@seams/wallet-server 0.6.2 → 0.7.3

package/dist/esm/core/WalletStore.js

@@ -1,44 +1,18 @@
 import { parseWalletId } from "../shared-ts/src/utils/domainIds.js";
+import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
+import { isPlainObject } from "../shared-ts/src/utils/validation.js";
 import { sameRouterAbMpcMaterialActivationRef } from "../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { sameRouterAbEd25519YaoActivationBindingV1, sameRouterAbEd25519YaoActivationKeysetV1, sameRouterAbEd25519YaoActivationPublicReceiptV1, sameRouterAbEd25519YaoRecoveryAdmissionRequestV1, sameRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { derivationClientSharePublicKey33B64uFromString, ecdsaClientRootPublicKey33B64uFromString, parseSdkEcdsaDerivationThresholdKeyId } from "../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
-import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
-import "../shared-ts/src/utils/validation.js";
 import { normalizeRuntimePolicyScope } from "../shared-ts/src/threshold/signingRootScope.js";
-import { parseRouterAbEcdsaDerivationActivationRefreshRequestV1, parseRouterAbEcdsaDerivationActivationRefreshResponseV1, parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaDerivationPublicIdentityV1, sameRouterAbServerIdentityV1 } from "../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { resolveD1DatabaseFromConfig } from "../storage/d1Sql.js";
-import { thresholdEcdsaChainTargetFromValue, thresholdEcdsaChainTargetKey } from "./thresholdEcdsaChainTarget.js";
-import "./defaultConfigsServer.js";
+import { parseRouterAbEcdsaDerivationActivationRefreshRequestV1, parseRouterAbEcdsaDerivationActivationRefreshResponseV1, parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaRegistrationActivationReceiptV1, sameRegistrationSignerSet, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaDerivationPublicIdentityV1 } from "../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { resolveStorePrefix } from "./d1TenantStore.js";
+import { createDurableObjectStore, postDurableObjectRequest } from "./storeBackends.js";
+import { thresholdEcdsaChainTargetKey } from "../shared-ts/src/utils/thresholdEcdsaChainTarget.js";
+import { thresholdEcdsaChainTargetFromValue } from "./thresholdEcdsaChainTarget.js";
 import { D1WalletStore, WALLET_STORE_D1_SCHEMA_SQL, buildWalletEcdsaSignerRecord, ensureWalletStoreD1Schema, parseWalletEd25519SignerRecord } from "./d1WalletStore.js";
 //#region src/core/WalletStore.ts
-function sameWalletEd25519ByteSequenceV1(left, right) {
-	if (left.length !== right.length) return false;
-	for (let index = 0; index < left.length; index += 1) if (left[index] !== right[index]) return false;
-	return true;
-}
-function sameWalletRuntimePolicyScopeV1(left, right) {
-	return left.orgId === right.orgId && left.projectId === right.projectId && left.envId === right.envId && left.signingRootVersion === right.signingRootVersion;
-}
-function sameWalletEd25519YaoActiveCapabilityV1(left, right) {
-	if (left.version !== right.version || !sameWalletEd25519ByteSequenceV1(left.activeCapabilityBinding, right.activeCapabilityBinding) || left.nearAccountId !== right.nearAccountId || !sameWalletRuntimePolicyScopeV1(left.runtimePolicyScope, right.runtimePolicyScope)) return false;
-	switch (left.version) {
-		case "wallet_ed25519_yao_registration_capability_v1":
-			if (right.version !== "wallet_ed25519_yao_registration_capability_v1") return false;
-			return sameRouterAbEd25519YaoRegistrationAdmissionRequestV1(left.admissionRequest, right.admissionRequest) && sameRouterAbEd25519YaoActivationBindingV1(left.admissionReceipt.binding, right.admissionReceipt.binding) && sameRouterAbEd25519YaoActivationKeysetV1(left.admissionReceipt.keyset, right.admissionReceipt.keyset) && sameRouterAbEd25519YaoActivationBindingV1(left.activationResult.binding, right.activationResult.binding) && sameRouterAbEd25519YaoActivationPublicReceiptV1(left.activationResult.public_receipt, right.activationResult.public_receipt);
-		case "wallet_ed25519_yao_recovery_capability_v1":
-			if (right.version !== "wallet_ed25519_yao_recovery_capability_v1") return false;
-			return sameRouterAbEd25519YaoRecoveryAdmissionRequestV1(left.admissionRequest, right.admissionRequest) && sameRouterAbEd25519YaoActivationBindingV1(left.activationResult.binding, right.activationResult.binding) && sameRouterAbEd25519YaoActivationPublicReceiptV1(left.activationResult.public_receipt, right.activationResult.public_receipt);
-		default: return assertNeverWalletEd25519YaoCapability(left);
-	}
-}
-function assertNeverWalletEd25519YaoCapability(capability) {
-	throw new Error(`Unexpected wallet Ed25519 Yao capability: ${String(capability)}`);
-}
-function sameWalletEd25519SignerRecordV1(left, right) {
-	return left.version === right.version && left.walletId === right.walletId && left.signerId === right.signerId && left.nearAccountId === right.nearAccountId && left.nearEd25519SigningKeyId === right.nearEd25519SigningKeyId && left.thresholdSessionId === right.thresholdSessionId && left.signerSlot === right.signerSlot && left.publicKey === right.publicKey && left.signingWorkerId === right.signingWorkerId && left.keyVersion === right.keyVersion && left.recoveryExportCapable === right.recoveryExportCapable && left.participantIds[0] === right.participantIds[0] && left.participantIds[1] === right.participantIds[1] && left.signingRootId === right.signingRootId && left.signingRootVersion === right.signingRootVersion && sameWalletRuntimePolicyScopeV1(left.runtimePolicyScope, right.runtimePolicyScope) && sameWalletEd25519YaoActiveCapabilityV1(left.activeYaoCapability, right.activeYaoCapability) && left.custodyKeyManifestDigestB64u === right.custodyKeyManifestDigestB64u && left.createdAtMs === right.createdAtMs && left.updatedAtMs === right.updatedAtMs;
-}
 function parseWalletEcdsaPendingSessionActivationRecord(raw) {
-	if (!isObject(raw) || raw.version !== "wallet_ecdsa_pending_session_activation_v1") return null;
+	if (!isPlainObject(raw) || raw.version !== "wallet_ecdsa_pending_session_activation_v1") return null;
 	const walletId = parseWalletId(raw.walletId);
 	const lifecycleId = normalizeOptionalTrimmedString(raw.lifecycleId);
 	const requestId = normalizeOptionalTrimmedString(raw.requestId);
@@ -74,37 +48,11 @@ function parseForwardedEcdsaRefreshResponse(raw) {
 function ecdsaPublicCapabilitiesEqual(left, right) {
 	return sameRouterAbEcdsaDerivationPublicCapabilityV1(left, right);
 }
-function sameWalletEcdsaSignerSetV1(left, right) {
-	return left.signer_set_id === right.signer_set_id && left.policy === right.policy && left.signer_a.role === right.signer_a.role && left.signer_a.signer_id === right.signer_a.signer_id && left.signer_a.key_epoch === right.signer_a.key_epoch && left.signer_b.role === right.signer_b.role && left.signer_b.signer_id === right.signer_b.signer_id && left.signer_b.key_epoch === right.signer_b.key_epoch && sameRouterAbServerIdentityV1(left.selected_server, right.selected_server);
-}
 function ecdsaPostRegistrationRequestMatchesCapability(input) {
-	return input.request.client_id === input.capability.client_id && input.request.router_id === input.capability.router_id && input.request.context.application_binding_digest_b64u === input.capability.context.application_binding_digest_b64u && sameRouterAbEcdsaDerivationPublicIdentityV1(input.request.public_identity, input.capability.public_identity) && sameWalletEcdsaSignerSetV1(input.request.signer_set, input.capability.signer_set);
-}
-function isObject(v) {
-	return Boolean(v && typeof v === "object" && !Array.isArray(v));
-}
-function trimString(value) {
-	return typeof value === "string" ? value.trim() : "";
-}
-function toPrefixWithColon(prefix, defaultPrefix) {
-	const p = normalizeOptionalTrimmedString(prefix);
-	if (!p) return defaultPrefix;
-	return p.endsWith(":") ? p : `${p}:`;
+	return input.request.client_id === input.capability.client_id && input.request.router_id === input.capability.router_id && input.request.context.application_binding_digest_b64u === input.capability.context.application_binding_digest_b64u && sameRouterAbEcdsaDerivationPublicIdentityV1(input.request.public_identity, input.capability.public_identity) && sameRegistrationSignerSet(input.request.signer_set, input.capability.signer_set);
 }
 function resolveWalletStoreNamespace(config) {
-	const explicit = normalizeOptionalTrimmedString(config.WALLET_PREFIX);
-	if (explicit) return toPrefixWithColon(explicit, "");
-	return `${toPrefixWithColon(normalizeOptionalTrimmedString(config.THRESHOLD_PREFIX) || "w3a", `w3a:`)}wallet:`;
-}
-function resolveDoNamespaceFromConfig(config) {
-	const isNamespace = (value) => isObject(value) && typeof value.idFromName === "function" && typeof value.get === "function";
-	const direct = config.namespace;
-	if (isNamespace(direct)) return direct;
-	const durableObjectNamespace = config.durableObjectNamespace;
-	if (isNamespace(durableObjectNamespace)) return durableObjectNamespace;
-	const envStyle = config.THRESHOLD_DO_NAMESPACE;
-	if (isNamespace(envStyle)) return envStyle;
-	return null;
+	return resolveStorePrefix(config, ["WALLET_PREFIX"], "wallet:");
 }
 function signerFamily(record) {
 	return record.version === "wallet_signer_ed25519_v1" ? "ed25519" : "ecdsa";
@@ -115,7 +63,7 @@ function normalizeTimestampMs(value) {
 	return Math.floor(numberValue);
 }
 function parseWalletRecord(raw) {
-	if (!isObject(raw)) return null;
+	if (!isPlainObject(raw)) return null;
 	if (raw.version !== "wallet_v1") return null;
 	const walletId = parseWalletId(raw.walletId);
 	const createdAtMs = normalizeTimestampMs(raw.createdAtMs);
@@ -129,13 +77,13 @@ function parseWalletRecord(raw) {
 	};
 }
 function parseWalletEcdsaSignerRecord(raw) {
-	if (!isObject(raw) || raw.version !== "wallet_signer_ecdsa_v1") return null;
+	if (!isPlainObject(raw) || raw.version !== "wallet_signer_ecdsa_v1") return null;
 	if ("evmFamilySigningKeySlotId" in raw) return null;
 	const walletId = parseWalletId(raw.walletId);
 	const signerId = normalizeOptionalTrimmedString(raw.signerId);
 	const chainTargetKey = normalizeOptionalTrimmedString(raw.chainTargetKey);
 	const chainTarget = thresholdEcdsaChainTargetFromValue(raw.chainTarget);
-	const walletKeyRaw = isObject(raw.walletKey) ? raw.walletKey : null;
+	const walletKeyRaw = isPlainObject(raw.walletKey) ? raw.walletKey : null;
 	const walletKey = walletKeyRaw ? parseWalletEcdsaSignerKey(walletKeyRaw) : null;
 	let activationReceipt;
 	let runtimePolicyScope;
@@ -225,19 +173,6 @@ function normalizeNonNegativeInteger(value) {
 	const normalized = Number(value);
 	return Number.isSafeInteger(normalized) && normalized >= 0 ? normalized : null;
 }
-function requireD1ScopeString(input, field) {
-	const normalized = normalizeOptionalTrimmedString(input);
-	if (!normalized) throw new Error(`${field} is required for D1 wallet store`);
-	return normalized;
-}
-function d1ScopeFromConfig(input) {
-	return {
-		namespace: requireD1ScopeString(input.namespace, "namespace"),
-		orgId: requireD1ScopeString(input.config.orgId || input.config.ORG_ID, "orgId"),
-		projectId: requireD1ScopeString(input.config.projectId || input.config.PROJECT_ID, "projectId"),
-		envId: requireD1ScopeString(input.config.envId || input.config.ENV_ID, "envId")
-	};
-}
 function buildWalletEd25519SignerId(input) {
 	const nearAccountId = String(input.nearAccountId || "").trim();
 	const signerSlot = Number(input.signerSlot);
@@ -310,23 +245,27 @@ var InMemoryWalletStore = class {
 	}
 };
 var CloudflareDurableObjectWalletStore = class {
-	constructor(input) {
-		this.input = input;
-		const id = input.namespace.idFromName(input.objectName);
-		this.stub = input.namespace.get(id);
+	constructor(stub, prefix) {
+		this.stub = stub;
+		this.prefix = prefix;
 	}
 	key(scope, id) {
-		return `${this.input.prefix}${scope}:${id}`;
+		return `${this.prefix}${scope}:${id}`;
+	}
+	/** The object's reply to a `get`, or `undefined` when it answers with an HTTP error. */
+	async get(key) {
+		const response = await postDurableObjectRequest(this.stub, {
+			op: "get",
+			key
+		});
+		if (!response.ok) return void 0;
+		return await response.json().catch(() => null);
 	}
 	async put(key, value) {
-		const response = await this.stub.fetch("https://threshold-store.invalid/", {
-			method: "POST",
-			headers: { "content-type": "application/json" },
-			body: JSON.stringify({
-				op: "set",
-				key,
-				value
-			})
+		const response = await postDurableObjectRequest(this.stub, {
+			op: "set",
+			key,
+			value
 		});
 		if (!response.ok) throw new Error(`Wallet DO store HTTP ${response.status}: ${await response.text()}`);
 	}
@@ -336,99 +275,48 @@ var CloudflareDurableObjectWalletStore = class {
 	async getWallet(input) {
 		const walletId = normalizeOptionalTrimmedString(input.walletId);
 		if (!walletId) return null;
-		const response = await this.stub.fetch("https://threshold-store.invalid/", {
-			method: "POST",
-			headers: { "content-type": "application/json" },
-			body: JSON.stringify({
-				op: "get",
-				key: this.key("subject", walletId)
-			})
-		});
-		if (!response.ok) return null;
-		return parseWalletRecord((await response.json().catch(() => null))?.value);
+		const current = await this.get(this.key("subject", walletId));
+		if (current === void 0) return null;
+		return parseWalletRecord(current?.value);
 	}
 	async getEcdsaSignerByKeyHandle(input) {
 		const walletId = normalizeOptionalTrimmedString(input.walletId);
 		const keyHandle = normalizeOptionalTrimmedString(input.keyHandle);
 		if (!walletId || !keyHandle) return null;
 		const chainTargetKey = thresholdEcdsaChainTargetKey(input.chainTarget);
-		const response = await this.stub.fetch("https://threshold-store.invalid/", {
-			method: "POST",
-			headers: { "content-type": "application/json" },
-			body: JSON.stringify({
-				op: "get",
-				key: this.key("signer", `${walletId}:ecdsa-key-handle:${keyHandle}:${chainTargetKey}`)
-			})
-		});
-		if (!response.ok) return null;
-		return parseWalletEcdsaSignerRecord((await response.json().catch(() => null))?.value);
+		const current = await this.get(this.key("signer", `${walletId}:ecdsa-key-handle:${keyHandle}:${chainTargetKey}`));
+		if (current === void 0) return null;
+		return parseWalletEcdsaSignerRecord(current?.value);
 	}
 	async getEd25519SignerBySlot(input) {
-		const response = await this.stub.fetch("https://threshold-store.invalid/", {
-			method: "POST",
-			headers: { "content-type": "application/json" },
-			body: JSON.stringify({
-				op: "get",
-				key: this.key("signer", `${input.walletId}:ed25519-slot:${input.signerSlot}`)
-			})
-		});
-		if (!response.ok) return null;
-		return parseWalletEd25519SignerRecord((await response.json().catch(() => null))?.value);
+		const current = await this.get(this.key("signer", `${input.walletId}:ed25519-slot:${input.signerSlot}`));
+		if (current === void 0) return null;
+		return parseWalletEd25519SignerRecord(current?.value);
 	}
 	async getEcdsaSignerByPublicCapability(input) {
-		const response = await this.stub.fetch("https://threshold-store.invalid/", {
-			method: "POST",
-			headers: { "content-type": "application/json" },
-			body: JSON.stringify({
-				op: "get",
-				key: this.key("signer", `${input.walletId}:ecdsa-public-capability:${input.publicCapability.registration_request_digest_b64u}`)
-			})
-		});
-		if (!response.ok) return null;
-		const signer = parseWalletEcdsaSignerRecord((await response.json().catch(() => null))?.value);
+		const current = await this.get(this.key("signer", `${input.walletId}:ecdsa-public-capability:${input.publicCapability.registration_request_digest_b64u}`));
+		if (current === void 0) return null;
+		const signer = parseWalletEcdsaSignerRecord(current?.value);
 		return signer && ecdsaPublicCapabilitiesEqual(signer.walletKey.publicCapability, input.publicCapability) ? signer : null;
 	}
 	async getEcdsaSignerByMaterialActivation(input) {
-		const response = await this.stub.fetch("https://threshold-store.invalid/", {
-			method: "POST",
-			headers: { "content-type": "application/json" },
-			body: JSON.stringify({
-				op: "get",
-				key: this.key("signer", `${input.walletId}:ecdsa-material-activation:${input.materialActivation.activation_id}`)
-			})
-		});
-		if (!response.ok) return null;
-		const signer = parseWalletEcdsaSignerRecord((await response.json().catch(() => null))?.value);
+		const current = await this.get(this.key("signer", `${input.walletId}:ecdsa-material-activation:${input.materialActivation.activation_id}`));
+		if (current === void 0) return null;
+		const signer = parseWalletEcdsaSignerRecord(current?.value);
 		return signer && signer.walletId === input.walletId && sameRouterAbMpcMaterialActivationRef(signer.walletKey.publicCapability.material_activation, input.materialActivation) ? signer : null;
 	}
 	async getEcdsaSignerByPostRegistrationRequest(input) {
 		const capabilityDigest = input.request.public_identity.context_binding_b64u;
-		const response = await this.stub.fetch("https://threshold-store.invalid/", {
-			method: "POST",
-			headers: { "content-type": "application/json" },
-			body: JSON.stringify({
-				op: "get",
-				key: this.key("signer", `${input.walletId}:ecdsa-context-binding:${capabilityDigest}`)
-			})
-		});
-		if (!response.ok) return null;
-		const signer = parseWalletEcdsaSignerRecord((await response.json().catch(() => null))?.value);
+		const current = await this.get(this.key("signer", `${input.walletId}:ecdsa-context-binding:${capabilityDigest}`));
+		if (current === void 0) return null;
+		const signer = parseWalletEcdsaSignerRecord(current?.value);
 		return signer && ecdsaPostRegistrationRequestMatchesCapability({
 			request: input.request,
 			capability: signer.walletKey.publicCapability
 		}) ? signer : null;
 	}
 	async listEcdsaSignersForWallet(input) {
-		const response = await this.stub.fetch("https://threshold-store.invalid/", {
-			method: "POST",
-			headers: { "content-type": "application/json" },
-			body: JSON.stringify({
-				op: "get",
-				key: this.key("signer", `${input.walletId}:ecdsa-list`)
-			})
-		});
-		if (!response.ok) return [];
-		const current = await response.json().catch(() => null);
+		const current = await this.get(this.key("signer", `${input.walletId}:ecdsa-list`));
 		if (current?.value === void 0 || current.value === null) return [];
 		if (!Array.isArray(current.value)) throw new Error("Wallet ECDSA signer list is invalid");
 		const signers = [];
@@ -458,38 +346,21 @@ var CloudflareDurableObjectWalletStore = class {
 		for (const record of records) await this.putSigner(record);
 	}
 };
+const WALLET_STORE = {
+	tag: "wallet",
+	name: "wallet",
+	inMemoryLog: "Using in-memory store (non-persistent)",
+	d1StoreName: "wallet store",
+	resolvePrefix: resolveWalletStoreNamespace
+};
 function createWalletStore(input) {
-	const config = isObject(input.config) ? input.config : {};
-	const prefix = resolveWalletStoreNamespace(config);
-	const kind = normalizeOptionalTrimmedString(config.kind);
-	if (kind === "d1") {
-		const database = resolveD1DatabaseFromConfig(config);
-		if (!database) throw new Error("[wallet] D1 store selected but no D1 database was provided");
-		input.logger.info("[wallet] Using D1 store");
-		return new D1WalletStore({
-			database,
-			...d1ScopeFromConfig({
-				config,
-				namespace: prefix
-			})
-		});
-	}
-	if (kind === "cloudflare-do") {
-		const namespace = resolveDoNamespaceFromConfig(config);
-		if (!namespace) throw new Error("cloudflare-do wallet store selected but no Durable Object namespace was provided");
-		const objectName = trimString(config.objectName) || trimString(config.name) || "threshold-store";
-		input.logger.info("[wallet] Using Cloudflare Durable Object store");
-		return new CloudflareDurableObjectWalletStore({
-			namespace,
-			objectName,
-			prefix
-		});
-	}
-	if (kind) throw new Error(`[wallet] Unknown wallet store kind: ${kind}`);
-	input.logger.info("[wallet] Using in-memory store (non-persistent)");
-	return new InMemoryWalletStore(prefix);
+	return createDurableObjectStore(input, WALLET_STORE, {
+		d1: (options) => new D1WalletStore(options),
+		durableObject: (stub, prefix) => new CloudflareDurableObjectWalletStore(stub, prefix),
+		inMemory: (prefix) => new InMemoryWalletStore(prefix)
+	});
 }
 //#endregion
-export { D1WalletStore, WALLET_STORE_D1_SCHEMA_SQL, buildWalletEcdsaSignerRecord, buildWalletEd25519SignerId, createWalletStore, ecdsaPostRegistrationRequestMatchesCapability, ensureWalletStoreD1Schema, parseWalletEcdsaPendingSessionActivationRecord, parseWalletEcdsaSignerRecord, resolveWalletStoreNamespace, sameWalletEd25519SignerRecordV1 };
+export { D1WalletStore, WALLET_STORE_D1_SCHEMA_SQL, buildWalletEcdsaSignerRecord, buildWalletEd25519SignerId, createWalletStore, ecdsaPostRegistrationRequestMatchesCapability, ensureWalletStoreD1Schema, parseWalletEcdsaPendingSessionActivationRecord, parseWalletEcdsaSignerRecord, resolveWalletStoreNamespace };
 
 //# sourceMappingURL=WalletStore.js.map