@seams/wallet-server 0.5.0

package/dist/esm/router/cloudflare/runtime/staticWalletConsoleBinding.js

@@ -0,0 +1,168 @@
+import { ROUTER_API_CREDENTIAL_SCOPES } from "../../framework/apiCredentialPorts.js";
+import { WALLET_CONSOLE_OP_PATHS_V1, decodeWalletConsoleTenantRootActiveLineageRequestV1 } from "./walletConsoleOps.js";
+//#region src/router/cloudflare/runtime/staticWalletConsoleBinding.ts
+function parseStaticWalletConsoleBindingConfigV1(value) {
+	const root = requiredRecord(value, "static Wallet deployment config");
+	const credential = requiredRecord(root.credential, "credential");
+	const deployment = requiredRecord(root.deployment, "deployment");
+	const tenantRoot = requiredRecord(root.tenantRoot, "tenantRoot");
+	return {
+		credential: {
+			apiKeyId: requiredConfigText(credential.apiKeyId, "credential.apiKeyId"),
+			publishableKey: requiredConfigText(credential.publishableKey, "credential.publishableKey"),
+			...credential.secretKey === void 0 ? {} : { secretKey: requiredConfigText(credential.secretKey, "credential.secretKey") },
+			allowedOrigins: requiredStringList(credential.allowedOrigins, "credential.allowedOrigins"),
+			scopes: requiredScopeList(credential.scopes)
+		},
+		deployment: {
+			orgId: requiredConfigText(deployment.orgId, "deployment.orgId"),
+			projectId: requiredConfigText(deployment.projectId, "deployment.projectId"),
+			environmentId: requiredConfigText(deployment.environmentId, "deployment.environmentId"),
+			environmentKey: requiredConfigText(deployment.environmentKey, "deployment.environmentKey"),
+			signingRootVersion: requiredConfigText(deployment.signingRootVersion, "deployment.signingRootVersion")
+		},
+		tenantRoot: {
+			identityDigestB64u: requiredConfigText(tenantRoot.identityDigestB64u, "tenantRoot.identityDigestB64u"),
+			custodyLineageB64u: requiredConfigText(tenantRoot.custodyLineageB64u, "tenantRoot.custodyLineageB64u"),
+			signingRootId: requiredConfigText(tenantRoot.signingRootId, "tenantRoot.signingRootId")
+		}
+	};
+}
+function requiredRecord(value, label) {
+	const parsed = record(value);
+	if (!parsed) throw new Error(`${label} must be an object`);
+	return parsed;
+}
+function requiredConfigText(value, label) {
+	const text = typeof value === "string" ? value.trim() : "";
+	if (!text) throw new Error(`${label} is required`);
+	return text;
+}
+function requiredStringList(value, label) {
+	if (!Array.isArray(value) || value.length === 0) throw new Error(`${label} is required`);
+	return value.map((entry, index) => requiredConfigText(entry, `${label}[${index}]`));
+}
+function requiredScopeList(value) {
+	if (!Array.isArray(value) || value.length === 0) throw new Error("credential.scopes is required");
+	return value.map(parseScope);
+}
+function parseScope(value, index) {
+	if (typeof value === "string") {
+		for (const scope of ROUTER_API_CREDENTIAL_SCOPES) if (scope === value) return scope;
+	}
+	throw new Error(`credential.scopes[${index}] is invalid`);
+}
+function createStaticWalletConsoleBindingV1(config) {
+	return { fetch: handleStaticWalletConsoleRequestV1.bind(void 0, config) };
+}
+async function handleStaticWalletConsoleRequestV1(config, input, init) {
+	const request = input instanceof Request ? input : new Request(input, init);
+	if (request.method !== "POST") return json({
+		ok: false,
+		message: "Method not allowed"
+	}, 405);
+	const body = await request.json().catch(() => null);
+	switch (new URL(request.url).pathname) {
+		case WALLET_CONSOLE_OP_PATHS_V1.publishableKeyAuth: return publishableKeyResponse(config, body);
+		case WALLET_CONSOLE_OP_PATHS_V1.secretKeyAuth: return secretKeyResponse(config, body);
+		case WALLET_CONSOLE_OP_PATHS_V1.projectEnvironments: return projectEnvironmentsResponse(config, body);
+		case WALLET_CONSOLE_OP_PATHS_V1.tenantRootActiveLineage: return activeLineageResponse(config, body);
+		case WALLET_CONSOLE_OP_PATHS_V1.usageEvents: return json({ ok: true });
+		default: return json({
+			ok: false,
+			message: "Unknown Wallet Console operation"
+		}, 404);
+	}
+}
+function publishableKeyResponse(config, value) {
+	const body = record(value);
+	if (!body || body.secret !== config.credential.publishableKey) return authFailure("publishable_key_invalid", "Publishable key is invalid");
+	if (body.environmentId !== config.deployment.environmentId) return authFailure("publishable_key_environment_mismatch", "Publishable key environment does not match", 403);
+	if (typeof body.origin !== "string" || !config.credential.allowedOrigins.includes(body.origin)) return authFailure("publishable_key_origin_blocked", "Publishable key origin is not allowed", 403);
+	return json({
+		ok: true,
+		principal: principal(config)
+	});
+}
+function secretKeyResponse(config, value) {
+	const body = record(value);
+	if (!config.credential.secretKey || !body || body.secret !== config.credential.secretKey) return authFailure("secret_key_invalid", "Secret key is invalid");
+	if (typeof body.environmentId === "string" && body.environmentId !== config.deployment.environmentId) return authFailure("secret_key_environment_mismatch", "Secret key environment does not match", 403);
+	if (!Array.isArray(body.requiredScopes)) return authFailure("secret_key_forbidden_scope", "Required scopes are invalid", 403);
+	for (const scope of body.requiredScopes) if (typeof scope !== "string" || !includesScope(config.credential.scopes, scope)) return authFailure("secret_key_forbidden_scope", "Secret key scope is not allowed", 403);
+	return json({
+		ok: true,
+		principal: principal(config)
+	});
+}
+function includesScope(scopes, value) {
+	for (const scope of scopes) if (scope === value) return true;
+	return false;
+}
+function projectEnvironmentsResponse(config, value) {
+	const context = record(record(value)?.context);
+	if (!context || context.orgId !== config.deployment.orgId) return json({
+		ok: false,
+		code: "environment_not_found",
+		message: "Environment not found"
+	}, 404);
+	return json({
+		ok: true,
+		environments: [{
+			id: config.deployment.environmentId,
+			projectId: config.deployment.projectId,
+			key: config.deployment.environmentKey,
+			signingRootVersion: config.deployment.signingRootVersion,
+			status: "ACTIVE"
+		}]
+	});
+}
+function activeLineageResponse(config, value) {
+	const decoded = decodeWalletConsoleTenantRootActiveLineageRequestV1(value);
+	if (!decoded.ok) return json({
+		ok: false,
+		code: "invalid_body",
+		message: "Identity is invalid"
+	}, 400);
+	const identity = decoded.value;
+	if (identity.orgId !== config.deployment.orgId || identity.projectId !== config.deployment.projectId || identity.envId !== config.deployment.environmentId || identity.signingRootId !== config.tenantRoot.signingRootId || identity.signingRootVersion !== config.deployment.signingRootVersion) return json({
+		ok: false,
+		code: "tenant_root_active_lineage_not_found",
+		message: "Active tenant-root lineage was not found"
+	}, 404);
+	return json({
+		ok: true,
+		identityDigestB64u: config.tenantRoot.identityDigestB64u,
+		custodyLineageB64u: config.tenantRoot.custodyLineageB64u
+	});
+}
+function principal(config) {
+	return {
+		apiKeyId: config.credential.apiKeyId,
+		orgId: config.deployment.orgId,
+		projectId: config.deployment.projectId,
+		envId: config.deployment.environmentKey,
+		environmentId: config.deployment.environmentId,
+		scopes: config.credential.scopes
+	};
+}
+function authFailure(code, message, status = 401) {
+	return json({
+		ok: false,
+		code,
+		message
+	}, status);
+}
+function record(value) {
+	return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function json(body, status = 200) {
+	return new Response(JSON.stringify(body), {
+		status,
+		headers: { "content-type": "application/json; charset=utf-8" }
+	});
+}
+//#endregion
+export { createStaticWalletConsoleBindingV1, handleStaticWalletConsoleRequestV1, parseStaticWalletConsoleBindingConfigV1 };
+
+//# sourceMappingURL=staticWalletConsoleBinding.js.map

package/dist/esm/router/cloudflare/runtime/tenantRootCreationGrant.js

@@ -0,0 +1,147 @@
+import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
+import { encodeTenantRootIdentityV1 } from "../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
+//#region src/router/cloudflare/runtime/tenantRootCreationGrant.ts
+const GRANT_DOMAIN = new TextEncoder().encode("tenant_root_creation_grant_v1");
+const GRANT_OPERATION = new TextEncoder().encode("tenant_root_authorize_create_v1");
+const GRANT_AUTH_DOMAIN = new TextEncoder().encode("tenant_root_creation_grant_authentication_v1");
+const ED25519_PKCS8_SEED_PREFIX = Uint8Array.from([
+	48,
+	46,
+	2,
+	1,
+	0,
+	48,
+	5,
+	6,
+	3,
+	43,
+	101,
+	112,
+	4,
+	34,
+	4,
+	32
+]);
+const MAX_IDENTIFIER_BYTES = 256;
+const MAX_GRANT_LIFETIME_MS = 3e5;
+function concatBytes(parts) {
+	const length = parts.reduce((sum, part) => sum + part.length, 0);
+	const output = new Uint8Array(length);
+	let offset = 0;
+	for (const part of parts) {
+		output.set(part, offset);
+		offset += part.length;
+	}
+	return output;
+}
+function lengthPrefix(value) {
+	if (value.length === 0 || value.length > 4294967295) throw new Error("Tenant-root grant canonical field length is invalid");
+	const output = new Uint8Array(4 + value.length);
+	new DataView(output.buffer).setUint32(0, value.length, false);
+	output.set(value, 4);
+	return output;
+}
+function u64(value, label) {
+	if (!Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive safe integer`);
+	const output = new Uint8Array(8);
+	new DataView(output.buffer).setBigUint64(0, BigInt(value), false);
+	return output;
+}
+function hasControlCharacters(value) {
+	for (const character of value) {
+		const codePoint = character.codePointAt(0) ?? 0;
+		if (codePoint <= 31 || codePoint >= 127 && codePoint <= 159) return true;
+	}
+	return false;
+}
+function identifierBytes(value, label) {
+	if (!value || value.trim() !== value || hasControlCharacters(value)) throw new Error(`${label} is invalid`);
+	const bytes = new TextEncoder().encode(value);
+	if (bytes.length > MAX_IDENTIFIER_BYTES) throw new Error(`${label} exceeds ${MAX_IDENTIFIER_BYTES} UTF-8 bytes`);
+	return bytes;
+}
+async function tenantRootIdentityDigestB64uV1(identity) {
+	return base64UrlEncode(await sha256(encodeTenantRootIdentityV1(identity)));
+}
+function exactBytes(value, expectedLength, label) {
+	if (value.length !== expectedLength || value.every((byte) => byte === 0)) throw new Error(`${label} must be a nonzero ${expectedLength}-byte value`);
+	return new Uint8Array(value);
+}
+function copyToArrayBuffer(bytes) {
+	const output = new ArrayBuffer(bytes.length);
+	new Uint8Array(output).set(bytes);
+	return output;
+}
+async function sha256(bytes) {
+	const subtle = globalThis.crypto?.subtle;
+	if (!subtle) throw new Error("WebCrypto is required for tenant-root grant issuance");
+	return new Uint8Array(await subtle.digest("SHA-256", copyToArrayBuffer(bytes)));
+}
+async function signEd25519(seed, message) {
+	const subtle = globalThis.crypto?.subtle;
+	if (!subtle) throw new Error("WebCrypto is required for tenant-root grant issuance");
+	const pkcs8 = concatBytes([ED25519_PKCS8_SEED_PREFIX, seed]);
+	try {
+		const key = await subtle.importKey("pkcs8", copyToArrayBuffer(pkcs8), "Ed25519", false, ["sign"]);
+		return new Uint8Array(await subtle.sign("Ed25519", key, copyToArrayBuffer(message)));
+	} finally {
+		pkcs8.fill(0);
+	}
+}
+function randomTenantRootCreationGrantBytesV1(length) {
+	if (!globalThis.crypto?.getRandomValues) throw new Error("A cryptographic random source is required for tenant-root grant issuance");
+	const bytes = new Uint8Array(length);
+	do
+		globalThis.crypto.getRandomValues(bytes);
+	while (bytes.every((byte) => byte === 0));
+	return bytes;
+}
+async function signTenantRootCreationGrantV1(input) {
+	if (!Number.isSafeInteger(input.issuedAtMs) || input.issuedAtMs <= 0 || !Number.isSafeInteger(input.expiresAtMs) || input.expiresAtMs <= input.issuedAtMs || input.expiresAtMs - input.issuedAtMs > MAX_GRANT_LIFETIME_MS) throw new Error("Tenant-root creation grant time window is invalid");
+	const identityBytes = encodeTenantRootIdentityV1(input.identity);
+	const custodyLineage = exactBytes(input.custodyLineage, 16, "custodyLineage");
+	const grantNonce = exactBytes(input.grantNonce, 32, "grantNonce");
+	const grantKeyId = identifierBytes(input.grantKeyId, "grantKeyId");
+	const seed = base64UrlDecode(input.signingSeedB64u);
+	if (seed.length !== 32) {
+		seed.fill(0);
+		throw new Error("Tenant-root grant authority signing seed must be 32 bytes");
+	}
+	const unsigned = concatBytes([
+		lengthPrefix(GRANT_DOMAIN),
+		lengthPrefix(GRANT_OPERATION),
+		lengthPrefix(identityBytes),
+		lengthPrefix(custodyLineage),
+		lengthPrefix(grantNonce),
+		lengthPrefix(u64(input.issuedAtMs, "issuedAtMs")),
+		lengthPrefix(u64(input.expiresAtMs, "expiresAtMs")),
+		lengthPrefix(grantKeyId)
+	]);
+	const authenticationInput = concatBytes([
+		lengthPrefix(GRANT_AUTH_DOMAIN),
+		lengthPrefix(grantKeyId),
+		lengthPrefix(unsigned)
+	]);
+	try {
+		const signature = await signEd25519(seed, authenticationInput);
+		if (signature.length !== 64) throw new Error("Tenant-root grant authority produced an invalid Ed25519 signature");
+		const grant = concatBytes([unsigned, lengthPrefix(signature)]);
+		const [identityDigest, grantDigest] = await Promise.all([sha256(identityBytes), sha256(grant)]);
+		return {
+			identityDigestB64u: base64UrlEncode(identityDigest),
+			custodyLineageB64u: base64UrlEncode(custodyLineage),
+			grantNonceB64u: base64UrlEncode(grantNonce),
+			grantKeyId: input.grantKeyId,
+			grantB64u: base64UrlEncode(grant),
+			grantDigestB64u: base64UrlEncode(grantDigest),
+			issuedAtMs: input.issuedAtMs,
+			expiresAtMs: input.expiresAtMs
+		};
+	} finally {
+		seed.fill(0);
+	}
+}
+//#endregion
+export { randomTenantRootCreationGrantBytesV1, signTenantRootCreationGrantV1, tenantRootIdentityDigestB64uV1 };
+
+//# sourceMappingURL=tenantRootCreationGrant.js.map

package/dist/esm/router/cloudflare/runtime/walletConsoleOps.js

@@ -0,0 +1,143 @@
+import { decodeTenantRootIdentityWireV1 } from "../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
+import "../../../shared-ts/src/tenant-root/index.js";
+//#region src/router/cloudflare/runtime/walletConsoleOps.ts
+const WALLET_CONSOLE_OPS_BASE_PATH_V1 = "/internal/wallet-console/v1";
+const WALLET_CONSOLE_SERVICE_ORIGIN_V1 = "https://wallet-console.internal";
+const WALLET_CONSOLE_OP_PATHS_V1 = {
+	secretKeyAuth: `${WALLET_CONSOLE_OPS_BASE_PATH_V1}/secret-key-auth`,
+	publishableKeyAuth: `${WALLET_CONSOLE_OPS_BASE_PATH_V1}/publishable-key-auth`,
+	usageEvents: `${WALLET_CONSOLE_OPS_BASE_PATH_V1}/usage-events`,
+	projectEnvironments: `${WALLET_CONSOLE_OPS_BASE_PATH_V1}/project-environments`,
+	tenantRootActiveLineage: `${WALLET_CONSOLE_OPS_BASE_PATH_V1}/tenant-root/active-lineage`
+};
+const TENANT_ROOT_ACTIVE_LINEAGE_SUCCESS_FIELDS = [
+	"ok",
+	"identityDigestB64u",
+	"custodyLineageB64u"
+];
+const TENANT_ROOT_ACTIVE_LINEAGE_SUCCESS_FIELD_SET = new Set(TENANT_ROOT_ACTIVE_LINEAGE_SUCCESS_FIELDS);
+const TENANT_ROOT_ACTIVE_LINEAGE_FAILURE_FIELDS = [
+	"ok",
+	"code",
+	"message"
+];
+const TENANT_ROOT_ACTIVE_LINEAGE_FAILURE_FIELD_SET = new Set(TENANT_ROOT_ACTIVE_LINEAGE_FAILURE_FIELDS);
+function canonicalProtocolString(value) {
+	if (typeof value !== "string" || value.length === 0 || value.trim() !== value) return null;
+	return value;
+}
+function mapTenantRootIdentityDecodeError(error) {
+	switch (error.kind) {
+		case "invalid_object": return error;
+		case "missing_field": return error;
+		case "unexpected_field": return error;
+		case "invalid_field": return error;
+	}
+}
+function decodeWalletConsoleTenantRootActiveLineageRequestV1(value) {
+	const decoded = decodeTenantRootIdentityWireV1(value);
+	if (!decoded.ok) return {
+		ok: false,
+		error: mapTenantRootIdentityDecodeError(decoded.error)
+	};
+	return {
+		ok: true,
+		value: {
+			orgId: decoded.value.orgId,
+			projectId: decoded.value.projectId,
+			envId: decoded.value.envId,
+			signingRootId: decoded.value.signingRootId,
+			signingRootVersion: decoded.value.signingRootVersion
+		}
+	};
+}
+function decodeWalletConsoleTenantRootActiveLineageResponseV1(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return {
+		ok: false,
+		error: { kind: "invalid_object" }
+	};
+	const record = value;
+	if (!Object.hasOwn(record, "ok")) return {
+		ok: false,
+		error: {
+			kind: "missing_field",
+			field: "ok"
+		}
+	};
+	if (record.ok !== true && record.ok !== false) return {
+		ok: false,
+		error: {
+			kind: "invalid_discriminant",
+			field: "ok"
+		}
+	};
+	const expectedFields = record.ok === true ? TENANT_ROOT_ACTIVE_LINEAGE_SUCCESS_FIELDS : TENANT_ROOT_ACTIVE_LINEAGE_FAILURE_FIELDS;
+	const expectedFieldSet = record.ok === true ? TENANT_ROOT_ACTIVE_LINEAGE_SUCCESS_FIELD_SET : TENANT_ROOT_ACTIVE_LINEAGE_FAILURE_FIELD_SET;
+	for (const field of expectedFields) if (!Object.hasOwn(record, field)) return {
+		ok: false,
+		error: {
+			kind: "missing_field",
+			field
+		}
+	};
+	for (const field of Object.keys(record)) if (!expectedFieldSet.has(field)) return {
+		ok: false,
+		error: {
+			kind: "unexpected_field",
+			field
+		}
+	};
+	if (record.ok === true) {
+		const identityDigestB64u = canonicalProtocolString(record.identityDigestB64u);
+		if (!identityDigestB64u) return {
+			ok: false,
+			error: {
+				kind: "invalid_field",
+				field: "identityDigestB64u"
+			}
+		};
+		const custodyLineageB64u = canonicalProtocolString(record.custodyLineageB64u);
+		if (!custodyLineageB64u) return {
+			ok: false,
+			error: {
+				kind: "invalid_field",
+				field: "custodyLineageB64u"
+			}
+		};
+		return {
+			ok: true,
+			value: {
+				ok: true,
+				identityDigestB64u,
+				custodyLineageB64u
+			}
+		};
+	}
+	if (record.code !== "invalid_body" && record.code !== "tenant_root_active_lineage_not_found") return {
+		ok: false,
+		error: {
+			kind: "invalid_field",
+			field: "code"
+		}
+	};
+	const message = canonicalProtocolString(record.message);
+	if (!message) return {
+		ok: false,
+		error: {
+			kind: "invalid_field",
+			field: "message"
+		}
+	};
+	return {
+		ok: true,
+		value: {
+			ok: false,
+			code: record.code,
+			message
+		}
+	};
+}
+//#endregion
+export { WALLET_CONSOLE_OPS_BASE_PATH_V1, WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, decodeWalletConsoleTenantRootActiveLineageRequestV1, decodeWalletConsoleTenantRootActiveLineageResponseV1 };
+
+//# sourceMappingURL=walletConsoleOps.js.map

package/dist/esm/router/cloudflare/runtime/walletConsoleOpsClient.js

@@ -0,0 +1,227 @@
+import { ROUTER_API_CREDENTIAL_SCOPES } from "../../framework/apiCredentialPorts.js";
+import { WALLET_CONSOLE_OP_PATHS_V1, WALLET_CONSOLE_SERVICE_ORIGIN_V1, decodeWalletConsoleTenantRootActiveLineageResponseV1 } from "./walletConsoleOps.js";
+//#region src/router/cloudflare/runtime/walletConsoleOpsClient.ts
+async function postJson(service, path, body) {
+	const response = await service.fetch(`${WALLET_CONSOLE_SERVICE_ORIGIN_V1}${path}`, {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify(body)
+	});
+	const parsed = await response.json().catch(() => null);
+	return {
+		status: response.status,
+		body: parsed
+	};
+}
+const PRINCIPAL_FIELDS = new Set([
+	"apiKeyId",
+	"orgId",
+	"projectId",
+	"envId",
+	"environmentId",
+	"scopes"
+]);
+const PROJECT_ENVIRONMENT_FIELDS = new Set([
+	"id",
+	"projectId",
+	"key",
+	"signingRootVersion",
+	"status"
+]);
+function responseText(value) {
+	return typeof value === "string" && value.length > 0 ? value : null;
+}
+function isRouterApiCredentialScope(value) {
+	return ROUTER_API_CREDENTIAL_SCOPES.includes(value);
+}
+function authFailureStatus(status) {
+	return status === 403 ? 403 : 401;
+}
+function parseRouterApiKeyPrincipal(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+	const record = value;
+	for (const field of Object.keys(record)) if (!PRINCIPAL_FIELDS.has(field)) return null;
+	const apiKeyId = responseText(record.apiKeyId);
+	const orgId = responseText(record.orgId);
+	const environmentId = responseText(record.environmentId);
+	if (!apiKeyId || !orgId || !environmentId || !Array.isArray(record.scopes)) return null;
+	const scopes = [];
+	for (const value of record.scopes) {
+		if (typeof value !== "string" || !isRouterApiCredentialScope(value)) return null;
+		scopes.push(value);
+	}
+	const projectId = Object.hasOwn(record, "projectId") ? responseText(record.projectId) : null;
+	if (Object.hasOwn(record, "projectId") && !projectId) return null;
+	const envId = Object.hasOwn(record, "envId") ? responseText(record.envId) : null;
+	if (Object.hasOwn(record, "envId") && !envId) return null;
+	return {
+		apiKeyId,
+		orgId,
+		environmentId,
+		scopes,
+		...projectId ? { projectId } : {},
+		...envId ? { envId } : {}
+	};
+}
+function parseSecretKeyFailureCode(value) {
+	switch (value) {
+		case "secret_key_missing":
+		case "secret_key_invalid":
+		case "secret_key_revoked":
+		case "secret_key_forbidden_scope":
+		case "secret_key_ip_blocked":
+		case "secret_key_environment_mismatch": return value;
+		default: return null;
+	}
+}
+function parsePublishableKeyFailureCode(value) {
+	switch (value) {
+		case "publishable_key_missing":
+		case "publishable_key_invalid":
+		case "publishable_key_revoked":
+		case "publishable_key_origin_blocked":
+		case "publishable_key_environment_mismatch": return value;
+		default: return null;
+	}
+}
+function parseSecretKeyAuthResponse(value, status) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+	const record = value;
+	if (record.ok === true) {
+		const principal = parseRouterApiKeyPrincipal(record.principal);
+		return principal ? {
+			ok: true,
+			principal
+		} : null;
+	}
+	if (record.ok !== false) return null;
+	const code = parseSecretKeyFailureCode(record.code);
+	const message = responseText(record.message);
+	if (!code || !message) return null;
+	return {
+		ok: false,
+		status: authFailureStatus(status),
+		code,
+		message
+	};
+}
+function parsePublishableKeyAuthResponse(value, status) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+	const record = value;
+	if (record.ok === true) {
+		const principal = parseRouterApiKeyPrincipal(record.principal);
+		return principal ? {
+			ok: true,
+			principal
+		} : null;
+	}
+	if (record.ok !== false) return null;
+	const code = parsePublishableKeyFailureCode(record.code);
+	const message = responseText(record.message);
+	if (!code || !message) return null;
+	return {
+		ok: false,
+		status: authFailureStatus(status),
+		code,
+		message
+	};
+}
+function parseProjectEnvironment(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+	const record = value;
+	for (const field of Object.keys(record)) if (!PROJECT_ENVIRONMENT_FIELDS.has(field)) return null;
+	const id = responseText(record.id);
+	const projectId = responseText(record.projectId);
+	const key = responseText(record.key);
+	const signingRootVersion = responseText(record.signingRootVersion);
+	if (!id || !projectId || !key || !signingRootVersion) return null;
+	const status = Object.hasOwn(record, "status") ? responseText(record.status) : null;
+	if (Object.hasOwn(record, "status") && !status) return null;
+	return {
+		id,
+		projectId,
+		key,
+		signingRootVersion,
+		...status ? { status } : {}
+	};
+}
+function parseProjectEnvironmentsResponse(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+	const record = value;
+	if (record.ok !== true || !Array.isArray(record.environments)) return null;
+	const environments = [];
+	for (const value of record.environments) {
+		const environment = parseProjectEnvironment(value);
+		if (!environment) return null;
+		environments.push(environment);
+	}
+	return environments;
+}
+function isUsageEventsSuccessResponse(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	const record = value;
+	return record.ok === true && Object.keys(record).length === 1;
+}
+function malformedSecretKeyAuthResult(status) {
+	return {
+		ok: false,
+		status: authFailureStatus(status),
+		code: "secret_key_invalid",
+		message: "Wallet Console authentication returned an invalid response"
+	};
+}
+function malformedPublishableKeyAuthResult(status) {
+	return {
+		ok: false,
+		status: authFailureStatus(status),
+		code: "publishable_key_invalid",
+		message: "Wallet Console authentication returned an invalid response"
+	};
+}
+/**
+* Gateway-side client for the private Wallet Console service binding. The
+* Wallet Gateway composes its Router API key auth and usage metering through
+* this client instead of a Console database binding.
+*/
+function createWalletConsoleOpsClient(service) {
+	return {
+		apiKeyAuth: { async authenticate(input) {
+			const { status, body } = await postJson(service, WALLET_CONSOLE_OP_PATHS_V1.secretKeyAuth, input);
+			return parseSecretKeyAuthResponse(body, status) ?? malformedSecretKeyAuthResult(status);
+		} },
+		publishableKeyAuth: { async authenticate(input) {
+			const { status, body } = await postJson(service, WALLET_CONSOLE_OP_PATHS_V1.publishableKeyAuth, input);
+			return parsePublishableKeyAuthResponse(body, status) ?? malformedPublishableKeyAuthResult(status);
+		} },
+		projectEnvironments: { async listEnvironments(context, filters) {
+			const { status, body } = await postJson(service, WALLET_CONSOLE_OP_PATHS_V1.projectEnvironments, {
+				context,
+				...filters ? { filters } : {}
+			});
+			const environments = parseProjectEnvironmentsResponse(body);
+			if (!environments) throw new Error(`Wallet Console environment resolution failed (HTTP ${status}): invalid response`);
+			return environments;
+		} },
+		tenantRootActiveLineage: { async resolveActiveLineage(identity) {
+			const { status, body } = await postJson(service, WALLET_CONSOLE_OP_PATHS_V1.tenantRootActiveLineage, identity);
+			const decoded = decodeWalletConsoleTenantRootActiveLineageResponseV1(body);
+			if (!decoded.ok) throw new Error(`Wallet Console tenant-root active-lineage resolution failed (HTTP ${status}): invalid response`);
+			if (!decoded.value.ok) {
+				if (status === 404 && decoded.value.code === "tenant_root_active_lineage_not_found") return null;
+				throw new Error(`Wallet Console tenant-root active-lineage resolution failed (HTTP ${status}): ${decoded.value.message}`);
+			}
+			return {
+				identityDigestB64u: decoded.value.identityDigestB64u,
+				custodyLineageB64u: decoded.value.custodyLineageB64u
+			};
+		} },
+		usageMeter: { async recordEvent(input) {
+			const { status, body } = await postJson(service, WALLET_CONSOLE_OP_PATHS_V1.usageEvents, input);
+			if (!isUsageEventsSuccessResponse(body)) throw new Error(`Wallet Console usage ingestion failed (HTTP ${status}): invalid response`);
+		} }
+	};
+}
+//#endregion
+export { createWalletConsoleOpsClient };
+
+//# sourceMappingURL=walletConsoleOpsClient.js.map