@seams/wallet-server 0.7.1 → 0.8.0

package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneLockStore.js

@@ -1,114 +0,0 @@
-import { parseLaneEnrollmentId, parseWalletKeyId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { d1ChangedRows } from "../../../../storage/d1Sql.js";
-import { requireD1LaneStoreOptions, scopeValues } from "./d1LaneRecords.js";
-//#region src/router/cloudflare/d1/signingLanes/d1LaneLockStore.ts
-const LOCK_TABLE = "lane_locks";
-var CloudflareD1LaneLockStore = class {
-	constructor(options) {
-		const normalized = requireD1LaneStoreOptions(options);
-		this.database = normalized.database;
-		this.scope = normalized.scope;
-	}
-	async acquireWalletKeyLock(input) {
-		return await this.acquire({
-			lockKey: `wallet-key:${String(input.walletKeyId)}`,
-			lockKind: "wallet_key",
-			walletKeyId: input.walletKeyId,
-			lockId: input.lockId,
-			ttlMs: input.ttlMs,
-			nowMs: input.nowMs
-		});
-	}
-	async acquireEnrollmentLock(input) {
-		return await this.acquire({
-			lockKey: `enrollment:${String(input.enrollmentId)}`,
-			lockKind: "enrollment",
-			enrollmentId: input.enrollmentId,
-			lockId: input.lockId,
-			ttlMs: input.ttlMs,
-			nowMs: input.nowMs
-		});
-	}
-	async releaseLock(input) {
-		return d1ChangedRows(await this.database.prepare(`DELETE FROM ${LOCK_TABLE} WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4 AND lock_key = ?5 AND lock_id = ?6`).bind(...scopeValues(this.scope), input.lockKey, input.lockId).run()) === 1;
-	}
-	async acquire(input) {
-		if (!input.lockId.trim()) throw new Error("lane lockId is required");
-		if (!Number.isSafeInteger(input.ttlMs) || input.ttlMs <= 0) throw new Error("lane lock ttlMs must be positive");
-		const current = await this.read(input.lockKey);
-		if (current && current.expiresAtMs > input.nowMs) return current.lockId === input.lockId ? {
-			outcome: "replayed",
-			lock: current
-		} : {
-			outcome: "conflict",
-			actual: current
-		};
-		const expiresAtMs = input.nowMs + input.ttlMs;
-		if (d1ChangedRows(await this.database.prepare(`INSERT INTO ${LOCK_TABLE} (namespace, org_id, project_id, env_id, lock_key, lock_kind, enrollment_id, wallet_key_id, lane_id, lock_id, expires_at_ms, acquired_at_ms) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, NULL, ?9, ?10, ?11) ON CONFLICT(namespace, org_id, project_id, env_id, lock_key) DO UPDATE SET lock_kind = excluded.lock_kind, enrollment_id = excluded.enrollment_id, wallet_key_id = excluded.wallet_key_id, lock_id = excluded.lock_id, expires_at_ms = excluded.expires_at_ms, acquired_at_ms = excluded.acquired_at_ms WHERE lane_locks.expires_at_ms <= excluded.acquired_at_ms`).bind(...scopeValues(this.scope), input.lockKey, input.lockKind, input.enrollmentId ? String(input.enrollmentId) : null, input.walletKeyId ? String(input.walletKeyId) : null, input.lockId, expiresAtMs, input.nowMs).run()) !== 1) {
-			const raced = await this.read(input.lockKey);
-			return raced && raced.lockId === input.lockId ? {
-				outcome: "replayed",
-				lock: raced
-			} : {
-				outcome: "conflict",
-				actual: raced
-			};
-		}
-		return {
-			outcome: "applied",
-			lock: input.lockKind === "wallet_key" ? {
-				lockKey: input.lockKey,
-				lockKind: "wallet_key",
-				walletKeyId: requireId(parseWalletKeyId, input.walletKeyId, "wallet key"),
-				lockId: input.lockId,
-				acquiredAtMs: input.nowMs,
-				expiresAtMs
-			} : {
-				lockKey: input.lockKey,
-				lockKind: "enrollment",
-				enrollmentId: requireId(parseLaneEnrollmentId, input.enrollmentId, "enrollment"),
-				lockId: input.lockId,
-				acquiredAtMs: input.nowMs,
-				expiresAtMs
-			}
-		};
-	}
-	async read(lockKey) {
-		const row = await this.database.prepare(`SELECT lock_key, lock_kind, enrollment_id, wallet_key_id, lane_id, lock_id, expires_at_ms, acquired_at_ms FROM ${LOCK_TABLE} WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4 AND lock_key = ?5`).bind(...scopeValues(this.scope), lockKey).first();
-		if (!row) return null;
-		const lockKind = row.lock_kind === "wallet_key" || row.lock_kind === "enrollment" ? row.lock_kind : null;
-		if (!lockKind || typeof row.lock_key !== "string" || typeof row.lock_id !== "string") throw new Error("stored lane lock is invalid");
-		const expiresAtMs = Number(row.expires_at_ms);
-		const acquiredAtMs = Number(row.acquired_at_ms);
-		if (!Number.isSafeInteger(expiresAtMs) || !Number.isSafeInteger(acquiredAtMs)) throw new Error("stored lane lock times are invalid");
-		if (lockKind === "wallet_key") {
-			if (typeof row.wallet_key_id !== "string") throw new Error("stored wallet-key lock is missing wallet key");
-			return {
-				lockKey: row.lock_key,
-				lockKind,
-				walletKeyId: requireId(parseWalletKeyId, row.wallet_key_id, "stored wallet key"),
-				lockId: row.lock_id,
-				acquiredAtMs,
-				expiresAtMs
-			};
-		}
-		if (typeof row.enrollment_id !== "string") throw new Error("stored enrollment lock is missing enrollment");
-		return {
-			lockKey: row.lock_key,
-			lockKind,
-			enrollmentId: requireId(parseLaneEnrollmentId, row.enrollment_id, "stored enrollment"),
-			lockId: row.lock_id,
-			acquiredAtMs,
-			expiresAtMs
-		};
-	}
-};
-function requireId(parser, raw, label) {
-	const result = parser(raw);
-	if (!result.ok) throw new Error(`${label} is invalid: ${result.error.message}`);
-	return result.value;
-}
-//#endregion
-export { CloudflareD1LaneLockStore };
-
-//# sourceMappingURL=d1LaneLockStore.js.map

package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneProtocolCommitter.js

@@ -1,16 +0,0 @@
-import { CloudflareD1LaneLifecycleStore } from "./d1LaneLifecycleStore.js";
-import { CloudflareD1LaneEnrollmentGateway } from "./d1LaneEnrollmentGateway.js";
-import { CloudflareLaneProtocolCommitterV1 } from "../../signingLanes/cloudflareLaneProtocolCommitter.js";
-//#region src/router/cloudflare/d1/signingLanes/d1LaneProtocolCommitter.ts
-function createCloudflareD1LaneProtocolCommitterV1(options) {
-	return new CloudflareLaneProtocolCommitterV1({
-		gateway: new CloudflareD1LaneEnrollmentGateway({ lifecycleStore: new CloudflareD1LaneLifecycleStore(options) }),
-		authorization: options.authorization,
-		execution: options.execution,
-		ed25519Transport: options.ed25519Transport
-	});
-}
-//#endregion
-export { createCloudflareD1LaneProtocolCommitterV1 };
-
-//# sourceMappingURL=d1LaneProtocolCommitter.js.map

package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneRecords.js

@@ -1,171 +0,0 @@
-import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
-import { isD1DatabaseLike, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
-import { parseAggregateLaneActivationReceiptV1, parseAggregateLaneRevocationReceiptV1, parseLaneEnrollmentLifecycleV1, parseLaneEnrollmentManifestV1, parseLaneHolderDeliveryReceiptV1, parseLaneProductEpochRecordV1, parseLaneProtocolCommitReceiptV1, parseLaneProtocolLifecycleV1, parseLaneServerActivationReceiptV1, parseLaneServerRetirementReceiptV1 } from "../../../../shared-ts/src/signing-lanes/rotationParsers.js";
-import { parseLaneProtocolJobV1 } from "../../../../shared-ts/src/signing-lanes/rotationProtocolParsers.js";
-//#region src/router/cloudflare/d1/signingLanes/d1LaneRecords.ts
-function requireD1LaneStoreOptions(input) {
-	if (!isD1DatabaseLike(input.database)) throw new Error("R102 lane D1 database is required");
-	return {
-		database: input.database,
-		scope: normalizeScope(input.scope),
-		now: input.now ?? Date.now
-	};
-}
-function normalizeScope(scope) {
-	return {
-		namespace: requiredScopeString(scope.namespace, "namespace"),
-		orgId: requiredScopeString(scope.orgId, "orgId"),
-		projectId: requiredScopeString(scope.projectId, "projectId"),
-		envId: requiredScopeString(scope.envId, "envId")
-	};
-}
-function requiredScopeString(value, label) {
-	const normalized = value.trim();
-	if (!normalized) throw new Error(`R102 lane ${label} is required`);
-	if (hasControlCharacter(normalized)) throw new Error(`R102 lane ${label} contains control characters`);
-	return normalized;
-}
-function hasControlCharacter(value) {
-	for (const character of value) {
-		const code = character.charCodeAt(0);
-		if (code <= 31 || code === 127) return true;
-	}
-	return false;
-}
-function parseVersion(value, label) {
-	const version = typeof value === "number" ? value : Number(value);
-	if (!Number.isSafeInteger(version) || version < 1) throw new Error(`${label} is invalid`);
-	return version;
-}
-function parseTimestamp(value, label) {
-	const timestamp = typeof value === "number" ? value : Number(value);
-	if (!Number.isSafeInteger(timestamp) || timestamp < 0) throw new Error(`${label} is invalid`);
-	return timestamp;
-}
-function parseRequiredString(value, label) {
-	if (typeof value !== "string" || !value.trim()) throw new Error(`${label} is invalid`);
-	return value;
-}
-function parseJsonRecord(value, label) {
-	const parsed = parseD1JsonColumn(value);
-	if (!isJsonRecord(parsed)) throw new Error(`${label} must be a JSON object`);
-	return parsed;
-}
-function isJsonRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-/** Compare parsed JSON records without relying on insertion order. */
-function equalLaneRecords(left, right) {
-	if (Object.is(left, right)) return true;
-	if (left === null || right === null || typeof left !== typeof right) return false;
-	if (Array.isArray(left) || Array.isArray(right)) {
-		if (!Array.isArray(left) || !Array.isArray(right) || left.length !== right.length) return false;
-		for (let index = 0; index < left.length; index += 1) if (!equalLaneRecords(left[index], right[index])) return false;
-		return true;
-	}
-	if (isJsonRecord(left) && isJsonRecord(right)) {
-		const leftKeys = Object.keys(left).sort();
-		const rightKeys = Object.keys(right).sort();
-		if (leftKeys.length !== rightKeys.length) return false;
-		for (let index = 0; index < leftKeys.length; index += 1) {
-			const key = leftKeys[index];
-			if (key !== rightKeys[index] || !equalLaneRecords(left[key], right[key])) return false;
-		}
-		return true;
-	}
-	return false;
-}
-function parseEnrollmentRow(row) {
-	return {
-		enrollmentId: parseRequiredString(row.enrollment_id, "enrollment_id"),
-		walletId: parseRequiredString(row.wallet_id, "wallet_id"),
-		manifestDigestB64u: parseRequiredString(row.manifest_digest_b64u, "manifest_digest_b64u"),
-		manifest: parseLaneEnrollmentManifestV1(parseJsonRecord(row.manifest_json, "lane enrollment manifest"), "lane enrollment manifest"),
-		lifecycle: parseLaneEnrollmentLifecycleV1(parseJsonRecord(row.lifecycle_json, "lane enrollment lifecycle"), "lane enrollment lifecycle"),
-		version: parseVersion(row.version, "enrollment version"),
-		commandDigestB64u: parseRequiredString(row.command_digest_b64u, "command_digest_b64u"),
-		createdAtMs: parseTimestamp(row.created_at_ms, "enrollment created_at_ms"),
-		updatedAtMs: parseTimestamp(row.updated_at_ms, "enrollment updated_at_ms")
-	};
-}
-function parseProtocolRow(row) {
-	const job = parseLaneProtocolJobV1(parseJsonRecord(row.job_json, "lane protocol job"), "lane protocol job");
-	const lifecycle = parseLaneProtocolLifecycleV1(parseJsonRecord(row.lifecycle_json, "lane protocol lifecycle"), "lane protocol lifecycle");
-	return {
-		operationId: parseRequiredString(row.operation_id, "operation_id"),
-		enrollmentId: parseRequiredString(row.enrollment_id, "enrollment_id"),
-		walletId: parseRequiredString(row.wallet_id, "wallet_id"),
-		walletKeyId: parseRequiredString(row.wallet_key_id, "wallet_key_id"),
-		sourceLaneId: parseRequiredString(row.source_lane_id, "source_lane_id"),
-		sourceLaneShareEpoch: parseRequiredString(row.source_lane_share_epoch, "source_lane_share_epoch"),
-		sourceRevocationEpoch: parseTimestamp(row.source_revocation_epoch, "source_revocation_epoch"),
-		targetLaneId: parseRequiredString(row.target_lane_id, "target_lane_id"),
-		targetLaneShareEpoch: parseRequiredString(row.target_lane_share_epoch, "target_lane_share_epoch"),
-		targetMaterialActivationId: parseRequiredString(row.target_material_activation_id, "target_material_activation_id"),
-		record: {
-			job,
-			lifecycle
-		},
-		version: parseVersion(row.version, "protocol version"),
-		commandDigestB64u: parseRequiredString(row.command_digest_b64u, "command_digest_b64u"),
-		createdAtMs: parseTimestamp(row.created_at_ms, "protocol created_at_ms"),
-		updatedAtMs: parseTimestamp(row.updated_at_ms, "protocol updated_at_ms")
-	};
-}
-function parseProductEpochRow(row) {
-	return parseLaneProductEpochRecordV1(parseJsonRecord(row.product_json, "lane product epoch"), "lane product epoch");
-}
-function parseReceiptRow(row) {
-	const receiptKind = parseRequiredString(row.receipt_kind, "receipt_kind");
-	const raw = row.receipt_json;
-	const value = (() => {
-		switch (receiptKind) {
-			case "lane_protocol_commit": return parseLaneProtocolCommitReceiptV1(parseJsonRecord(raw, "lane protocol commit receipt"));
-			case "lane_holder_delivery": return parseLaneHolderDeliveryReceiptV1(parseJsonRecord(raw, "lane holder delivery receipt"));
-			case "lane_server_activation": return parseLaneServerActivationReceiptV1(parseJsonRecord(raw, "lane server activation receipt"));
-			case "ecdsa_server_retirement": return parseLaneServerRetirementReceiptV1(parseJsonRecord(raw, "ECDSA server retirement receipt"));
-			case "ed25519_server_retirement": return parseLaneServerRetirementReceiptV1(parseJsonRecord(raw, "Ed25519 server retirement receipt"));
-			case "aggregate_activation": return parseAggregateLaneActivationReceiptV1(parseJsonRecord(raw, "aggregate lane activation receipt"));
-			case "aggregate_revocation": return parseAggregateLaneRevocationReceiptV1(parseJsonRecord(raw, "aggregate lane revocation receipt"));
-			default: throw new Error(`unknown R102 receipt kind ${receiptKind}`);
-		}
-	})();
-	return {
-		receiptId: parseRequiredString(row.receipt_id, "receipt_id"),
-		receiptKind,
-		receiptDigestB64u: parseRequiredString(row.receipt_digest_b64u, "receipt_digest_b64u"),
-		value
-	};
-}
-async function digestLaneEnrollmentRevocationCommand(input) {
-	return base64UrlEncode(await sha256BytesUtf8([
-		"seams/rotatable-signing-lanes/revoke-enrollment/v1",
-		String(input.enrollmentId),
-		String(input.walletId),
-		input.manifestDigestB64u,
-		input.reason,
-		String(input.requestedAtMs)
-	].join("\0")));
-}
-function scopeValues(scope) {
-	return [
-		scope.namespace,
-		scope.orgId,
-		scope.projectId,
-		scope.envId
-	];
-}
-function firstBatchResult(results, index) {
-	const result = results[index];
-	if (!result || typeof result !== "object") throw new Error(`R102 lane D1 batch result ${index} is invalid`);
-	return result;
-}
-const LANE_CAS_GUARD_SQL = "INSERT INTO lane_cas_guard (guard_id) SELECT 1 WHERE changes() = 0";
-function assertD1Success(result, label) {
-	if (result.success === false) throw new Error(`${label} failed`);
-}
-//#endregion
-export { LANE_CAS_GUARD_SQL, assertD1Success, digestLaneEnrollmentRevocationCommand, equalLaneRecords, firstBatchResult, normalizeScope, parseEnrollmentRow, parseJsonRecord, parseProductEpochRow, parseProtocolRow, parseReceiptRow, parseRequiredString, parseTimestamp, parseVersion, requireD1LaneStoreOptions, scopeValues };
-
-//# sourceMappingURL=d1LaneRecords.js.map

package/dist/esm/router/cloudflare/d1/signingLanes/index.js

@@ -1,10 +0,0 @@
-import { LANE_CAS_GUARD_SQL, assertD1Success, digestLaneEnrollmentRevocationCommand, equalLaneRecords, firstBatchResult, normalizeScope, parseEnrollmentRow, parseJsonRecord, parseProductEpochRow, parseProtocolRow, parseReceiptRow, parseRequiredString, parseTimestamp, parseVersion, requireD1LaneStoreOptions, scopeValues } from "./d1LaneRecords.js";
-import { CloudflareD1LaneLifecycleStore } from "./d1LaneLifecycleStore.js";
-import { createCloudflareD1EcdsaLanePrivateBindingResolverV1 } from "./d1EcdsaLanePrivateBindingResolver.js";
-import { CloudflareD1LaneEffectJournalStore } from "./d1LaneEffectJournalStore.js";
-import { CloudflareD1LaneLockStore } from "./d1LaneLockStore.js";
-import { CloudflareD1LaneEnrollmentGateway } from "./d1LaneEnrollmentGateway.js";
-import { createCloudflareD1LaneLifecycleApplicationService } from "./d1LaneLifecycleApplicationService.js";
-import { createCloudflareD1LaneAggregateRevocationApplicationService } from "./d1LaneAggregateRevocationApplicationService.js";
-import { createCloudflareD1LaneProtocolCommitterV1 } from "./d1LaneProtocolCommitter.js";
-export { CloudflareD1LaneEffectJournalStore, CloudflareD1LaneEnrollmentGateway, CloudflareD1LaneLifecycleStore, CloudflareD1LaneLockStore, LANE_CAS_GUARD_SQL, assertD1Success, createCloudflareD1EcdsaLanePrivateBindingResolverV1, createCloudflareD1LaneAggregateRevocationApplicationService, createCloudflareD1LaneLifecycleApplicationService, createCloudflareD1LaneProtocolCommitterV1, digestLaneEnrollmentRevocationCommand, equalLaneRecords, firstBatchResult, normalizeScope, parseEnrollmentRow, parseJsonRecord, parseProductEpochRow, parseProtocolRow, parseReceiptRow, parseRequiredString, parseTimestamp, parseVersion, requireD1LaneStoreOptions, scopeValues };