@tatchi-xyz/sdk 0.20.0 → 0.31.0

package/dist/cjs/server/core/SessionService.js.map

@@ -1 +1 @@
-{"version":3,"file":"SessionService.js","names":["token: string | null","payload: any","e: any"],"sources":["../../../../src/server/core/SessionService.ts"],"sourcesContent":["\nexport interface SessionConfig {\n  jwt?: {\n    /** Required: JWT signing hook; return a complete token */\n    signToken?: (input: { header: Record<string, unknown>; payload: Record<string, unknown> }) => Promise<string> | string;\n    /** Required: JWT verification hook */\n    verifyToken?: (token: string) => Promise<{ valid: boolean; payload?: any }> | { valid: boolean; payload?: any };\n    /** Optional: sliding refresh window (seconds) to allow /session/refresh before exp, default 900 (15 min) */\n    refreshWindowSec?: number;\n    /** Optional: build additional claims to include in the payload */\n    buildClaims?: (input: { sub: string; context?: Record<string, unknown> }) => Promise<Record<string, unknown> | void> | Record<string, unknown> | void;\n  };\n  cookie?: {\n    /** Cookie name. Default: 'w3a_session' */\n    name?: string;\n    /** Optional override: build Set-Cookie header for a new token */\n    buildSetHeader?: (token: string) => string;\n    /** Optional override: build Set-Cookie header that clears the cookie */\n    buildClearHeader?: () => string;\n    /** Optional override: extract token from headers (Authorization/Cookie) */\n    extractToken?: (headers: Record<string, string | string[] | undefined>, cookieName: string) => string | null;\n  };\n}\n\nexport class SessionService<TClaims = any> {\n  private cfg: NonNullable<SessionConfig>;\n\n  constructor(cfg: NonNullable<SessionConfig>) {\n    this.cfg = cfg || ({} as any);\n  }\n\n  getCookieName(): string {\n    return this.cfg?.cookie?.name || 'w3a_session';\n  }\n\n  buildSetCookie(token: string): string {\n    if (this.cfg?.cookie?.buildSetHeader) return this.cfg.cookie.buildSetHeader(token);\n    const name = this.getCookieName();\n    const cookieParts = [`${name}=${token}`];\n    const path = '/';\n    const httpOnly = true;\n    const secure = true; // default secure\n    const sameSite = 'Lax';\n    const maxAge = 24 * 3600; // 1 day default\n    cookieParts.push(`Path=${path}`);\n    if (httpOnly) cookieParts.push('HttpOnly');\n    if (secure) cookieParts.push('Secure');\n    if (sameSite) cookieParts.push(`SameSite=${sameSite}`);\n    if (maxAge) {\n      cookieParts.push(`Max-Age=${maxAge}`);\n      const expires = new Date(Date.now() + (maxAge * 1000)).toUTCString();\n      cookieParts.push(`Expires=${expires}`);\n    }\n    return cookieParts.join('; ');\n  }\n\n  buildClearCookie(): string {\n    if (this.cfg?.cookie?.buildClearHeader) return this.cfg.cookie.buildClearHeader();\n    const name = this.getCookieName();\n    const path = '/';\n    const secure = true;\n    const httpOnly = true;\n    const parts = [\n      `${name}=`,\n      `Path=${path}`,\n      'Max-Age=0',\n      'Expires=Thu, 01 Jan 1970 00:00:00 GMT'\n    ];\n    if (httpOnly) parts.push('HttpOnly');\n    if (secure) parts.push('Secure');\n    const sameSite = 'Lax';\n    if (sameSite) parts.push(`SameSite=${sameSite}`);\n    return parts.join('; ');\n  }\n\n  /** Sign a JWT with configured algorithm. Adds iat/exp and copies iss/aud. */\n  async signJwt(sub: string, extraClaims?: Record<string, unknown>): Promise<string> {\n    const jwt = this.cfg?.jwt || {};\n    const built = await Promise.resolve(jwt.buildClaims?.({ sub, context: extraClaims })) || {};\n    const payload = { sub, ...(extraClaims || {}), ...(built || {}) } as Record<string, unknown>;\n    if (typeof jwt.signToken === 'function') {\n      // Full override of signing: user supplies the complete token\n      const token = await Promise.resolve(jwt.signToken({ header: { typ: 'JWT' }, payload } as any));\n      return token;\n    }\n    throw new Error('SessionService: No JWT signing hook or provider configured');\n  }\n\n  /** Verify signature and expiration. Returns payload on success. */\n  async verifyJwt(token: string): Promise<{ valid: boolean; payload?: any }> {\n    const verify = this.cfg?.jwt?.verifyToken;\n    if (typeof verify !== 'function') return { valid: false };\n    return await Promise.resolve(verify(token));\n  }\n\n  parse(headers: Record<string, string | string[] | undefined>): Promise<{ ok: boolean; claims?: TClaims } | { ok: false }>{\n    const authHeader = (headers['authorization'] || headers['Authorization']) as string | undefined;\n    let token: string | null = null;\n    if (authHeader && /^Bearer\\s+/.test(authHeader)) token = authHeader.replace(/^Bearer\\s+/i, '').trim();\n    const cookieHeader = (headers['cookie'] || headers['Cookie']) as string | undefined;\n    if (!token && cookieHeader) {\n      const name = this.getCookieName();\n      for (const part of cookieHeader.split(';')) {\n        const [k, v] = part.split('=');\n        if (k && k.trim() === name) { token = (v || '').trim(); break; }\n      }\n    }\n    if (!token) return Promise.resolve({ ok: false });\n    return this.verifyJwt(token).then(v => v.valid ? { ok: true, claims: v.payload as TClaims } : { ok: false });\n  }\n\n  // === token helpers ===\n  extractTokenFromHeaders(headers: Record<string, string | string[] | undefined>): string | null {\n    if (this.cfg?.cookie?.extractToken) return this.cfg.cookie.extractToken(headers, this.getCookieName());\n    const authHeader = (headers['authorization'] || headers['Authorization']) as string | undefined;\n    if (authHeader && /^Bearer\\s+/.test(authHeader)) return authHeader.replace(/^Bearer\\s+/i, '').trim();\n    const cookieHeader = (headers['cookie'] || headers['Cookie']) as string | undefined;\n    if (cookieHeader) {\n      const name = this.getCookieName();\n      for (const part of cookieHeader.split(';')) {\n        const [k, v] = part.split('=');\n        if (k && k.trim() === name) return (v || '').trim();\n      }\n    }\n    return null;\n  }\n\n  async refresh(headers: Record<string, string | string[] | undefined>): Promise<{ ok: boolean; jwt?: string; code?: string; message?: string }>{\n    try {\n      const token = this.extractTokenFromHeaders(headers);\n      if (!token) return { ok: false, code: 'unauthorized', message: 'No session token' };\n      const v = await this.verifyJwt(token);\n      if (!v.valid) return { ok: false, code: 'unauthorized', message: 'Invalid token' };\n      const payload: any = v.payload || {};\n      if (!this.isWithinRefreshWindow(payload)) return { ok: false, code: 'not_eligible', message: 'Not within refresh window' };\n      const sub = String(payload.sub || '');\n      if (!sub) return { ok: false, code: 'invalid_claims', message: 'Missing sub claim' };\n      const next = await this.signJwt(sub);\n      return { ok: true, jwt: next };\n    } catch (e: any) {\n      return { ok: false, code: 'internal', message: e?.message || 'Refresh failed' };\n    }\n  }\n\n  nowSeconds(): number { return Math.floor(Date.now() / 1000); }\n\n  private isWithinRefreshWindow(payload: any): boolean {\n    try {\n      const now = this.nowSeconds();\n      const exp = Number(payload?.exp || 0);\n      if (!exp || now >= exp) return false; // no refresh if already expired\n      const windowSec = Number(this.cfg?.jwt?.refreshWindowSec || 15 * 60);\n      return (exp - now) <= windowSec;\n    } catch { return false; }\n  }\n}\n\n/*\n * Utility: parse comma-separated list of origins into a normalized unique list\n * - canonicalizes to protocol + host + optional port\n * - lowercases host, strips path/query/hash, trims spaces/trailing slashes\n */\nexport function parseCsvList(input?: string): string[] {\n  const out = new Set<string>();\n  for (const raw of String(input || '').split(',')) {\n    const s = raw.trim();\n    if (!s) continue;\n    try {\n      const u = new URL(s);\n      const host = u.hostname.toLowerCase();\n      const port = u.port ? `:${u.port}` : '';\n      const proto = u.protocol === 'http:' || u.protocol === 'https:' ? u.protocol : 'https:';\n      out.add(`${proto}//${host}${port}`);\n    } catch {\n      const stripped = s.replace(/\\/$/, '');\n      if (stripped) out.add(stripped);\n    }\n  }\n  return Array.from(out);\n}\n\n/*\n * Utility: merge multiple CSV lists of origins and return normalized list or '*'\n */\nexport function buildCorsOrigins(...inputs: Array<string | undefined>): string[] | '*' {\n  const merged = new Set<string>();\n  for (const input of inputs) {\n    for (const origin of parseCsvList(input)) merged.add(origin);\n  }\n  const list = Array.from(merged);\n  return list.length > 0 ? list : '*';\n}\n"],"mappings":";;AAwBA,IAAa,iBAAb,MAA2C;CACzC,AAAQ;CAER,YAAY,KAAiC;AAC3C,OAAK,MAAM,OAAQ;;CAGrB,gBAAwB;AACtB,SAAO,KAAK,KAAK,QAAQ,QAAQ;;CAGnC,eAAe,OAAuB;AACpC,MAAI,KAAK,KAAK,QAAQ,eAAgB,QAAO,KAAK,IAAI,OAAO,eAAe;EAC5E,MAAM,OAAO,KAAK;EAClB,MAAM,cAAc,CAAC,GAAG,KAAK,GAAG;EAChC,MAAM,OAAO;EAGb,MAAM,WAAW;EACjB,MAAM,SAAS,KAAK;AACpB,cAAY,KAAK,QAAQ;AACX,cAAY,KAAK;AACnB,cAAY,KAAK;AACf,cAAY,KAAK,YAAY;EAC/B;AACV,eAAY,KAAK,WAAW;GAC5B,MAAM,UAAU,IAAI,KAAK,KAAK,QAAS,SAAS,KAAO;AACvD,eAAY,KAAK,WAAW;;AAE9B,SAAO,YAAY,KAAK;;CAG1B,mBAA2B;AACzB,MAAI,KAAK,KAAK,QAAQ,iBAAkB,QAAO,KAAK,IAAI,OAAO;EAC/D,MAAM,OAAO,KAAK;EAClB,MAAM,OAAO;EAGb,MAAM,QAAQ;GACZ,GAAG,KAAK;GACR,QAAQ;GACR;GACA;;AAEY,QAAM,KAAK;AACb,QAAM,KAAK;EACvB,MAAM,WAAW;AACH,QAAM,KAAK,YAAY;AACrC,SAAO,MAAM,KAAK;;;CAIpB,MAAM,QAAQ,KAAa,aAAwD;EACjF,MAAM,MAAM,KAAK,KAAK,OAAO;EAC7B,MAAM,QAAQ,MAAM,QAAQ,QAAQ,IAAI,cAAc;GAAE;GAAK,SAAS;SAAmB;EACzF,MAAM,UAAU;GAAE;GAAK,GAAI,eAAe;GAAK,GAAI,SAAS;;AAC5D,MAAI,OAAO,IAAI,cAAc,YAAY;GAEvC,MAAM,QAAQ,MAAM,QAAQ,QAAQ,IAAI,UAAU;IAAE,QAAQ,EAAE,KAAK;IAAS;;AAC5E,UAAO;;AAET,QAAM,IAAI,MAAM;;;CAIlB,MAAM,UAAU,OAA2D;EACzE,MAAM,SAAS,KAAK,KAAK,KAAK;AAC9B,MAAI,OAAO,WAAW,WAAY,QAAO,EAAE,OAAO;AAClD,SAAO,MAAM,QAAQ,QAAQ,OAAO;;CAGtC,MAAM,SAAmH;EACvH,MAAM,aAAc,QAAQ,oBAAoB,QAAQ;EACxD,IAAIA,QAAuB;AAC3B,MAAI,cAAc,aAAa,KAAK,YAAa,SAAQ,WAAW,QAAQ,eAAe,IAAI;EAC/F,MAAM,eAAgB,QAAQ,aAAa,QAAQ;AACnD,MAAI,CAAC,SAAS,cAAc;GAC1B,MAAM,OAAO,KAAK;AAClB,QAAK,MAAM,QAAQ,aAAa,MAAM,MAAM;IAC1C,MAAM,CAAC,GAAG,KAAK,KAAK,MAAM;AAC1B,QAAI,KAAK,EAAE,WAAW,MAAM;AAAE,cAAS,KAAK,IAAI;AAAQ;;;;AAG5D,MAAI,CAAC,MAAO,QAAO,QAAQ,QAAQ,EAAE,IAAI;AACzC,SAAO,KAAK,UAAU,OAAO,MAAK,MAAK,EAAE,QAAQ;GAAE,IAAI;GAAM,QAAQ,EAAE;MAAuB,EAAE,IAAI;;CAItG,wBAAwB,SAAuE;AAC7F,MAAI,KAAK,KAAK,QAAQ,aAAc,QAAO,KAAK,IAAI,OAAO,aAAa,SAAS,KAAK;EACtF,MAAM,aAAc,QAAQ,oBAAoB,QAAQ;AACxD,MAAI,cAAc,aAAa,KAAK,YAAa,QAAO,WAAW,QAAQ,eAAe,IAAI;EAC9F,MAAM,eAAgB,QAAQ,aAAa,QAAQ;AACnD,MAAI,cAAc;GAChB,MAAM,OAAO,KAAK;AAClB,QAAK,MAAM,QAAQ,aAAa,MAAM,MAAM;IAC1C,MAAM,CAAC,GAAG,KAAK,KAAK,MAAM;AAC1B,QAAI,KAAK,EAAE,WAAW,KAAM,SAAQ,KAAK,IAAI;;;AAGjD,SAAO;;CAGT,MAAM,QAAQ,SAAgI;AAC5I,MAAI;GACF,MAAM,QAAQ,KAAK,wBAAwB;AAC3C,OAAI,CAAC,MAAO,QAAO;IAAE,IAAI;IAAO,MAAM;IAAgB,SAAS;;GAC/D,MAAM,IAAI,MAAM,KAAK,UAAU;AAC/B,OAAI,CAAC,EAAE,MAAO,QAAO;IAAE,IAAI;IAAO,MAAM;IAAgB,SAAS;;GACjE,MAAMC,UAAe,EAAE,WAAW;AAClC,OAAI,CAAC,KAAK,sBAAsB,SAAU,QAAO;IAAE,IAAI;IAAO,MAAM;IAAgB,SAAS;;GAC7F,MAAM,MAAM,OAAO,QAAQ,OAAO;AAClC,OAAI,CAAC,IAAK,QAAO;IAAE,IAAI;IAAO,MAAM;IAAkB,SAAS;;GAC/D,MAAM,OAAO,MAAM,KAAK,QAAQ;AAChC,UAAO;IAAE,IAAI;IAAM,KAAK;;WACjBC,GAAQ;AACf,UAAO;IAAE,IAAI;IAAO,MAAM;IAAY,SAAS,GAAG,WAAW;;;;CAIjE,aAAqB;AAAE,SAAO,KAAK,MAAM,KAAK,QAAQ;;CAEtD,AAAQ,sBAAsB,SAAuB;AACnD,MAAI;GACF,MAAM,MAAM,KAAK;GACjB,MAAM,MAAM,OAAO,SAAS,OAAO;AACnC,OAAI,CAAC,OAAO,OAAO,IAAK,QAAO;GAC/B,MAAM,YAAY,OAAO,KAAK,KAAK,KAAK,oBAAoB;AAC5D,UAAQ,MAAM,OAAQ;UAChB;AAAE,UAAO;;;;AASrB,SAAgB,aAAa,OAA0B;CACrD,MAAM,sBAAM,IAAI;AAChB,MAAK,MAAM,OAAO,OAAO,SAAS,IAAI,MAAM,MAAM;EAChD,MAAM,IAAI,IAAI;AACd,MAAI,CAAC,EAAG;AACR,MAAI;GACF,MAAM,IAAI,IAAI,IAAI;GAClB,MAAM,OAAO,EAAE,SAAS;GACxB,MAAM,OAAO,EAAE,OAAO,IAAI,EAAE,SAAS;GACrC,MAAM,QAAQ,EAAE,aAAa,WAAW,EAAE,aAAa,WAAW,EAAE,WAAW;AAC/E,OAAI,IAAI,GAAG,MAAM,IAAI,OAAO;UACtB;GACN,MAAM,WAAW,EAAE,QAAQ,OAAO;AAClC,OAAI,SAAU,KAAI,IAAI;;;AAG1B,QAAO,MAAM,KAAK;;AAMpB,SAAgB,iBAAiB,GAAG,QAAmD;CACrF,MAAM,yBAAS,IAAI;AACnB,MAAK,MAAM,SAAS,OAClB,MAAK,MAAM,UAAU,aAAa,OAAQ,QAAO,IAAI;CAEvD,MAAM,OAAO,MAAM,KAAK;AACxB,QAAO,KAAK,SAAS,IAAI,OAAO"}
+{"version":3,"file":"SessionService.js","names":["token: string | null","payload: any","e: any"],"sources":["../../../../src/server/core/SessionService.ts"],"sourcesContent":["\nexport interface SessionConfig {\n  jwt?: {\n    /** Required: JWT signing hook; return a complete token */\n    signToken?: (input: { header: Record<string, unknown>; payload: Record<string, unknown> }) => Promise<string> | string;\n    /** Required: JWT verification hook */\n    verifyToken?: (token: string) => Promise<{ valid: boolean; payload?: any }> | { valid: boolean; payload?: any };\n    /** Optional: sliding refresh window (seconds) to allow /session/refresh before exp, default 900 (15 min) */\n    refreshWindowSec?: number;\n    /** Optional: build additional claims to include in the payload */\n    buildClaims?: (input: { sub: string; context?: Record<string, unknown> }) => Promise<Record<string, unknown> | void> | Record<string, unknown> | void;\n  };\n  cookie?: {\n    /** Cookie name. Default: 'w3a_session' */\n    name?: string;\n    /** Optional override: build Set-Cookie header for a new token */\n    buildSetHeader?: (token: string) => string;\n    /** Optional override: build Set-Cookie header that clears the cookie */\n    buildClearHeader?: () => string;\n    /** Optional override: extract token from headers (Authorization/Cookie) */\n    extractToken?: (headers: Record<string, string | string[] | undefined>, cookieName: string) => string | null;\n  };\n}\n\nexport class SessionService<TClaims extends Record<string, unknown> = Record<string, unknown>> {\n  private cfg: NonNullable<SessionConfig>;\n\n  constructor(cfg: NonNullable<SessionConfig>) {\n    this.cfg = cfg || ({} as any);\n  }\n\n  getCookieName(): string {\n    return this.cfg?.cookie?.name || 'w3a_session';\n  }\n\n  buildSetCookie(token: string): string {\n    if (this.cfg?.cookie?.buildSetHeader) return this.cfg.cookie.buildSetHeader(token);\n    const name = this.getCookieName();\n    const cookieParts = [`${name}=${token}`];\n    const path = '/';\n    const httpOnly = true;\n    const secure = true; // default secure\n    const sameSite = 'Lax';\n    const maxAge = 24 * 3600; // 1 day default\n    cookieParts.push(`Path=${path}`);\n    if (httpOnly) cookieParts.push('HttpOnly');\n    if (secure) cookieParts.push('Secure');\n    if (sameSite) cookieParts.push(`SameSite=${sameSite}`);\n    if (maxAge) {\n      cookieParts.push(`Max-Age=${maxAge}`);\n      const expires = new Date(Date.now() + (maxAge * 1000)).toUTCString();\n      cookieParts.push(`Expires=${expires}`);\n    }\n    return cookieParts.join('; ');\n  }\n\n  buildClearCookie(): string {\n    if (this.cfg?.cookie?.buildClearHeader) return this.cfg.cookie.buildClearHeader();\n    const name = this.getCookieName();\n    const path = '/';\n    const secure = true;\n    const httpOnly = true;\n    const parts = [\n      `${name}=`,\n      `Path=${path}`,\n      'Max-Age=0',\n      'Expires=Thu, 01 Jan 1970 00:00:00 GMT'\n    ];\n    if (httpOnly) parts.push('HttpOnly');\n    if (secure) parts.push('Secure');\n    const sameSite = 'Lax';\n    if (sameSite) parts.push(`SameSite=${sameSite}`);\n    return parts.join('; ');\n  }\n\n  /** Sign a JWT with configured algorithm. Adds iat/exp and copies iss/aud. */\n  async signJwt(sub: string, extraClaims?: Record<string, unknown>): Promise<string> {\n    const jwt = this.cfg?.jwt || {};\n    const built = await Promise.resolve(jwt.buildClaims?.({ sub, context: extraClaims })) || {};\n    const payload = { sub, ...(extraClaims || {}), ...(built || {}) } as Record<string, unknown>;\n    if (typeof jwt.signToken === 'function') {\n      // Full override of signing: user supplies the complete token\n      const token = await Promise.resolve(jwt.signToken({ header: { typ: 'JWT' }, payload } as any));\n      return token;\n    }\n    throw new Error('SessionService: No JWT signing hook or provider configured');\n  }\n\n  /** Verify signature and expiration. Returns payload on success. */\n  async verifyJwt(token: string): Promise<{ valid: boolean; payload?: any }> {\n    const verify = this.cfg?.jwt?.verifyToken;\n    if (typeof verify !== 'function') return { valid: false };\n    return await Promise.resolve(verify(token));\n  }\n\n  parse(\n    headers: Record<string, string | string[] | undefined>\n  ): Promise<{ ok: true; claims: TClaims } | { ok: false }> {\n    const authHeader = (headers['authorization'] || headers['Authorization']) as string | undefined;\n    let token: string | null = null;\n    if (authHeader && /^Bearer\\s+/.test(authHeader)) token = authHeader.replace(/^Bearer\\s+/i, '').trim();\n    const cookieHeader = (headers['cookie'] || headers['Cookie']) as string | undefined;\n    if (!token && cookieHeader) {\n      const name = this.getCookieName();\n      for (const part of cookieHeader.split(';')) {\n        const [k, v] = part.split('=');\n        if (k && k.trim() === name) { token = (v || '').trim(); break; }\n      }\n    }\n    if (!token) return Promise.resolve({ ok: false });\n    return this.verifyJwt(token).then(v =>\n      v.valid\n        ? { ok: true, claims: v.payload as TClaims }\n        : { ok: false }\n    );\n  }\n\n  // === token helpers ===\n  extractTokenFromHeaders(headers: Record<string, string | string[] | undefined>): string | null {\n    if (this.cfg?.cookie?.extractToken) return this.cfg.cookie.extractToken(headers, this.getCookieName());\n    const authHeader = (headers['authorization'] || headers['Authorization']) as string | undefined;\n    if (authHeader && /^Bearer\\s+/.test(authHeader)) return authHeader.replace(/^Bearer\\s+/i, '').trim();\n    const cookieHeader = (headers['cookie'] || headers['Cookie']) as string | undefined;\n    if (cookieHeader) {\n      const name = this.getCookieName();\n      for (const part of cookieHeader.split(';')) {\n        const [k, v] = part.split('=');\n        if (k && k.trim() === name) return (v || '').trim();\n      }\n    }\n    return null;\n  }\n\n  async refresh(headers: Record<string, string | string[] | undefined>): Promise<{ ok: boolean; jwt?: string; code?: string; message?: string }>{\n    try {\n      const token = this.extractTokenFromHeaders(headers);\n      if (!token) return { ok: false, code: 'unauthorized', message: 'No session token' };\n      const v = await this.verifyJwt(token);\n      if (!v.valid) return { ok: false, code: 'unauthorized', message: 'Invalid token' };\n      const payload: any = v.payload || {};\n      if (!this.isWithinRefreshWindow(payload)) return { ok: false, code: 'not_eligible', message: 'Not within refresh window' };\n      const sub = String(payload.sub || '');\n      if (!sub) return { ok: false, code: 'invalid_claims', message: 'Missing sub claim' };\n      const next = await this.signJwt(sub);\n      return { ok: true, jwt: next };\n    } catch (e: any) {\n      return { ok: false, code: 'internal', message: e?.message || 'Refresh failed' };\n    }\n  }\n\n  nowSeconds(): number { return Math.floor(Date.now() / 1000); }\n\n  private isWithinRefreshWindow(payload: any): boolean {\n    try {\n      const now = this.nowSeconds();\n      const exp = Number(payload?.exp || 0);\n      if (!exp || now >= exp) return false; // no refresh if already expired\n      const windowSec = Number(this.cfg?.jwt?.refreshWindowSec || 15 * 60);\n      return (exp - now) <= windowSec;\n    } catch { return false; }\n  }\n}\n\n/*\n * Utility: parse comma-separated list of origins into a normalized unique list\n * - canonicalizes to protocol + host + optional port\n * - lowercases host, strips path/query/hash, trims spaces/trailing slashes\n */\nexport function parseCsvList(input?: string): string[] {\n  const out = new Set<string>();\n  for (const raw of String(input || '').split(',')) {\n    const s = raw.trim();\n    if (!s) continue;\n    try {\n      const u = new URL(s);\n      const host = u.hostname.toLowerCase();\n      const port = u.port ? `:${u.port}` : '';\n      const proto = u.protocol === 'http:' || u.protocol === 'https:' ? u.protocol : 'https:';\n      out.add(`${proto}//${host}${port}`);\n    } catch {\n      const stripped = s.replace(/\\/$/, '');\n      if (stripped) out.add(stripped);\n    }\n  }\n  return Array.from(out);\n}\n\n/*\n * Utility: merge multiple CSV lists of origins and return normalized list or '*'\n */\nexport function buildCorsOrigins(...inputs: Array<string | undefined>): string[] | '*' {\n  const merged = new Set<string>();\n  for (const input of inputs) {\n    for (const origin of parseCsvList(input)) merged.add(origin);\n  }\n  const list = Array.from(merged);\n  return list.length > 0 ? list : '*';\n}\n"],"mappings":";;AAwBA,IAAa,iBAAb,MAA+F;CAC7F,AAAQ;CAER,YAAY,KAAiC;AAC3C,OAAK,MAAM,OAAQ;;CAGrB,gBAAwB;AACtB,SAAO,KAAK,KAAK,QAAQ,QAAQ;;CAGnC,eAAe,OAAuB;AACpC,MAAI,KAAK,KAAK,QAAQ,eAAgB,QAAO,KAAK,IAAI,OAAO,eAAe;EAC5E,MAAM,OAAO,KAAK;EAClB,MAAM,cAAc,CAAC,GAAG,KAAK,GAAG;EAChC,MAAM,OAAO;EAGb,MAAM,WAAW;EACjB,MAAM,SAAS,KAAK;AACpB,cAAY,KAAK,QAAQ;AACX,cAAY,KAAK;AACnB,cAAY,KAAK;AACf,cAAY,KAAK,YAAY;EAC/B;AACV,eAAY,KAAK,WAAW;GAC5B,MAAM,UAAU,IAAI,KAAK,KAAK,QAAS,SAAS,KAAO;AACvD,eAAY,KAAK,WAAW;;AAE9B,SAAO,YAAY,KAAK;;CAG1B,mBAA2B;AACzB,MAAI,KAAK,KAAK,QAAQ,iBAAkB,QAAO,KAAK,IAAI,OAAO;EAC/D,MAAM,OAAO,KAAK;EAClB,MAAM,OAAO;EAGb,MAAM,QAAQ;GACZ,GAAG,KAAK;GACR,QAAQ;GACR;GACA;;AAEY,QAAM,KAAK;AACb,QAAM,KAAK;EACvB,MAAM,WAAW;AACH,QAAM,KAAK,YAAY;AACrC,SAAO,MAAM,KAAK;;;CAIpB,MAAM,QAAQ,KAAa,aAAwD;EACjF,MAAM,MAAM,KAAK,KAAK,OAAO;EAC7B,MAAM,QAAQ,MAAM,QAAQ,QAAQ,IAAI,cAAc;GAAE;GAAK,SAAS;SAAmB;EACzF,MAAM,UAAU;GAAE;GAAK,GAAI,eAAe;GAAK,GAAI,SAAS;;AAC5D,MAAI,OAAO,IAAI,cAAc,YAAY;GAEvC,MAAM,QAAQ,MAAM,QAAQ,QAAQ,IAAI,UAAU;IAAE,QAAQ,EAAE,KAAK;IAAS;;AAC5E,UAAO;;AAET,QAAM,IAAI,MAAM;;;CAIlB,MAAM,UAAU,OAA2D;EACzE,MAAM,SAAS,KAAK,KAAK,KAAK;AAC9B,MAAI,OAAO,WAAW,WAAY,QAAO,EAAE,OAAO;AAClD,SAAO,MAAM,QAAQ,QAAQ,OAAO;;CAGtC,MACE,SACwD;EACxD,MAAM,aAAc,QAAQ,oBAAoB,QAAQ;EACxD,IAAIA,QAAuB;AAC3B,MAAI,cAAc,aAAa,KAAK,YAAa,SAAQ,WAAW,QAAQ,eAAe,IAAI;EAC/F,MAAM,eAAgB,QAAQ,aAAa,QAAQ;AACnD,MAAI,CAAC,SAAS,cAAc;GAC1B,MAAM,OAAO,KAAK;AAClB,QAAK,MAAM,QAAQ,aAAa,MAAM,MAAM;IAC1C,MAAM,CAAC,GAAG,KAAK,KAAK,MAAM;AAC1B,QAAI,KAAK,EAAE,WAAW,MAAM;AAAE,cAAS,KAAK,IAAI;AAAQ;;;;AAG5D,MAAI,CAAC,MAAO,QAAO,QAAQ,QAAQ,EAAE,IAAI;AACzC,SAAO,KAAK,UAAU,OAAO,MAAK,MAChC,EAAE,QACE;GAAE,IAAI;GAAM,QAAQ,EAAE;MACtB,EAAE,IAAI;;CAKd,wBAAwB,SAAuE;AAC7F,MAAI,KAAK,KAAK,QAAQ,aAAc,QAAO,KAAK,IAAI,OAAO,aAAa,SAAS,KAAK;EACtF,MAAM,aAAc,QAAQ,oBAAoB,QAAQ;AACxD,MAAI,cAAc,aAAa,KAAK,YAAa,QAAO,WAAW,QAAQ,eAAe,IAAI;EAC9F,MAAM,eAAgB,QAAQ,aAAa,QAAQ;AACnD,MAAI,cAAc;GAChB,MAAM,OAAO,KAAK;AAClB,QAAK,MAAM,QAAQ,aAAa,MAAM,MAAM;IAC1C,MAAM,CAAC,GAAG,KAAK,KAAK,MAAM;AAC1B,QAAI,KAAK,EAAE,WAAW,KAAM,SAAQ,KAAK,IAAI;;;AAGjD,SAAO;;CAGT,MAAM,QAAQ,SAAgI;AAC5I,MAAI;GACF,MAAM,QAAQ,KAAK,wBAAwB;AAC3C,OAAI,CAAC,MAAO,QAAO;IAAE,IAAI;IAAO,MAAM;IAAgB,SAAS;;GAC/D,MAAM,IAAI,MAAM,KAAK,UAAU;AAC/B,OAAI,CAAC,EAAE,MAAO,QAAO;IAAE,IAAI;IAAO,MAAM;IAAgB,SAAS;;GACjE,MAAMC,UAAe,EAAE,WAAW;AAClC,OAAI,CAAC,KAAK,sBAAsB,SAAU,QAAO;IAAE,IAAI;IAAO,MAAM;IAAgB,SAAS;;GAC7F,MAAM,MAAM,OAAO,QAAQ,OAAO;AAClC,OAAI,CAAC,IAAK,QAAO;IAAE,IAAI;IAAO,MAAM;IAAkB,SAAS;;GAC/D,MAAM,OAAO,MAAM,KAAK,QAAQ;AAChC,UAAO;IAAE,IAAI;IAAM,KAAK;;WACjBC,GAAQ;AACf,UAAO;IAAE,IAAI;IAAO,MAAM;IAAY,SAAS,GAAG,WAAW;;;;CAIjE,aAAqB;AAAE,SAAO,KAAK,MAAM,KAAK,QAAQ;;CAEtD,AAAQ,sBAAsB,SAAuB;AACnD,MAAI;GACF,MAAM,MAAM,KAAK;GACjB,MAAM,MAAM,OAAO,SAAS,OAAO;AACnC,OAAI,CAAC,OAAO,OAAO,IAAK,QAAO;GAC/B,MAAM,YAAY,OAAO,KAAK,KAAK,KAAK,oBAAoB;AAC5D,UAAQ,MAAM,OAAQ;UAChB;AAAE,UAAO;;;;AASrB,SAAgB,aAAa,OAA0B;CACrD,MAAM,sBAAM,IAAI;AAChB,MAAK,MAAM,OAAO,OAAO,SAAS,IAAI,MAAM,MAAM;EAChD,MAAM,IAAI,IAAI;AACd,MAAI,CAAC,EAAG;AACR,MAAI;GACF,MAAM,IAAI,IAAI,IAAI;GAClB,MAAM,OAAO,EAAE,SAAS;GACxB,MAAM,OAAO,EAAE,OAAO,IAAI,EAAE,SAAS;GACrC,MAAM,QAAQ,EAAE,aAAa,WAAW,EAAE,aAAa,WAAW,EAAE,WAAW;AAC/E,OAAI,IAAI,GAAG,MAAM,IAAI,OAAO;UACtB;GACN,MAAM,WAAW,EAAE,QAAQ,OAAO;AAClC,OAAI,SAAU,KAAI,IAAI;;;AAG1B,QAAO,MAAM,KAAK;;AAMpB,SAAgB,iBAAiB,GAAG,QAAmD;CACrF,MAAM,yBAAS,IAAI;AACnB,MAAK,MAAM,SAAS,OAClB,MAAK,MAAM,UAAU,aAAa,OAAQ,QAAO,IAAI;CAEvD,MAAM,OAAO,MAAM,KAAK;AACxB,QAAO,KAAK,SAAS,IAAI,OAAO"}

package/dist/cjs/server/core/ShamirService.js

@@ -1,4 +1,4 @@
-const require_validation = require('../sdk/src/core/WalletIframe/validation.js');
+const require_validation = require('../sdk/src/utils/validation.js');
 const require_shamirWorker = require('./shamirWorker.js');
 
 //#region src/server/core/ShamirService.ts

package/dist/cjs/server/core/ShamirService.js.map

@@ -1 +1 @@
-{"version":3,"file":"ShamirService.js","names":["Shamir3PassUtils","specs: GraceKeySpec[]","normalized: GraceKeySpec[]","error: any","isString","keyId: string | null","e: any"],"sources":["../../../../src/server/core/ShamirService.ts"],"sourcesContent":["import type {\n  AuthServiceConfig,\n  ShamirApplyServerLockRequest,\n  ShamirApplyServerLockResponse,\n  ShamirRemoveServerLockRequest,\n  ShamirRemoveServerLockResponse,\n} from './types';\nimport { isString } from '../../core/WalletIframe/validation';\nimport { Shamir3PassUtils, setShamirWasmModuleOverride } from './shamirWorker';\n\ntype ShamirConfig = AuthServiceConfig['shamir'];\n\ntype GraceKeySpec = { e_s_b64u: string; d_s_b64u: string };\n\nexport class ShamirService {\n  private config: ShamirConfig | undefined;\n  private graceKeysFilePath: string | null;\n\n  private shamir3pass: Shamir3PassUtils | null = null;\n  private graceKeys: Map<string, Shamir3PassUtils> = new Map();\n  private graceKeySpecs: Map<string, GraceKeySpec> = new Map();\n  private graceKeysLoaded = false;\n  private graceKeysLoadPromise: Promise<void> | null = null;\n\n  constructor(config: ShamirConfig | undefined, graceKeysFilePath: string | null) {\n    this.config = config;\n    const graceFileCandidate = (this.config?.graceShamirKeysFile || '').trim();\n    this.graceKeysFilePath = graceKeysFilePath || graceFileCandidate || 'grace-keys.json';\n  }\n\n  hasShamir(): boolean {\n    return Boolean(this.config && this.shamir3pass);\n  }\n\n  getShamirConfig(): ShamirConfig | undefined {\n    return this.config;\n  }\n\n  getCurrentShamirKeyId(): string | null {\n    return this.shamir3pass?.getCurrentKeyId?.() || null;\n  }\n\n  getGraceKeyIds(): string[] {\n    return Array.from(this.graceKeys.keys());\n  }\n\n  hasGraceKey(keyId: string): boolean {\n    return this.graceKeys.has(keyId);\n  }\n\n  async ensureReady(): Promise<boolean> {\n    if (!this.config) {\n      return false;\n    }\n    if (this.shamir3pass) {\n      return true;\n    }\n\n    try {\n      // Configure WASM override when provided (e.g. Cloudflare Workers).\n      // This ensures Shamir endpoints like /vrf/apply-server-lock work\n      // even when AuthService._ensureSignerAndRelayerAccount has not run.\n      if (this.config.moduleOrPath) {\n        try {\n          setShamirWasmModuleOverride(this.config.moduleOrPath);\n        } catch (error) {\n          console.warn('[ShamirService] Failed to configure Shamir WASM override:', error);\n        }\n      }\n\n      this.shamir3pass = new Shamir3PassUtils({\n        p_b64u: this.config.shamir_p_b64u,\n        e_s_b64u: this.config.shamir_e_s_b64u,\n        d_s_b64u: this.config.shamir_d_s_b64u,\n      });\n      try {\n        await this.shamir3pass.initialize();\n      } catch {\n        // Initialization failures are logged by Shamir3PassUtils; treat as non-fatal\n      }\n      await this.ensureGraceKeysLoaded();\n    } catch (err) {\n      console.error('Failed to initialize Shamir 3-pass:', err);\n    }\n\n    return this.hasShamir();\n  }\n\n  async ensureGraceKeysLoaded(): Promise<void> {\n    if (this.graceKeysLoaded) {\n      return;\n    }\n    if (this.graceKeysLoadPromise) {\n      await this.graceKeysLoadPromise;\n      return;\n    }\n\n    this.graceKeysLoadPromise = (async () => {\n      const specs: GraceKeySpec[] = [];\n\n      const fileSpecs = await this.loadGraceKeysFromFile();\n      if (fileSpecs.length) {\n        specs.push(...fileSpecs);\n      }\n\n      if (Array.isArray(this.config?.graceShamirKeys) && this.config!.graceShamirKeys!.length) {\n        specs.push(...(this.config!.graceShamirKeys as any));\n      }\n\n      if (specs.length) {\n        for (const spec of specs) {\n          await this.addGraceKeyInternal(spec, { persist: false, skipIfExists: true });\n        }\n      }\n\n      this.graceKeysLoaded = true;\n      this.syncGraceKeySpecsToConfig();\n    })();\n\n    try {\n      await this.graceKeysLoadPromise;\n    } finally {\n      this.graceKeysLoadPromise = null;\n      this.graceKeysLoaded = true;\n    }\n  }\n\n  private async loadGraceKeysFromFile(): Promise<GraceKeySpec[]> {\n    if (!this.isNodeEnvironment()) {\n      return [];\n    }\n    const filePath = this.graceKeysFilePath?.trim();\n    if (!filePath) {\n      return [];\n    }\n\n    try {\n      const { readFile } = await import('node:fs/promises');\n      const raw = await readFile(filePath, 'utf8');\n      const parsed = JSON.parse(raw);\n      if (!Array.isArray(parsed)) {\n        console.warn(`[ShamirService] Grace keys file ${filePath} is not an array; ignoring contents`);\n        return [];\n      }\n      const normalized: GraceKeySpec[] = [];\n      for (const entry of parsed) {\n        if (!entry || typeof entry !== 'object') continue;\n        const e = (entry as any).e_s_b64u;\n        const d = (entry as any).d_s_b64u;\n        if (typeof e === 'string' && e && typeof d === 'string' && d) {\n          normalized.push({ e_s_b64u: e, d_s_b64u: d });\n        }\n      }\n      return normalized;\n    } catch (error: any) {\n      if (error?.code !== 'ENOENT') {\n        console.warn(`[ShamirService] Failed to read grace keys file ${filePath}:`, error);\n      }\n      return [];\n    }\n  }\n\n  private syncGraceKeySpecsToConfig(): void {\n    if (!this.config) return;\n\n    if (this.graceKeySpecs.size === 0) {\n      this.config.graceShamirKeys = undefined;\n      return;\n    }\n\n    this.config.graceShamirKeys = Array.from(this.graceKeySpecs.values()).map((spec) => ({\n      e_s_b64u: spec.e_s_b64u,\n      d_s_b64u: spec.d_s_b64u,\n    }));\n  }\n\n  private async persistGraceKeysToDisk(): Promise<void> {\n    if (!this.isNodeEnvironment()) {\n      return;\n    }\n    const filePath = this.graceKeysFilePath?.trim();\n    if (!filePath) {\n      return;\n    }\n    const entries = Array.from(this.graceKeySpecs.entries()).map(([keyId, spec]) => ({\n      keyId,\n      e_s_b64u: spec.e_s_b64u,\n      d_s_b64u: spec.d_s_b64u,\n    }));\n    try {\n      const { writeFile } = await import('node:fs/promises');\n      const serialized = JSON.stringify(entries, null, 2);\n      await writeFile(filePath, `${serialized}\\n`, 'utf8');\n    } catch (error) {\n      console.warn(`[ShamirService] Failed to persist grace keys to ${filePath}:`, error);\n    }\n  }\n\n  async addGraceKeyInternal(\n    spec: { e_s_b64u: string; d_s_b64u: string },\n    opts?: { persist?: boolean; skipIfExists?: boolean }\n  ): Promise<{ keyId: string } | null> {\n    await this.ensureGraceKeysLoaded();\n\n    const e = spec?.e_s_b64u;\n    const d = spec?.d_s_b64u;\n    if (!isString(e) || !e || !isString(d) || !d) {\n      return null;\n    }\n\n    const p_b64u = this.config?.shamir_p_b64u;\n    if (!p_b64u) {\n      console.warn('[ShamirService] Missing Shamir p_b64u; cannot add grace key');\n      return null;\n    }\n    const util = new Shamir3PassUtils({\n      p_b64u,\n      e_s_b64u: e,\n      d_s_b64u: d,\n    });\n\n    let keyId = util.getCurrentKeyId();\n    if (!keyId) {\n      try {\n        await util.initialize();\n        keyId = util.getCurrentKeyId();\n      } catch (error) {\n        console.warn('[ShamirService] Failed to initialize grace Shamir key (skipped):', error);\n        return null;\n      }\n    }\n\n    if (!keyId) {\n      return null;\n    }\n\n    if (opts?.skipIfExists && this.graceKeys.has(keyId)) {\n      return { keyId };\n    }\n\n    if (!this.graceKeys.has(keyId)) {\n      this.graceKeys.set(keyId, util);\n    }\n    if (!this.graceKeySpecs.has(keyId)) {\n      this.graceKeySpecs.set(keyId, { e_s_b64u: e, d_s_b64u: d });\n    }\n\n    this.syncGraceKeySpecsToConfig();\n\n    if (opts?.persist !== false) {\n      await this.persistGraceKeysToDisk();\n    }\n\n    return { keyId };\n  }\n\n  async removeGraceKeyInternal(\n    keyId: string,\n    opts?: { persist?: boolean }\n  ): Promise<boolean> {\n    await this.ensureGraceKeysLoaded();\n    if (!isString(keyId) || !keyId) {\n      return false;\n    }\n    const removedUtil = this.graceKeys.delete(keyId);\n    const removedSpec = this.graceKeySpecs.delete(keyId);\n    if (!removedUtil && !removedSpec) {\n      return false;\n    }\n    this.syncGraceKeySpecsToConfig();\n    if (opts?.persist !== false) {\n      await this.persistGraceKeysToDisk();\n    }\n    return true;\n  }\n\n  async applyServerLock(kek_c_b64u: string): Promise<ShamirApplyServerLockResponse> {\n    if (!this.shamir3pass) throw new Error('Shamir3Pass not initialized');\n    return this.shamir3pass.applyServerLock({ kek_c_b64u } as ShamirApplyServerLockRequest);\n  }\n\n  async removeServerLock(kek_cs_b64u: string): Promise<ShamirRemoveServerLockResponse> {\n    if (!this.shamir3pass) throw new Error('Shamir3Pass not initialized');\n    return this.shamir3pass.removeServerLock({ kek_cs_b64u } as ShamirRemoveServerLockRequest);\n  }\n\n  async generateShamirServerKeypair(): Promise<{ e_s_b64u: string; d_s_b64u: string; keyId: string | null }> {\n    if (!this.shamir3pass) throw new Error('Shamir3Pass not initialized');\n\n    const { e_s_b64u, d_s_b64u } = await this.shamir3pass.generateServerKeypair();\n    const p_b64u = this.config?.shamir_p_b64u;\n    if (!p_b64u) throw new Error('Shamir not configured');\n    const util = new Shamir3PassUtils({\n      p_b64u,\n      e_s_b64u,\n      d_s_b64u,\n    });\n    let keyId: string | null = null;\n    try {\n      keyId = util.getCurrentKeyId();\n      if (!keyId) {\n        await util.initialize();\n        keyId = util.getCurrentKeyId();\n      }\n    } catch (error) {\n      console.warn('[ShamirService] Failed to derive keyId for generated Shamir keypair:', error);\n    }\n\n    return { e_s_b64u, d_s_b64u, keyId };\n  }\n\n  async rotateShamirServerKeypair(options?: {\n    keepCurrentInGrace?: boolean;\n    persistGraceToDisk?: boolean;\n  }): Promise<{\n    newKeypair: { e_s_b64u: string; d_s_b64u: string };\n    newKeyId: string | null;\n    previousKeyId: string | null;\n    graceKeyIds: string[];\n  }> {\n    await this.ensureGraceKeysLoaded();\n    if (!this.shamir3pass) throw new Error('Shamir3Pass not initialized');\n    if (!this.config) throw new Error('Shamir not configured');\n\n    const keepCurrentInGrace = options?.keepCurrentInGrace !== false;\n    const persistGrace = options?.persistGraceToDisk !== false;\n\n    const previousKeyId = this.shamir3pass.getCurrentKeyId();\n    const previousKeypair = {\n      e_s_b64u: this.config.shamir_e_s_b64u,\n      d_s_b64u: this.config.shamir_d_s_b64u,\n    };\n\n    const { e_s_b64u: newE, d_s_b64u: newD } = await this.shamir3pass.generateServerKeypair();\n    const newUtil = new Shamir3PassUtils({\n      p_b64u: this.config.shamir_p_b64u,\n      e_s_b64u: newE,\n      d_s_b64u: newD,\n    });\n\n    await newUtil.initialize();\n\n    this.shamir3pass = newUtil;\n    this.config.shamir_e_s_b64u = newE;\n    this.config.shamir_d_s_b64u = newD;\n\n    const newKeyId = newUtil.getCurrentKeyId();\n\n    if (\n      keepCurrentInGrace\n      && previousKeyId\n      && isString(previousKeypair.e_s_b64u)\n      && isString(previousKeypair.d_s_b64u)\n    ) {\n      await this.addGraceKeyInternal(previousKeypair, { persist: persistGrace, skipIfExists: true });\n    } else if (persistGrace) {\n      await this.persistGraceKeysToDisk();\n    }\n\n    return {\n      newKeypair: { e_s_b64u: newE, d_s_b64u: newD },\n      newKeyId,\n      previousKeyId,\n      graceKeyIds: Array.from(this.graceKeys.keys()),\n    };\n  }\n\n  async handleRotateShamirKeypair(request: { keepOldInGrace?: boolean }): Promise<{\n    status: number;\n    headers: Record<string, string>;\n    body: string;\n  }> {\n    try {\n      const keepOldInGrace = request?.keepOldInGrace !== false;\n      const result = await this.rotateShamirServerKeypair({ keepCurrentInGrace: keepOldInGrace });\n      return {\n        status: 200,\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify(result),\n      };\n    } catch (e: any) {\n      return {\n        status: 500,\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify({ error: 'internal', details: e?.message }),\n      };\n    }\n  }\n\n  async removeGraceServerLockWithKey(\n    keyId: string,\n    request: ShamirRemoveServerLockRequest,\n  ): Promise<ShamirRemoveServerLockResponse> {\n    const util = this.graceKeys.get(keyId)!;\n    return util.removeServerLock(request);\n  }\n\n  private isNodeEnvironment(): boolean {\n    const isNode = Boolean((globalThis as any).process?.versions?.node);\n    const isCloudflareWorker = typeof (globalThis as any).WebSocketPair !== 'undefined'\n      || (typeof navigator !== 'undefined' && (navigator as any).userAgent?.includes?.('Cloudflare-Workers'));\n    return isNode && !isCloudflareWorker;\n  }\n}\n"],"mappings":";;;;AAcA,IAAa,gBAAb,MAA2B;CACzB,AAAQ;CACR,AAAQ;CAER,AAAQ,cAAuC;CAC/C,AAAQ,4BAA2C,IAAI;CACvD,AAAQ,gCAA2C,IAAI;CACvD,AAAQ,kBAAkB;CAC1B,AAAQ,uBAA6C;CAErD,YAAY,QAAkC,mBAAkC;AAC9E,OAAK,SAAS;EACd,MAAM,sBAAsB,KAAK,QAAQ,uBAAuB,IAAI;AACpE,OAAK,oBAAoB,qBAAqB,sBAAsB;;CAGtE,YAAqB;AACnB,SAAO,QAAQ,KAAK,UAAU,KAAK;;CAGrC,kBAA4C;AAC1C,SAAO,KAAK;;CAGd,wBAAuC;AACrC,SAAO,KAAK,aAAa,uBAAuB;;CAGlD,iBAA2B;AACzB,SAAO,MAAM,KAAK,KAAK,UAAU;;CAGnC,YAAY,OAAwB;AAClC,SAAO,KAAK,UAAU,IAAI;;CAG5B,MAAM,cAAgC;AACpC,MAAI,CAAC,KAAK,OACR,QAAO;AAET,MAAI,KAAK,YACP,QAAO;AAGT,MAAI;AAIF,OAAI,KAAK,OAAO,aACd,KAAI;AACF,qDAA4B,KAAK,OAAO;YACjC,OAAO;AACd,YAAQ,KAAK,6DAA6D;;AAI9E,QAAK,cAAc,IAAIA,sCAAiB;IACtC,QAAQ,KAAK,OAAO;IACpB,UAAU,KAAK,OAAO;IACtB,UAAU,KAAK,OAAO;;AAExB,OAAI;AACF,UAAM,KAAK,YAAY;WACjB;AAGR,SAAM,KAAK;WACJ,KAAK;AACZ,WAAQ,MAAM,uCAAuC;;AAGvD,SAAO,KAAK;;CAGd,MAAM,wBAAuC;AAC3C,MAAI,KAAK,gBACP;AAEF,MAAI,KAAK,sBAAsB;AAC7B,SAAM,KAAK;AACX;;AAGF,OAAK,wBAAwB,YAAY;GACvC,MAAMC,QAAwB;GAE9B,MAAM,YAAY,MAAM,KAAK;AAC7B,OAAI,UAAU,OACZ,OAAM,KAAK,GAAG;AAGhB,OAAI,MAAM,QAAQ,KAAK,QAAQ,oBAAoB,KAAK,OAAQ,gBAAiB,OAC/E,OAAM,KAAK,GAAI,KAAK,OAAQ;AAG9B,OAAI,MAAM,OACR,MAAK,MAAM,QAAQ,MACjB,OAAM,KAAK,oBAAoB,MAAM;IAAE,SAAS;IAAO,cAAc;;AAIzE,QAAK,kBAAkB;AACvB,QAAK;;AAGP,MAAI;AACF,SAAM,KAAK;YACH;AACR,QAAK,uBAAuB;AAC5B,QAAK,kBAAkB;;;CAI3B,MAAc,wBAAiD;AAC7D,MAAI,CAAC,KAAK,oBACR,QAAO;EAET,MAAM,WAAW,KAAK,mBAAmB;AACzC,MAAI,CAAC,SACH,QAAO;AAGT,MAAI;GACF,MAAM,EAAE,aAAa,MAAM,OAAO;GAClC,MAAM,MAAM,MAAM,SAAS,UAAU;GACrC,MAAM,SAAS,KAAK,MAAM;AAC1B,OAAI,CAAC,MAAM,QAAQ,SAAS;AAC1B,YAAQ,KAAK,mCAAmC,SAAS;AACzD,WAAO;;GAET,MAAMC,aAA6B;AACnC,QAAK,MAAM,SAAS,QAAQ;AAC1B,QAAI,CAAC,SAAS,OAAO,UAAU,SAAU;IACzC,MAAM,IAAK,MAAc;IACzB,MAAM,IAAK,MAAc;AACzB,QAAI,OAAO,MAAM,YAAY,KAAK,OAAO,MAAM,YAAY,EACzD,YAAW,KAAK;KAAE,UAAU;KAAG,UAAU;;;AAG7C,UAAO;WACAC,OAAY;AACnB,OAAI,OAAO,SAAS,SAClB,SAAQ,KAAK,kDAAkD,SAAS,IAAI;AAE9E,UAAO;;;CAIX,AAAQ,4BAAkC;AACxC,MAAI,CAAC,KAAK,OAAQ;AAElB,MAAI,KAAK,cAAc,SAAS,GAAG;AACjC,QAAK,OAAO,kBAAkB;AAC9B;;AAGF,OAAK,OAAO,kBAAkB,MAAM,KAAK,KAAK,cAAc,UAAU,KAAK,UAAU;GACnF,UAAU,KAAK;GACf,UAAU,KAAK;;;CAInB,MAAc,yBAAwC;AACpD,MAAI,CAAC,KAAK,oBACR;EAEF,MAAM,WAAW,KAAK,mBAAmB;AACzC,MAAI,CAAC,SACH;EAEF,MAAM,UAAU,MAAM,KAAK,KAAK,cAAc,WAAW,KAAK,CAAC,OAAO,WAAW;GAC/E;GACA,UAAU,KAAK;GACf,UAAU,KAAK;;AAEjB,MAAI;GACF,MAAM,EAAE,cAAc,MAAM,OAAO;GACnC,MAAM,aAAa,KAAK,UAAU,SAAS,MAAM;AACjD,SAAM,UAAU,UAAU,GAAG,WAAW,KAAK;WACtC,OAAO;AACd,WAAQ,KAAK,mDAAmD,SAAS,IAAI;;;CAIjF,MAAM,oBACJ,MACA,MACmC;AACnC,QAAM,KAAK;EAEX,MAAM,IAAI,MAAM;EAChB,MAAM,IAAI,MAAM;AAChB,MAAI,CAACC,4BAAS,MAAM,CAAC,KAAK,CAACA,4BAAS,MAAM,CAAC,EACzC,QAAO;EAGT,MAAM,SAAS,KAAK,QAAQ;AAC5B,MAAI,CAAC,QAAQ;AACX,WAAQ,KAAK;AACb,UAAO;;EAET,MAAM,OAAO,IAAIJ,sCAAiB;GAChC;GACA,UAAU;GACV,UAAU;;EAGZ,IAAI,QAAQ,KAAK;AACjB,MAAI,CAAC,MACH,KAAI;AACF,SAAM,KAAK;AACX,WAAQ,KAAK;WACN,OAAO;AACd,WAAQ,KAAK,oEAAoE;AACjF,UAAO;;AAIX,MAAI,CAAC,MACH,QAAO;AAGT,MAAI,MAAM,gBAAgB,KAAK,UAAU,IAAI,OAC3C,QAAO,EAAE;AAGX,MAAI,CAAC,KAAK,UAAU,IAAI,OACtB,MAAK,UAAU,IAAI,OAAO;AAE5B,MAAI,CAAC,KAAK,cAAc,IAAI,OAC1B,MAAK,cAAc,IAAI,OAAO;GAAE,UAAU;GAAG,UAAU;;AAGzD,OAAK;AAEL,MAAI,MAAM,YAAY,MACpB,OAAM,KAAK;AAGb,SAAO,EAAE;;CAGX,MAAM,uBACJ,OACA,MACkB;AAClB,QAAM,KAAK;AACX,MAAI,CAACI,4BAAS,UAAU,CAAC,MACvB,QAAO;EAET,MAAM,cAAc,KAAK,UAAU,OAAO;EAC1C,MAAM,cAAc,KAAK,cAAc,OAAO;AAC9C,MAAI,CAAC,eAAe,CAAC,YACnB,QAAO;AAET,OAAK;AACL,MAAI,MAAM,YAAY,MACpB,OAAM,KAAK;AAEb,SAAO;;CAGT,MAAM,gBAAgB,YAA4D;AAChF,MAAI,CAAC,KAAK,YAAa,OAAM,IAAI,MAAM;AACvC,SAAO,KAAK,YAAY,gBAAgB,EAAE;;CAG5C,MAAM,iBAAiB,aAA8D;AACnF,MAAI,CAAC,KAAK,YAAa,OAAM,IAAI,MAAM;AACvC,SAAO,KAAK,YAAY,iBAAiB,EAAE;;CAG7C,MAAM,8BAAqG;AACzG,MAAI,CAAC,KAAK,YAAa,OAAM,IAAI,MAAM;EAEvC,MAAM,EAAE,UAAU,aAAa,MAAM,KAAK,YAAY;EACtD,MAAM,SAAS,KAAK,QAAQ;AAC5B,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM;EAC7B,MAAM,OAAO,IAAIJ,sCAAiB;GAChC;GACA;GACA;;EAEF,IAAIK,QAAuB;AAC3B,MAAI;AACF,WAAQ,KAAK;AACb,OAAI,CAAC,OAAO;AACV,UAAM,KAAK;AACX,YAAQ,KAAK;;WAER,OAAO;AACd,WAAQ,KAAK,wEAAwE;;AAGvF,SAAO;GAAE;GAAU;GAAU;;;CAG/B,MAAM,0BAA0B,SAQ7B;AACD,QAAM,KAAK;AACX,MAAI,CAAC,KAAK,YAAa,OAAM,IAAI,MAAM;AACvC,MAAI,CAAC,KAAK,OAAQ,OAAM,IAAI,MAAM;EAElC,MAAM,qBAAqB,SAAS,uBAAuB;EAC3D,MAAM,eAAe,SAAS,uBAAuB;EAErD,MAAM,gBAAgB,KAAK,YAAY;EACvC,MAAM,kBAAkB;GACtB,UAAU,KAAK,OAAO;GACtB,UAAU,KAAK,OAAO;;EAGxB,MAAM,EAAE,UAAU,MAAM,UAAU,SAAS,MAAM,KAAK,YAAY;EAClE,MAAM,UAAU,IAAIL,sCAAiB;GACnC,QAAQ,KAAK,OAAO;GACpB,UAAU;GACV,UAAU;;AAGZ,QAAM,QAAQ;AAEd,OAAK,cAAc;AACnB,OAAK,OAAO,kBAAkB;AAC9B,OAAK,OAAO,kBAAkB;EAE9B,MAAM,WAAW,QAAQ;AAEzB,MACE,sBACG,iBACAI,4BAAS,gBAAgB,aACzBA,4BAAS,gBAAgB,UAE5B,OAAM,KAAK,oBAAoB,iBAAiB;GAAE,SAAS;GAAc,cAAc;;WAC9E,aACT,OAAM,KAAK;AAGb,SAAO;GACL,YAAY;IAAE,UAAU;IAAM,UAAU;;GACxC;GACA;GACA,aAAa,MAAM,KAAK,KAAK,UAAU;;;CAI3C,MAAM,0BAA0B,SAI7B;AACD,MAAI;GACF,MAAM,iBAAiB,SAAS,mBAAmB;GACnD,MAAM,SAAS,MAAM,KAAK,0BAA0B,EAAE,oBAAoB;AAC1E,UAAO;IACL,QAAQ;IACR,SAAS,EAAE,gBAAgB;IAC3B,MAAM,KAAK,UAAU;;WAEhBE,GAAQ;AACf,UAAO;IACL,QAAQ;IACR,SAAS,EAAE,gBAAgB;IAC3B,MAAM,KAAK,UAAU;KAAE,OAAO;KAAY,SAAS,GAAG;;;;;CAK5D,MAAM,6BACJ,OACA,SACyC;EACzC,MAAM,OAAO,KAAK,UAAU,IAAI;AAChC,SAAO,KAAK,iBAAiB;;CAG/B,AAAQ,oBAA6B;EACnC,MAAM,SAAS,QAAS,WAAmB,SAAS,UAAU;EAC9D,MAAM,qBAAqB,OAAQ,WAAmB,kBAAkB,eAClE,OAAO,cAAc,eAAgB,UAAkB,WAAW,WAAW;AACnF,SAAO,UAAU,CAAC"}
+{"version":3,"file":"ShamirService.js","names":["Shamir3PassUtils","specs: GraceKeySpec[]","normalized: GraceKeySpec[]","error: any","isString","keyId: string | null","e: any"],"sources":["../../../../src/server/core/ShamirService.ts"],"sourcesContent":["import type {\n  AuthServiceConfig,\n  ShamirApplyServerLockRequest,\n  ShamirApplyServerLockResponse,\n  ShamirRemoveServerLockRequest,\n  ShamirRemoveServerLockResponse,\n} from './types';\nimport { isString } from '@/utils/validation';\nimport { Shamir3PassUtils, setShamirWasmModuleOverride } from './shamirWorker';\n\ntype ShamirConfig = AuthServiceConfig['shamir'];\n\ntype GraceKeySpec = { e_s_b64u: string; d_s_b64u: string };\n\nexport class ShamirService {\n  private config: ShamirConfig | undefined;\n  private graceKeysFilePath: string | null;\n\n  private shamir3pass: Shamir3PassUtils | null = null;\n  private graceKeys: Map<string, Shamir3PassUtils> = new Map();\n  private graceKeySpecs: Map<string, GraceKeySpec> = new Map();\n  private graceKeysLoaded = false;\n  private graceKeysLoadPromise: Promise<void> | null = null;\n\n  constructor(config: ShamirConfig | undefined, graceKeysFilePath: string | null) {\n    this.config = config;\n    const graceFileCandidate = (this.config?.graceShamirKeysFile || '').trim();\n    this.graceKeysFilePath = graceKeysFilePath || graceFileCandidate || 'grace-keys.json';\n  }\n\n  hasShamir(): boolean {\n    return Boolean(this.config && this.shamir3pass);\n  }\n\n  getShamirConfig(): ShamirConfig | undefined {\n    return this.config;\n  }\n\n  getCurrentShamirKeyId(): string | null {\n    return this.shamir3pass?.getCurrentKeyId?.() || null;\n  }\n\n  getGraceKeyIds(): string[] {\n    return Array.from(this.graceKeys.keys());\n  }\n\n  hasGraceKey(keyId: string): boolean {\n    return this.graceKeys.has(keyId);\n  }\n\n  async ensureReady(): Promise<boolean> {\n    if (!this.config) {\n      return false;\n    }\n    if (this.shamir3pass) {\n      return true;\n    }\n\n    try {\n      // Configure WASM override when provided (e.g. Cloudflare Workers).\n      // This ensures Shamir endpoints like /vrf/apply-server-lock work\n      // even when AuthService._ensureSignerAndRelayerAccount has not run.\n      if (this.config.moduleOrPath) {\n        try {\n          setShamirWasmModuleOverride(this.config.moduleOrPath);\n        } catch (error) {\n          console.warn('[ShamirService] Failed to configure Shamir WASM override:', error);\n        }\n      }\n\n      this.shamir3pass = new Shamir3PassUtils({\n        p_b64u: this.config.shamir_p_b64u,\n        e_s_b64u: this.config.shamir_e_s_b64u,\n        d_s_b64u: this.config.shamir_d_s_b64u,\n      });\n      try {\n        await this.shamir3pass.initialize();\n      } catch {\n        // Initialization failures are logged by Shamir3PassUtils; treat as non-fatal\n      }\n      await this.ensureGraceKeysLoaded();\n    } catch (err) {\n      console.error('Failed to initialize Shamir 3-pass:', err);\n    }\n\n    return this.hasShamir();\n  }\n\n  async ensureGraceKeysLoaded(): Promise<void> {\n    if (this.graceKeysLoaded) {\n      return;\n    }\n    if (this.graceKeysLoadPromise) {\n      await this.graceKeysLoadPromise;\n      return;\n    }\n\n    this.graceKeysLoadPromise = (async () => {\n      const specs: GraceKeySpec[] = [];\n\n      const fileSpecs = await this.loadGraceKeysFromFile();\n      if (fileSpecs.length) {\n        specs.push(...fileSpecs);\n      }\n\n      if (Array.isArray(this.config?.graceShamirKeys) && this.config!.graceShamirKeys!.length) {\n        specs.push(...(this.config!.graceShamirKeys as any));\n      }\n\n      if (specs.length) {\n        for (const spec of specs) {\n          await this.addGraceKeyInternal(spec, { persist: false, skipIfExists: true });\n        }\n      }\n\n      this.graceKeysLoaded = true;\n      this.syncGraceKeySpecsToConfig();\n    })();\n\n    try {\n      await this.graceKeysLoadPromise;\n    } finally {\n      this.graceKeysLoadPromise = null;\n      this.graceKeysLoaded = true;\n    }\n  }\n\n  private async loadGraceKeysFromFile(): Promise<GraceKeySpec[]> {\n    if (!this.isNodeEnvironment()) {\n      return [];\n    }\n    const filePath = this.graceKeysFilePath?.trim();\n    if (!filePath) {\n      return [];\n    }\n\n    try {\n      const { readFile } = await import('node:fs/promises');\n      const raw = await readFile(filePath, 'utf8');\n      const parsed = JSON.parse(raw);\n      if (!Array.isArray(parsed)) {\n        console.warn(`[ShamirService] Grace keys file ${filePath} is not an array; ignoring contents`);\n        return [];\n      }\n      const normalized: GraceKeySpec[] = [];\n      for (const entry of parsed) {\n        if (!entry || typeof entry !== 'object') continue;\n        const e = (entry as any).e_s_b64u;\n        const d = (entry as any).d_s_b64u;\n        if (typeof e === 'string' && e && typeof d === 'string' && d) {\n          normalized.push({ e_s_b64u: e, d_s_b64u: d });\n        }\n      }\n      return normalized;\n    } catch (error: any) {\n      if (error?.code !== 'ENOENT') {\n        console.warn(`[ShamirService] Failed to read grace keys file ${filePath}:`, error);\n      }\n      return [];\n    }\n  }\n\n  private syncGraceKeySpecsToConfig(): void {\n    if (!this.config) return;\n\n    if (this.graceKeySpecs.size === 0) {\n      this.config.graceShamirKeys = undefined;\n      return;\n    }\n\n    this.config.graceShamirKeys = Array.from(this.graceKeySpecs.values()).map((spec) => ({\n      e_s_b64u: spec.e_s_b64u,\n      d_s_b64u: spec.d_s_b64u,\n    }));\n  }\n\n  private async persistGraceKeysToDisk(): Promise<void> {\n    if (!this.isNodeEnvironment()) {\n      return;\n    }\n    const filePath = this.graceKeysFilePath?.trim();\n    if (!filePath) {\n      return;\n    }\n    const entries = Array.from(this.graceKeySpecs.entries()).map(([keyId, spec]) => ({\n      keyId,\n      e_s_b64u: spec.e_s_b64u,\n      d_s_b64u: spec.d_s_b64u,\n    }));\n    try {\n      const { writeFile } = await import('node:fs/promises');\n      const serialized = JSON.stringify(entries, null, 2);\n      await writeFile(filePath, `${serialized}\\n`, 'utf8');\n    } catch (error) {\n      console.warn(`[ShamirService] Failed to persist grace keys to ${filePath}:`, error);\n    }\n  }\n\n  async addGraceKeyInternal(\n    spec: { e_s_b64u: string; d_s_b64u: string },\n    opts?: { persist?: boolean; skipIfExists?: boolean }\n  ): Promise<{ keyId: string } | null> {\n    await this.ensureGraceKeysLoaded();\n\n    const e = spec?.e_s_b64u;\n    const d = spec?.d_s_b64u;\n    if (!isString(e) || !e || !isString(d) || !d) {\n      return null;\n    }\n\n    const p_b64u = this.config?.shamir_p_b64u;\n    if (!p_b64u) {\n      console.warn('[ShamirService] Missing Shamir p_b64u; cannot add grace key');\n      return null;\n    }\n    const util = new Shamir3PassUtils({\n      p_b64u,\n      e_s_b64u: e,\n      d_s_b64u: d,\n    });\n\n    let keyId = util.getCurrentKeyId();\n    if (!keyId) {\n      try {\n        await util.initialize();\n        keyId = util.getCurrentKeyId();\n      } catch (error) {\n        console.warn('[ShamirService] Failed to initialize grace Shamir key (skipped):', error);\n        return null;\n      }\n    }\n\n    if (!keyId) {\n      return null;\n    }\n\n    if (opts?.skipIfExists && this.graceKeys.has(keyId)) {\n      return { keyId };\n    }\n\n    if (!this.graceKeys.has(keyId)) {\n      this.graceKeys.set(keyId, util);\n    }\n    if (!this.graceKeySpecs.has(keyId)) {\n      this.graceKeySpecs.set(keyId, { e_s_b64u: e, d_s_b64u: d });\n    }\n\n    this.syncGraceKeySpecsToConfig();\n\n    if (opts?.persist !== false) {\n      await this.persistGraceKeysToDisk();\n    }\n\n    return { keyId };\n  }\n\n  async removeGraceKeyInternal(\n    keyId: string,\n    opts?: { persist?: boolean }\n  ): Promise<boolean> {\n    await this.ensureGraceKeysLoaded();\n    if (!isString(keyId) || !keyId) {\n      return false;\n    }\n    const removedUtil = this.graceKeys.delete(keyId);\n    const removedSpec = this.graceKeySpecs.delete(keyId);\n    if (!removedUtil && !removedSpec) {\n      return false;\n    }\n    this.syncGraceKeySpecsToConfig();\n    if (opts?.persist !== false) {\n      await this.persistGraceKeysToDisk();\n    }\n    return true;\n  }\n\n  async applyServerLock(kek_c_b64u: string): Promise<ShamirApplyServerLockResponse> {\n    if (!this.shamir3pass) throw new Error('Shamir3Pass not initialized');\n    return this.shamir3pass.applyServerLock({ kek_c_b64u } as ShamirApplyServerLockRequest);\n  }\n\n  async removeServerLock(kek_cs_b64u: string): Promise<ShamirRemoveServerLockResponse> {\n    if (!this.shamir3pass) throw new Error('Shamir3Pass not initialized');\n    return this.shamir3pass.removeServerLock({ kek_cs_b64u } as ShamirRemoveServerLockRequest);\n  }\n\n  async generateShamirServerKeypair(): Promise<{ e_s_b64u: string; d_s_b64u: string; keyId: string | null }> {\n    if (!this.shamir3pass) throw new Error('Shamir3Pass not initialized');\n\n    const { e_s_b64u, d_s_b64u } = await this.shamir3pass.generateServerKeypair();\n    const p_b64u = this.config?.shamir_p_b64u;\n    if (!p_b64u) throw new Error('Shamir not configured');\n    const util = new Shamir3PassUtils({\n      p_b64u,\n      e_s_b64u,\n      d_s_b64u,\n    });\n    let keyId: string | null = null;\n    try {\n      keyId = util.getCurrentKeyId();\n      if (!keyId) {\n        await util.initialize();\n        keyId = util.getCurrentKeyId();\n      }\n    } catch (error) {\n      console.warn('[ShamirService] Failed to derive keyId for generated Shamir keypair:', error);\n    }\n\n    return { e_s_b64u, d_s_b64u, keyId };\n  }\n\n  async rotateShamirServerKeypair(options?: {\n    keepCurrentInGrace?: boolean;\n    persistGraceToDisk?: boolean;\n  }): Promise<{\n    newKeypair: { e_s_b64u: string; d_s_b64u: string };\n    newKeyId: string | null;\n    previousKeyId: string | null;\n    graceKeyIds: string[];\n  }> {\n    await this.ensureGraceKeysLoaded();\n    if (!this.shamir3pass) throw new Error('Shamir3Pass not initialized');\n    if (!this.config) throw new Error('Shamir not configured');\n\n    const keepCurrentInGrace = options?.keepCurrentInGrace !== false;\n    const persistGrace = options?.persistGraceToDisk !== false;\n\n    const previousKeyId = this.shamir3pass.getCurrentKeyId();\n    const previousKeypair = {\n      e_s_b64u: this.config.shamir_e_s_b64u,\n      d_s_b64u: this.config.shamir_d_s_b64u,\n    };\n\n    const { e_s_b64u: newE, d_s_b64u: newD } = await this.shamir3pass.generateServerKeypair();\n    const newUtil = new Shamir3PassUtils({\n      p_b64u: this.config.shamir_p_b64u,\n      e_s_b64u: newE,\n      d_s_b64u: newD,\n    });\n\n    await newUtil.initialize();\n\n    this.shamir3pass = newUtil;\n    this.config.shamir_e_s_b64u = newE;\n    this.config.shamir_d_s_b64u = newD;\n\n    const newKeyId = newUtil.getCurrentKeyId();\n\n    if (\n      keepCurrentInGrace\n      && previousKeyId\n      && isString(previousKeypair.e_s_b64u)\n      && isString(previousKeypair.d_s_b64u)\n    ) {\n      await this.addGraceKeyInternal(previousKeypair, { persist: persistGrace, skipIfExists: true });\n    } else if (persistGrace) {\n      await this.persistGraceKeysToDisk();\n    }\n\n    return {\n      newKeypair: { e_s_b64u: newE, d_s_b64u: newD },\n      newKeyId,\n      previousKeyId,\n      graceKeyIds: Array.from(this.graceKeys.keys()),\n    };\n  }\n\n  async handleRotateShamirKeypair(request: { keepOldInGrace?: boolean }): Promise<{\n    status: number;\n    headers: Record<string, string>;\n    body: string;\n  }> {\n    try {\n      const keepOldInGrace = request?.keepOldInGrace !== false;\n      const result = await this.rotateShamirServerKeypair({ keepCurrentInGrace: keepOldInGrace });\n      return {\n        status: 200,\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify(result),\n      };\n    } catch (e: any) {\n      return {\n        status: 500,\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify({ error: 'internal', details: e?.message }),\n      };\n    }\n  }\n\n  async removeGraceServerLockWithKey(\n    keyId: string,\n    request: ShamirRemoveServerLockRequest,\n  ): Promise<ShamirRemoveServerLockResponse> {\n    const util = this.graceKeys.get(keyId)!;\n    return util.removeServerLock(request);\n  }\n\n  private isNodeEnvironment(): boolean {\n    const isNode = Boolean((globalThis as any).process?.versions?.node);\n    const isCloudflareWorker = typeof (globalThis as any).WebSocketPair !== 'undefined'\n      || (typeof navigator !== 'undefined' && (navigator as any).userAgent?.includes?.('Cloudflare-Workers'));\n    return isNode && !isCloudflareWorker;\n  }\n}\n"],"mappings":";;;;AAcA,IAAa,gBAAb,MAA2B;CACzB,AAAQ;CACR,AAAQ;CAER,AAAQ,cAAuC;CAC/C,AAAQ,4BAA2C,IAAI;CACvD,AAAQ,gCAA2C,IAAI;CACvD,AAAQ,kBAAkB;CAC1B,AAAQ,uBAA6C;CAErD,YAAY,QAAkC,mBAAkC;AAC9E,OAAK,SAAS;EACd,MAAM,sBAAsB,KAAK,QAAQ,uBAAuB,IAAI;AACpE,OAAK,oBAAoB,qBAAqB,sBAAsB;;CAGtE,YAAqB;AACnB,SAAO,QAAQ,KAAK,UAAU,KAAK;;CAGrC,kBAA4C;AAC1C,SAAO,KAAK;;CAGd,wBAAuC;AACrC,SAAO,KAAK,aAAa,uBAAuB;;CAGlD,iBAA2B;AACzB,SAAO,MAAM,KAAK,KAAK,UAAU;;CAGnC,YAAY,OAAwB;AAClC,SAAO,KAAK,UAAU,IAAI;;CAG5B,MAAM,cAAgC;AACpC,MAAI,CAAC,KAAK,OACR,QAAO;AAET,MAAI,KAAK,YACP,QAAO;AAGT,MAAI;AAIF,OAAI,KAAK,OAAO,aACd,KAAI;AACF,qDAA4B,KAAK,OAAO;YACjC,OAAO;AACd,YAAQ,KAAK,6DAA6D;;AAI9E,QAAK,cAAc,IAAIA,sCAAiB;IACtC,QAAQ,KAAK,OAAO;IACpB,UAAU,KAAK,OAAO;IACtB,UAAU,KAAK,OAAO;;AAExB,OAAI;AACF,UAAM,KAAK,YAAY;WACjB;AAGR,SAAM,KAAK;WACJ,KAAK;AACZ,WAAQ,MAAM,uCAAuC;;AAGvD,SAAO,KAAK;;CAGd,MAAM,wBAAuC;AAC3C,MAAI,KAAK,gBACP;AAEF,MAAI,KAAK,sBAAsB;AAC7B,SAAM,KAAK;AACX;;AAGF,OAAK,wBAAwB,YAAY;GACvC,MAAMC,QAAwB;GAE9B,MAAM,YAAY,MAAM,KAAK;AAC7B,OAAI,UAAU,OACZ,OAAM,KAAK,GAAG;AAGhB,OAAI,MAAM,QAAQ,KAAK,QAAQ,oBAAoB,KAAK,OAAQ,gBAAiB,OAC/E,OAAM,KAAK,GAAI,KAAK,OAAQ;AAG9B,OAAI,MAAM,OACR,MAAK,MAAM,QAAQ,MACjB,OAAM,KAAK,oBAAoB,MAAM;IAAE,SAAS;IAAO,cAAc;;AAIzE,QAAK,kBAAkB;AACvB,QAAK;;AAGP,MAAI;AACF,SAAM,KAAK;YACH;AACR,QAAK,uBAAuB;AAC5B,QAAK,kBAAkB;;;CAI3B,MAAc,wBAAiD;AAC7D,MAAI,CAAC,KAAK,oBACR,QAAO;EAET,MAAM,WAAW,KAAK,mBAAmB;AACzC,MAAI,CAAC,SACH,QAAO;AAGT,MAAI;GACF,MAAM,EAAE,aAAa,MAAM,OAAO;GAClC,MAAM,MAAM,MAAM,SAAS,UAAU;GACrC,MAAM,SAAS,KAAK,MAAM;AAC1B,OAAI,CAAC,MAAM,QAAQ,SAAS;AAC1B,YAAQ,KAAK,mCAAmC,SAAS;AACzD,WAAO;;GAET,MAAMC,aAA6B;AACnC,QAAK,MAAM,SAAS,QAAQ;AAC1B,QAAI,CAAC,SAAS,OAAO,UAAU,SAAU;IACzC,MAAM,IAAK,MAAc;IACzB,MAAM,IAAK,MAAc;AACzB,QAAI,OAAO,MAAM,YAAY,KAAK,OAAO,MAAM,YAAY,EACzD,YAAW,KAAK;KAAE,UAAU;KAAG,UAAU;;;AAG7C,UAAO;WACAC,OAAY;AACnB,OAAI,OAAO,SAAS,SAClB,SAAQ,KAAK,kDAAkD,SAAS,IAAI;AAE9E,UAAO;;;CAIX,AAAQ,4BAAkC;AACxC,MAAI,CAAC,KAAK,OAAQ;AAElB,MAAI,KAAK,cAAc,SAAS,GAAG;AACjC,QAAK,OAAO,kBAAkB;AAC9B;;AAGF,OAAK,OAAO,kBAAkB,MAAM,KAAK,KAAK,cAAc,UAAU,KAAK,UAAU;GACnF,UAAU,KAAK;GACf,UAAU,KAAK;;;CAInB,MAAc,yBAAwC;AACpD,MAAI,CAAC,KAAK,oBACR;EAEF,MAAM,WAAW,KAAK,mBAAmB;AACzC,MAAI,CAAC,SACH;EAEF,MAAM,UAAU,MAAM,KAAK,KAAK,cAAc,WAAW,KAAK,CAAC,OAAO,WAAW;GAC/E;GACA,UAAU,KAAK;GACf,UAAU,KAAK;;AAEjB,MAAI;GACF,MAAM,EAAE,cAAc,MAAM,OAAO;GACnC,MAAM,aAAa,KAAK,UAAU,SAAS,MAAM;AACjD,SAAM,UAAU,UAAU,GAAG,WAAW,KAAK;WACtC,OAAO;AACd,WAAQ,KAAK,mDAAmD,SAAS,IAAI;;;CAIjF,MAAM,oBACJ,MACA,MACmC;AACnC,QAAM,KAAK;EAEX,MAAM,IAAI,MAAM;EAChB,MAAM,IAAI,MAAM;AAChB,MAAI,CAACC,4BAAS,MAAM,CAAC,KAAK,CAACA,4BAAS,MAAM,CAAC,EACzC,QAAO;EAGT,MAAM,SAAS,KAAK,QAAQ;AAC5B,MAAI,CAAC,QAAQ;AACX,WAAQ,KAAK;AACb,UAAO;;EAET,MAAM,OAAO,IAAIJ,sCAAiB;GAChC;GACA,UAAU;GACV,UAAU;;EAGZ,IAAI,QAAQ,KAAK;AACjB,MAAI,CAAC,MACH,KAAI;AACF,SAAM,KAAK;AACX,WAAQ,KAAK;WACN,OAAO;AACd,WAAQ,KAAK,oEAAoE;AACjF,UAAO;;AAIX,MAAI,CAAC,MACH,QAAO;AAGT,MAAI,MAAM,gBAAgB,KAAK,UAAU,IAAI,OAC3C,QAAO,EAAE;AAGX,MAAI,CAAC,KAAK,UAAU,IAAI,OACtB,MAAK,UAAU,IAAI,OAAO;AAE5B,MAAI,CAAC,KAAK,cAAc,IAAI,OAC1B,MAAK,cAAc,IAAI,OAAO;GAAE,UAAU;GAAG,UAAU;;AAGzD,OAAK;AAEL,MAAI,MAAM,YAAY,MACpB,OAAM,KAAK;AAGb,SAAO,EAAE;;CAGX,MAAM,uBACJ,OACA,MACkB;AAClB,QAAM,KAAK;AACX,MAAI,CAACI,4BAAS,UAAU,CAAC,MACvB,QAAO;EAET,MAAM,cAAc,KAAK,UAAU,OAAO;EAC1C,MAAM,cAAc,KAAK,cAAc,OAAO;AAC9C,MAAI,CAAC,eAAe,CAAC,YACnB,QAAO;AAET,OAAK;AACL,MAAI,MAAM,YAAY,MACpB,OAAM,KAAK;AAEb,SAAO;;CAGT,MAAM,gBAAgB,YAA4D;AAChF,MAAI,CAAC,KAAK,YAAa,OAAM,IAAI,MAAM;AACvC,SAAO,KAAK,YAAY,gBAAgB,EAAE;;CAG5C,MAAM,iBAAiB,aAA8D;AACnF,MAAI,CAAC,KAAK,YAAa,OAAM,IAAI,MAAM;AACvC,SAAO,KAAK,YAAY,iBAAiB,EAAE;;CAG7C,MAAM,8BAAqG;AACzG,MAAI,CAAC,KAAK,YAAa,OAAM,IAAI,MAAM;EAEvC,MAAM,EAAE,UAAU,aAAa,MAAM,KAAK,YAAY;EACtD,MAAM,SAAS,KAAK,QAAQ;AAC5B,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM;EAC7B,MAAM,OAAO,IAAIJ,sCAAiB;GAChC;GACA;GACA;;EAEF,IAAIK,QAAuB;AAC3B,MAAI;AACF,WAAQ,KAAK;AACb,OAAI,CAAC,OAAO;AACV,UAAM,KAAK;AACX,YAAQ,KAAK;;WAER,OAAO;AACd,WAAQ,KAAK,wEAAwE;;AAGvF,SAAO;GAAE;GAAU;GAAU;;;CAG/B,MAAM,0BAA0B,SAQ7B;AACD,QAAM,KAAK;AACX,MAAI,CAAC,KAAK,YAAa,OAAM,IAAI,MAAM;AACvC,MAAI,CAAC,KAAK,OAAQ,OAAM,IAAI,MAAM;EAElC,MAAM,qBAAqB,SAAS,uBAAuB;EAC3D,MAAM,eAAe,SAAS,uBAAuB;EAErD,MAAM,gBAAgB,KAAK,YAAY;EACvC,MAAM,kBAAkB;GACtB,UAAU,KAAK,OAAO;GACtB,UAAU,KAAK,OAAO;;EAGxB,MAAM,EAAE,UAAU,MAAM,UAAU,SAAS,MAAM,KAAK,YAAY;EAClE,MAAM,UAAU,IAAIL,sCAAiB;GACnC,QAAQ,KAAK,OAAO;GACpB,UAAU;GACV,UAAU;;AAGZ,QAAM,QAAQ;AAEd,OAAK,cAAc;AACnB,OAAK,OAAO,kBAAkB;AAC9B,OAAK,OAAO,kBAAkB;EAE9B,MAAM,WAAW,QAAQ;AAEzB,MACE,sBACG,iBACAI,4BAAS,gBAAgB,aACzBA,4BAAS,gBAAgB,UAE5B,OAAM,KAAK,oBAAoB,iBAAiB;GAAE,SAAS;GAAc,cAAc;;WAC9E,aACT,OAAM,KAAK;AAGb,SAAO;GACL,YAAY;IAAE,UAAU;IAAM,UAAU;;GACxC;GACA;GACA,aAAa,MAAM,KAAK,KAAK,UAAU;;;CAI3C,MAAM,0BAA0B,SAI7B;AACD,MAAI;GACF,MAAM,iBAAiB,SAAS,mBAAmB;GACnD,MAAM,SAAS,MAAM,KAAK,0BAA0B,EAAE,oBAAoB;AAC1E,UAAO;IACL,QAAQ;IACR,SAAS,EAAE,gBAAgB;IAC3B,MAAM,KAAK,UAAU;;WAEhBE,GAAQ;AACf,UAAO;IACL,QAAQ;IACR,SAAS,EAAE,gBAAgB;IAC3B,MAAM,KAAK,UAAU;KAAE,OAAO;KAAY,SAAS,GAAG;;;;;CAK5D,MAAM,6BACJ,OACA,SACyC;EACzC,MAAM,OAAO,KAAK,UAAU,IAAI;AAChC,SAAO,KAAK,iBAAiB;;CAG/B,AAAQ,oBAA6B;EACnC,MAAM,SAAS,QAAS,WAAmB,SAAS,UAAU;EAC9D,MAAM,qBAAqB,OAAQ,WAAmB,kBAAkB,eAClE,OAAO,cAAc,eAAgB,UAAkB,WAAW,WAAW;AACnF,SAAO,UAAU,CAAC"}