@seams/wallet-server 0.5.0

package/dist/esm/core/ThresholdService/stores/SessionStore.js

@@ -0,0 +1,437 @@
+import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
+import "../../../shared-ts/src/utils/validation.js";
+import { isObject, parseThresholdEcdsaMpcSessionRecord, parseThresholdEd25519CoordinatorSigningSessionRecord, parseThresholdEd25519MpcSessionRecord, parseThresholdEd25519SigningSessionRecord, toThresholdEcdsaPrefixFromBase, toThresholdEcdsaSessionPrefix, toThresholdEd25519PrefixFromBase, toThresholdEd25519SessionPrefix } from "../validation.js";
+import { RedisTcpClient, UpstashRedisRestClient, redisEval, redisGetRaw, redisGetdelJson, redisSetJson } from "../kv.js";
+import { createCloudflareDurableObjectThresholdEcdsaStores, createCloudflareDurableObjectThresholdEd25519Stores } from "./CloudflareDurableObjectStore.js";
+import { readNonDurableObjectThresholdStoreKind } from "./StoreConfig.js";
+//#region src/core/ThresholdService/stores/SessionStore.ts
+function parseRawJson(raw) {
+	if (!raw) return null;
+	try {
+		return JSON.parse(raw);
+	} catch {
+		return null;
+	}
+}
+function stableStoreVersion(value) {
+	return JSON.stringify(value);
+}
+var InMemoryThresholdEd25519SessionStore = class {
+	constructor(input) {
+		this.map = /* @__PURE__ */ new Map();
+		this.keyPrefix = toThresholdEd25519SessionPrefix(input.keyPrefix);
+		this.coordinatorPrefix = `${this.keyPrefix}coord:`;
+		this.parseMpcSessionRecord = input.parseMpcSessionRecord || parseThresholdEd25519MpcSessionRecord;
+	}
+	key(id) {
+		return `${this.keyPrefix}${id}`;
+	}
+	coordKey(id) {
+		return `${this.coordinatorPrefix}${id}`;
+	}
+	getRaw(key) {
+		const entry = this.map.get(key);
+		if (!entry) return null;
+		if (Date.now() > entry.expiresAtMs) {
+			this.map.delete(key);
+			return null;
+		}
+		return entry.value;
+	}
+	async putMpcSession(id, record, ttlMs) {
+		const key = this.key(id);
+		const expiresAtMs = Date.now() + Math.max(0, Number(ttlMs) || 0);
+		this.map.set(key, {
+			value: record,
+			expiresAtMs
+		});
+	}
+	async readMpcSession(id) {
+		const key = this.key(id);
+		const raw = this.getRaw(key);
+		const record = this.parseMpcSessionRecord(raw);
+		return record ? {
+			record,
+			version: stableStoreVersion(raw)
+		} : null;
+	}
+	async claimMpcSession(id, version) {
+		const key = this.key(id);
+		const entry = this.map.get(key);
+		if (!entry) return {
+			ok: false,
+			code: "not_found"
+		};
+		if (Date.now() > entry.expiresAtMs) {
+			this.map.delete(key);
+			return {
+				ok: false,
+				code: "expired"
+			};
+		}
+		if (stableStoreVersion(entry.value) !== version) return {
+			ok: false,
+			code: "version_mismatch"
+		};
+		const record = this.parseMpcSessionRecord(entry.value);
+		this.map.delete(key);
+		return record ? {
+			ok: true,
+			record
+		} : {
+			ok: false,
+			code: "invalid_record"
+		};
+	}
+	async takeMpcSession(id) {
+		const key = this.key(id);
+		const raw = this.getRaw(key);
+		this.map.delete(key);
+		return this.parseMpcSessionRecord(raw);
+	}
+	async putSigningSession(id, record, ttlMs) {
+		const key = this.key(id);
+		const expiresAtMs = Date.now() + Math.max(0, Number(ttlMs) || 0);
+		this.map.set(key, {
+			value: record,
+			expiresAtMs
+		});
+	}
+	async takeSigningSession(id) {
+		const key = this.key(id);
+		const raw = this.getRaw(key);
+		this.map.delete(key);
+		return parseThresholdEd25519SigningSessionRecord(raw);
+	}
+	async putCoordinatorSigningSession(id, record, ttlMs) {
+		const key = this.coordKey(id);
+		const expiresAtMs = Date.now() + Math.max(0, Number(ttlMs) || 0);
+		this.map.set(key, {
+			value: record,
+			expiresAtMs
+		});
+	}
+	async takeCoordinatorSigningSession(id) {
+		const key = this.coordKey(id);
+		const raw = this.getRaw(key);
+		this.map.delete(key);
+		return parseThresholdEd25519CoordinatorSigningSessionRecord(raw);
+	}
+};
+var UpstashRedisRestThresholdEd25519SessionStore = class {
+	constructor(input) {
+		const url = normalizeOptionalTrimmedString(input.url);
+		const token = normalizeOptionalTrimmedString(input.token);
+		if (!url) throw new Error("Upstash session store missing url");
+		if (!token) throw new Error("Upstash session store missing token");
+		this.client = new UpstashRedisRestClient({
+			url,
+			token
+		});
+		this.keyPrefix = toThresholdEd25519SessionPrefix(input.keyPrefix);
+		this.coordinatorPrefix = `${this.keyPrefix}coord:`;
+		this.parseMpcSessionRecord = input.parseMpcSessionRecord || parseThresholdEd25519MpcSessionRecord;
+	}
+	key(id) {
+		return `${this.keyPrefix}${id}`;
+	}
+	coordKey(id) {
+		return `${this.coordinatorPrefix}${id}`;
+	}
+	async putMpcSession(id, record, ttlMs) {
+		const k = id;
+		if (!k) throw new Error("Missing mpcSessionId");
+		await this.client.setJson(this.key(k), record, ttlMs);
+	}
+	async readMpcSession(id) {
+		const k = id;
+		if (!k) return null;
+		const raw = await this.client.getRaw(this.key(k));
+		const version = typeof raw === "string" ? raw : stableStoreVersion(raw);
+		const record = this.parseMpcSessionRecord(typeof raw === "string" ? parseRawJson(raw) : raw);
+		return record ? {
+			record,
+			version
+		} : null;
+	}
+	async claimMpcSession(id, version) {
+		const k = id;
+		if (!k) return {
+			ok: false,
+			code: "not_found"
+		};
+		const raw = await this.client.eval("local v=redis.call('GET', KEYS[1]); if not v then return '__err__:not_found' end; local decoded=cjson.decode(v); local expires=tonumber(decoded['expiresAtMs']) or 0; if expires <= tonumber(ARGV[2]) then redis.call('DEL', KEYS[1]); return '__err__:expired' end; if v ~= ARGV[1] then return '__err__:version_mismatch' end; redis.call('DEL', KEYS[1]); return v", [this.key(k)], [version, String(Date.now())]);
+		if (raw === "__err__:not_found") return {
+			ok: false,
+			code: "not_found"
+		};
+		if (raw === "__err__:expired") return {
+			ok: false,
+			code: "expired"
+		};
+		if (raw === "__err__:version_mismatch") return {
+			ok: false,
+			code: "version_mismatch"
+		};
+		const parsed = this.parseMpcSessionRecord(parseRawJson(typeof raw === "string" ? raw : null));
+		return parsed ? {
+			ok: true,
+			record: parsed
+		} : {
+			ok: false,
+			code: "invalid_record"
+		};
+	}
+	async takeMpcSession(id) {
+		const k = id;
+		if (!k) return null;
+		const raw = await this.client.getdelJson(this.key(k));
+		return this.parseMpcSessionRecord(raw);
+	}
+	async putSigningSession(id, record, ttlMs) {
+		const k = id;
+		if (!k) throw new Error("Missing signingSessionId");
+		await this.client.setJson(this.key(k), record, ttlMs);
+	}
+	async takeSigningSession(id) {
+		const k = id;
+		if (!k) return null;
+		return parseThresholdEd25519SigningSessionRecord(await this.client.getdelJson(this.key(k)));
+	}
+	async putCoordinatorSigningSession(id, record, ttlMs) {
+		const k = id;
+		if (!k) throw new Error("Missing coordinator signingSessionId");
+		await this.client.setJson(this.coordKey(k), record, ttlMs);
+	}
+	async takeCoordinatorSigningSession(id) {
+		const k = id;
+		if (!k) return null;
+		return parseThresholdEd25519CoordinatorSigningSessionRecord(await this.client.getdelJson(this.coordKey(k)));
+	}
+};
+var RedisTcpThresholdEd25519SessionStore = class {
+	constructor(input) {
+		const url = normalizeOptionalTrimmedString(input.redisUrl);
+		if (!url) throw new Error("redis-tcp session store missing redisUrl");
+		this.client = new RedisTcpClient(url);
+		this.keyPrefix = toThresholdEd25519SessionPrefix(input.keyPrefix);
+		this.coordinatorPrefix = `${this.keyPrefix}coord:`;
+		this.parseMpcSessionRecord = input.parseMpcSessionRecord || parseThresholdEd25519MpcSessionRecord;
+	}
+	key(id) {
+		return `${this.keyPrefix}${id}`;
+	}
+	coordKey(id) {
+		return `${this.coordinatorPrefix}${id}`;
+	}
+	async putMpcSession(id, record, ttlMs) {
+		const k = id;
+		if (!k) throw new Error("Missing mpcSessionId");
+		await redisSetJson(this.client, this.key(k), record, ttlMs);
+	}
+	async readMpcSession(id) {
+		const k = id;
+		if (!k) return null;
+		const raw = await redisGetRaw(this.client, this.key(k));
+		const record = this.parseMpcSessionRecord(parseRawJson(raw));
+		return record && raw ? {
+			record,
+			version: raw
+		} : null;
+	}
+	async claimMpcSession(id, version) {
+		const k = id;
+		if (!k) return {
+			ok: false,
+			code: "not_found"
+		};
+		const raw = await redisEval(this.client, "local v=redis.call('GET', KEYS[1]); if not v then return '__err__:not_found' end; local decoded=cjson.decode(v); local expires=tonumber(decoded['expiresAtMs']) or 0; if expires <= tonumber(ARGV[2]) then redis.call('DEL', KEYS[1]); return '__err__:expired' end; if v ~= ARGV[1] then return '__err__:version_mismatch' end; redis.call('DEL', KEYS[1]); return v", [this.key(k)], [version, String(Date.now())]);
+		const value = raw.type === "bulk" ? raw.value : raw.type === "simple" ? raw.value : null;
+		if (value === "__err__:not_found") return {
+			ok: false,
+			code: "not_found"
+		};
+		if (value === "__err__:expired") return {
+			ok: false,
+			code: "expired"
+		};
+		if (value === "__err__:version_mismatch") return {
+			ok: false,
+			code: "version_mismatch"
+		};
+		const parsed = this.parseMpcSessionRecord(parseRawJson(value));
+		return parsed ? {
+			ok: true,
+			record: parsed
+		} : {
+			ok: false,
+			code: "invalid_record"
+		};
+	}
+	async takeMpcSession(id) {
+		const k = id;
+		if (!k) return null;
+		const raw = await redisGetdelJson(this.client, this.key(k));
+		return this.parseMpcSessionRecord(raw);
+	}
+	async putSigningSession(id, record, ttlMs) {
+		const k = id;
+		if (!k) throw new Error("Missing signingSessionId");
+		await redisSetJson(this.client, this.key(k), record, ttlMs);
+	}
+	async takeSigningSession(id) {
+		const k = id;
+		if (!k) return null;
+		return parseThresholdEd25519SigningSessionRecord(await redisGetdelJson(this.client, this.key(k)));
+	}
+	async putCoordinatorSigningSession(id, record, ttlMs) {
+		const k = id;
+		if (!k) throw new Error("Missing coordinator signingSessionId");
+		await redisSetJson(this.client, this.coordKey(k), record, ttlMs);
+	}
+	async takeCoordinatorSigningSession(id) {
+		const k = id;
+		if (!k) return null;
+		return parseThresholdEd25519CoordinatorSigningSessionRecord(await redisGetdelJson(this.client, this.coordKey(k)));
+	}
+};
+function createThresholdEd25519SessionStore(input) {
+	const doStores = createCloudflareDurableObjectThresholdEd25519Stores({
+		config: input.config,
+		logger: input.logger
+	});
+	if (doStores) return doStores.sessionStore;
+	const config = isObject(input.config) ? input.config : {};
+	const allowInMemory = normalizeOptionalTrimmedString(config.THRESHOLD_ALLOW_IN_MEMORY_STORES) === "1";
+	const requirePersistent = !input.isNode && !allowInMemory;
+	const basePrefix = normalizeOptionalTrimmedString(config.THRESHOLD_PREFIX);
+	const envPrefix = normalizeOptionalTrimmedString(config.THRESHOLD_ED25519_SESSION_PREFIX) || toThresholdEd25519PrefixFromBase(basePrefix, "sess") || "";
+	const kind = readNonDurableObjectThresholdStoreKind(config, "threshold-ed25519");
+	if (kind === "in-memory") {
+		if (requirePersistent) throw new Error("[threshold-ed25519] In-memory session store is not supported in this runtime; configure Upstash/Redis or Durable Objects");
+		return new InMemoryThresholdEd25519SessionStore({ keyPrefix: envPrefix || void 0 });
+	}
+	if (kind === "upstash-redis-rest") return new UpstashRedisRestThresholdEd25519SessionStore({
+		url: normalizeOptionalTrimmedString(config.url) || normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_URL),
+		token: normalizeOptionalTrimmedString(config.token) || normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_TOKEN),
+		keyPrefix: normalizeOptionalTrimmedString(config.keyPrefix) || envPrefix
+	});
+	if (kind === "redis-tcp") {
+		if (!input.isNode) {
+			if (requirePersistent) throw new Error("[threshold-ed25519] redis-tcp session store is not supported in this runtime; configure Upstash/Redis REST or Durable Objects");
+			input.logger.warn("[threshold-ed25519] redis-tcp session store is not supported in this runtime; falling back to in-memory");
+			return new InMemoryThresholdEd25519SessionStore({ keyPrefix: envPrefix || void 0 });
+		}
+		return new RedisTcpThresholdEd25519SessionStore({
+			redisUrl: normalizeOptionalTrimmedString(config.redisUrl) || normalizeOptionalTrimmedString(config.REDIS_URL),
+			keyPrefix: normalizeOptionalTrimmedString(config.keyPrefix) || envPrefix
+		});
+	}
+	const upstashUrl = normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_URL);
+	const upstashToken = normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_TOKEN);
+	if (upstashUrl || upstashToken) {
+		if (!upstashUrl || !upstashToken) throw new Error("Upstash session store enabled but UPSTASH_REDIS_REST_URL / UPSTASH_REDIS_REST_TOKEN are not both set");
+		input.logger.info("[threshold-ed25519] Using Upstash REST session store for signing session persistence");
+		return new UpstashRedisRestThresholdEd25519SessionStore({
+			url: upstashUrl,
+			token: upstashToken,
+			keyPrefix: envPrefix || void 0
+		});
+	}
+	const redisUrl = normalizeOptionalTrimmedString(config.REDIS_URL);
+	if (redisUrl) {
+		if (!input.isNode) {
+			if (requirePersistent) throw new Error("[threshold-ed25519] REDIS_URL is set but TCP Redis is not supported in this runtime; use Upstash/Redis REST or Durable Objects");
+			input.logger.warn("[threshold-ed25519] REDIS_URL is set but TCP Redis is not supported in this runtime; falling back to in-memory");
+			return new InMemoryThresholdEd25519SessionStore({ keyPrefix: envPrefix || void 0 });
+		}
+		input.logger.info("[threshold-ed25519] Using redis-tcp session store for signing session persistence");
+		return new RedisTcpThresholdEd25519SessionStore({
+			redisUrl,
+			keyPrefix: envPrefix || void 0
+		});
+	}
+	if (requirePersistent) throw new Error("[threshold-ed25519] Threshold signing sessions require persistent storage in this runtime; configure UPSTASH_REDIS_REST_URL/UPSTASH_REDIS_REST_TOKEN or Durable Objects");
+	input.logger.info("[threshold-ed25519] Using in-memory session store for threshold signing sessions (non-persistent)");
+	return new InMemoryThresholdEd25519SessionStore({ keyPrefix: envPrefix || void 0 });
+}
+function createThresholdEcdsaSessionStore(input) {
+	const doStores = createCloudflareDurableObjectThresholdEcdsaStores({
+		config: input.config,
+		logger: input.logger
+	});
+	if (doStores) return doStores.sessionStore;
+	const config = isObject(input.config) ? input.config : {};
+	const allowInMemory = normalizeOptionalTrimmedString(config.THRESHOLD_ALLOW_IN_MEMORY_STORES) === "1";
+	const requirePersistent = !input.isNode && !allowInMemory;
+	const basePrefix = normalizeOptionalTrimmedString(config.THRESHOLD_PREFIX);
+	const envPrefix = toThresholdEcdsaSessionPrefix(normalizeOptionalTrimmedString(config.THRESHOLD_ECDSA_SESSION_PREFIX) || toThresholdEcdsaPrefixFromBase(basePrefix, "sess"));
+	const kind = readNonDurableObjectThresholdStoreKind(config, "threshold-ecdsa");
+	if (kind === "in-memory") {
+		if (requirePersistent) throw new Error("[threshold-ecdsa] In-memory session store is not supported in this runtime; configure Upstash/Redis or Durable Objects");
+		return new InMemoryThresholdEd25519SessionStore({
+			keyPrefix: envPrefix,
+			parseMpcSessionRecord: parseThresholdEcdsaMpcSessionRecord
+		});
+	}
+	if (kind === "upstash-redis-rest") return new UpstashRedisRestThresholdEd25519SessionStore({
+		url: normalizeOptionalTrimmedString(config.url) || normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_URL),
+		token: normalizeOptionalTrimmedString(config.token) || normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_TOKEN),
+		keyPrefix: normalizeOptionalTrimmedString(config.keyPrefix) || envPrefix,
+		parseMpcSessionRecord: parseThresholdEcdsaMpcSessionRecord
+	});
+	if (kind === "redis-tcp") {
+		if (!input.isNode) {
+			if (requirePersistent) throw new Error("[threshold-ecdsa] redis-tcp session store is not supported in this runtime; configure Upstash/Redis REST or Durable Objects");
+			input.logger.warn("[threshold-ecdsa] redis-tcp session store is not supported in this runtime; falling back to in-memory");
+			return new InMemoryThresholdEd25519SessionStore({
+				keyPrefix: envPrefix,
+				parseMpcSessionRecord: parseThresholdEcdsaMpcSessionRecord
+			});
+		}
+		return new RedisTcpThresholdEd25519SessionStore({
+			redisUrl: normalizeOptionalTrimmedString(config.redisUrl) || normalizeOptionalTrimmedString(config.REDIS_URL),
+			keyPrefix: normalizeOptionalTrimmedString(config.keyPrefix) || envPrefix,
+			parseMpcSessionRecord: parseThresholdEcdsaMpcSessionRecord
+		});
+	}
+	const upstashUrl = normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_URL);
+	const upstashToken = normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_TOKEN);
+	if (upstashUrl || upstashToken) {
+		if (!upstashUrl || !upstashToken) throw new Error("Upstash session store enabled but UPSTASH_REDIS_REST_URL / UPSTASH_REDIS_REST_TOKEN are not both set");
+		input.logger.info("[threshold-ecdsa] Using Upstash REST session store for signing session persistence");
+		return new UpstashRedisRestThresholdEd25519SessionStore({
+			url: upstashUrl,
+			token: upstashToken,
+			keyPrefix: envPrefix,
+			parseMpcSessionRecord: parseThresholdEcdsaMpcSessionRecord
+		});
+	}
+	const redisUrl = normalizeOptionalTrimmedString(config.REDIS_URL);
+	if (redisUrl) {
+		if (!input.isNode) {
+			if (requirePersistent) throw new Error("[threshold-ecdsa] REDIS_URL is set but TCP Redis is not supported in this runtime; use Upstash/Redis REST or Durable Objects");
+			input.logger.warn("[threshold-ecdsa] REDIS_URL is set but TCP Redis is not supported in this runtime; falling back to in-memory");
+			return new InMemoryThresholdEd25519SessionStore({
+				keyPrefix: envPrefix,
+				parseMpcSessionRecord: parseThresholdEcdsaMpcSessionRecord
+			});
+		}
+		input.logger.info("[threshold-ecdsa] Using redis-tcp session store for signing session persistence");
+		return new RedisTcpThresholdEd25519SessionStore({
+			redisUrl,
+			keyPrefix: envPrefix,
+			parseMpcSessionRecord: parseThresholdEcdsaMpcSessionRecord
+		});
+	}
+	if (requirePersistent) throw new Error("[threshold-ecdsa] Threshold signing sessions require persistent storage in this runtime; configure UPSTASH_REDIS_REST_URL/UPSTASH_REDIS_REST_TOKEN or Durable Objects");
+	input.logger.info("[threshold-ecdsa] Using in-memory session store for threshold signing sessions (non-persistent)");
+	return new InMemoryThresholdEd25519SessionStore({
+		keyPrefix: envPrefix,
+		parseMpcSessionRecord: parseThresholdEcdsaMpcSessionRecord
+	});
+}
+//#endregion
+export { createThresholdEcdsaSessionStore, createThresholdEd25519SessionStore };
+
+//# sourceMappingURL=SessionStore.js.map

package/dist/esm/core/ThresholdService/stores/StoreConfig.js

@@ -0,0 +1,13 @@
+import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
+import "../../../shared-ts/src/utils/validation.js";
+//#region src/core/ThresholdService/stores/StoreConfig.ts
+function readNonDurableObjectThresholdStoreKind(config, storeLabel) {
+	const kind = normalizeOptionalTrimmedString(config.kind);
+	if (!kind) return null;
+	if (kind === "in-memory" || kind === "upstash-redis-rest" || kind === "redis-tcp") return kind;
+	throw new Error(`[${storeLabel}] Unknown threshold store kind: ${kind}`);
+}
+//#endregion
+export { readNonDurableObjectThresholdStoreKind };
+
+//# sourceMappingURL=StoreConfig.js.map