@seams/wallet-server 0.5.0

package/dist/esm/core/WalletAuthMethodStore.js

@@ -0,0 +1,180 @@
+import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
+import "../shared-ts/src/utils/validation.js";
+import { resolveD1DatabaseFromConfig } from "../storage/d1Sql.js";
+import "./defaultConfigsServer.js";
+import { D1WalletAuthMethodStore, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL, ensureWalletAuthMethodStoreD1Schema, ensureWalletAuthMethodStoreD1SchemaV2, normalizeWalletAuthMethod, normalizeWalletAuthMethodV2, prepareD1WalletAuthMethodV2PutStatement, walletAuthMethodId, walletAuthMethodV2Id } from "./d1WalletAuthMethodStore.js";
+//#region src/core/WalletAuthMethodStore.ts
+function isObject(value) {
+	return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function trimString(value) {
+	return typeof value === "string" ? value.trim() : "";
+}
+function toPrefixWithColon(prefix, defaultPrefix) {
+	const p = normalizeOptionalTrimmedString(prefix);
+	if (!p) return defaultPrefix;
+	return p.endsWith(":") ? p : `${p}:`;
+}
+function resolveWalletAuthMethodStoreNamespace(config) {
+	const explicit = normalizeOptionalTrimmedString(config.WALLET_AUTH_METHOD_PREFIX);
+	if (explicit) return toPrefixWithColon(explicit, "");
+	return `${toPrefixWithColon(normalizeOptionalTrimmedString(config.THRESHOLD_PREFIX) || "w3a", `w3a:`)}wallet-auth-method:`;
+}
+function requireD1ScopeString(input, field) {
+	const normalized = normalizeOptionalTrimmedString(input);
+	if (!normalized) throw new Error(`${field} is required for D1 wallet auth-method store`);
+	return normalized;
+}
+function d1ScopeFromConfig(input) {
+	return {
+		namespace: requireD1ScopeString(input.namespace, "namespace"),
+		orgId: requireD1ScopeString(input.config.orgId || input.config.ORG_ID, "orgId"),
+		projectId: requireD1ScopeString(input.config.projectId || input.config.PROJECT_ID, "projectId"),
+		envId: requireD1ScopeString(input.config.envId || input.config.ENV_ID, "envId")
+	};
+}
+var InMemoryWalletAuthMethodStore = class {
+	constructor(namespace) {
+		this.namespace = namespace;
+		this.records = /* @__PURE__ */ new Map();
+	}
+	async put(record) {
+		this.records.set(`${this.namespace}${walletAuthMethodId(record)}`, record);
+	}
+	async getPasskey(input) {
+		return this.records.get(`${this.namespace}passkey:${input.rpId}:${input.credentialIdB64u}`) || null;
+	}
+	async getEmailOtp(input) {
+		return this.records.get(`${this.namespace}email_otp:${input.walletId}:${input.emailHashHex}`) || null;
+	}
+	async listForWallet(input) {
+		return [...this.records.values()].filter((record) => record.walletId === input.walletId && (record.kind === "email_otp" || !input.rpId || record.rpId === input.rpId));
+	}
+};
+var CloudflareDurableObjectWalletAuthMethodStore = class {
+	constructor(input) {
+		this.input = input;
+		const id = input.namespace.idFromName(input.objectName);
+		this.stub = input.namespace.get(id);
+	}
+	key(id) {
+		return `${this.input.prefix}auth-method:${id}`;
+	}
+	walletIndexKey(input) {
+		return `${this.input.prefix}wallet-index:${input.rpId || "*"}:${input.walletId}`;
+	}
+	async request(body) {
+		const response = await this.stub.fetch("https://threshold-store.invalid/", {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify(body)
+		});
+		if (!response.ok) throw new Error(`Wallet auth-method DO store HTTP ${response.status}: ${await response.text()}`);
+		return await response.json().catch(() => null);
+	}
+	async put(record) {
+		const key = this.key(walletAuthMethodId(record));
+		const indexKey = this.walletIndexKey({
+			walletId: record.walletId,
+			...record.kind === "passkey" ? { rpId: record.rpId } : {}
+		});
+		const allWalletIndexKey = this.walletIndexKey({ walletId: record.walletId });
+		const current = await this.request({
+			op: "get",
+			key: indexKey
+		});
+		const keys = Array.isArray(current?.value) ? current.value.filter((value) => typeof value === "string" && value.length > 0) : [];
+		const nextKeys = keys.includes(key) ? keys : [...keys, key];
+		const allCurrent = await this.request({
+			op: "get",
+			key: allWalletIndexKey
+		});
+		const allKeys = Array.isArray(allCurrent?.value) ? allCurrent.value.filter((value) => typeof value === "string" && value.length > 0) : [];
+		const nextAllKeys = allKeys.includes(key) ? allKeys : [...allKeys, key];
+		await this.request({
+			op: "set",
+			key,
+			value: record
+		});
+		await this.request({
+			op: "set",
+			key: indexKey,
+			value: nextKeys
+		});
+		await this.request({
+			op: "set",
+			key: allWalletIndexKey,
+			value: nextAllKeys
+		});
+	}
+	async getPasskey(input) {
+		return normalizeWalletAuthMethod((await this.request({
+			op: "get",
+			key: this.key(`passkey:${input.rpId}:${input.credentialIdB64u}`)
+		}))?.value);
+	}
+	async getEmailOtp(input) {
+		return normalizeWalletAuthMethod((await this.request({
+			op: "get",
+			key: this.key(`email_otp:${input.walletId}:${input.emailHashHex}`)
+		}))?.value);
+	}
+	async listForWallet(input) {
+		const current = await this.request({
+			op: "get",
+			key: this.walletIndexKey({ walletId: input.walletId })
+		});
+		const keys = Array.isArray(current?.value) ? current.value.filter((value) => typeof value === "string" && value.length > 0) : [];
+		const records = [];
+		for (const key of keys) {
+			const record = normalizeWalletAuthMethod((await this.request({
+				op: "get",
+				key
+			}))?.value);
+			if (record && (record.kind === "email_otp" || !input.rpId || record.rpId === input.rpId)) records.push(record);
+		}
+		return records;
+	}
+};
+function resolveDoNamespaceFromConfig(config) {
+	const isNamespace = (value) => isObject(value) && typeof value.idFromName === "function" && typeof value.get === "function";
+	if (isNamespace(config.namespace)) return config.namespace;
+	if (isNamespace(config.durableObjectNamespace)) return config.durableObjectNamespace;
+	if (isNamespace(config.THRESHOLD_DO_NAMESPACE)) return config.THRESHOLD_DO_NAMESPACE;
+	return null;
+}
+function createWalletAuthMethodStore(input) {
+	const config = isObject(input.config) ? input.config : {};
+	const namespace = resolveWalletAuthMethodStoreNamespace(config);
+	const kind = normalizeOptionalTrimmedString(config.kind);
+	if (kind === "d1") {
+		const database = resolveD1DatabaseFromConfig(config);
+		if (!database) throw new Error("[wallet-auth-method] D1 store selected but no D1 database was provided");
+		input.logger.info("[wallet-auth-method] Using D1 store");
+		return new D1WalletAuthMethodStore({
+			database,
+			...d1ScopeFromConfig({
+				config,
+				namespace
+			})
+		});
+	}
+	if (kind === "cloudflare-do") {
+		const durableObjectNamespace = resolveDoNamespaceFromConfig(config);
+		if (!durableObjectNamespace) throw new Error("cloudflare-do wallet auth-method store selected but no Durable Object namespace was provided");
+		const objectName = trimString(config.objectName) || trimString(config.name) || "threshold-store";
+		input.logger.info("[wallet-auth-method] Using Cloudflare Durable Object store");
+		return new CloudflareDurableObjectWalletAuthMethodStore({
+			namespace: durableObjectNamespace,
+			objectName,
+			prefix: namespace
+		});
+	}
+	if (kind) throw new Error(`[wallet-auth-method] Unknown wallet auth-method store kind: ${kind}`);
+	input.logger.info("[wallet-auth-method] Using in-memory store");
+	return new InMemoryWalletAuthMethodStore(namespace);
+}
+//#endregion
+export { D1WalletAuthMethodStore, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL, createWalletAuthMethodStore, ensureWalletAuthMethodStoreD1Schema, ensureWalletAuthMethodStoreD1SchemaV2, normalizeWalletAuthMethod, normalizeWalletAuthMethodV2, prepareD1WalletAuthMethodV2PutStatement, resolveWalletAuthMethodStoreNamespace, walletAuthMethodV2Id };
+
+//# sourceMappingURL=WalletAuthMethodStore.js.map

package/dist/esm/core/WalletStore.js

@@ -0,0 +1,495 @@
+import { parseWalletId } from "../shared-ts/src/utils/domainIds.js";
+import { sameRouterAbMpcMaterialActivationRef } from "../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { sameRouterAbEd25519YaoActivationBindingV1, sameRouterAbEd25519YaoActivationKeysetV1, sameRouterAbEd25519YaoActivationPublicReceiptV1, sameRouterAbEd25519YaoRecoveryAdmissionRequestV1, sameRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { derivationClientSharePublicKey33B64uFromString, ecdsaClientRootPublicKey33B64uFromString, parseSdkEcdsaDerivationThresholdKeyId } from "../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
+import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
+import "../shared-ts/src/utils/validation.js";
+import { normalizeRuntimePolicyScope } from "../shared-ts/src/threshold/signingRootScope.js";
+import { parseRouterAbEcdsaDerivationActivationRefreshRequestV1, parseRouterAbEcdsaDerivationActivationRefreshResponseV1, parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaDerivationPublicIdentityV1, sameRouterAbServerIdentityV1 } from "../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { resolveD1DatabaseFromConfig } from "../storage/d1Sql.js";
+import { thresholdEcdsaChainTargetFromValue, thresholdEcdsaChainTargetKey } from "./thresholdEcdsaChainTarget.js";
+import "./defaultConfigsServer.js";
+import { D1WalletStore, WALLET_STORE_D1_SCHEMA_SQL, buildWalletEcdsaSignerRecord, ensureWalletStoreD1Schema, parseWalletEd25519SignerRecord } from "./d1WalletStore.js";
+//#region src/core/WalletStore.ts
+function sameWalletEd25519ByteSequenceV1(left, right) {
+	if (left.length !== right.length) return false;
+	for (let index = 0; index < left.length; index += 1) if (left[index] !== right[index]) return false;
+	return true;
+}
+function sameWalletRuntimePolicyScopeV1(left, right) {
+	return left.orgId === right.orgId && left.projectId === right.projectId && left.envId === right.envId && left.signingRootVersion === right.signingRootVersion;
+}
+function sameWalletEd25519YaoActiveCapabilityV1(left, right) {
+	if (left.version !== right.version || !sameWalletEd25519ByteSequenceV1(left.activeCapabilityBinding, right.activeCapabilityBinding) || left.nearAccountId !== right.nearAccountId || !sameWalletRuntimePolicyScopeV1(left.runtimePolicyScope, right.runtimePolicyScope)) return false;
+	switch (left.version) {
+		case "wallet_ed25519_yao_registration_capability_v1":
+			if (right.version !== "wallet_ed25519_yao_registration_capability_v1") return false;
+			return sameRouterAbEd25519YaoRegistrationAdmissionRequestV1(left.admissionRequest, right.admissionRequest) && sameRouterAbEd25519YaoActivationBindingV1(left.admissionReceipt.binding, right.admissionReceipt.binding) && sameRouterAbEd25519YaoActivationKeysetV1(left.admissionReceipt.keyset, right.admissionReceipt.keyset) && sameRouterAbEd25519YaoActivationBindingV1(left.activationResult.binding, right.activationResult.binding) && sameRouterAbEd25519YaoActivationPublicReceiptV1(left.activationResult.public_receipt, right.activationResult.public_receipt);
+		case "wallet_ed25519_yao_recovery_capability_v1":
+			if (right.version !== "wallet_ed25519_yao_recovery_capability_v1") return false;
+			return sameRouterAbEd25519YaoRecoveryAdmissionRequestV1(left.admissionRequest, right.admissionRequest) && sameRouterAbEd25519YaoActivationBindingV1(left.activationResult.binding, right.activationResult.binding) && sameRouterAbEd25519YaoActivationPublicReceiptV1(left.activationResult.public_receipt, right.activationResult.public_receipt);
+		default: return assertNeverWalletEd25519YaoCapability(left);
+	}
+}
+function assertNeverWalletEd25519YaoCapability(capability) {
+	throw new Error(`Unexpected wallet Ed25519 Yao capability: ${String(capability)}`);
+}
+function sameWalletEd25519SignerRecordV1(left, right) {
+	return left.version === right.version && left.walletId === right.walletId && left.signerId === right.signerId && left.nearAccountId === right.nearAccountId && left.nearEd25519SigningKeyId === right.nearEd25519SigningKeyId && left.thresholdSessionId === right.thresholdSessionId && left.signerSlot === right.signerSlot && left.publicKey === right.publicKey && left.signingWorkerId === right.signingWorkerId && left.keyVersion === right.keyVersion && left.recoveryExportCapable === right.recoveryExportCapable && left.participantIds[0] === right.participantIds[0] && left.participantIds[1] === right.participantIds[1] && left.signingRootId === right.signingRootId && left.signingRootVersion === right.signingRootVersion && sameWalletRuntimePolicyScopeV1(left.runtimePolicyScope, right.runtimePolicyScope) && sameWalletEd25519YaoActiveCapabilityV1(left.activeYaoCapability, right.activeYaoCapability) && left.custodyKeyManifestDigestB64u === right.custodyKeyManifestDigestB64u && left.createdAtMs === right.createdAtMs && left.updatedAtMs === right.updatedAtMs;
+}
+function parseWalletEcdsaPendingSessionActivationRecord(raw) {
+	if (!isObject(raw) || raw.version !== "wallet_ecdsa_pending_session_activation_v1") return null;
+	const walletId = parseWalletId(raw.walletId);
+	const lifecycleId = normalizeOptionalTrimmedString(raw.lifecycleId);
+	const requestId = normalizeOptionalTrimmedString(raw.requestId);
+	const createdAtMs = normalizeTimestampMs(raw.createdAtMs);
+	const expiresAtMs = normalizeTimestampMs(raw.expiresAtMs);
+	if (!walletId.ok || !lifecycleId || !requestId || createdAtMs == null || expiresAtMs == null || expiresAtMs <= createdAtMs) return null;
+	try {
+		const base = {
+			version: "wallet_ecdsa_pending_session_activation_v1",
+			walletId: walletId.value,
+			lifecycleId,
+			requestId,
+			publicCapability: parseRouterAbEcdsaDerivationPublicCapabilityV1(raw.publicCapability),
+			createdAtMs,
+			expiresAtMs
+		};
+		if (raw.operation !== "refresh") return null;
+		return {
+			...base,
+			operation: "refresh",
+			request: parseRouterAbEcdsaDerivationActivationRefreshRequestV1(raw.request),
+			response: parseForwardedEcdsaRefreshResponse(raw.response)
+		};
+	} catch {
+		return null;
+	}
+}
+function parseForwardedEcdsaRefreshResponse(raw) {
+	const response = parseRouterAbEcdsaDerivationActivationRefreshResponseV1(raw);
+	if (response.result !== "forwarded") throw new Error("Persisted ECDSA refresh proof must be forwarded");
+	return response;
+}
+function ecdsaPublicCapabilitiesEqual(left, right) {
+	return sameRouterAbEcdsaDerivationPublicCapabilityV1(left, right);
+}
+function sameWalletEcdsaSignerSetV1(left, right) {
+	return left.signer_set_id === right.signer_set_id && left.policy === right.policy && left.signer_a.role === right.signer_a.role && left.signer_a.signer_id === right.signer_a.signer_id && left.signer_a.key_epoch === right.signer_a.key_epoch && left.signer_b.role === right.signer_b.role && left.signer_b.signer_id === right.signer_b.signer_id && left.signer_b.key_epoch === right.signer_b.key_epoch && sameRouterAbServerIdentityV1(left.selected_server, right.selected_server);
+}
+function ecdsaPostRegistrationRequestMatchesCapability(input) {
+	return input.request.client_id === input.capability.client_id && input.request.router_id === input.capability.router_id && input.request.context.application_binding_digest_b64u === input.capability.context.application_binding_digest_b64u && sameRouterAbEcdsaDerivationPublicIdentityV1(input.request.public_identity, input.capability.public_identity) && sameWalletEcdsaSignerSetV1(input.request.signer_set, input.capability.signer_set);
+}
+function isObject(v) {
+	return Boolean(v && typeof v === "object" && !Array.isArray(v));
+}
+function trimString(value) {
+	return typeof value === "string" ? value.trim() : "";
+}
+function toPrefixWithColon(prefix, defaultPrefix) {
+	const p = normalizeOptionalTrimmedString(prefix);
+	if (!p) return defaultPrefix;
+	return p.endsWith(":") ? p : `${p}:`;
+}
+function resolveWalletStoreNamespace(config) {
+	const explicit = normalizeOptionalTrimmedString(config.WALLET_PREFIX);
+	if (explicit) return toPrefixWithColon(explicit, "");
+	return `${toPrefixWithColon(normalizeOptionalTrimmedString(config.THRESHOLD_PREFIX) || "w3a", `w3a:`)}wallet:`;
+}
+function resolveDoNamespaceFromConfig(config) {
+	const isNamespace = (value) => isObject(value) && typeof value.idFromName === "function" && typeof value.get === "function";
+	const direct = config.namespace;
+	if (isNamespace(direct)) return direct;
+	const durableObjectNamespace = config.durableObjectNamespace;
+	if (isNamespace(durableObjectNamespace)) return durableObjectNamespace;
+	const envStyle = config.THRESHOLD_DO_NAMESPACE;
+	if (isNamespace(envStyle)) return envStyle;
+	return null;
+}
+function signerFamily(record) {
+	return record.version === "wallet_signer_ed25519_v1" ? "ed25519" : "ecdsa";
+}
+function normalizeTimestampMs(value) {
+	const numberValue = Number(value);
+	if (!Number.isFinite(numberValue) || numberValue < 0) return null;
+	return Math.floor(numberValue);
+}
+function parseWalletRecord(raw) {
+	if (!isObject(raw)) return null;
+	if (raw.version !== "wallet_v1") return null;
+	const walletId = parseWalletId(raw.walletId);
+	const createdAtMs = normalizeTimestampMs(raw.createdAtMs);
+	const updatedAtMs = normalizeTimestampMs(raw.updatedAtMs);
+	if (!walletId.ok || createdAtMs == null || updatedAtMs == null) return null;
+	return {
+		version: "wallet_v1",
+		walletId: walletId.value,
+		createdAtMs,
+		updatedAtMs
+	};
+}
+function parseWalletEcdsaSignerRecord(raw) {
+	if (!isObject(raw) || raw.version !== "wallet_signer_ecdsa_v1") return null;
+	if ("evmFamilySigningKeySlotId" in raw) return null;
+	const walletId = parseWalletId(raw.walletId);
+	const signerId = normalizeOptionalTrimmedString(raw.signerId);
+	const chainTargetKey = normalizeOptionalTrimmedString(raw.chainTargetKey);
+	const chainTarget = thresholdEcdsaChainTargetFromValue(raw.chainTarget);
+	const walletKeyRaw = isObject(raw.walletKey) ? raw.walletKey : null;
+	const walletKey = walletKeyRaw ? parseWalletEcdsaSignerKey(walletKeyRaw) : null;
+	let activationReceipt;
+	let runtimePolicyScope;
+	let custodyClientRootPublicKey33B64u;
+	try {
+		activationReceipt = parseRouterAbEcdsaRegistrationActivationReceiptV1(raw.activationReceipt);
+		runtimePolicyScope = normalizeRuntimePolicyScope(raw.runtimePolicyScope);
+		custodyClientRootPublicKey33B64u = ecdsaClientRootPublicKey33B64uFromString(String(raw.custodyClientRootPublicKey33B64u ?? ""));
+	} catch {
+		return null;
+	}
+	const custodyKeyManifestDigestB64u = normalizeOptionalTrimmedString(raw.custodyKeyManifestDigestB64u);
+	const createdAtMs = normalizeTimestampMs(raw.createdAtMs);
+	const updatedAtMs = normalizeTimestampMs(raw.updatedAtMs);
+	if (!walletId.ok || !signerId || !chainTargetKey || !chainTarget || !walletKey || !custodyKeyManifestDigestB64u || createdAtMs === null || updatedAtMs === null || walletKey.walletId !== walletId.value || thresholdEcdsaChainTargetKey(chainTarget) !== chainTargetKey || thresholdEcdsaChainTargetKey(walletKey.chainTarget) !== chainTargetKey) return null;
+	return {
+		version: "wallet_signer_ecdsa_v1",
+		walletId: walletId.value,
+		signerId,
+		chainTargetKey,
+		chainTarget,
+		walletKey,
+		activationReceipt,
+		runtimePolicyScope,
+		custodyKeyManifestDigestB64u,
+		custodyClientRootPublicKey33B64u,
+		createdAtMs,
+		updatedAtMs
+	};
+}
+function parseWalletEcdsaSignerKey(raw) {
+	if ("evmFamilySigningKeySlotId" in raw) return null;
+	const walletId = parseWalletId(raw.walletId);
+	const chainTarget = thresholdEcdsaChainTargetFromValue(raw.chainTarget);
+	const participantIds = raw.participantIds;
+	const clientShareRetryCounter = normalizeNonNegativeInteger(raw.clientShareRetryCounter);
+	const relayerShareRetryCounter = normalizeNonNegativeInteger(raw.relayerShareRetryCounter);
+	let publicCapability;
+	try {
+		publicCapability = parseRouterAbEcdsaDerivationPublicCapabilityV1(raw.publicCapability);
+	} catch {
+		return null;
+	}
+	let derivationClientSharePublicKey33B64u;
+	try {
+		derivationClientSharePublicKey33B64u = derivationClientSharePublicKey33B64uFromString(normalizeOptionalTrimmedString(raw.derivationClientSharePublicKey33B64u) || "");
+	} catch {
+		return null;
+	}
+	if (raw.keyScope !== "evm-family" || !walletId.ok || !chainTarget || !Array.isArray(participantIds) || participantIds.length !== 2 || participantIds[0] !== 1 || participantIds[1] !== 2 || clientShareRetryCounter === null || relayerShareRetryCounter === null) return null;
+	const keyHandle = normalizeOptionalTrimmedString(raw.keyHandle);
+	let ecdsaThresholdKeyId;
+	try {
+		ecdsaThresholdKeyId = parseSdkEcdsaDerivationThresholdKeyId(raw.ecdsaThresholdKeyId);
+	} catch {
+		return null;
+	}
+	const signingRootId = normalizeOptionalTrimmedString(raw.signingRootId);
+	const signingRootVersion = normalizeOptionalTrimmedString(raw.signingRootVersion);
+	const thresholdEcdsaPublicKeyB64u = normalizeOptionalTrimmedString(raw.thresholdEcdsaPublicKeyB64u);
+	const thresholdOwnerAddress = normalizeOptionalTrimmedString(raw.thresholdOwnerAddress);
+	const relayerKeyId = normalizeOptionalTrimmedString(raw.relayerKeyId);
+	const relayerVerifyingShareB64u = normalizeOptionalTrimmedString(raw.relayerVerifyingShareB64u);
+	const contextBinding32B64u = normalizeOptionalTrimmedString(raw.contextBinding32B64u);
+	if (!keyHandle || !signingRootId || !signingRootVersion || !thresholdEcdsaPublicKeyB64u || !thresholdOwnerAddress || !relayerKeyId || !relayerVerifyingShareB64u || !contextBinding32B64u) return null;
+	return {
+		keyScope: "evm-family",
+		chainTarget,
+		walletId: walletId.value,
+		keyHandle,
+		ecdsaThresholdKeyId,
+		signingRootId,
+		signingRootVersion,
+		thresholdEcdsaPublicKeyB64u,
+		thresholdOwnerAddress,
+		relayerKeyId,
+		relayerVerifyingShareB64u,
+		contextBinding32B64u,
+		derivationClientSharePublicKey33B64u,
+		clientShareRetryCounter,
+		relayerShareRetryCounter,
+		participantIds: [1, 2],
+		publicCapability
+	};
+}
+function normalizeNonNegativeInteger(value) {
+	const normalized = Number(value);
+	return Number.isSafeInteger(normalized) && normalized >= 0 ? normalized : null;
+}
+function requireD1ScopeString(input, field) {
+	const normalized = normalizeOptionalTrimmedString(input);
+	if (!normalized) throw new Error(`${field} is required for D1 wallet store`);
+	return normalized;
+}
+function d1ScopeFromConfig(input) {
+	return {
+		namespace: requireD1ScopeString(input.namespace, "namespace"),
+		orgId: requireD1ScopeString(input.config.orgId || input.config.ORG_ID, "orgId"),
+		projectId: requireD1ScopeString(input.config.projectId || input.config.PROJECT_ID, "projectId"),
+		envId: requireD1ScopeString(input.config.envId || input.config.ENV_ID, "envId")
+	};
+}
+function buildWalletEd25519SignerId(input) {
+	const nearAccountId = String(input.nearAccountId || "").trim();
+	const signerSlot = Number(input.signerSlot);
+	if (!nearAccountId) throw new Error("Ed25519 signer ID requires nearAccountId");
+	if (!Number.isSafeInteger(signerSlot) || signerSlot < 1) throw new Error("Ed25519 signer ID requires an exact signerSlot");
+	return `ed25519:${nearAccountId}:${signerSlot}`;
+}
+var InMemoryWalletStore = class {
+	constructor(prefix) {
+		this.prefix = prefix;
+		this.subjects = /* @__PURE__ */ new Map();
+		this.signers = /* @__PURE__ */ new Map();
+		this.pendingEcdsaActivations = /* @__PURE__ */ new Map();
+	}
+	async getWallet(input) {
+		const walletId = normalizeOptionalTrimmedString(input.walletId);
+		if (!walletId) return null;
+		return this.subjects.get(`${this.prefix}${walletId}`) ?? null;
+	}
+	async getEcdsaSignerByKeyHandle(input) {
+		const walletId = normalizeOptionalTrimmedString(input.walletId);
+		const keyHandle = normalizeOptionalTrimmedString(input.keyHandle);
+		if (!walletId || !keyHandle) return null;
+		const chainTargetKey = thresholdEcdsaChainTargetKey(input.chainTarget);
+		const matches = [...this.signers.values()].filter((record) => record.version === "wallet_signer_ecdsa_v1" && record.walletId === walletId && record.walletKey.keyHandle === keyHandle && record.chainTargetKey === chainTargetKey);
+		return matches.length === 1 ? matches[0] : null;
+	}
+	async getEd25519SignerBySlot(input) {
+		const matches = [...this.signers.values()].filter((record) => record.version === "wallet_signer_ed25519_v1" && record.walletId === input.walletId && record.signerSlot === input.signerSlot);
+		return matches.length === 1 ? matches[0] ?? null : null;
+	}
+	async getEcdsaSignerByPublicCapability(input) {
+		const matches = [...this.signers.values()].filter((record) => record.version === "wallet_signer_ecdsa_v1" && record.walletId === input.walletId && ecdsaPublicCapabilitiesEqual(record.walletKey.publicCapability, input.publicCapability));
+		if (matches.length === 0) return null;
+		const keyHandle = matches[0]?.walletKey.keyHandle;
+		if (!keyHandle || matches.some((record) => record.walletKey.keyHandle !== keyHandle)) throw new Error("Wallet has conflicting ECDSA public capabilities");
+		return matches[0] ?? null;
+	}
+	async getEcdsaSignerByMaterialActivation(input) {
+		const matches = [...this.signers.values()].filter((record) => record.version === "wallet_signer_ecdsa_v1" && record.walletId === input.walletId && sameRouterAbMpcMaterialActivationRef(record.walletKey.publicCapability.material_activation, input.materialActivation));
+		if (matches.length === 0) return null;
+		const keyHandle = matches[0]?.walletKey.keyHandle;
+		if (!keyHandle || matches.some((record) => record.walletKey.keyHandle !== keyHandle)) throw new Error("Wallet has conflicting ECDSA material activations");
+		return matches[0] ?? null;
+	}
+	async getEcdsaSignerByPostRegistrationRequest(input) {
+		const matches = [...this.signers.values()].filter((record) => record.version === "wallet_signer_ecdsa_v1" && record.walletId === input.walletId && ecdsaPostRegistrationRequestMatchesCapability({
+			request: input.request,
+			capability: record.walletKey.publicCapability
+		}));
+		if (matches.length === 0) return null;
+		const keyHandle = matches[0]?.walletKey.keyHandle;
+		if (!keyHandle || matches.some((record) => record.walletKey.keyHandle !== keyHandle)) throw new Error("Wallet has conflicting ECDSA post-registration identities");
+		return matches[0] ?? null;
+	}
+	async listEcdsaSignersForWallet(input) {
+		return [...this.signers.values()].filter((record) => record.version === "wallet_signer_ecdsa_v1" && record.walletId === input.walletId);
+	}
+	async putEcdsaPendingSessionActivation(record) {
+		this.pendingEcdsaActivations.set(`${record.walletId}:${record.lifecycleId}:${record.requestId}`, record);
+	}
+	async putSubject(record) {
+		this.subjects.set(`${this.prefix}${record.walletId}`, record);
+	}
+	async putSigner(record) {
+		this.signers.set(`${this.prefix}${record.walletId}:${signerFamily(record)}:${record.signerId}`, record);
+	}
+	async putSigners(records) {
+		for (const record of records) await this.putSigner(record);
+	}
+};
+var CloudflareDurableObjectWalletStore = class {
+	constructor(input) {
+		this.input = input;
+		const id = input.namespace.idFromName(input.objectName);
+		this.stub = input.namespace.get(id);
+	}
+	key(scope, id) {
+		return `${this.input.prefix}${scope}:${id}`;
+	}
+	async put(key, value) {
+		const response = await this.stub.fetch("https://threshold-store.invalid/", {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({
+				op: "set",
+				key,
+				value
+			})
+		});
+		if (!response.ok) throw new Error(`Wallet DO store HTTP ${response.status}: ${await response.text()}`);
+	}
+	async putSubject(record) {
+		await this.put(this.key("subject", record.walletId), record);
+	}
+	async getWallet(input) {
+		const walletId = normalizeOptionalTrimmedString(input.walletId);
+		if (!walletId) return null;
+		const response = await this.stub.fetch("https://threshold-store.invalid/", {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({
+				op: "get",
+				key: this.key("subject", walletId)
+			})
+		});
+		if (!response.ok) return null;
+		return parseWalletRecord((await response.json().catch(() => null))?.value);
+	}
+	async getEcdsaSignerByKeyHandle(input) {
+		const walletId = normalizeOptionalTrimmedString(input.walletId);
+		const keyHandle = normalizeOptionalTrimmedString(input.keyHandle);
+		if (!walletId || !keyHandle) return null;
+		const chainTargetKey = thresholdEcdsaChainTargetKey(input.chainTarget);
+		const response = await this.stub.fetch("https://threshold-store.invalid/", {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({
+				op: "get",
+				key: this.key("signer", `${walletId}:ecdsa-key-handle:${keyHandle}:${chainTargetKey}`)
+			})
+		});
+		if (!response.ok) return null;
+		return parseWalletEcdsaSignerRecord((await response.json().catch(() => null))?.value);
+	}
+	async getEd25519SignerBySlot(input) {
+		const response = await this.stub.fetch("https://threshold-store.invalid/", {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({
+				op: "get",
+				key: this.key("signer", `${input.walletId}:ed25519-slot:${input.signerSlot}`)
+			})
+		});
+		if (!response.ok) return null;
+		return parseWalletEd25519SignerRecord((await response.json().catch(() => null))?.value);
+	}
+	async getEcdsaSignerByPublicCapability(input) {
+		const response = await this.stub.fetch("https://threshold-store.invalid/", {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({
+				op: "get",
+				key: this.key("signer", `${input.walletId}:ecdsa-public-capability:${input.publicCapability.registration_request_digest_b64u}`)
+			})
+		});
+		if (!response.ok) return null;
+		const signer = parseWalletEcdsaSignerRecord((await response.json().catch(() => null))?.value);
+		return signer && ecdsaPublicCapabilitiesEqual(signer.walletKey.publicCapability, input.publicCapability) ? signer : null;
+	}
+	async getEcdsaSignerByMaterialActivation(input) {
+		const response = await this.stub.fetch("https://threshold-store.invalid/", {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({
+				op: "get",
+				key: this.key("signer", `${input.walletId}:ecdsa-material-activation:${input.materialActivation.activation_id}`)
+			})
+		});
+		if (!response.ok) return null;
+		const signer = parseWalletEcdsaSignerRecord((await response.json().catch(() => null))?.value);
+		return signer && signer.walletId === input.walletId && sameRouterAbMpcMaterialActivationRef(signer.walletKey.publicCapability.material_activation, input.materialActivation) ? signer : null;
+	}
+	async getEcdsaSignerByPostRegistrationRequest(input) {
+		const capabilityDigest = input.request.public_identity.context_binding_b64u;
+		const response = await this.stub.fetch("https://threshold-store.invalid/", {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({
+				op: "get",
+				key: this.key("signer", `${input.walletId}:ecdsa-context-binding:${capabilityDigest}`)
+			})
+		});
+		if (!response.ok) return null;
+		const signer = parseWalletEcdsaSignerRecord((await response.json().catch(() => null))?.value);
+		return signer && ecdsaPostRegistrationRequestMatchesCapability({
+			request: input.request,
+			capability: signer.walletKey.publicCapability
+		}) ? signer : null;
+	}
+	async listEcdsaSignersForWallet(input) {
+		const response = await this.stub.fetch("https://threshold-store.invalid/", {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({
+				op: "get",
+				key: this.key("signer", `${input.walletId}:ecdsa-list`)
+			})
+		});
+		if (!response.ok) return [];
+		const current = await response.json().catch(() => null);
+		if (current?.value === void 0 || current.value === null) return [];
+		if (!Array.isArray(current.value)) throw new Error("Wallet ECDSA signer list is invalid");
+		const signers = [];
+		for (const raw of current.value) {
+			const signer = parseWalletEcdsaSignerRecord(raw);
+			if (!signer || signer.walletId !== input.walletId) throw new Error("Wallet ECDSA signer list contains an invalid record");
+			signers.push(signer);
+		}
+		return signers;
+	}
+	async putEcdsaPendingSessionActivation(record) {
+		await this.put(this.key("ecdsa-session-activation", `${record.walletId}:${record.lifecycleId}:${record.requestId}`), record);
+	}
+	async putSigner(record) {
+		await this.put(this.key("signer", `${record.walletId}:${signerFamily(record)}:${record.signerId}`), record);
+		if (record.version === "wallet_signer_ecdsa_v1") {
+			await this.put(this.key("signer", `${record.walletId}:ecdsa-key-handle:${record.walletKey.keyHandle}:${record.chainTargetKey}`), record);
+			await this.put(this.key("signer", `${record.walletId}:ecdsa-public-capability:${record.walletKey.publicCapability.registration_request_digest_b64u}`), record);
+			await this.put(this.key("signer", `${record.walletId}:ecdsa-material-activation:${record.walletKey.publicCapability.material_activation.activation_id}`), record);
+			await this.put(this.key("signer", `${record.walletId}:ecdsa-context-binding:${record.walletKey.publicCapability.public_identity.context_binding_b64u}`), record);
+			const next = (await this.listEcdsaSignersForWallet({ walletId: record.walletId })).filter((signer) => signer.chainTargetKey !== record.chainTargetKey);
+			await this.put(this.key("signer", `${record.walletId}:ecdsa-list`), [...next, record]);
+		}
+		if (record.version === "wallet_signer_ed25519_v1") await this.put(this.key("signer", `${record.walletId}:ed25519-slot:${record.signerSlot}`), record);
+	}
+	async putSigners(records) {
+		for (const record of records) await this.putSigner(record);
+	}
+};
+function createWalletStore(input) {
+	const config = isObject(input.config) ? input.config : {};
+	const prefix = resolveWalletStoreNamespace(config);
+	const kind = normalizeOptionalTrimmedString(config.kind);
+	if (kind === "d1") {
+		const database = resolveD1DatabaseFromConfig(config);
+		if (!database) throw new Error("[wallet] D1 store selected but no D1 database was provided");
+		input.logger.info("[wallet] Using D1 store");
+		return new D1WalletStore({
+			database,
+			...d1ScopeFromConfig({
+				config,
+				namespace: prefix
+			})
+		});
+	}
+	if (kind === "cloudflare-do") {
+		const namespace = resolveDoNamespaceFromConfig(config);
+		if (!namespace) throw new Error("cloudflare-do wallet store selected but no Durable Object namespace was provided");
+		const objectName = trimString(config.objectName) || trimString(config.name) || "threshold-store";
+		input.logger.info("[wallet] Using Cloudflare Durable Object store");
+		return new CloudflareDurableObjectWalletStore({
+			namespace,
+			objectName,
+			prefix
+		});
+	}
+	if (kind) throw new Error(`[wallet] Unknown wallet store kind: ${kind}`);
+	input.logger.info("[wallet] Using in-memory store (non-persistent)");
+	return new InMemoryWalletStore(prefix);
+}
+//#endregion
+export { D1WalletStore, WALLET_STORE_D1_SCHEMA_SQL, buildWalletEcdsaSignerRecord, buildWalletEd25519SignerId, createWalletStore, ecdsaPostRegistrationRequestMatchesCapability, ensureWalletStoreD1Schema, parseWalletEcdsaPendingSessionActivationRecord, parseWalletEcdsaSignerRecord, resolveWalletStoreNamespace, sameWalletEd25519SignerRecordV1 };
+
+//# sourceMappingURL=WalletStore.js.map