@seams/wallet-server 0.5.0

package/dist/esm/storage/tenantRoute.js

@@ -0,0 +1,89 @@
+//#region src/storage/tenantRoute.ts
+function assertNeverTenantStorageRoute(route) {
+	throw new Error(`Unhandled tenant storage route kind: ${JSON.stringify(route)}`);
+}
+function normalizeRequiredString(value, field) {
+	const normalized = value.trim();
+	if (!normalized) throw new Error(`${field} is required`);
+	return normalized;
+}
+function requireOrgId(value) {
+	normalizeRequiredString(value, "orgId");
+	return value;
+}
+function normalizeRouteVersion(value) {
+	if (!Number.isInteger(value) || value < 1) throw new Error("routeVersion must be a positive integer");
+	return value;
+}
+function createSignerD1DoStorageTarget(input) {
+	return {
+		kind: "cloudflare_d1_do",
+		metadataBindingName: normalizeRequiredString(input.metadataBindingName, "signer D1 metadataBindingName"),
+		metadataDatabaseName: normalizeRequiredString(input.metadataDatabaseName, "signer D1 metadataDatabaseName"),
+		metadataDatabase: input.metadataDatabase
+	};
+}
+function createCloudflareTenantStorageRoute(input) {
+	return {
+		kind: "cloudflare_d1_do",
+		namespace: normalizeRequiredString(input.namespace, "namespace"),
+		orgId: requireOrgId(input.orgId),
+		routeVersion: normalizeRouteVersion(input.routeVersion),
+		topology: input.topology,
+		jurisdiction: input.jurisdiction,
+		signer: input.signer
+	};
+}
+var StaticCloudflareTenantStorageRouteResolver = class {
+	constructor(input) {
+		this.routeVersion = normalizeRouteVersion(input.routeVersion);
+		this.topology = input.topology;
+		this.jurisdiction = input.jurisdiction;
+		this.signerTarget = input.signer;
+	}
+	resolveTenantStorageRoute(input) {
+		return createCloudflareTenantStorageRoute({
+			namespace: input.namespace,
+			orgId: input.orgId,
+			routeVersion: this.routeVersion,
+			topology: this.topology,
+			jurisdiction: this.jurisdiction,
+			signer: this.signerTarget
+		});
+	}
+};
+function createStaticCloudflareTenantStorageRouteResolver(input) {
+	return new StaticCloudflareTenantStorageRouteResolver(input);
+}
+function createStaticCloudflareTenantStorageRouteResolverFromBindings(input) {
+	const signerTarget = createSignerD1DoStorageTarget({
+		metadataBindingName: input.signerMetadataBindingName,
+		metadataDatabaseName: input.signerMetadataDatabaseName,
+		metadataDatabase: input.signerMetadataDatabase
+	});
+	return createStaticCloudflareTenantStorageRouteResolver({
+		routeVersion: input.routeVersion,
+		topology: input.topology,
+		jurisdiction: input.jurisdiction,
+		signer: signerTarget
+	});
+}
+function tenantStorageRouteBackendFamily(route) {
+	switch (route.kind) {
+		case "cloudflare_d1_do": return "cloudflare_d1_do";
+		case "postgres": return "postgres";
+		default: return assertNeverTenantStorageRoute(route);
+	}
+}
+function tenantStorageRouteDiagnostic(route) {
+	return {
+		backendFamily: tenantStorageRouteBackendFamily(route),
+		namespace: route.namespace,
+		orgId: route.orgId,
+		routeVersion: route.routeVersion
+	};
+}
+//#endregion
+export { StaticCloudflareTenantStorageRouteResolver, createCloudflareTenantStorageRoute, createSignerD1DoStorageTarget, createStaticCloudflareTenantStorageRouteResolver, createStaticCloudflareTenantStorageRouteResolverFromBindings, tenantStorageRouteBackendFamily, tenantStorageRouteDiagnostic };
+
+//# sourceMappingURL=tenantRoute.js.map

package/dist/esm/tenant-root.js

@@ -0,0 +1,5 @@
+import { base64UrlDecode, base64UrlEncode } from "./shared-ts/src/utils/base64.js";
+import { alphabetizeStringify, sha256Bytes } from "./shared-ts/src/utils/digests.js";
+import { buildTenantRootIdentityFromAuthenticatedDeploymentV1, decodeTenantRootIdentityWireV1, encodeTenantRootIdentityV1, isTenantRootIdentityFieldCanonicalV1 } from "./shared-ts/src/tenant-root/tenantRootIdentity.js";
+import { TENANT_ROOT_DOWNLOAD_MAX_LIFETIME_MS_V1, TENANT_ROOT_OPERATION_MAX_LIFETIME_MS_V1, TENANT_ROOT_RESTORE_ROLE_IMPORT_KEY_ISSUE_OPERATION_KIND_V1, buildTenantRootOperationRecordV1, canonicalTenantRootOperationRecordJsonV1, isTenantRootOperationKindV1, parseTenantRootOperationRecordV1, tenantRootOperationDigestB64uV1, tenantRootOperationFollowsGovernanceV1, tenantRootOperationMaxLifetimeMsV1 } from "./shared-ts/src/tenant-root/tenantRootOperationRecord.js";
+export { TENANT_ROOT_DOWNLOAD_MAX_LIFETIME_MS_V1, TENANT_ROOT_OPERATION_MAX_LIFETIME_MS_V1, TENANT_ROOT_RESTORE_ROLE_IMPORT_KEY_ISSUE_OPERATION_KIND_V1, alphabetizeStringify, base64UrlDecode, base64UrlEncode, buildTenantRootIdentityFromAuthenticatedDeploymentV1, buildTenantRootOperationRecordV1, canonicalTenantRootOperationRecordJsonV1, decodeTenantRootIdentityWireV1, encodeTenantRootIdentityV1, isTenantRootIdentityFieldCanonicalV1, isTenantRootOperationKindV1, parseTenantRootOperationRecordV1, sha256Bytes, tenantRootOperationDigestB64uV1, tenantRootOperationFollowsGovernanceV1, tenantRootOperationMaxLifetimeMsV1 };

package/dist/esm/threshold/session/signingSessionSeal/crypto/cipher.js

@@ -0,0 +1,204 @@
+import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
+import "../../../../shared-ts/src/utils/validation.js";
+import { SIGNING_SESSION_SEAL_ALG, SIGNING_SESSION_SEAL_GROUP_ID, encodeSigningSessionHkdfTuple } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
+import { parseSigningSessionSealKeyVersion } from "../../../../core/keyMaterialBrands.js";
+import { addSigningSessionSealLock, deriveSigningSessionSealLockKeyHandle, destroySigningSessionSealLockKeyHandle, removeSigningSessionSealLock } from "./shamir3PassWasm.js";
+//#region src/threshold/session/signingSessionSeal/crypto/cipher.ts
+function toErrorResult(error) {
+	if (error && typeof error === "object" && !Array.isArray(error) && error.code) return {
+		ok: false,
+		code: String(error.code || "").trim() || "internal",
+		message: String(error.message || "").trim() || "Signing-session seal cipher failed"
+	};
+	return {
+		ok: false,
+		code: "internal",
+		message: error instanceof Error ? error.message : String(error || "Signing-session seal cipher failed")
+	};
+}
+function normalizeResult(result) {
+	if (!result.ok) return {
+		ok: false,
+		code: String(result.code || "internal").trim() || "internal",
+		message: String(result.message || "Signing-session seal cipher failed").trim() || "Signing-session seal cipher failed"
+	};
+	const ciphertext = normalizeOptionalTrimmedString(result.ciphertext);
+	if (!ciphertext) return {
+		ok: false,
+		code: "invalid_ciphertext",
+		message: "Signing-session seal cipher returned empty ciphertext"
+	};
+	return {
+		ok: true,
+		ciphertext,
+		...String(result.keyVersion || "").trim() ? { keyVersion: String(result.keyVersion).trim() } : {}
+	};
+}
+function createSigningSessionSealCipherAdapter(options) {
+	return { run: async (input) => {
+		const handlerInput = {
+			thresholdSessionId: input.thresholdSessionId,
+			ciphertext: input.ciphertext,
+			...input.keyVersion ? { keyVersion: input.keyVersion } : {},
+			...input.metadata ? { metadata: input.metadata } : {},
+			auth: input.auth
+		};
+		try {
+			return normalizeResult(input.operation === "apply-server-seal" ? await options.applyServerSeal(handlerInput) : await options.removeServerSeal(handlerInput));
+		} catch (error) {
+			return toErrorResult(error);
+		}
+	} };
+}
+function createPassthroughSigningSessionSealCipherAdapter() {
+	return createSigningSessionSealCipherAdapter({
+		applyServerSeal: async (input) => ({
+			ok: true,
+			ciphertext: input.ciphertext,
+			...input.keyVersion ? { keyVersion: input.keyVersion } : {}
+		}),
+		removeServerSeal: async (input) => ({
+			ok: true,
+			ciphertext: input.ciphertext,
+			...input.keyVersion ? { keyVersion: input.keyVersion } : {}
+		})
+	});
+}
+function normalizeKeyVersion(value, label) {
+	const keyVersion = normalizeOptionalTrimmedString(value);
+	if (!keyVersion) throw new Error(`${label} is required`);
+	return parseSigningSessionSealKeyVersion(keyVersion);
+}
+function normalizeConfig(config) {
+	if (config.kind !== "shamir3pass_root_v2") throw new Error("Signing-session seal root configuration kind is invalid");
+	if (!(config.rootSecret32 instanceof Uint8Array) || config.rootSecret32.length !== 32) throw new Error("Signing-session seal root secret must be exactly 32 bytes");
+	if (config.protocol.algorithm !== "shamir3pass-v2" || config.protocol.groupId !== "rfc2409-group2") throw new Error("Signing-session seal protocol is unsupported");
+	const currentKeyVersion = normalizeKeyVersion(config.currentKeyVersion, "currentKeyVersion");
+	const acceptedWarmKeyVersions = config.acceptedWarmKeyVersions.map((keyVersion, index) => normalizeKeyVersion(keyVersion, `acceptedWarmKeyVersions[${index}]`));
+	if (!acceptedWarmKeyVersions.includes(currentKeyVersion)) throw new Error("acceptedWarmKeyVersions must include currentKeyVersion");
+	if (new Set(acceptedWarmKeyVersions).size !== acceptedWarmKeyVersions.length) throw new Error("acceptedWarmKeyVersions must not contain duplicates");
+	return {
+		kind: "shamir3pass_root_v2",
+		rootSecret32: config.rootSecret32.slice(),
+		currentKeyVersion,
+		acceptedWarmKeyVersions,
+		protocol: {
+			algorithm: SIGNING_SESSION_SEAL_ALG,
+			groupId: SIGNING_SESSION_SEAL_GROUP_ID
+		}
+	};
+}
+function encodeSigningSessionSealServerLockContext(input) {
+	return encodeSigningSessionHkdfTuple([
+		"seams/router-ab/signing-session-seal",
+		input.protocol.algorithm,
+		input.protocol.groupId,
+		input.keyVersion,
+		"server-lock/v1"
+	]);
+}
+function defaultRuntime() {
+	return {
+		deriveLockKeyHandle: deriveSigningSessionSealLockKeyHandle,
+		addLock: addSigningSessionSealLock,
+		removeLock: removeSigningSessionSealLock,
+		destroyLockKeyHandle: destroySigningSessionSealLockKeyHandle
+	};
+}
+async function deriveAcceptedKeyHandles(input) {
+	const handles = /* @__PURE__ */ new Map();
+	try {
+		for (const keyVersion of input.config.acceptedWarmKeyVersions) {
+			const handle = await input.runtime.deriveLockKeyHandle({
+				groupId: input.config.protocol.groupId,
+				rootSecret32: input.config.rootSecret32,
+				context: encodeSigningSessionSealServerLockContext({
+					protocol: input.config.protocol,
+					keyVersion
+				})
+			});
+			handles.set(keyVersion, handle);
+		}
+		return handles;
+	} catch (error) {
+		for (const handle of handles.values()) input.runtime.destroyLockKeyHandle(handle);
+		throw error;
+	} finally {
+		input.config.rootSecret32.fill(0);
+	}
+}
+var SigningSessionSealKeyHandles = class {
+	constructor(config, runtime) {
+		this.config = config;
+		this.runtime = runtime;
+		this.initialization = null;
+	}
+	get() {
+		if (!this.initialization) this.initialization = deriveAcceptedKeyHandles({
+			config: this.config,
+			runtime: this.runtime
+		});
+		return this.initialization;
+	}
+};
+function cipherFailure(code, message) {
+	return {
+		ok: false,
+		code,
+		message
+	};
+}
+function mapCipherError(error, defaultMessage) {
+	const message = normalizeOptionalTrimmedString(error instanceof Error ? error.message : error) || defaultMessage;
+	const lowered = message.toLowerCase();
+	if (lowered.includes("keyversion")) return cipherFailure("invalid_key_version", message);
+	if (lowered.includes("ciphertext") || lowered.includes("base64url") || lowered.includes("group")) return cipherFailure("invalid_ciphertext", message);
+	return cipherFailure("internal", message);
+}
+function createSigningSessionSealShamir3PassCipherAdapter(options) {
+	const config = normalizeConfig(options.config);
+	options.config.rootSecret32.fill(0);
+	const runtime = options.runtime ?? defaultRuntime();
+	const handles = new SigningSessionSealKeyHandles(config, runtime);
+	return createSigningSessionSealCipherAdapter({
+		applyServerSeal: async (input) => {
+			const requestedKeyVersion = normalizeOptionalTrimmedString(input.keyVersion);
+			if (requestedKeyVersion && requestedKeyVersion !== config.currentKeyVersion) return cipherFailure("invalid_key_version", `Requested keyVersion "${requestedKeyVersion}" does not match active keyVersion "${config.currentKeyVersion}"`);
+			try {
+				const handle = (await handles.get()).get(config.currentKeyVersion);
+				if (handle === void 0) throw new Error("currentKeyVersion handle is unavailable");
+				return {
+					ok: true,
+					ciphertext: await runtime.addLock({
+						handle,
+						ciphertextB64u: input.ciphertext
+					}),
+					keyVersion: config.currentKeyVersion
+				};
+			} catch (error) {
+				return mapCipherError(error, "Failed to apply server seal");
+			}
+		},
+		removeServerSeal: async (input) => {
+			const keyVersion = normalizeKeyVersion(input.keyVersion, "keyVersion");
+			try {
+				const handle = (await handles.get()).get(keyVersion);
+				if (handle === void 0) return cipherFailure("invalid_key_version", `Unknown keyVersion "${keyVersion}"`);
+				return {
+					ok: true,
+					ciphertext: await runtime.removeLock({
+						handle,
+						ciphertextB64u: input.ciphertext
+					}),
+					keyVersion
+				};
+			} catch (error) {
+				return mapCipherError(error, "Failed to remove server seal");
+			}
+		}
+	});
+}
+//#endregion
+export { createPassthroughSigningSessionSealCipherAdapter, createSigningSessionSealCipherAdapter, createSigningSessionSealShamir3PassCipherAdapter, encodeSigningSessionSealServerLockContext };
+
+//# sourceMappingURL=cipher.js.map

package/dist/esm/threshold/session/signingSessionSeal/crypto/shamir3PassWasm.js

@@ -0,0 +1,87 @@
+import { __wbg_init, init_shamir3pass_runtime, shamir3pass_add_lock, shamir3pass_derive_lock_key_handle, shamir3pass_destroy_lock_key_handle, shamir3pass_remove_lock } from "../../../../wasm/shamir3pass_runtime/pkg/shamir3pass_runtime.js";
+//#region src/threshold/session/signingSessionSeal/crypto/shamir3PassWasm.ts
+const SHAMIR3PASS_WASM_PATH_CANDIDATES = [
+	"../../../../wasm/shamir3pass_runtime/pkg/shamir3pass_runtime_bg.wasm",
+	"../../../../wasm/shamir3pass_runtime/pkg/shamir3pass_runtime_bg.wasm",
+	"../../../../wasm/shamir3pass_runtime/pkg/shamir3pass_runtime_bg.wasm"
+];
+let initialization = null;
+function isNodeEnvironment() {
+	const processObject = globalThis.process;
+	const isNode = Boolean(processObject?.versions?.node);
+	const webSocketPair = globalThis.WebSocketPair;
+	const navigatorObject = globalThis.navigator;
+	const isCloudflareWorker = typeof webSocketPair !== "undefined" || typeof navigatorObject?.userAgent === "string" && navigatorObject.userAgent.includes("Cloudflare-Workers");
+	return isNode && !isCloudflareWorker;
+}
+function wasmUrls() {
+	return SHAMIR3PASS_WASM_PATH_CANDIDATES.map((path) => new URL(path, import.meta.url));
+}
+async function initializeCompiledModule(module) {
+	await __wbg_init({ module_or_path: module });
+	init_shamir3pass_runtime();
+}
+async function loadBundledModule() {
+	try {
+		const imported = await import("../../../../wasm/shamir3pass_runtime/pkg/shamir3pass_runtime_bg.wasm");
+		return imported.default instanceof WebAssembly.Module ? imported.default : null;
+	} catch {
+		return null;
+	}
+}
+async function initializeNodeRuntime() {
+	const { fileURLToPath } = await import("node:url");
+	const { readFile } = await import("node:fs/promises");
+	for (const url of wasmUrls()) try {
+		const bytes = await readFile(fileURLToPath(url));
+		await initializeCompiledModule(await WebAssembly.compile(bytes));
+		return;
+	} catch {}
+	throw new Error("[shamir3pass] Failed to initialize WASM from filesystem candidates");
+}
+async function initializeWorkerRuntime() {
+	const bundledModule = await loadBundledModule();
+	if (bundledModule) {
+		await initializeCompiledModule(bundledModule);
+		return;
+	}
+	let lastError = null;
+	for (const url of wasmUrls()) try {
+		await __wbg_init({ module_or_path: url });
+		init_shamir3pass_runtime();
+		return;
+	} catch (error) {
+		lastError = error;
+	}
+	throw lastError instanceof Error ? lastError : /* @__PURE__ */ new Error("[shamir3pass] Failed to initialize WASM");
+}
+async function ensureSigningSessionSealShamir3PassWasm() {
+	if (!initialization) initialization = isNodeEnvironment() ? initializeNodeRuntime() : initializeWorkerRuntime();
+	await initialization;
+}
+async function deriveSigningSessionSealLockKeyHandle(input) {
+	await ensureSigningSessionSealShamir3PassWasm();
+	const rootSecret32 = input.rootSecret32.slice();
+	const context = input.context.slice();
+	try {
+		return shamir3pass_derive_lock_key_handle(input.groupId, rootSecret32, context);
+	} finally {
+		rootSecret32.fill(0);
+		context.fill(0);
+	}
+}
+async function addSigningSessionSealLock(input) {
+	await ensureSigningSessionSealShamir3PassWasm();
+	return shamir3pass_add_lock(input.handle, input.ciphertextB64u);
+}
+async function removeSigningSessionSealLock(input) {
+	await ensureSigningSessionSealShamir3PassWasm();
+	return shamir3pass_remove_lock(input.handle, input.ciphertextB64u);
+}
+function destroySigningSessionSealLockKeyHandle(handle) {
+	return shamir3pass_destroy_lock_key_handle(handle);
+}
+//#endregion
+export { addSigningSessionSealLock, deriveSigningSessionSealLockKeyHandle, destroySigningSessionSealLockKeyHandle, ensureSigningSessionSealShamir3PassWasm, removeSigningSessionSealLock };
+
+//# sourceMappingURL=shamir3PassWasm.js.map

package/dist/esm/threshold/session/signingSessionSeal/guards/backends.js

@@ -0,0 +1,192 @@
+import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
+import "../../../../shared-ts/src/utils/validation.js";
+import { RedisTcpClient, UpstashRedisRestClient } from "../../../../core/ThresholdService/kv.js";
+import { createInMemorySigningSessionSealRateLimiter } from "./index.js";
+//#region src/threshold/session/signingSessionSeal/guards/backends.ts
+const WINDOW_COUNTER_LUA = `
+local key = KEYS[1]
+local window_ms = tonumber(ARGV[1]) or 1
+if window_ms < 1 then
+  window_ms = 1
+end
+local current = redis.call('INCR', key)
+if current == 1 then
+  redis.call('PEXPIRE', key, window_ms)
+end
+local ttl = redis.call('PTTL', key)
+if ttl < 0 then
+  redis.call('PEXPIRE', key, window_ms)
+  ttl = window_ms
+end
+return tostring(current) .. ":" .. tostring(ttl)
+`.trim();
+function parseCounterWindow(raw) {
+	if (typeof raw !== "string") return null;
+	const [countText, ttlText] = raw.split(":");
+	const count = Number(countText);
+	const ttlMs = Number(ttlText);
+	if (!Number.isFinite(count) || !Number.isFinite(ttlMs)) return null;
+	return {
+		count: Math.max(0, Math.floor(count)),
+		ttlMs: Math.max(0, Math.floor(ttlMs))
+	};
+}
+function finalizeConsume(input) {
+	const remaining = Math.max(0, input.limit - input.count);
+	const resetAtMs = input.nowMs + Math.max(0, input.ttlMs);
+	if (input.count > input.limit) return {
+		ok: false,
+		code: "rate_limited",
+		message: "Rate limit exceeded",
+		remaining: 0,
+		resetAtMs,
+		retryAfterMs: Math.max(0, resetAtMs - input.nowMs)
+	};
+	return {
+		ok: true,
+		remaining,
+		resetAtMs
+	};
+}
+var UpstashSigningSessionSealRateLimiter = class {
+	constructor(input) {
+		this.client = new UpstashRedisRestClient({
+			url: input.url,
+			token: input.token
+		});
+		this.keyPrefix = normalizeOptionalTrimmedString(input.keyPrefix);
+	}
+	withPrefix(key) {
+		return this.keyPrefix ? `${this.keyPrefix}${key}` : key;
+	}
+	async consume(input) {
+		const key = this.withPrefix(normalizeOptionalTrimmedString(input.key));
+		if (!key) return {
+			ok: false,
+			code: "invalid_rate_limit_key",
+			message: "Rate-limit key is required"
+		};
+		try {
+			const parsed = parseCounterWindow(await this.client.eval(WINDOW_COUNTER_LUA, [key], [String(Math.max(1, Math.floor(Number(input.windowMs) || 0)))]));
+			if (!parsed) return {
+				ok: false,
+				code: "internal",
+				message: "Invalid Upstash rate-limit response"
+			};
+			return finalizeConsume({
+				count: parsed.count,
+				ttlMs: parsed.ttlMs,
+				limit: Math.max(1, Math.floor(Number(input.limit) || 0)),
+				nowMs: Math.floor(Number(input.nowMs) || 0)
+			});
+		} catch (error) {
+			return {
+				ok: false,
+				code: "internal",
+				message: error instanceof Error ? error.message : String(error || "Upstash rate-limit failed")
+			};
+		}
+	}
+};
+function redisRespToString(resp) {
+	if (resp.type === "error") return null;
+	if (resp.type === "bulk") return typeof resp.value === "string" ? resp.value : null;
+	if (resp.type === "integer") return String(resp.value);
+	if (resp.type === "simple") return resp.value;
+	return null;
+}
+var RedisTcpSigningSessionSealRateLimiter = class {
+	constructor(input) {
+		this.client = new RedisTcpClient(input.redisUrl);
+		this.keyPrefix = normalizeOptionalTrimmedString(input.keyPrefix);
+	}
+	withPrefix(key) {
+		return this.keyPrefix ? `${this.keyPrefix}${key}` : key;
+	}
+	async consume(input) {
+		const key = this.withPrefix(normalizeOptionalTrimmedString(input.key));
+		if (!key) return {
+			ok: false,
+			code: "invalid_rate_limit_key",
+			message: "Rate-limit key is required"
+		};
+		try {
+			const resp = await this.client.send([
+				"EVAL",
+				WINDOW_COUNTER_LUA,
+				"1",
+				key,
+				String(Math.max(1, Math.floor(Number(input.windowMs) || 0)))
+			]);
+			if (resp.type === "error") return {
+				ok: false,
+				code: "internal",
+				message: `Redis EVAL error: ${resp.value}`
+			};
+			const parsed = parseCounterWindow(redisRespToString(resp));
+			if (!parsed) return {
+				ok: false,
+				code: "internal",
+				message: "Invalid Redis rate-limit response"
+			};
+			return finalizeConsume({
+				count: parsed.count,
+				ttlMs: parsed.ttlMs,
+				limit: Math.max(1, Math.floor(Number(input.limit) || 0)),
+				nowMs: Math.floor(Number(input.nowMs) || 0)
+			});
+		} catch (error) {
+			return {
+				ok: false,
+				code: "internal",
+				message: error instanceof Error ? error.message : String(error || "Redis rate-limit failed")
+			};
+		}
+	}
+};
+function createUpstashSigningSessionSealRateLimiter(options) {
+	return new UpstashSigningSessionSealRateLimiter(options);
+}
+function createRedisTcpSigningSessionSealRateLimiter(options) {
+	return new RedisTcpSigningSessionSealRateLimiter(options);
+}
+function resolveSigningSessionSealRateLimitFromEnv(input) {
+	const limiterKind = normalizeOptionalTrimmedString(input.limiterKind || "").toLowerCase();
+	const upstashUrl = normalizeOptionalTrimmedString(input.upstashUrl || "");
+	const upstashToken = normalizeOptionalTrimmedString(input.upstashToken || "");
+	const redisUrl = normalizeOptionalTrimmedString(input.redisUrl || "");
+	const keyPrefix = normalizeOptionalTrimmedString(input.keyPrefix || "") || void 0;
+	const selectedKind = limiterKind || (upstashUrl || upstashToken ? "upstash-redis-rest" : redisUrl ? "redis-tcp" : "in-memory");
+	if (selectedKind === "upstash-redis-rest") {
+		if (!upstashUrl || !upstashToken) throw new Error("Upstash Signing-session seal rate limiter requires both upstashUrl and upstashToken");
+		return {
+			limiter: createUpstashSigningSessionSealRateLimiter({
+				url: upstashUrl,
+				token: upstashToken,
+				keyPrefix
+			}),
+			limit: input.limit,
+			windowMs: input.windowMs
+		};
+	}
+	if (selectedKind === "redis-tcp") {
+		if (!redisUrl) throw new Error("Redis TCP Signing-session seal rate limiter requires redisUrl");
+		return {
+			limiter: createRedisTcpSigningSessionSealRateLimiter({
+				redisUrl,
+				keyPrefix
+			}),
+			limit: input.limit,
+			windowMs: input.windowMs
+		};
+	}
+	return {
+		limiter: createInMemorySigningSessionSealRateLimiter(),
+		limit: input.limit,
+		windowMs: input.windowMs
+	};
+}
+//#endregion
+export { createRedisTcpSigningSessionSealRateLimiter, createUpstashSigningSessionSealRateLimiter, resolveSigningSessionSealRateLimitFromEnv };
+
+//# sourceMappingURL=backends.js.map