@seams/wallet-server 0.6.2 → 0.7.3

package/dist/esm/core/SessionService.js

@@ -1,3 +1,4 @@
+import { failure } from "../shared-ts/src/utils/failure.js";
 //#region src/core/SessionService.ts
 function normalizeParsedCorsOrigin(url) {
 	const host = url.hostname.toLowerCase();
@@ -153,36 +154,16 @@ var SessionService = class {
 	async refresh(headers) {
 		try {
 			const token = this.extractTokenFromHeaders(headers);
-			if (!token) return {
-				ok: false,
-				code: "unauthorized",
-				message: "No session token"
-			};
+			if (!token) return failure("unauthorized", "No session token");
 			const v = await this.verifyJwt(token);
 			if (!v.valid) {
-				if (v.reason === "expired") return {
-					ok: false,
-					code: "wallet_session_expired",
-					message: "Wallet Session expired"
-				};
-				return {
-					ok: false,
-					code: "unauthorized",
-					message: "Invalid token"
-				};
+				if (v.reason === "expired") return failure("wallet_session_expired", "Wallet Session expired");
+				return failure("unauthorized", "Invalid token");
 			}
 			const payload = v.payload || {};
-			if (!this.isWithinRefreshWindow(payload)) return {
-				ok: false,
-				code: "not_eligible",
-				message: "Not within refresh window"
-			};
+			if (!this.isWithinRefreshWindow(payload)) return failure("not_eligible", "Not within refresh window");
 			const sub = String(payload.sub || "");
-			if (!sub) return {
-				ok: false,
-				code: "invalid_claims",
-				message: "Missing sub claim"
-			};
+			if (!sub) return failure("invalid_claims", "Missing sub claim");
 			const extra = {};
 			for (const [k, v] of Object.entries(payload || {})) {
 				if (k === "sub" || k === "exp" || k === "iat" || k === "nbf" || k === "jti" || k === "iss" || k === "aud") continue;
@@ -193,11 +174,7 @@ var SessionService = class {
 				jwt: await this.signJwt(sub, extra)
 			};
 		} catch (e) {
-			return {
-				ok: false,
-				code: "internal",
-				message: e?.message || "Refresh failed"
-			};
+			return failure("internal", e?.message || "Refresh failed");
 		}
 	}
 	nowSeconds() {

package/dist/esm/core/ThresholdService/config.js

@@ -1,5 +1,3 @@
-import { base64UrlDecode } from "../../shared-ts/src/utils/base64.js";
-import "../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import "../../shared-ts/src/utils/validation.js";
 import { THRESHOLD_ED25519_2P_PARTICIPANT_IDS, normalizeThresholdEd25519ParticipantId, normalizeThresholdEd25519ParticipantIds } from "../../shared-ts/src/threshold/participants.js";
@@ -10,85 +8,6 @@ function coerceThresholdNodeRole(input) {
 	if (role === "coordinator") return "coordinator";
 	return "coordinator";
 }
-function parseThresholdRelayerCosigners(input) {
-	const asJson = (raw) => {
-		try {
-			return JSON.parse(raw);
-		} catch {
-			return null;
-		}
-	};
-	const raw = typeof input === "string" ? asJson(input) : input;
-	if (!Array.isArray(raw) || raw.length === 0) return null;
-	const out = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const item of raw) {
-		if (!item || typeof item !== "object" || Array.isArray(item)) return null;
-		const rec = item;
-		const cosignerId = normalizeThresholdEd25519ParticipantId(rec.cosignerId);
-		const relayerUrl = normalizeOptionalTrimmedString(rec.relayerUrl)?.replace(/\/+$/, "");
-		if (!cosignerId || !relayerUrl) return null;
-		const key = `${cosignerId}:${relayerUrl}`;
-		if (seen.has(key)) continue;
-		seen.add(key);
-		out.push({
-			cosignerId,
-			relayerUrl
-		});
-	}
-	out.sort((a, b) => a.cosignerId - b.cosignerId || a.relayerUrl.localeCompare(b.relayerUrl));
-	return out.length ? out : null;
-}
-function parseThresholdCoordinatorPeers(input) {
-	const asJson = (raw) => {
-		try {
-			return JSON.parse(raw);
-		} catch {
-			return null;
-		}
-	};
-	const raw = typeof input === "string" ? asJson(input) : input;
-	if (!Array.isArray(raw) || raw.length === 0) return null;
-	const out = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const item of raw) {
-		if (!item || typeof item !== "object" || Array.isArray(item)) return null;
-		const rec = item;
-		const instanceId = normalizeOptionalTrimmedString(rec.instanceId);
-		const relayerUrl = normalizeOptionalTrimmedString(rec.relayerUrl)?.replace(/\/+$/, "");
-		if (!instanceId || !relayerUrl) return null;
-		const key = `${instanceId}:${relayerUrl}`;
-		if (seen.has(key)) continue;
-		seen.add(key);
-		out.push({
-			instanceId,
-			relayerUrl
-		});
-	}
-	out.sort((a, b) => a.instanceId.localeCompare(b.instanceId) || a.relayerUrl.localeCompare(b.relayerUrl));
-	return out.length ? out : null;
-}
-function parseThresholdRelayerCosignerThreshold(input) {
-	const raw = normalizeOptionalTrimmedString(input);
-	if (!raw) return null;
-	const n = Number(raw);
-	if (!Number.isFinite(n)) return null;
-	const t = Math.floor(n);
-	if (t < 1) return null;
-	return t;
-}
-function parseThresholdCoordinatorSharedSecretBytes(input) {
-	const coordinatorSharedSecretB64u = normalizeOptionalTrimmedString(input);
-	if (!coordinatorSharedSecretB64u) return null;
-	let decoded;
-	try {
-		decoded = base64UrlDecode(coordinatorSharedSecretB64u);
-	} catch {
-		throw new Error("THRESHOLD_COORDINATOR_SHARED_SECRET_B64U must be valid base64url");
-	}
-	if (decoded.length !== 32) throw new Error(`THRESHOLD_COORDINATOR_SHARED_SECRET_B64U must decode to 32 bytes, got ${decoded.length}`);
-	return decoded;
-}
 function parseThresholdEd25519ParticipantIds2p(input) {
 	const clientIdRaw = input.THRESHOLD_ED25519_CLIENT_PARTICIPANT_ID;
 	const relayerIdRaw = input.THRESHOLD_ED25519_RELAYER_PARTICIPANT_ID;
@@ -106,6 +25,6 @@ function parseThresholdEd25519ParticipantIds2p(input) {
 	};
 }
 //#endregion
-export { coerceThresholdNodeRole, parseThresholdCoordinatorPeers, parseThresholdCoordinatorSharedSecretBytes, parseThresholdEd25519ParticipantIds2p, parseThresholdRelayerCosignerThreshold, parseThresholdRelayerCosigners };
+export { coerceThresholdNodeRole, parseThresholdEd25519ParticipantIds2p };
 
 //# sourceMappingURL=config.js.map

package/dist/esm/core/ThresholdService/kv.js

@@ -1,4 +1,4 @@
-import { isObject } from "./validation.js";
+import { isPlainObject } from "../../shared-ts/src/utils/validation.js";
 //#region src/core/ThresholdService/kv.ts
 function tryParseJson(raw) {
 	try {
@@ -8,7 +8,7 @@ function tryParseJson(raw) {
 	}
 }
 function readResult(json) {
-	if (!isObject(json) || !("result" in json)) return null;
+	if (!isPlainObject(json) || !("result" in json)) return null;
 	const v = json.result;
 	return v === void 0 || v === null ? null : v;
 }
@@ -113,7 +113,7 @@ var UpstashRedisRestClient = class {
 			...argList
 		].map((part) => encodeURIComponent(String(part)));
 		const json = await this.call(`/${segments.join("/")}`, "POST");
-		if (isObject(json) && typeof json.error === "string") throw new Error(`Upstash EVAL error: ${json.error}`);
+		if (isPlainObject(json) && typeof json.error === "string") throw new Error(`Upstash EVAL error: ${json.error}`);
 		return readResult(json);
 	}
 };

package/dist/esm/core/ThresholdService/routerAb/ecdsaDerivationPoolFillHandlers.js

@@ -1,17 +1,37 @@
 import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
 import "../../../shared-ts/src/utils/validation.js";
 import { signingRootScopeFromRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
-import { parseRouterAbEcdsaDerivationNormalSigningScopeV1, sameRouterAbEcdsaDerivationNormalSigningScopeV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { ROUTER_AB_ECDSA_PRESIGN_CEREMONY_MAX_LIFETIME_MS, parseRouterAbEcdsaDerivationNormalSigningScopeV1, sameRouterAbEcdsaDerivationNormalSigningScopeV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { normalizeThresholdEd25519ParticipantIds } from "../../../shared-ts/src/threshold/participants.js";
+import { parseEcdsaKeyHandle } from "../../../shared-ts/src/threshold/keyMaterialBrands.js";
 import { WALLET_SESSION_FAILURE_CODES } from "../../../shared-ts/src/utils/walletSessionFailure.js";
 import { startRouterAbEcdsaPresignSession, stepRouterAbEcdsaPresignSession } from "./ecdsaDerivationPresignBridge.js";
-import { parseEcdsaKeyHandle } from "../../keyMaterialBrands.js";
 //#region src/core/ThresholdService/routerAb/ecdsaDerivationPoolFillHandlers.ts
 const PRESIGN_SESSION_ID_PREFIX = "ecdsa-presign-v2";
-const MAX_PRESIGN_CEREMONY_LIFETIME_MS = 5 * 6e4;
 const MAX_DURABLE_PRESIGNATURE_LIFETIME_MS = 2160 * 60 * 6e4;
+function ownerWalletScopeMatchesBinding(binding) {
+	const owner = binding.ownerWalletScope;
+	const policy = binding.runtimePolicyScope;
+	return owner.orgId === policy.orgId && owner.projectId === policy.projectId && owner.walletId === binding.walletId && owner.projectEnvironmentId.length > 0;
+}
+function presignAuthorityForBinding(binding) {
+	const scope = binding.ownerWalletScope;
+	const walletScope = {
+		org_id: scope.orgId,
+		project_id: scope.projectId,
+		project_environment_id: scope.projectEnvironmentId,
+		wallet_id: scope.walletId
+	};
+	return binding.authorization.kind === "operation_step_up" ? {
+		kind: "operation_step_up",
+		wallet_scope: walletScope
+	} : {
+		kind: "owner_wallet_session",
+		wallet_scope: walletScope
+	};
+}
 function resolveRouterAbEcdsaPresignDeadlines(input) {
-	const ceremonyExpiresAtMs = Math.min(input.requestedCeremonyExpiresAtMs, input.thresholdExpiresAtMs, input.nowMs + MAX_PRESIGN_CEREMONY_LIFETIME_MS);
+	const ceremonyExpiresAtMs = Math.min(input.requestedCeremonyExpiresAtMs, input.thresholdExpiresAtMs, input.nowMs + ROUTER_AB_ECDSA_PRESIGN_CEREMONY_MAX_LIFETIME_MS);
 	const maximumAuthorizedMaterialExpiry = input.authorization.kind === "operation_step_up" ? input.authorization.materialExpiresAtMs : Number.MAX_SAFE_INTEGER;
 	return {
 		ceremonyExpiresAtMs,
@@ -202,6 +222,11 @@ var RouterAbEcdsaDerivationPoolFillHandlers = class {
 	}
 	async startStrictPresignSession(input) {
 		const transport = this.signingWorkerTransport;
+		if (!ownerWalletScopeMatchesBinding(input.binding)) return {
+			ok: false,
+			code: WALLET_SESSION_FAILURE_CODES.scopeMismatch,
+			message: "Presign owner Wallet Session scope does not match active material"
+		};
 		const scope = input.poolFill.scope;
 		const trustedScope = input.binding.routerAbEcdsaDerivationNormalSigning.scope;
 		if (!sameRouterAbEcdsaDerivationNormalSigningScopeV1(scope, trustedScope)) return {
@@ -241,12 +266,13 @@ var RouterAbEcdsaDerivationPoolFillHandlers = class {
 		if (ceremonyExpiresAtMs !== input.poolFill.ceremonyExpiresAtMs || materialExpiresAtMs !== input.poolFill.materialExpiresAtMs) return {
 			ok: false,
 			code: "invalid_pool_fill_expiry",
-			message: "Presign initialization deadlines exceed live authorization"
+			message: `Presign initialization deadlines exceed live authorization (requested ceremony ${input.poolFill.ceremonyExpiresAtMs} material ${input.poolFill.materialExpiresAtMs}; authorized ceremony ${ceremonyExpiresAtMs} material ${materialExpiresAtMs})`
 		};
 		const presignSessionId = input.presignSessionId;
 		const started = await startRouterAbEcdsaPresignSession({
 			signingWorkerBaseUrl: transport.signingWorkerBaseUrl,
 			scope,
+			authority: presignAuthorityForBinding(input.binding),
 			presignSessionId,
 			firstMessageB64u: input.firstMessageB64u,
 			ceremonyExpiresAtMs,
@@ -276,10 +302,16 @@ var RouterAbEcdsaDerivationPoolFillHandlers = class {
 	}
 	async stepStrictPresignSession(input) {
 		const transport = this.signingWorkerTransport;
+		if (!ownerWalletScopeMatchesBinding(input.binding)) return {
+			ok: false,
+			code: WALLET_SESSION_FAILURE_CODES.scopeMismatch,
+			message: "Presign owner Wallet Session scope does not match active material"
+		};
 		const scope = input.binding.routerAbEcdsaDerivationNormalSigning.scope;
 		const stepped = await stepRouterAbEcdsaPresignSession({
 			signingWorkerBaseUrl: transport.signingWorkerBaseUrl,
 			scope,
+			authority: presignAuthorityForBinding(input.binding),
 			presignSessionId: input.presignSessionId,
 			requestedStage: input.requestedStage,
 			outgoingMessagesB64u: input.outgoingMessagesB64u,

package/dist/esm/core/ThresholdService/routerAb/ecdsaDerivationPresignBridge.js

@@ -1,24 +1,11 @@
-import { buildCloudflareSigningWorkerEcdsaDerivationPresignaturePoolPutRequestV1, parseCloudflareSigningWorkerEcdsaDerivationPresignaturePoolPutReceiptForRequestV1, parseCloudflareSigningWorkerEcdsaDerivationPresignaturePoolPutRequestV1, parseRouterAbEcdsaDerivationNormalSigningScopeV1, parseRouterAbEcdsaSigningWorkerProtocolExportShareEnvelopeV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { parseRouterAbEcdsaDerivationNormalSigningScopeV1, parseRouterAbEcdsaSigningWorkerProtocolExportShareEnvelopeV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1, postRouterAbInternalServiceJson } from "./internalServiceHttp.js";
 //#region src/core/ThresholdService/routerAb/ecdsaDerivationPresignBridge.ts
-const CLOUDFLARE_SIGNING_WORKER_ECDSA_DERIVATION_PRESIGNATURE_POOL_PUT_PATH = "/router-ab/signing-worker/ecdsa-derivation/presignature-pool/put";
 const CLOUDFLARE_SIGNING_WORKER_ECDSA_PRESIGN_SESSION_INIT_PATH = "/router-ab/signing-worker/ecdsa-derivation/presignature-session/init";
 const CLOUDFLARE_SIGNING_WORKER_ECDSA_PRESIGN_SESSION_STEP_PATH = "/router-ab/signing-worker/ecdsa-derivation/presignature-session/step";
 const CLOUDFLARE_SIGNING_WORKER_ECDSA_LINKED_PRESIGN_SESSION_INIT_PATH = "/router-ab/signing-worker/ecdsa-derivation/linked-device/presignature-session/init";
 const CLOUDFLARE_SIGNING_WORKER_ECDSA_LINKED_PRESIGN_SESSION_STEP_PATH = "/router-ab/signing-worker/ecdsa-derivation/linked-device/presignature-session/step";
 const CLOUDFLARE_SIGNING_WORKER_ECDSA_LINKED_EXPORT_SHARE_PATH = "/router-ab/signing-worker/ecdsa-derivation/linked-device/export-share";
-function buildRouterAbEcdsaDerivationPresignaturePoolPutRequest(input) {
-	return parseCloudflareSigningWorkerEcdsaDerivationPresignaturePoolPutRequestV1(buildCloudflareSigningWorkerEcdsaDerivationPresignaturePoolPutRequestV1({
-		scope: parseRouterAbEcdsaDerivationNormalSigningScopeV1(input.scope),
-		presignature: input.presignature,
-		expiresAtMs: input.materialExpiresAtMs
-	}));
-}
-function privatePoolFillUrl(signingWorkerBaseUrl) {
-	const base = signingWorkerBaseUrl.trim().replace(/\/+$/, "");
-	if (!base) throw new Error("signingWorkerBaseUrl is required");
-	return `${base}${CLOUDFLARE_SIGNING_WORKER_ECDSA_DERIVATION_PRESIGNATURE_POOL_PUT_PATH}`;
-}
 function errorMessage(error) {
 	return String(error && typeof error === "object" && "message" in error ? error.message : error || "");
 }
@@ -153,6 +140,7 @@ async function startRouterAbEcdsaPresignSession(input) {
 		path: CLOUDFLARE_SIGNING_WORKER_ECDSA_PRESIGN_SESSION_INIT_PATH,
 		body: {
 			scope: parseRouterAbEcdsaDerivationNormalSigningScopeV1(input.scope),
+			authority: input.authority,
 			presign_session_id: input.presignSessionId,
 			first_message_b64u: input.firstMessageB64u,
 			ceremony_expires_at_ms: input.ceremonyExpiresAtMs,
@@ -169,6 +157,7 @@ async function stepRouterAbEcdsaPresignSession(input) {
 		path: CLOUDFLARE_SIGNING_WORKER_ECDSA_PRESIGN_SESSION_STEP_PATH,
 		body: {
 			scope: parseRouterAbEcdsaDerivationNormalSigningScopeV1(input.scope),
+			authority: input.authority,
 			presign_session_id: input.presignSessionId,
 			requested_stage: input.requestedStage,
 			outgoing_messages_b64u: input.outgoingMessagesB64u,
@@ -215,66 +204,7 @@ async function stepRouterAbLinkedDeviceEcdsaPresignSession(input) {
 		fetchImpl: input.fetchImpl
 	});
 }
-async function putRouterAbEcdsaDerivationPresignaturePoolFill(input) {
-	const request = parseCloudflareSigningWorkerEcdsaDerivationPresignaturePoolPutRequestV1(input.request);
-	const url = privatePoolFillUrl(input.signingWorkerBaseUrl);
-	const response = await postRouterAbInternalServiceJson({
-		url,
-		body: request,
-		authSecret: input.auth.secret,
-		fetchImpl: input.fetchImpl
-	});
-	if (!response.ok && response.code === "network_error") return {
-		ok: false,
-		code: "network_error",
-		message: `pool-fill request to ${url} failed: ${response.message}`
-	};
-	if (!response.ok && response.code === "http_error") return {
-		ok: false,
-		code: "http_error",
-		message: response.bodyText || `pool-fill request failed with HTTP ${response.status}`,
-		status: response.status,
-		bodyText: response.bodyText
-	};
-	if (!response.ok) return {
-		ok: false,
-		code: "invalid_response",
-		message: "pool-fill response body is not valid JSON",
-		status: response.status,
-		bodyText: response.bodyText
-	};
-	let receipt;
-	try {
-		receipt = parseCloudflareSigningWorkerEcdsaDerivationPresignaturePoolPutReceiptForRequestV1(request, response.json);
-	} catch (error) {
-		return {
-			ok: false,
-			code: "invalid_response",
-			message: errorMessage(error),
-			status: response.status,
-			bodyText: response.bodyText
-		};
-	}
-	if (!receipt.stored) return {
-		ok: false,
-		code: "already_exists",
-		message: "Router A/B ECDSA derivation presignature already exists in the SigningWorker pool",
-		status: response.status,
-		receipt: {
-			...receipt,
-			stored: false
-		}
-	};
-	return {
-		ok: true,
-		status: response.status,
-		receipt: {
-			...receipt,
-			stored: true
-		}
-	};
-}
 //#endregion
-export { CLOUDFLARE_SIGNING_WORKER_ECDSA_DERIVATION_PRESIGNATURE_POOL_PUT_PATH, CLOUDFLARE_SIGNING_WORKER_ECDSA_LINKED_EXPORT_SHARE_PATH, CLOUDFLARE_SIGNING_WORKER_ECDSA_LINKED_PRESIGN_SESSION_INIT_PATH, CLOUDFLARE_SIGNING_WORKER_ECDSA_LINKED_PRESIGN_SESSION_STEP_PATH, CLOUDFLARE_SIGNING_WORKER_ECDSA_PRESIGN_SESSION_INIT_PATH, CLOUDFLARE_SIGNING_WORKER_ECDSA_PRESIGN_SESSION_STEP_PATH, ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1, buildRouterAbEcdsaDerivationPresignaturePoolPutRequest, exportRouterAbLinkedDeviceEcdsaShare, putRouterAbEcdsaDerivationPresignaturePoolFill, startRouterAbEcdsaPresignSession, startRouterAbLinkedDeviceEcdsaPresignSession, stepRouterAbEcdsaPresignSession, stepRouterAbLinkedDeviceEcdsaPresignSession };
+export { ROUTER_AB_INTERNAL_SERVICE_AUTH_HEADER_V1, exportRouterAbLinkedDeviceEcdsaShare, startRouterAbEcdsaPresignSession, startRouterAbLinkedDeviceEcdsaPresignSession, stepRouterAbEcdsaPresignSession, stepRouterAbLinkedDeviceEcdsaPresignSession };
 
 //# sourceMappingURL=ecdsaDerivationPresignBridge.js.map

package/dist/esm/core/ThresholdService/routerAbNormalSigningPolicy.js

@@ -1,5 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import "../../shared-ts/src/utils/validation.js";
+import { failure } from "../../shared-ts/src/utils/failure.js";
 //#region src/core/ThresholdService/routerAbNormalSigningPolicy.ts
 function parseRouterAbNormalSigningServerPolicy(config) {
 	const signingWorkerId = normalizeOptionalTrimmedString(config.ROUTER_AB_NORMAL_SIGNING_WORKER_ID);
@@ -10,16 +11,8 @@ function parseRouterAbNormalSigningServerPolicy(config) {
 	};
 }
 function validateRouterAbNormalSigningServerPolicy(args) {
-	if (!args.requested) return {
-		ok: false,
-		code: "unauthorized",
-		message: "sessionPolicy.routerAbNormalSigning is required for Router A/B normal signing"
-	};
-	if (args.requested.signingWorkerId !== args.policy.signingWorkerId) return {
-		ok: false,
-		code: "unauthorized",
-		message: "sessionPolicy.routerAbNormalSigning.signingWorkerId is not allowed for this threshold server"
-	};
+	if (!args.requested) return failure("unauthorized", "sessionPolicy.routerAbNormalSigning is required for Router A/B normal signing");
+	if (args.requested.signingWorkerId !== args.policy.signingWorkerId) return failure("unauthorized", "sessionPolicy.routerAbNormalSigning.signingWorkerId is not allowed for this threshold server");
 	return {
 		ok: true,
 		value: null

package/dist/esm/core/ThresholdService/stores/CloudflareDurableObjectStore.js

@@ -1,39 +1,12 @@
 import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
-import "../../../shared-ts/src/utils/validation.js";
+import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
 import "../../defaultConfigsServer.js";
-import { canonicalThresholdEd25519RelayerKeyId, isObject, parseEcdsaWalletSessionRecord, parseEd25519WalletSessionRecord, parseThresholdEcdsaMpcSessionRecord, parseThresholdEd25519CoordinatorSigningSessionRecord, parseThresholdEd25519KeyRecord, parseThresholdEd25519MpcSessionRecord, parseThresholdEd25519SigningSessionRecord, toThresholdEcdsaPrefixFromBase, toThresholdEcdsaSessionPrefix, toThresholdEcdsaWalletSessionPrefix, toThresholdEd25519KeyPrefix, toThresholdEd25519PrefixFromBase, toThresholdEd25519SessionPrefix, toThresholdEd25519WalletSessionPrefix } from "../validation.js";
+import { canonicalThresholdEd25519RelayerKeyId, parseEcdsaWalletSessionRecord, parseEd25519WalletSessionRecord, parseThresholdEcdsaMpcSessionRecord, parseThresholdEd25519CoordinatorSigningSessionRecord, parseThresholdEd25519KeyRecord, parseThresholdEd25519MpcSessionRecord, parseThresholdEd25519SigningSessionRecord, toThresholdEcdsaPrefixFromBase, toThresholdEcdsaSessionPrefix, toThresholdEcdsaWalletSessionPrefix, toThresholdEd25519KeyPrefix, toThresholdEd25519PrefixFromBase, toThresholdEd25519SessionPrefix, toThresholdEd25519WalletSessionPrefix } from "../validation.js";
+import { durableObjectName, durableObjectStub, requestDurableObjectJson, resolveDurableObjectNamespace } from "../../storeBackends.js";
 //#region src/core/ThresholdService/stores/CloudflareDurableObjectStore.ts
-function isDurableObjectNamespaceLike(v) {
-	return Boolean(v) && typeof v === "object" && !Array.isArray(v) && typeof v.idFromName === "function" && typeof v.get === "function";
-}
-function resolveDoNamespaceFromConfig(config) {
-	const direct = config.namespace;
-	if (isDurableObjectNamespaceLike(direct)) return direct;
-	const alt = config.durableObjectNamespace;
-	if (isDurableObjectNamespaceLike(alt)) return alt;
-	const envStyle = config.THRESHOLD_DO_NAMESPACE;
-	if (isDurableObjectNamespaceLike(envStyle)) return envStyle;
-	return null;
-}
-function resolveDoStub(input) {
-	const id = input.namespace.idFromName(input.objectName);
-	return input.namespace.get(id);
-}
 async function callDo(stub, req) {
-	const resp = await stub.fetch("https://threshold-store.invalid/", {
-		method: "POST",
-		headers: { "content-type": "application/json" },
-		body: JSON.stringify(req)
-	});
-	const text = await resp.text();
-	if (!resp.ok) throw new Error(`Threshold DO store HTTP ${resp.status}: ${text}`);
-	let json;
-	try {
-		json = text ? JSON.parse(text) : null;
-	} catch {
-		throw new Error(`Threshold DO store returned non-JSON response: ${text.slice(0, 200)}`);
-	}
-	if (!isObject(json)) throw new Error("Threshold DO store returned invalid JSON shape");
+	const json = await requestDurableObjectJson(stub, req, "Threshold");
+	if (!isPlainObject(json)) throw new Error("Threshold DO store returned invalid JSON shape");
 	if (json.ok === true) return json;
 	const code = normalizeOptionalTrimmedString(json.code);
 	const message = normalizeOptionalTrimmedString(json.message);
@@ -65,10 +38,7 @@ function computeSessionPrefixEcdsa(config) {
 }
 var CloudflareDurableObjectWalletSessionStore = class {
 	constructor(input) {
-		this.stub = resolveDoStub({
-			namespace: input.namespace,
-			objectName: input.objectName
-		});
+		this.stub = durableObjectStub(input.namespace, input.objectName);
 		this.keyPrefix = input.keyPrefix;
 		this.parseRecord = input.parseRecord;
 	}
@@ -101,7 +71,7 @@ var CloudflareDurableObjectWalletSessionStore = class {
 		});
 		if (!resp.ok) return null;
 		const raw = resp.value;
-		const entry = isObject(raw) ? raw : null;
+		const entry = isPlainObject(raw) ? raw : null;
 		const record = entry ? this.parseRecord(entry.record) : null;
 		const expiresAtMs = entry ? entry.expiresAtMs : null;
 		if (!record || typeof expiresAtMs !== "number" || !Number.isFinite(expiresAtMs)) return null;
@@ -215,10 +185,7 @@ var CloudflareDurableObjectWalletSessionStore = class {
 };
 var CloudflareDurableObjectThresholdEd25519SessionStore = class {
 	constructor(input) {
-		this.stub = resolveDoStub({
-			namespace: input.namespace,
-			objectName: input.objectName
-		});
+		this.stub = durableObjectStub(input.namespace, input.objectName);
 		this.keyPrefix = input.keyPrefix;
 		this.coordinatorPrefix = `${this.keyPrefix}coord:`;
 		this.parseMpcSessionRecord = input.parseMpcSessionRecord || parseThresholdEd25519MpcSessionRecord;
@@ -333,10 +300,7 @@ var CloudflareDurableObjectThresholdEd25519SessionStore = class {
 };
 var CloudflareDurableObjectThresholdEd25519KeyStore = class {
 	constructor(input) {
-		this.stub = resolveDoStub({
-			namespace: input.namespace,
-			objectName: input.objectName
-		});
+		this.stub = durableObjectStub(input.namespace, input.objectName);
 		this.keyPrefix = input.keyPrefix;
 	}
 	key(relayerKeyId) {
@@ -373,11 +337,11 @@ var CloudflareDurableObjectThresholdEd25519KeyStore = class {
 	}
 };
 function createCloudflareDurableObjectThresholdEd25519Stores(input) {
-	const config = isObject(input.config) ? input.config : {};
+	const config = isPlainObject(input.config) ? input.config : {};
 	if (normalizeOptionalTrimmedString(config.kind) !== "cloudflare-do") return null;
-	const namespace = resolveDoNamespaceFromConfig(config);
+	const namespace = resolveDurableObjectNamespace(config);
 	if (!namespace) throw new Error("cloudflare-do threshold store selected but no Durable Object namespace was provided (expected config.namespace)");
-	const objectName = normalizeOptionalTrimmedString(config.objectName) || normalizeOptionalTrimmedString(config.name) || "threshold-store";
+	const objectName = durableObjectName(config);
 	const walletSessionPrefix = computeWalletSessionPrefix(config);
 	const sessionPrefix = computeSessionPrefix(config);
 	const keyPrefix = computeKeyPrefix(config);
@@ -402,9 +366,9 @@ function createCloudflareDurableObjectThresholdEd25519Stores(input) {
 	};
 }
 function createCloudflareDurableObjectThresholdEcdsaStores(input) {
-	const config = isObject(input.config) ? input.config : {};
+	const config = isPlainObject(input.config) ? input.config : {};
 	if (normalizeOptionalTrimmedString(config.kind) !== "cloudflare-do") return null;
-	const namespace = resolveDoNamespaceFromConfig(config);
+	const namespace = resolveDurableObjectNamespace(config);
 	if (!namespace) throw new Error("cloudflare-do threshold store selected but no Durable Object namespace was provided (expected config.namespace)");
 	const configuredObjectName = normalizeOptionalTrimmedString(config.objectName) || normalizeOptionalTrimmedString(config.name);
 	const ecdsaObjectName = configuredObjectName || "threshold-ecdsa-store";
@@ -428,6 +392,6 @@ function createCloudflareDurableObjectThresholdEcdsaStores(input) {
 	};
 }
 //#endregion
-export { CloudflareDurableObjectThresholdEd25519KeyStore, CloudflareDurableObjectThresholdEd25519SessionStore, CloudflareDurableObjectWalletSessionStore, createCloudflareDurableObjectThresholdEcdsaStores, createCloudflareDurableObjectThresholdEd25519Stores };
+export { createCloudflareDurableObjectThresholdEcdsaStores, createCloudflareDurableObjectThresholdEd25519Stores };
 
 //# sourceMappingURL=CloudflareDurableObjectStore.js.map

package/dist/esm/core/ThresholdService/stores/KeyStore.js

@@ -1,6 +1,6 @@
 import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
-import "../../../shared-ts/src/utils/validation.js";
-import { canonicalThresholdEd25519RelayerKeyId, isObject, parseThresholdEd25519KeyRecord, toThresholdEd25519KeyPrefix, toThresholdEd25519PrefixFromBase } from "../validation.js";
+import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
+import { canonicalThresholdEd25519RelayerKeyId, parseThresholdEd25519KeyRecord, toThresholdEd25519KeyPrefix, toThresholdEd25519PrefixFromBase } from "../validation.js";
 import { RedisTcpClient, UpstashRedisRestClient, redisDel, redisGetJson, redisSetJson } from "../kv.js";
 import { createCloudflareDurableObjectThresholdEd25519Stores } from "./CloudflareDurableObjectStore.js";
 import { readNonDurableObjectThresholdStoreKind } from "./StoreConfig.js";
@@ -88,7 +88,7 @@ function createThresholdEd25519KeyStore(input) {
 		logger: input.logger
 	});
 	if (doStores) return doStores.keyStore;
-	const config = isObject(input.config) ? input.config : {};
+	const config = isPlainObject(input.config) ? input.config : {};
 	const basePrefix = normalizeOptionalTrimmedString(config.THRESHOLD_PREFIX);
 	const envPrefix = normalizeOptionalTrimmedString(config.THRESHOLD_ED25519_KEYSTORE_PREFIX) || toThresholdEd25519PrefixFromBase(basePrefix, "key") || "";
 	const kind = readNonDurableObjectThresholdStoreKind(config, "threshold-ed25519");

package/dist/esm/core/ThresholdService/stores/SessionStore.js

@@ -1,8 +1,8 @@
 import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
-import "../../../shared-ts/src/utils/validation.js";
-import { isObject, parseThresholdEcdsaMpcSessionRecord, parseThresholdEd25519CoordinatorSigningSessionRecord, parseThresholdEd25519MpcSessionRecord, parseThresholdEd25519SigningSessionRecord, toThresholdEcdsaPrefixFromBase, toThresholdEcdsaSessionPrefix, toThresholdEd25519PrefixFromBase, toThresholdEd25519SessionPrefix } from "../validation.js";
+import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
+import { parseThresholdEd25519CoordinatorSigningSessionRecord, parseThresholdEd25519MpcSessionRecord, parseThresholdEd25519SigningSessionRecord, toThresholdEd25519PrefixFromBase, toThresholdEd25519SessionPrefix } from "../validation.js";
 import { RedisTcpClient, UpstashRedisRestClient, redisEval, redisGetRaw, redisGetdelJson, redisSetJson } from "../kv.js";
-import { createCloudflareDurableObjectThresholdEcdsaStores, createCloudflareDurableObjectThresholdEd25519Stores } from "./CloudflareDurableObjectStore.js";
+import { createCloudflareDurableObjectThresholdEd25519Stores } from "./CloudflareDurableObjectStore.js";
 import { readNonDurableObjectThresholdStoreKind } from "./StoreConfig.js";
 //#region src/core/ThresholdService/stores/SessionStore.ts
 function parseRawJson(raw) {
@@ -301,7 +301,7 @@ function createThresholdEd25519SessionStore(input) {
 		logger: input.logger
 	});
 	if (doStores) return doStores.sessionStore;
-	const config = isObject(input.config) ? input.config : {};
+	const config = isPlainObject(input.config) ? input.config : {};
 	const allowInMemory = normalizeOptionalTrimmedString(config.THRESHOLD_ALLOW_IN_MEMORY_STORES) === "1";
 	const requirePersistent = !input.isNode && !allowInMemory;
 	const basePrefix = normalizeOptionalTrimmedString(config.THRESHOLD_PREFIX);
@@ -355,83 +355,7 @@ function createThresholdEd25519SessionStore(input) {
 	input.logger.info("[threshold-ed25519] Using in-memory session store for threshold signing sessions (non-persistent)");
 	return new InMemoryThresholdEd25519SessionStore({ keyPrefix: envPrefix || void 0 });
 }
-function createThresholdEcdsaSessionStore(input) {
-	const doStores = createCloudflareDurableObjectThresholdEcdsaStores({
-		config: input.config,
-		logger: input.logger
-	});
-	if (doStores) return doStores.sessionStore;
-	const config = isObject(input.config) ? input.config : {};
-	const allowInMemory = normalizeOptionalTrimmedString(config.THRESHOLD_ALLOW_IN_MEMORY_STORES) === "1";
-	const requirePersistent = !input.isNode && !allowInMemory;
-	const basePrefix = normalizeOptionalTrimmedString(config.THRESHOLD_PREFIX);
-	const envPrefix = toThresholdEcdsaSessionPrefix(normalizeOptionalTrimmedString(config.THRESHOLD_ECDSA_SESSION_PREFIX) || toThresholdEcdsaPrefixFromBase(basePrefix, "sess"));
-	const kind = readNonDurableObjectThresholdStoreKind(config, "threshold-ecdsa");
-	if (kind === "in-memory") {
-		if (requirePersistent) throw new Error("[threshold-ecdsa] In-memory session store is not supported in this runtime; configure Upstash/Redis or Durable Objects");
-		return new InMemoryThresholdEd25519SessionStore({
-			keyPrefix: envPrefix,
-			parseMpcSessionRecord: parseThresholdEcdsaMpcSessionRecord
-		});
-	}
-	if (kind === "upstash-redis-rest") return new UpstashRedisRestThresholdEd25519SessionStore({
-		url: normalizeOptionalTrimmedString(config.url) || normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_URL),
-		token: normalizeOptionalTrimmedString(config.token) || normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_TOKEN),
-		keyPrefix: normalizeOptionalTrimmedString(config.keyPrefix) || envPrefix,
-		parseMpcSessionRecord: parseThresholdEcdsaMpcSessionRecord
-	});
-	if (kind === "redis-tcp") {
-		if (!input.isNode) {
-			if (requirePersistent) throw new Error("[threshold-ecdsa] redis-tcp session store is not supported in this runtime; configure Upstash/Redis REST or Durable Objects");
-			input.logger.warn("[threshold-ecdsa] redis-tcp session store is not supported in this runtime; falling back to in-memory");
-			return new InMemoryThresholdEd25519SessionStore({
-				keyPrefix: envPrefix,
-				parseMpcSessionRecord: parseThresholdEcdsaMpcSessionRecord
-			});
-		}
-		return new RedisTcpThresholdEd25519SessionStore({
-			redisUrl: normalizeOptionalTrimmedString(config.redisUrl) || normalizeOptionalTrimmedString(config.REDIS_URL),
-			keyPrefix: normalizeOptionalTrimmedString(config.keyPrefix) || envPrefix,
-			parseMpcSessionRecord: parseThresholdEcdsaMpcSessionRecord
-		});
-	}
-	const upstashUrl = normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_URL);
-	const upstashToken = normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_TOKEN);
-	if (upstashUrl || upstashToken) {
-		if (!upstashUrl || !upstashToken) throw new Error("Upstash session store enabled but UPSTASH_REDIS_REST_URL / UPSTASH_REDIS_REST_TOKEN are not both set");
-		input.logger.info("[threshold-ecdsa] Using Upstash REST session store for signing session persistence");
-		return new UpstashRedisRestThresholdEd25519SessionStore({
-			url: upstashUrl,
-			token: upstashToken,
-			keyPrefix: envPrefix,
-			parseMpcSessionRecord: parseThresholdEcdsaMpcSessionRecord
-		});
-	}
-	const redisUrl = normalizeOptionalTrimmedString(config.REDIS_URL);
-	if (redisUrl) {
-		if (!input.isNode) {
-			if (requirePersistent) throw new Error("[threshold-ecdsa] REDIS_URL is set but TCP Redis is not supported in this runtime; use Upstash/Redis REST or Durable Objects");
-			input.logger.warn("[threshold-ecdsa] REDIS_URL is set but TCP Redis is not supported in this runtime; falling back to in-memory");
-			return new InMemoryThresholdEd25519SessionStore({
-				keyPrefix: envPrefix,
-				parseMpcSessionRecord: parseThresholdEcdsaMpcSessionRecord
-			});
-		}
-		input.logger.info("[threshold-ecdsa] Using redis-tcp session store for signing session persistence");
-		return new RedisTcpThresholdEd25519SessionStore({
-			redisUrl,
-			keyPrefix: envPrefix,
-			parseMpcSessionRecord: parseThresholdEcdsaMpcSessionRecord
-		});
-	}
-	if (requirePersistent) throw new Error("[threshold-ecdsa] Threshold signing sessions require persistent storage in this runtime; configure UPSTASH_REDIS_REST_URL/UPSTASH_REDIS_REST_TOKEN or Durable Objects");
-	input.logger.info("[threshold-ecdsa] Using in-memory session store for threshold signing sessions (non-persistent)");
-	return new InMemoryThresholdEd25519SessionStore({
-		keyPrefix: envPrefix,
-		parseMpcSessionRecord: parseThresholdEcdsaMpcSessionRecord
-	});
-}
 //#endregion
-export { createThresholdEcdsaSessionStore, createThresholdEd25519SessionStore };
+export { createThresholdEd25519SessionStore };
 
 //# sourceMappingURL=SessionStore.js.map