@seams/wallet-server 0.9.3 → 0.10.0

package/dist/types/wallet-server/src/router/domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationRequestScopedRuntime.d.ts

@@ -8,7 +8,7 @@ export type RouterAbEd25519YaoProductRegistrationRequestScopedRuntimeInputV1 = {
     readonly store: RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1;
     /** The Router, which owns each registration's execution and its consumption. */
     readonly registrationBackend: RouterAbEd25519YaoPinnedRegistrationBackend;
-    /** Loads one canonical signer record for an existing-wallet capability miss. */
+    /** Loads the canonical signer record of a capability lookup. */
     readonly loadPersistedActiveCapability?: (input: RouterAbEd25519YaoActiveCapabilityLookupV1) => Promise<WalletEd25519YaoActiveCapabilityRecord | null>;
 };
 /**

package/dist/types/wallet-server/src/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.d.ts

@@ -372,6 +372,13 @@ type RouterAbEd25519YaoWarmRecoveryBootstrapV1 = RouterAbEd25519YaoExactRecovery
 export interface RouterAbEd25519YaoActiveCapabilityResolverV1 {
     resolveActiveCapability(input: RouterAbEd25519YaoActiveCapabilityLookupV1): Promise<RouterAbEd25519YaoActiveCapabilityLookupResultV1> | RouterAbEd25519YaoActiveCapabilityLookupResultV1;
 }
+/**
+ * Stores a wallet's signer-row capability in the recovery state, so that a
+ * recovery admission can suspend it. A lookup alone stores nothing.
+ */
+export interface RouterAbEd25519YaoActiveCapabilityRehydratorV1 {
+    rehydrateActiveCapability(input: RouterAbEd25519YaoActiveCapabilityLookupV1): Promise<RouterAbEd25519YaoActiveCapabilityLookupResultV1> | RouterAbEd25519YaoActiveCapabilityLookupResultV1;
+}
 type CapabilityIdentity = {
     readonly capabilityBinding: RouterAbEd25519YaoBytes32V1;
     readonly nearAccountId: string;

package/dist/types/wallet-server/src/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecoveryRequestScopedCloudflare.d.ts

@@ -1,5 +1,5 @@
 import { type WalletLifecycleRoutingPublisher } from '../../../../authorization/lifecycleRouting';
-import { type RouterAbEd25519YaoCapabilityPersistenceV1, type RouterAbEd25519YaoRecoveryAuthorizationAdapter, type RouterAbEd25519YaoRecoveryBackend, type RouterAbEd25519YaoActiveCapabilityResolverV1, type WarmBootstrapLinkedEd25519AuthorityReaderV1 } from './routerAbEd25519YaoRecovery';
+import { type RouterAbEd25519YaoCapabilityPersistenceV1, type RouterAbEd25519YaoRecoveryAuthorizationAdapter, type RouterAbEd25519YaoRecoveryBackend, type RouterAbEd25519YaoActiveCapabilityRehydratorV1, type RouterAbEd25519YaoActiveCapabilityResolverV1, type WarmBootstrapLinkedEd25519AuthorityReaderV1 } from './routerAbEd25519YaoRecovery';
 export type { WarmBootstrapLinkedEd25519AuthorityReaderV1 } from './routerAbEd25519YaoRecovery';
 import type { RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1 } from '../capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore';
 export type RouterAbEd25519YaoRecoveryRequestScopedCloudflareInputV1 = {
@@ -9,7 +9,7 @@ export type RouterAbEd25519YaoRecoveryRequestScopedCloudflareInputV1 = {
     readonly backend: RouterAbEd25519YaoRecoveryBackend;
     readonly authorization: RouterAbEd25519YaoRecoveryAuthorizationAdapter;
     readonly capabilityPersistence: RouterAbEd25519YaoCapabilityPersistenceV1;
-    readonly capabilities: RouterAbEd25519YaoActiveCapabilityResolverV1;
+    readonly capabilities: RouterAbEd25519YaoActiveCapabilityResolverV1 & RouterAbEd25519YaoActiveCapabilityRehydratorV1;
     readonly linkedAuthorities?: WarmBootstrapLinkedEd25519AuthorityReaderV1 | null;
 };
 export declare function handleRouterAbEd25519YaoRecoveryRequestScopedCloudflareV1(input: RouterAbEd25519YaoRecoveryRequestScopedCloudflareInputV1): Promise<Response>;

package/dist/types/wallet-server/src/router/domains/ed25519Yao/registration/routerAbEd25519YaoHttpRegistrationBackend.d.ts

@@ -1,5 +1,6 @@
+import { type WalletObjectIdentity } from '../../../cloudflare/runtime/walletObjectAddresses';
 import type { RouterAbEd25519YaoRegistrationExecutionAuthorityV1 } from './routerAbEd25519YaoRegistrationExecutionRecord';
-import { type RouterAbEd25519YaoActivationExecuteRequestV1, type RouterAbEd25519YaoActivationKeysetV1, type RouterAbEd25519YaoRecoveryActivationRequestV1, type RouterAbEd25519YaoRecoveryAdmissionRequestV1, type RouterAbEd25519YaoRegistrationAdmissionRequestV1, type RouterAbEd25519YaoExportAdmissionRequestV1, type RouterAbEd25519YaoExportExecuteRequestV1 } from '../../../../../../shared-ts/src/utils/routerAbEd25519Yao';
+import { type RouterAbEd25519YaoBytes32V1, type RouterAbEd25519YaoActivationAdmissionReceiptV1, type RouterAbEd25519YaoActivationExecuteRequestV1, type RouterAbEd25519YaoActivationKeysetV1, type RouterAbEd25519YaoRecoveryActivationRequestV1, type RouterAbEd25519YaoRecoveryAdmissionRequestV1, type RouterAbEd25519YaoRegistrationAdmissionRequestV1, type RouterAbEd25519YaoExportAdmissionRequestV1, type RouterAbEd25519YaoExportExecuteRequestV1 } from '../../../../../../shared-ts/src/utils/routerAbEd25519Yao';
 import type { RouterAbEd25519YaoRegistrationBackend, RouterAbEd25519YaoRegistrationBackendResult } from './routerAbEd25519YaoRegistration';
 import type { RouterAbEd25519YaoExportBackend, RouterAbEd25519YaoExportExecuteClaimV1 } from '../export/routerAbEd25519YaoExport';
 import type { RouterAbEd25519YaoRecoveryBackend, RouterAbEd25519YaoRecoveryExecuteClaimV1 } from '../recovery/routerAbEd25519YaoRecovery';
@@ -57,7 +58,8 @@ export declare class RouterAbEd25519YaoHttpRegistrationBackend implements Router
     private lastRouterServerTiming;
     constructor(config: RouterAbEd25519YaoHttpRegistrationBackendConfig);
     takeLastRouterServerTiming(): string | null;
-    admit(request: RouterAbEd25519YaoRegistrationAdmissionRequestV1, _traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationBackendResult>;
+    prepareRegistrationPair(identity: WalletObjectIdentity, request: RouterAbEd25519YaoRegistrationAdmissionRequestV1, receipt: RouterAbEd25519YaoActivationAdmissionReceiptV1<'registration'>, expiresAtMs: number): Promise<void>;
+    admit(request: RouterAbEd25519YaoRegistrationAdmissionRequestV1, _traceContext?: RouterAbTraceContextV1, mintedSessionId?: RouterAbEd25519YaoBytes32V1): Promise<RouterAbEd25519YaoRegistrationBackendResult>;
     admitRecovery(request: RouterAbEd25519YaoRecoveryAdmissionRequestV1, _traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationBackendResult>;
     admitExport(request: RouterAbEd25519YaoExportAdmissionRequestV1, _traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationBackendResult>;
     executeExport(request: RouterAbEd25519YaoExportExecuteRequestV1, claim: RouterAbEd25519YaoExportExecuteClaimV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationBackendResult>;
@@ -81,6 +83,6 @@ export declare function createRouterAbEd25519YaoHttpRegistrationBackendFromEnv(i
     resolveTenantRoot: RouterAbEd25519YaoTenantRootResolverV1;
     onSpan?: (span: RouterAbEd25519YaoGatewaySpanV1) => void;
     fetch: typeof fetch;
-}): RouterAbEd25519YaoPinnedRegistrationBackend & RouterAbEd25519YaoRecoveryBackend & RouterAbEd25519YaoExportBackend;
+}): RouterAbEd25519YaoHttpRegistrationBackend;
 export {};
 //# sourceMappingURL=routerAbEd25519YaoHttpRegistrationBackend.d.ts.map

package/dist/types/wallet-server/src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistration.d.ts

@@ -30,11 +30,16 @@ export type RouterAbEd25519YaoRegistrationBackendResult = {
 } | RouterAbEd25519YaoRegistrationBackendFailure;
 export interface RouterAbEd25519YaoRegistrationBackend {
     takeLastRouterServerTiming?(): string | null;
-    admit(request: RouterAbEd25519YaoRegistrationAdmissionRequestV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationBackendResult> | RouterAbEd25519YaoRegistrationBackendResult;
+    /**
+     * Issues the admission receipt. A registration passes the session that its
+     * setup minted, and the receipt is over that session. Without one the
+     * backend mints the session here.
+     */
+    admit(request: RouterAbEd25519YaoRegistrationAdmissionRequestV1, traceContext?: RouterAbTraceContextV1, mintedSessionId?: RouterAbEd25519YaoBytes32V1): Promise<RouterAbEd25519YaoRegistrationBackendResult> | RouterAbEd25519YaoRegistrationBackendResult;
     execute(request: RouterAbEd25519YaoRegistrationExecuteRequestV1, admissionRequest: RouterAbEd25519YaoRegistrationExecuteAdmissionContextV1, ownershipGeneration: number, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationBackendResult> | RouterAbEd25519YaoRegistrationBackendResult;
 }
 export interface RouterAbEd25519YaoRegistrationService {
-    admit(request: RouterAbEd25519YaoRegistrationAdmissionRequestV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationServiceResult<RouterAbEd25519YaoRegistrationAdmissionReceiptV1>>;
+    admit(request: RouterAbEd25519YaoRegistrationAdmissionRequestV1, traceContext?: RouterAbTraceContextV1, mintedSessionId?: RouterAbEd25519YaoBytes32V1): Promise<RouterAbEd25519YaoRegistrationServiceResult<RouterAbEd25519YaoRegistrationAdmissionReceiptV1>>;
     execute(request: RouterAbEd25519YaoRegistrationExecuteRequestV1, ownershipGeneration: number, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationServiceResult<RouterAbEd25519YaoRegistrationResultV1>>;
 }
 export type RouterAbEd25519YaoRegistrationAdmissionClaimV1 = {
@@ -181,6 +186,16 @@ export interface RouterAbEd25519YaoActivationConsumerV1 {
     consumeActivated(request: RouterAbEd25519YaoActivationConsumptionRequestV1): Promise<RouterAbEd25519YaoActivationConsumptionResultV1> | RouterAbEd25519YaoActivationConsumptionResultV1;
 }
 export declare function encodeRouterAbEd25519YaoRegistrationAdmissionFingerprintV1(request: RouterAbEd25519YaoRegistrationAdmissionRequestV1): string;
+/**
+ * The receipt that `backend` issues for `request` over the session that setup
+ * minted, checked as an admission checks it. It stores nothing and admits
+ * nothing: the admission still follows the verified proof.
+ */
+export declare function describeRouterAbEd25519YaoRegistrationAdmissionV1(input: {
+    readonly backend: RouterAbEd25519YaoRegistrationBackend;
+    readonly request: RouterAbEd25519YaoRegistrationAdmissionRequestV1;
+    readonly mintedSessionId: RouterAbEd25519YaoBytes32V1;
+}): Promise<RouterAbEd25519YaoRegistrationServiceResult<RouterAbEd25519YaoRegistrationAdmissionReceiptV1>>;
 export declare function routerAbEd25519YaoExecutionMatchesAdmissionV1(request: RouterAbEd25519YaoRegistrationExecuteRequestV1, receipt: RouterAbEd25519YaoRegistrationAdmissionReceiptV1): boolean;
 export declare function createRouterAbEd25519YaoRegistrationModule(input: {
     service: RouterAbEd25519YaoRegistrationService;
@@ -192,7 +207,7 @@ export declare class InMemoryRouterAbEd25519YaoRegistrationService implements Ro
     private readonly lifecycleSessions;
     private readonly admissionClaims;
     constructor(backend: RouterAbEd25519YaoRegistrationBackend, state?: InMemoryRouterAbEd25519YaoRegistrationStateV1);
-    admit(request: RouterAbEd25519YaoRegistrationAdmissionRequestV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationServiceResult<RouterAbEd25519YaoRegistrationAdmissionReceiptV1>>;
+    admit(request: RouterAbEd25519YaoRegistrationAdmissionRequestV1, traceContext?: RouterAbTraceContextV1, mintedSessionId?: RouterAbEd25519YaoBytes32V1): Promise<RouterAbEd25519YaoRegistrationServiceResult<RouterAbEd25519YaoRegistrationAdmissionReceiptV1>>;
     prepareAdmit(request: RouterAbEd25519YaoRegistrationAdmissionRequestV1): RouterAbEd25519YaoRegistrationAdmissionPreparationV1;
     commitAdmit(input: RouterAbEd25519YaoRegistrationAdmissionCommitInputV1): RouterAbEd25519YaoRegistrationServiceResult<RouterAbEd25519YaoRegistrationAdmissionReceiptV1>;
     execute(request: RouterAbEd25519YaoRegistrationExecuteRequestV1, ownershipGeneration: number, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationServiceResult<RouterAbEd25519YaoRegistrationResultV1>>;

package/dist/types/wallet-server/src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationIntentAuthorization.d.ts

@@ -68,6 +68,8 @@ type RouterAbEd25519YaoBearerCredentialDigestResultV1 = {
 };
 export declare function routerAbEd25519YaoBearerCredentialDigestV1(request: Request): Promise<RouterAbEd25519YaoBearerCredentialDigestResultV1>;
 export declare function routerAbEd25519YaoCredentialDigestHexV1(digest: Uint8Array): string;
+/** The digest that an admission binds for the credential of its registration intent. */
+export declare function routerAbEd25519YaoCredentialDigestSha256HexV1(credential: string): Promise<string>;
 export declare class InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationStateV1 {
     readonly authorities: IntentAuthority[];
 }

package/dist/types/wallet-server/src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationRequestScopedCloudflare.d.ts

@@ -1,4 +1,7 @@
 import type { VerifiedNearRegistrationContinuationV1 } from './routerAbEd25519YaoRegistrationIntentAuthorization';
+import { type RouterAbEd25519YaoActivationExecuteRequestV1, type RouterAbEd25519YaoActivationResultV1 } from '../../../../../../shared-ts/src/utils/routerAbEd25519Yao';
+import { type RouterAbTraceContextV1 } from '../../../../../../shared-ts/src/utils/routerAbTraceContext';
+import type { RouterAbEd25519YaoRegistrationServiceResult } from './routerAbEd25519YaoRegistration';
 import type { RouterAbEd25519YaoPinnedRegistrationBackend } from './routerAbEd25519YaoHttpRegistrationBackend';
 import { type RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1 } from '../capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore';
 export type RouterAbEd25519YaoRegistrationRequestScopedCloudflareInputV1 = {
@@ -10,5 +13,41 @@ export type RouterAbEd25519YaoRegistrationRequestScopedCloudflareInputV1 = {
     readonly store: RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1;
     readonly backend: RouterAbEd25519YaoPinnedRegistrationBackend;
 };
+type RouterAbEd25519YaoRegistrationExecuteRequestV1 = RouterAbEd25519YaoActivationExecuteRequestV1<'registration'>;
+type RouterAbEd25519YaoRegistrationResultV1 = RouterAbEd25519YaoActivationResultV1<'registration'>;
+type AuthorizationFailure = {
+    readonly ok: false;
+    readonly status: 401 | 403 | 409 | 429 | 503;
+    readonly code: string;
+    readonly message: string;
+};
+type RegistrationExecutionTimingV1 = {
+    readonly credentialDigestMs: number;
+    readonly d1AdmissionReadMs: number;
+    readonly routerExecutionMs: number;
+    readonly routerServerTiming: string | null;
+    readonly resultReconstructionMs: number;
+};
+export type RouterAbEd25519YaoTimedRegistrationExecutionResultV1 = {
+    readonly result: RouterAbEd25519YaoRegistrationServiceResult<RouterAbEd25519YaoRegistrationResultV1> | AuthorizationFailure;
+    readonly timing: RegistrationExecutionTimingV1;
+};
 export declare function handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1(input: RouterAbEd25519YaoRegistrationRequestScopedCloudflareInputV1): Promise<Response>;
+/**
+ * Runs one admitted registration for the holder of its credential. The
+ * execute route takes the credential from its bearer. A respond that carries
+ * the execute request takes it from the signed setup that it just verified.
+ */
+export declare function executeRouterAbEd25519YaoAdmittedRegistrationV1(input: Pick<RouterAbEd25519YaoRegistrationRequestScopedCloudflareInputV1, 'store' | 'backend'> & {
+    readonly request: RouterAbEd25519YaoRegistrationExecuteRequestV1;
+    readonly credentialDigestSha256Hex: string;
+    readonly credentialDigestMs: number;
+    readonly trace: RouterAbTraceContextV1;
+}): Promise<RouterAbEd25519YaoTimedRegistrationExecutionResultV1>;
+/**
+ * The timing of one execution as Server-Timing entries, for a route that
+ * reports them in its own header: a respond that ran the execution.
+ */
+export declare function routerAbEd25519YaoRegistrationExecutionTimingEntriesV1(timing: RouterAbEd25519YaoTimedRegistrationExecutionResultV1['timing']): Array<readonly [string, number]>;
+export {};
 //# sourceMappingURL=routerAbEd25519YaoRegistrationRequestScopedCloudflare.d.ts.map

package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationInputs.d.ts

@@ -3,6 +3,7 @@ import type { RegistrationSignerSetSelection } from '../../../../../shared-ts/sr
 import type { RegistrationEstablishedSessionProjectionV2 } from '../../../../../shared-ts/src/utils/registrationEstablishedSession';
 import type { RegisterWalletInput, RegistrationAuthMethodInput } from '../../../../../shared-ts/src/utils/registrationAuthMethodInput';
 import type { RouterAbEcdsaRegistrationRequestV1, RouterAbEcdsaVerifiedClientActivationFactsV1 } from '../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
+import type { RouterAbEd25519YaoActivationExecuteRequestV1 } from '../../../../../shared-ts/src/utils/routerAbEd25519Yao';
 import type { WalletRegistrationAuthorityInput, WalletRegistrationFinalizeSignerWork } from '../../../core/registrationContracts';
 import type { ThresholdRuntimePolicyScope } from '../../../core/types';
 import type { WalletRegistrationSetupMinter, WalletRegistrationSetupVerifier } from './walletRegistrationSetupPayload';
@@ -33,6 +34,11 @@ export type WalletRegistrationRespondInput = {
         readonly strictRegistration: RouterAbEcdsaRegistrationRequestV1;
         readonly requestDigestB64u: string;
     };
+    /**
+     * The execute request of an Ed25519-only plan, prepared from the admission
+     * that setup described. Respond admits, then runs it in the same request.
+     */
+    readonly ed25519Execution?: RouterAbEd25519YaoActivationExecuteRequestV1<'registration'>;
     /** Verifies the opaque setup token before authority-bound work begins. */
     readonly verifier: WalletRegistrationSetupVerifier;
     readonly userAgent?: string;

package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationReservation.d.ts

@@ -1,9 +1,11 @@
+import type { Variant } from '../../../../../shared-ts/src/utils/variant';
 import type { WalletSessionLocatorPublication } from '../../../authorization/sessionRouting';
 import type { CommittedWalletRegistration } from '../../../authorization/domain';
 import type { D1PreparedStatementLike } from '../../../storage/tenantRoute';
 import { type DeviceId } from '../../../../../shared-ts/src/authorization/capabilityKinds';
 import { type WalletAuthorityId, type WalletAuthMethodId, type WalletId } from '../../../../../shared-ts/src/utils/domainIds';
 import type { WalletRegistrationSetupInput } from './walletRegistrationInputs';
+import type { RouterAbEd25519YaoActivationAdmissionReceiptV1, RouterAbEd25519YaoRegistrationAdmissionRequestV1 } from '../../../../../shared-ts/src/utils/routerAbEd25519Yao';
 export type WalletRegistrationSetupReservation = {
     readonly walletId: WalletId;
     readonly ceremonyId: string;
@@ -30,10 +32,22 @@ export type WalletRegistrationSetupReservationResult = {
     readonly lifecycle?: never;
 };
 /** Persist custody addresses before setup completes, then start the reserved wallet objects. */
-export type RegistrationWalletStarter = (registration: {
+export type RegistrationWalletStartup = {
     readonly walletId: WalletId;
     readonly ownershipGeneration: number;
-}) => Promise<void>;
+} & ({
+    readonly kind: 'objects';
+    readonly admissionRequest?: never;
+    readonly admissionReceipt?: never;
+    readonly expiresAtMs?: never;
+} | {
+    readonly kind: 'pair';
+    readonly admissionRequest: RouterAbEd25519YaoRegistrationAdmissionRequestV1;
+    readonly admissionReceipt: RouterAbEd25519YaoActivationAdmissionReceiptV1<'registration'>;
+    readonly expiresAtMs: number;
+});
+export type RegistrationPairStartup = Variant<RegistrationWalletStartup, 'kind', 'pair'>;
+export type RegistrationWalletStarter = (registration: RegistrationWalletStartup) => Promise<void>;
 type ReservationOutcome = {
     readonly ok: true;
 } | {

package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationRoutes.d.ts

@@ -21,6 +21,7 @@ type RouterApiWalletRegistrationServices = {
     session?: SessionAdapter | null;
     publishableKeyAuth?: RouterApiPublishableKeyAuthAdapter | null;
     registrationContext?: WalletRegistrationContextResolver | null;
+    registrationSetupRateLimit?: import('../../framework/registrationSetupRateLimit').RegistrationSetupRateLimit;
 };
 type RouterApiWalletRegistrationInput = {
     body: unknown;

package/dist/types/wallet-server/src/router/framework/registrationSetupRateLimit.d.ts

@@ -0,0 +1,11 @@
+export type RegistrationSetupRateLimitInput = {
+    readonly apiKeyId: string;
+    readonly orgId: string;
+    readonly projectId: string;
+    readonly envId: string;
+    readonly sourceIp: string;
+};
+export type RegistrationSetupRateLimit = (input: RegistrationSetupRateLimitInput) => Promise<{
+    readonly allowed: boolean;
+}>;
+//# sourceMappingURL=registrationSetupRateLimit.d.ts.map

package/dist/types/wallet-server/src/router/framework/routerApi.d.ts

@@ -157,6 +157,7 @@ export interface RouterApiOptions {
     publishableKeyAuth?: RouterApiPublishableKeyAuthAdapter | null;
     /** Fresh credential and active-environment resolution for registration setup. */
     registrationContext?: WalletRegistrationContextResolver | null;
+    registrationSetupRateLimit?: import('./registrationSetupRateLimit').RegistrationSetupRateLimit;
     /**
      * Optional Router API usage-meter adapter used to emit host runtime events.
      */

package/dist/types/wallet-server/src/storage/d1Retry.d.ts

@@ -0,0 +1,10 @@
+export declare function isTransientD1Error(error: unknown): boolean;
+/**
+ * Runs `operation` again after a transient D1 fault. Such a fault does not say
+ * whether a write committed, so `operation` must give the same result when it
+ * runs after its own earlier commit: reads, `INSERT OR IGNORE`, and conditional
+ * writes that accept their own outcome. It must build its statements on each
+ * run. Every other error, and the last transient one, reaches the caller.
+ */
+export declare function retryTransientD1<T>(operation: () => Promise<T>): Promise<T>;
+//# sourceMappingURL=d1Retry.d.ts.map

package/migrations/d1-signer/0079_tenant_lookup_indexes.sql

@@ -0,0 +1,33 @@
+-- Lookups that had no usable index and read every session or every wallet of
+-- a tenant. Each index below serves statements that already exist; no
+-- statement changes its result.
+--
+-- Without statistics the planner expects about ten rows behind the first
+-- column of any index. An index that covers a lookup therefore wins over a
+-- narrower one that needs the table row, although its first column is the
+-- namespace, which every row shares. The two session indexes carry the columns
+-- that their lookups read so that the planner selects them.
+
+-- The operation triggers find the session that owns an operation through
+-- wallet_operation_authorizations with the namespace, the tenant and the
+-- authorization only. The primary key has org_id, project_id and env_id before
+-- tenant_id, and the triggers compare those three inside an OR, so the key
+-- gave a namespace prefix and the triggers read every session.
+CREATE INDEX wallet_session_authorizations_v2_tenant_authorization_idx
+  ON wallet_session_authorizations_v2 (
+    namespace, tenant_id, authorization_id, org_id, project_id, env_id, wallet_id
+  );
+
+-- The quota freeze triggers find the session of a quota with the namespace,
+-- the tenant, the quota and the wallet session only.
+CREATE INDEX wallet_session_authorizations_v2_tenant_quota_idx
+  ON wallet_session_authorizations_v2 (
+    namespace, tenant_id, quota_id, wallet_session_id, org_id, project_id, env_id, wallet_id
+  );
+
+-- The registration cancellation fences and the Gateway admission find a wallet
+-- by its registration ceremony. wallet_id is last so that the first match is
+-- the one the primary key order gave, and so that the admission reads the
+-- index only.
+CREATE INDEX wallet_execution_generations_origin_idx
+  ON wallet_execution_generations (namespace, org_id, project_id, env_id, origin, origin_id, wallet_id);

package/migrations/d1-signer/0080_registration_setup_rate_limits.sql

@@ -0,0 +1,11 @@
+CREATE TABLE registration_setup_rate_limits (
+    namespace TEXT NOT NULL,
+    org_id TEXT NOT NULL,
+    project_id TEXT NOT NULL,
+    env_id TEXT NOT NULL,
+    rate_key TEXT NOT NULL,
+    consumed_count INTEGER NOT NULL CHECK (consumed_count BETWEEN 1 AND 30),
+    reset_at_ms INTEGER NOT NULL,
+    PRIMARY KEY (namespace, org_id, project_id, env_id, rate_key)
+);
+CREATE INDEX registration_setup_rate_limits_expiry ON registration_setup_rate_limits (reset_at_ms);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seams/wallet-server",
-  "version": "0.9.3",
+  "version": "0.10.0",
   "type": "module",
   "description": "Seams server TypeScript SDK for NEAR and EVM-family wallets",
   "main": "./dist/esm/index.js",

package/src/README.md

@@ -23,7 +23,7 @@ authentication is intentionally outside this package.
 ## Primary wallet routes
 
 Wallet-management routes (registration, signer setup/inventory, auth-method
-management and implicit NEAR funding) require `X-Seams-Wallet-Protocol: 3`.
+management and implicit NEAR funding) require `X-Seams-Wallet-Protocol: 4`.
 Missing or unsupported values return HTTP 409, `wallet_protocol_mismatch`, with
 reload/upgrade instructions before parsing the body or invoking route services.
 The current Wallet SDK sends this header automatically. Direct HTTP clients,