@seams/wallet-server 0.5.0

package/dist/esm/core/d1WalletStore.js

@@ -0,0 +1,724 @@
+import { parseWalletId } from "../shared-ts/src/utils/domainIds.js";
+import { sameRouterAbMpcMaterialActivationRef } from "../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { parseRouterAbEd25519YaoRecoveryActivationResultV1, parseRouterAbEd25519YaoRecoveryAdmissionRequestV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
+import "../shared-ts/src/utils/validation.js";
+import { normalizeRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope } from "../shared-ts/src/threshold/signingRootScope.js";
+import { sameRouterAbEcdsaDerivationPublicCapabilityV1 } from "../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { d1ChangedRows, formatD1ExecStatement, parseD1JsonColumn } from "../storage/d1Sql.js";
+import { thresholdEcdsaChainTargetKey } from "./thresholdEcdsaChainTarget.js";
+import { normalizeThresholdEd25519ParticipantIds } from "../shared-ts/src/threshold/participants.js";
+import { ecdsaPostRegistrationRequestMatchesCapability, parseWalletEcdsaPendingSessionActivationRecord, parseWalletEcdsaSignerRecord } from "./WalletStore.js";
+//#region src/core/d1WalletStore.ts
+function sameD1WalletRuntimePolicyScopeV1(left, right) {
+	return left.orgId === right.orgId && left.projectId === right.projectId && left.envId === right.envId && left.signingRootVersion === right.signingRootVersion;
+}
+function walletEcdsaSignerKeyFromRegistration(walletKey) {
+	return {
+		keyScope: walletKey.keyScope,
+		chainTarget: walletKey.chainTarget,
+		walletId: walletKey.walletId,
+		keyHandle: walletKey.keyHandle,
+		ecdsaThresholdKeyId: walletKey.ecdsaThresholdKeyId,
+		signingRootId: walletKey.signingRootId,
+		signingRootVersion: walletKey.signingRootVersion,
+		thresholdEcdsaPublicKeyB64u: walletKey.thresholdEcdsaPublicKeyB64u,
+		thresholdOwnerAddress: walletKey.thresholdOwnerAddress,
+		relayerKeyId: walletKey.relayerKeyId,
+		relayerVerifyingShareB64u: walletKey.relayerVerifyingShareB64u,
+		contextBinding32B64u: walletKey.contextBinding32B64u,
+		derivationClientSharePublicKey33B64u: walletKey.derivationClientSharePublicKey33B64u,
+		clientShareRetryCounter: walletKey.clientShareRetryCounter,
+		relayerShareRetryCounter: walletKey.relayerShareRetryCounter,
+		participantIds: walletKey.participantIds,
+		publicCapability: walletKey.publicCapability
+	};
+}
+const WALLET_STORE_D1_SCHEMA_SQL = Object.freeze([
+	`
+    CREATE TABLE IF NOT EXISTS wallets (
+      namespace TEXT NOT NULL,
+      org_id TEXT NOT NULL,
+      project_id TEXT NOT NULL,
+      env_id TEXT NOT NULL,
+      wallet_id TEXT NOT NULL,
+      record_json TEXT NOT NULL,
+      created_at_ms INTEGER NOT NULL,
+      updated_at_ms INTEGER NOT NULL,
+      PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_id),
+      CHECK (length(wallet_id) > 0),
+      CHECK (json_valid(record_json)),
+      CHECK (created_at_ms >= 0),
+      CHECK (updated_at_ms >= created_at_ms),
+      CHECK (COALESCE(json_extract(record_json, '$.version') = 'wallet_v1', 0)),
+      CHECK (COALESCE(json_extract(record_json, '$.walletId') = wallet_id, 0))
+    )
+  `,
+	`
+    CREATE TABLE IF NOT EXISTS wallet_signers (
+      namespace TEXT NOT NULL,
+      org_id TEXT NOT NULL,
+      project_id TEXT NOT NULL,
+      env_id TEXT NOT NULL,
+      wallet_id TEXT NOT NULL,
+      signer_family TEXT NOT NULL,
+      signer_id TEXT NOT NULL,
+      chain_target_key TEXT,
+      record_json TEXT NOT NULL,
+      created_at_ms INTEGER NOT NULL,
+      updated_at_ms INTEGER NOT NULL,
+      PRIMARY KEY (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        wallet_id,
+        signer_family,
+        signer_id
+      ),
+      CHECK (length(wallet_id) > 0),
+      CHECK (signer_family IN ('ed25519', 'ecdsa')),
+      CHECK (length(signer_id) > 0),
+      CHECK (json_valid(record_json)),
+      CHECK (created_at_ms >= 0),
+      CHECK (updated_at_ms >= created_at_ms),
+      CHECK (COALESCE(json_extract(record_json, '$.walletId') = wallet_id, 0)),
+      CHECK (COALESCE(json_extract(record_json, '$.signerId') = signer_id, 0)),
+      CHECK (
+        (
+          signer_family = 'ed25519'
+          AND chain_target_key IS NULL
+          AND substr(signer_id, 1, 8) = 'ed25519:'
+          AND COALESCE(
+            json_extract(record_json, '$.version') = 'wallet_signer_ed25519_v1',
+            0
+          )
+        )
+        OR
+        (
+          signer_family = 'ecdsa'
+          AND chain_target_key IS NOT NULL
+          AND length(chain_target_key) > 0
+          AND signer_id = 'ecdsa:' || chain_target_key
+          AND COALESCE(
+            json_extract(record_json, '$.version') = 'wallet_signer_ecdsa_v1',
+            0
+          )
+          AND COALESCE(json_extract(record_json, '$.chainTargetKey') = chain_target_key, 0)
+        )
+      )
+    )
+  `,
+	`
+    CREATE INDEX IF NOT EXISTS wallet_signers_wallet_idx
+      ON wallet_signers (namespace, org_id, project_id, env_id, wallet_id, signer_family)
+  `,
+	`
+    CREATE INDEX IF NOT EXISTS wallet_signers_chain_target_idx
+      ON wallet_signers (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        signer_family,
+        chain_target_key
+      )
+  `,
+	`
+    CREATE TABLE IF NOT EXISTS wallet_ecdsa_pending_session_activations (
+      namespace TEXT NOT NULL,
+      org_id TEXT NOT NULL,
+      project_id TEXT NOT NULL,
+      env_id TEXT NOT NULL,
+      wallet_id TEXT NOT NULL,
+      lifecycle_id TEXT NOT NULL,
+      request_id TEXT NOT NULL,
+      record_json TEXT NOT NULL,
+      expires_at_ms INTEGER NOT NULL,
+      PRIMARY KEY (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        wallet_id,
+        lifecycle_id,
+        request_id
+      ),
+      CHECK (json_valid(record_json)),
+      CHECK (expires_at_ms > 0)
+    )
+  `
+]);
+async function ensureWalletStoreD1Schema(options) {
+	for (const statement of WALLET_STORE_D1_SCHEMA_SQL) await options.database.exec(formatD1ExecStatement(statement));
+}
+function isObject(value) {
+	return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function normalizeTimestampMs(value) {
+	const numberValue = Number(value);
+	if (!Number.isFinite(numberValue) || numberValue < 0) return null;
+	return Math.floor(numberValue);
+}
+function parseWalletRecord(raw) {
+	if (!isObject(raw)) return null;
+	if (raw.version !== "wallet_v1") return null;
+	const walletId = parseWalletId(raw.walletId);
+	const createdAtMs = normalizeTimestampMs(raw.createdAtMs);
+	const updatedAtMs = normalizeTimestampMs(raw.updatedAtMs);
+	if (!walletId.ok || createdAtMs == null || updatedAtMs == null) return null;
+	return {
+		version: "wallet_v1",
+		walletId: walletId.value,
+		createdAtMs,
+		updatedAtMs
+	};
+}
+function equalBytes(left, right) {
+	if (left.length !== right.length) return false;
+	for (let index = 0; index < left.length; index += 1) if (left[index] !== right[index]) return false;
+	return true;
+}
+function parseWalletEd25519YaoActiveCapabilityRecord(raw) {
+	if (!isObject(raw)) return null;
+	const nearAccountId = normalizeOptionalTrimmedString(raw.nearAccountId);
+	if (!nearAccountId) return null;
+	let runtimePolicyScope;
+	try {
+		runtimePolicyScope = normalizeRuntimePolicyScope(raw.runtimePolicyScope);
+	} catch {
+		return null;
+	}
+	switch (raw.version) {
+		case "wallet_ed25519_yao_registration_capability_v1": {
+			const admissionRequest = parseRouterAbEd25519YaoRegistrationAdmissionRequestV1(raw.admissionRequest);
+			const activationResult = parseRouterAbEd25519YaoRegistrationActivationResultV1(raw.activationResult);
+			const admissionReceipt = parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1(raw.admissionReceipt);
+			if (!admissionRequest.ok || !admissionReceipt.ok || !activationResult.ok || !Array.isArray(raw.activeCapabilityBinding) || !equalBytes(raw.activeCapabilityBinding, activationResult.value.binding.session_id)) return null;
+			return {
+				version: "wallet_ed25519_yao_registration_capability_v1",
+				activeCapabilityBinding: [...activationResult.value.binding.session_id],
+				nearAccountId,
+				admissionRequest: admissionRequest.value,
+				admissionReceipt: admissionReceipt.value,
+				activationResult: activationResult.value,
+				runtimePolicyScope
+			};
+		}
+		case "wallet_ed25519_yao_recovery_capability_v1": {
+			const admissionRequest = parseRouterAbEd25519YaoRecoveryAdmissionRequestV1(raw.admissionRequest);
+			const activationResult = parseRouterAbEd25519YaoRecoveryActivationResultV1(raw.activationResult);
+			if (!admissionRequest.ok || !activationResult.ok || !Array.isArray(raw.activeCapabilityBinding) || !equalBytes(raw.activeCapabilityBinding, admissionRequest.value.replacement_capability_binding)) return null;
+			return {
+				version: "wallet_ed25519_yao_recovery_capability_v1",
+				activeCapabilityBinding: [...admissionRequest.value.replacement_capability_binding],
+				nearAccountId,
+				admissionRequest: admissionRequest.value,
+				activationResult: activationResult.value,
+				runtimePolicyScope
+			};
+		}
+		default: return null;
+	}
+}
+function parseWalletEd25519SignerRecord(raw) {
+	if (!isObject(raw) || raw.version !== "wallet_signer_ed25519_v1") return null;
+	const walletId = parseWalletId(raw.walletId);
+	const signerId = normalizeOptionalTrimmedString(raw.signerId);
+	const nearAccountId = normalizeOptionalTrimmedString(raw.nearAccountId);
+	const nearEd25519SigningKeyId = normalizeOptionalTrimmedString(raw.nearEd25519SigningKeyId);
+	const thresholdSessionId = normalizeOptionalTrimmedString(raw.thresholdSessionId);
+	const publicKey = normalizeOptionalTrimmedString(raw.publicKey);
+	const signingWorkerId = normalizeOptionalTrimmedString(raw.signingWorkerId);
+	const keyVersion = normalizeOptionalTrimmedString(raw.keyVersion);
+	const signingRootId = normalizeOptionalTrimmedString(raw.signingRootId);
+	const signingRootVersion = normalizeOptionalTrimmedString(raw.signingRootVersion);
+	const custodyKeyManifestDigestB64u = normalizeOptionalTrimmedString(raw.custodyKeyManifestDigestB64u);
+	const signerSlot = Math.floor(Number(raw.signerSlot));
+	const createdAtMs = normalizeTimestampMs(raw.createdAtMs);
+	const updatedAtMs = normalizeTimestampMs(raw.updatedAtMs);
+	const participantIds = normalizeThresholdEd25519ParticipantIds(raw.participantIds);
+	const activeYaoCapability = parseWalletEd25519YaoActiveCapabilityRecord(raw.activeYaoCapability);
+	let runtimePolicyScope;
+	try {
+		runtimePolicyScope = normalizeRuntimePolicyScope(raw.runtimePolicyScope);
+	} catch {
+		return null;
+	}
+	const expectedSigningRoot = signingRootScopeFromRuntimePolicyScope(runtimePolicyScope);
+	if (!walletId.ok || !signerId || !nearAccountId || !nearEd25519SigningKeyId || !thresholdSessionId || !publicKey || !signingWorkerId || !keyVersion || !signingRootId || !signingRootVersion || !custodyKeyManifestDigestB64u || signingRootId !== expectedSigningRoot.signingRootId || signingRootVersion !== expectedSigningRoot.signingRootVersion || !participantIds || !activeYaoCapability || participantIds.length !== 2 || participantIds[0] === participantIds[1] || !Number.isSafeInteger(signerSlot) || signerSlot <= 0 || createdAtMs == null || updatedAtMs == null || raw.recoveryExportCapable !== true) return null;
+	const firstParticipantId = participantIds[0];
+	const secondParticipantId = participantIds[1];
+	if (firstParticipantId === void 0 || secondParticipantId === void 0) return null;
+	const capabilityApplication = activeYaoCapability.admissionRequest.application_binding;
+	const capabilityScope = activeYaoCapability.admissionRequest.scope;
+	const capabilityParticipants = activeYaoCapability.admissionRequest.participant_ids;
+	if (activeYaoCapability.nearAccountId !== nearAccountId || capabilityApplication.wallet_id !== walletId.value || capabilityApplication.near_ed25519_signing_key_id !== nearEd25519SigningKeyId || capabilityApplication.key_creation_signer_slot !== signerSlot || capabilityApplication.signing_root_id !== signingRootId || capabilityScope.account_id !== walletId.value || capabilityScope.root_share_epoch !== signingRootVersion || capabilityScope.signing_worker_id !== signingWorkerId || capabilityParticipants[0] !== firstParticipantId || capabilityParticipants[1] !== secondParticipantId || !sameD1WalletRuntimePolicyScopeV1(activeYaoCapability.runtimePolicyScope, runtimePolicyScope)) return null;
+	return {
+		version: "wallet_signer_ed25519_v1",
+		walletId: walletId.value,
+		signerId,
+		nearAccountId,
+		nearEd25519SigningKeyId,
+		thresholdSessionId,
+		signerSlot,
+		publicKey,
+		signingWorkerId,
+		keyVersion,
+		recoveryExportCapable: true,
+		participantIds: [firstParticipantId, secondParticipantId],
+		signingRootId,
+		signingRootVersion,
+		runtimePolicyScope,
+		activeYaoCapability,
+		custodyKeyManifestDigestB64u,
+		createdAtMs,
+		updatedAtMs
+	};
+}
+function requireD1ScopeString(input, field) {
+	const normalized = normalizeOptionalTrimmedString(input);
+	if (!normalized) throw new Error(`${field} is required for D1 wallet store`);
+	return normalized;
+}
+function normalizeD1WalletStoreOptions(input) {
+	return {
+		database: input.database,
+		namespace: requireD1ScopeString(input.namespace, "namespace"),
+		orgId: requireD1ScopeString(input.orgId, "orgId"),
+		projectId: requireD1ScopeString(input.projectId, "projectId"),
+		envId: requireD1ScopeString(input.envId, "envId"),
+		ensureSchema: input.ensureSchema !== false
+	};
+}
+function assertNeverWalletSignerRecord(record) {
+	throw new Error(`Unexpected wallet signer record: ${JSON.stringify(record)}`);
+}
+function signerFamily(record) {
+	return record.version === "wallet_signer_ed25519_v1" ? "ed25519" : "ecdsa";
+}
+function recordChainTargetKey(record) {
+	return record.version === "wallet_signer_ecdsa_v1" ? record.chainTargetKey : null;
+}
+function ensureWalletSignerRecord(record) {
+	switch (record.version) {
+		case "wallet_signer_ed25519_v1":
+		case "wallet_signer_ecdsa_v1":
+			if (!normalizeOptionalTrimmedString(record.walletId)) throw new Error("walletId is required");
+			if (!normalizeOptionalTrimmedString(record.signerId)) throw new Error("signerId is required");
+			return record;
+		default: return assertNeverWalletSignerRecord(record);
+	}
+}
+function prepareD1WalletPutSubjectStatement(input) {
+	const parsed = parseWalletRecord(input.record);
+	if (!parsed) throw new Error("Invalid wallet record");
+	return input.database.prepare(`INSERT INTO wallets (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        wallet_id,
+        record_json,
+        created_at_ms,
+        updated_at_ms
+      )
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT (namespace, org_id, project_id, env_id, wallet_id)
+      DO UPDATE SET
+        record_json = EXCLUDED.record_json,
+        created_at_ms = MIN(wallets.created_at_ms, EXCLUDED.created_at_ms),
+        updated_at_ms = MAX(wallets.updated_at_ms, EXCLUDED.updated_at_ms)`).bind(input.scope.namespace, input.scope.orgId, input.scope.projectId, input.scope.envId, parsed.walletId, JSON.stringify(parsed), parsed.createdAtMs, parsed.updatedAtMs);
+}
+function prepareD1WalletPutSignerStatement(input) {
+	const parsed = ensureWalletSignerRecord(input.record);
+	return input.database.prepare(`INSERT INTO wallet_signers (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        wallet_id,
+        signer_family,
+        signer_id,
+        chain_target_key,
+        record_json,
+        created_at_ms,
+        updated_at_ms
+      )
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        wallet_id,
+        signer_family,
+        signer_id
+      )
+      DO UPDATE SET
+        chain_target_key = EXCLUDED.chain_target_key,
+        record_json = EXCLUDED.record_json,
+        created_at_ms = MIN(wallet_signers.created_at_ms, EXCLUDED.created_at_ms),
+        updated_at_ms = MAX(wallet_signers.updated_at_ms, EXCLUDED.updated_at_ms)`).bind(input.scope.namespace, input.scope.orgId, input.scope.projectId, input.scope.envId, parsed.walletId, signerFamily(parsed), parsed.signerId, recordChainTargetKey(parsed), JSON.stringify(parsed), parsed.createdAtMs, parsed.updatedAtMs);
+}
+function buildWalletEcdsaSignerRecord(input) {
+	const chainTargetKey = thresholdEcdsaChainTargetKey(input.walletKey.chainTarget);
+	return {
+		version: "wallet_signer_ecdsa_v1",
+		walletId: input.walletId,
+		signerId: `ecdsa:${chainTargetKey}`,
+		chainTargetKey,
+		chainTarget: input.walletKey.chainTarget,
+		walletKey: walletEcdsaSignerKeyFromRegistration(input.walletKey),
+		activationReceipt: input.activationReceipt,
+		runtimePolicyScope: input.runtimePolicyScope,
+		custodyKeyManifestDigestB64u: input.custodyKeyManifestDigestB64u,
+		custodyClientRootPublicKey33B64u: input.custodyClientRootPublicKey33B64u,
+		createdAtMs: input.createdAtMs,
+		updatedAtMs: input.updatedAtMs
+	};
+}
+var D1WalletStore = class {
+	constructor(input) {
+		this.adapterKind = "d1";
+		this.schemaReady = false;
+		const normalized = normalizeD1WalletStoreOptions(input);
+		this.database = normalized.database;
+		this.scope = {
+			namespace: normalized.namespace,
+			orgId: normalized.orgId,
+			projectId: normalized.projectId,
+			envId: normalized.envId
+		};
+		this.ensureSchemaOnUse = normalized.ensureSchema;
+	}
+	async ensureSchema() {
+		if (!this.ensureSchemaOnUse || this.schemaReady) return;
+		await ensureWalletStoreD1Schema({ database: this.database });
+		this.schemaReady = true;
+	}
+	async getWallet(input) {
+		await this.ensureSchema();
+		const walletId = normalizeOptionalTrimmedString(input.walletId);
+		if (!walletId) return null;
+		return parseWalletRecord(parseD1JsonColumn((await this.database.prepare(`SELECT record_json
+           FROM wallets
+          WHERE namespace = ?
+            AND org_id = ?
+            AND project_id = ?
+            AND env_id = ?
+            AND wallet_id = ?
+          LIMIT 1`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, walletId).first())?.record_json));
+	}
+	async getEcdsaSignerByKeyHandle(input) {
+		await this.ensureSchema();
+		const walletId = normalizeOptionalTrimmedString(input.walletId);
+		const keyHandle = normalizeOptionalTrimmedString(input.keyHandle);
+		if (!walletId || !keyHandle) return null;
+		const chainTargetKey = thresholdEcdsaChainTargetKey(input.chainTarget);
+		const signer = parseWalletEcdsaSignerRecord(parseD1JsonColumn((await this.database.prepare(`SELECT record_json
+           FROM wallet_signers
+          WHERE namespace = ?
+            AND org_id = ?
+            AND project_id = ?
+            AND env_id = ?
+            AND wallet_id = ?
+            AND signer_family = 'ecdsa'
+            AND chain_target_key = ?
+            AND json_extract(record_json, '$.walletKey.keyHandle') = ?
+          LIMIT 1`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, walletId, chainTargetKey, keyHandle).first())?.record_json));
+		if (!signer || signer.walletId !== walletId || signer.walletKey.keyHandle !== keyHandle || signer.chainTargetKey !== chainTargetKey) return null;
+		return signer;
+	}
+	async getEcdsaSignerByPublicCapability(input) {
+		await this.ensureSchema();
+		const walletId = normalizeOptionalTrimmedString(input.walletId);
+		if (!walletId) return null;
+		const rows = (await this.database.prepare(`SELECT record_json
+           FROM wallet_signers
+          WHERE namespace = ?
+            AND org_id = ?
+            AND project_id = ?
+            AND env_id = ?
+            AND wallet_id = ?
+            AND signer_family = 'ecdsa'
+            AND json_extract(
+              record_json,
+              '$.walletKey.publicCapability.registration_request_digest_b64u'
+            ) = ?
+          LIMIT 2`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, walletId, input.publicCapability.registration_request_digest_b64u).all()).results || [];
+		if (rows.length === 0) return null;
+		const matches = rows.map((row) => parseWalletEcdsaSignerRecord(parseD1JsonColumn(row.record_json))).filter((record) => {
+			if (!record) return false;
+			return sameRouterAbEcdsaDerivationPublicCapabilityV1(record.walletKey.publicCapability, input.publicCapability);
+		});
+		if (matches.length === 0) return null;
+		const keyHandle = matches[0]?.walletKey.keyHandle;
+		if (!keyHandle || matches.some((record) => record.walletKey.keyHandle !== keyHandle)) throw new Error("Wallet has conflicting ECDSA public capabilities");
+		return matches[0] ?? null;
+	}
+	async getEcdsaSignerByMaterialActivation(input) {
+		await this.ensureSchema();
+		const walletId = normalizeOptionalTrimmedString(input.walletId);
+		if (!walletId) return null;
+		const matches = ((await this.database.prepare(`SELECT record_json
+           FROM wallet_signers
+          WHERE namespace = ?
+            AND org_id = ?
+            AND project_id = ?
+            AND env_id = ?
+            AND wallet_id = ?
+            AND signer_family = 'ecdsa'
+            AND json_extract(
+              record_json,
+              '$.walletKey.publicCapability.material_activation.activation_id'
+            ) = ?
+          LIMIT 4`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, walletId, input.materialActivation.activation_id).all()).results || []).map((row) => parseWalletEcdsaSignerRecord(parseD1JsonColumn(row.record_json))).filter((record) => record !== null && record.walletId === walletId && sameRouterAbMpcMaterialActivationRef(record.walletKey.publicCapability.material_activation, input.materialActivation));
+		if (matches.length === 0) return null;
+		const keyHandle = matches[0]?.walletKey.keyHandle;
+		if (!keyHandle || matches.some((record) => record.walletKey.keyHandle !== keyHandle)) throw new Error("Wallet has conflicting ECDSA material activations");
+		return matches[0] ?? null;
+	}
+	async getEcdsaSignerByPostRegistrationRequest(input) {
+		await this.ensureSchema();
+		const walletId = normalizeOptionalTrimmedString(input.walletId);
+		if (!walletId) return null;
+		const matches = ((await this.database.prepare(`SELECT record_json
+           FROM wallet_signers
+          WHERE namespace = ?
+            AND org_id = ?
+            AND project_id = ?
+            AND env_id = ?
+            AND wallet_id = ?
+            AND signer_family = 'ecdsa'
+            AND json_extract(
+              record_json,
+              '$.walletKey.publicCapability.public_identity.context_binding_b64u'
+            ) = ?
+          LIMIT 4`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, walletId, input.request.public_identity.context_binding_b64u).all()).results || []).map((row) => parseWalletEcdsaSignerRecord(parseD1JsonColumn(row.record_json))).filter((record) => record !== null && ecdsaPostRegistrationRequestMatchesCapability({
+			request: input.request,
+			capability: record.walletKey.publicCapability
+		}));
+		if (matches.length === 0) return null;
+		const keyHandle = matches[0]?.walletKey.keyHandle;
+		if (!keyHandle || matches.some((record) => record.walletKey.keyHandle !== keyHandle)) throw new Error("Wallet has conflicting ECDSA post-registration identities");
+		return matches[0] ?? null;
+	}
+	async listEcdsaSignersForWallet(input) {
+		await this.ensureSchema();
+		const result = await this.database.prepare(`SELECT record_json
+           FROM wallet_signers
+          WHERE namespace = ?
+            AND org_id = ?
+            AND project_id = ?
+            AND env_id = ?
+            AND wallet_id = ?
+            AND signer_family = 'ecdsa'
+          ORDER BY signer_id`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, input.walletId).all();
+		const signers = [];
+		for (const row of result.results || []) {
+			const signer = parseWalletEcdsaSignerRecord(parseD1JsonColumn(row.record_json));
+			if (!signer || signer.walletId !== input.walletId) throw new Error("Wallet ECDSA signer record is invalid");
+			signers.push(signer);
+		}
+		return signers;
+	}
+	async listEcdsaPendingSessionActivationsForLifecycle(input) {
+		await this.ensureSchema();
+		const lifecycleId = normalizeOptionalTrimmedString(input.lifecycleId);
+		if (!lifecycleId) return [];
+		const result = await this.database.prepare(`SELECT record_json
+           FROM wallet_ecdsa_pending_session_activations
+          WHERE namespace = ?
+            AND org_id = ?
+            AND project_id = ?
+            AND env_id = ?
+            AND wallet_id = ?
+            AND lifecycle_id = ?
+            AND expires_at_ms > ?
+          ORDER BY request_id`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, input.walletId, lifecycleId, Date.now()).all();
+		const records = [];
+		for (const row of result.results || []) {
+			const record = parseWalletEcdsaPendingSessionActivationRecord(parseD1JsonColumn(row.record_json));
+			if (!record || record.walletId !== input.walletId || record.lifecycleId !== lifecycleId) throw new Error("Wallet ECDSA recovery activation record is invalid");
+			records.push(record);
+		}
+		return records;
+	}
+	async putEcdsaPendingSessionActivation(record) {
+		await this.ensureSchema();
+		await this.database.prepare(`INSERT INTO wallet_ecdsa_pending_session_activations (
+          namespace,
+          org_id,
+          project_id,
+          env_id,
+          wallet_id,
+          lifecycle_id,
+          request_id,
+          record_json,
+          expires_at_ms
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+        ON CONFLICT (
+          namespace,
+          org_id,
+          project_id,
+          env_id,
+          wallet_id,
+          lifecycle_id,
+          request_id
+        ) DO NOTHING`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, record.walletId, record.lifecycleId, record.requestId, JSON.stringify(record), record.expiresAtMs).run();
+	}
+	async getEd25519Signer(input) {
+		await this.ensureSchema();
+		const walletId = normalizeOptionalTrimmedString(input.walletId);
+		const nearAccountId = normalizeOptionalTrimmedString(input.nearAccountId);
+		const nearEd25519SigningKeyId = normalizeOptionalTrimmedString(input.nearEd25519SigningKeyId);
+		if (!walletId || !nearAccountId || !nearEd25519SigningKeyId) return null;
+		const rows = (await this.database.prepare(`SELECT record_json
+           FROM wallet_signers
+          WHERE namespace = ?
+            AND org_id = ?
+            AND project_id = ?
+            AND env_id = ?
+            AND wallet_id = ?
+            AND signer_family = 'ed25519'
+            AND json_extract(record_json, '$.nearAccountId') = ?
+            AND json_extract(record_json, '$.nearEd25519SigningKeyId') = ?
+          LIMIT 2`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, walletId, nearAccountId, nearEd25519SigningKeyId).all()).results || [];
+		if (rows.length !== 1) return null;
+		return parseWalletEd25519SignerRecord(parseD1JsonColumn(rows[0]?.record_json));
+	}
+	async getEd25519SignerByMaterialActivation(input) {
+		await this.ensureSchema();
+		const walletId = normalizeOptionalTrimmedString(input.walletId);
+		if (!walletId) return null;
+		const matches = ((await this.database.prepare(`SELECT record_json
+           FROM wallet_signers
+          WHERE namespace = ?
+            AND org_id = ?
+            AND project_id = ?
+            AND env_id = ?
+            AND wallet_id = ?
+            AND signer_family = 'ed25519'
+            AND json_extract(
+              record_json,
+              '$.activeYaoCapability.admissionRequest.scope.material_activation.activation_id'
+            ) = ?
+          LIMIT 4`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, walletId, input.materialActivation.activation_id).all()).results || []).map((row) => parseWalletEd25519SignerRecord(parseD1JsonColumn(row.record_json))).filter((record) => record !== null && record.walletId === walletId && sameRouterAbMpcMaterialActivationRef(record.activeYaoCapability.admissionRequest.scope.material_activation, input.materialActivation));
+		if (matches.length === 0) return null;
+		const signerId = matches[0]?.signerId;
+		if (!signerId || matches.some((record) => record.signerId !== signerId)) throw new Error("Wallet has conflicting Ed25519 material activations");
+		return matches[0] ?? null;
+	}
+	async getEd25519SignerBySlot(input) {
+		await this.ensureSchema();
+		const walletId = normalizeOptionalTrimmedString(input.walletId);
+		const signerSlot = Math.floor(Number(input.signerSlot));
+		if (!walletId || !Number.isSafeInteger(signerSlot) || signerSlot <= 0) return null;
+		const rows = (await this.database.prepare(`SELECT record_json
+           FROM wallet_signers
+          WHERE namespace = ?
+            AND org_id = ?
+            AND project_id = ?
+            AND env_id = ?
+            AND wallet_id = ?
+            AND signer_family = 'ed25519'
+            AND json_extract(record_json, '$.signerSlot') = ?
+          LIMIT 2`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, walletId, signerSlot).all()).results || [];
+		if (rows.length === 0) return null;
+		if (rows.length !== 1) throw new Error("Wallet has duplicate Ed25519 signer slots");
+		const signer = parseWalletEd25519SignerRecord(parseD1JsonColumn(rows[0]?.record_json));
+		if (!signer || signer.signerSlot !== signerSlot) throw new Error("Wallet Ed25519 signer slot record is invalid");
+		return signer;
+	}
+	async listEd25519Signers() {
+		await this.ensureSchema();
+		const result = await this.database.prepare(`SELECT record_json
+           FROM wallet_signers
+          WHERE namespace = ?
+            AND org_id = ?
+            AND project_id = ?
+            AND env_id = ?
+            AND signer_family = 'ed25519'
+          ORDER BY wallet_id, signer_id`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId).all();
+		const signers = [];
+		for (const row of result.results || []) {
+			const signer = parseWalletEd25519SignerRecord(parseD1JsonColumn(row.record_json));
+			if (!signer) throw new Error("Wallet Ed25519 signer record is invalid");
+			signers.push(signer);
+		}
+		return signers;
+	}
+	async listEd25519SignersForWallet(input) {
+		await this.ensureSchema();
+		const result = await this.database.prepare(`SELECT record_json
+           FROM wallet_signers
+          WHERE namespace = ?
+            AND org_id = ?
+            AND project_id = ?
+            AND env_id = ?
+            AND wallet_id = ?
+            AND signer_family = 'ed25519'
+          ORDER BY signer_id`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, input.walletId).all();
+		const signers = [];
+		for (const row of result.results || []) {
+			const signer = parseWalletEd25519SignerRecord(parseD1JsonColumn(row.record_json));
+			if (!signer || signer.walletId !== input.walletId) throw new Error("Wallet Ed25519 signer record is invalid");
+			signers.push(signer);
+		}
+		return signers;
+	}
+	async putSubject(record) {
+		await this.ensureSchema();
+		await prepareD1WalletPutSubjectStatement({
+			database: this.database,
+			scope: this.scope,
+			record
+		}).run();
+	}
+	async putSigner(record) {
+		await this.ensureSchema();
+		await prepareD1WalletPutSignerStatement({
+			database: this.database,
+			scope: this.scope,
+			record
+		}).run();
+	}
+	async putEd25519SignerIfSlotAvailable(record) {
+		await this.ensureSchema();
+		const parsed = parseWalletEd25519SignerRecord(record);
+		if (!parsed) throw new Error("Invalid Ed25519 wallet signer record");
+		return d1ChangedRows(await this.database.prepare(`INSERT INTO wallet_signers (
+          namespace,
+          org_id,
+          project_id,
+          env_id,
+          wallet_id,
+          signer_family,
+          signer_id,
+          chain_target_key,
+          record_json,
+          created_at_ms,
+          updated_at_ms
+        )
+        SELECT ?, ?, ?, ?, ?, 'ed25519', ?, NULL, ?, ?, ?
+        WHERE NOT EXISTS (
+          SELECT 1
+            FROM wallet_signers
+           WHERE namespace = ?
+             AND org_id = ?
+             AND project_id = ?
+             AND env_id = ?
+             AND wallet_id = ?
+             AND signer_family = 'ed25519'
+             AND json_extract(record_json, '$.signerSlot') = ?
+        )`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, parsed.walletId, parsed.signerId, JSON.stringify(parsed), parsed.createdAtMs, parsed.updatedAtMs, this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, parsed.walletId, parsed.signerSlot).run()) === 1;
+	}
+	async putSigners(records) {
+		for (const record of records) await this.putSigner(record);
+	}
+};
+//#endregion
+export { D1WalletStore, WALLET_STORE_D1_SCHEMA_SQL, buildWalletEcdsaSignerRecord, ensureWalletStoreD1Schema, parseWalletEd25519SignerRecord, prepareD1WalletPutSignerStatement, prepareD1WalletPutSubjectStatement };
+
+//# sourceMappingURL=d1WalletStore.js.map