@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/router/cloudflare/durableObjects/thresholdStore.js

@@ -1,397 +0,0 @@
-import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
-import { failure } from "../../../shared-ts/src/utils/failure.js";
-import { EXPORT_REPLAY_GUARD_CLOCK_SKEW_MS, EXPORT_REPLAY_GUARD_MIN_RETENTION_MS } from "../../../core/ThresholdService/stores/exportReplayGuard.js";
-//#region src/router/cloudflare/durableObjects/thresholdStore.ts
-const ECDSA_SHARED_IDENTITY_CONFLICT_MESSAGE = "[threshold-ecdsa] EVM-family key identity already exists for wallet/subject/rp/signing root";
-const ECDSA_KEY_HANDLE_CONFLICT_MESSAGE = "[threshold-ecdsa] ECDSA key handle already exists in this namespace";
-function json(body, init) {
-	return new Response(JSON.stringify(body), {
-		status: init?.status ?? 200,
-		headers: {
-			"content-type": "application/json; charset=utf-8",
-			...init?.headers || {}
-		}
-	});
-}
-function ok(value) {
-	return {
-		ok: true,
-		value
-	};
-}
-function toKey(input) {
-	return typeof input === "string" ? input.trim() : "";
-}
-function toTtlSeconds(ttlMs) {
-	if (ttlMs === void 0 || ttlMs === null) return null;
-	const n = Number(ttlMs);
-	if (!Number.isFinite(n) || n <= 0) return null;
-	return Math.max(1, Math.ceil(n / 1e3));
-}
-function jsonValueContains(actual, expected) {
-	if (Array.isArray(expected)) return Array.isArray(actual) && actual.length === expected.length && expected.every((value, index) => jsonValueContains(actual[index], value));
-	if (isPlainObject(expected)) {
-		if (!isPlainObject(actual)) return false;
-		return Object.entries(expected).every(([key, value]) => jsonValueContains(actual[key], value));
-	}
-	return Object.is(actual, expected);
-}
-function stableStoreVersion(value) {
-	return JSON.stringify(value);
-}
-function isJsonValue(value) {
-	if (value === null || typeof value === "string" || typeof value === "boolean") return true;
-	if (typeof value === "number") return Number.isFinite(value);
-	if (Array.isArray(value)) return value.every((entry) => isJsonValue(entry));
-	if (!isPlainObject(value)) return false;
-	return Object.values(value).every((entry) => isJsonValue(entry));
-}
-function isVersionedJsonRecordEnvelope(value) {
-	return isPlainObject(value) && value.kind === "cloudflare_versioned_json_record_v1" && typeof value.version === "string" && value.version.length > 0 && isJsonValue(value.value);
-}
-function newVersionedJsonRecordVersion() {
-	const version = crypto.randomUUID();
-	if (!version) throw new Error("Unable to create versioned JSON record version");
-	return version;
-}
-function parseAuthEntry(raw) {
-	if (!isPlainObject(raw)) return null;
-	const record = raw.record;
-	const remainingUses = raw.remainingUses;
-	const expiresAtMs = raw.expiresAtMs;
-	if (!isPlainObject(record)) return null;
-	if (typeof remainingUses !== "number" || !Number.isFinite(remainingUses)) return null;
-	if (typeof expiresAtMs !== "number" || !Number.isFinite(expiresAtMs)) return null;
-	const rec = record;
-	if (typeof rec.expiresAtMs !== "number" || !Number.isFinite(rec.expiresAtMs)) return null;
-	if (rec.participantIds !== void 0 && !Array.isArray(rec.participantIds)) return null;
-	if (typeof rec.relayerKeyId !== "string") return null;
-	return raw;
-}
-async function withTxn(state, fn) {
-	if (typeof state.storage.transaction === "function") return await state.storage.transaction(fn);
-	return await fn(state.storage);
-}
-async function withRequiredTxn(state, operation) {
-	if (typeof state.storage.transaction !== "function") throw new Error("Registration wallet lifecycle requires transactional Durable Object storage");
-	return await state.storage.transaction(operation);
-}
-function registrationCeremonyIdentityMatches(input) {
-	if (!isPlainObject(input.raw)) return false;
-	if (toKey(input.raw.registrationCeremonyId) !== input.registrationCeremonyId) return false;
-	if (!isPlainObject(input.raw.intent)) return false;
-	return toKey(input.raw.intent.walletId) === input.walletId;
-}
-var ThresholdStoreDurableObject = class {
-	constructor(state, _env) {
-		this.state = state;
-	}
-	async fetch(request) {
-		if (request.method.toUpperCase() !== "POST") return json(failure("method_not_allowed", "POST required"), { status: 405 });
-		let body;
-		try {
-			body = await request.json();
-		} catch {
-			body = null;
-		}
-		if (!isPlainObject(body)) return json(failure("invalid_body", "Expected JSON object"));
-		const op = body.op;
-		if (typeof op !== "string") return json(failure("invalid_body", "Missing op"));
-		const req = body;
-		if (op === "get") {
-			const key = toKey(req.key);
-			if (!key) return json(failure("invalid_body", "Missing key"));
-			return json(ok(await this.state.storage.get(key) ?? null));
-		}
-		if (op === "readVersioned") {
-			const key = toKey(req.key);
-			if (!key) return json(failure("invalid_body", "Missing key"));
-			const value = await this.state.storage.get(key);
-			if (value === null || value === void 0) return json(ok(null));
-			return json(ok({
-				value,
-				version: stableStoreVersion(value)
-			}));
-		}
-		if (op === "readVersionedJson") {
-			const key = toKey(req.key);
-			if (!key) return json(failure("invalid_body", "Missing key"));
-			const stored = await this.state.storage.get(key);
-			if (stored === null || stored === void 0) return json(ok({ status: "missing" }));
-			if (!isVersionedJsonRecordEnvelope(stored)) return json(ok({ status: "invalid_record" }));
-			return json(ok({
-				status: "present",
-				value: stored.value,
-				version: stored.version
-			}));
-		}
-		if (op === "putVersionedJson") {
-			const key = toKey(req.key);
-			if (!key) return json(failure("invalid_body", "Missing key"));
-			const expectedVersion = req.expectedVersion;
-			if (expectedVersion !== null && typeof expectedVersion !== "string") return json(failure("invalid_body", "expectedVersion must be null or a non-empty string"));
-			if (typeof expectedVersion === "string" && !toKey(expectedVersion)) return json(failure("invalid_body", "expectedVersion must be null or a non-empty string"));
-			const value = req.value;
-			if (!isJsonValue(value)) return json(failure("invalid_body", "value must be JSON serializable"));
-			const ttl = toTtlSeconds(req.ttlMs);
-			return json(ok(await withRequiredTxn(this.state, async (store) => {
-				const current = await store.get(key);
-				if (current === null || current === void 0) {
-					if (expectedVersion !== null) return { status: "version_mismatch" };
-				} else {
-					if (!isVersionedJsonRecordEnvelope(current)) return { status: "invalid_record" };
-					if (expectedVersion !== current.version) return { status: "version_mismatch" };
-				}
-				const version = newVersionedJsonRecordVersion();
-				await store.put(key, {
-					kind: "cloudflare_versioned_json_record_v1",
-					version,
-					value
-				}, ttl ? { expirationTtl: ttl } : void 0);
-				return {
-					status: "stored",
-					version
-				};
-			})));
-		}
-		if (op === "set") {
-			const key = toKey(req.key);
-			if (!key) return json(failure("invalid_body", "Missing key"));
-			const ttl = toTtlSeconds(req.ttlMs);
-			await this.state.storage.put(key, req.value, ttl ? { expirationTtl: ttl } : void 0);
-			return json(ok(true));
-		}
-		if (op === "claimVersioned") {
-			const key = toKey(req.key);
-			const expectedVersion = toKey(req.expectedVersion);
-			if (!key) return json(failure("invalid_body", "Missing key"));
-			if (!expectedVersion) return json(failure("invalid_body", "Missing expectedVersion"));
-			return json(ok(await withTxn(this.state, async (store) => {
-				const value = await store.get(key);
-				if (value === null || value === void 0) return { status: "not_found" };
-				const expiresAtMs = isPlainObject(value) && typeof value.expiresAtMs === "number" ? value.expiresAtMs : NaN;
-				if (Number.isFinite(expiresAtMs) && expiresAtMs <= Date.now()) {
-					await store.delete(key);
-					return { status: "expired" };
-				}
-				if (stableStoreVersion(value) !== expectedVersion) return { status: "version_mismatch" };
-				await store.delete(key);
-				return {
-					status: "ok",
-					value
-				};
-			})));
-		}
-		if (op === "setWithIdentityGuard") {
-			const key = toKey(req.key);
-			const identityKey = toKey(req.identityKey);
-			const identityValue = toKey(req.identityValue);
-			const keyHandleKey = toKey(req.keyHandleKey);
-			const keyHandleValue = toKey(req.keyHandleValue);
-			if (!key) return json(failure("invalid_body", "Missing key"));
-			if (!identityKey) return json(failure("invalid_body", "Missing identityKey"));
-			if (!identityValue) return json(failure("invalid_body", "Missing identityValue"));
-			if (!keyHandleKey) return json(failure("invalid_body", "Missing keyHandleKey"));
-			if (!keyHandleValue) return json(failure("invalid_body", "Missing keyHandleValue"));
-			const ttl = toTtlSeconds(req.ttlMs);
-			return json(await withTxn(this.state, async (store) => {
-				const existing = await store.get(identityKey);
-				if (existing !== null && existing !== void 0 && existing !== identityValue) return failure("conflict", ECDSA_SHARED_IDENTITY_CONFLICT_MESSAGE);
-				const existingKeyHandle = await store.get(keyHandleKey);
-				if (existingKeyHandle !== null && existingKeyHandle !== void 0 && existingKeyHandle !== keyHandleValue) return failure("conflict", ECDSA_KEY_HANDLE_CONFLICT_MESSAGE);
-				await store.put(key, req.value, ttl ? { expirationTtl: ttl } : void 0);
-				await store.put(identityKey, identityValue);
-				await store.put(keyHandleKey, keyHandleValue);
-				return ok(true);
-			}));
-		}
-		if (op === "del") {
-			const key = toKey(req.key);
-			if (!key) return json(failure("invalid_body", "Missing key"));
-			return json(ok(await this.state.storage.delete(key)));
-		}
-		if (op === "delWithIdentityGuard") {
-			const key = toKey(req.key);
-			const identityKey = toKey(req.identityKey);
-			const identityValue = toKey(req.identityValue);
-			const keyHandleKey = toKey(req.keyHandleKey);
-			const keyHandleValue = toKey(req.keyHandleValue);
-			if (!key) return json(failure("invalid_body", "Missing key"));
-			if (!identityKey) return json(failure("invalid_body", "Missing identityKey"));
-			if (!identityValue) return json(failure("invalid_body", "Missing identityValue"));
-			if (!keyHandleKey) return json(failure("invalid_body", "Missing keyHandleKey"));
-			if (!keyHandleValue) return json(failure("invalid_body", "Missing keyHandleValue"));
-			await withTxn(this.state, async (store) => {
-				await store.delete(key);
-				if (await store.get(identityKey) === identityValue) await store.delete(identityKey);
-				if (await store.get(keyHandleKey) === keyHandleValue) await store.delete(keyHandleKey);
-			});
-			return json(ok(true));
-		}
-		if (op === "getdel") {
-			const key = toKey(req.key);
-			if (!key) return json(failure("invalid_body", "Missing key"));
-			return json(ok(await withTxn(this.state, async (store) => {
-				const v = await store.get(key);
-				await store.delete(key);
-				return v ?? null;
-			})));
-		}
-		if (op === "getdelIfRelatedMatches") {
-			const key = toKey(req.key);
-			const relatedKey = toKey(req.relatedKey);
-			if (!key) return json(failure("invalid_body", "Missing key"));
-			if (!relatedKey) return json(failure("invalid_body", "Missing relatedKey"));
-			const expectedRelated = req.expectedRelated;
-			return json(ok(await withTxn(this.state, async (store) => {
-				if (!jsonValueContains(await store.get(relatedKey), expectedRelated)) return {
-					matched: false,
-					value: null
-				};
-				const v = await store.get(key);
-				await store.delete(key);
-				return {
-					matched: true,
-					value: v ?? null
-				};
-			})));
-		}
-		if (op === "walletTakeEcdsaPendingSessionActivationPair") {
-			const recoveryKey = toKey(req.recoveryKey);
-			const refreshKey = toKey(req.refreshKey);
-			if (!recoveryKey) return json(failure("invalid_body", "Missing recoveryKey"));
-			if (!refreshKey) return json(failure("invalid_body", "Missing refreshKey"));
-			if (recoveryKey === refreshKey) return json(failure("invalid_body", "Recovery and refresh keys must be distinct"));
-			return json(ok(await withRequiredTxn(this.state, async (store) => {
-				const recovery = await store.get(recoveryKey);
-				const refresh = await store.get(refreshKey);
-				if (recovery === null || recovery === void 0 || refresh === null || refresh === void 0) return null;
-				await store.delete(recoveryKey);
-				await store.delete(refreshKey);
-				return {
-					recovery,
-					refresh
-				};
-			})));
-		}
-		if (op === "registrationCancelTerminal") {
-			const ceremonyKey = toKey(req.ceremonyKey);
-			const registrationCeremonyId = toKey(req.registrationCeremonyId);
-			const walletId = toKey(req.walletId);
-			if (!ceremonyKey) return json(failure("invalid_body", "Missing terminal registration ceremony key"));
-			if (!registrationCeremonyId) return json(failure("invalid_body", "Missing terminal registration ceremony ID"));
-			if (!walletId) return json(failure("invalid_body", "Missing terminal registration walletId"));
-			return json(await withRequiredTxn(this.state, async (store) => {
-				const ceremony = await store.get(ceremonyKey);
-				if (ceremony === null || ceremony === void 0) return ok({
-					kind: "not_found",
-					ceremonyDeleted: false
-				});
-				if (!registrationCeremonyIdentityMatches({
-					raw: ceremony,
-					registrationCeremonyId,
-					walletId
-				})) return failure("registration_ceremony_identity_mismatch", "Terminal registration cancellation does not match the stored ceremony");
-				await store.delete(ceremonyKey);
-				return ok({
-					kind: "cancelled",
-					ceremonyDeleted: true
-				});
-			}));
-		}
-		if (op === "authConsumeUseCount") {
-			const key = toKey(req.key);
-			if (!key) return json(failure("invalid_body", "Missing key"));
-			return json(await withTxn(this.state, async (store) => {
-				const entry = parseAuthEntry(await store.get(key));
-				if (!entry) return failure("wallet_session_missing", "Wallet Session is missing");
-				if (entry.expiresAtMs <= Date.now()) {
-					await store.delete(key);
-					return failure("wallet_session_expired", "Wallet Session expired");
-				}
-				if (entry.remainingUses <= 0) return failure("wallet_budget_exhausted", "Wallet Session exhausted");
-				entry.remainingUses -= 1;
-				const ttlSeconds = Math.max(1, Math.ceil(Math.max(0, entry.expiresAtMs - Date.now()) / 1e3));
-				await store.put(key, entry, { expirationTtl: ttlSeconds });
-				return ok({ remainingUses: entry.remainingUses });
-			}));
-		}
-		if (op === "authConsumeUseCountOnce") {
-			const key = toKey(req.key);
-			const idempotencyKey = toKey(req.idempotencyKey);
-			if (!key) return json(failure("invalid_body", "Missing key"));
-			if (!idempotencyKey) return json(failure("invalid_body", "Missing idempotencyKey"));
-			return json(await withTxn(this.state, async (store) => {
-				const entry = parseAuthEntry(await store.get(key));
-				if (!entry) return failure("wallet_session_missing", "Wallet Session is missing");
-				if (entry.expiresAtMs <= Date.now()) {
-					await store.delete(key);
-					return failure("wallet_session_expired", "Wallet Session expired");
-				}
-				const consumedIdempotencyKeys = entry.consumedIdempotencyKeys || {};
-				if (consumedIdempotencyKeys[idempotencyKey]) return ok({ remainingUses: entry.remainingUses });
-				if (entry.remainingUses <= 0) return failure("wallet_budget_exhausted", "Wallet Session exhausted");
-				entry.remainingUses -= 1;
-				entry.consumedIdempotencyKeys = {
-					...consumedIdempotencyKeys,
-					[idempotencyKey]: true
-				};
-				const ttlSeconds = Math.max(1, Math.ceil(Math.max(0, entry.expiresAtMs - Date.now()) / 1e3));
-				await store.put(key, entry, { expirationTtl: ttlSeconds });
-				return ok({ remainingUses: entry.remainingUses });
-			}));
-		}
-		if (op === "authHasConsumedUseCountOnce") {
-			const key = toKey(req.key);
-			const idempotencyKey = toKey(req.idempotencyKey);
-			if (!key) return json(failure("invalid_body", "Missing key"));
-			if (!idempotencyKey) return json(failure("invalid_body", "Missing idempotencyKey"));
-			return json(await withTxn(this.state, async (store) => {
-				const entry = parseAuthEntry(await store.get(key));
-				if (!entry) return failure("wallet_session_missing", "Wallet Session is missing");
-				if (entry.expiresAtMs <= Date.now()) {
-					await store.delete(key);
-					return failure("wallet_session_expired", "Wallet Session expired");
-				}
-				return ok({ consumed: (entry.consumedIdempotencyKeys || {})[idempotencyKey] === true });
-			}));
-		}
-		if (op === "authGetSessionStatus") {
-			const key = toKey(req.key);
-			if (!key) return json(failure("invalid_body", "Missing key"));
-			const entry = parseAuthEntry(await this.state.storage.get(key));
-			if (!entry) return json(failure("wallet_session_missing", "Wallet Session is missing"));
-			if (entry.expiresAtMs <= Date.now()) {
-				await this.state.storage.delete(key);
-				return json(failure("wallet_session_expired", "Wallet Session expired"));
-			}
-			return json(ok({
-				record: entry.record,
-				expiresAtMs: entry.expiresAtMs,
-				remainingUses: entry.remainingUses
-			}));
-		}
-		if (op === "authReserveReplayGuard") {
-			const key = toKey(req.key);
-			const expiresAtMs = Number(req.expiresAtMs);
-			if (!key) return json(failure("invalid_body", "Missing key"));
-			if (!Number.isFinite(expiresAtMs)) return json(failure("invalid_body", "Invalid expiresAtMs"));
-			return json(await withTxn(this.state, async (store) => {
-				const nowMs = Date.now();
-				if (expiresAtMs <= nowMs) return failure("export_authorization_expired", "Export authorization expired");
-				const raw = await store.get(key);
-				const existingExpiresAtMs = raw && typeof raw === "object" && "expiresAtMs" in raw ? Number(raw.expiresAtMs) : NaN;
-				if (Number.isFinite(existingExpiresAtMs) && existingExpiresAtMs > nowMs) return failure("export_nonce_replay", "Export authorization nonce already used");
-				const retainedUntilMs = Math.max(nowMs + EXPORT_REPLAY_GUARD_MIN_RETENTION_MS, expiresAtMs + EXPORT_REPLAY_GUARD_CLOCK_SKEW_MS);
-				const ttlSeconds = Math.max(1, Math.ceil((retainedUntilMs - nowMs) / 1e3));
-				await store.put(key, { expiresAtMs: retainedUntilMs }, { expirationTtl: ttlSeconds });
-				return ok({ reserved: true });
-			}));
-		}
-		return json(failure("invalid_body", `Unknown op: ${op}`));
-	}
-};
-//#endregion
-export { ThresholdStoreDurableObject };
-
-//# sourceMappingURL=thresholdStore.js.map