@seams/wallet-server 0.11.0 → 0.13.0

package/dist/types/wallet-server/src/router/framework/authServicePort.d.ts

@@ -1033,7 +1033,7 @@ export interface RouterApiWalletRegistrationService {
     setupWalletRegistration(input: WalletRegistrationSetupInput): Promise<RouteResponse>;
     respondWalletRegistration(input: WalletRegistrationRespondInput, traceContext?: RouterAbTraceContextV1, serverTiming?: Array<readonly [string, number]>, waitUntil?: (promise: Promise<unknown>) => void): Promise<WalletRegistrationRespondResponseV2>;
     authorizeWalletRegistrationNearAdmission(input: WalletRegistrationNearAdmissionInput): Promise<WalletRegistrationNearAdmissionResponseV2>;
-    activateWalletRegistration(input: WalletRegistrationActivateInput, traceContext?: RouterAbTraceContextV1, serverTiming?: Array<readonly [string, number]>): Promise<WalletRegistrationActivateResponseV2>;
+    activateWalletRegistration(input: WalletRegistrationActivateInput, traceContext?: RouterAbTraceContextV1, serverTiming?: Array<readonly [string, number]>, waitUntil?: (promise: Promise<unknown>) => void): Promise<WalletRegistrationActivateResponseV2>;
     completeWalletRegistrationNearProvisioning(input: WalletRegistrationNearProvisioningInput, serverTiming?: Array<readonly [string, number]>, waitUntil?: (promise: Promise<unknown>) => void): Promise<WalletRegistrationNearProvisioningResponseV2>;
     refreshEd25519YaoWalletSession(input: RouterAbEd25519YaoBudgetRefreshRequestV1): Promise<RouterAbEd25519YaoBudgetRefreshResponseV1>;
     provisionEd25519YaoWalletSession(input: RouterAbEd25519YaoVerifiedWalletUnlockRequestV1): Promise<RouterAbEd25519YaoVerifiedWalletUnlockResponseV1>;

package/dist/types/wallet-server/src/threshold/session/signingSessionSeal/guards/backends.d.ts

@@ -1,23 +1,8 @@
-import type { CreateSigningSessionSealRateLimitGuardOptions, SigningSessionSealRateLimiter } from './index';
+import type { SigningSessionSealRateLimiter } from './index';
 export interface CreateUpstashSigningSessionSealRateLimiterOptions {
     url: string;
     token: string;
     keyPrefix?: string;
 }
-export interface CreateRedisTcpSigningSessionSealRateLimiterOptions {
-    redisUrl: string;
-    keyPrefix?: string;
-}
 export declare function createUpstashSigningSessionSealRateLimiter(options: CreateUpstashSigningSessionSealRateLimiterOptions): SigningSessionSealRateLimiter;
-export declare function createRedisTcpSigningSessionSealRateLimiter(options: CreateRedisTcpSigningSessionSealRateLimiterOptions): SigningSessionSealRateLimiter;
-export interface CreateSigningSessionSealRateLimitFromEnvInput {
-    limiterKind?: 'in-memory' | 'upstash-redis-rest' | 'redis-tcp' | null;
-    upstashUrl?: string | null;
-    upstashToken?: string | null;
-    redisUrl?: string | null;
-    keyPrefix?: string | null;
-    limit: number;
-    windowMs: number;
-}
-export declare function resolveSigningSessionSealRateLimitFromEnv(input: CreateSigningSessionSealRateLimitFromEnvInput): Pick<CreateSigningSessionSealRateLimitGuardOptions, 'limiter' | 'limit' | 'windowMs'>;
 //# sourceMappingURL=backends.d.ts.map

package/dist/types/wallet-server/src/threshold/session/signingSessionSeal/idempotencyBackends.d.ts

@@ -1,24 +1,9 @@
-import type { SigningSessionSealIdempotencyStore, SigningSessionSealServiceIdempotencyOptions } from './signingSessionSeal.types';
+import type { SigningSessionSealIdempotencyStore } from './signingSessionSeal.types';
 export interface CreateUpstashSigningSessionSealIdempotencyStoreOptions {
     url: string;
     token: string;
     keyPrefix?: string;
     nowMs?: () => number;
 }
-export interface CreateRedisTcpSigningSessionSealIdempotencyStoreOptions {
-    redisUrl: string;
-    keyPrefix?: string;
-    nowMs?: () => number;
-}
 export declare function createUpstashSigningSessionSealIdempotencyStore(options: CreateUpstashSigningSessionSealIdempotencyStoreOptions): SigningSessionSealIdempotencyStore;
-export declare function createRedisTcpSigningSessionSealIdempotencyStore(options: CreateRedisTcpSigningSessionSealIdempotencyStoreOptions): SigningSessionSealIdempotencyStore;
-export interface CreateSigningSessionSealIdempotencyFromEnvInput {
-    idempotencyKind?: string | null;
-    upstashUrl?: string | null;
-    upstashToken?: string | null;
-    redisUrl?: string | null;
-    keyPrefix?: string | null;
-    ttlMs?: number | null;
-}
-export declare function resolveSigningSessionSealIdempotencyFromEnv(input: CreateSigningSessionSealIdempotencyFromEnvInput): SigningSessionSealServiceIdempotencyOptions;
 //# sourceMappingURL=idempotencyBackends.d.ts.map

package/dist/types/wallet-server/src/threshold/session/signingSessionSeal/index.d.ts

@@ -4,8 +4,8 @@ export type { CreateSigningSessionSealAuditLoggerOptions } from './observability
 export type { CreateSigningSessionSealRoutesOptionsInput } from './routesOptions';
 export type { CreateSigningSessionSealOptionsInput } from './options';
 export type { CreateSigningSessionSealRateLimitGuardOptions, InMemorySigningSessionSealRateLimiterOptions, SigningSessionSealRateLimitConsumeInput, SigningSessionSealRateLimitConsumeResult, SigningSessionSealRateLimiter, SigningSessionSealRateLimitRejectedEvent, } from './guards';
-export type { CreateSigningSessionSealRateLimitFromEnvInput, CreateRedisTcpSigningSessionSealRateLimiterOptions, CreateUpstashSigningSessionSealRateLimiterOptions, } from './guards/backends';
-export type { CreateSigningSessionSealIdempotencyFromEnvInput, CreateRedisTcpSigningSessionSealIdempotencyStoreOptions, CreateUpstashSigningSessionSealIdempotencyStoreOptions, } from './idempotencyBackends';
+export type { CreateUpstashSigningSessionSealRateLimiterOptions, } from './guards/backends';
+export type { CreateUpstashSigningSessionSealIdempotencyStoreOptions, } from './idempotencyBackends';
 export { signingSessionSealAuthorizeStatusCode, signingSessionSealStatusCode, } from './transport/shared';
 export { buildSigningSessionSealApplyPath, buildSigningSessionSealRemovePath, resolveSigningSessionSealBasePath, parseSigningSessionSealApplyBody, parseSigningSessionSealRemoveBody, authorizeSigningSessionSealRequest, } from './transport/shared';
 export { createSigningSessionSealCipherAdapter, createPassthroughSigningSessionSealCipherAdapter, createSigningSessionSealShamir3PassCipherAdapter, encodeSigningSessionSealServerLockContext, } from './crypto/cipher';
@@ -15,8 +15,8 @@ export { createSigningSessionSealAuditLogger } from './observability/audit';
 export { createSigningSessionSealRoutesOptions } from './routesOptions';
 export { createSigningSessionSealOptions, parseSigningSessionSealRootConfig } from './options';
 export { createInMemorySigningSessionSealRateLimiter, createSigningSessionSealRateLimitGuard, } from './guards';
-export { createRedisTcpSigningSessionSealRateLimiter, createUpstashSigningSessionSealRateLimiter, resolveSigningSessionSealRateLimitFromEnv, } from './guards/backends';
-export { createRedisTcpSigningSessionSealIdempotencyStore, createUpstashSigningSessionSealIdempotencyStore, resolveSigningSessionSealIdempotencyFromEnv, } from './idempotencyBackends';
+export { createUpstashSigningSessionSealRateLimiter, } from './guards/backends';
+export { createUpstashSigningSessionSealIdempotencyStore, } from './idempotencyBackends';
 export { composeSigningSessionSealGuards } from './guards';
 export { handleSigningSessionSealRoutes } from './transport/fetch';
 //# sourceMappingURL=index.d.ts.map

package/migrations/d1-signer/0081_registration_directory_publications.sql

@@ -0,0 +1,26 @@
+-- An active registration home whose directory write has no acknowledgement yet.
+-- The batch that completes the registration operation and activates the home
+-- inserts the row; the acknowledgement deletes it. A refused row stays for an operator.
+CREATE TABLE wallet_registration_directory_publications (
+  namespace TEXT NOT NULL, org_id TEXT NOT NULL, project_id TEXT NOT NULL, env_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL,
+  ceremony_id TEXT NOT NULL CHECK(length(ceremony_id) > 0),
+  session_digest TEXT NOT NULL CHECK(length(session_digest) > 0),
+  session_expires_at_ms INTEGER NOT NULL
+    CHECK(session_expires_at_ms > 0 AND session_expires_at_ms <= 9007199254740991),
+  state TEXT NOT NULL DEFAULT 'pending' CHECK(state IN ('pending', 'refused')),
+  attempts INTEGER NOT NULL DEFAULT 0 CHECK(attempts >= 0),
+  next_attempt_at_ms INTEGER NOT NULL CHECK(next_attempt_at_ms > 0),
+  PRIMARY KEY(namespace, org_id, project_id, env_id, wallet_id)
+);
+
+CREATE INDEX wallet_registration_directory_publications_due
+  ON wallet_registration_directory_publications(namespace, org_id, project_id, env_id, state, next_attempt_at_ms);
+
+CREATE TRIGGER wallet_registration_directory_publication_identity
+BEFORE UPDATE ON wallet_registration_directory_publications
+WHEN NEW.wallet_id IS NOT OLD.wallet_id OR NEW.ceremony_id IS NOT OLD.ceremony_id
+  OR NEW.session_digest IS NOT OLD.session_digest
+  OR NEW.session_expires_at_ms IS NOT OLD.session_expires_at_ms
+  OR (OLD.state = 'refused' AND NEW.state != 'refused')
+BEGIN SELECT RAISE(ABORT, 'wallet_registration_directory_publication_conflicts'); END;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seams/wallet-server",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "type": "module",
   "description": "Seams server TypeScript SDK for NEAR and EVM-family wallets",
   "main": "./dist/esm/index.js",

package/dist/esm/router/cloudflare/runtime/createSelfHostedCloudflareSigningWorker.js

@@ -1,93 +0,0 @@
-import { coerceRouterLogger } from "../../framework/logger.js";
-import { json, withCors } from "../../framework/http.js";
-import { handleThresholdEcdsa } from "../../transport/fetch/routes/thresholdEcdsa.js";
-import { handleThresholdEd25519 } from "../../transport/fetch/routes/thresholdEd25519.js";
-import { validateRouterApiRorOptions } from "../../framework/ror/provider.js";
-import "../../framework/routerApi.js";
-//#region src/router/cloudflare/runtime/createSelfHostedCloudflareSigningWorker.ts
-function notFound() {
-	return new Response("Not Found", { status: 404 });
-}
-function selfHostedHealthResponse(ctx) {
-	if (ctx.method !== "GET") return null;
-	if (ctx.pathname !== "/healthz" && ctx.pathname !== "/readyz") return null;
-	if (ctx.pathname === "/healthz" && !ctx.opts.healthz) return null;
-	if (ctx.pathname === "/readyz" && !ctx.opts.readyz) return null;
-	return json({
-		ok: true,
-		selfHosted: true,
-		threshold: { configured: Boolean(ctx.opts.routerAbNormalSigningRouterProxy) }
-	}, { status: 200 });
-}
-function createSelfHostedContext(input) {
-	const url = new URL(input.request.url);
-	return {
-		request: input.request,
-		url,
-		pathname: url.pathname,
-		method: input.request.method.toUpperCase(),
-		runtime: input.cfCtx ? {
-			kind: "background",
-			waitUntil: (promise) => input.cfCtx?.waitUntil(promise)
-		} : { kind: "inline" },
-		service: input.service,
-		opts: input.opts,
-		logger: input.logger,
-		routeDefinitions: []
-	};
-}
-function createSelfHostedCloudflareSigningRouter(service, opts = {}) {
-	const sessionCookieName = String(opts.sessionCookieName || "").trim() || "seams-jwt";
-	const effectiveOpts = {
-		...opts,
-		sessionCookieName
-	};
-	if (effectiveOpts.ror) validateRouterApiRorOptions(effectiveOpts.ror);
-	const logger = coerceRouterLogger(effectiveOpts.logger);
-	const handler = async (request, _env, cfCtx) => {
-		if (request.method.toUpperCase() === "OPTIONS") {
-			const res = new Response(null, { status: 204 });
-			withCors(res.headers, effectiveOpts, request);
-			return res;
-		}
-		const ctx = createSelfHostedContext({
-			request,
-			cfCtx,
-			service,
-			opts: effectiveOpts,
-			logger
-		});
-		try {
-			const response = selfHostedHealthResponse(ctx) || await handleThresholdEd25519(ctx) || await handleThresholdEcdsa(ctx) || notFound();
-			withCors(response.headers, effectiveOpts, request);
-			return response;
-		} catch (error) {
-			const res = json({
-				code: "internal",
-				message: error instanceof Error ? error.message : String(error)
-			}, { status: 500 });
-			withCors(res.headers, effectiveOpts, request);
-			return res;
-		}
-	};
-	return handler;
-}
-function createSelfHostedCloudflareSigningWorker(input) {
-	return { async fetch(request, env, ctx) {
-		const service = await input.createAuthService({
-			request,
-			env,
-			ctx
-		});
-		return createSelfHostedCloudflareSigningRouter(service, typeof input.routerOptions === "function" ? await input.routerOptions({
-			request,
-			env,
-			ctx,
-			service
-		}) : input.routerOptions || {})(request, env, ctx);
-	} };
-}
-//#endregion
-export { createSelfHostedCloudflareSigningRouter, createSelfHostedCloudflareSigningWorker };
-
-//# sourceMappingURL=createSelfHostedCloudflareSigningWorker.js.map

package/dist/types/wallet-server/src/router/cloudflare/runtime/createSelfHostedCloudflareSigningWorker.d.ts

@@ -1,23 +0,0 @@
-import type { RouterApiServiceBag } from '../../framework/authServicePort';
-import type { RouterApiOptions } from '../../framework/routerApi';
-import type { CfEnv, CfExecutionContext, FetchHandler } from './cloudflare.types';
-type SelfHostedWorker<Env> = {
-    fetch(request: Request, env: Env, ctx: CfExecutionContext): Promise<Response>;
-};
-export type SelfHostedCloudflareSigningWorkerFactoryInput<Env extends CfEnv = CfEnv> = {
-    readonly createAuthService: (input: {
-        readonly request: Request;
-        readonly env: Env;
-        readonly ctx: CfExecutionContext;
-    }) => RouterApiServiceBag | Promise<RouterApiServiceBag>;
-    readonly routerOptions?: RouterApiOptions | ((input: {
-        readonly request: Request;
-        readonly env: Env;
-        readonly ctx: CfExecutionContext;
-        readonly service: RouterApiServiceBag;
-    }) => RouterApiOptions | Promise<RouterApiOptions>);
-};
-export declare function createSelfHostedCloudflareSigningRouter(service: RouterApiServiceBag, opts?: RouterApiOptions): FetchHandler;
-export declare function createSelfHostedCloudflareSigningWorker<Env extends CfEnv = CfEnv>(input: SelfHostedCloudflareSigningWorkerFactoryInput<Env>): SelfHostedWorker<Env>;
-export {};
-//# sourceMappingURL=createSelfHostedCloudflareSigningWorker.d.ts.map