@seams/wallet-server 0.6.2 → 0.7.3

package/dist/esm/core/ThresholdService/stores/WalletSessionStore.js

@@ -1,26 +1,49 @@
 import { normalizeOptionalTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
-import "../../../shared-ts/src/utils/validation.js";
-import { isObject, parseEcdsaWalletSessionRecord, parseEd25519WalletSessionRecord, toThresholdEcdsaPrefixFromBase, toThresholdEcdsaWalletSessionPrefix, toThresholdEd25519PrefixFromBase, toThresholdEd25519WalletSessionPrefix } from "../validation.js";
+import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
+import { failure } from "../../../shared-ts/src/utils/failure.js";
+import { parseEcdsaWalletSessionRecord, parseEd25519WalletSessionRecord, toThresholdEcdsaPrefixFromBase, toThresholdEcdsaWalletSessionPrefix, toThresholdEd25519PrefixFromBase, toThresholdEd25519WalletSessionPrefix } from "../validation.js";
 import { RedisTcpClient, UpstashRedisRestClient, redisGetJson, redisSetJson } from "../kv.js";
+import { EXPORT_REPLAY_GUARD_CLOCK_SKEW_MS, EXPORT_REPLAY_GUARD_MIN_RETENTION_MS } from "./exportReplayGuard.js";
 import { createCloudflareDurableObjectThresholdEcdsaStores, createCloudflareDurableObjectThresholdEd25519Stores } from "./CloudflareDurableObjectStore.js";
 import { readNonDurableObjectThresholdStoreKind } from "./StoreConfig.js";
 //#region src/core/ThresholdService/stores/WalletSessionStore.ts
-const EXPORT_REPLAY_GUARD_CLOCK_SKEW_MS = 5 * 6e4;
-const EXPORT_REPLAY_GUARD_MIN_RETENTION_MS = 1440 * 6e4;
+/** A wallet session store's keys: record, use counter, consume-once markers, replay guards. */
+var WalletSessionKeys = class {
+	constructor(keyPrefix) {
+		this.prefix = toThresholdEd25519WalletSessionPrefix(keyPrefix);
+	}
+	meta(id) {
+		return `${this.prefix}${id}`;
+	}
+	uses(id) {
+		return `${this.prefix}${id}:uses`;
+	}
+	consumeOnce(id, idempotencyKey) {
+		return `${this.uses(id)}:once:${normalizeConsumeOnceKey(idempotencyKey)}`;
+	}
+	replayGuard(scopeId, replayKey) {
+		return `${this.prefix}replay:${normalizeConsumeOnceKey(scopeId)}:${normalizeConsumeOnceKey(replayKey)}`;
+	}
+};
 var InMemoryWalletSessionStore = class {
 	constructor(input) {
 		this.map = /* @__PURE__ */ new Map();
 		this.replayGuards = /* @__PURE__ */ new Map();
-		this.keyPrefix = toThresholdEd25519WalletSessionPrefix(input.keyPrefix);
-	}
-	key(id) {
-		return `${this.keyPrefix}${id}`;
+		this.keys = new WalletSessionKeys(input.keyPrefix);
 	}
-	replayGuardKey(scopeId, replayKey) {
-		return `${this.keyPrefix}replay:${normalizeConsumeOnceKey(scopeId)}:${normalizeConsumeOnceKey(replayKey)}`;
+	/** The session's entry, or why it cannot be used: missing, or expired (and dropped). */
+	liveEntry(id) {
+		const key = this.keys.meta(id);
+		const entry = this.map.get(key);
+		if (!entry) return failure("wallet_session_missing", "Wallet Session is missing");
+		if (entry.expiresAtMs <= Date.now()) {
+			this.map.delete(key);
+			return failure("wallet_session_expired", "Wallet Session expired");
+		}
+		return entry;
 	}
 	async putSession(id, record, opts) {
-		const key = this.key(id);
+		const key = this.keys.meta(id);
 		const ttlMs = Math.max(0, Number(opts.ttlMs) || 0);
 		const expiresAtMs = Date.now() + ttlMs;
 		this.map.set(key, {
@@ -31,7 +54,7 @@ var InMemoryWalletSessionStore = class {
 		});
 	}
 	async getSession(id) {
-		const key = this.key(id);
+		const key = this.keys.meta(id);
 		const entry = this.map.get(key);
 		if (!entry) return null;
 		if (entry.expiresAtMs <= Date.now()) {
@@ -41,7 +64,7 @@ var InMemoryWalletSessionStore = class {
 		return entry.record;
 	}
 	async getSessionStatus(id) {
-		const key = this.key(id);
+		const key = this.keys.meta(id);
 		const entry = this.map.get(key);
 		if (!entry) return {
 			ok: false,
@@ -64,26 +87,9 @@ var InMemoryWalletSessionStore = class {
 		};
 	}
 	async consumeUseCount(id) {
-		const key = this.key(id);
-		const entry = this.map.get(key);
-		if (!entry) return {
-			ok: false,
-			code: "wallet_session_missing",
-			message: "Wallet Session is missing"
-		};
-		if (entry.expiresAtMs <= Date.now()) {
-			this.map.delete(key);
-			return {
-				ok: false,
-				code: "wallet_session_expired",
-				message: "Wallet Session expired"
-			};
-		}
-		if (entry.remainingUses <= 0) return {
-			ok: false,
-			code: "wallet_budget_exhausted",
-			message: "Wallet Session exhausted"
-		};
+		const entry = this.liveEntry(id);
+		if ("ok" in entry) return entry;
+		if (entry.remainingUses <= 0) return failure("wallet_budget_exhausted", "Wallet Session exhausted");
 		entry.remainingUses -= 1;
 		return {
 			ok: true,
@@ -91,31 +97,14 @@ var InMemoryWalletSessionStore = class {
 		};
 	}
 	async consumeUseCountOnce(id, idempotencyKey) {
-		const key = this.key(id);
-		const entry = this.map.get(key);
-		if (!entry) return {
-			ok: false,
-			code: "wallet_session_missing",
-			message: "Wallet Session is missing"
-		};
-		if (entry.expiresAtMs <= Date.now()) {
-			this.map.delete(key);
-			return {
-				ok: false,
-				code: "wallet_session_expired",
-				message: "Wallet Session expired"
-			};
-		}
+		const entry = this.liveEntry(id);
+		if ("ok" in entry) return entry;
 		const consumeKey = String(idempotencyKey || "").trim();
 		if (consumeKey && entry.consumedIdempotencyKeys.has(consumeKey)) return {
 			ok: true,
 			remainingUses: entry.remainingUses
 		};
-		if (entry.remainingUses <= 0) return {
-			ok: false,
-			code: "wallet_budget_exhausted",
-			message: "Wallet Session exhausted"
-		};
+		if (entry.remainingUses <= 0) return failure("wallet_budget_exhausted", "Wallet Session exhausted");
 		entry.remainingUses -= 1;
 		if (consumeKey) entry.consumedIdempotencyKeys.add(consumeKey);
 		return {
@@ -124,21 +113,8 @@ var InMemoryWalletSessionStore = class {
 		};
 	}
 	async hasConsumedUseCountOnce(id, idempotencyKey) {
-		const key = this.key(id);
-		const entry = this.map.get(key);
-		if (!entry) return {
-			ok: false,
-			code: "wallet_session_missing",
-			message: "Wallet Session is missing"
-		};
-		if (entry.expiresAtMs <= Date.now()) {
-			this.map.delete(key);
-			return {
-				ok: false,
-				code: "wallet_session_expired",
-				message: "Wallet Session expired"
-			};
-		}
+		const entry = this.liveEntry(id);
+		if ("ok" in entry) return entry;
 		const consumeKey = String(idempotencyKey || "").trim();
 		return {
 			ok: true,
@@ -146,7 +122,7 @@ var InMemoryWalletSessionStore = class {
 		};
 	}
 	async reserveReplayGuard(scopeId, replayKey, expiresAtMs) {
-		const key = this.replayGuardKey(scopeId, replayKey);
+		const key = this.keys.replayGuard(scopeId, replayKey);
 		if (!key) return replayGuardInvalid();
 		const nowMs = Date.now();
 		const existingExpiresAtMs = this.replayGuards.get(key);
@@ -158,6 +134,45 @@ var InMemoryWalletSessionStore = class {
 		return { ok: true };
 	}
 };
+/** A backend failure as an `internal` result: the error's message, else `fallback`. */
+function walletSessionStoreFailure(error, fallback) {
+	return failure("internal", String(error && typeof error === "object" && "message" in error ? error.message : error || fallback));
+}
+/**
+* A remote store's session status: the parsed record while it is live, with its remaining uses.
+* A backend failure, or a use count that is not a non-negative integer, reads as unavailable.
+*/
+async function readWalletSessionStatus(input) {
+	try {
+		const record = await input.readRecord();
+		if (!record) return {
+			ok: false,
+			code: "wallet_session_missing"
+		};
+		if (record.expiresAtMs <= Date.now()) return {
+			ok: false,
+			code: "wallet_session_expired"
+		};
+		const remainingUses = Number(await input.readRemainingUses());
+		if (!Number.isSafeInteger(remainingUses) || remainingUses < 0) return {
+			ok: false,
+			code: "wallet_session_unavailable"
+		};
+		return {
+			ok: true,
+			status: {
+				record,
+				expiresAtMs: record.expiresAtMs,
+				remainingUses
+			}
+		};
+	} catch {
+		return {
+			ok: false,
+			code: "wallet_session_unavailable"
+		};
+	}
+}
 function normalizeConsumeOnceKey(value) {
 	return String(value || "").trim().replace(/[^A-Za-z0-9._:-]/g, "_").slice(0, 512);
 }
@@ -169,74 +184,38 @@ function replayGuardTtlMs(expiresAtMs, nowMs = Date.now()) {
 	return Math.max(EXPORT_REPLAY_GUARD_MIN_RETENTION_MS, Math.floor(retainUntilMs - nowMs));
 }
 function replayGuardInvalid() {
-	return {
-		ok: false,
-		code: "invalid_body",
-		message: "Invalid replay guard key"
-	};
+	return failure("invalid_body", "Invalid replay guard key");
 }
 function replayGuardExpired() {
-	return {
-		ok: false,
-		code: "export_authorization_expired",
-		message: "Export authorization expired"
-	};
+	return failure("export_authorization_expired", "Export authorization expired");
 }
 function replayGuardDuplicate() {
-	return {
-		ok: false,
-		code: "export_nonce_replay",
-		message: "Export authorization nonce already used"
-	};
+	return failure("export_nonce_replay", "Export authorization nonce already used");
 }
 function parseRedisReplayGuardResult(raw) {
 	const text = String(raw ?? "").trim();
 	if (text === "ok") return { ok: true };
 	if (text === "duplicate") return replayGuardDuplicate();
 	if (text === "expired") return replayGuardExpired();
-	return {
-		ok: false,
-		code: "internal",
-		message: "Redis replay guard returned invalid response"
-	};
+	return failure("internal", "Redis replay guard returned invalid response");
 }
 function parseRedisConsumeOnceResult(raw) {
 	const text = String(raw ?? "").trim();
 	if (text.startsWith("ok:")) {
 		const remainingUses = Number(text.slice(3));
-		if (!Number.isFinite(remainingUses)) return {
-			ok: false,
-			code: "internal",
-			message: "Redis consume-once returned invalid uses"
-		};
+		if (!Number.isFinite(remainingUses)) return failure("internal", "Redis consume-once returned invalid uses");
 		return {
 			ok: true,
 			remainingUses
 		};
 	}
-	if (text === "wallet_session_missing") return {
-		ok: false,
-		code: "wallet_session_missing",
-		message: "Wallet Session is missing"
-	};
-	if (text === "wallet_budget_exhausted") return {
-		ok: false,
-		code: "wallet_budget_exhausted",
-		message: "Wallet Session signing budget is exhausted"
-	};
-	return {
-		ok: false,
-		code: "internal",
-		message: "Redis consume-once returned invalid response"
-	};
+	if (text === "wallet_session_missing") return failure("wallet_session_missing", "Wallet Session is missing");
+	if (text === "wallet_budget_exhausted") return failure("wallet_budget_exhausted", "Wallet Session signing budget is exhausted");
+	return failure("internal", "Redis consume-once returned invalid response");
 }
 function parseRedisConsumedUseResult(raw) {
 	const value = typeof raw === "number" ? raw : Number(String(raw ?? "").trim());
-	if (!Number.isFinite(value)) return {
-		ok: false,
-		code: "internal",
-		message: "Redis consumed-use check returned invalid response"
-	};
+	if (!Number.isFinite(value)) return failure("internal", "Redis consumed-use check returned invalid response");
 	return {
 		ok: true,
 		consumed: value > 0
@@ -309,81 +288,36 @@ var UpstashRedisRestWalletSessionStore = class {
 			url,
 			token
 		});
-		this.keyPrefix = toThresholdEd25519WalletSessionPrefix(input.keyPrefix);
-		this.parseRecord = input.parseRecord || parseEd25519WalletSessionRecord;
-	}
-	metaKey(id) {
-		return `${this.keyPrefix}${id}`;
-	}
-	usesKey(id) {
-		return `${this.keyPrefix}${id}:uses`;
-	}
-	consumeOnceKey(id, idempotencyKey) {
-		return `${this.usesKey(id)}:once:${normalizeConsumeOnceKey(idempotencyKey)}`;
-	}
-	replayGuardKey(scopeId, replayKey) {
-		return `${this.keyPrefix}replay:${normalizeConsumeOnceKey(scopeId)}:${normalizeConsumeOnceKey(replayKey)}`;
+		this.keys = new WalletSessionKeys(input.keyPrefix);
+		this.parseRecord = input.parseRecord;
 	}
 	async putSession(id, record, opts) {
 		const ttlMs = Math.max(0, Number(opts.ttlMs) || 0);
-		await this.client.setJson(this.metaKey(id), record, ttlMs);
-		await this.client.setRaw(this.usesKey(id), String(Math.max(0, Number(opts.remainingUses) || 0)), ttlMs);
+		await this.client.setJson(this.keys.meta(id), record, ttlMs);
+		await this.client.setRaw(this.keys.uses(id), String(Math.max(0, Number(opts.remainingUses) || 0)), ttlMs);
 	}
 	async getSession(id) {
-		const raw = await this.client.getJson(this.metaKey(id));
+		const raw = await this.client.getJson(this.keys.meta(id));
 		return this.parseRecord(raw);
 	}
 	async getSessionStatus(id) {
-		try {
-			const record = this.parseRecord(await this.client.getJson(this.metaKey(id)));
-			if (!record) return {
-				ok: false,
-				code: "wallet_session_missing"
-			};
-			if (record.expiresAtMs <= Date.now()) return {
-				ok: false,
-				code: "wallet_session_expired"
-			};
-			const remainingUses = Number(await this.client.getRaw(this.usesKey(id)));
-			if (!Number.isSafeInteger(remainingUses) || remainingUses < 0) return {
-				ok: false,
-				code: "wallet_session_unavailable"
-			};
-			return {
-				ok: true,
-				status: {
-					record,
-					expiresAtMs: record.expiresAtMs,
-					remainingUses
-				}
-			};
-		} catch {
-			return {
-				ok: false,
-				code: "wallet_session_unavailable"
-			};
-		}
+		return readWalletSessionStatus({
+			readRecord: async () => this.parseRecord(await this.client.getJson(this.keys.meta(id))),
+			readRemainingUses: () => this.client.getRaw(this.keys.uses(id))
+		});
 	}
 	async consumeUseCount(id) {
 		try {
-			return parseRedisConsumeOnceResult(await this.client.eval(CONSUME_USE_COUNT_LUA, [this.usesKey(id)], []));
+			return parseRedisConsumeOnceResult(await this.client.eval(CONSUME_USE_COUNT_LUA, [this.keys.uses(id)], []));
 		} catch (e) {
-			return {
-				ok: false,
-				code: "internal",
-				message: String(e && typeof e === "object" && "message" in e ? e.message : e || "Failed to consume threshold session")
-			};
+			return walletSessionStoreFailure(e, "Failed to consume threshold session");
 		}
 	}
 	async consumeUseCountOnce(id, idempotencyKey) {
 		try {
-			return parseRedisConsumeOnceResult(await this.client.eval(CONSUME_ONCE_LUA, [this.usesKey(id), this.consumeOnceKey(id, idempotencyKey)], []));
+			return parseRedisConsumeOnceResult(await this.client.eval(CONSUME_ONCE_LUA, [this.keys.uses(id), this.keys.consumeOnce(id, idempotencyKey)], []));
 		} catch (e) {
-			return {
-				ok: false,
-				code: "internal",
-				message: String(e && typeof e === "object" && "message" in e ? e.message : e || "Failed to consume threshold session")
-			};
+			return walletSessionStoreFailure(e, "Failed to consume threshold session");
 		}
 	}
 	async hasConsumedUseCountOnce(id, idempotencyKey) {
@@ -393,26 +327,18 @@ var UpstashRedisRestWalletSessionStore = class {
 			consumed: false
 		};
 		try {
-			return parseRedisConsumedUseResult(await this.client.eval(CONSUME_ONCE_EXISTS_LUA, [this.consumeOnceKey(id, consumeKey)], []));
+			return parseRedisConsumedUseResult(await this.client.eval(CONSUME_ONCE_EXISTS_LUA, [this.keys.consumeOnce(id, consumeKey)], []));
 		} catch (e) {
-			return {
-				ok: false,
-				code: "internal",
-				message: String(e && typeof e === "object" && "message" in e ? e.message : e || "Failed to check consumed threshold session operation")
-			};
+			return walletSessionStoreFailure(e, "Failed to check consumed threshold session operation");
 		}
 	}
 	async reserveReplayGuard(scopeId, replayKey, expiresAtMs) {
 		try {
 			const ttlMs = replayGuardTtlMs(expiresAtMs);
 			if (ttlMs <= 0) return replayGuardExpired();
-			return parseRedisReplayGuardResult(await this.client.eval(REPLAY_GUARD_LUA, [this.replayGuardKey(scopeId, replayKey)], [String(Math.max(1, Math.ceil(ttlMs / 1e3)))]));
+			return parseRedisReplayGuardResult(await this.client.eval(REPLAY_GUARD_LUA, [this.keys.replayGuard(scopeId, replayKey)], [String(Math.max(1, Math.ceil(ttlMs / 1e3)))]));
 		} catch (e) {
-			return {
-				ok: false,
-				code: "internal",
-				message: String(e && typeof e === "object" && "message" in e ? e.message : e || "Failed to reserve replay guard")
-			};
+			return walletSessionStoreFailure(e, "Failed to reserve replay guard");
 		}
 	}
 };
@@ -421,29 +347,17 @@ var RedisTcpWalletSessionStore = class {
 		const url = normalizeOptionalTrimmedString(input.redisUrl);
 		if (!url) throw new Error("redis-tcp wallet session store missing redisUrl");
 		this.client = new RedisTcpClient(url);
-		this.keyPrefix = toThresholdEd25519WalletSessionPrefix(input.keyPrefix);
-		this.parseRecord = input.parseRecord || parseEd25519WalletSessionRecord;
-	}
-	metaKey(id) {
-		return `${this.keyPrefix}${id}`;
-	}
-	usesKey(id) {
-		return `${this.keyPrefix}${id}:uses`;
-	}
-	consumeOnceKey(id, idempotencyKey) {
-		return `${this.usesKey(id)}:once:${normalizeConsumeOnceKey(idempotencyKey)}`;
-	}
-	replayGuardKey(scopeId, replayKey) {
-		return `${this.keyPrefix}replay:${normalizeConsumeOnceKey(scopeId)}:${normalizeConsumeOnceKey(replayKey)}`;
+		this.keys = new WalletSessionKeys(input.keyPrefix);
+		this.parseRecord = input.parseRecord;
 	}
 	async putSession(id, record, opts) {
 		const ttlMs = Math.max(0, Number(opts.ttlMs) || 0);
-		await redisSetJson(this.client, this.metaKey(id), record, ttlMs);
+		await redisSetJson(this.client, this.keys.meta(id), record, ttlMs);
 		const ttlSeconds = Math.max(1, Math.ceil(ttlMs / 1e3));
 		const uses = String(Math.max(0, Number(opts.remainingUses) || 0));
 		const resp = await this.client.send([
 			"SET",
-			this.usesKey(id),
+			this.keys.uses(id),
 			uses,
 			"EX",
 			String(ttlSeconds)
@@ -451,44 +365,17 @@ var RedisTcpWalletSessionStore = class {
 		if (resp.type === "error") throw new Error(`Redis SET error: ${resp.value}`);
 	}
 	async getSession(id) {
-		const raw = await redisGetJson(this.client, this.metaKey(id));
+		const raw = await redisGetJson(this.client, this.keys.meta(id));
 		return this.parseRecord(raw);
 	}
 	async getSessionStatus(id) {
-		try {
-			const record = this.parseRecord(await redisGetJson(this.client, this.metaKey(id)));
-			if (!record) return {
-				ok: false,
-				code: "wallet_session_missing"
-			};
-			if (record.expiresAtMs <= Date.now()) return {
-				ok: false,
-				code: "wallet_session_expired"
-			};
-			const usesResponse = await this.client.send(["GET", this.usesKey(id)]);
-			if (usesResponse.type === "error") return {
-				ok: false,
-				code: "wallet_session_unavailable"
-			};
-			const remainingUses = Number(redisRawValue(usesResponse));
-			if (!Number.isSafeInteger(remainingUses) || remainingUses < 0) return {
-				ok: false,
-				code: "wallet_session_unavailable"
-			};
-			return {
-				ok: true,
-				status: {
-					record,
-					expiresAtMs: record.expiresAtMs,
-					remainingUses
-				}
-			};
-		} catch {
-			return {
-				ok: false,
-				code: "wallet_session_unavailable"
-			};
-		}
+		return readWalletSessionStatus({
+			readRecord: async () => this.parseRecord(await redisGetJson(this.client, this.keys.meta(id))),
+			readRemainingUses: async () => {
+				const usesResponse = await this.client.send(["GET", this.keys.uses(id)]);
+				return usesResponse.type === "error" ? void 0 : redisRawValue(usesResponse);
+			}
+		});
 	}
 	async consumeUseCount(id) {
 		try {
@@ -496,20 +383,12 @@ var RedisTcpWalletSessionStore = class {
 				"EVAL",
 				CONSUME_USE_COUNT_LUA,
 				"1",
-				this.usesKey(id)
+				this.keys.uses(id)
 			]);
-			if (resp.type === "error") return {
-				ok: false,
-				code: "internal",
-				message: `Redis EVAL error: ${resp.value}`
-			};
+			if (resp.type === "error") return failure("internal", `Redis EVAL error: ${resp.value}`);
 			return parseRedisConsumeOnceResult(redisRawValue(resp));
 		} catch (e) {
-			return {
-				ok: false,
-				code: "internal",
-				message: String(e && typeof e === "object" && "message" in e ? e.message : e || "Failed to consume threshold session")
-			};
+			return walletSessionStoreFailure(e, "Failed to consume threshold session");
 		}
 	}
 	async consumeUseCountOnce(id, idempotencyKey) {
@@ -518,21 +397,13 @@ var RedisTcpWalletSessionStore = class {
 				"EVAL",
 				CONSUME_ONCE_LUA,
 				"2",
-				this.usesKey(id),
-				this.consumeOnceKey(id, idempotencyKey)
+				this.keys.uses(id),
+				this.keys.consumeOnce(id, idempotencyKey)
 			]);
-			if (resp.type === "error") return {
-				ok: false,
-				code: "internal",
-				message: `Redis EVAL error: ${resp.value}`
-			};
+			if (resp.type === "error") return failure("internal", `Redis EVAL error: ${resp.value}`);
 			return parseRedisConsumeOnceResult(resp.type === "integer" ? String(resp.value) : resp.value);
 		} catch (e) {
-			return {
-				ok: false,
-				code: "internal",
-				message: String(e && typeof e === "object" && "message" in e ? e.message : e || "Failed to consume threshold session")
-			};
+			return walletSessionStoreFailure(e, "Failed to consume threshold session");
 		}
 	}
 	async hasConsumedUseCountOnce(id, idempotencyKey) {
@@ -542,19 +413,11 @@ var RedisTcpWalletSessionStore = class {
 			consumed: false
 		};
 		try {
-			const resp = await this.client.send(["EXISTS", this.consumeOnceKey(id, consumeKey)]);
-			if (resp.type === "error") return {
-				ok: false,
-				code: "internal",
-				message: `Redis EXISTS error: ${resp.value}`
-			};
+			const resp = await this.client.send(["EXISTS", this.keys.consumeOnce(id, consumeKey)]);
+			if (resp.type === "error") return failure("internal", `Redis EXISTS error: ${resp.value}`);
 			return parseRedisConsumedUseResult(resp.value);
 		} catch (e) {
-			return {
-				ok: false,
-				code: "internal",
-				message: String(e && typeof e === "object" && "message" in e ? e.message : e || "Failed to check consumed threshold session operation")
-			};
+			return walletSessionStoreFailure(e, "Failed to check consumed threshold session operation");
 		}
 	}
 	async reserveReplayGuard(scopeId, replayKey, expiresAtMs) {
@@ -563,158 +426,114 @@ var RedisTcpWalletSessionStore = class {
 			if (ttlMs <= 0) return replayGuardExpired();
 			const resp = await this.client.send([
 				"SET",
-				this.replayGuardKey(scopeId, replayKey),
+				this.keys.replayGuard(scopeId, replayKey),
 				"1",
 				"NX",
 				"EX",
 				String(Math.max(1, Math.ceil(ttlMs / 1e3)))
 			]);
-			if (resp.type === "error") return {
-				ok: false,
-				code: "internal",
-				message: `Redis SET error: ${resp.value}`
-			};
+			if (resp.type === "error") return failure("internal", `Redis SET error: ${resp.value}`);
 			if (resp.type === "bulk" && resp.value === null) return replayGuardDuplicate();
 			if (resp.type === "simple" && resp.value === "OK") return { ok: true };
-			return {
-				ok: false,
-				code: "internal",
-				message: "Redis replay guard returned invalid response"
-			};
+			return failure("internal", "Redis replay guard returned invalid response");
 		} catch (e) {
-			return {
-				ok: false,
-				code: "internal",
-				message: String(e && typeof e === "object" && "message" in e ? e.message : e || "Failed to reserve replay guard")
-			};
+			return walletSessionStoreFailure(e, "Failed to reserve replay guard");
 		}
 	}
 };
-function createEd25519WalletSessionStore(input) {
-	const doStores = createCloudflareDurableObjectThresholdEd25519Stores({
-		config: input.config,
-		logger: input.logger
-	});
-	if (doStores) return doStores.walletSessionStore;
-	const config = isObject(input.config) ? input.config : {};
+/**
+* Selects a wallet session store: Durable Objects, else the config's explicit `kind`, else Upstash
+* or Redis from env-shaped config, else in memory where the runtime allows it.
+*/
+function createWalletSessionStore(input, spec) {
+	const durableObjectStore = spec.durableObjectStore(input);
+	if (durableObjectStore) return durableObjectStore;
+	const { tag, parseRecord } = spec;
+	const config = isPlainObject(input.config) ? input.config : {};
 	const allowInMemory = normalizeOptionalTrimmedString(config.THRESHOLD_ALLOW_IN_MEMORY_STORES) === "1";
 	const requirePersistent = !input.isNode && !allowInMemory;
-	const basePrefix = normalizeOptionalTrimmedString(config.THRESHOLD_PREFIX);
-	const envPrefix = normalizeOptionalTrimmedString(config.THRESHOLD_ED25519_WALLET_SESSION_PREFIX) || toThresholdEd25519PrefixFromBase(basePrefix, "wallet-session") || "";
-	const kind = readNonDurableObjectThresholdStoreKind(config, "threshold-ed25519");
+	const envPrefix = spec.envPrefix(config);
+	const inMemory = () => new InMemoryWalletSessionStore({ keyPrefix: envPrefix || void 0 });
+	const kind = readNonDurableObjectThresholdStoreKind(config, tag);
 	if (kind === "in-memory") {
-		if (requirePersistent) throw new Error("[threshold-ed25519] In-memory wallet session store is not supported in this runtime; configure Upstash/Redis or Durable Objects");
-		return new InMemoryWalletSessionStore({ keyPrefix: envPrefix || void 0 });
+		if (requirePersistent) throw new Error(`[${tag}] In-memory wallet session store is not supported in this runtime; configure Upstash/Redis or Durable Objects`);
+		return inMemory();
 	}
 	if (kind === "upstash-redis-rest") return new UpstashRedisRestWalletSessionStore({
 		url: normalizeOptionalTrimmedString(config.url) || normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_URL),
 		token: normalizeOptionalTrimmedString(config.token) || normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_TOKEN),
 		keyPrefix: normalizeOptionalTrimmedString(config.keyPrefix) || envPrefix,
-		parseRecord: parseEd25519WalletSessionRecord
+		parseRecord
 	});
 	if (kind === "redis-tcp") {
 		if (!input.isNode) {
-			if (requirePersistent) throw new Error("[threshold-ed25519] redis-tcp wallet session store is not supported in this runtime; configure Upstash/Redis REST or Durable Objects");
-			input.logger.warn("[threshold-ed25519] redis-tcp wallet session store is not supported in this runtime; falling back to in-memory");
-			return new InMemoryWalletSessionStore({ keyPrefix: envPrefix || void 0 });
+			if (requirePersistent) throw new Error(`[${tag}] redis-tcp wallet session store is not supported in this runtime; configure Upstash/Redis REST or Durable Objects`);
+			input.logger.warn(`[${tag}] redis-tcp wallet session store is not supported in this runtime; falling back to in-memory`);
+			return inMemory();
 		}
 		return new RedisTcpWalletSessionStore({
 			redisUrl: normalizeOptionalTrimmedString(config.redisUrl) || normalizeOptionalTrimmedString(config.REDIS_URL),
 			keyPrefix: normalizeOptionalTrimmedString(config.keyPrefix) || envPrefix,
-			parseRecord: parseEd25519WalletSessionRecord
+			parseRecord
 		});
 	}
 	const upstashUrl = normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_URL);
 	const upstashToken = normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_TOKEN);
 	if (upstashUrl || upstashToken) {
 		if (!upstashUrl || !upstashToken) throw new Error("Upstash wallet session store enabled but UPSTASH_REDIS_REST_URL / UPSTASH_REDIS_REST_TOKEN are not both set");
-		input.logger.info("[threshold-ed25519] Using Upstash REST store for Wallet Session records");
+		input.logger.info(`[${tag}] Using Upstash REST store for Wallet Session records`);
 		return new UpstashRedisRestWalletSessionStore({
 			url: upstashUrl,
 			token: upstashToken,
-			keyPrefix: envPrefix || void 0
+			keyPrefix: envPrefix || void 0,
+			parseRecord
 		});
 	}
 	const redisUrl = normalizeOptionalTrimmedString(config.REDIS_URL);
 	if (redisUrl) {
 		if (!input.isNode) {
-			if (requirePersistent) throw new Error("[threshold-ed25519] REDIS_URL is set but TCP Redis is not supported in this runtime; use Upstash/Redis REST or Durable Objects");
-			input.logger.warn("[threshold-ed25519] REDIS_URL is set but TCP Redis is not supported in this runtime; falling back to in-memory");
-			return new InMemoryWalletSessionStore({ keyPrefix: envPrefix || void 0 });
+			if (requirePersistent) throw new Error(`[${tag}] REDIS_URL is set but TCP Redis is not supported in this runtime; use Upstash/Redis REST or Durable Objects`);
+			input.logger.warn(`[${tag}] REDIS_URL is set but TCP Redis is not supported in this runtime; falling back to in-memory`);
+			return inMemory();
 		}
-		input.logger.info("[threshold-ed25519] Using redis-tcp store for Wallet Session records");
+		input.logger.info(`[${tag}] Using redis-tcp store for Wallet Session records`);
 		return new RedisTcpWalletSessionStore({
 			redisUrl,
-			keyPrefix: envPrefix || void 0
+			keyPrefix: envPrefix || void 0,
+			parseRecord
 		});
 	}
-	if (requirePersistent) throw new Error("[threshold-ed25519] Wallet Session records require persistent storage in this runtime; configure UPSTASH_REDIS_REST_URL/UPSTASH_REDIS_REST_TOKEN or Durable Objects");
-	input.logger.info("[threshold-ed25519] Using in-memory Wallet Session store (non-persistent)");
-	return new InMemoryWalletSessionStore({ keyPrefix: envPrefix || void 0 });
+	if (requirePersistent) throw new Error(`[${tag}] Wallet Session records require persistent storage in this runtime; configure UPSTASH_REDIS_REST_URL/UPSTASH_REDIS_REST_TOKEN or Durable Objects`);
+	input.logger.info(`[${tag}] Using in-memory Wallet Session store (non-persistent)`);
+	return inMemory();
 }
-function createEcdsaWalletSessionStore(input) {
-	const doStores = createCloudflareDurableObjectThresholdEcdsaStores({
-		config: input.config,
-		logger: input.logger
+function createEd25519WalletSessionStore(input) {
+	return createWalletSessionStore(input, {
+		tag: "threshold-ed25519",
+		durableObjectStore: ({ config, logger }) => createCloudflareDurableObjectThresholdEd25519Stores({
+			config,
+			logger
+		})?.walletSessionStore ?? null,
+		envPrefix: (config) => {
+			const basePrefix = normalizeOptionalTrimmedString(config.THRESHOLD_PREFIX);
+			return normalizeOptionalTrimmedString(config.THRESHOLD_ED25519_WALLET_SESSION_PREFIX) || toThresholdEd25519PrefixFromBase(basePrefix, "wallet-session") || "";
+		},
+		parseRecord: parseEd25519WalletSessionRecord
 	});
-	if (doStores) return doStores.walletSessionStore;
-	const config = isObject(input.config) ? input.config : {};
-	const allowInMemory = normalizeOptionalTrimmedString(config.THRESHOLD_ALLOW_IN_MEMORY_STORES) === "1";
-	const requirePersistent = !input.isNode && !allowInMemory;
-	const basePrefix = normalizeOptionalTrimmedString(config.THRESHOLD_PREFIX);
-	const envPrefix = toThresholdEcdsaWalletSessionPrefix(normalizeOptionalTrimmedString(config.THRESHOLD_ECDSA_WALLET_SESSION_PREFIX) || toThresholdEcdsaPrefixFromBase(basePrefix, "wallet-session"));
-	const kind = readNonDurableObjectThresholdStoreKind(config, "threshold-ecdsa");
-	if (kind === "in-memory") {
-		if (requirePersistent) throw new Error("[threshold-ecdsa] In-memory wallet session store is not supported in this runtime; configure Upstash/Redis or Durable Objects");
-		return new InMemoryWalletSessionStore({ keyPrefix: envPrefix });
-	}
-	if (kind === "upstash-redis-rest") return new UpstashRedisRestWalletSessionStore({
-		url: normalizeOptionalTrimmedString(config.url) || normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_URL),
-		token: normalizeOptionalTrimmedString(config.token) || normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_TOKEN),
-		keyPrefix: normalizeOptionalTrimmedString(config.keyPrefix) || envPrefix,
+}
+function createEcdsaWalletSessionStore(input) {
+	return createWalletSessionStore(input, {
+		tag: "threshold-ecdsa",
+		durableObjectStore: ({ config, logger }) => createCloudflareDurableObjectThresholdEcdsaStores({
+			config,
+			logger
+		})?.walletSessionStore ?? null,
+		envPrefix: (config) => {
+			const basePrefix = normalizeOptionalTrimmedString(config.THRESHOLD_PREFIX);
+			return toThresholdEcdsaWalletSessionPrefix(normalizeOptionalTrimmedString(config.THRESHOLD_ECDSA_WALLET_SESSION_PREFIX) || toThresholdEcdsaPrefixFromBase(basePrefix, "wallet-session"));
+		},
 		parseRecord: parseEcdsaWalletSessionRecord
 	});
-	if (kind === "redis-tcp") {
-		if (!input.isNode) {
-			if (requirePersistent) throw new Error("[threshold-ecdsa] redis-tcp wallet session store is not supported in this runtime; configure Upstash/Redis REST or Durable Objects");
-			input.logger.warn("[threshold-ecdsa] redis-tcp wallet session store is not supported in this runtime; falling back to in-memory");
-			return new InMemoryWalletSessionStore({ keyPrefix: envPrefix });
-		}
-		return new RedisTcpWalletSessionStore({
-			redisUrl: normalizeOptionalTrimmedString(config.redisUrl) || normalizeOptionalTrimmedString(config.REDIS_URL),
-			keyPrefix: normalizeOptionalTrimmedString(config.keyPrefix) || envPrefix,
-			parseRecord: parseEcdsaWalletSessionRecord
-		});
-	}
-	const upstashUrl = normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_URL);
-	const upstashToken = normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_TOKEN);
-	if (upstashUrl || upstashToken) {
-		if (!upstashUrl || !upstashToken) throw new Error("Upstash wallet session store enabled but UPSTASH_REDIS_REST_URL / UPSTASH_REDIS_REST_TOKEN are not both set");
-		input.logger.info("[threshold-ecdsa] Using Upstash REST store for Wallet Session records");
-		return new UpstashRedisRestWalletSessionStore({
-			url: upstashUrl,
-			token: upstashToken,
-			keyPrefix: envPrefix,
-			parseRecord: parseEcdsaWalletSessionRecord
-		});
-	}
-	const redisUrl = normalizeOptionalTrimmedString(config.REDIS_URL);
-	if (redisUrl) {
-		if (!input.isNode) {
-			if (requirePersistent) throw new Error("[threshold-ecdsa] REDIS_URL is set but TCP Redis is not supported in this runtime; use Upstash/Redis REST or Durable Objects");
-			input.logger.warn("[threshold-ecdsa] REDIS_URL is set but TCP Redis is not supported in this runtime; falling back to in-memory");
-			return new InMemoryWalletSessionStore({ keyPrefix: envPrefix });
-		}
-		input.logger.info("[threshold-ecdsa] Using redis-tcp store for Wallet Session records");
-		return new RedisTcpWalletSessionStore({
-			redisUrl,
-			keyPrefix: envPrefix,
-			parseRecord: parseEcdsaWalletSessionRecord
-		});
-	}
-	if (requirePersistent) throw new Error("[threshold-ecdsa] Wallet Session records require persistent storage in this runtime; configure UPSTASH_REDIS_REST_URL/UPSTASH_REDIS_REST_TOKEN or Durable Objects");
-	input.logger.info("[threshold-ecdsa] Using in-memory Wallet Session store (non-persistent)");
-	return new InMemoryWalletSessionStore({ keyPrefix: envPrefix });
 }
 //#endregion
 export { createEcdsaWalletSessionStore, createEd25519WalletSessionStore };