@seams/wallet-server 0.6.2 → 0.7.3

package/dist/esm/core/ThresholdService/stores/exportReplayGuard.js

@@ -0,0 +1,7 @@
+//#region src/core/ThresholdService/stores/exportReplayGuard.ts
+const EXPORT_REPLAY_GUARD_CLOCK_SKEW_MS = 5 * 6e4;
+const EXPORT_REPLAY_GUARD_MIN_RETENTION_MS = 1440 * 6e4;
+//#endregion
+export { EXPORT_REPLAY_GUARD_CLOCK_SKEW_MS, EXPORT_REPLAY_GUARD_MIN_RETENTION_MS };
+
+//# sourceMappingURL=exportReplayGuard.js.map

package/dist/esm/core/ThresholdService/validation.js

@@ -1,31 +1,16 @@
 import { parseWebAuthnRpId } from "../../shared-ts/src/utils/domainIds.js";
 import { base64UrlDecode } from "../../shared-ts/src/utils/base64.js";
 import "../../shared-ts/src/utils/encoders.js";
-import { ensureEd25519Prefix } from "../../shared-ts/src/utils/near.js";
-import { parseEvmFamilySigningKeySlotIdOrNull } from "../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
-import { ECDSA_DERIVATION_ROLE_LOCAL_FIRST_BOOTSTRAP_ROOT_PROOF_VERSION } from "../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { normalizeOptionalString, normalizeTrimmedString } from "../../shared-ts/src/utils/normalize.js";
-import "../../shared-ts/src/utils/validation.js";
-import { normalizeRuntimePolicyScope } from "../../shared-ts/src/threshold/signingRootScope.js";
+import { ensureEd25519Prefix } from "../../shared-ts/src/utils/near.js";
+import { isPlainObject } from "../../shared-ts/src/utils/validation.js";
 import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority } from "../../shared-ts/src/utils/walletAuthAuthority.js";
 import { THRESHOLD_ED25519_2P_PARTICIPANT_IDS, normalizeThresholdEd25519ParticipantIds } from "../../shared-ts/src/threshold/participants.js";
-import { parseEcdsaKeyHandle } from "../keyMaterialBrands.js";
-import { registrationPreparationIdFromString } from "../types.js";
-import "../../shared-ts/src/signing-lanes/index.js";
-import "../../shared-ts/src/threshold/sessionPolicy.js";
+import { parseEcdsaKeyHandle } from "../../shared-ts/src/threshold/keyMaterialBrands.js";
 //#region src/core/ThresholdService/validation.ts
-function isObject(v) {
-	return !!v && typeof v === "object" && !Array.isArray(v);
-}
 function isValidNumber(v) {
 	return typeof v === "number" && Number.isFinite(v);
 }
-function isNonNegativeInteger(v) {
-	return typeof v === "number" && Number.isSafeInteger(v) && v >= 0;
-}
-function isPositiveIntegerAtMost(value, maximum) {
-	return typeof value === "number" && Number.isSafeInteger(value) && value > 0 && value <= maximum;
-}
 function decodeFixedB64u(value, expectedLength) {
 	try {
 		const decoded = base64UrlDecode(value);
@@ -35,11 +20,6 @@ function decodeFixedB64u(value, expectedLength) {
 		return null;
 	}
 }
-function parseB64uFixed(value, expectedLength) {
-	const text = normalizeOptionalString(value);
-	if (!text) return null;
-	return decodeFixedB64u(text, expectedLength) ? text : null;
-}
 function parseSec1CompressedPublicKey33B64u(value) {
 	const text = normalizeOptionalString(value);
 	if (!text) return null;
@@ -49,75 +29,6 @@ function parseSec1CompressedPublicKey33B64u(value) {
 	if (prefix !== 2 && prefix !== 3) return null;
 	return text;
 }
-function parseEcdsaDerivationClientRootProof(value) {
-	if (!isObject(value)) return null;
-	if (normalizeOptionalString(value.version) !== "ecdsa-derivation:role-local:first-bootstrap-root-proof:v2") return null;
-	const clientRootPublicKey33B64u = parseSec1CompressedPublicKey33B64u(value.clientRootPublicKey33B64u);
-	const digest32B64u = parseB64uFixed(value.digest32B64u, 32);
-	const signature65B64u = parseB64uFixed(value.signature65B64u, 65);
-	if (!clientRootPublicKey33B64u || !digest32B64u || !signature65B64u) return null;
-	return {
-		version: ECDSA_DERIVATION_ROLE_LOCAL_FIRST_BOOTSTRAP_ROOT_PROOF_VERSION,
-		clientRootPublicKey33B64u,
-		digest32B64u,
-		signature65B64u
-	};
-}
-function parseWebAuthnAuthenticationCredential(value) {
-	if (!isObject(value)) return null;
-	const id = normalizeOptionalString(value.id);
-	const rawId = normalizeOptionalString(value.rawId);
-	const type = normalizeOptionalString(value.type);
-	const authenticatorAttachment = value.authenticatorAttachment === void 0 || value.authenticatorAttachment === null ? null : normalizeOptionalString(value.authenticatorAttachment);
-	if (!id || !rawId || !type) return null;
-	if (value.authenticatorAttachment !== void 0 && value.authenticatorAttachment !== null) {
-		if (!authenticatorAttachment) return null;
-	}
-	if (!isObject(value.response)) return null;
-	const clientDataJSON = normalizeOptionalString(value.response.clientDataJSON);
-	const authenticatorData = normalizeOptionalString(value.response.authenticatorData);
-	const signature = normalizeOptionalString(value.response.signature);
-	const userHandle = value.response.userHandle === void 0 || value.response.userHandle === null ? null : normalizeOptionalString(value.response.userHandle);
-	if (!clientDataJSON || !authenticatorData || !signature) return null;
-	if (value.response.userHandle !== void 0 && value.response.userHandle !== null && !userHandle) return null;
-	return {
-		id,
-		rawId,
-		type,
-		authenticatorAttachment,
-		response: {
-			clientDataJSON,
-			authenticatorData,
-			signature,
-			userHandle
-		},
-		clientExtensionResults: value.clientExtensionResults ?? null
-	};
-}
-function parseEcdsaDerivationPasskeyBootstrapAuthorization(value) {
-	if (!isObject(value)) return null;
-	if (normalizeOptionalString(value.kind) !== "passkey_bootstrap") return null;
-	const rpId = normalizeOptionalString(value.rpId);
-	const webauthnAuthentication = parseWebAuthnAuthenticationCredential(value.webauthn_authentication);
-	let runtimePolicyScope;
-	if (value.runtimePolicyScope !== void 0) try {
-		runtimePolicyScope = normalizeRuntimePolicyScope(value.runtimePolicyScope);
-	} catch {
-		return null;
-	}
-	const projectEnvironmentId = normalizeOptionalString(value.projectEnvironmentId);
-	if (!rpId || !webauthnAuthentication) return null;
-	return {
-		kind: "passkey_bootstrap",
-		rpId,
-		webauthn_authentication: webauthnAuthentication,
-		...runtimePolicyScope ? { runtimePolicyScope } : {},
-		...projectEnvironmentId ? { projectEnvironmentId } : {}
-	};
-}
-function hasForbiddenFields(raw, fields) {
-	return fields.some((field) => raw[field] !== void 0);
-}
 function hasThresholdEcdsaSigningRootMetadata(raw) {
 	return raw.signingRootId !== void 0 || raw.signingRootVersion !== void 0 || raw.walletKeyVersion !== void 0 || raw.derivationVersion !== void 0;
 }
@@ -169,18 +80,12 @@ function toThresholdEd25519PrefixFromBase(basePrefix, kind) {
 function canonicalThresholdEd25519RelayerKeyId(relayerKeyId) {
 	return ensureEd25519Prefix(normalizeOptionalString(relayerKeyId));
 }
-function toThresholdEcdsaKeyPrefix(prefix) {
-	return toPrefixWithColon(prefix, "w3a:threshold-ecdsa:key:");
-}
 function toThresholdEcdsaSessionPrefix(prefix) {
 	return toPrefixWithColon(prefix, "w3a:threshold-ecdsa:sess:");
 }
 function toThresholdEcdsaWalletSessionPrefix(prefix) {
 	return toPrefixWithColon(prefix, "w3a:threshold-ecdsa:wallet-session:");
 }
-function toThresholdEcdsaPresignPrefix(prefix) {
-	return toPrefixWithColon(prefix, "w3a:threshold-ecdsa:presign:");
-}
 function toThresholdEcdsaPrefixFromBase(basePrefix, kind) {
 	const base = normalizeOptionalString(basePrefix);
 	if (!base) return "";
@@ -189,7 +94,7 @@ function toThresholdEcdsaPrefixFromBase(basePrefix, kind) {
 	return `${trimmed.endsWith(":") ? trimmed : `${trimmed}:`}threshold-ecdsa:${kind}:`;
 }
 function parseThresholdEd25519RouterMaterial(raw) {
-	if (!isObject(raw.routerMaterial)) return null;
+	if (!isPlainObject(raw.routerMaterial)) return null;
 	const signingShareB64u = normalizeOptionalString(raw.routerMaterial.signingShareB64u);
 	const verifyingShareB64u = normalizeOptionalString(raw.routerMaterial.verifyingShareB64u);
 	if (!signingShareB64u || !verifyingShareB64u) return null;
@@ -199,7 +104,7 @@ function parseThresholdEd25519RouterMaterial(raw) {
 	};
 }
 function parseThresholdEd25519ReadyKeyRecord(raw) {
-	if (!isObject(raw)) return null;
+	if (!isPlainObject(raw)) return null;
 	const kind = normalizeOptionalString(raw.kind);
 	const walletId = normalizeOptionalString(raw.walletId);
 	const nearAccountId = normalizeOptionalString(raw.nearAccountId);
@@ -225,43 +130,8 @@ function parseThresholdEd25519ReadyKeyRecord(raw) {
 function parseThresholdEd25519KeyRecord(raw) {
 	return parseThresholdEd25519ReadyKeyRecord(raw);
 }
-const ECDSA_DERIVATION_BOOTSTRAP_FORBIDDEN_FIELDS = [
-	...[
-		"subjectId",
-		"walletSessionUserId",
-		"walletKeyId",
-		"subject_id",
-		"wallet_session_user_id",
-		"wallet_id",
-		"wallet_key_id",
-		"ecdsa_threshold_key_id",
-		"signing_root_id",
-		"signing_root_version",
-		"keyPurpose",
-		"key_purpose",
-		"keyVersion",
-		"key_version"
-	],
-	"rpId",
-	"rp_id",
-	"chainTarget",
-	"yClient32Le",
-	"yClient32LeB64u",
-	"clientRootShare32B64u",
-	"clientShare32B64u",
-	"xClient32",
-	"xClient32B64u",
-	"yRelayer32Le",
-	"yRelayer32LeB64u",
-	"xRelayer32",
-	"xRelayer32B64u",
-	"relayerShare32B64u",
-	"serverExportShare32B64u",
-	"canonicalPrivateKeyHex",
-	"privateKeyHex"
-];
 function parseEcdsaDerivationPublicIdentity(raw) {
-	if (!isObject(raw)) return null;
+	if (!isPlainObject(raw)) return null;
 	const derivationClientSharePublicKey33B64u = parseSec1CompressedPublicKey33B64u(raw.derivationClientSharePublicKey33B64u);
 	const relayerPublicKey33B64u = parseSec1CompressedPublicKey33B64u(raw.relayerPublicKey33B64u);
 	const groupPublicKey33B64u = parseSec1CompressedPublicKey33B64u(raw.groupPublicKey33B64u);
@@ -274,63 +144,8 @@ function parseEcdsaDerivationPublicIdentity(raw) {
 		ethereumAddress
 	};
 }
-function parseEcdsaDerivationClientBootstrapRequest(raw) {
-	if (!isObject(raw)) return null;
-	if (hasForbiddenFields(raw, ECDSA_DERIVATION_BOOTSTRAP_FORBIDDEN_FIELDS)) return null;
-	if (normalizeOptionalString(raw.formatVersion) !== "ecdsa-derivation-role-local") return null;
-	if (normalizeOptionalString(raw.keyScope) !== "evm-family") return null;
-	const walletId = normalizeOptionalString(raw.walletId);
-	const evmFamilySigningKeySlotId = parseEvmFamilySigningKeySlotIdOrNull(raw.evmFamilySigningKeySlotId);
-	const ecdsaThresholdKeyId = normalizeOptionalString(raw.ecdsaThresholdKeyId);
-	const signingRootId = normalizeOptionalString(raw.signingRootId);
-	const signingRootVersion = normalizeOptionalString(raw.signingRootVersion);
-	const relayerKeyId = normalizeOptionalString(raw.relayerKeyId);
-	const registrationPreparationIdRaw = normalizeOptionalString(raw.registrationPreparationId);
-	const derivationClientSharePublicKey33B64u = parseSec1CompressedPublicKey33B64u(raw.derivationClientSharePublicKey33B64u);
-	const contextBinding32B64u = parseB64uFixed(raw.contextBinding32B64u, 32);
-	const requestId = normalizeOptionalString(raw.requestId);
-	const sessionId = normalizeOptionalString(raw.sessionId);
-	const clientShareRetryCounter = raw.clientShareRetryCounter;
-	const ttlMs = raw.ttlMs;
-	const remainingUses = raw.remainingUses;
-	const participantIds = normalizeThresholdEd25519ParticipantIds(raw.participantIds);
-	const runtimePolicyScopeRaw = raw.runtimePolicyScope;
-	const runtimePolicyScope = runtimePolicyScopeRaw === void 0 ? null : parseRuntimePolicyScope(runtimePolicyScopeRaw);
-	const clientRootProof = raw.clientRootProof === void 0 ? null : parseEcdsaDerivationClientRootProof(raw.clientRootProof);
-	const passkeyBootstrapAuthorization = raw.passkeyBootstrapAuthorization === void 0 ? null : parseEcdsaDerivationPasskeyBootstrapAuthorization(raw.passkeyBootstrapAuthorization);
-	if (!walletId || !evmFamilySigningKeySlotId || !ecdsaThresholdKeyId || !signingRootId || !signingRootVersion || !relayerKeyId || !derivationClientSharePublicKey33B64u || !contextBinding32B64u || !requestId || !sessionId || !isNonNegativeInteger(clientShareRetryCounter) || !isPositiveIntegerAtMost(ttlMs, 2592e6) || !isPositiveIntegerAtMost(remainingUses, 1e6) || !participantIds || runtimePolicyScopeRaw !== void 0 && !runtimePolicyScope || raw.clientRootProof !== void 0 && !clientRootProof || raw.passkeyBootstrapAuthorization !== void 0 && !passkeyBootstrapAuthorization || [raw.clientRootProof, raw.passkeyBootstrapAuthorization].filter((value) => value !== void 0).length > 1) return null;
-	const base = {
-		formatVersion: "ecdsa-derivation-role-local",
-		walletId,
-		evmFamilySigningKeySlotId,
-		ecdsaThresholdKeyId,
-		signingRootId,
-		signingRootVersion,
-		keyScope: "evm-family",
-		relayerKeyId,
-		...registrationPreparationIdRaw ? { registrationPreparationId: registrationPreparationIdFromString(registrationPreparationIdRaw) } : {},
-		derivationClientSharePublicKey33B64u,
-		clientShareRetryCounter,
-		contextBinding32B64u,
-		requestId,
-		sessionId,
-		ttlMs,
-		remainingUses,
-		participantIds,
-		...runtimePolicyScope ? { runtimePolicyScope } : {}
-	};
-	if (clientRootProof) return {
-		...base,
-		clientRootProof
-	};
-	if (passkeyBootstrapAuthorization) return {
-		...base,
-		passkeyBootstrapAuthorization
-	};
-	return base;
-}
 function parseThresholdEd25519Commitments(raw) {
-	if (!isObject(raw)) return null;
+	if (!isPlainObject(raw)) return null;
 	const hiding = normalizeOptionalString(raw.hiding);
 	const binding = normalizeOptionalString(raw.binding);
 	if (!hiding || !binding) return null;
@@ -340,7 +155,7 @@ function parseThresholdEd25519Commitments(raw) {
 	};
 }
 function parseThresholdEd25519CommitmentsById(raw) {
-	if (!isObject(raw)) return null;
+	if (!isPlainObject(raw)) return null;
 	const out = {};
 	for (const [k, v] of Object.entries(raw)) {
 		const key = normalizeTrimmedString(k);
@@ -352,7 +167,7 @@ function parseThresholdEd25519CommitmentsById(raw) {
 	return Object.keys(out).length ? out : null;
 }
 function parseThresholdEd25519AuthorityScope(raw) {
-	if (!isObject(raw)) return null;
+	if (!isPlainObject(raw)) return null;
 	const kind = normalizeOptionalString(raw.kind);
 	switch (kind) {
 		case "passkey_rp": {
@@ -398,7 +213,7 @@ function thresholdEd25519AuthorityScopesMatch(left, right) {
 	return false;
 }
 function parseThresholdEd25519MpcSessionRecord(raw) {
-	if (!isObject(raw)) return null;
+	if (!isPlainObject(raw)) return null;
 	const expiresAtMs = raw.expiresAtMs;
 	const ecdsaThresholdKeyId = normalizeOptionalString(raw.ecdsaThresholdKeyId);
 	const keyHandle = normalizeOptionalString(raw.keyHandle);
@@ -431,7 +246,7 @@ function parseThresholdEd25519MpcSessionRecord(raw) {
 	};
 }
 function parseThresholdEcdsaMpcSessionRecord(raw) {
-	if (!isObject(raw)) return null;
+	if (!isPlainObject(raw)) return null;
 	const expiresAtMs = raw.expiresAtMs;
 	const ecdsaThresholdKeyId = normalizeOptionalString(raw.ecdsaThresholdKeyId);
 	const keyHandle = normalizeOptionalString(raw.keyHandle);
@@ -461,7 +276,7 @@ function parseThresholdEcdsaMpcSessionRecord(raw) {
 	};
 }
 function parseThresholdEd25519SigningSessionRecord(raw) {
-	if (!isObject(raw)) return null;
+	if (!isPlainObject(raw)) return null;
 	const expiresAtMs = raw.expiresAtMs;
 	const mpcSessionId = normalizeOptionalString(raw.mpcSessionId);
 	const relayerKeyId = normalizeOptionalString(raw.relayerKeyId);
@@ -489,7 +304,7 @@ function parseThresholdEd25519SigningSessionRecord(raw) {
 	};
 }
 function parseThresholdEd25519SigningShareMaterial(raw) {
-	if (isObject(raw.signingShare)) {
+	if (isPlainObject(raw.signingShare)) {
 		const kind = normalizeOptionalString(raw.signingShare.kind);
 		if (kind === "key_store") return normalizeOptionalString(raw.signingShare.relayerSigningShareB64u) ? null : { kind };
 		if (kind === "embedded_cosigner_share") {
@@ -508,7 +323,7 @@ function parseThresholdEd25519SigningShareMaterial(raw) {
 	} : { kind: "key_store" };
 }
 function parseThresholdEd25519StringById(raw) {
-	if (!isObject(raw)) return null;
+	if (!isPlainObject(raw)) return null;
 	const out = {};
 	for (const [k, v] of Object.entries(raw)) {
 		const key = normalizeTrimmedString(k);
@@ -519,7 +334,7 @@ function parseThresholdEd25519StringById(raw) {
 	return Object.keys(out).length ? out : null;
 }
 function parseThresholdEd25519CoordinatorSigningSessionRecord(raw) {
-	if (!isObject(raw)) return null;
+	if (!isPlainObject(raw)) return null;
 	const expiresAtMs = raw.expiresAtMs;
 	const mpcSessionId = normalizeOptionalString(raw.mpcSessionId);
 	const relayerKeyId = normalizeOptionalString(raw.relayerKeyId);
@@ -556,7 +371,7 @@ function parseThresholdEd25519CoordinatorSigningSessionRecord(raw) {
 	};
 }
 function parseEd25519WalletSessionRecord(raw) {
-	if (!isObject(raw)) return null;
+	if (!isPlainObject(raw)) return null;
 	const expiresAtMs = raw.expiresAtMs;
 	const relayerKeyId = normalizeOptionalString(raw.relayerKeyId);
 	const userId = normalizeOptionalString(raw.userId);
@@ -583,7 +398,7 @@ function parseEd25519WalletSessionRecord(raw) {
 	};
 }
 function parseEcdsaWalletSessionRecord(raw) {
-	if (!isObject(raw)) return null;
+	if (!isPlainObject(raw)) return null;
 	if ("evmFamilySigningKeySlotId" in raw) return null;
 	const expiresAtMs = raw.expiresAtMs;
 	const relayerKeyId = normalizeOptionalString(raw.relayerKeyId);
@@ -612,34 +427,7 @@ function parseEcdsaWalletSessionRecord(raw) {
 		...signingRootMetadata.value
 	};
 }
-function parseRuntimePolicyScope(raw) {
-	try {
-		return normalizeRuntimePolicyScope(raw);
-	} catch {
-		return null;
-	}
-}
-function normalizeByteArray32(input) {
-	if (input instanceof Uint8Array) return input.length === 32 ? input : null;
-	if (!Array.isArray(input) || input.length !== 32) return null;
-	const out = new Uint8Array(32);
-	for (let i = 0; i < 32; i++) {
-		const v = Number(input[i]);
-		if (!Number.isFinite(v) || v < 0 || v > 255) return null;
-		out[i] = v;
-	}
-	return out;
-}
-function toNearPublicKeyStr(v) {
-	return ensureEd25519Prefix(normalizeOptionalString(v));
-}
-function extractAuthorizeSigningPublicKey(purpose, signingPayload) {
-	if (!isObject(signingPayload)) return "";
-	if (purpose === "near_tx") return toNearPublicKeyStr((isObject(signingPayload.transactionContext) ? signingPayload.transactionContext : null)?.nearPublicKeyStr);
-	if (purpose === "nep461_delegate") return toNearPublicKeyStr((isObject(signingPayload.delegate) ? signingPayload.delegate : null)?.publicKey);
-	return "";
-}
 //#endregion
-export { canonicalThresholdEd25519RelayerKeyId, extractAuthorizeSigningPublicKey, isObject, isValidNumber, normalizeByteArray32, parseEcdsaDerivationClientBootstrapRequest, parseEcdsaDerivationPublicIdentity, parseEcdsaWalletSessionRecord, parseEd25519WalletSessionRecord, parseThresholdEcdsaMpcSessionRecord, parseThresholdEd25519AuthorityScope, parseThresholdEd25519Commitments, parseThresholdEd25519CommitmentsById, parseThresholdEd25519CoordinatorSigningSessionRecord, parseThresholdEd25519KeyRecord, parseThresholdEd25519MpcSessionRecord, parseThresholdEd25519ReadyKeyRecord, parseThresholdEd25519SigningSessionRecord, parseThresholdEd25519StringById, thresholdEd25519AuthorityScopeFromWalletAuthAuthority, thresholdEd25519AuthorityScopesMatch, toNearPublicKeyStr, toPrefixWithColon, toThresholdEcdsaKeyPrefix, toThresholdEcdsaPrefixFromBase, toThresholdEcdsaPresignPrefix, toThresholdEcdsaSessionPrefix, toThresholdEcdsaWalletSessionPrefix, toThresholdEd25519KeyPrefix, toThresholdEd25519PrefixFromBase, toThresholdEd25519SessionPrefix, toThresholdEd25519WalletSessionPrefix };
+export { canonicalThresholdEd25519RelayerKeyId, parseEcdsaDerivationPublicIdentity, parseEcdsaWalletSessionRecord, parseEd25519WalletSessionRecord, parseThresholdEcdsaMpcSessionRecord, parseThresholdEd25519AuthorityScope, parseThresholdEd25519CoordinatorSigningSessionRecord, parseThresholdEd25519KeyRecord, parseThresholdEd25519MpcSessionRecord, parseThresholdEd25519SigningSessionRecord, thresholdEd25519AuthorityScopeFromWalletAuthAuthority, thresholdEd25519AuthorityScopesMatch, toPrefixWithColon, toThresholdEcdsaPrefixFromBase, toThresholdEcdsaSessionPrefix, toThresholdEcdsaWalletSessionPrefix, toThresholdEd25519KeyPrefix, toThresholdEd25519PrefixFromBase, toThresholdEd25519SessionPrefix, toThresholdEd25519WalletSessionPrefix };
 
 //# sourceMappingURL=validation.js.map

package/dist/esm/core/WalletAuthMethodStore.js

@@ -1,37 +1,9 @@
-import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
-import "../shared-ts/src/utils/validation.js";
-import { resolveD1DatabaseFromConfig } from "../storage/d1Sql.js";
-import "./defaultConfigsServer.js";
-import { D1WalletAuthMethodStore, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL, ensureWalletAuthMethodStoreD1Schema, ensureWalletAuthMethodStoreD1SchemaV2, normalizeWalletAuthMethod, normalizeWalletAuthMethodV2, prepareD1WalletAuthMethodV2PutStatement, walletAuthMethodId, walletAuthMethodV2Id } from "./d1WalletAuthMethodStore.js";
+import { resolveStorePrefix } from "./d1TenantStore.js";
+import { createDurableObjectStore, postDurableObjectRequest } from "./storeBackends.js";
+import { D1WalletAuthMethodStore, WALLET_AUTH_METHOD_D1_STORE, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL, ensureWalletAuthMethodStoreD1Schema, ensureWalletAuthMethodStoreD1SchemaV2, normalizeWalletAuthMethod, normalizeWalletAuthMethodV2, prepareD1WalletAuthMethodV2PutStatement, walletAuthMethodId, walletAuthMethodV2Id } from "./d1WalletAuthMethodStore.js";
 //#region src/core/WalletAuthMethodStore.ts
-function isObject(value) {
-	return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
-function trimString(value) {
-	return typeof value === "string" ? value.trim() : "";
-}
-function toPrefixWithColon(prefix, defaultPrefix) {
-	const p = normalizeOptionalTrimmedString(prefix);
-	if (!p) return defaultPrefix;
-	return p.endsWith(":") ? p : `${p}:`;
-}
 function resolveWalletAuthMethodStoreNamespace(config) {
-	const explicit = normalizeOptionalTrimmedString(config.WALLET_AUTH_METHOD_PREFIX);
-	if (explicit) return toPrefixWithColon(explicit, "");
-	return `${toPrefixWithColon(normalizeOptionalTrimmedString(config.THRESHOLD_PREFIX) || "w3a", `w3a:`)}wallet-auth-method:`;
-}
-function requireD1ScopeString(input, field) {
-	const normalized = normalizeOptionalTrimmedString(input);
-	if (!normalized) throw new Error(`${field} is required for D1 wallet auth-method store`);
-	return normalized;
-}
-function d1ScopeFromConfig(input) {
-	return {
-		namespace: requireD1ScopeString(input.namespace, "namespace"),
-		orgId: requireD1ScopeString(input.config.orgId || input.config.ORG_ID, "orgId"),
-		projectId: requireD1ScopeString(input.config.projectId || input.config.PROJECT_ID, "projectId"),
-		envId: requireD1ScopeString(input.config.envId || input.config.ENV_ID, "envId")
-	};
+	return resolveStorePrefix(config, ["WALLET_AUTH_METHOD_PREFIX"], "wallet-auth-method:");
 }
 var InMemoryWalletAuthMethodStore = class {
 	constructor(namespace) {
@@ -52,23 +24,18 @@ var InMemoryWalletAuthMethodStore = class {
 	}
 };
 var CloudflareDurableObjectWalletAuthMethodStore = class {
-	constructor(input) {
-		this.input = input;
-		const id = input.namespace.idFromName(input.objectName);
-		this.stub = input.namespace.get(id);
+	constructor(stub, prefix) {
+		this.stub = stub;
+		this.prefix = prefix;
 	}
 	key(id) {
-		return `${this.input.prefix}auth-method:${id}`;
+		return `${this.prefix}auth-method:${id}`;
 	}
 	walletIndexKey(input) {
-		return `${this.input.prefix}wallet-index:${input.rpId || "*"}:${input.walletId}`;
+		return `${this.prefix}wallet-index:${input.rpId || "*"}:${input.walletId}`;
 	}
 	async request(body) {
-		const response = await this.stub.fetch("https://threshold-store.invalid/", {
-			method: "POST",
-			headers: { "content-type": "application/json" },
-			body: JSON.stringify(body)
-		});
+		const response = await postDurableObjectRequest(this.stub, body);
 		if (!response.ok) throw new Error(`Wallet auth-method DO store HTTP ${response.status}: ${await response.text()}`);
 		return await response.json().catch(() => null);
 	}
@@ -136,43 +103,19 @@ var CloudflareDurableObjectWalletAuthMethodStore = class {
 		return records;
 	}
 };
-function resolveDoNamespaceFromConfig(config) {
-	const isNamespace = (value) => isObject(value) && typeof value.idFromName === "function" && typeof value.get === "function";
-	if (isNamespace(config.namespace)) return config.namespace;
-	if (isNamespace(config.durableObjectNamespace)) return config.durableObjectNamespace;
-	if (isNamespace(config.THRESHOLD_DO_NAMESPACE)) return config.THRESHOLD_DO_NAMESPACE;
-	return null;
-}
+const WALLET_AUTH_METHOD_STORE = {
+	tag: "wallet-auth-method",
+	name: "wallet auth-method",
+	inMemoryLog: "Using in-memory store",
+	d1StoreName: WALLET_AUTH_METHOD_D1_STORE,
+	resolvePrefix: resolveWalletAuthMethodStoreNamespace
+};
 function createWalletAuthMethodStore(input) {
-	const config = isObject(input.config) ? input.config : {};
-	const namespace = resolveWalletAuthMethodStoreNamespace(config);
-	const kind = normalizeOptionalTrimmedString(config.kind);
-	if (kind === "d1") {
-		const database = resolveD1DatabaseFromConfig(config);
-		if (!database) throw new Error("[wallet-auth-method] D1 store selected but no D1 database was provided");
-		input.logger.info("[wallet-auth-method] Using D1 store");
-		return new D1WalletAuthMethodStore({
-			database,
-			...d1ScopeFromConfig({
-				config,
-				namespace
-			})
-		});
-	}
-	if (kind === "cloudflare-do") {
-		const durableObjectNamespace = resolveDoNamespaceFromConfig(config);
-		if (!durableObjectNamespace) throw new Error("cloudflare-do wallet auth-method store selected but no Durable Object namespace was provided");
-		const objectName = trimString(config.objectName) || trimString(config.name) || "threshold-store";
-		input.logger.info("[wallet-auth-method] Using Cloudflare Durable Object store");
-		return new CloudflareDurableObjectWalletAuthMethodStore({
-			namespace: durableObjectNamespace,
-			objectName,
-			prefix: namespace
-		});
-	}
-	if (kind) throw new Error(`[wallet-auth-method] Unknown wallet auth-method store kind: ${kind}`);
-	input.logger.info("[wallet-auth-method] Using in-memory store");
-	return new InMemoryWalletAuthMethodStore(namespace);
+	return createDurableObjectStore(input, WALLET_AUTH_METHOD_STORE, {
+		d1: (options) => new D1WalletAuthMethodStore(options),
+		durableObject: (stub, prefix) => new CloudflareDurableObjectWalletAuthMethodStore(stub, prefix),
+		inMemory: (prefix) => new InMemoryWalletAuthMethodStore(prefix)
+	});
 }
 //#endregion
 export { D1WalletAuthMethodStore, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL, createWalletAuthMethodStore, ensureWalletAuthMethodStoreD1Schema, ensureWalletAuthMethodStoreD1SchemaV2, normalizeWalletAuthMethod, normalizeWalletAuthMethodV2, prepareD1WalletAuthMethodV2PutStatement, resolveWalletAuthMethodStoreNamespace, walletAuthMethodV2Id };