@seams/wallet-server 0.6.2 → 0.7.3

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationSetup.js

@@ -1,13 +1,15 @@
-import { computeRegistrationIntentDigestB64u, normalizeRegistrationAuthMethodInput, normalizeRegistrationSignerPlan, registrationSignerSetSelectionFromPlan } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
+import { normalizeRegistrationAuthMethodInput } from "../../../../shared-ts/src/utils/registrationAuthMethodInput.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { thresholdEcdsaChainTargetFromValue } from "../../../../core/thresholdEcdsaChainTarget.js";
 import { computeWalletRegistrationSetupDigestB64u, mintSignedWalletRegistrationSetup } from "../../../domains/walletRegistration/walletRegistrationSetupPayload.js";
+import { normalizeRegistrationSignerPlan, registrationSignerSetSelectionFromPlan } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
+import { computeRegistrationIntentDigestB64u } from "../../../../shared-ts/src/utils/registrationIntent.js";
 //#region src/router/cloudflare/d1/registration/d1WalletRegistrationSetup.ts
 /**
-* Refactor 94C. `/wallets/register/setup` — one request replacing the bootstrap
-* grant, the registration intent, and registration start.
+* `/wallets/register/setup` — one request replacing the bootstrap grant, the
+* registration intent, and registration start.
 *
 * The three legs it replaces made six-plus serialized storage round trips
 * between them, most of it bookkeeping written on every request and read on

package/dist/esm/router/cloudflare/d1/registration/walletRegistrationEstablishedSessionIssuer.js

@@ -1,15 +1,15 @@
 import { mpcMaterialActivationRefsEqual, parseEmailOtpChallengeId, parseThresholdEcdsaSessionId, parseThresholdEd25519SessionId, parseWebAuthnCredentialIdB64u } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseAuthFactorId, parsePrincipalId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import "../../../../shared-ts/src/utils/encoders.js";
 import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
-import { nearEd25519SigningKeyIdFromString, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { isEmailOtpWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseSessionOrigin, parseVerifiedOwnerProofId } from "../../../../authorization/domain.js";
 import { buildVerifiedOwnerProof, buildVerifiedWalletSessionEmailOtpFactorResult, buildVerifiedWalletSessionPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
+import { nearEd25519SigningKeyIdFromString, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { DEFAULT_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
 import { deriveThresholdEcdsaKeyHandle } from "../../../../shared-ts/src/utils/thresholdEcdsaKeyHandle.js";
 import { registrationEstablishedMintId } from "./walletRegistrationSessionCommitReceipt.js";

package/dist/esm/router/cloudflare/d1/registration/walletRegistrationSessionCommitReceipt.js

@@ -1,10 +1,11 @@
 import { parseWalletAuthMethodId, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
-import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { parseWalletAuthAuthority } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
+import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { parseSessionOrigin } from "../../../../authorization/domain.js";
+import { hasExactKeys } from "../../../../shared-ts/src/utils/exactKeys.js";
 import { parseWalletCustodyRegistrationOutcome } from "../../../../shared-ts/src/passkey-custody/ceremonyCommitPayload.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
 //#region src/router/cloudflare/d1/registration/walletRegistrationSessionCommitReceipt.ts
@@ -466,10 +467,6 @@ function parsePositiveSafeInteger(value) {
 function parseNonNegativeSafeInteger(value) {
 	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : null;
 }
-function hasExactKeys(record, expected) {
-	const actual = Object.keys(record);
-	return actual.length === expected.length && expected.every((key) => actual.includes(key));
-}
 function containsPersistedRegistrationCredential(value) {
 	if (Array.isArray(value)) return value.some(containsPersistedRegistrationCredential);
 	if (value === null || typeof value !== "object") return false;
@@ -481,6 +478,6 @@ function containsPersistedRegistrationCredential(value) {
 	return false;
 }
 //#endregion
-export { parseWalletRegistrationSessionCommitReceiptV2, projectRegistrationEstablishedSessionV2, projectWalletRegistrationSessionCommitReceiptV2, registrationEstablishedMintId, registrationReplayAuthMethodFields, replayedRegistrationCommit, unissuedRegistrationCommit };
+export { parseWalletRegistrationSessionCommitReceiptV2, projectWalletRegistrationSessionCommitReceiptV2, registrationEstablishedMintId, registrationReplayAuthMethodFields, replayedRegistrationCommit, unissuedRegistrationCommit };
 
 //# sourceMappingURL=walletRegistrationSessionCommitReceipt.js.map

package/dist/esm/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.js

@@ -1,4 +1,6 @@
-import { isD1DatabaseLike } from "../../../../storage/d1Sql.js";
+import { isPlainObject, requireNonEmptyString } from "../../../../shared-ts/src/utils/validation.js";
+import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
+import { isD1DatabaseLike, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
 import { abusePrincipalKey, runtimePolicyScopeKey } from "../../../domains/signingOperations/routerAbNormalSigningAdmissionCore.js";
 //#region src/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.ts
 const ROUTER_AB_NORMAL_SIGNING_ADMISSION_TABLE = "router_ab_normal_signing_admission_records";
@@ -6,16 +8,32 @@ var CloudflareD1RouterAbNormalSigningAdmissionStore = class {
 	constructor(options) {
 		if (!isD1DatabaseLike(options.database)) throw new Error("Router A/B normal-signing admission D1 database is required");
 		this.database = options.database;
-		this.storageNamespace = requireNonEmptyString("storageNamespace", options.storageNamespace);
+		this.storageNamespace = requireNonEmptyString(options.storageNamespace, "storageNamespace");
 		this.now = options.now || Date.now;
 	}
-	async evaluateProjectPolicy(input) {
-		const row = await this.readDecision(input.runtimePolicyScope, "project_policy", runtimePolicyScopeKey(input.runtimePolicyScope));
-		return row === null ? { kind: "allowed" } : parseProjectPolicyDecision(row);
-	}
-	async evaluateAbuse(input) {
-		const row = await this.readDecision(input.runtimePolicyScope, "abuse", abusePrincipalKey(input));
-		return row === null ? { kind: "allowed" } : parseAbuseDecision(row);
+	async evaluatePolicy(input) {
+		if (input.curve === "ecdsa" && input.policyReadSource.kind === "credential_snapshot") {
+			const decision = input.policyReadSource.policyRead.resolve(this.database, this.storageNamespace, input);
+			if (decision) return decision;
+		}
+		const scope = input.runtimePolicyScope;
+		return parsePolicyRow(await this.database.prepare(`WITH scope(namespace, org_id, project_id, env_id, signing_root_version,
+                  project_key, abuse_key) AS (VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7))
+       SELECT project.record_key AS project_key, project.decision AS project_decision,
+              project.retry_after_ms AS project_retry_after_ms,
+              abuse.record_key AS abuse_key, abuse.decision AS abuse_decision,
+              abuse.retry_after_ms AS abuse_retry_after_ms
+         FROM scope
+         LEFT JOIN ${ROUTER_AB_NORMAL_SIGNING_ADMISSION_TABLE} AS project
+           ON project.namespace = scope.namespace AND project.org_id = scope.org_id
+          AND project.project_id = scope.project_id AND project.env_id = scope.env_id
+          AND project.signing_root_version = scope.signing_root_version
+          AND project.record_kind = 'project_policy' AND project.record_key = scope.project_key
+         LEFT JOIN ${ROUTER_AB_NORMAL_SIGNING_ADMISSION_TABLE} AS abuse
+           ON abuse.namespace = scope.namespace AND abuse.org_id = scope.org_id
+          AND abuse.project_id = scope.project_id AND abuse.env_id = scope.env_id
+          AND abuse.signing_root_version = scope.signing_root_version
+          AND abuse.record_kind = 'abuse' AND abuse.record_key = scope.abuse_key`).bind(this.storageNamespace, scope.orgId, scope.projectId, scope.envId, scope.signingRootVersion, runtimePolicyScopeKey(scope), abusePrincipalKey(input)).first());
 	}
 	async setProjectPolicy(scope, decision) {
 		const normalized = normalizeProjectPolicyDecision(decision);
@@ -31,17 +49,6 @@ var CloudflareD1RouterAbNormalSigningAdmissionStore = class {
 	async clearAbuseDecision(input) {
 		await this.deleteRecord(input.runtimePolicyScope, "abuse", abusePrincipalKey(input));
 	}
-	async readDecision(scope, kind, key) {
-		return await this.database.prepare(`SELECT decision, retry_after_ms
-           FROM ${ROUTER_AB_NORMAL_SIGNING_ADMISSION_TABLE}
-          WHERE namespace = ?1
-            AND org_id = ?2
-            AND project_id = ?3
-            AND env_id = ?4
-            AND signing_root_version = ?5
-            AND record_kind = ?6
-            AND record_key = ?7`).bind(this.storageNamespace, scope.orgId, scope.projectId, scope.envId, scope.signingRootVersion, kind, key).first();
-	}
 	async putDecision(scope, kind, key, decision, retryAfterMs) {
 		await requireSuccessfulD1Write(this.database.prepare(`INSERT INTO ${ROUTER_AB_NORMAL_SIGNING_ADMISSION_TABLE} (
              namespace, org_id, project_id, env_id, signing_root_version,
@@ -93,7 +100,7 @@ function normalizeAbuseDecision(decision) {
 	}
 }
 function parseProjectPolicyDecision(row) {
-	const decision = requireNonEmptyString("decision", row.decision);
+	const decision = requireNonEmptyString(row.decision, "decision");
 	switch (decision) {
 		case "allowed": return { kind: "allowed" };
 		case "rejected": return {
@@ -104,7 +111,7 @@ function parseProjectPolicyDecision(row) {
 	}
 }
 function parseAbuseDecision(row) {
-	const decision = requireNonEmptyString("decision", row.decision);
+	const decision = requireNonEmptyString(row.decision, "decision");
 	switch (decision) {
 		case "allowed": return { kind: "allowed" };
 		case "rate_limited": return {
@@ -124,10 +131,6 @@ async function requireSuccessfulD1Write(statement) {
 function isSuccessfulD1Result(result) {
 	return result.success === true;
 }
-function requireNonEmptyString(label, value) {
-	if (typeof value === "string" && value.trim().length > 0) return value.trim();
-	throw new Error(`${label} must be a non-empty string`);
-}
 function requirePositiveInteger(label, value) {
 	const numeric = typeof value === "bigint" ? Number(value) : value;
 	if (typeof numeric === "number" && Number.isSafeInteger(numeric) && numeric > 0) return numeric;
@@ -140,7 +143,116 @@ function requirePositiveInteger(label, value) {
 function assertNever(value) {
 	throw new Error(`Unexpected Router A/B normal-signing admission branch: ${String(value)}`);
 }
+function parsePolicyRow(row) {
+	if (!row) throw new Error("Router A/B admission policy snapshot is missing");
+	if (row.project_key !== null) {
+		const project = parseProjectPolicyDecision({
+			decision: row.project_decision,
+			retry_after_ms: row.project_retry_after_ms
+		});
+		if (project.kind === "rejected") return {
+			kind: "project_policy_rejected",
+			retryAfterMs: project.retryAfterMs
+		};
+	}
+	if (row.abuse_key === null) return { kind: "allowed" };
+	const abuse = parseAbuseDecision({
+		decision: row.abuse_decision,
+		retry_after_ms: row.abuse_retry_after_ms
+	});
+	return abuse.kind === "rejected" ? {
+		kind: "abuse_rejected",
+		retryAfterMs: abuse.retryAfterMs
+	} : abuse;
+}
+var D1EcdsaAdmissionPolicyRead = class D1EcdsaAdmissionPolicyRead {
+	#decisions;
+	constructor(database, namespace, walletId, activationId, decisions) {
+		this.database = database;
+		this.namespace = namespace;
+		this.walletId = walletId;
+		this.activationId = activationId;
+		this.#decisions = decisions;
+	}
+	static fromRows(database, namespace, walletId, activationId, rows) {
+		if (!Array.isArray(rows)) throw new Error("ECDSA policy candidates are invalid");
+		const decisions = /* @__PURE__ */ new Map();
+		for (const row of rows) {
+			if (!isPlainObject(row)) throw new Error("ECDSA policy candidate is invalid");
+			const key = runtimePolicyScopeKey(normalizeRuntimePolicyScope(parseD1JsonColumn(row.scope_json)));
+			if (decisions.has(key)) throw new Error("ECDSA policy scope is ambiguous");
+			try {
+				const decision = parsePolicyRow({
+					project_key: row.project_key,
+					project_decision: row.project_decision,
+					project_retry_after_ms: row.project_retry_after_ms,
+					abuse_key: row.abuse_key,
+					abuse_decision: row.abuse_decision,
+					abuse_retry_after_ms: row.abuse_retry_after_ms
+				});
+				decisions.set(key, {
+					ok: true,
+					decision
+				});
+			} catch (error) {
+				decisions.set(key, {
+					ok: false,
+					message: error instanceof Error ? error.message : "ECDSA policy read failed"
+				});
+			}
+		}
+		return new D1EcdsaAdmissionPolicyRead(database, namespace, walletId, activationId, decisions);
+	}
+	resolve(database, namespace, input) {
+		if (database !== this.database || namespace !== this.namespace) return null;
+		if (input.walletId !== this.walletId || input.materialActivationId !== this.activationId) throw new Error("ECDSA policy credential scope does not match");
+		const result = this.#decisions.get(runtimePolicyScopeKey(input.runtimePolicyScope));
+		if (!result) throw new Error("Verified ECDSA material policy scope is missing");
+		if (!result.ok) throw new Error(result.message);
+		return result.decision;
+	}
+};
+const ECDSA_CREDENTIAL_POLICY_PROJECTION = `
+  (WITH candidates AS (
+     SELECT DISTINCT json_extract(signer.record_json, '$.runtimePolicyScope') AS scope_json
+       FROM wallet_signers AS signer
+      WHERE signer.namespace = session.namespace AND signer.org_id = session.org_id
+        AND signer.project_id = session.project_id AND signer.env_id = session.env_id
+        AND signer.wallet_id = session.wallet_id AND signer.signer_family = 'ecdsa'
+        AND json_valid(signer.record_json)
+   ), scopes AS (
+     SELECT scope_json,
+            json_extract(scope_json, '$.orgId') AS org_id,
+            json_extract(scope_json, '$.projectId') AS project_id,
+            json_extract(scope_json, '$.envId') AS env_id,
+            json_extract(scope_json, '$.signingRootVersion') AS signing_root_version,
+            json_extract(scope_json, '$.orgId') || char(31) ||
+            json_extract(scope_json, '$.projectId') || char(31) ||
+            json_extract(scope_json, '$.envId') || char(31) ||
+            json_extract(scope_json, '$.signingRootVersion') AS project_key
+       FROM candidates
+   )
+   SELECT json_group_array(json_object(
+     'scope_json', scopes.scope_json,
+     'project_key', project.record_key, 'project_decision', project.decision,
+     'project_retry_after_ms', project.retry_after_ms,
+     'abuse_key', abuse.record_key, 'abuse_decision', abuse.decision,
+     'abuse_retry_after_ms', abuse.retry_after_ms))
+     FROM scopes
+     LEFT JOIN router_ab_normal_signing_admission_records AS project
+       ON project.namespace = session.namespace AND project.org_id = scopes.org_id
+      AND project.project_id = scopes.project_id AND project.env_id = scopes.env_id
+      AND project.signing_root_version = scopes.signing_root_version
+      AND project.record_kind = 'project_policy' AND project.record_key = scopes.project_key
+     LEFT JOIN router_ab_normal_signing_admission_records AS abuse
+       ON abuse.namespace = session.namespace AND abuse.org_id = scopes.org_id
+      AND abuse.project_id = scopes.project_id AND abuse.env_id = scopes.env_id
+      AND abuse.signing_root_version = scopes.signing_root_version
+      AND abuse.record_kind = 'abuse'
+      AND abuse.record_key = scopes.project_key || char(31) || session.wallet_id || char(31) ||
+          'material_activation:' || ? || char(31) || 'ecdsa'
+  ) AS ecdsa_policy_records_json,`;
 //#endregion
-export { CloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1RouterAbNormalSigningAdmissionStore };
+export { CloudflareD1RouterAbNormalSigningAdmissionStore, D1EcdsaAdmissionPolicyRead, ECDSA_CREDENTIAL_POLICY_PROJECTION, createCloudflareD1RouterAbNormalSigningAdmissionStore };
 
 //# sourceMappingURL=d1RouterAbNormalSigningAdmissionStore.js.map

package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneEffectJournalStore.js

@@ -7,7 +7,6 @@ var CloudflareD1LaneEffectJournalStore = class {
 		const normalized = requireD1LaneStoreOptions(options);
 		this.database = normalized.database;
 		this.scope = normalized.scope;
-		this.now = normalized.now;
 	}
 	async getEffect(input) {
 		const row = await this.database.prepare(`SELECT effect_id, enrollment_id, operation_id, wallet_id, wallet_key_id, lane_id, lane_share_epoch, effect_kind, request_digest_b64u, status, response_digest_b64u, recorded_at_ms, confirmed_at_ms, version, command_digest_b64u FROM ${EFFECT_TABLE} WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4 AND effect_id = ?5`).bind(...scopeValues(this.scope), input.effectId).first();

package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneLifecycleStore.js

@@ -2,8 +2,8 @@ import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { sha256Bytes } from "../../../../shared-ts/src/utils/digests.js";
 import { d1ChangedRows } from "../../../../storage/d1Sql.js";
-import { computeLaneParticipantSetBindingDigestV1 } from "../../../../shared-ts/src/signing-lanes/participantDigest.js";
 import { buildLaneProductEpochPendingVisibilityV1, buildLaneProductEpochRevokedV1, parseAggregateLaneActivationReceiptV1, parseAggregateLaneRevocationReceiptV1, parseCompleteSigningLaneRevocationV1, parseLaneEnrollmentManifestV1, parseLaneHolderDeliveryReceiptV1, parseLaneProductEpochRecordV1, parseLaneProtocolCommitReceiptV1, parseLaneRefreshPredecessorRetirementV1, parseLaneServerActivationReceiptV1, parseLaneServerRetirementReceiptV1, parseRevokeSigningLaneV1 } from "../../../../shared-ts/src/signing-lanes/rotationParsers.js";
+import { computeLaneParticipantSetBindingDigestV1 } from "../../../../shared-ts/src/signing-lanes/participantDigest.js";
 import { computeAggregateLaneActivationReceiptDigestV1, computeAggregateLaneRevocationReceiptDigestV1, computeEcdsaServerRetirementReceiptDigestV1, computeEd25519ServerRetirementReceiptDigestV1, computeLaneEnrollmentManifestDigestV1, computeRevokeSigningLaneDigestV1, encodeLaneHolderDeliveryReceiptV1, encodeLaneProtocolCommitReceiptV1, encodeLaneServerActivationReceiptV1 } from "../../../../shared-ts/src/signing-lanes/rotationDigests.js";
 import { activateLaneProductEpochV1, beginLaneProductEpochRevocationV1, completeLaneProductEpochRevocationV1, retireFencedLaneProductEpochV1, transitionLaneEnrollmentLifecycleV1 } from "../../../../shared-ts/src/signing-lanes/rotationLifecycle.js";
 import { LANE_CAS_GUARD_SQL, assertD1Success, digestLaneEnrollmentRevocationCommand, equalLaneRecords, firstBatchResult, parseEnrollmentRow, parseJsonRecord, parseProductEpochRow, parseProtocolRow, parseRequiredString, parseVersion, requireD1LaneStoreOptions, scopeValues } from "./d1LaneRecords.js";

package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneRecords.js

@@ -1,7 +1,8 @@
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { isD1DatabaseLike, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
-import { parseAggregateLaneActivationReceiptV1, parseAggregateLaneRevocationReceiptV1, parseLaneEnrollmentLifecycleV1, parseLaneEnrollmentManifestV1, parseLaneHolderDeliveryReceiptV1, parseLaneProductEpochRecordV1, parseLaneProtocolCommitReceiptV1, parseLaneProtocolJobV1, parseLaneProtocolLifecycleV1, parseLaneServerActivationReceiptV1, parseLaneServerRetirementReceiptV1 } from "../../../../shared-ts/src/signing-lanes/rotationParsers.js";
+import { parseAggregateLaneActivationReceiptV1, parseAggregateLaneRevocationReceiptV1, parseLaneEnrollmentLifecycleV1, parseLaneEnrollmentManifestV1, parseLaneHolderDeliveryReceiptV1, parseLaneProductEpochRecordV1, parseLaneProtocolCommitReceiptV1, parseLaneProtocolLifecycleV1, parseLaneServerActivationReceiptV1, parseLaneServerRetirementReceiptV1 } from "../../../../shared-ts/src/signing-lanes/rotationParsers.js";
+import { parseLaneProtocolJobV1 } from "../../../../shared-ts/src/signing-lanes/rotationProtocolParsers.js";
 //#region src/router/cloudflare/d1/signingLanes/d1LaneRecords.ts
 function requireD1LaneStoreOptions(input) {
 	if (!isD1DatabaseLike(input.database)) throw new Error("R102 lane D1 database is required");

package/dist/esm/router/cloudflare/d1/versionedJson/d1VersionedJsonRecordStore.js

@@ -1,12 +1,10 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
-import { isD1DatabaseLike } from "../../../../storage/d1Sql.js";
+import { D1_BATCH_CAS_GUARD_SQL, isD1DatabaseLike } from "../../../../storage/d1Sql.js";
 import { containsControlCharacter } from "../../durableObjects/versionedJsonRecordStore.js";
 //#region src/router/cloudflare/d1/versionedJson/d1VersionedJsonRecordStore.ts
 const TABLE_NAME = "router_ab_yao_versioned_json_records";
-const CAS_GUARD_SQL = `INSERT INTO router_ab_yao_versioned_json_cas_guard (guard_id)
-SELECT 1
- WHERE changes() = 0`;
+const CAS_GUARD_SQL = D1_BATCH_CAS_GUARD_SQL;
 var CloudflareD1VersionedJsonRecordStoreError = class extends Error {
 	constructor(code, message) {
 		super(message);
@@ -181,59 +179,6 @@ var CloudflareD1VersionedJsonRecordStore = class {
 		}
 		return statements;
 	}
-	async patchAtomically(input) {
-		const storageKey = this.storageKey(input.key);
-		const expectedVersion = parseVersion(input.expectedVersion);
-		if (expectedVersion === null) throw new Error("Cloudflare D1 atomic JSON patch expectedVersion is invalid");
-		if (!Number.isSafeInteger(input.unexpired.nowMs) || input.unexpired.nowMs <= 0 || !isJsonPath(input.unexpired.jsonPath)) throw new Error("Cloudflare D1 atomic JSON patch expiry predicate is invalid");
-		for (const predicate of input.exactStringPredicates) if (!isJsonPath(predicate.jsonPath) || typeof predicate.value !== "string") throw new Error("Cloudflare D1 atomic JSON patch exact predicate is invalid");
-		if (!isJsonObject(input.patch)) throw new Error("Cloudflare D1 atomic JSON patch value is invalid");
-		const exactSql = input.exactStringPredicates.map((_, index) => `AND json_extract(record_json, ?${9 + index * 2}) = ?${10 + index * 2}`).join("\n");
-		const expiryPathIndex = 9 + input.exactStringPredicates.length * 2;
-		const nowIndex = expiryPathIndex + 1;
-		const bindings = [
-			this.scope.namespace,
-			this.scope.orgId,
-			this.scope.projectId,
-			this.scope.envId,
-			storageKey,
-			JSON.stringify(input.patch),
-			Date.now(),
-			expectedVersion,
-			...input.exactStringPredicates.flatMap((predicate) => [predicate.jsonPath, predicate.value]),
-			input.unexpired.jsonPath,
-			input.unexpired.nowMs
-		];
-		let row;
-		try {
-			row = await this.database.prepare(`UPDATE ${TABLE_NAME}
-              SET version = version + 1,
-                  record_json = json_patch(record_json, json(?6)),
-                  updated_at_ms = ?7
-            WHERE namespace = ?1
-              AND org_id = ?2
-              AND project_id = ?3
-              AND env_id = ?4
-              AND record_key = ?5
-              AND version = ?8
-              ${exactSql}
-              AND json_extract(record_json, ?${expiryPathIndex}) > ?${nowIndex}
-          RETURNING version, record_json`).bind(...bindings).first();
-		} catch (error) {
-			throw requestFailure(error);
-		}
-		if (row === null) return { kind: "version_mismatch" };
-		const parsed = this.parseReadResult({
-			success: true,
-			results: [row]
-		});
-		if (parsed.kind !== "present") throw invalidResponseFailure("Cloudflare D1 atomic JSON patch omitted its stored value");
-		return {
-			kind: "stored",
-			version: parsed.version,
-			value: parsed.value
-		};
-	}
 	prepareBatchMutations(mutations) {
 		if (mutations.length === 0) throw new Error("Cloudflare D1 versioned JSON batch requires at least one mutation");
 		const seenKeys = /* @__PURE__ */ new Set();
@@ -340,9 +285,6 @@ function normalizeRecordKey(value) {
 	if (key.length > 512 || containsControlCharacter(key)) throw new Error("Cloudflare D1 versioned JSON record key is invalid");
 	return key;
 }
-function isJsonPath(value) {
-	return typeof value === "string" && /^\$\.[A-Za-z][A-Za-z0-9.]*$/u.test(value);
-}
 function parseVersion(value) {
 	const text = typeof value === "number" ? String(value) : normalizeOptionalTrimmedString(value);
 	if (!text || !/^\d+$/u.test(text)) return null;