@seams/wallet-server 0.5.0

package/dist/esm/router/cloudflare/durableObjects/versionedJsonRecordStore.js

@@ -0,0 +1,192 @@
+import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
+import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
+//#region src/router/cloudflare/durableObjects/versionedJsonRecordStore.ts
+var CloudflareVersionedJsonRecordStoreError = class extends Error {
+	constructor(code, message) {
+		super(message);
+		this.name = "CloudflareVersionedJsonRecordStoreError";
+		this.code = code;
+	}
+};
+var CloudflareDurableObjectVersionedJsonRecordStore = class {
+	constructor(options) {
+		if (!isDurableObjectNamespaceLike(options.namespace)) throw new Error("Cloudflare Durable Object namespace is required");
+		if (typeof options.objectNameForKey !== "function") throw new Error("Cloudflare versioned JSON object-name resolver is required");
+		if (typeof options.encode !== "function" || typeof options.parse !== "function") throw new Error("Cloudflare versioned JSON encoder and parser are required");
+		this.namespace = options.namespace;
+		this.objectNameForKey = options.objectNameForKey;
+		this.encode = options.encode;
+		this.parse = options.parse;
+		this.keyPrefix = normalizeKeyPrefix(options.keyPrefix);
+	}
+	async read(key) {
+		const recordKey = normalizeRecordKey(key);
+		const storageKey = this.storageKey(recordKey);
+		const response = await this.call(recordKey, {
+			op: "readVersionedJson",
+			key: storageKey
+		});
+		if (!response.ok) throw requestFailure(response.message);
+		const parsed = parseVersionedJsonReadResponse(response.value);
+		if (!parsed) throw invalidResponseFailure("Versioned JSON read response is invalid");
+		switch (parsed.status) {
+			case "missing": return { kind: "missing" };
+			case "invalid_record": throw invalidRecordFailure("Stored versioned JSON record envelope is invalid");
+			case "present": {
+				const value = this.parse(parsed.value);
+				if (value === null) throw invalidRecordFailure("Stored versioned JSON record is invalid");
+				const version = normalizeOptionalTrimmedString(parsed.version);
+				if (!version) throw invalidRecordFailure("Stored versioned JSON record version is invalid");
+				return {
+					kind: "present",
+					value,
+					version
+				};
+			}
+			default: return assertNever(parsed);
+		}
+	}
+	async put(key, value, expectedVersion, options = {}) {
+		const recordKey = normalizeRecordKey(key);
+		const storageKey = this.storageKey(recordKey);
+		if (expectedVersion !== null && !normalizeOptionalTrimmedString(expectedVersion)) throw new Error("Versioned JSON record expectedVersion must be null or non-empty");
+		const encoded = this.encode(value);
+		if (!isJsonObject(encoded)) throw new Error("Versioned JSON record encoder returned a non-object value");
+		const response = await this.call(recordKey, {
+			op: "putVersionedJson",
+			key: storageKey,
+			expectedVersion,
+			value: encoded,
+			...options.ttlMs === void 0 ? {} : { ttlMs: options.ttlMs }
+		});
+		if (!response.ok) throw requestFailure(response.message);
+		const parsed = parseVersionedJsonPutResponse(response.value);
+		if (!parsed) throw invalidResponseFailure("Versioned JSON put response is invalid");
+		switch (parsed.status) {
+			case "stored": {
+				const version = normalizeOptionalTrimmedString(parsed.version);
+				if (!version) throw invalidResponseFailure("Stored version is invalid");
+				return {
+					kind: "stored",
+					version
+				};
+			}
+			case "version_mismatch": return { kind: "version_mismatch" };
+			case "invalid_record": throw invalidRecordFailure("Stored versioned JSON record envelope is invalid");
+			default: return assertNever(parsed);
+		}
+	}
+	storageKey(key) {
+		const normalized = normalizeRecordKey(key);
+		return `${this.keyPrefix}${normalized}`;
+	}
+	stubForKey(key) {
+		const objectName = this.objectNameForKey(key);
+		if (!normalizeOptionalTrimmedString(objectName)) throw new Error("Cloudflare versioned JSON object-name resolver returned an empty name");
+		return this.namespace.get(this.namespace.idFromName(objectName));
+	}
+	async call(objectNameKey, request) {
+		const stub = this.stubForKey(objectNameKey);
+		let response;
+		try {
+			response = await stub.fetch("https://threshold-store.invalid/", {
+				method: "POST",
+				headers: { "content-type": "application/json" },
+				body: JSON.stringify(request)
+			});
+		} catch (error) {
+			throw requestFailure(error instanceof Error ? error.message : "Versioned JSON request failed");
+		}
+		const text = await response.text();
+		if (!response.ok) throw requestFailure(`Durable Object HTTP ${response.status}: ${text}`);
+		let parsed;
+		try {
+			parsed = text ? JSON.parse(text) : null;
+		} catch {
+			throw invalidResponseFailure("Versioned JSON Durable Object returned invalid JSON");
+		}
+		if (!isPlainObject(parsed)) throw invalidResponseFailure("Versioned JSON Durable Object response is not an object");
+		if (parsed.ok === true && "value" in parsed) return {
+			ok: true,
+			value: parsed.value
+		};
+		if (parsed.ok === false) return {
+			ok: false,
+			code: normalizeOptionalTrimmedString(parsed.code) || "request_failed",
+			message: normalizeOptionalTrimmedString(parsed.message) || "Versioned JSON Durable Object request failed"
+		};
+		throw invalidResponseFailure("Versioned JSON Durable Object response has invalid status");
+	}
+};
+function createCloudflareDurableObjectVersionedJsonRecordStore(options) {
+	return new CloudflareDurableObjectVersionedJsonRecordStore(options);
+}
+function parseVersionedJsonReadResponse(value) {
+	if (!isPlainObject(value)) return null;
+	const status = normalizeOptionalTrimmedString(value.status);
+	if (status === "missing" || status === "invalid_record") return { status };
+	if (status !== "present" || !("value" in value)) return null;
+	const version = normalizeOptionalTrimmedString(value.version);
+	return version ? {
+		status,
+		value: value.value,
+		version
+	} : null;
+}
+function parseVersionedJsonPutResponse(value) {
+	if (!isPlainObject(value)) return null;
+	const status = normalizeOptionalTrimmedString(value.status);
+	if (status === "version_mismatch" || status === "invalid_record") return { status };
+	if (status !== "stored") return null;
+	const version = normalizeOptionalTrimmedString(value.version);
+	return version ? {
+		status,
+		version
+	} : null;
+}
+function normalizeKeyPrefix(value) {
+	const prefix = normalizeOptionalTrimmedString(value);
+	if (!prefix) return "versioned-json:";
+	return prefix.endsWith(":") ? prefix : `${prefix}:`;
+}
+function normalizeRecordKey(value) {
+	const key = normalizeOptionalTrimmedString(value);
+	if (!key) throw new Error("Versioned JSON record key is required");
+	if (key.length > 512 || containsControlCharacter(key)) throw new Error("Versioned JSON record key is invalid");
+	return key;
+}
+function containsControlCharacter(value) {
+	for (let index = 0; index < value.length; index += 1) {
+		const code = value.charCodeAt(index);
+		if (code <= 31 || code === 127) return true;
+	}
+	return false;
+}
+function isDurableObjectNamespaceLike(value) {
+	return isPlainObject(value) && typeof value.idFromName === "function" && typeof value.get === "function";
+}
+function isJsonObject(value) {
+	return isPlainObject(value) && Object.values(value).every(isJsonValue);
+}
+function isJsonValue(value) {
+	if (value === null || typeof value === "string" || typeof value === "boolean") return true;
+	if (typeof value === "number") return Number.isFinite(value);
+	if (Array.isArray(value)) return value.every(isJsonValue);
+	return isJsonObject(value);
+}
+function requestFailure(message) {
+	return new CloudflareVersionedJsonRecordStoreError("request_failed", message);
+}
+function invalidRecordFailure(message) {
+	return new CloudflareVersionedJsonRecordStoreError("invalid_record", message);
+}
+function invalidResponseFailure(message) {
+	return new CloudflareVersionedJsonRecordStoreError("invalid_response", message);
+}
+function assertNever(value) {
+	throw invalidResponseFailure(`Unknown versioned JSON response: ${String(value)}`);
+}
+//#endregion
+export { CloudflareDurableObjectVersionedJsonRecordStore, CloudflareVersionedJsonRecordStoreError, containsControlCharacter, createCloudflareDurableObjectVersionedJsonRecordStore };
+
+//# sourceMappingURL=versionedJsonRecordStore.js.map

package/dist/esm/router/cloudflare/runtime/cloudflareSignerWasm.js

@@ -0,0 +1,8 @@
+//#region src/router/cloudflare/runtime/cloudflareSignerWasm.ts
+async function loadCloudflareSignerWasmModule() {
+	return (await import("../../../wasm/signer.js")).default;
+}
+//#endregion
+export { loadCloudflareSignerWasmModule };
+
+//# sourceMappingURL=cloudflareSignerWasm.js.map

package/dist/esm/router/cloudflare/runtime/createCloudflareRouter.js

@@ -0,0 +1,19 @@
+import { attachRouterApiRouteSurface, getRouterApiRouteSurface } from "../../framework/routerApiRouteSurface.js";
+import { createFetchRouter } from "../../transport/fetch/createFetchRouter.js";
+//#region src/router/cloudflare/runtime/createCloudflareRouter.ts
+function createCloudflareRouter(service, opts = {}) {
+	const fetchHandler = createFetchRouter(service, opts, { kind: "inline" });
+	const handler = async (request, _env, cfCtx) => {
+		return await fetchHandler(request, cfCtx ? {
+			kind: "background",
+			waitUntil: (promise) => cfCtx.waitUntil(promise)
+		} : { kind: "inline" });
+	};
+	const surface = getRouterApiRouteSurface(fetchHandler);
+	if (!surface) throw new Error("[router.cloudflare] Fetch router route surface is unavailable");
+	return attachRouterApiRouteSurface(handler, surface);
+}
+//#endregion
+export { createCloudflareRouter };
+
+//# sourceMappingURL=createCloudflareRouter.js.map

package/dist/esm/router/cloudflare/runtime/createSelfHostedCloudflareSigningWorker.js

@@ -0,0 +1,94 @@
+import "../../../shared-ts/src/utils/validation.js";
+import { coerceRouterLogger } from "../../framework/logger.js";
+import { json, withCors } from "../../framework/http.js";
+import { handleThresholdEcdsa } from "../../transport/fetch/routes/thresholdEcdsa.js";
+import { handleThresholdEd25519 } from "../../transport/fetch/routes/thresholdEd25519.js";
+import { validateRouterApiRorOptions } from "../../framework/ror/provider.js";
+import "../../framework/routerApi.js";
+//#region src/router/cloudflare/runtime/createSelfHostedCloudflareSigningWorker.ts
+function notFound() {
+	return new Response("Not Found", { status: 404 });
+}
+function selfHostedHealthResponse(ctx) {
+	if (ctx.method !== "GET") return null;
+	if (ctx.pathname !== "/healthz" && ctx.pathname !== "/readyz") return null;
+	if (ctx.pathname === "/healthz" && !ctx.opts.healthz) return null;
+	if (ctx.pathname === "/readyz" && !ctx.opts.readyz) return null;
+	return json({
+		ok: true,
+		selfHosted: true,
+		threshold: { configured: Boolean(ctx.opts.routerAbNormalSigningRouterProxy) }
+	}, { status: 200 });
+}
+function createSelfHostedContext(input) {
+	const url = new URL(input.request.url);
+	return {
+		request: input.request,
+		url,
+		pathname: url.pathname,
+		method: input.request.method.toUpperCase(),
+		runtime: input.cfCtx ? {
+			kind: "background",
+			waitUntil: (promise) => input.cfCtx?.waitUntil(promise)
+		} : { kind: "inline" },
+		service: input.service,
+		opts: input.opts,
+		logger: input.logger,
+		routeDefinitions: []
+	};
+}
+function createSelfHostedCloudflareSigningRouter(service, opts = {}) {
+	const sessionCookieName = String(opts.sessionCookieName || "").trim() || "seams-jwt";
+	const effectiveOpts = {
+		...opts,
+		sessionCookieName
+	};
+	if (effectiveOpts.ror) validateRouterApiRorOptions(effectiveOpts.ror);
+	const logger = coerceRouterLogger(effectiveOpts.logger);
+	const handler = async (request, env, cfCtx) => {
+		if (request.method.toUpperCase() === "OPTIONS") {
+			const res = new Response(null, { status: 204 });
+			withCors(res.headers, effectiveOpts, request);
+			return res;
+		}
+		const ctx = createSelfHostedContext({
+			request,
+			cfCtx,
+			service,
+			opts: effectiveOpts,
+			logger
+		});
+		try {
+			const response = selfHostedHealthResponse(ctx) || await handleThresholdEd25519(ctx) || await handleThresholdEcdsa(ctx) || notFound();
+			withCors(response.headers, effectiveOpts, request);
+			return response;
+		} catch (error) {
+			const res = json({
+				code: "internal",
+				message: error instanceof Error ? error.message : String(error)
+			}, { status: 500 });
+			withCors(res.headers, effectiveOpts, request);
+			return res;
+		}
+	};
+	return handler;
+}
+function createSelfHostedCloudflareSigningWorker(input) {
+	return { async fetch(request, env, ctx) {
+		const service = await input.createAuthService({
+			request,
+			env,
+			ctx
+		});
+		return createSelfHostedCloudflareSigningRouter(service, typeof input.routerOptions === "function" ? await input.routerOptions({
+			request,
+			env,
+			ctx,
+			service
+		}) : input.routerOptions || {})(request, env, ctx);
+	} };
+}
+//#endregion
+export { createSelfHostedCloudflareSigningRouter, createSelfHostedCloudflareSigningWorker };
+
+//# sourceMappingURL=createSelfHostedCloudflareSigningWorker.js.map

package/dist/esm/router/cloudflare/runtime/ed25519SessionAdapter.js

@@ -0,0 +1,106 @@
+import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
+import "../../../shared-ts/src/utils/encoders.js";
+import { SessionService } from "../../../core/SessionService.js";
+import { CrossSiteSessionCookieAdapter, encodeSessionJsonSegment, normalizeSessionString, normalizeSessionTtlSeconds, parseSessionJwt, requireNormalizedSessionString, sessionJwtTimeClaims, toSessionArrayBufferCopy } from "./sessionAdapterRuntime.js";
+//#region src/router/cloudflare/runtime/ed25519SessionAdapter.ts
+var Ed25519SessionJwtAdapter = class {
+	constructor(options) {
+		this.options = options;
+		this.issuer = requireNormalizedSessionString(options.issuer, "Ed25519 session issuer");
+		this.audience = requireNormalizedSessionString(options.audience, "Ed25519 session audience");
+		this.keyId = requireNormalizedSessionString(options.keyId, "Ed25519 session key id");
+		this.ttlSeconds = normalizeSessionTtlSeconds(options.ttlSeconds);
+		this.signingKey = this.importSigningKey();
+		this.verifyingKey = this.importVerifyingKey();
+	}
+	async signToken(input) {
+		const nowSeconds = Math.floor(Date.now() / 1e3);
+		const timeClaims = sessionJwtTimeClaims(input.payload, nowSeconds, this.ttlSeconds);
+		const signingInput = `${encodeSessionJsonSegment({
+			...input.header,
+			typ: "JWT",
+			alg: "EdDSA",
+			kid: this.keyId
+		})}.${encodeSessionJsonSegment({
+			...input.payload,
+			...routerWalletSessionScopeClaims(input.payload),
+			...timeClaims,
+			iss: this.issuer,
+			aud: this.audience
+		})}`;
+		const signature = await crypto.subtle.sign({ name: "Ed25519" }, await this.signingKey, new TextEncoder().encode(signingInput));
+		return `${signingInput}.${base64UrlEncode(new Uint8Array(signature))}`;
+	}
+	async verifyToken(token) {
+		const parsed = parseSessionJwt(token);
+		if (!parsed.ok) return { valid: false };
+		if (normalizeSessionString(parsed.header.alg) !== "EdDSA" || normalizeSessionString(parsed.header.kid) !== this.keyId || normalizeSessionString(parsed.payload.iss) !== this.issuer || !payloadMatchesAudience(parsed.payload, this.audience)) return { valid: false };
+		let signature;
+		try {
+			signature = base64UrlDecode(parsed.signatureB64u);
+		} catch {
+			return { valid: false };
+		}
+		return await crypto.subtle.verify({ name: "Ed25519" }, await this.verifyingKey, toSessionArrayBufferCopy(signature), new TextEncoder().encode(`${parsed.headerB64u}.${parsed.payloadB64u}`)) ? {
+			valid: true,
+			payload: parsed.payload
+		} : { valid: false };
+	}
+	async importSigningKey() {
+		return await crypto.subtle.importKey("jwk", this.options.privateJwk, { name: "Ed25519" }, false, ["sign"]);
+	}
+	async importVerifyingKey() {
+		const { crv, kty, x } = this.options.privateJwk;
+		return await crypto.subtle.importKey("jwk", {
+			alg: "EdDSA",
+			crv,
+			kty,
+			use: "sig",
+			x
+		}, { name: "Ed25519" }, false, ["verify"]);
+	}
+};
+function payloadMatchesAudience(payload, audience) {
+	const value = payload.aud;
+	if (typeof value === "string") return value === audience;
+	return Array.isArray(value) && value.includes(audience);
+}
+function routerWalletSessionScopeClaims(payload) {
+	const kind = normalizeSessionString(payload.kind);
+	if (kind !== "router_ab_ed25519_wallet_session_v1" && kind !== "router_ab_ecdsa_derivation_wallet_session_v1") return {};
+	if (payload.authorizationKind === "linked_device_wallet_session") return {};
+	const scope = payload.runtimePolicyScope && typeof payload.runtimePolicyScope === "object" && !Array.isArray(payload.runtimePolicyScope) ? payload.runtimePolicyScope : null;
+	const claims = {
+		org_id: requireNormalizedSessionString(scope?.orgId, "Wallet Session org id"),
+		project_id: requireNormalizedSessionString(scope?.projectId, "Wallet Session project id"),
+		environment: requireNormalizedSessionString(scope?.envId, "Wallet Session environment"),
+		account_id: requireNormalizedSessionString(payload.walletId ?? payload.sub, "Wallet Session account id")
+	};
+	if (payload.sid === void 0) return claims;
+	return {
+		...claims,
+		sid: requireNormalizedSessionString(payload.sid, "Wallet Session Seams session id")
+	};
+}
+function createEd25519SessionAdapter(options) {
+	const jwt = new Ed25519SessionJwtAdapter(options);
+	const cookieName = normalizeSessionString(options.cookieName) || "seams-jwt";
+	const ttlSeconds = normalizeSessionTtlSeconds(options.ttlSeconds);
+	const cookie = new CrossSiteSessionCookieAdapter(cookieName, ttlSeconds);
+	return new SessionService({
+		jwt: {
+			signToken: jwt.signToken.bind(jwt),
+			verifyToken: jwt.verifyToken.bind(jwt),
+			refreshWindowSec: ttlSeconds
+		},
+		cookie: {
+			name: cookieName,
+			buildSetHeader: cookie.buildSetHeader.bind(cookie),
+			buildClearHeader: cookie.buildClearHeader.bind(cookie)
+		}
+	});
+}
+//#endregion
+export { createEd25519SessionAdapter };
+
+//# sourceMappingURL=ed25519SessionAdapter.js.map

package/dist/esm/router/cloudflare/runtime/environment.js

@@ -0,0 +1,25 @@
+import { normalizeSessionString } from "./sessionAdapterRuntime.js";
+//#region src/router/cloudflare/runtime/environment.ts
+function requireEnvironmentString(env, name) {
+	const value = readEnvironmentString(env, name);
+	if (!value) throw new Error(`${name} is required`);
+	return value;
+}
+function readEnvironmentString(env, name) {
+	return normalizeSessionString(env[name]);
+}
+function readEnvironmentCsv(input) {
+	const values = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const raw of normalizeSessionString(input).split(",")) {
+		const value = raw.trim();
+		if (!value || seen.has(value)) continue;
+		values.push(value);
+		seen.add(value);
+	}
+	return values;
+}
+//#endregion
+export { readEnvironmentCsv, readEnvironmentString, requireEnvironmentString };
+
+//# sourceMappingURL=environment.js.map

package/dist/esm/router/cloudflare/runtime/routerAbPrewarm.js

@@ -0,0 +1,34 @@
+import { ROUTER_AB_MPC_ROUTER_ORIGIN } from "./routerAbServiceBindings.js";
+//#region src/router/cloudflare/runtime/routerAbPrewarm.ts
+const ROUTER_AB_PREWARM_CRON = "* * * * *";
+const ROUTER_AB_PREWARM_PATH = "/internal/prewarm";
+const ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER = "x-router-ab-internal-service-auth";
+function parseRouterAbPrewarmEnabled(value) {
+	if (value === "true") return true;
+	if (value === "false") return false;
+	throw new Error("ROUTER_AB_PREWARM_ENABLED must be true or false");
+}
+function requireRouterAbInternalServiceAuthSecret(env) {
+	const value = String(env.ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET || "").trim();
+	if (!value) throw new Error("ROUTER_AB_INTERNAL_SERVICE_AUTH_SECRET is required");
+	return value;
+}
+function isSuccessfulRouterAbPrewarmResponse(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value) || Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null) return false;
+	const fields = new Map(Object.entries(value));
+	return fields.size === 1 && fields.get("ok") === true;
+}
+async function runRouterAbPrewarmScheduledV1(event, env) {
+	if (event.cron !== ROUTER_AB_PREWARM_CRON) return;
+	if (!parseRouterAbPrewarmEnabled(env.ROUTER_AB_PREWARM_ENABLED)) return;
+	const response = await env.MPC_ROUTER.fetch(new Request(`${ROUTER_AB_MPC_ROUTER_ORIGIN}${ROUTER_AB_PREWARM_PATH}`, {
+		method: "POST",
+		headers: { [ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER]: requireRouterAbInternalServiceAuthSecret(env) }
+	}));
+	if (!response.ok) throw new Error(`Router A/B prewarm failed with HTTP ${response.status}`);
+	if (!isSuccessfulRouterAbPrewarmResponse(await response.json())) throw new Error("Router A/B prewarm returned an invalid response");
+}
+//#endregion
+export { runRouterAbPrewarmScheduledV1 };
+
+//# sourceMappingURL=routerAbPrewarm.js.map

package/dist/esm/router/cloudflare/runtime/routerAbServiceBindings.js

@@ -0,0 +1,33 @@
+//#region src/router/cloudflare/runtime/routerAbServiceBindings.ts
+const ROUTER_AB_MPC_ROUTER_ORIGIN = "https://mpc-router.router-ab.internal";
+const ROUTER_AB_SIGNING_WORKER_ORIGIN = "https://signing-worker.router-ab.internal";
+var RouterAbServiceBindingDispatcher = class {
+	constructor(env) {
+		this.env = env;
+	}
+	async fetch(input, init) {
+		const request = new Request(input, init);
+		return await this.bindingForOrigin(new URL(request.url).origin).fetch(request);
+	}
+	bindingForOrigin(origin) {
+		switch (parseRouterAbServiceBindingOrigin(origin)) {
+			case ROUTER_AB_MPC_ROUTER_ORIGIN: return this.env.MPC_ROUTER;
+			case ROUTER_AB_SIGNING_WORKER_ORIGIN: return this.env.SIGNING_WORKER;
+		}
+	}
+};
+function parseRouterAbServiceBindingOrigin(origin) {
+	switch (origin) {
+		case ROUTER_AB_MPC_ROUTER_ORIGIN:
+		case ROUTER_AB_SIGNING_WORKER_ORIGIN: return origin;
+		default: throw new Error(`Unsupported Router A/B service-binding origin: ${origin}`);
+	}
+}
+function createRouterAbServiceBindingFetch(env) {
+	const dispatcher = new RouterAbServiceBindingDispatcher(env);
+	return dispatcher.fetch.bind(dispatcher);
+}
+//#endregion
+export { ROUTER_AB_MPC_ROUTER_ORIGIN, ROUTER_AB_SIGNING_WORKER_ORIGIN, createRouterAbServiceBindingFetch };
+
+//# sourceMappingURL=routerAbServiceBindings.js.map

package/dist/esm/router/cloudflare/runtime/sessionAdapterRuntime.js

@@ -0,0 +1,104 @@
+import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
+import "../../../shared-ts/src/utils/encoders.js";
+//#region src/router/cloudflare/runtime/sessionAdapterRuntime.ts
+var CrossSiteSessionCookieAdapter = class {
+	constructor(cookieName, ttlSeconds) {
+		this.cookieName = cookieName;
+		this.ttlSeconds = ttlSeconds;
+	}
+	buildSetHeader(token) {
+		const expires = new Date(Date.now() + this.ttlSeconds * 1e3).toUTCString();
+		return [
+			`${this.cookieName}=${token}`,
+			"Path=/",
+			"HttpOnly",
+			"Secure",
+			"SameSite=None",
+			`Max-Age=${this.ttlSeconds}`,
+			`Expires=${expires}`
+		].join("; ");
+	}
+	buildClearHeader() {
+		return [
+			`${this.cookieName}=`,
+			"Path=/",
+			"HttpOnly",
+			"Secure",
+			"SameSite=None",
+			"Max-Age=0",
+			"Expires=Thu, 01 Jan 1970 00:00:00 GMT"
+		].join("; ");
+	}
+};
+function requireNormalizedSessionString(value, label) {
+	const normalized = normalizeSessionString(value);
+	if (!normalized) throw new Error(`${label} is required`);
+	return normalized;
+}
+function sessionJwtTimeClaims(payload, nowSeconds, ttlSeconds) {
+	if (!isRouterWalletSessionPayload(payload)) return {
+		iat: nowSeconds,
+		exp: nowSeconds + ttlSeconds
+	};
+	const iat = Number(payload.iat);
+	const exp = Number(payload.exp);
+	if (!Number.isSafeInteger(iat) || iat < 0 || iat > nowSeconds || !Number.isSafeInteger(exp) || exp <= nowSeconds || exp > nowSeconds + ttlSeconds) throw new Error("Wallet Session JWT lifetime exceeds the session signing policy");
+	return {
+		iat,
+		exp
+	};
+}
+function normalizeSessionTtlSeconds(input) {
+	const ttl = Number(input || 1440 * 60);
+	if (!Number.isSafeInteger(ttl) || ttl < 60 || ttl > 720 * 60 * 60) throw new Error("staging session ttlSeconds must be between 60 seconds and 30 days");
+	return ttl;
+}
+function encodeSessionJsonSegment(input) {
+	return base64UrlEncode(new TextEncoder().encode(JSON.stringify(input)));
+}
+function parseSessionJwt(token) {
+	const parts = normalizeSessionString(token).split(".");
+	if (parts.length !== 3) return { ok: false };
+	const header = parseJsonSegment(parts[0] || "");
+	const payload = parseJsonSegment(parts[1] || "");
+	if (!header || !payload) return { ok: false };
+	return {
+		ok: true,
+		headerB64u: parts[0] || "",
+		payloadB64u: parts[1] || "",
+		signatureB64u: parts[2] || "",
+		header,
+		payload
+	};
+}
+function toSessionArrayBufferCopy(bytes) {
+	const out = new ArrayBuffer(bytes.byteLength);
+	new Uint8Array(out).set(bytes);
+	return out;
+}
+function normalizeSessionString(input) {
+	return String(input || "").trim();
+}
+function isRouterWalletSessionPayload(payload) {
+	return payload.kind === "router_ab_ed25519_wallet_session_v1" || payload.kind === "router_ab_ecdsa_derivation_wallet_session_v1";
+}
+function parseJsonSegment(input) {
+	let decoded;
+	try {
+		decoded = base64UrlDecode(input);
+	} catch {
+		return null;
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(new TextDecoder().decode(decoded));
+	} catch {
+		return null;
+	}
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+	return parsed;
+}
+//#endregion
+export { CrossSiteSessionCookieAdapter, encodeSessionJsonSegment, normalizeSessionString, normalizeSessionTtlSeconds, parseSessionJwt, requireNormalizedSessionString, sessionJwtTimeClaims, toSessionArrayBufferCopy };
+
+//# sourceMappingURL=sessionAdapterRuntime.js.map