@seams/wallet-server 0.9.4 → 0.10.0

package/dist/types/wallet-server/src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistration.d.ts

@@ -30,11 +30,16 @@ export type RouterAbEd25519YaoRegistrationBackendResult = {
 } | RouterAbEd25519YaoRegistrationBackendFailure;
 export interface RouterAbEd25519YaoRegistrationBackend {
     takeLastRouterServerTiming?(): string | null;
-    admit(request: RouterAbEd25519YaoRegistrationAdmissionRequestV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationBackendResult> | RouterAbEd25519YaoRegistrationBackendResult;
+    /**
+     * Issues the admission receipt. A registration passes the session that its
+     * setup minted, and the receipt is over that session. Without one the
+     * backend mints the session here.
+     */
+    admit(request: RouterAbEd25519YaoRegistrationAdmissionRequestV1, traceContext?: RouterAbTraceContextV1, mintedSessionId?: RouterAbEd25519YaoBytes32V1): Promise<RouterAbEd25519YaoRegistrationBackendResult> | RouterAbEd25519YaoRegistrationBackendResult;
     execute(request: RouterAbEd25519YaoRegistrationExecuteRequestV1, admissionRequest: RouterAbEd25519YaoRegistrationExecuteAdmissionContextV1, ownershipGeneration: number, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationBackendResult> | RouterAbEd25519YaoRegistrationBackendResult;
 }
 export interface RouterAbEd25519YaoRegistrationService {
-    admit(request: RouterAbEd25519YaoRegistrationAdmissionRequestV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationServiceResult<RouterAbEd25519YaoRegistrationAdmissionReceiptV1>>;
+    admit(request: RouterAbEd25519YaoRegistrationAdmissionRequestV1, traceContext?: RouterAbTraceContextV1, mintedSessionId?: RouterAbEd25519YaoBytes32V1): Promise<RouterAbEd25519YaoRegistrationServiceResult<RouterAbEd25519YaoRegistrationAdmissionReceiptV1>>;
     execute(request: RouterAbEd25519YaoRegistrationExecuteRequestV1, ownershipGeneration: number, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationServiceResult<RouterAbEd25519YaoRegistrationResultV1>>;
 }
 export type RouterAbEd25519YaoRegistrationAdmissionClaimV1 = {
@@ -181,6 +186,16 @@ export interface RouterAbEd25519YaoActivationConsumerV1 {
     consumeActivated(request: RouterAbEd25519YaoActivationConsumptionRequestV1): Promise<RouterAbEd25519YaoActivationConsumptionResultV1> | RouterAbEd25519YaoActivationConsumptionResultV1;
 }
 export declare function encodeRouterAbEd25519YaoRegistrationAdmissionFingerprintV1(request: RouterAbEd25519YaoRegistrationAdmissionRequestV1): string;
+/**
+ * The receipt that `backend` issues for `request` over the session that setup
+ * minted, checked as an admission checks it. It stores nothing and admits
+ * nothing: the admission still follows the verified proof.
+ */
+export declare function describeRouterAbEd25519YaoRegistrationAdmissionV1(input: {
+    readonly backend: RouterAbEd25519YaoRegistrationBackend;
+    readonly request: RouterAbEd25519YaoRegistrationAdmissionRequestV1;
+    readonly mintedSessionId: RouterAbEd25519YaoBytes32V1;
+}): Promise<RouterAbEd25519YaoRegistrationServiceResult<RouterAbEd25519YaoRegistrationAdmissionReceiptV1>>;
 export declare function routerAbEd25519YaoExecutionMatchesAdmissionV1(request: RouterAbEd25519YaoRegistrationExecuteRequestV1, receipt: RouterAbEd25519YaoRegistrationAdmissionReceiptV1): boolean;
 export declare function createRouterAbEd25519YaoRegistrationModule(input: {
     service: RouterAbEd25519YaoRegistrationService;
@@ -192,7 +207,7 @@ export declare class InMemoryRouterAbEd25519YaoRegistrationService implements Ro
     private readonly lifecycleSessions;
     private readonly admissionClaims;
     constructor(backend: RouterAbEd25519YaoRegistrationBackend, state?: InMemoryRouterAbEd25519YaoRegistrationStateV1);
-    admit(request: RouterAbEd25519YaoRegistrationAdmissionRequestV1, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationServiceResult<RouterAbEd25519YaoRegistrationAdmissionReceiptV1>>;
+    admit(request: RouterAbEd25519YaoRegistrationAdmissionRequestV1, traceContext?: RouterAbTraceContextV1, mintedSessionId?: RouterAbEd25519YaoBytes32V1): Promise<RouterAbEd25519YaoRegistrationServiceResult<RouterAbEd25519YaoRegistrationAdmissionReceiptV1>>;
     prepareAdmit(request: RouterAbEd25519YaoRegistrationAdmissionRequestV1): RouterAbEd25519YaoRegistrationAdmissionPreparationV1;
     commitAdmit(input: RouterAbEd25519YaoRegistrationAdmissionCommitInputV1): RouterAbEd25519YaoRegistrationServiceResult<RouterAbEd25519YaoRegistrationAdmissionReceiptV1>;
     execute(request: RouterAbEd25519YaoRegistrationExecuteRequestV1, ownershipGeneration: number, traceContext?: RouterAbTraceContextV1): Promise<RouterAbEd25519YaoRegistrationServiceResult<RouterAbEd25519YaoRegistrationResultV1>>;

package/dist/types/wallet-server/src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationIntentAuthorization.d.ts

@@ -68,6 +68,8 @@ type RouterAbEd25519YaoBearerCredentialDigestResultV1 = {
 };
 export declare function routerAbEd25519YaoBearerCredentialDigestV1(request: Request): Promise<RouterAbEd25519YaoBearerCredentialDigestResultV1>;
 export declare function routerAbEd25519YaoCredentialDigestHexV1(digest: Uint8Array): string;
+/** The digest that an admission binds for the credential of its registration intent. */
+export declare function routerAbEd25519YaoCredentialDigestSha256HexV1(credential: string): Promise<string>;
 export declare class InMemoryRouterAbEd25519YaoRegistrationIntentAuthorizationStateV1 {
     readonly authorities: IntentAuthority[];
 }

package/dist/types/wallet-server/src/router/domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationRequestScopedCloudflare.d.ts

@@ -1,4 +1,7 @@
 import type { VerifiedNearRegistrationContinuationV1 } from './routerAbEd25519YaoRegistrationIntentAuthorization';
+import { type RouterAbEd25519YaoActivationExecuteRequestV1, type RouterAbEd25519YaoActivationResultV1 } from '../../../../../../shared-ts/src/utils/routerAbEd25519Yao';
+import { type RouterAbTraceContextV1 } from '../../../../../../shared-ts/src/utils/routerAbTraceContext';
+import type { RouterAbEd25519YaoRegistrationServiceResult } from './routerAbEd25519YaoRegistration';
 import type { RouterAbEd25519YaoPinnedRegistrationBackend } from './routerAbEd25519YaoHttpRegistrationBackend';
 import { type RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1 } from '../capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore';
 export type RouterAbEd25519YaoRegistrationRequestScopedCloudflareInputV1 = {
@@ -10,5 +13,41 @@ export type RouterAbEd25519YaoRegistrationRequestScopedCloudflareInputV1 = {
     readonly store: RouterAbEd25519YaoProductRegistrationPartitionedStateStoreV1;
     readonly backend: RouterAbEd25519YaoPinnedRegistrationBackend;
 };
+type RouterAbEd25519YaoRegistrationExecuteRequestV1 = RouterAbEd25519YaoActivationExecuteRequestV1<'registration'>;
+type RouterAbEd25519YaoRegistrationResultV1 = RouterAbEd25519YaoActivationResultV1<'registration'>;
+type AuthorizationFailure = {
+    readonly ok: false;
+    readonly status: 401 | 403 | 409 | 429 | 503;
+    readonly code: string;
+    readonly message: string;
+};
+type RegistrationExecutionTimingV1 = {
+    readonly credentialDigestMs: number;
+    readonly d1AdmissionReadMs: number;
+    readonly routerExecutionMs: number;
+    readonly routerServerTiming: string | null;
+    readonly resultReconstructionMs: number;
+};
+export type RouterAbEd25519YaoTimedRegistrationExecutionResultV1 = {
+    readonly result: RouterAbEd25519YaoRegistrationServiceResult<RouterAbEd25519YaoRegistrationResultV1> | AuthorizationFailure;
+    readonly timing: RegistrationExecutionTimingV1;
+};
 export declare function handleRouterAbEd25519YaoRegistrationRequestScopedCloudflareV1(input: RouterAbEd25519YaoRegistrationRequestScopedCloudflareInputV1): Promise<Response>;
+/**
+ * Runs one admitted registration for the holder of its credential. The
+ * execute route takes the credential from its bearer. A respond that carries
+ * the execute request takes it from the signed setup that it just verified.
+ */
+export declare function executeRouterAbEd25519YaoAdmittedRegistrationV1(input: Pick<RouterAbEd25519YaoRegistrationRequestScopedCloudflareInputV1, 'store' | 'backend'> & {
+    readonly request: RouterAbEd25519YaoRegistrationExecuteRequestV1;
+    readonly credentialDigestSha256Hex: string;
+    readonly credentialDigestMs: number;
+    readonly trace: RouterAbTraceContextV1;
+}): Promise<RouterAbEd25519YaoTimedRegistrationExecutionResultV1>;
+/**
+ * The timing of one execution as Server-Timing entries, for a route that
+ * reports them in its own header: a respond that ran the execution.
+ */
+export declare function routerAbEd25519YaoRegistrationExecutionTimingEntriesV1(timing: RouterAbEd25519YaoTimedRegistrationExecutionResultV1['timing']): Array<readonly [string, number]>;
+export {};
 //# sourceMappingURL=routerAbEd25519YaoRegistrationRequestScopedCloudflare.d.ts.map

package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationInputs.d.ts

@@ -3,6 +3,7 @@ import type { RegistrationSignerSetSelection } from '../../../../../shared-ts/sr
 import type { RegistrationEstablishedSessionProjectionV2 } from '../../../../../shared-ts/src/utils/registrationEstablishedSession';
 import type { RegisterWalletInput, RegistrationAuthMethodInput } from '../../../../../shared-ts/src/utils/registrationAuthMethodInput';
 import type { RouterAbEcdsaRegistrationRequestV1, RouterAbEcdsaVerifiedClientActivationFactsV1 } from '../../../../../shared-ts/src/utils/routerAbEcdsaDerivation';
+import type { RouterAbEd25519YaoActivationExecuteRequestV1 } from '../../../../../shared-ts/src/utils/routerAbEd25519Yao';
 import type { WalletRegistrationAuthorityInput, WalletRegistrationFinalizeSignerWork } from '../../../core/registrationContracts';
 import type { ThresholdRuntimePolicyScope } from '../../../core/types';
 import type { WalletRegistrationSetupMinter, WalletRegistrationSetupVerifier } from './walletRegistrationSetupPayload';
@@ -33,6 +34,11 @@ export type WalletRegistrationRespondInput = {
         readonly strictRegistration: RouterAbEcdsaRegistrationRequestV1;
         readonly requestDigestB64u: string;
     };
+    /**
+     * The execute request of an Ed25519-only plan, prepared from the admission
+     * that setup described. Respond admits, then runs it in the same request.
+     */
+    readonly ed25519Execution?: RouterAbEd25519YaoActivationExecuteRequestV1<'registration'>;
     /** Verifies the opaque setup token before authority-bound work begins. */
     readonly verifier: WalletRegistrationSetupVerifier;
     readonly userAgent?: string;

package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationReservation.d.ts

@@ -1,9 +1,11 @@
+import type { Variant } from '../../../../../shared-ts/src/utils/variant';
 import type { WalletSessionLocatorPublication } from '../../../authorization/sessionRouting';
 import type { CommittedWalletRegistration } from '../../../authorization/domain';
 import type { D1PreparedStatementLike } from '../../../storage/tenantRoute';
 import { type DeviceId } from '../../../../../shared-ts/src/authorization/capabilityKinds';
 import { type WalletAuthorityId, type WalletAuthMethodId, type WalletId } from '../../../../../shared-ts/src/utils/domainIds';
 import type { WalletRegistrationSetupInput } from './walletRegistrationInputs';
+import type { RouterAbEd25519YaoActivationAdmissionReceiptV1, RouterAbEd25519YaoRegistrationAdmissionRequestV1 } from '../../../../../shared-ts/src/utils/routerAbEd25519Yao';
 export type WalletRegistrationSetupReservation = {
     readonly walletId: WalletId;
     readonly ceremonyId: string;
@@ -30,10 +32,22 @@ export type WalletRegistrationSetupReservationResult = {
     readonly lifecycle?: never;
 };
 /** Persist custody addresses before setup completes, then start the reserved wallet objects. */
-export type RegistrationWalletStarter = (registration: {
+export type RegistrationWalletStartup = {
     readonly walletId: WalletId;
     readonly ownershipGeneration: number;
-}) => Promise<void>;
+} & ({
+    readonly kind: 'objects';
+    readonly admissionRequest?: never;
+    readonly admissionReceipt?: never;
+    readonly expiresAtMs?: never;
+} | {
+    readonly kind: 'pair';
+    readonly admissionRequest: RouterAbEd25519YaoRegistrationAdmissionRequestV1;
+    readonly admissionReceipt: RouterAbEd25519YaoActivationAdmissionReceiptV1<'registration'>;
+    readonly expiresAtMs: number;
+});
+export type RegistrationPairStartup = Variant<RegistrationWalletStartup, 'kind', 'pair'>;
+export type RegistrationWalletStarter = (registration: RegistrationWalletStartup) => Promise<void>;
 type ReservationOutcome = {
     readonly ok: true;
 } | {

package/dist/types/wallet-server/src/router/domains/walletRegistration/walletRegistrationRoutes.d.ts

@@ -21,6 +21,7 @@ type RouterApiWalletRegistrationServices = {
     session?: SessionAdapter | null;
     publishableKeyAuth?: RouterApiPublishableKeyAuthAdapter | null;
     registrationContext?: WalletRegistrationContextResolver | null;
+    registrationSetupRateLimit?: import('../../framework/registrationSetupRateLimit').RegistrationSetupRateLimit;
 };
 type RouterApiWalletRegistrationInput = {
     body: unknown;

package/dist/types/wallet-server/src/router/framework/registrationSetupRateLimit.d.ts

@@ -0,0 +1,11 @@
+export type RegistrationSetupRateLimitInput = {
+    readonly apiKeyId: string;
+    readonly orgId: string;
+    readonly projectId: string;
+    readonly envId: string;
+    readonly sourceIp: string;
+};
+export type RegistrationSetupRateLimit = (input: RegistrationSetupRateLimitInput) => Promise<{
+    readonly allowed: boolean;
+}>;
+//# sourceMappingURL=registrationSetupRateLimit.d.ts.map

package/dist/types/wallet-server/src/router/framework/routerApi.d.ts

@@ -157,6 +157,7 @@ export interface RouterApiOptions {
     publishableKeyAuth?: RouterApiPublishableKeyAuthAdapter | null;
     /** Fresh credential and active-environment resolution for registration setup. */
     registrationContext?: WalletRegistrationContextResolver | null;
+    registrationSetupRateLimit?: import('./registrationSetupRateLimit').RegistrationSetupRateLimit;
     /**
      * Optional Router API usage-meter adapter used to emit host runtime events.
      */

package/migrations/d1-signer/0079_tenant_lookup_indexes.sql

@@ -0,0 +1,33 @@
+-- Lookups that had no usable index and read every session or every wallet of
+-- a tenant. Each index below serves statements that already exist; no
+-- statement changes its result.
+--
+-- Without statistics the planner expects about ten rows behind the first
+-- column of any index. An index that covers a lookup therefore wins over a
+-- narrower one that needs the table row, although its first column is the
+-- namespace, which every row shares. The two session indexes carry the columns
+-- that their lookups read so that the planner selects them.
+
+-- The operation triggers find the session that owns an operation through
+-- wallet_operation_authorizations with the namespace, the tenant and the
+-- authorization only. The primary key has org_id, project_id and env_id before
+-- tenant_id, and the triggers compare those three inside an OR, so the key
+-- gave a namespace prefix and the triggers read every session.
+CREATE INDEX wallet_session_authorizations_v2_tenant_authorization_idx
+  ON wallet_session_authorizations_v2 (
+    namespace, tenant_id, authorization_id, org_id, project_id, env_id, wallet_id
+  );
+
+-- The quota freeze triggers find the session of a quota with the namespace,
+-- the tenant, the quota and the wallet session only.
+CREATE INDEX wallet_session_authorizations_v2_tenant_quota_idx
+  ON wallet_session_authorizations_v2 (
+    namespace, tenant_id, quota_id, wallet_session_id, org_id, project_id, env_id, wallet_id
+  );
+
+-- The registration cancellation fences and the Gateway admission find a wallet
+-- by its registration ceremony. wallet_id is last so that the first match is
+-- the one the primary key order gave, and so that the admission reads the
+-- index only.
+CREATE INDEX wallet_execution_generations_origin_idx
+  ON wallet_execution_generations (namespace, org_id, project_id, env_id, origin, origin_id, wallet_id);

package/migrations/d1-signer/0080_registration_setup_rate_limits.sql

@@ -0,0 +1,11 @@
+CREATE TABLE registration_setup_rate_limits (
+    namespace TEXT NOT NULL,
+    org_id TEXT NOT NULL,
+    project_id TEXT NOT NULL,
+    env_id TEXT NOT NULL,
+    rate_key TEXT NOT NULL,
+    consumed_count INTEGER NOT NULL CHECK (consumed_count BETWEEN 1 AND 30),
+    reset_at_ms INTEGER NOT NULL,
+    PRIMARY KEY (namespace, org_id, project_id, env_id, rate_key)
+);
+CREATE INDEX registration_setup_rate_limits_expiry ON registration_setup_rate_limits (reset_at_ms);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seams/wallet-server",
-  "version": "0.9.4",
+  "version": "0.10.0",
   "type": "module",
   "description": "Seams server TypeScript SDK for NEAR and EVM-family wallets",
   "main": "./dist/esm/index.js",

package/src/README.md

@@ -23,7 +23,7 @@ authentication is intentionally outside this package.
 ## Primary wallet routes
 
 Wallet-management routes (registration, signer setup/inventory, auth-method
-management and implicit NEAR funding) require `X-Seams-Wallet-Protocol: 3`.
+management and implicit NEAR funding) require `X-Seams-Wallet-Protocol: 4`.
 Missing or unsupported values return HTTP 409, `wallet_protocol_mismatch`, with
 reload/upgrade instructions before parsing the body or invoking route services.
 The current Wallet SDK sends this header automatically. Direct HTTP clients,