV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1 } from "./domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPersistence.js";
@@ -41,4 +40,4 @@ import { handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1 } from ".
 import { createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1 } from "./domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRuntime.js";
 import { runRouterAbEd25519YaoRegistrationSideEffectV1 } from "./domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
 import { CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1 } from "./cloudflare/signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.js";
-export { CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareD1AuthorizationStore, CloudflareD1RouterAbNormalSigningAdmissionStore, CloudflareD1VaultProxyStore, CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, CloudflareD1WebAuthnAuthService, CloudflareD1WebAuthnStore, CloudflareDurableObjectVersionedJsonRecordStore, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, CloudflareVersionedJsonRecordStoreError, DEFAULT_WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_V1, DEFAULT_WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_V1, InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, InMemoryRouterAbEd25519YaoRegistrationService, InMemoryRouterAbNormalSigningAdmissionStore, ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, RouterAbEd25519YaoHttpRegistrationBackend, StaticCloudflareTenantStorageRouteResolver, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, WALLET_CONSOLE_API_WALLET_DETAIL_PREFIX_V1, WALLET_CONSOLE_OPS_BASE_PATH_V1, WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_ID_V1, WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_ID_V1, WALLET_CONTROL_AUTH_MARKER_V1, WALLET_CONTROL_BASE_PATH_V1, WALLET_CONTROL_SERVICE_ORIGIN_V1, WALLET_RUNTIME_OPS_BASE_PATH_V1, WALLET_RUNTIME_OP_PATHS_V1, WALLET_RUNTIME_SERVICE_ORIGIN_V1, buildRouterAbEd25519YaoProductAdmissionRequestV1, coerceRouterLogger, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1VersionedJsonRecordStore, createCloudflareDurableObjectVersionedJsonRecordStore, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createCloudflareRouter, createCloudflareTenantStorageRoute, createCloudflareWalletGatewayRouterV1, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterApiRuntimeSnapshotConsumer, createRouterAbEd25519YaoCeremonyStateStoreV1, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule, createRouterAbNormalSigningAdmissionAdapter, createRouterApiModule, createSelfHostedCloudflareSigningRouter, createSelfHostedCloudflareSigningWorker, createSignerD1DoStorageTarget, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createStaticWalletConsoleBindingV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createWalletConsoleOpsClient, createWalletConsoleRelayProxyExtensionV1, createWalletControlClientBindings, createWalletRuntimeOpsHandler, decodeWalletConsoleTenantRootActiveLineageRequestV1, decodeWalletConsoleTenantRootActiveLineageResponseV1, defineRoute, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, extractBearerCredential, extractRouterApiEnvironmentId, getRouterApiRouteExtensionRoutes, handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1, handleStaticWalletConsoleRequestV1, handleWalletControlRequest, matchesRouteDefinitionRequest, mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, parseRouterAbPublicKeysetV2, parseStaticWalletConsoleBindingConfigV1, parseWalletRegistrationContextResponse, parseWalletRuntimeExecuteSignedDelegateRequest, parseWalletRuntimeExecuteSignedDelegateResponse, parseWalletRuntimeExecuteSignedDelegateResult, parseWalletRuntimeRelayerAccount, parseWalletRuntimeWalletIdentitiesResult, parseWalletRuntimeWalletIdentityRequest, partitionRouterAbEd25519YaoProductRegistrationStateV1, randomTenantRootCreationGrantBytesV1, readEnvironmentCsv, readEnvironmentString, requireEnvironmentString, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1, resolveRuntimeTenantRootLineage, resolveSourceIpFromFetchHeaders, runRouterAbEd25519YaoProductRegistrationRequestScopedV1, runRouterAbEd25519YaoRegistrationSideEffectV1, runRouterAbEd25519YaoRegistrationTwoPhaseV1, runRouterAbPrewarmScheduledV1, signTenantRootCreationGrantV1, tenantRootIdentityDigestB64uV1, validateRuntimeSnapshotExpectation, walletConsoleApiWalletGetRouteDefinitionV1, walletConsoleApiWalletListRouteDefinitionV1, walletConsoleApiWalletSearchRouteDefinitionV1, walletConsoleRelayRouteDefinitionsV1, walletConsoleSignedDelegateRouteDefinitionV1, walletConsoleSponsoredEvmCallRouteDefinitionV1 };
+export { CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareD1AuthorizationStore, CloudflareD1RouterAbNormalSigningAdmissionStore, CloudflareD1VaultProxyStore, CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, CloudflareD1WebAuthnAuthService, CloudflareD1WebAuthnStore, CloudflareDurableObjectVersionedJsonRecordStore, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, CloudflareVersionedJsonRecordStoreError, DEFAULT_WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_V1, DEFAULT_WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_V1, InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, InMemoryRouterAbEd25519YaoRegistrationService, InMemoryRouterAbNormalSigningAdmissionStore, ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, RouterAbEd25519YaoHttpRegistrationBackend, StaticCloudflareTenantStorageRouteResolver, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, WALLET_CONSOLE_API_WALLET_DETAIL_PREFIX_V1, WALLET_CONSOLE_OPS_BASE_PATH_V1, WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_ID_V1, WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_ID_V1, WALLET_CONTROL_AUTH_MARKER_V1, WALLET_CONTROL_BASE_PATH_V1, WALLET_CONTROL_SERVICE_ORIGIN_V1, WALLET_RUNTIME_OPS_BASE_PATH_V1, WALLET_RUNTIME_OP_PATHS_V1, WALLET_RUNTIME_SERVICE_ORIGIN_V1, buildRouterAbEd25519YaoProductAdmissionRequestV1, coerceRouterLogger, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1VersionedJsonRecordStore, createCloudflareDurableObjectVersionedJsonRecordStore, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createCloudflareRouter, createCloudflareTenantStorageRoute, createCloudflareWalletGatewayRouterV1, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterApiRuntimeSnapshotConsumer, createRouterAbEd25519YaoCeremonyStateStoreV1, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule, createRouterAbNormalSigningAdmissionAdapter, createRouterApiModule, createSignerD1DoStorageTarget, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createStaticWalletConsoleBindingV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createWalletConsoleOpsClient, createWalletConsoleRelayProxyExtensionV1, createWalletControlClientBindings, createWalletRuntimeOpsHandler, decodeWalletConsoleTenantRootActiveLineageRequestV1, decodeWalletConsoleTenantRootActiveLineageResponseV1, defineRoute, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, extractBearerCredential, extractRouterApiEnvironmentId, getRouterApiRouteExtensionRoutes, handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1, handleStaticWalletConsoleRequestV1, handleWalletControlRequest, matchesRouteDefinitionRequest, mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, parseRouterAbPublicKeysetV2, parseStaticWalletConsoleBindingConfigV1, parseWalletRegistrationContextResponse, parseWalletRuntimeExecuteSignedDelegateRequest, parseWalletRuntimeExecuteSignedDelegateResponse, parseWalletRuntimeExecuteSignedDelegateResult, parseWalletRuntimeRelayerAccount, parseWalletRuntimeWalletIdentitiesResult, parseWalletRuntimeWalletIdentityRequest, partitionRouterAbEd25519YaoProductRegistrationStateV1, randomTenantRootCreationGrantBytesV1, readEnvironmentCsv, readEnvironmentString, requireEnvironmentString, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1, resolveRuntimeTenantRootLineage, resolveSourceIpFromFetchHeaders, runRouterAbEd25519YaoProductRegistrationRequestScopedV1, runRouterAbEd25519YaoRegistrationSideEffectV1, runRouterAbEd25519YaoRegistrationTwoPhaseV1, runRouterAbPrewarmScheduledV1, signTenantRootCreationGrantV1, tenantRootIdentityDigestB64uV1, validateRuntimeSnapshotExpectation, walletConsoleApiWalletGetRouteDefinitionV1, walletConsoleApiWalletListRouteDefinitionV1, walletConsoleApiWalletSearchRouteDefinitionV1, walletConsoleRelayRouteDefinitionsV1, walletConsoleSignedDelegateRouteDefinitionV1, walletConsoleSponsoredEvmCallRouteDefinitionV1 };

package/dist/esm/router/cloudflare.js

@@ -14366,7 +14366,7 @@ async function handleRouterApiWalletRegistrationActivate(input) {
 		...body.emailOtpEnrollment ? { emailOtpEnrollment: body.emailOtpEnrollment } : {},
 		...body.walletCustodyCommit !== void 0 ? { walletCustodyCommit: body.walletCustodyCommit } : {},
 		verifier: session
-	}, traceContext.value ?? void 0, serverTiming);
+	}, traceContext.value ?? void 0, serverTiming, input.waitUntil);
 	if (!result.ok) return routeJson(400, result);
 	if (!isEmailOtpWalletRegistrationActivateSuccessV2(result) && !isPasskeyWalletRegistrationActivateSuccessV2(result)) return routeError(500, "internal", "Wallet registration activation returned an invalid authority");
 	return routeJson(200, result, { headers: registrationServerTimingHeaders(serverTiming) });
@@ -39464,90 +39464,6 @@ function createInMemoryRouterApiRuntimeSnapshotConsumer() {
 	};
 }
 //#endregion
-//#region src/router/cloudflare/runtime/createSelfHostedCloudflareSigningWorker.ts
-function notFound() {
-	return new Response("Not Found", { status: 404 });
-}
-function selfHostedHealthResponse(ctx) {
-	if (ctx.method !== "GET") return null;
-	if (ctx.pathname !== "/healthz" && ctx.pathname !== "/readyz") return null;
-	if (ctx.pathname === "/healthz" && !ctx.opts.healthz) return null;
-	if (ctx.pathname === "/readyz" && !ctx.opts.readyz) return null;
-	return json$3({
-		ok: true,
-		selfHosted: true,
-		threshold: { configured: Boolean(ctx.opts.routerAbNormalSigningRouterProxy) }
-	}, { status: 200 });
-}
-function createSelfHostedContext(input) {
-	const url = new URL(input.request.url);
-	return {
-		request: input.request,
-		url,
-		pathname: url.pathname,
-		method: input.request.method.toUpperCase(),
-		runtime: input.cfCtx ? {
-			kind: "background",
-			waitUntil: (promise) => input.cfCtx?.waitUntil(promise)
-		} : { kind: "inline" },
-		service: input.service,
-		opts: input.opts,
-		logger: input.logger,
-		routeDefinitions: []
-	};
-}
-function createSelfHostedCloudflareSigningRouter(service, opts = {}) {
-	const sessionCookieName = String(opts.sessionCookieName || "").trim() || "seams-jwt";
-	const effectiveOpts = {
-		...opts,
-		sessionCookieName
-	};
-	if (effectiveOpts.ror) validateRouterApiRorOptions(effectiveOpts.ror);
-	const logger = coerceRouterLogger(effectiveOpts.logger);
-	const handler = async (request, _env, cfCtx) => {
-		if (request.method.toUpperCase() === "OPTIONS") {
-			const res = new Response(null, { status: 204 });
-			withCors(res.headers, effectiveOpts, request);
-			return res;
-		}
-		const ctx = createSelfHostedContext({
-			request,
-			cfCtx,
-			service,
-			opts: effectiveOpts,
-			logger
-		});
-		try {
-			const response = selfHostedHealthResponse(ctx) || await handleThresholdEd25519(ctx) || await handleThresholdEcdsa(ctx) || notFound();
-			withCors(response.headers, effectiveOpts, request);
-			return response;
-		} catch (error) {
-			const res = json$3({
-				code: "internal",
-				message: error instanceof Error ? error.message : String(error)
-			}, { status: 500 });
-			withCors(res.headers, effectiveOpts, request);
-			return res;
-		}
-	};
-	return handler;
-}
-function createSelfHostedCloudflareSigningWorker(input) {
-	return { async fetch(request, env, ctx) {
-		const service = await input.createAuthService({
-			request,
-			env,
-			ctx
-		});
-		return createSelfHostedCloudflareSigningRouter(service, typeof input.routerOptions === "function" ? await input.routerOptions({
-			request,
-			env,
-			ctx,
-			service
-		}) : input.routerOptions || {})(request, env, ctx);
-	} };
-}
-//#endregion
 //#region src/router/cloudflare/durableObjects/versionedJsonRecordStore.ts
 var CloudflareVersionedJsonRecordStoreError = class extends Error {
 	constructor(code, message) {
@@ -43027,6 +42943,6 @@ async function establishedGeneration(admit, walletId) {
 	return admitted.ownershipGeneration;
 }
 //#endregion
-export { CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareD1AuthorizationStore, CloudflareD1RouterAbNormalSigningAdmissionStore, CloudflareD1VaultProxyStore, CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, CloudflareD1WebAuthnAuthService, CloudflareD1WebAuthnStore, CloudflareDurableObjectVersionedJsonRecordStore, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, CloudflareVersionedJsonRecordStoreError, DEFAULT_WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_V1, DEFAULT_WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_V1, InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, InMemoryRouterAbEd25519YaoRegistrationService, InMemoryRouterAbNormalSigningAdmissionStore, ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, RouterAbEd25519YaoHttpRegistrationBackend, StaticCloudflareTenantStorageRouteResolver, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, WALLET_CONSOLE_API_WALLET_DETAIL_PREFIX_V1, WALLET_CONSOLE_OPS_BASE_PATH_V1, WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_ID_V1, WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_ID_V1, WALLET_CONTROL_AUTH_MARKER_V1, WALLET_CONTROL_BASE_PATH_V1, WALLET_CONTROL_SERVICE_ORIGIN_V1, WALLET_RUNTIME_OPS_BASE_PATH_V1, WALLET_RUNTIME_OP_PATHS_V1, WALLET_RUNTIME_SERVICE_ORIGIN_V1, buildRouterAbEd25519YaoProductAdmissionRequestV1, coerceRouterLogger, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1VersionedJsonRecordStore, createCloudflareDurableObjectVersionedJsonRecordStore, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createCloudflareRouter, createCloudflareTenantStorageRoute, createCloudflareWalletGatewayRouterV1, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterApiRuntimeSnapshotConsumer, createRouterAbEd25519YaoCeremonyStateStoreV1, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule, createRouterAbNormalSigningAdmissionAdapter, createRouterApiModule, createSelfHostedCloudflareSigningRouter, createSelfHostedCloudflareSigningWorker, createSignerD1DoStorageTarget, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createStaticWalletConsoleBindingV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createWalletConsoleOpsClient, createWalletConsoleRelayProxyExtensionV1, createWalletControlClientBindings, createWalletRuntimeOpsHandler, decodeWalletConsoleTenantRootActiveLineageRequestV1, decodeWalletConsoleTenantRootActiveLineageResponseV1, defineRoute, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, extractBearerCredential, extractRouterApiEnvironmentId, getRouterApiRouteExtensionRoutes, handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1, handleStaticWalletConsoleRequestV1, handleWalletControlRequest, matchesRouteDefinitionRequest, mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, parseRouterAbPublicKeysetV2, parseStaticWalletConsoleBindingConfigV1, parseWalletRegistrationContextResponse, parseWalletRuntimeExecuteSignedDelegateRequest, parseWalletRuntimeExecuteSignedDelegateResponse, parseWalletRuntimeExecuteSignedDelegateResult, parseWalletRuntimeRelayerAccount, parseWalletRuntimeWalletIdentitiesResult, parseWalletRuntimeWalletIdentityRequest, partitionRouterAbEd25519YaoProductRegistrationStateV1, randomTenantRootCreationGrantBytesV1, readEnvironmentCsv, readEnvironmentString, requireEnvironmentString, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1, resolveRuntimeTenantRootLineage, resolveSourceIpFromFetchHeaders, runRouterAbEd25519YaoProductRegistrationRequestScopedV1, runRouterAbEd25519YaoRegistrationSideEffectV1, runRouterAbEd25519YaoRegistrationTwoPhaseV1, runRouterAbPrewarmScheduledV1, signTenantRootCreationGrantV1, tenantRootIdentityDigestB64uV1, validateRuntimeSnapshotExpectation, walletConsoleApiWalletGetRouteDefinitionV1, walletConsoleApiWalletListRouteDefinitionV1, walletConsoleApiWalletSearchRouteDefinitionV1, walletConsoleRelayRouteDefinitionsV1, walletConsoleSignedDelegateRouteDefinitionV1, walletConsoleSponsoredEvmCallRouteDefinitionV1 };
+export { CLOUDFLARE_ROUTER_ED25519_YAO_SOURCE_PRESERVING_EXECUTE_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_DEACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ECDSA_RESERVE_INACTIVE_SOURCE_PRESERVING_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_ACTIVATE_RESERVATION_PATH_V1, CLOUDFLARE_SIGNING_WORKER_ED25519_YAO_DEACTIVATE_RESERVATION_PATH_V1, CloudflareD1AuthorizationStore, CloudflareD1RouterAbNormalSigningAdmissionStore, CloudflareD1VaultProxyStore, CloudflareD1VersionedJsonRecordStore, CloudflareD1VersionedJsonRecordStoreError, CloudflareD1WebAuthnAuthService, CloudflareD1WebAuthnStore, CloudflareDurableObjectVersionedJsonRecordStore, CloudflareOrdinaryInactiveSignerMaterialDeactivationWorkerV1, CloudflareOrdinaryInactiveSignerMaterialReservationWorkerV1, CloudflareVersionedJsonRecordStoreError, DEFAULT_WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_V1, DEFAULT_WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_V1, InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationAdapter, InMemoryRouterAbEd25519YaoRegistrationService, InMemoryRouterAbNormalSigningAdmissionStore, ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1, ROUTER_AB_PUBLIC_KEYSET_PATH, ROUTER_AB_PUBLIC_KEYSET_VERSION_V2, ROUTER_AB_PUBLIC_KEYSET_WELL_KNOWN_PATH, RouterAbEd25519YaoHttpRegistrationBackend, StaticCloudflareTenantStorageRouteResolver, UnavailableOrdinaryInactiveSignerMaterialDeactivationWorkerV1, UnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, WALLET_CONSOLE_API_WALLET_DETAIL_PREFIX_V1, WALLET_CONSOLE_OPS_BASE_PATH_V1, WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, WALLET_CONSOLE_SIGNED_DELEGATE_ROUTE_ID_V1, WALLET_CONSOLE_SPONSORED_EVM_CALL_ROUTE_ID_V1, WALLET_CONTROL_AUTH_MARKER_V1, WALLET_CONTROL_BASE_PATH_V1, WALLET_CONTROL_SERVICE_ORIGIN_V1, WALLET_RUNTIME_OPS_BASE_PATH_V1, WALLET_RUNTIME_OP_PATHS_V1, WALLET_RUNTIME_SERVICE_ORIGIN_V1, buildRouterAbEd25519YaoProductAdmissionRequestV1, coerceRouterLogger, createCloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1VersionedJsonRecordStore, createCloudflareDurableObjectVersionedJsonRecordStore, createCloudflareLinkedDeviceEd25519SourcePreservingRouterEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationEndpointV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1, createCloudflareRouter, createCloudflareTenantStorageRoute, createCloudflareWalletGatewayRouterV1, createInMemoryRouterAbNormalSigningAdmissionAdapter, createInMemoryRouterAbNormalSigningAdmissionStore, createInMemoryRouterApiRuntimeSnapshotConsumer, createRouterAbEd25519YaoCeremonyStateStoreV1, createRouterAbEd25519YaoHttpRegistrationBackendFromEnv, createRouterAbEd25519YaoProductRegistrationCompositionFromPortsV1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreFromD1V1, createRouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1, createRouterAbEd25519YaoProductRegistrationRequestScopedRuntimeV1, createRouterAbEd25519YaoProductRegistrationRuntimeV1, createRouterAbEd25519YaoProductRegistrationStateV1, createRouterAbEd25519YaoRegistrationModule, createRouterAbNormalSigningAdmissionAdapter, createRouterApiModule, createSignerD1DoStorageTarget, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, createStaticWalletConsoleBindingV1, createUnavailableOrdinaryInactiveSignerMaterialDeactivationPortV1, createUnavailableOrdinaryInactiveSignerMaterialReservationWorkerV1, createWalletConsoleOpsClient, createWalletConsoleRelayProxyExtensionV1, createWalletControlClientBindings, createWalletRuntimeOpsHandler, decodeWalletConsoleTenantRootActiveLineageRequestV1, decodeWalletConsoleTenantRootActiveLineageResponseV1, defineRoute, encodeRouterAbEd25519YaoProductRegistrationPartitionRecordV1, encodeRouterAbEd25519YaoProductRegistrationStateV1, extractBearerCredential, extractRouterApiEnvironmentId, getRouterApiRouteExtensionRoutes, handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1, handleStaticWalletConsoleRequestV1, handleWalletControlRequest, matchesRouteDefinitionRequest, mergeRouterAbEd25519YaoProductRegistrationStatePartitionV1, parseRouterAbEd25519YaoCeremonyKeyV1, parseRouterAbEd25519YaoProductRegistrationPartitionRecordV1, parseRouterAbEd25519YaoProductRegistrationStateJsonV1, parseRouterAbPublicKeysetV2, parseStaticWalletConsoleBindingConfigV1, parseWalletRegistrationContextResponse, parseWalletRuntimeExecuteSignedDelegateRequest, parseWalletRuntimeExecuteSignedDelegateResponse, parseWalletRuntimeExecuteSignedDelegateResult, parseWalletRuntimeRelayerAccount, parseWalletRuntimeWalletIdentitiesResult, parseWalletRuntimeWalletIdentityRequest, partitionRouterAbEd25519YaoProductRegistrationStateV1, randomTenantRootCreationGrantBytesV1, readEnvironmentCsv, readEnvironmentString, requireEnvironmentString, resolveRouterAbEd25519YaoCeremonyKeyFromRequestV1, resolveRuntimeTenantRootLineage, resolveSourceIpFromFetchHeaders, runRouterAbEd25519YaoProductRegistrationRequestScopedV1, runRouterAbEd25519YaoRegistrationSideEffectV1, runRouterAbEd25519YaoRegistrationTwoPhaseV1, runRouterAbPrewarmScheduledV1, signTenantRootCreationGrantV1, tenantRootIdentityDigestB64uV1, validateRuntimeSnapshotExpectation, walletConsoleApiWalletGetRouteDefinitionV1, walletConsoleApiWalletListRouteDefinitionV1, walletConsoleApiWalletSearchRouteDefinitionV1, walletConsoleRelayRouteDefinitionsV1, walletConsoleSignedDelegateRouteDefinitionV1, walletConsoleSponsoredEvmCallRouteDefinitionV1 };
 
 //# sourceMappingURL=cloudflare.js.map

package/dist/esm/router/domains/walletRegistration/walletRegistrationRoutes.js

@@ -1891,7 +1891,7 @@ async function handleRouterApiWalletRegistrationActivate(input) {
 		...body.emailOtpEnrollment ? { emailOtpEnrollment: body.emailOtpEnrollment } : {},
 		...body.walletCustodyCommit !== void 0 ? { walletCustodyCommit: body.walletCustodyCommit } : {},
 		verifier: session
-	}, traceContext.value ?? void 0, serverTiming);
+	}, traceContext.value ?? void 0, serverTiming, input.waitUntil);
 	if (!result.ok) return routeJson(400, result);
 	if (!isEmailOtpWalletRegistrationActivateSuccessV2(result) && !isPasskeyWalletRegistrationActivateSuccessV2(result)) return routeError(500, "internal", "Wallet registration activation returned an invalid authority");
 	return routeJson(200, result, { headers: registrationServerTimingHeaders(serverTiming) });

package/dist/esm/threshold/session/signingSessionSeal/guards/backends.js

@@ -1,6 +1,5 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import { createInMemorySigningSessionSealRateLimiter } from "./index.js";
-import { RedisTcpClient, UpstashRedisRestClient } from "../../../../core/ThresholdService/kv.js";
+import { UpstashRedisRestClient } from "../../../../core/ThresholdService/kv.js";
 //#region src/threshold/session/signingSessionSeal/guards/backends.ts
 const WINDOW_COUNTER_LUA = `
 local key = KEYS[1]
@@ -87,105 +86,10 @@ var UpstashSigningSessionSealRateLimiter = class {
 		}
 	}
 };
-function redisRespToString(resp) {
-	if (resp.type === "error") return null;
-	if (resp.type === "bulk") return typeof resp.value === "string" ? resp.value : null;
-	if (resp.type === "integer") return String(resp.value);
-	if (resp.type === "simple") return resp.value;
-	return null;
-}
-var RedisTcpSigningSessionSealRateLimiter = class {
-	constructor(input) {
-		this.client = new RedisTcpClient(input.redisUrl);
-		this.keyPrefix = normalizeOptionalTrimmedString(input.keyPrefix);
-	}
-	withPrefix(key) {
-		return this.keyPrefix ? `${this.keyPrefix}${key}` : key;
-	}
-	async consume(input) {
-		const key = this.withPrefix(normalizeOptionalTrimmedString(input.key));
-		if (!key) return {
-			ok: false,
-			code: "invalid_rate_limit_key",
-			message: "Rate-limit key is required"
-		};
-		try {
-			const resp = await this.client.send([
-				"EVAL",
-				WINDOW_COUNTER_LUA,
-				"1",
-				key,
-				String(Math.max(1, Math.floor(Number(input.windowMs) || 0)))
-			]);
-			if (resp.type === "error") return {
-				ok: false,
-				code: "internal",
-				message: `Redis EVAL error: ${resp.value}`
-			};
-			const parsed = parseCounterWindow(redisRespToString(resp));
-			if (!parsed) return {
-				ok: false,
-				code: "internal",
-				message: "Invalid Redis rate-limit response"
-			};
-			return finalizeConsume({
-				count: parsed.count,
-				ttlMs: parsed.ttlMs,
-				limit: Math.max(1, Math.floor(Number(input.limit) || 0)),
-				nowMs: Math.floor(Number(input.nowMs) || 0)
-			});
-		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: error instanceof Error ? error.message : String(error || "Redis rate-limit failed")
-			};
-		}
-	}
-};
 function createUpstashSigningSessionSealRateLimiter(options) {
 	return new UpstashSigningSessionSealRateLimiter(options);
 }
-function createRedisTcpSigningSessionSealRateLimiter(options) {
-	return new RedisTcpSigningSessionSealRateLimiter(options);
-}
-function resolveSigningSessionSealRateLimitFromEnv(input) {
-	const limiterKind = normalizeOptionalTrimmedString(input.limiterKind || "").toLowerCase();
-	const upstashUrl = normalizeOptionalTrimmedString(input.upstashUrl || "");
-	const upstashToken = normalizeOptionalTrimmedString(input.upstashToken || "");
-	const redisUrl = normalizeOptionalTrimmedString(input.redisUrl || "");
-	const keyPrefix = normalizeOptionalTrimmedString(input.keyPrefix || "") || void 0;
-	const selectedKind = limiterKind || (upstashUrl || upstashToken ? "upstash-redis-rest" : redisUrl ? "redis-tcp" : "in-memory");
-	if (selectedKind === "upstash-redis-rest") {
-		if (!upstashUrl || !upstashToken) throw new Error("Upstash Signing-session seal rate limiter requires both upstashUrl and upstashToken");
-		return {
-			limiter: createUpstashSigningSessionSealRateLimiter({
-				url: upstashUrl,
-				token: upstashToken,
-				keyPrefix
-			}),
-			limit: input.limit,
-			windowMs: input.windowMs
-		};
-	}
-	if (selectedKind === "redis-tcp") {
-		if (!redisUrl) throw new Error("Redis TCP Signing-session seal rate limiter requires redisUrl");
-		return {
-			limiter: createRedisTcpSigningSessionSealRateLimiter({
-				redisUrl,
-				keyPrefix
-			}),
-			limit: input.limit,
-			windowMs: input.windowMs
-		};
-	}
-	return {
-		limiter: createInMemorySigningSessionSealRateLimiter(),
-		limit: input.limit,
-		windowMs: input.windowMs
-	};
-}
 //#endregion
-export { createRedisTcpSigningSessionSealRateLimiter, createUpstashSigningSessionSealRateLimiter, resolveSigningSessionSealRateLimitFromEnv };
+export { createUpstashSigningSessionSealRateLimiter };
 
 //# sourceMappingURL=backends.js.map

package/dist/esm/threshold/session/signingSessionSeal/idempotencyBackends.js

@@ -1,6 +1,5 @@
 import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
-import { RedisTcpClient, UpstashRedisRestClient, redisDel, redisGetJson, redisSetJson } from "../../../core/ThresholdService/kv.js";
-import { createInMemorySigningSessionSealIdempotencyStore } from "./idempotency.js";
+import { UpstashRedisRestClient } from "../../../core/ThresholdService/kv.js";
 import { parseCurrentSigningSessionSealIdempotencyResultRecord, parseCurrentSigningSessionSealIdempotencyStoredEntry } from "./idempotencyRecords.js";
 //#region src/threshold/session/signingSessionSeal/idempotencyBackends.ts
 const DEFAULT_KEY_PREFIX = "threshold:signing-session-seal:idempotency:";
@@ -55,76 +54,10 @@ var UpstashSigningSessionSealIdempotencyStore = class {
 		}, ttlMs);
 	}
 };
-var RedisTcpSigningSessionSealIdempotencyStore = class {
-	constructor(options) {
-		this.client = new RedisTcpClient(options.redisUrl);
-		this.keyPrefix = normalizeOptionalTrimmedString(options.keyPrefix) || DEFAULT_KEY_PREFIX;
-		this.nowMs = options.nowMs || Date.now;
-	}
-	async get(input) {
-		const key = prefixedKey(this.keyPrefix, input.key);
-		if (!key) return null;
-		const entry = parseCurrentSigningSessionSealIdempotencyStoredEntry(await redisGetJson(this.client, key));
-		if (!entry) return null;
-		if (entry.expiresAtMs <= input.nowMs) {
-			try {
-				await redisDel(this.client, key);
-			} catch {}
-			return null;
-		}
-		return entry.result;
-	}
-	async set(input) {
-		const key = prefixedKey(this.keyPrefix, input.key);
-		if (!key) return;
-		const expiresAtMs = toPositiveInt(input.expiresAtMs);
-		if (expiresAtMs === void 0) return;
-		const normalizedResult = parseCurrentSigningSessionSealIdempotencyResultRecord(input.result);
-		if (!normalizedResult) return;
-		const ttlMs = ttlMsUntilExpiry(expiresAtMs, this.nowMs());
-		if (ttlMs <= 0) return;
-		await redisSetJson(this.client, key, {
-			result: normalizedResult,
-			expiresAtMs
-		}, ttlMs);
-	}
-};
 function createUpstashSigningSessionSealIdempotencyStore(options) {
 	return new UpstashSigningSessionSealIdempotencyStore(options);
 }
-function createRedisTcpSigningSessionSealIdempotencyStore(options) {
-	return new RedisTcpSigningSessionSealIdempotencyStore(options);
-}
-function resolveSigningSessionSealIdempotencyFromEnv(input) {
-	const idempotencyKind = normalizeOptionalTrimmedString(input.idempotencyKind || "").toLowerCase();
-	const upstashUrl = normalizeOptionalTrimmedString(input.upstashUrl || "");
-	const upstashToken = normalizeOptionalTrimmedString(input.upstashToken || "");
-	const redisUrl = normalizeOptionalTrimmedString(input.redisUrl || "");
-	const keyPrefix = normalizeOptionalTrimmedString(input.keyPrefix || "") || DEFAULT_KEY_PREFIX;
-	const ttlMs = toPositiveInt(input.ttlMs);
-	const selectedKind = idempotencyKind || (upstashUrl || upstashToken ? "upstash-redis-rest" : redisUrl ? "redis-tcp" : "in-memory");
-	let store;
-	if (selectedKind === "upstash-redis-rest") {
-		if (!upstashUrl || !upstashToken) throw new Error("Upstash signing session-seal idempotency requires both upstashUrl and upstashToken");
-		store = createUpstashSigningSessionSealIdempotencyStore({
-			url: upstashUrl,
-			token: upstashToken,
-			keyPrefix
-		});
-	} else if (selectedKind === "redis-tcp") {
-		if (!redisUrl) throw new Error("Redis TCP signing session-seal idempotency requires redisUrl");
-		store = createRedisTcpSigningSessionSealIdempotencyStore({
-			redisUrl,
-			keyPrefix
-		});
-	} else if (selectedKind === "in-memory") store = createInMemorySigningSessionSealIdempotencyStore();
-	else throw new Error(`Unsupported signing session-seal idempotency kind "${selectedKind}". Expected in-memory, upstash-redis-rest, or redis-tcp.`);
-	return {
-		store,
-		...ttlMs ? { ttlMs } : {}
-	};
-}
 //#endregion
-export { createRedisTcpSigningSessionSealIdempotencyStore, createUpstashSigningSessionSealIdempotencyStore, resolveSigningSessionSealIdempotencyFromEnv };
+export { createUpstashSigningSessionSealIdempotencyStore };
 
 //# sourceMappingURL=idempotencyBackends.js.map

package/dist/esm/threshold/session/signingSessionSeal/index.js

@@ -7,6 +7,6 @@ import { createSigningSessionSealService } from "./service.js";
 import { createSigningSessionSealRoutesOptions } from "./routesOptions.js";
 import { createSigningSessionSealOptions, parseSigningSessionSealRootConfig } from "./options.js";
 import { createInMemorySigningSessionSealIdempotencyStore } from "./idempotency.js";
-import { createRedisTcpSigningSessionSealRateLimiter, createUpstashSigningSessionSealRateLimiter, resolveSigningSessionSealRateLimitFromEnv } from "./guards/backends.js";
-import { createRedisTcpSigningSessionSealIdempotencyStore, createUpstashSigningSessionSealIdempotencyStore, resolveSigningSessionSealIdempotencyFromEnv } from "./idempotencyBackends.js";
-export { authorizeSigningSessionSealRequest, buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, composeSigningSessionSealGuards, createInMemorySigningSessionSealIdempotencyStore, createInMemorySigningSessionSealRateLimiter, createPassthroughSigningSessionSealCipherAdapter, createRedisTcpSigningSessionSealIdempotencyStore, createRedisTcpSigningSessionSealRateLimiter, createSigningSessionSealAuditLogger, createSigningSessionSealCipherAdapter, createSigningSessionSealOptions, createSigningSessionSealRateLimitGuard, createSigningSessionSealRoutesOptions, createSigningSessionSealService, createSigningSessionSealShamir3PassCipherAdapter, createUpstashSigningSessionSealIdempotencyStore, createUpstashSigningSessionSealRateLimiter, encodeSigningSessionSealServerLockContext, handleSigningSessionSealRoutes, parseSigningSessionSealApplyBody, parseSigningSessionSealRemoveBody, parseSigningSessionSealRootConfig, resolveSigningSessionSealBasePath, resolveSigningSessionSealIdempotencyFromEnv, resolveSigningSessionSealRateLimitFromEnv, signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode };
+import { createUpstashSigningSessionSealRateLimiter } from "./guards/backends.js";
+import { createUpstashSigningSessionSealIdempotencyStore } from "./idempotencyBackends.js";
+export { authorizeSigningSessionSealRequest, buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, composeSigningSessionSealGuards, createInMemorySigningSessionSealIdempotencyStore, createInMemorySigningSessionSealRateLimiter, createPassthroughSigningSessionSealCipherAdapter, createSigningSessionSealAuditLogger, createSigningSessionSealCipherAdapter, createSigningSessionSealOptions, createSigningSessionSealRateLimitGuard, createSigningSessionSealRoutesOptions, createSigningSessionSealService, createSigningSessionSealShamir3PassCipherAdapter, createUpstashSigningSessionSealIdempotencyStore, createUpstashSigningSessionSealRateLimiter, encodeSigningSessionSealServerLockContext, handleSigningSessionSealRoutes, parseSigningSessionSealApplyBody, parseSigningSessionSealRemoveBody, parseSigningSessionSealRootConfig, resolveSigningSessionSealBasePath, signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode };

package/dist/types/wallet-server/src/cloud-host.d.ts

@@ -119,7 +119,7 @@ export type { LinkedDeviceBootstrapStore, LinkedDeviceBootstrapResult, } from '.
 export { parseLinkedDeviceSessionRecordV1 } from './core/deviceLinking/linkedDeviceSessionRecord';
 export type { LinkedDeviceSessionRecordV1 } from './core/deviceLinking/linkedDeviceSessionRecord';
 export { computeLinkedDeviceSessionClaimDigestV1 } from '../../shared-ts/src/device-linking/digests';
-export { admitD1EstablishedWalletHome } from './router/cloudflare/d1/registration/d1WalletExecutionAuthority';
+export { admitD1EstablishedWalletHome, resumeRegistrationDirectoryPublicationsV1, type RegistrationDirectoryPublicationDelivery, } from './router/cloudflare/d1/registration/d1WalletExecutionAuthority';
 export { D1WalletObjectAddresses } from './router/cloudflare/d1/walletObjectAddresses';
 export { walletObjectIdentity, WalletObjectAddressSnapshot, type WalletObjectIdentity } from './router/cloudflare/runtime/walletObjectAddresses';
 //# sourceMappingURL=cloud-host.d.ts.map

package/dist/types/wallet-server/src/core/ThresholdService/kv.d.ts

@@ -13,33 +13,4 @@ export declare class UpstashRedisRestClient {
     setJson(key: string, value: unknown, ttlMs?: number): Promise<void>;
     eval(script: string, keys: string[], args: string[]): Promise<unknown | null>;
 }
-export type RedisResp = {
-    type: 'simple';
-    value: string;
-} | {
-    type: 'error';
-    value: string;
-} | {
-    type: 'integer';
-    value: number;
-} | {
-    type: 'bulk';
-    value: string | null;
-};
-export declare class RedisTcpClient {
-    private readonly url;
-    private socket;
-    private buffer;
-    private pending;
-    private connecting;
-    constructor(redisUrl: string);
-    private ensureConnected;
-    private connect;
-    private drain;
-    private failAll;
-    send(args: string[]): Promise<RedisResp>;
-}
-export declare function redisGetJson(client: RedisTcpClient, key: string): Promise<unknown | null>;
-export declare function redisDel(client: RedisTcpClient, key: string): Promise<void>;
-export declare function redisSetJson(client: RedisTcpClient, key: string, value: unknown, ttlMs?: number): Promise<void>;
 //# sourceMappingURL=kv.d.ts.map

package/dist/types/wallet-server/src/localHostedWalletGatewayHandler.d.ts

@@ -3,6 +3,8 @@ import type { CfExecutionContext } from './router/cloudflare/runtime/cloudflare.
 export type LocalHostedWalletGatewayEnv = CloudflareD1GatewayBaseEnv & {
     readonly WALLET_LOCAL_DEPLOYMENT_JSON: string;
 };
+/** Sends the due directory publications to the local registration authority. */
+export declare function resumeLocalRegistrationDirectoryPublicationsV1(env: LocalHostedWalletGatewayEnv): Promise<void>;
 /**
  * The local Gateway: the hosted Gateway handler plus the intended-suite
  * transport faults, which a request arms with local-only headers. The local

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletExecutionAuthority.d.ts

@@ -1,6 +1,6 @@
 import { type D1TenantScope } from '../../../../core/d1TenantStore';
 import type { D1DatabaseLike, D1ResultLike } from '../../../../storage/tenantRoute';
-import type { RegistrationEstablishedPublication, WalletExecutionAuthority, WalletRegistrationHomeAuthority, WalletRegistrationReservationAuthority } from '../../../domains/walletRegistration/walletRegistrationReservation';
+import type { RegistrationActivationWrite, WalletExecutionAuthority, WalletRegistrationHomeAuthority, WalletRegistrationReservationAuthority } from '../../../domains/walletRegistration/walletRegistrationReservation';
 type Authority = WalletRegistrationReservationAuthority;
 type HomeAdmission = Awaited<ReturnType<Authority['admitHome']>>;
 type OrdinaryAdmission = Awaited<ReturnType<WalletExecutionAuthority['admitEstablishedHome']>>;
@@ -10,6 +10,7 @@ type RegistrationHomeRow = {
     readonly registration_completion: string;
     readonly relocation_blocked: number;
 };
+export type RegistrationDirectoryPublicationDelivery = 'acknowledged' | 'deferred' | 'refused';
 export declare class D1WalletExecutionAuthority implements WalletRegistrationHomeAuthority, WalletExecutionAuthority {
     private readonly database;
     private readonly scope;
@@ -26,7 +27,14 @@ export declare class D1WalletExecutionAuthority implements WalletRegistrationHom
         readonly code: string;
         readonly message: string;
     }>;
-    publishEstablished(input: Parameters<WalletRegistrationHomeAuthority['publishEstablished']>[0]): Promise<RegistrationEstablishedPublication>;
+    prepareEstablished(input: Parameters<WalletRegistrationHomeAuthority['prepareEstablished']>[0]): RegistrationActivationWrite | null;
+    /** Sends the publications that are due, oldest first, one at a time. */
+    resumeDirectoryPublications(input: {
+        readonly nowMs: number;
+        readonly limit: number;
+    }): Promise<Record<RegistrationDirectoryPublicationDelivery, number>>;
+    private deliver;
+    private preparePublicationUpdate;
     private fixCancellation;
     /** The state update with its guard. The guard reads the row count of the update before it. */
     private prepareState;
@@ -37,5 +45,17 @@ export declare function prepareD1RegistrationHomeReservation(database: D1Databas
     readonly ownershipGeneration: number;
 }): import("../../../cloudflare-adaptor").D1PreparedStatementLike[];
 export declare function admitD1EstablishedWalletHome(database: D1DatabaseLike, scope: D1TenantScope, input: Parameters<WalletExecutionAuthority['admitEstablishedHome']>[0]): Promise<OrdinaryAdmission>;
+/**
+ * Sends the due directory publications of one tenant scope. The Gateway's
+ * scheduled handler runs it, so a publication that the finalize response could
+ * not deliver still reaches the directory.
+ */
+export declare function resumeRegistrationDirectoryPublicationsV1(input: {
+    readonly database: D1DatabaseLike;
+    readonly scope: D1TenantScope;
+    readonly registrationAuthority: Authority;
+    readonly nowMs?: number;
+    readonly limit?: number;
+}): Promise<Record<RegistrationDirectoryPublicationDelivery, number>>;
 export {};
 //# sourceMappingURL=d1WalletExecutionAuthority.d.ts.map

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/d1WalletRegistrationService.d.ts

@@ -320,7 +320,7 @@ export declare class CloudflareD1WalletRegistrationService {
      * before execution; an ambiguous outcome after the custody call stays
      * `uncertain` rather than being guessed either way.
      */
-    activateWalletRegistration(input: WalletRegistrationActivateInput, traceContext?: RouterAbTraceContextV1, serverTiming?: Array<readonly [string, number]>): Promise<WalletRegistrationActivateResponseV2>;
+    activateWalletRegistration(input: WalletRegistrationActivateInput, traceContext?: RouterAbTraceContextV1, serverTiming?: Array<readonly [string, number]>, waitUntil?: (promise: Promise<unknown>) => void): Promise<WalletRegistrationActivateResponseV2>;
     /**
      * Router/SigningWorker activation followed by the blocking finalize
      * persistence, as one unit inside the operation row. The commit is told the

package/dist/types/wallet-server/src/router/cloudflare/d1/registration/walletRegistrationEstablishedSessionIssuer.d.ts

@@ -18,7 +18,7 @@ type RegistrationEstablishedSessionIssuanceDependencies = {
     readonly authorizationService: RegistrationEstablishedSessionIssuerAuthorizationService;
     readonly authorizationTenantId: TenantId;
     readonly foundingAuthority: ActiveWalletAuthorityV1;
-    readonly homeCompletion: Pick<WalletRegistrationHomeAuthority, 'publishEstablished'>;
+    readonly homeCompletion: Pick<WalletRegistrationHomeAuthority, 'prepareEstablished'>;
 };
 export type RegistrationInitialSessionCommit = {
     readonly kind: 'uncommitted';

package/dist/types/wallet-server/src/router/cloudflare-adaptor.d.ts

@@ -44,8 +44,6 @@ export type { InMemoryRouterApiRuntimeSnapshotConsumer, RouterApiRuntimeSnapshot
 export { createInMemoryRouterApiRuntimeSnapshotConsumer, validateRuntimeSnapshotExpectation, } from './framework/runtimeSnapshotConsumer';
 export { extractBearerCredential, extractRouterApiEnvironmentId, resolveSourceIpFromFetchHeaders, } from './auth/routerApiKeyAuth';
 export { createCloudflareRouter } from './cloudflare/runtime/createCloudflareRouter';
-export type { SelfHostedCloudflareSigningWorkerFactoryInput } from './cloudflare/runtime/createSelfHostedCloudflareSigningWorker';
-export { createSelfHostedCloudflareSigningRouter, createSelfHostedCloudflareSigningWorker, } from './cloudflare/runtime/createSelfHostedCloudflareSigningWorker';
 export { CloudflareDurableObjectVersionedJsonRecordStore, CloudflareVersionedJsonRecordStoreError, createCloudflareDurableObjectVersionedJsonRecordStore, } from './cloudflare/durableObjects/versionedJsonRecordStore';
 export type { CloudflareVersionedJsonRecordStoreOptions } from './cloudflare/durableObjects/versionedJsonRecordStore';
 export type { VersionedJsonObject, VersionedJsonRecordPutResult, VersionedJsonRecordReadResult, VersionedJsonValue, } from './framework/versionedJsonRecordStore';

package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationReservation.d.ts

@@ -93,37 +93,32 @@ export interface WalletRegistrationReservationAuthority {
     })): Promise<ReservationOutcome>;
 }
 /**
- * The local write that makes an established registration active. It follows
- * the acknowledged directory write. It commits in the batch of the record
+ * The local write that makes an established registration active and records
+ * its directory publication as pending. It commits in the batch of the record
  * that completes the registration operation, or it does not commit.
  */
 export type RegistrationActivationWrite = {
     readonly statements: readonly D1PreparedStatementLike[];
-};
-export type RegistrationEstablishedPublication = {
-    readonly ok: true;
-    /** None when an earlier completion already activated the registration. */
-    readonly activation: RegistrationActivationWrite | null;
-    readonly code?: never;
-    readonly message?: never;
-} | {
-    readonly ok: false;
-    readonly code: string;
-    readonly message: string;
-    readonly activation?: never;
+    /**
+     * Sends the pending directory publication. Call it only after the statements
+     * commit. It never throws: a failed delivery stays pending for the next attempt.
+     */
+    readonly publish: () => Promise<void>;
 };
 /** The registration authority at the wallet's home, which owns the local activation. */
 export interface WalletRegistrationHomeAuthority extends Pick<WalletRegistrationReservationAuthority, 'reserve' | 'admitHome'> {
     /**
-     * Publishes the committed registration decision to its directory and prepares the
-     * activation. The caller commits the activation with its completion record.
+     * Prepares the activation of the committed registration decision with its
+     * pending directory publication. None when an earlier completion already
+     * activated the registration. The caller commits the activation with its
+     * completion record, then publishes.
      */
-    publishEstablished(input: {
+    prepareEstablished(input: {
         readonly registration: CommittedWalletRegistration;
         readonly session: WalletSessionLocatorPublication & {
             readonly kind: 'credential';
         };
-    }): Promise<RegistrationEstablishedPublication>;
+    }): RegistrationActivationWrite | null;
     /** Fixes a definitive cancellation, publishes it, and retires the local home. */
     cancel(input: {
         readonly ceremonyId: string;