@seams/wallet-server 0.5.0

package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneLockStore.js

@@ -0,0 +1,114 @@
+import { parseLaneEnrollmentId, parseWalletKeyId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { d1ChangedRows } from "../../../../storage/d1Sql.js";
+import { requireD1LaneStoreOptions, scopeValues } from "./d1LaneRecords.js";
+//#region src/router/cloudflare/d1/signingLanes/d1LaneLockStore.ts
+const LOCK_TABLE = "lane_locks";
+var CloudflareD1LaneLockStore = class {
+	constructor(options) {
+		const normalized = requireD1LaneStoreOptions(options);
+		this.database = normalized.database;
+		this.scope = normalized.scope;
+	}
+	async acquireWalletKeyLock(input) {
+		return await this.acquire({
+			lockKey: `wallet-key:${String(input.walletKeyId)}`,
+			lockKind: "wallet_key",
+			walletKeyId: input.walletKeyId,
+			lockId: input.lockId,
+			ttlMs: input.ttlMs,
+			nowMs: input.nowMs
+		});
+	}
+	async acquireEnrollmentLock(input) {
+		return await this.acquire({
+			lockKey: `enrollment:${String(input.enrollmentId)}`,
+			lockKind: "enrollment",
+			enrollmentId: input.enrollmentId,
+			lockId: input.lockId,
+			ttlMs: input.ttlMs,
+			nowMs: input.nowMs
+		});
+	}
+	async releaseLock(input) {
+		return d1ChangedRows(await this.database.prepare(`DELETE FROM ${LOCK_TABLE} WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4 AND lock_key = ?5 AND lock_id = ?6`).bind(...scopeValues(this.scope), input.lockKey, input.lockId).run()) === 1;
+	}
+	async acquire(input) {
+		if (!input.lockId.trim()) throw new Error("lane lockId is required");
+		if (!Number.isSafeInteger(input.ttlMs) || input.ttlMs <= 0) throw new Error("lane lock ttlMs must be positive");
+		const current = await this.read(input.lockKey);
+		if (current && current.expiresAtMs > input.nowMs) return current.lockId === input.lockId ? {
+			outcome: "replayed",
+			lock: current
+		} : {
+			outcome: "conflict",
+			actual: current
+		};
+		const expiresAtMs = input.nowMs + input.ttlMs;
+		if (d1ChangedRows(await this.database.prepare(`INSERT INTO ${LOCK_TABLE} (namespace, org_id, project_id, env_id, lock_key, lock_kind, enrollment_id, wallet_key_id, lane_id, lock_id, expires_at_ms, acquired_at_ms) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, NULL, ?9, ?10, ?11) ON CONFLICT(namespace, org_id, project_id, env_id, lock_key) DO UPDATE SET lock_kind = excluded.lock_kind, enrollment_id = excluded.enrollment_id, wallet_key_id = excluded.wallet_key_id, lock_id = excluded.lock_id, expires_at_ms = excluded.expires_at_ms, acquired_at_ms = excluded.acquired_at_ms WHERE lane_locks.expires_at_ms <= excluded.acquired_at_ms`).bind(...scopeValues(this.scope), input.lockKey, input.lockKind, input.enrollmentId ? String(input.enrollmentId) : null, input.walletKeyId ? String(input.walletKeyId) : null, input.lockId, expiresAtMs, input.nowMs).run()) !== 1) {
+			const raced = await this.read(input.lockKey);
+			return raced && raced.lockId === input.lockId ? {
+				outcome: "replayed",
+				lock: raced
+			} : {
+				outcome: "conflict",
+				actual: raced
+			};
+		}
+		return {
+			outcome: "applied",
+			lock: input.lockKind === "wallet_key" ? {
+				lockKey: input.lockKey,
+				lockKind: "wallet_key",
+				walletKeyId: requireId(parseWalletKeyId, input.walletKeyId, "wallet key"),
+				lockId: input.lockId,
+				acquiredAtMs: input.nowMs,
+				expiresAtMs
+			} : {
+				lockKey: input.lockKey,
+				lockKind: "enrollment",
+				enrollmentId: requireId(parseLaneEnrollmentId, input.enrollmentId, "enrollment"),
+				lockId: input.lockId,
+				acquiredAtMs: input.nowMs,
+				expiresAtMs
+			}
+		};
+	}
+	async read(lockKey) {
+		const row = await this.database.prepare(`SELECT lock_key, lock_kind, enrollment_id, wallet_key_id, lane_id, lock_id, expires_at_ms, acquired_at_ms FROM ${LOCK_TABLE} WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4 AND lock_key = ?5`).bind(...scopeValues(this.scope), lockKey).first();
+		if (!row) return null;
+		const lockKind = row.lock_kind === "wallet_key" || row.lock_kind === "enrollment" ? row.lock_kind : null;
+		if (!lockKind || typeof row.lock_key !== "string" || typeof row.lock_id !== "string") throw new Error("stored lane lock is invalid");
+		const expiresAtMs = Number(row.expires_at_ms);
+		const acquiredAtMs = Number(row.acquired_at_ms);
+		if (!Number.isSafeInteger(expiresAtMs) || !Number.isSafeInteger(acquiredAtMs)) throw new Error("stored lane lock times are invalid");
+		if (lockKind === "wallet_key") {
+			if (typeof row.wallet_key_id !== "string") throw new Error("stored wallet-key lock is missing wallet key");
+			return {
+				lockKey: row.lock_key,
+				lockKind,
+				walletKeyId: requireId(parseWalletKeyId, row.wallet_key_id, "stored wallet key"),
+				lockId: row.lock_id,
+				acquiredAtMs,
+				expiresAtMs
+			};
+		}
+		if (typeof row.enrollment_id !== "string") throw new Error("stored enrollment lock is missing enrollment");
+		return {
+			lockKey: row.lock_key,
+			lockKind,
+			enrollmentId: requireId(parseLaneEnrollmentId, row.enrollment_id, "stored enrollment"),
+			lockId: row.lock_id,
+			acquiredAtMs,
+			expiresAtMs
+		};
+	}
+};
+function requireId(parser, raw, label) {
+	const result = parser(raw);
+	if (!result.ok) throw new Error(`${label} is invalid: ${result.error.message}`);
+	return result.value;
+}
+//#endregion
+export { CloudflareD1LaneLockStore };
+
+//# sourceMappingURL=d1LaneLockStore.js.map

package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneProtocolCommitter.js

@@ -0,0 +1,16 @@
+import { CloudflareD1LaneLifecycleStore } from "./d1LaneLifecycleStore.js";
+import { CloudflareD1LaneEnrollmentGateway } from "./d1LaneEnrollmentGateway.js";
+import { CloudflareLaneProtocolCommitterV1 } from "../../signingLanes/cloudflareLaneProtocolCommitter.js";
+//#region src/router/cloudflare/d1/signingLanes/d1LaneProtocolCommitter.ts
+function createCloudflareD1LaneProtocolCommitterV1(options) {
+	return new CloudflareLaneProtocolCommitterV1({
+		gateway: new CloudflareD1LaneEnrollmentGateway({ lifecycleStore: new CloudflareD1LaneLifecycleStore(options) }),
+		authorization: options.authorization,
+		execution: options.execution,
+		ed25519Transport: options.ed25519Transport
+	});
+}
+//#endregion
+export { createCloudflareD1LaneProtocolCommitterV1 };
+
+//# sourceMappingURL=d1LaneProtocolCommitter.js.map

package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneRecords.js

@@ -0,0 +1,170 @@
+import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
+import { sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { isD1DatabaseLike, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
+import { parseAggregateLaneActivationReceiptV1, parseAggregateLaneRevocationReceiptV1, parseLaneEnrollmentLifecycleV1, parseLaneEnrollmentManifestV1, parseLaneHolderDeliveryReceiptV1, parseLaneProductEpochRecordV1, parseLaneProtocolCommitReceiptV1, parseLaneProtocolJobV1, parseLaneProtocolLifecycleV1, parseLaneServerActivationReceiptV1, parseLaneServerRetirementReceiptV1 } from "../../../../shared-ts/src/signing-lanes/rotationParsers.js";
+//#region src/router/cloudflare/d1/signingLanes/d1LaneRecords.ts
+function requireD1LaneStoreOptions(input) {
+	if (!isD1DatabaseLike(input.database)) throw new Error("R102 lane D1 database is required");
+	return {
+		database: input.database,
+		scope: normalizeScope(input.scope),
+		now: input.now ?? Date.now
+	};
+}
+function normalizeScope(scope) {
+	return {
+		namespace: requiredScopeString(scope.namespace, "namespace"),
+		orgId: requiredScopeString(scope.orgId, "orgId"),
+		projectId: requiredScopeString(scope.projectId, "projectId"),
+		envId: requiredScopeString(scope.envId, "envId")
+	};
+}
+function requiredScopeString(value, label) {
+	const normalized = value.trim();
+	if (!normalized) throw new Error(`R102 lane ${label} is required`);
+	if (hasControlCharacter(normalized)) throw new Error(`R102 lane ${label} contains control characters`);
+	return normalized;
+}
+function hasControlCharacter(value) {
+	for (const character of value) {
+		const code = character.charCodeAt(0);
+		if (code <= 31 || code === 127) return true;
+	}
+	return false;
+}
+function parseVersion(value, label) {
+	const version = typeof value === "number" ? value : Number(value);
+	if (!Number.isSafeInteger(version) || version < 1) throw new Error(`${label} is invalid`);
+	return version;
+}
+function parseTimestamp(value, label) {
+	const timestamp = typeof value === "number" ? value : Number(value);
+	if (!Number.isSafeInteger(timestamp) || timestamp < 0) throw new Error(`${label} is invalid`);
+	return timestamp;
+}
+function parseRequiredString(value, label) {
+	if (typeof value !== "string" || !value.trim()) throw new Error(`${label} is invalid`);
+	return value;
+}
+function parseJsonRecord(value, label) {
+	const parsed = parseD1JsonColumn(value);
+	if (!isJsonRecord(parsed)) throw new Error(`${label} must be a JSON object`);
+	return parsed;
+}
+function isJsonRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/** Compare parsed JSON records without relying on insertion order. */
+function equalLaneRecords(left, right) {
+	if (Object.is(left, right)) return true;
+	if (left === null || right === null || typeof left !== typeof right) return false;
+	if (Array.isArray(left) || Array.isArray(right)) {
+		if (!Array.isArray(left) || !Array.isArray(right) || left.length !== right.length) return false;
+		for (let index = 0; index < left.length; index += 1) if (!equalLaneRecords(left[index], right[index])) return false;
+		return true;
+	}
+	if (isJsonRecord(left) && isJsonRecord(right)) {
+		const leftKeys = Object.keys(left).sort();
+		const rightKeys = Object.keys(right).sort();
+		if (leftKeys.length !== rightKeys.length) return false;
+		for (let index = 0; index < leftKeys.length; index += 1) {
+			const key = leftKeys[index];
+			if (key !== rightKeys[index] || !equalLaneRecords(left[key], right[key])) return false;
+		}
+		return true;
+	}
+	return false;
+}
+function parseEnrollmentRow(row) {
+	return {
+		enrollmentId: parseRequiredString(row.enrollment_id, "enrollment_id"),
+		walletId: parseRequiredString(row.wallet_id, "wallet_id"),
+		manifestDigestB64u: parseRequiredString(row.manifest_digest_b64u, "manifest_digest_b64u"),
+		manifest: parseLaneEnrollmentManifestV1(parseJsonRecord(row.manifest_json, "lane enrollment manifest"), "lane enrollment manifest"),
+		lifecycle: parseLaneEnrollmentLifecycleV1(parseJsonRecord(row.lifecycle_json, "lane enrollment lifecycle"), "lane enrollment lifecycle"),
+		version: parseVersion(row.version, "enrollment version"),
+		commandDigestB64u: parseRequiredString(row.command_digest_b64u, "command_digest_b64u"),
+		createdAtMs: parseTimestamp(row.created_at_ms, "enrollment created_at_ms"),
+		updatedAtMs: parseTimestamp(row.updated_at_ms, "enrollment updated_at_ms")
+	};
+}
+function parseProtocolRow(row) {
+	const job = parseLaneProtocolJobV1(parseJsonRecord(row.job_json, "lane protocol job"), "lane protocol job");
+	const lifecycle = parseLaneProtocolLifecycleV1(parseJsonRecord(row.lifecycle_json, "lane protocol lifecycle"), "lane protocol lifecycle");
+	return {
+		operationId: parseRequiredString(row.operation_id, "operation_id"),
+		enrollmentId: parseRequiredString(row.enrollment_id, "enrollment_id"),
+		walletId: parseRequiredString(row.wallet_id, "wallet_id"),
+		walletKeyId: parseRequiredString(row.wallet_key_id, "wallet_key_id"),
+		sourceLaneId: parseRequiredString(row.source_lane_id, "source_lane_id"),
+		sourceLaneShareEpoch: parseRequiredString(row.source_lane_share_epoch, "source_lane_share_epoch"),
+		sourceRevocationEpoch: parseTimestamp(row.source_revocation_epoch, "source_revocation_epoch"),
+		targetLaneId: parseRequiredString(row.target_lane_id, "target_lane_id"),
+		targetLaneShareEpoch: parseRequiredString(row.target_lane_share_epoch, "target_lane_share_epoch"),
+		targetMaterialActivationId: parseRequiredString(row.target_material_activation_id, "target_material_activation_id"),
+		record: {
+			job,
+			lifecycle
+		},
+		version: parseVersion(row.version, "protocol version"),
+		commandDigestB64u: parseRequiredString(row.command_digest_b64u, "command_digest_b64u"),
+		createdAtMs: parseTimestamp(row.created_at_ms, "protocol created_at_ms"),
+		updatedAtMs: parseTimestamp(row.updated_at_ms, "protocol updated_at_ms")
+	};
+}
+function parseProductEpochRow(row) {
+	return parseLaneProductEpochRecordV1(parseJsonRecord(row.product_json, "lane product epoch"), "lane product epoch");
+}
+function parseReceiptRow(row) {
+	const receiptKind = parseRequiredString(row.receipt_kind, "receipt_kind");
+	const raw = row.receipt_json;
+	const value = (() => {
+		switch (receiptKind) {
+			case "lane_protocol_commit": return parseLaneProtocolCommitReceiptV1(parseJsonRecord(raw, "lane protocol commit receipt"));
+			case "lane_holder_delivery": return parseLaneHolderDeliveryReceiptV1(parseJsonRecord(raw, "lane holder delivery receipt"));
+			case "lane_server_activation": return parseLaneServerActivationReceiptV1(parseJsonRecord(raw, "lane server activation receipt"));
+			case "ecdsa_server_retirement": return parseLaneServerRetirementReceiptV1(parseJsonRecord(raw, "ECDSA server retirement receipt"));
+			case "ed25519_server_retirement": return parseLaneServerRetirementReceiptV1(parseJsonRecord(raw, "Ed25519 server retirement receipt"));
+			case "aggregate_activation": return parseAggregateLaneActivationReceiptV1(parseJsonRecord(raw, "aggregate lane activation receipt"));
+			case "aggregate_revocation": return parseAggregateLaneRevocationReceiptV1(parseJsonRecord(raw, "aggregate lane revocation receipt"));
+			default: throw new Error(`unknown R102 receipt kind ${receiptKind}`);
+		}
+	})();
+	return {
+		receiptId: parseRequiredString(row.receipt_id, "receipt_id"),
+		receiptKind,
+		receiptDigestB64u: parseRequiredString(row.receipt_digest_b64u, "receipt_digest_b64u"),
+		value
+	};
+}
+async function digestLaneEnrollmentRevocationCommand(input) {
+	return base64UrlEncode(await sha256BytesUtf8([
+		"seams/rotatable-signing-lanes/revoke-enrollment/v1",
+		String(input.enrollmentId),
+		String(input.walletId),
+		input.manifestDigestB64u,
+		input.reason,
+		String(input.requestedAtMs)
+	].join("\0")));
+}
+function scopeValues(scope) {
+	return [
+		scope.namespace,
+		scope.orgId,
+		scope.projectId,
+		scope.envId
+	];
+}
+function firstBatchResult(results, index) {
+	const result = results[index];
+	if (!result || typeof result !== "object") throw new Error(`R102 lane D1 batch result ${index} is invalid`);
+	return result;
+}
+const LANE_CAS_GUARD_SQL = "INSERT INTO lane_cas_guard (guard_id) SELECT 1 WHERE changes() = 0";
+function assertD1Success(result, label) {
+	if (result.success === false) throw new Error(`${label} failed`);
+}
+//#endregion
+export { LANE_CAS_GUARD_SQL, assertD1Success, digestLaneEnrollmentRevocationCommand, equalLaneRecords, firstBatchResult, normalizeScope, parseEnrollmentRow, parseJsonRecord, parseProductEpochRow, parseProtocolRow, parseReceiptRow, parseRequiredString, parseTimestamp, parseVersion, requireD1LaneStoreOptions, scopeValues };
+
+//# sourceMappingURL=d1LaneRecords.js.map

package/dist/esm/router/cloudflare/d1/signingLanes/index.js

@@ -0,0 +1,10 @@
+import { LANE_CAS_GUARD_SQL, assertD1Success, digestLaneEnrollmentRevocationCommand, equalLaneRecords, firstBatchResult, normalizeScope, parseEnrollmentRow, parseJsonRecord, parseProductEpochRow, parseProtocolRow, parseReceiptRow, parseRequiredString, parseTimestamp, parseVersion, requireD1LaneStoreOptions, scopeValues } from "./d1LaneRecords.js";
+import { CloudflareD1LaneLifecycleStore } from "./d1LaneLifecycleStore.js";
+import { createCloudflareD1EcdsaLanePrivateBindingResolverV1 } from "./d1EcdsaLanePrivateBindingResolver.js";
+import { CloudflareD1LaneEffectJournalStore } from "./d1LaneEffectJournalStore.js";
+import { CloudflareD1LaneLockStore } from "./d1LaneLockStore.js";
+import { CloudflareD1LaneEnrollmentGateway } from "./d1LaneEnrollmentGateway.js";
+import { createCloudflareD1LaneLifecycleApplicationService } from "./d1LaneLifecycleApplicationService.js";
+import { createCloudflareD1LaneAggregateRevocationApplicationService } from "./d1LaneAggregateRevocationApplicationService.js";
+import { createCloudflareD1LaneProtocolCommitterV1 } from "./d1LaneProtocolCommitter.js";
+export { CloudflareD1LaneEffectJournalStore, CloudflareD1LaneEnrollmentGateway, CloudflareD1LaneLifecycleStore, CloudflareD1LaneLockStore, LANE_CAS_GUARD_SQL, assertD1Success, createCloudflareD1EcdsaLanePrivateBindingResolverV1, createCloudflareD1LaneAggregateRevocationApplicationService, createCloudflareD1LaneLifecycleApplicationService, createCloudflareD1LaneProtocolCommitterV1, digestLaneEnrollmentRevocationCommand, equalLaneRecords, firstBatchResult, normalizeScope, parseEnrollmentRow, parseJsonRecord, parseProductEpochRow, parseProtocolRow, parseReceiptRow, parseRequiredString, parseTimestamp, parseVersion, requireD1LaneStoreOptions, scopeValues };