@seams/wallet-server 0.5.0

package/dist/esm/core/ThresholdService/stores/WalletSessionStore.js

@@ -0,0 +1,722 @@
+import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
+import "../../../shared-ts/src/utils/validation.js";
+import { isObject, parseEcdsaWalletSessionRecord, parseEd25519WalletSessionRecord, toThresholdEcdsaPrefixFromBase, toThresholdEcdsaWalletSessionPrefix, toThresholdEd25519PrefixFromBase, toThresholdEd25519WalletSessionPrefix } from "../validation.js";
+import { RedisTcpClient, UpstashRedisRestClient, redisGetJson, redisSetJson } from "../kv.js";
+import { createCloudflareDurableObjectThresholdEcdsaStores, createCloudflareDurableObjectThresholdEd25519Stores } from "./CloudflareDurableObjectStore.js";
+import { readNonDurableObjectThresholdStoreKind } from "./StoreConfig.js";
+//#region src/core/ThresholdService/stores/WalletSessionStore.ts
+const EXPORT_REPLAY_GUARD_CLOCK_SKEW_MS = 5 * 6e4;
+const EXPORT_REPLAY_GUARD_MIN_RETENTION_MS = 1440 * 6e4;
+var InMemoryWalletSessionStore = class {
+	constructor(input) {
+		this.map = /* @__PURE__ */ new Map();
+		this.replayGuards = /* @__PURE__ */ new Map();
+		this.keyPrefix = toThresholdEd25519WalletSessionPrefix(input.keyPrefix);
+	}
+	key(id) {
+		return `${this.keyPrefix}${id}`;
+	}
+	replayGuardKey(scopeId, replayKey) {
+		return `${this.keyPrefix}replay:${normalizeConsumeOnceKey(scopeId)}:${normalizeConsumeOnceKey(replayKey)}`;
+	}
+	async putSession(id, record, opts) {
+		const key = this.key(id);
+		const ttlMs = Math.max(0, Number(opts.ttlMs) || 0);
+		const expiresAtMs = Date.now() + ttlMs;
+		this.map.set(key, {
+			record,
+			remainingUses: Math.max(0, Number(opts.remainingUses) || 0),
+			expiresAtMs,
+			consumedIdempotencyKeys: /* @__PURE__ */ new Set()
+		});
+	}
+	async getSession(id) {
+		const key = this.key(id);
+		const entry = this.map.get(key);
+		if (!entry) return null;
+		if (entry.expiresAtMs <= Date.now()) {
+			this.map.delete(key);
+			return null;
+		}
+		return entry.record;
+	}
+	async getSessionStatus(id) {
+		const key = this.key(id);
+		const entry = this.map.get(key);
+		if (!entry) return {
+			ok: false,
+			code: "wallet_session_missing"
+		};
+		if (entry.expiresAtMs <= Date.now()) {
+			this.map.delete(key);
+			return {
+				ok: false,
+				code: "wallet_session_expired"
+			};
+		}
+		return {
+			ok: true,
+			status: {
+				record: entry.record,
+				expiresAtMs: entry.expiresAtMs,
+				remainingUses: entry.remainingUses
+			}
+		};
+	}
+	async consumeUseCount(id) {
+		const key = this.key(id);
+		const entry = this.map.get(key);
+		if (!entry) return {
+			ok: false,
+			code: "wallet_session_missing",
+			message: "Wallet Session is missing"
+		};
+		if (entry.expiresAtMs <= Date.now()) {
+			this.map.delete(key);
+			return {
+				ok: false,
+				code: "wallet_session_expired",
+				message: "Wallet Session expired"
+			};
+		}
+		if (entry.remainingUses <= 0) return {
+			ok: false,
+			code: "wallet_budget_exhausted",
+			message: "Wallet Session exhausted"
+		};
+		entry.remainingUses -= 1;
+		return {
+			ok: true,
+			remainingUses: entry.remainingUses
+		};
+	}
+	async consumeUseCountOnce(id, idempotencyKey) {
+		const key = this.key(id);
+		const entry = this.map.get(key);
+		if (!entry) return {
+			ok: false,
+			code: "wallet_session_missing",
+			message: "Wallet Session is missing"
+		};
+		if (entry.expiresAtMs <= Date.now()) {
+			this.map.delete(key);
+			return {
+				ok: false,
+				code: "wallet_session_expired",
+				message: "Wallet Session expired"
+			};
+		}
+		const consumeKey = String(idempotencyKey || "").trim();
+		if (consumeKey && entry.consumedIdempotencyKeys.has(consumeKey)) return {
+			ok: true,
+			remainingUses: entry.remainingUses
+		};
+		if (entry.remainingUses <= 0) return {
+			ok: false,
+			code: "wallet_budget_exhausted",
+			message: "Wallet Session exhausted"
+		};
+		entry.remainingUses -= 1;
+		if (consumeKey) entry.consumedIdempotencyKeys.add(consumeKey);
+		return {
+			ok: true,
+			remainingUses: entry.remainingUses
+		};
+	}
+	async hasConsumedUseCountOnce(id, idempotencyKey) {
+		const key = this.key(id);
+		const entry = this.map.get(key);
+		if (!entry) return {
+			ok: false,
+			code: "wallet_session_missing",
+			message: "Wallet Session is missing"
+		};
+		if (entry.expiresAtMs <= Date.now()) {
+			this.map.delete(key);
+			return {
+				ok: false,
+				code: "wallet_session_expired",
+				message: "Wallet Session expired"
+			};
+		}
+		const consumeKey = String(idempotencyKey || "").trim();
+		return {
+			ok: true,
+			consumed: !!consumeKey && entry.consumedIdempotencyKeys.has(consumeKey)
+		};
+	}
+	async reserveReplayGuard(scopeId, replayKey, expiresAtMs) {
+		const key = this.replayGuardKey(scopeId, replayKey);
+		if (!key) return replayGuardInvalid();
+		const nowMs = Date.now();
+		const existingExpiresAtMs = this.replayGuards.get(key);
+		if (existingExpiresAtMs !== void 0 && existingExpiresAtMs > nowMs) return replayGuardDuplicate();
+		if (existingExpiresAtMs !== void 0) this.replayGuards.delete(key);
+		const ttlMs = replayGuardTtlMs(expiresAtMs, nowMs);
+		if (ttlMs <= 0) return replayGuardExpired();
+		this.replayGuards.set(key, nowMs + ttlMs);
+		return { ok: true };
+	}
+};
+function normalizeConsumeOnceKey(value) {
+	return String(value || "").trim().replace(/[^A-Za-z0-9._:-]/g, "_").slice(0, 512);
+}
+function replayGuardTtlMs(expiresAtMs, nowMs = Date.now()) {
+	const expires = Number(expiresAtMs);
+	if (!Number.isFinite(expires)) return 0;
+	const retainUntilMs = expires + EXPORT_REPLAY_GUARD_CLOCK_SKEW_MS;
+	if (retainUntilMs <= nowMs) return 0;
+	return Math.max(EXPORT_REPLAY_GUARD_MIN_RETENTION_MS, Math.floor(retainUntilMs - nowMs));
+}
+function replayGuardInvalid() {
+	return {
+		ok: false,
+		code: "invalid_body",
+		message: "Invalid replay guard key"
+	};
+}
+function replayGuardExpired() {
+	return {
+		ok: false,
+		code: "export_authorization_expired",
+		message: "Export authorization expired"
+	};
+}
+function replayGuardDuplicate() {
+	return {
+		ok: false,
+		code: "export_nonce_replay",
+		message: "Export authorization nonce already used"
+	};
+}
+function parseRedisReplayGuardResult(raw) {
+	const text = String(raw ?? "").trim();
+	if (text === "ok") return { ok: true };
+	if (text === "duplicate") return replayGuardDuplicate();
+	if (text === "expired") return replayGuardExpired();
+	return {
+		ok: false,
+		code: "internal",
+		message: "Redis replay guard returned invalid response"
+	};
+}
+function parseRedisConsumeOnceResult(raw) {
+	const text = String(raw ?? "").trim();
+	if (text.startsWith("ok:")) {
+		const remainingUses = Number(text.slice(3));
+		if (!Number.isFinite(remainingUses)) return {
+			ok: false,
+			code: "internal",
+			message: "Redis consume-once returned invalid uses"
+		};
+		return {
+			ok: true,
+			remainingUses
+		};
+	}
+	if (text === "wallet_session_missing") return {
+		ok: false,
+		code: "wallet_session_missing",
+		message: "Wallet Session is missing"
+	};
+	if (text === "wallet_budget_exhausted") return {
+		ok: false,
+		code: "wallet_budget_exhausted",
+		message: "Wallet Session signing budget is exhausted"
+	};
+	return {
+		ok: false,
+		code: "internal",
+		message: "Redis consume-once returned invalid response"
+	};
+}
+function parseRedisConsumedUseResult(raw) {
+	const value = typeof raw === "number" ? raw : Number(String(raw ?? "").trim());
+	if (!Number.isFinite(value)) return {
+		ok: false,
+		code: "internal",
+		message: "Redis consumed-use check returned invalid response"
+	};
+	return {
+		ok: true,
+		consumed: value > 0
+	};
+}
+function redisRawValue(resp) {
+	if (resp.type === "integer") return String(resp.value);
+	return resp.value;
+}
+const CONSUME_ONCE_EXISTS_LUA = `
+local marker_key = KEYS[1]
+return redis.call('EXISTS', marker_key)
+`;
+const CONSUME_USE_COUNT_LUA = `
+local uses_key = KEYS[1]
+local current = tonumber(redis.call('GET', uses_key) or '')
+if current == nil then
+  return 'wallet_session_missing'
+end
+if current <= 0 then
+  return 'wallet_budget_exhausted'
+end
+return 'ok:' .. tostring(redis.call('INCRBY', uses_key, -1))
+`;
+const CONSUME_ONCE_LUA = `
+local uses_key = KEYS[1]
+local marker_key = KEYS[2]
+if redis.call('EXISTS', marker_key) == 1 then
+  local current = redis.call('GET', uses_key)
+  if not current then
+    return 'wallet_session_missing'
+  end
+  return 'ok:' .. tostring(current)
+end
+local current = tonumber(redis.call('GET', uses_key) or '')
+if current == nil then
+  return 'wallet_session_missing'
+end
+if current <= 0 then
+  return 'wallet_budget_exhausted'
+end
+local remaining = redis.call('INCRBY', uses_key, -1)
+local ttl = redis.call('TTL', uses_key)
+if ttl and ttl > 0 then
+  redis.call('SET', marker_key, '1', 'EX', ttl)
+else
+  redis.call('SET', marker_key, '1', 'EX', 60)
+end
+return 'ok:' .. tostring(remaining)
+`;
+const REPLAY_GUARD_LUA = `
+local key = KEYS[1]
+local ttl_seconds = tonumber(ARGV[1] or '')
+if ttl_seconds == nil or ttl_seconds <= 0 then
+  return 'expired'
+end
+if redis.call('EXISTS', key) == 1 then
+  return 'duplicate'
+end
+redis.call('SET', key, '1', 'EX', ttl_seconds)
+return 'ok'
+`;
+var UpstashRedisRestWalletSessionStore = class {
+	constructor(input) {
+		const url = normalizeOptionalTrimmedString(input.url);
+		const token = normalizeOptionalTrimmedString(input.token);
+		if (!url) throw new Error("Upstash wallet session store missing url");
+		if (!token) throw new Error("Upstash wallet session store missing token");
+		this.client = new UpstashRedisRestClient({
+			url,
+			token
+		});
+		this.keyPrefix = toThresholdEd25519WalletSessionPrefix(input.keyPrefix);
+		this.parseRecord = input.parseRecord || parseEd25519WalletSessionRecord;
+	}
+	metaKey(id) {
+		return `${this.keyPrefix}${id}`;
+	}
+	usesKey(id) {
+		return `${this.keyPrefix}${id}:uses`;
+	}
+	consumeOnceKey(id, idempotencyKey) {
+		return `${this.usesKey(id)}:once:${normalizeConsumeOnceKey(idempotencyKey)}`;
+	}
+	replayGuardKey(scopeId, replayKey) {
+		return `${this.keyPrefix}replay:${normalizeConsumeOnceKey(scopeId)}:${normalizeConsumeOnceKey(replayKey)}`;
+	}
+	async putSession(id, record, opts) {
+		const ttlMs = Math.max(0, Number(opts.ttlMs) || 0);
+		await this.client.setJson(this.metaKey(id), record, ttlMs);
+		await this.client.setRaw(this.usesKey(id), String(Math.max(0, Number(opts.remainingUses) || 0)), ttlMs);
+	}
+	async getSession(id) {
+		const raw = await this.client.getJson(this.metaKey(id));
+		return this.parseRecord(raw);
+	}
+	async getSessionStatus(id) {
+		try {
+			const record = this.parseRecord(await this.client.getJson(this.metaKey(id)));
+			if (!record) return {
+				ok: false,
+				code: "wallet_session_missing"
+			};
+			if (record.expiresAtMs <= Date.now()) return {
+				ok: false,
+				code: "wallet_session_expired"
+			};
+			const remainingUses = Number(await this.client.getRaw(this.usesKey(id)));
+			if (!Number.isSafeInteger(remainingUses) || remainingUses < 0) return {
+				ok: false,
+				code: "wallet_session_unavailable"
+			};
+			return {
+				ok: true,
+				status: {
+					record,
+					expiresAtMs: record.expiresAtMs,
+					remainingUses
+				}
+			};
+		} catch {
+			return {
+				ok: false,
+				code: "wallet_session_unavailable"
+			};
+		}
+	}
+	async consumeUseCount(id) {
+		try {
+			return parseRedisConsumeOnceResult(await this.client.eval(CONSUME_USE_COUNT_LUA, [this.usesKey(id)], []));
+		} catch (e) {
+			return {
+				ok: false,
+				code: "internal",
+				message: String(e && typeof e === "object" && "message" in e ? e.message : e || "Failed to consume threshold session")
+			};
+		}
+	}
+	async consumeUseCountOnce(id, idempotencyKey) {
+		try {
+			return parseRedisConsumeOnceResult(await this.client.eval(CONSUME_ONCE_LUA, [this.usesKey(id), this.consumeOnceKey(id, idempotencyKey)], []));
+		} catch (e) {
+			return {
+				ok: false,
+				code: "internal",
+				message: String(e && typeof e === "object" && "message" in e ? e.message : e || "Failed to consume threshold session")
+			};
+		}
+	}
+	async hasConsumedUseCountOnce(id, idempotencyKey) {
+		const consumeKey = normalizeConsumeOnceKey(idempotencyKey);
+		if (!consumeKey) return {
+			ok: true,
+			consumed: false
+		};
+		try {
+			return parseRedisConsumedUseResult(await this.client.eval(CONSUME_ONCE_EXISTS_LUA, [this.consumeOnceKey(id, consumeKey)], []));
+		} catch (e) {
+			return {
+				ok: false,
+				code: "internal",
+				message: String(e && typeof e === "object" && "message" in e ? e.message : e || "Failed to check consumed threshold session operation")
+			};
+		}
+	}
+	async reserveReplayGuard(scopeId, replayKey, expiresAtMs) {
+		try {
+			const ttlMs = replayGuardTtlMs(expiresAtMs);
+			if (ttlMs <= 0) return replayGuardExpired();
+			return parseRedisReplayGuardResult(await this.client.eval(REPLAY_GUARD_LUA, [this.replayGuardKey(scopeId, replayKey)], [String(Math.max(1, Math.ceil(ttlMs / 1e3)))]));
+		} catch (e) {
+			return {
+				ok: false,
+				code: "internal",
+				message: String(e && typeof e === "object" && "message" in e ? e.message : e || "Failed to reserve replay guard")
+			};
+		}
+	}
+};
+var RedisTcpWalletSessionStore = class {
+	constructor(input) {
+		const url = normalizeOptionalTrimmedString(input.redisUrl);
+		if (!url) throw new Error("redis-tcp wallet session store missing redisUrl");
+		this.client = new RedisTcpClient(url);
+		this.keyPrefix = toThresholdEd25519WalletSessionPrefix(input.keyPrefix);
+		this.parseRecord = input.parseRecord || parseEd25519WalletSessionRecord;
+	}
+	metaKey(id) {
+		return `${this.keyPrefix}${id}`;
+	}
+	usesKey(id) {
+		return `${this.keyPrefix}${id}:uses`;
+	}
+	consumeOnceKey(id, idempotencyKey) {
+		return `${this.usesKey(id)}:once:${normalizeConsumeOnceKey(idempotencyKey)}`;
+	}
+	replayGuardKey(scopeId, replayKey) {
+		return `${this.keyPrefix}replay:${normalizeConsumeOnceKey(scopeId)}:${normalizeConsumeOnceKey(replayKey)}`;
+	}
+	async putSession(id, record, opts) {
+		const ttlMs = Math.max(0, Number(opts.ttlMs) || 0);
+		await redisSetJson(this.client, this.metaKey(id), record, ttlMs);
+		const ttlSeconds = Math.max(1, Math.ceil(ttlMs / 1e3));
+		const uses = String(Math.max(0, Number(opts.remainingUses) || 0));
+		const resp = await this.client.send([
+			"SET",
+			this.usesKey(id),
+			uses,
+			"EX",
+			String(ttlSeconds)
+		]);
+		if (resp.type === "error") throw new Error(`Redis SET error: ${resp.value}`);
+	}
+	async getSession(id) {
+		const raw = await redisGetJson(this.client, this.metaKey(id));
+		return this.parseRecord(raw);
+	}
+	async getSessionStatus(id) {
+		try {
+			const record = this.parseRecord(await redisGetJson(this.client, this.metaKey(id)));
+			if (!record) return {
+				ok: false,
+				code: "wallet_session_missing"
+			};
+			if (record.expiresAtMs <= Date.now()) return {
+				ok: false,
+				code: "wallet_session_expired"
+			};
+			const usesResponse = await this.client.send(["GET", this.usesKey(id)]);
+			if (usesResponse.type === "error") return {
+				ok: false,
+				code: "wallet_session_unavailable"
+			};
+			const remainingUses = Number(redisRawValue(usesResponse));
+			if (!Number.isSafeInteger(remainingUses) || remainingUses < 0) return {
+				ok: false,
+				code: "wallet_session_unavailable"
+			};
+			return {
+				ok: true,
+				status: {
+					record,
+					expiresAtMs: record.expiresAtMs,
+					remainingUses
+				}
+			};
+		} catch {
+			return {
+				ok: false,
+				code: "wallet_session_unavailable"
+			};
+		}
+	}
+	async consumeUseCount(id) {
+		try {
+			const resp = await this.client.send([
+				"EVAL",
+				CONSUME_USE_COUNT_LUA,
+				"1",
+				this.usesKey(id)
+			]);
+			if (resp.type === "error") return {
+				ok: false,
+				code: "internal",
+				message: `Redis EVAL error: ${resp.value}`
+			};
+			return parseRedisConsumeOnceResult(redisRawValue(resp));
+		} catch (e) {
+			return {
+				ok: false,
+				code: "internal",
+				message: String(e && typeof e === "object" && "message" in e ? e.message : e || "Failed to consume threshold session")
+			};
+		}
+	}
+	async consumeUseCountOnce(id, idempotencyKey) {
+		try {
+			const resp = await this.client.send([
+				"EVAL",
+				CONSUME_ONCE_LUA,
+				"2",
+				this.usesKey(id),
+				this.consumeOnceKey(id, idempotencyKey)
+			]);
+			if (resp.type === "error") return {
+				ok: false,
+				code: "internal",
+				message: `Redis EVAL error: ${resp.value}`
+			};
+			return parseRedisConsumeOnceResult(resp.type === "integer" ? String(resp.value) : resp.value);
+		} catch (e) {
+			return {
+				ok: false,
+				code: "internal",
+				message: String(e && typeof e === "object" && "message" in e ? e.message : e || "Failed to consume threshold session")
+			};
+		}
+	}
+	async hasConsumedUseCountOnce(id, idempotencyKey) {
+		const consumeKey = normalizeConsumeOnceKey(idempotencyKey);
+		if (!consumeKey) return {
+			ok: true,
+			consumed: false
+		};
+		try {
+			const resp = await this.client.send(["EXISTS", this.consumeOnceKey(id, consumeKey)]);
+			if (resp.type === "error") return {
+				ok: false,
+				code: "internal",
+				message: `Redis EXISTS error: ${resp.value}`
+			};
+			return parseRedisConsumedUseResult(resp.value);
+		} catch (e) {
+			return {
+				ok: false,
+				code: "internal",
+				message: String(e && typeof e === "object" && "message" in e ? e.message : e || "Failed to check consumed threshold session operation")
+			};
+		}
+	}
+	async reserveReplayGuard(scopeId, replayKey, expiresAtMs) {
+		try {
+			const ttlMs = replayGuardTtlMs(expiresAtMs);
+			if (ttlMs <= 0) return replayGuardExpired();
+			const resp = await this.client.send([
+				"SET",
+				this.replayGuardKey(scopeId, replayKey),
+				"1",
+				"NX",
+				"EX",
+				String(Math.max(1, Math.ceil(ttlMs / 1e3)))
+			]);
+			if (resp.type === "error") return {
+				ok: false,
+				code: "internal",
+				message: `Redis SET error: ${resp.value}`
+			};
+			if (resp.type === "bulk" && resp.value === null) return replayGuardDuplicate();
+			if (resp.type === "simple" && resp.value === "OK") return { ok: true };
+			return {
+				ok: false,
+				code: "internal",
+				message: "Redis replay guard returned invalid response"
+			};
+		} catch (e) {
+			return {
+				ok: false,
+				code: "internal",
+				message: String(e && typeof e === "object" && "message" in e ? e.message : e || "Failed to reserve replay guard")
+			};
+		}
+	}
+};
+function createEd25519WalletSessionStore(input) {
+	const doStores = createCloudflareDurableObjectThresholdEd25519Stores({
+		config: input.config,
+		logger: input.logger
+	});
+	if (doStores) return doStores.walletSessionStore;
+	const config = isObject(input.config) ? input.config : {};
+	const allowInMemory = normalizeOptionalTrimmedString(config.THRESHOLD_ALLOW_IN_MEMORY_STORES) === "1";
+	const requirePersistent = !input.isNode && !allowInMemory;
+	const basePrefix = normalizeOptionalTrimmedString(config.THRESHOLD_PREFIX);
+	const envPrefix = normalizeOptionalTrimmedString(config.THRESHOLD_ED25519_WALLET_SESSION_PREFIX) || toThresholdEd25519PrefixFromBase(basePrefix, "wallet-session") || "";
+	const kind = readNonDurableObjectThresholdStoreKind(config, "threshold-ed25519");
+	if (kind === "in-memory") {
+		if (requirePersistent) throw new Error("[threshold-ed25519] In-memory wallet session store is not supported in this runtime; configure Upstash/Redis or Durable Objects");
+		return new InMemoryWalletSessionStore({ keyPrefix: envPrefix || void 0 });
+	}
+	if (kind === "upstash-redis-rest") return new UpstashRedisRestWalletSessionStore({
+		url: normalizeOptionalTrimmedString(config.url) || normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_URL),
+		token: normalizeOptionalTrimmedString(config.token) || normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_TOKEN),
+		keyPrefix: normalizeOptionalTrimmedString(config.keyPrefix) || envPrefix,
+		parseRecord: parseEd25519WalletSessionRecord
+	});
+	if (kind === "redis-tcp") {
+		if (!input.isNode) {
+			if (requirePersistent) throw new Error("[threshold-ed25519] redis-tcp wallet session store is not supported in this runtime; configure Upstash/Redis REST or Durable Objects");
+			input.logger.warn("[threshold-ed25519] redis-tcp wallet session store is not supported in this runtime; falling back to in-memory");
+			return new InMemoryWalletSessionStore({ keyPrefix: envPrefix || void 0 });
+		}
+		return new RedisTcpWalletSessionStore({
+			redisUrl: normalizeOptionalTrimmedString(config.redisUrl) || normalizeOptionalTrimmedString(config.REDIS_URL),
+			keyPrefix: normalizeOptionalTrimmedString(config.keyPrefix) || envPrefix,
+			parseRecord: parseEd25519WalletSessionRecord
+		});
+	}
+	const upstashUrl = normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_URL);
+	const upstashToken = normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_TOKEN);
+	if (upstashUrl || upstashToken) {
+		if (!upstashUrl || !upstashToken) throw new Error("Upstash wallet session store enabled but UPSTASH_REDIS_REST_URL / UPSTASH_REDIS_REST_TOKEN are not both set");
+		input.logger.info("[threshold-ed25519] Using Upstash REST store for Wallet Session records");
+		return new UpstashRedisRestWalletSessionStore({
+			url: upstashUrl,
+			token: upstashToken,
+			keyPrefix: envPrefix || void 0
+		});
+	}
+	const redisUrl = normalizeOptionalTrimmedString(config.REDIS_URL);
+	if (redisUrl) {
+		if (!input.isNode) {
+			if (requirePersistent) throw new Error("[threshold-ed25519] REDIS_URL is set but TCP Redis is not supported in this runtime; use Upstash/Redis REST or Durable Objects");
+			input.logger.warn("[threshold-ed25519] REDIS_URL is set but TCP Redis is not supported in this runtime; falling back to in-memory");
+			return new InMemoryWalletSessionStore({ keyPrefix: envPrefix || void 0 });
+		}
+		input.logger.info("[threshold-ed25519] Using redis-tcp store for Wallet Session records");
+		return new RedisTcpWalletSessionStore({
+			redisUrl,
+			keyPrefix: envPrefix || void 0
+		});
+	}
+	if (requirePersistent) throw new Error("[threshold-ed25519] Wallet Session records require persistent storage in this runtime; configure UPSTASH_REDIS_REST_URL/UPSTASH_REDIS_REST_TOKEN or Durable Objects");
+	input.logger.info("[threshold-ed25519] Using in-memory Wallet Session store (non-persistent)");
+	return new InMemoryWalletSessionStore({ keyPrefix: envPrefix || void 0 });
+}
+function createEcdsaWalletSessionStore(input) {
+	const doStores = createCloudflareDurableObjectThresholdEcdsaStores({
+		config: input.config,
+		logger: input.logger
+	});
+	if (doStores) return doStores.walletSessionStore;
+	const config = isObject(input.config) ? input.config : {};
+	const allowInMemory = normalizeOptionalTrimmedString(config.THRESHOLD_ALLOW_IN_MEMORY_STORES) === "1";
+	const requirePersistent = !input.isNode && !allowInMemory;
+	const basePrefix = normalizeOptionalTrimmedString(config.THRESHOLD_PREFIX);
+	const envPrefix = toThresholdEcdsaWalletSessionPrefix(normalizeOptionalTrimmedString(config.THRESHOLD_ECDSA_WALLET_SESSION_PREFIX) || toThresholdEcdsaPrefixFromBase(basePrefix, "wallet-session"));
+	const kind = readNonDurableObjectThresholdStoreKind(config, "threshold-ecdsa");
+	if (kind === "in-memory") {
+		if (requirePersistent) throw new Error("[threshold-ecdsa] In-memory wallet session store is not supported in this runtime; configure Upstash/Redis or Durable Objects");
+		return new InMemoryWalletSessionStore({ keyPrefix: envPrefix });
+	}
+	if (kind === "upstash-redis-rest") return new UpstashRedisRestWalletSessionStore({
+		url: normalizeOptionalTrimmedString(config.url) || normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_URL),
+		token: normalizeOptionalTrimmedString(config.token) || normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_TOKEN),
+		keyPrefix: normalizeOptionalTrimmedString(config.keyPrefix) || envPrefix,
+		parseRecord: parseEcdsaWalletSessionRecord
+	});
+	if (kind === "redis-tcp") {
+		if (!input.isNode) {
+			if (requirePersistent) throw new Error("[threshold-ecdsa] redis-tcp wallet session store is not supported in this runtime; configure Upstash/Redis REST or Durable Objects");
+			input.logger.warn("[threshold-ecdsa] redis-tcp wallet session store is not supported in this runtime; falling back to in-memory");
+			return new InMemoryWalletSessionStore({ keyPrefix: envPrefix });
+		}
+		return new RedisTcpWalletSessionStore({
+			redisUrl: normalizeOptionalTrimmedString(config.redisUrl) || normalizeOptionalTrimmedString(config.REDIS_URL),
+			keyPrefix: normalizeOptionalTrimmedString(config.keyPrefix) || envPrefix,
+			parseRecord: parseEcdsaWalletSessionRecord
+		});
+	}
+	const upstashUrl = normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_URL);
+	const upstashToken = normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_TOKEN);
+	if (upstashUrl || upstashToken) {
+		if (!upstashUrl || !upstashToken) throw new Error("Upstash wallet session store enabled but UPSTASH_REDIS_REST_URL / UPSTASH_REDIS_REST_TOKEN are not both set");
+		input.logger.info("[threshold-ecdsa] Using Upstash REST store for Wallet Session records");
+		return new UpstashRedisRestWalletSessionStore({
+			url: upstashUrl,
+			token: upstashToken,
+			keyPrefix: envPrefix,
+			parseRecord: parseEcdsaWalletSessionRecord
+		});
+	}
+	const redisUrl = normalizeOptionalTrimmedString(config.REDIS_URL);
+	if (redisUrl) {
+		if (!input.isNode) {
+			if (requirePersistent) throw new Error("[threshold-ecdsa] REDIS_URL is set but TCP Redis is not supported in this runtime; use Upstash/Redis REST or Durable Objects");
+			input.logger.warn("[threshold-ecdsa] REDIS_URL is set but TCP Redis is not supported in this runtime; falling back to in-memory");
+			return new InMemoryWalletSessionStore({ keyPrefix: envPrefix });
+		}
+		input.logger.info("[threshold-ecdsa] Using redis-tcp store for Wallet Session records");
+		return new RedisTcpWalletSessionStore({
+			redisUrl,
+			keyPrefix: envPrefix,
+			parseRecord: parseEcdsaWalletSessionRecord
+		});
+	}
+	if (requirePersistent) throw new Error("[threshold-ecdsa] Wallet Session records require persistent storage in this runtime; configure UPSTASH_REDIS_REST_URL/UPSTASH_REDIS_REST_TOKEN or Durable Objects");
+	input.logger.info("[threshold-ecdsa] Using in-memory Wallet Session store (non-persistent)");
+	return new InMemoryWalletSessionStore({ keyPrefix: envPrefix });
+}
+//#endregion
+export { createEcdsaWalletSessionStore, createEd25519WalletSessionStore };
+
+//# sourceMappingURL=WalletSessionStore.js.map