@tatchi-xyz/sdk 0.21.0 → 0.31.0

package/dist/esm/server/core/ThresholdService/cosigners.js

@@ -0,0 +1,278 @@
+import { toOptionalTrimmedString } from "../../sdk/src/utils/validation.js";
+import { base64UrlDecode, base64UrlEncode } from "../../sdk/src/utils/base64.js";
+import { sha512 } from "../../node_modules/.pnpm/@noble_hashes@2.0.1/node_modules/@noble/hashes/sha2.js";
+
+//#region src/server/core/ThresholdService/cosigners.ts
+const ED25519_ORDER_L = (1n << 252n) + 27742317777372353535851937790883648493n;
+function modL(x) {
+	const r = x % ED25519_ORDER_L;
+	return r >= 0n ? r : r + ED25519_ORDER_L;
+}
+function bytesToBigintLE(bytes) {
+	let out = 0n;
+	for (let i = 0; i < bytes.length; i += 1) out |= BigInt(bytes[i]) << 8n * BigInt(i);
+	return out;
+}
+function bigintToBytesLE32(x) {
+	const out = new Uint8Array(32);
+	let v = modL(x);
+	for (let i = 0; i < 32; i += 1) {
+		out[i] = Number(v & 255n);
+		v >>= 8n;
+	}
+	return out;
+}
+function invModL(x) {
+	let a = modL(x);
+	if (a === 0n) throw new Error("ed25519 scalar inverse: division by zero");
+	let t = 0n;
+	let newT = 1n;
+	let r = ED25519_ORDER_L;
+	let newR = a;
+	while (newR !== 0n) {
+		const q = r / newR;
+		[t, newT] = [newT, t - q * newT];
+		[r, newR] = [newR, r - q * newR];
+	}
+	if (r !== 1n) throw new Error("ed25519 scalar inverse: non-invertible");
+	return modL(t);
+}
+function hashToScalarWideLE(inputs) {
+	const totalLen = inputs.reduce((acc, b) => acc + b.length, 0);
+	const preimage = new Uint8Array(totalLen);
+	let offset = 0;
+	for (const chunk of inputs) {
+		preimage.set(chunk, offset);
+		offset += chunk.length;
+	}
+	const digest = sha512(preimage);
+	return modL(bytesToBigintLE(digest));
+}
+function deriveCosignerPolyCoefficients(input) {
+	const t = Math.floor(Number(input.cosignerThreshold) || 0);
+	if (!Number.isFinite(t) || t < 1) throw new Error("cosignerThreshold must be an integer >= 1");
+	const relayerSigningShareBytes = input.relayerSigningShareBytes;
+	if (relayerSigningShareBytes.length !== 32) throw new Error(`relayerSigningShare must be 32 bytes, got ${relayerSigningShareBytes.length}`);
+	const a0 = modL(bytesToBigintLE(relayerSigningShareBytes));
+	if (a0 === 0n) throw new Error("relayer signing share must be non-zero");
+	const coeffs = [a0];
+	if (t === 1) return coeffs;
+	const prefix = new TextEncoder().encode("w3a/threshold-ed25519/cosigner-poly_v1");
+	const tBytes = new Uint8Array(4);
+	new DataView(tBytes.buffer).setUint32(0, t, true);
+	for (let i = 1; i < t; i += 1) {
+		const idx = new Uint8Array(4);
+		new DataView(idx.buffer).setUint32(0, i, true);
+		const ai = hashToScalarWideLE([
+			prefix,
+			tBytes,
+			relayerSigningShareBytes,
+			idx
+		]);
+		coeffs.push(ai);
+	}
+	return coeffs;
+}
+function normalizeCosignerIds(input) {
+	if (!Array.isArray(input)) return null;
+	const ids = [];
+	for (const item of input) {
+		const n = Number(item);
+		if (!Number.isFinite(n)) return null;
+		const v = Math.floor(n);
+		if (v <= 0 || v > 65535) return null;
+		ids.push(v);
+	}
+	ids.sort((a, b) => a - b);
+	const unique = [];
+	for (const id of ids) if (unique.length === 0 || unique[unique.length - 1] !== id) unique.push(id);
+	return unique.length ? unique : null;
+}
+function deriveRelayerCosignerSharesFromRelayerSigningShare(input) {
+	const relayerSigningShareB64u = toOptionalTrimmedString(input.relayerSigningShareB64u);
+	if (!relayerSigningShareB64u) return {
+		ok: false,
+		code: "invalid_body",
+		message: "relayerSigningShareB64u is required"
+	};
+	let relayerSigningShareBytes;
+	try {
+		relayerSigningShareBytes = base64UrlDecode(relayerSigningShareB64u);
+	} catch (e) {
+		return {
+			ok: false,
+			code: "invalid_body",
+			message: `Invalid relayerSigningShareB64u: ${String(e || "decode failed")}`
+		};
+	}
+	if (relayerSigningShareBytes.length !== 32) return {
+		ok: false,
+		code: "invalid_body",
+		message: `relayerSigningShareB64u must be 32 bytes, got ${relayerSigningShareBytes.length}`
+	};
+	const cosignerIds = normalizeCosignerIds(input.cosignerIds);
+	if (!cosignerIds) return {
+		ok: false,
+		code: "invalid_body",
+		message: "cosignerIds must be a non-empty list of u16 ids"
+	};
+	const t = Math.floor(Number(input.cosignerThreshold) || 0);
+	if (!Number.isFinite(t) || t < 1) return {
+		ok: false,
+		code: "invalid_body",
+		message: "cosignerThreshold must be an integer >= 1"
+	};
+	if (t > cosignerIds.length) return {
+		ok: false,
+		code: "invalid_body",
+		message: `cosignerThreshold must be <= cosignerIds.length (got t=${t}, n=${cosignerIds.length})`
+	};
+	const coeffs = deriveCosignerPolyCoefficients({
+		relayerSigningShareBytes,
+		cosignerThreshold: t
+	});
+	const sharesByCosignerId = {};
+	for (const id of cosignerIds) {
+		const x = BigInt(id);
+		let xPow = x;
+		let y = coeffs[0];
+		for (let j = 1; j < coeffs.length; j += 1) {
+			y = modL(y + coeffs[j] * xPow);
+			xPow = modL(xPow * x);
+		}
+		if (y === 0n) return {
+			ok: false,
+			code: "internal",
+			message: `Derived cosigner share is zero for cosignerId=${id}`
+		};
+		sharesByCosignerId[String(id)] = base64UrlEncode(bigintToBytesLE32(y));
+	}
+	return {
+		ok: true,
+		sharesByCosignerId
+	};
+}
+function lagrangeCoefficientAtZeroForCosigner(input) {
+	const cosignerIds = normalizeCosignerIds(input.cosignerIds);
+	if (!cosignerIds) return {
+		ok: false,
+		code: "invalid_body",
+		message: "cosignerIds must be a non-empty list of u16 ids"
+	};
+	const cosignerId = Math.floor(Number(input.cosignerId) || 0);
+	if (!Number.isFinite(cosignerId) || cosignerId <= 0 || cosignerId > 65535) return {
+		ok: false,
+		code: "invalid_body",
+		message: "cosignerId must be an integer in [1,65535]"
+	};
+	if (!cosignerIds.includes(cosignerId)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "cosignerIds must include cosignerId"
+	};
+	const xI = BigInt(cosignerId);
+	let num = 1n;
+	let den = 1n;
+	for (const id of cosignerIds) {
+		if (id === cosignerId) continue;
+		const xJ = BigInt(id);
+		num = modL(num * xJ);
+		den = modL(den * (xJ - xI));
+	}
+	if (den === 0n) return {
+		ok: false,
+		code: "invalid_body",
+		message: "duplicated cosignerId in cosignerIds"
+	};
+	const lambda = modL(num * invModL(den));
+	return {
+		ok: true,
+		lambda: bigintToBytesLE32(lambda)
+	};
+}
+function multiplyEd25519ScalarB64uByScalarBytesLE32(input) {
+	const scalarB64u = toOptionalTrimmedString(input.scalarB64u);
+	if (!scalarB64u) return {
+		ok: false,
+		code: "invalid_body",
+		message: "scalarB64u is required"
+	};
+	let scalarBytes;
+	try {
+		scalarBytes = base64UrlDecode(scalarB64u);
+	} catch (e) {
+		return {
+			ok: false,
+			code: "invalid_body",
+			message: `Invalid scalarB64u: ${String(e || "decode failed")}`
+		};
+	}
+	if (scalarBytes.length !== 32) return {
+		ok: false,
+		code: "invalid_body",
+		message: `scalarB64u must be 32 bytes, got ${scalarBytes.length}`
+	};
+	const factorBytes = input.factorBytesLE32;
+	if (!(factorBytes instanceof Uint8Array) || factorBytes.length !== 32) return {
+		ok: false,
+		code: "invalid_body",
+		message: "factorBytesLE32 must be a 32-byte Uint8Array"
+	};
+	const scalar = modL(bytesToBigintLE(scalarBytes));
+	const factor = modL(bytesToBigintLE(factorBytes));
+	const out = modL(scalar * factor);
+	if (out === 0n) return {
+		ok: false,
+		code: "internal",
+		message: "Derived scalar is zero"
+	};
+	return {
+		ok: true,
+		scalarB64u: base64UrlEncode(bigintToBytesLE32(out))
+	};
+}
+function addEd25519ScalarsB64u(input) {
+	if (!Array.isArray(input.scalarsB64u) || input.scalarsB64u.length === 0) return {
+		ok: false,
+		code: "invalid_body",
+		message: "scalarsB64u must be a non-empty array"
+	};
+	let acc = 0n;
+	for (const item of input.scalarsB64u) {
+		const raw = toOptionalTrimmedString(item);
+		if (!raw) return {
+			ok: false,
+			code: "invalid_body",
+			message: "scalarsB64u contains an empty item"
+		};
+		let bytes;
+		try {
+			bytes = base64UrlDecode(raw);
+		} catch (e) {
+			return {
+				ok: false,
+				code: "invalid_body",
+				message: `Invalid scalar encoding: ${String(e || "decode failed")}`
+			};
+		}
+		if (bytes.length !== 32) return {
+			ok: false,
+			code: "invalid_body",
+			message: `scalar must be 32 bytes, got ${bytes.length}`
+		};
+		acc = modL(acc + bytesToBigintLE(bytes));
+	}
+	if (acc === 0n) return {
+		ok: false,
+		code: "internal",
+		message: "Sum of scalars is zero"
+	};
+	return {
+		ok: true,
+		scalarB64u: base64UrlEncode(bigintToBytesLE32(acc))
+	};
+}
+
+//#endregion
+export { addEd25519ScalarsB64u, deriveRelayerCosignerSharesFromRelayerSigningShare, lagrangeCoefficientAtZeroForCosigner, multiplyEd25519ScalarB64uByScalarBytesLE32, normalizeCosignerIds };
+//# sourceMappingURL=cosigners.js.map

package/dist/esm/server/core/ThresholdService/cosigners.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cosigners.js","names":["coeffs: bigint[]","ids: number[]","unique: number[]","relayerSigningShareBytes: Uint8Array","e: unknown","sharesByCosignerId: Record<string, string>","scalarBytes: Uint8Array","bytes: Uint8Array"],"sources":["../../../../../src/server/core/ThresholdService/cosigners.ts"],"sourcesContent":["import { base64UrlDecode, base64UrlEncode } from '../../../utils/encoders';\nimport { toOptionalTrimmedString } from '../../../utils/validation';\nimport { sha512 } from '@noble/hashes/sha2.js';\n\nconst ED25519_ORDER_L = (1n << 252n) + 27742317777372353535851937790883648493n;\n\nfunction modL(x: bigint): bigint {\n  const r = x % ED25519_ORDER_L;\n  return r >= 0n ? r : r + ED25519_ORDER_L;\n}\n\nfunction bytesToBigintLE(bytes: Uint8Array): bigint {\n  let out = 0n;\n  for (let i = 0; i < bytes.length; i += 1) {\n    out |= BigInt(bytes[i]!) << (8n * BigInt(i));\n  }\n  return out;\n}\n\nfunction bigintToBytesLE32(x: bigint): Uint8Array {\n  const out = new Uint8Array(32);\n  let v = modL(x);\n  for (let i = 0; i < 32; i += 1) {\n    out[i] = Number(v & 0xffn);\n    v >>= 8n;\n  }\n  return out;\n}\n\nfunction invModL(x: bigint): bigint {\n  let a = modL(x);\n  if (a === 0n) throw new Error('ed25519 scalar inverse: division by zero');\n\n  // Extended Euclidean algorithm to find inverse mod L.\n  let t = 0n;\n  let newT = 1n;\n  let r = ED25519_ORDER_L;\n  let newR = a;\n  while (newR !== 0n) {\n    const q = r / newR;\n    [t, newT] = [newT, t - q * newT];\n    [r, newR] = [newR, r - q * newR];\n  }\n  if (r !== 1n) throw new Error('ed25519 scalar inverse: non-invertible');\n  return modL(t);\n}\n\nfunction u16ToScalarBytesLE(id: number): Uint8Array {\n  const n = Math.floor(Number(id) || 0);\n  if (!Number.isFinite(n) || n <= 0 || n > 65535) {\n    throw new Error('cosignerId must be an integer in [1,65535]');\n  }\n  const bytes = new Uint8Array(32);\n  bytes[0] = n & 0xff;\n  bytes[1] = (n >>> 8) & 0xff;\n  return bytes;\n}\n\nfunction hashToScalarWideLE(inputs: Uint8Array[]): bigint {\n  const totalLen = inputs.reduce((acc, b) => acc + b.length, 0);\n  const preimage = new Uint8Array(totalLen);\n  let offset = 0;\n  for (const chunk of inputs) {\n    preimage.set(chunk, offset);\n    offset += chunk.length;\n  }\n  const digest = sha512(preimage);\n  return modL(bytesToBigintLE(digest));\n}\n\nfunction deriveCosignerPolyCoefficients(input: {\n  relayerSigningShareBytes: Uint8Array;\n  cosignerThreshold: number;\n}): bigint[] {\n  const t = Math.floor(Number(input.cosignerThreshold) || 0);\n  if (!Number.isFinite(t) || t < 1) {\n    throw new Error('cosignerThreshold must be an integer >= 1');\n  }\n\n  const relayerSigningShareBytes = input.relayerSigningShareBytes;\n  if (relayerSigningShareBytes.length !== 32) {\n    throw new Error(`relayerSigningShare must be 32 bytes, got ${relayerSigningShareBytes.length}`);\n  }\n\n  const a0 = modL(bytesToBigintLE(relayerSigningShareBytes));\n  if (a0 === 0n) {\n    throw new Error('relayer signing share must be non-zero');\n  }\n\n  const coeffs: bigint[] = [a0];\n  if (t === 1) return coeffs;\n\n  const prefix = new TextEncoder().encode('w3a/threshold-ed25519/cosigner-poly_v1');\n  const tBytes = new Uint8Array(4);\n  new DataView(tBytes.buffer).setUint32(0, t, true);\n\n  for (let i = 1; i < t; i += 1) {\n    const idx = new Uint8Array(4);\n    new DataView(idx.buffer).setUint32(0, i, true);\n    const ai = hashToScalarWideLE([prefix, tBytes, relayerSigningShareBytes, idx]);\n    coeffs.push(ai);\n  }\n  return coeffs;\n}\n\nexport function normalizeCosignerIds(input: unknown): number[] | null {\n  if (!Array.isArray(input)) return null;\n  const ids: number[] = [];\n  for (const item of input) {\n    const n = Number(item);\n    if (!Number.isFinite(n)) return null;\n    const v = Math.floor(n);\n    if (v <= 0 || v > 65535) return null;\n    ids.push(v);\n  }\n  ids.sort((a, b) => a - b);\n  const unique: number[] = [];\n  for (const id of ids) {\n    if (unique.length === 0 || unique[unique.length - 1] !== id) unique.push(id);\n  }\n  return unique.length ? unique : null;\n}\n\nexport function deriveRelayerCosignerSharesFromRelayerSigningShare(input: {\n  relayerSigningShareB64u: string;\n  cosignerIds: number[];\n  cosignerThreshold: number;\n}): {\n  ok: true;\n  sharesByCosignerId: Record<string, string>;\n} | {\n  ok: false;\n  code: string;\n  message: string;\n} {\n  const relayerSigningShareB64u = toOptionalTrimmedString(input.relayerSigningShareB64u);\n  if (!relayerSigningShareB64u) {\n    return { ok: false, code: 'invalid_body', message: 'relayerSigningShareB64u is required' };\n  }\n\n  let relayerSigningShareBytes: Uint8Array;\n  try {\n    relayerSigningShareBytes = base64UrlDecode(relayerSigningShareB64u);\n  } catch (e: unknown) {\n    return { ok: false, code: 'invalid_body', message: `Invalid relayerSigningShareB64u: ${String(e || 'decode failed')}` };\n  }\n  if (relayerSigningShareBytes.length !== 32) {\n    return { ok: false, code: 'invalid_body', message: `relayerSigningShareB64u must be 32 bytes, got ${relayerSigningShareBytes.length}` };\n  }\n\n  const cosignerIds = normalizeCosignerIds(input.cosignerIds);\n  if (!cosignerIds) {\n    return { ok: false, code: 'invalid_body', message: 'cosignerIds must be a non-empty list of u16 ids' };\n  }\n\n  const t = Math.floor(Number(input.cosignerThreshold) || 0);\n  if (!Number.isFinite(t) || t < 1) {\n    return { ok: false, code: 'invalid_body', message: 'cosignerThreshold must be an integer >= 1' };\n  }\n  if (t > cosignerIds.length) {\n    return { ok: false, code: 'invalid_body', message: `cosignerThreshold must be <= cosignerIds.length (got t=${t}, n=${cosignerIds.length})` };\n  }\n\n  const coeffs = deriveCosignerPolyCoefficients({ relayerSigningShareBytes, cosignerThreshold: t });\n\n  const sharesByCosignerId: Record<string, string> = {};\n  for (const id of cosignerIds) {\n    const x = BigInt(id);\n    let xPow = x;\n    let y = coeffs[0]!;\n    for (let j = 1; j < coeffs.length; j += 1) {\n      y = modL(y + coeffs[j]! * xPow);\n      xPow = modL(xPow * x);\n    }\n    if (y === 0n) {\n      return { ok: false, code: 'internal', message: `Derived cosigner share is zero for cosignerId=${id}` };\n    }\n    sharesByCosignerId[String(id)] = base64UrlEncode(bigintToBytesLE32(y));\n  }\n\n  return { ok: true, sharesByCosignerId };\n}\n\nexport function lagrangeCoefficientAtZeroForCosigner(input: {\n  cosignerId: number;\n  cosignerIds: number[];\n}): { ok: true; lambda: Uint8Array } | { ok: false; code: string; message: string } {\n  const cosignerIds = normalizeCosignerIds(input.cosignerIds);\n  if (!cosignerIds) {\n    return { ok: false, code: 'invalid_body', message: 'cosignerIds must be a non-empty list of u16 ids' };\n  }\n\n  const cosignerId = Math.floor(Number(input.cosignerId) || 0);\n  if (!Number.isFinite(cosignerId) || cosignerId <= 0 || cosignerId > 65535) {\n    return { ok: false, code: 'invalid_body', message: 'cosignerId must be an integer in [1,65535]' };\n  }\n  if (!cosignerIds.includes(cosignerId)) {\n    return { ok: false, code: 'invalid_body', message: 'cosignerIds must include cosignerId' };\n  }\n\n  const xI = BigInt(cosignerId);\n  let num = 1n;\n  let den = 1n;\n  for (const id of cosignerIds) {\n    if (id === cosignerId) continue;\n    const xJ = BigInt(id);\n    num = modL(num * xJ);\n    den = modL(den * (xJ - xI));\n  }\n  if (den === 0n) {\n    return { ok: false, code: 'invalid_body', message: 'duplicated cosignerId in cosignerIds' };\n  }\n\n  const lambda = modL(num * invModL(den));\n  return { ok: true, lambda: bigintToBytesLE32(lambda) };\n}\n\nexport function encodeFrostIdentifierBytesFromU16(id: number): Uint8Array {\n  return u16ToScalarBytesLE(id);\n}\n\nexport function multiplyEd25519ScalarB64uByScalarBytesLE32(input: {\n  scalarB64u: string;\n  factorBytesLE32: Uint8Array;\n}): { ok: true; scalarB64u: string } | { ok: false; code: string; message: string } {\n  const scalarB64u = toOptionalTrimmedString(input.scalarB64u);\n  if (!scalarB64u) {\n    return { ok: false, code: 'invalid_body', message: 'scalarB64u is required' };\n  }\n\n  let scalarBytes: Uint8Array;\n  try {\n    scalarBytes = base64UrlDecode(scalarB64u);\n  } catch (e: unknown) {\n    return { ok: false, code: 'invalid_body', message: `Invalid scalarB64u: ${String(e || 'decode failed')}` };\n  }\n  if (scalarBytes.length !== 32) {\n    return { ok: false, code: 'invalid_body', message: `scalarB64u must be 32 bytes, got ${scalarBytes.length}` };\n  }\n\n  const factorBytes = input.factorBytesLE32;\n  if (!(factorBytes instanceof Uint8Array) || factorBytes.length !== 32) {\n    return { ok: false, code: 'invalid_body', message: 'factorBytesLE32 must be a 32-byte Uint8Array' };\n  }\n\n  const scalar = modL(bytesToBigintLE(scalarBytes));\n  const factor = modL(bytesToBigintLE(factorBytes));\n  const out = modL(scalar * factor);\n  if (out === 0n) {\n    return { ok: false, code: 'internal', message: 'Derived scalar is zero' };\n  }\n  return { ok: true, scalarB64u: base64UrlEncode(bigintToBytesLE32(out)) };\n}\n\nexport function addEd25519ScalarsB64u(input: {\n  scalarsB64u: string[];\n}): { ok: true; scalarB64u: string } | { ok: false; code: string; message: string } {\n  if (!Array.isArray(input.scalarsB64u) || input.scalarsB64u.length === 0) {\n    return { ok: false, code: 'invalid_body', message: 'scalarsB64u must be a non-empty array' };\n  }\n\n  let acc = 0n;\n  for (const item of input.scalarsB64u) {\n    const raw = toOptionalTrimmedString(item);\n    if (!raw) return { ok: false, code: 'invalid_body', message: 'scalarsB64u contains an empty item' };\n    let bytes: Uint8Array;\n    try {\n      bytes = base64UrlDecode(raw);\n    } catch (e: unknown) {\n      return { ok: false, code: 'invalid_body', message: `Invalid scalar encoding: ${String(e || 'decode failed')}` };\n    }\n    if (bytes.length !== 32) {\n      return { ok: false, code: 'invalid_body', message: `scalar must be 32 bytes, got ${bytes.length}` };\n    }\n    acc = modL(acc + bytesToBigintLE(bytes));\n  }\n\n  if (acc === 0n) {\n    return { ok: false, code: 'internal', message: 'Sum of scalars is zero' };\n  }\n  return { ok: true, scalarB64u: base64UrlEncode(bigintToBytesLE32(acc)) };\n}\n"],"mappings":";;;;;AAIA,MAAM,mBAAmB,MAAM,QAAQ;AAEvC,SAAS,KAAK,GAAmB;CAC/B,MAAM,IAAI,IAAI;AACd,QAAO,KAAK,KAAK,IAAI,IAAI;;AAG3B,SAAS,gBAAgB,OAA2B;CAClD,IAAI,MAAM;AACV,MAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,EACrC,QAAO,OAAO,MAAM,OAAS,KAAK,OAAO;AAE3C,QAAO;;AAGT,SAAS,kBAAkB,GAAuB;CAChD,MAAM,MAAM,IAAI,WAAW;CAC3B,IAAI,IAAI,KAAK;AACb,MAAK,IAAI,IAAI,GAAG,IAAI,IAAI,KAAK,GAAG;AAC9B,MAAI,KAAK,OAAO,IAAI;AACpB,QAAM;;AAER,QAAO;;AAGT,SAAS,QAAQ,GAAmB;CAClC,IAAI,IAAI,KAAK;AACb,KAAI,MAAM,GAAI,OAAM,IAAI,MAAM;CAG9B,IAAI,IAAI;CACR,IAAI,OAAO;CACX,IAAI,IAAI;CACR,IAAI,OAAO;AACX,QAAO,SAAS,IAAI;EAClB,MAAM,IAAI,IAAI;AACd,GAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,IAAI;AAC3B,GAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,IAAI;;AAE7B,KAAI,MAAM,GAAI,OAAM,IAAI,MAAM;AAC9B,QAAO,KAAK;;AAcd,SAAS,mBAAmB,QAA8B;CACxD,MAAM,WAAW,OAAO,QAAQ,KAAK,MAAM,MAAM,EAAE,QAAQ;CAC3D,MAAM,WAAW,IAAI,WAAW;CAChC,IAAI,SAAS;AACb,MAAK,MAAM,SAAS,QAAQ;AAC1B,WAAS,IAAI,OAAO;AACpB,YAAU,MAAM;;CAElB,MAAM,SAAS,OAAO;AACtB,QAAO,KAAK,gBAAgB;;AAG9B,SAAS,+BAA+B,OAG3B;CACX,MAAM,IAAI,KAAK,MAAM,OAAO,MAAM,sBAAsB;AACxD,KAAI,CAAC,OAAO,SAAS,MAAM,IAAI,EAC7B,OAAM,IAAI,MAAM;CAGlB,MAAM,2BAA2B,MAAM;AACvC,KAAI,yBAAyB,WAAW,GACtC,OAAM,IAAI,MAAM,6CAA6C,yBAAyB;CAGxF,MAAM,KAAK,KAAK,gBAAgB;AAChC,KAAI,OAAO,GACT,OAAM,IAAI,MAAM;CAGlB,MAAMA,SAAmB,CAAC;AAC1B,KAAI,MAAM,EAAG,QAAO;CAEpB,MAAM,SAAS,IAAI,cAAc,OAAO;CACxC,MAAM,SAAS,IAAI,WAAW;AAC9B,KAAI,SAAS,OAAO,QAAQ,UAAU,GAAG,GAAG;AAE5C,MAAK,IAAI,IAAI,GAAG,IAAI,GAAG,KAAK,GAAG;EAC7B,MAAM,MAAM,IAAI,WAAW;AAC3B,MAAI,SAAS,IAAI,QAAQ,UAAU,GAAG,GAAG;EACzC,MAAM,KAAK,mBAAmB;GAAC;GAAQ;GAAQ;GAA0B;;AACzE,SAAO,KAAK;;AAEd,QAAO;;AAGT,SAAgB,qBAAqB,OAAiC;AACpE,KAAI,CAAC,MAAM,QAAQ,OAAQ,QAAO;CAClC,MAAMC,MAAgB;AACtB,MAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,IAAI,OAAO;AACjB,MAAI,CAAC,OAAO,SAAS,GAAI,QAAO;EAChC,MAAM,IAAI,KAAK,MAAM;AACrB,MAAI,KAAK,KAAK,IAAI,MAAO,QAAO;AAChC,MAAI,KAAK;;AAEX,KAAI,MAAM,GAAG,MAAM,IAAI;CACvB,MAAMC,SAAmB;AACzB,MAAK,MAAM,MAAM,IACf,KAAI,OAAO,WAAW,KAAK,OAAO,OAAO,SAAS,OAAO,GAAI,QAAO,KAAK;AAE3E,QAAO,OAAO,SAAS,SAAS;;AAGlC,SAAgB,mDAAmD,OAWjE;CACA,MAAM,0BAA0B,wBAAwB,MAAM;AAC9D,KAAI,CAAC,wBACH,QAAO;EAAE,IAAI;EAAO,MAAM;EAAgB,SAAS;;CAGrD,IAAIC;AACJ,KAAI;AACF,6BAA2B,gBAAgB;UACpCC,GAAY;AACnB,SAAO;GAAE,IAAI;GAAO,MAAM;GAAgB,SAAS,oCAAoC,OAAO,KAAK;;;AAErG,KAAI,yBAAyB,WAAW,GACtC,QAAO;EAAE,IAAI;EAAO,MAAM;EAAgB,SAAS,iDAAiD,yBAAyB;;CAG/H,MAAM,cAAc,qBAAqB,MAAM;AAC/C,KAAI,CAAC,YACH,QAAO;EAAE,IAAI;EAAO,MAAM;EAAgB,SAAS;;CAGrD,MAAM,IAAI,KAAK,MAAM,OAAO,MAAM,sBAAsB;AACxD,KAAI,CAAC,OAAO,SAAS,MAAM,IAAI,EAC7B,QAAO;EAAE,IAAI;EAAO,MAAM;EAAgB,SAAS;;AAErD,KAAI,IAAI,YAAY,OAClB,QAAO;EAAE,IAAI;EAAO,MAAM;EAAgB,SAAS,0DAA0D,EAAE,MAAM,YAAY,OAAO;;CAG1I,MAAM,SAAS,+BAA+B;EAAE;EAA0B,mBAAmB;;CAE7F,MAAMC,qBAA6C;AACnD,MAAK,MAAM,MAAM,aAAa;EAC5B,MAAM,IAAI,OAAO;EACjB,IAAI,OAAO;EACX,IAAI,IAAI,OAAO;AACf,OAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK,GAAG;AACzC,OAAI,KAAK,IAAI,OAAO,KAAM;AAC1B,UAAO,KAAK,OAAO;;AAErB,MAAI,MAAM,GACR,QAAO;GAAE,IAAI;GAAO,MAAM;GAAY,SAAS,iDAAiD;;AAElG,qBAAmB,OAAO,OAAO,gBAAgB,kBAAkB;;AAGrE,QAAO;EAAE,IAAI;EAAM;;;AAGrB,SAAgB,qCAAqC,OAG+B;CAClF,MAAM,cAAc,qBAAqB,MAAM;AAC/C,KAAI,CAAC,YACH,QAAO;EAAE,IAAI;EAAO,MAAM;EAAgB,SAAS;;CAGrD,MAAM,aAAa,KAAK,MAAM,OAAO,MAAM,eAAe;AAC1D,KAAI,CAAC,OAAO,SAAS,eAAe,cAAc,KAAK,aAAa,MAClE,QAAO;EAAE,IAAI;EAAO,MAAM;EAAgB,SAAS;;AAErD,KAAI,CAAC,YAAY,SAAS,YACxB,QAAO;EAAE,IAAI;EAAO,MAAM;EAAgB,SAAS;;CAGrD,MAAM,KAAK,OAAO;CAClB,IAAI,MAAM;CACV,IAAI,MAAM;AACV,MAAK,MAAM,MAAM,aAAa;AAC5B,MAAI,OAAO,WAAY;EACvB,MAAM,KAAK,OAAO;AAClB,QAAM,KAAK,MAAM;AACjB,QAAM,KAAK,OAAO,KAAK;;AAEzB,KAAI,QAAQ,GACV,QAAO;EAAE,IAAI;EAAO,MAAM;EAAgB,SAAS;;CAGrD,MAAM,SAAS,KAAK,MAAM,QAAQ;AAClC,QAAO;EAAE,IAAI;EAAM,QAAQ,kBAAkB;;;AAO/C,SAAgB,2CAA2C,OAGyB;CAClF,MAAM,aAAa,wBAAwB,MAAM;AACjD,KAAI,CAAC,WACH,QAAO;EAAE,IAAI;EAAO,MAAM;EAAgB,SAAS;;CAGrD,IAAIC;AACJ,KAAI;AACF,gBAAc,gBAAgB;UACvBF,GAAY;AACnB,SAAO;GAAE,IAAI;GAAO,MAAM;GAAgB,SAAS,uBAAuB,OAAO,KAAK;;;AAExF,KAAI,YAAY,WAAW,GACzB,QAAO;EAAE,IAAI;EAAO,MAAM;EAAgB,SAAS,oCAAoC,YAAY;;CAGrG,MAAM,cAAc,MAAM;AAC1B,KAAI,EAAE,uBAAuB,eAAe,YAAY,WAAW,GACjE,QAAO;EAAE,IAAI;EAAO,MAAM;EAAgB,SAAS;;CAGrD,MAAM,SAAS,KAAK,gBAAgB;CACpC,MAAM,SAAS,KAAK,gBAAgB;CACpC,MAAM,MAAM,KAAK,SAAS;AAC1B,KAAI,QAAQ,GACV,QAAO;EAAE,IAAI;EAAO,MAAM;EAAY,SAAS;;AAEjD,QAAO;EAAE,IAAI;EAAM,YAAY,gBAAgB,kBAAkB;;;AAGnE,SAAgB,sBAAsB,OAE8C;AAClF,KAAI,CAAC,MAAM,QAAQ,MAAM,gBAAgB,MAAM,YAAY,WAAW,EACpE,QAAO;EAAE,IAAI;EAAO,MAAM;EAAgB,SAAS;;CAGrD,IAAI,MAAM;AACV,MAAK,MAAM,QAAQ,MAAM,aAAa;EACpC,MAAM,MAAM,wBAAwB;AACpC,MAAI,CAAC,IAAK,QAAO;GAAE,IAAI;GAAO,MAAM;GAAgB,SAAS;;EAC7D,IAAIG;AACJ,MAAI;AACF,WAAQ,gBAAgB;WACjBH,GAAY;AACnB,UAAO;IAAE,IAAI;IAAO,MAAM;IAAgB,SAAS,4BAA4B,OAAO,KAAK;;;AAE7F,MAAI,MAAM,WAAW,GACnB,QAAO;GAAE,IAAI;GAAO,MAAM;GAAgB,SAAS,gCAAgC,MAAM;;AAE3F,QAAM,KAAK,MAAM,gBAAgB;;AAGnC,KAAI,QAAQ,GACV,QAAO;EAAE,IAAI;EAAO,MAAM;EAAY,SAAS;;AAEjD,QAAO;EAAE,IAAI;EAAM,YAAY,gBAAgB,kBAAkB"}

package/dist/esm/server/core/ThresholdService/createThresholdSigningService.js

@@ -0,0 +1,98 @@
+import { isObject } from "../../sdk/src/utils/validation.js";
+import { ThresholdSigningService } from "./ThresholdSigningService.js";
+import { coerceLogger } from "../logger.js";
+import { createThresholdEd25519AuthSessionStore } from "./stores/AuthSessionStore.js";
+import { createThresholdEd25519KeyStore } from "./stores/KeyStore.js";
+import { createThresholdEd25519SessionStore } from "./stores/SessionStore.js";
+
+//#region src/server/core/ThresholdService/createThresholdSigningService.ts
+function isNodeEnvironment() {
+	const processObj = globalThis.process;
+	const isNode = Boolean(processObj?.versions?.node);
+	const webSocketPair = globalThis.WebSocketPair;
+	const isCloudflareWorker = typeof webSocketPair !== "undefined" || typeof navigator !== "undefined" && String(navigator.userAgent || "").includes("Cloudflare-Workers");
+	return isNode && !isCloudflareWorker;
+}
+function createThresholdSigningService(input) {
+	const logger = coerceLogger(input.logger);
+	const isNode = input.isNode ?? isNodeEnvironment();
+	const env = isNode ? globalThis.process?.env : void 0;
+	const envFallback = env ? {
+		UPSTASH_REDIS_REST_URL: env.UPSTASH_REDIS_REST_URL,
+		UPSTASH_REDIS_REST_TOKEN: env.UPSTASH_REDIS_REST_TOKEN,
+		REDIS_URL: env.REDIS_URL,
+		THRESHOLD_ED25519_KEYSTORE_PREFIX: env.THRESHOLD_ED25519_KEYSTORE_PREFIX,
+		THRESHOLD_ED25519_SESSION_PREFIX: env.THRESHOLD_ED25519_SESSION_PREFIX,
+		THRESHOLD_ED25519_AUTH_PREFIX: env.THRESHOLD_ED25519_AUTH_PREFIX,
+		THRESHOLD_ED25519_CLIENT_PARTICIPANT_ID: env.THRESHOLD_ED25519_CLIENT_PARTICIPANT_ID,
+		THRESHOLD_ED25519_RELAYER_PARTICIPANT_ID: env.THRESHOLD_ED25519_RELAYER_PARTICIPANT_ID,
+		THRESHOLD_ED25519_MASTER_SECRET_B64U: env.THRESHOLD_ED25519_MASTER_SECRET_B64U,
+		THRESHOLD_ED25519_SHARE_MODE: env.THRESHOLD_ED25519_SHARE_MODE,
+		THRESHOLD_NODE_ROLE: env.THRESHOLD_NODE_ROLE,
+		THRESHOLD_COORDINATOR_SHARED_SECRET_B64U: env.THRESHOLD_COORDINATOR_SHARED_SECRET_B64U,
+		THRESHOLD_ED25519_RELAYER_COSIGNERS: env.THRESHOLD_ED25519_RELAYER_COSIGNERS,
+		THRESHOLD_ED25519_RELAYER_COSIGNER_ID: env.THRESHOLD_ED25519_RELAYER_COSIGNER_ID,
+		THRESHOLD_ED25519_RELAYER_COSIGNER_T: env.THRESHOLD_ED25519_RELAYER_COSIGNER_T
+	} : null;
+	const config = isObject(envFallback) && isObject(input.thresholdEd25519KeyStore) ? {
+		...envFallback,
+		...input.thresholdEd25519KeyStore
+	} : input.thresholdEd25519KeyStore ?? envFallback;
+	try {
+		const cosignersRaw = config?.THRESHOLD_ED25519_RELAYER_COSIGNERS;
+		const cosignerCount = (() => {
+			if (typeof cosignersRaw !== "string") return null;
+			const parsed = JSON.parse(cosignersRaw);
+			return Array.isArray(parsed) ? parsed.length : null;
+		})();
+		const shareMode = config?.THRESHOLD_ED25519_SHARE_MODE;
+		const nodeRole = config?.THRESHOLD_NODE_ROLE;
+		const cosignerId = config?.THRESHOLD_ED25519_RELAYER_COSIGNER_ID;
+		const cosignerT = config?.THRESHOLD_ED25519_RELAYER_COSIGNER_T;
+		const hasMasterSecret = Boolean(typeof config?.THRESHOLD_ED25519_MASTER_SECRET_B64U === "string" && config?.THRESHOLD_ED25519_MASTER_SECRET_B64U?.trim());
+		logger.info("[threshold-ed25519] init", {
+			isNode,
+			nodeRole: typeof nodeRole === "string" ? nodeRole : null,
+			shareMode: typeof shareMode === "string" ? shareMode : null,
+			hasMasterSecret,
+			cosignerId: typeof cosignerId === "string" ? cosignerId : null,
+			cosignerT: typeof cosignerT === "string" ? cosignerT : null,
+			cosignerCount
+		});
+	} catch {}
+	const keyStore = createThresholdEd25519KeyStore({
+		config,
+		logger,
+		isNode
+	});
+	const sessionStore = createThresholdEd25519SessionStore({
+		config,
+		logger,
+		isNode
+	});
+	const authSessionStore = createThresholdEd25519AuthSessionStore({
+		config,
+		logger,
+		isNode
+	});
+	const ensureReady = async () => {
+		await input.authService.getRelayerAccount();
+	};
+	return new ThresholdSigningService({
+		logger,
+		keyStore,
+		sessionStore,
+		authSessionStore,
+		config,
+		ensureReady,
+		ensureSignerWasm: ensureReady,
+		verifyAuthenticationResponse: (req) => input.authService.verifyAuthenticationResponse(req),
+		viewAccessKeyList: (accountId) => input.authService.viewAccessKeyList(accountId),
+		txStatus: (txHash, senderAccountId) => input.authService.txStatus(txHash, senderAccountId),
+		webAuthnContractId: input.authService.getWebAuthnContractId()
+	});
+}
+
+//#endregion
+export { createThresholdSigningService };
+//# sourceMappingURL=createThresholdSigningService.js.map

package/dist/esm/server/core/ThresholdService/createThresholdSigningService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createThresholdSigningService.js","names":["envFallback: ThresholdEd25519KeyStoreConfigInput | null"],"sources":["../../../../../src/server/core/ThresholdService/createThresholdSigningService.ts"],"sourcesContent":["import type { AuthService } from '../AuthService';\nimport type { ThresholdEd25519KeyStoreConfigInput } from '../types';\nimport type { Logger } from '../logger';\nimport { coerceLogger } from '../logger';\nimport { ThresholdSigningService } from './ThresholdSigningService';\nimport { createThresholdEd25519AuthSessionStore } from './stores/AuthSessionStore';\nimport { createThresholdEd25519KeyStore } from './stores/KeyStore';\nimport { createThresholdEd25519SessionStore } from './stores/SessionStore';\nimport { isObject } from '../../../utils/validation';\n\nfunction isNodeEnvironment(): boolean {\n  const processObj = (globalThis as unknown as { process?: { versions?: { node?: string } } }).process;\n  const isNode = Boolean(processObj?.versions?.node);\n  const webSocketPair = (globalThis as unknown as { WebSocketPair?: unknown }).WebSocketPair;\n  const isCloudflareWorker = typeof webSocketPair !== 'undefined'\n    || (typeof navigator !== 'undefined' && String(navigator.userAgent || '').includes('Cloudflare-Workers'));\n  return isNode && !isCloudflareWorker;\n}\n\nexport function createThresholdSigningService(input: {\n  authService: AuthService;\n  thresholdEd25519KeyStore?: ThresholdEd25519KeyStoreConfigInput | null;\n  logger?: Logger | null;\n  isNode?: boolean;\n}): ThresholdSigningService {\n  const logger = coerceLogger(input.logger);\n  const isNode = input.isNode ?? isNodeEnvironment();\n  const env = isNode\n    ? (globalThis as unknown as { process?: { env?: Record<string, string | undefined> } }).process?.env\n    : undefined;\n  const envFallback: ThresholdEd25519KeyStoreConfigInput | null = env\n    ? {\n      UPSTASH_REDIS_REST_URL: env.UPSTASH_REDIS_REST_URL,\n      UPSTASH_REDIS_REST_TOKEN: env.UPSTASH_REDIS_REST_TOKEN,\n      REDIS_URL: env.REDIS_URL,\n      THRESHOLD_ED25519_KEYSTORE_PREFIX: env.THRESHOLD_ED25519_KEYSTORE_PREFIX,\n      THRESHOLD_ED25519_SESSION_PREFIX: env.THRESHOLD_ED25519_SESSION_PREFIX,\n      THRESHOLD_ED25519_AUTH_PREFIX: env.THRESHOLD_ED25519_AUTH_PREFIX,\n      THRESHOLD_ED25519_CLIENT_PARTICIPANT_ID: env.THRESHOLD_ED25519_CLIENT_PARTICIPANT_ID,\n      THRESHOLD_ED25519_RELAYER_PARTICIPANT_ID: env.THRESHOLD_ED25519_RELAYER_PARTICIPANT_ID,\n      THRESHOLD_ED25519_MASTER_SECRET_B64U: env.THRESHOLD_ED25519_MASTER_SECRET_B64U,\n      THRESHOLD_ED25519_SHARE_MODE: env.THRESHOLD_ED25519_SHARE_MODE,\n      THRESHOLD_NODE_ROLE: env.THRESHOLD_NODE_ROLE,\n      THRESHOLD_COORDINATOR_SHARED_SECRET_B64U: env.THRESHOLD_COORDINATOR_SHARED_SECRET_B64U,\n      THRESHOLD_ED25519_RELAYER_COSIGNERS: env.THRESHOLD_ED25519_RELAYER_COSIGNERS,\n      THRESHOLD_ED25519_RELAYER_COSIGNER_ID: env.THRESHOLD_ED25519_RELAYER_COSIGNER_ID,\n      THRESHOLD_ED25519_RELAYER_COSIGNER_T: env.THRESHOLD_ED25519_RELAYER_COSIGNER_T,\n    }\n    : null;\n\n  // Merge explicit config over env-derived defaults so callers can set\n  // `kind: 'in-memory'` (etc) while still using env vars like THRESHOLD_NODE_ROLE.\n  const config = (isObject(envFallback) && isObject(input.thresholdEd25519KeyStore))\n    ? ({ ...envFallback, ...input.thresholdEd25519KeyStore } as ThresholdEd25519KeyStoreConfigInput)\n    : (input.thresholdEd25519KeyStore ?? envFallback);\n\n  // Emit a single, non-sensitive config summary to help hosts confirm that threshold signing is wired up.\n  try {\n    const cosignersRaw = (config as { THRESHOLD_ED25519_RELAYER_COSIGNERS?: unknown })?.THRESHOLD_ED25519_RELAYER_COSIGNERS;\n    const cosignerCount = (() => {\n      if (typeof cosignersRaw !== 'string') return null;\n      const parsed = JSON.parse(cosignersRaw);\n      return Array.isArray(parsed) ? parsed.length : null;\n    })();\n    const shareMode = (config as { THRESHOLD_ED25519_SHARE_MODE?: unknown })?.THRESHOLD_ED25519_SHARE_MODE;\n    const nodeRole = (config as { THRESHOLD_NODE_ROLE?: unknown })?.THRESHOLD_NODE_ROLE;\n    const cosignerId = (config as { THRESHOLD_ED25519_RELAYER_COSIGNER_ID?: unknown })?.THRESHOLD_ED25519_RELAYER_COSIGNER_ID;\n    const cosignerT = (config as { THRESHOLD_ED25519_RELAYER_COSIGNER_T?: unknown })?.THRESHOLD_ED25519_RELAYER_COSIGNER_T;\n    const hasMasterSecret = Boolean(\n      typeof (config as { THRESHOLD_ED25519_MASTER_SECRET_B64U?: unknown })?.THRESHOLD_ED25519_MASTER_SECRET_B64U === 'string'\n      && (config as { THRESHOLD_ED25519_MASTER_SECRET_B64U?: string })?.THRESHOLD_ED25519_MASTER_SECRET_B64U?.trim(),\n    );\n\n    logger.info('[threshold-ed25519] init', {\n      isNode,\n      nodeRole: typeof nodeRole === 'string' ? nodeRole : null,\n      shareMode: typeof shareMode === 'string' ? shareMode : null,\n      hasMasterSecret,\n      cosignerId: typeof cosignerId === 'string' ? cosignerId : null,\n      cosignerT: typeof cosignerT === 'string' ? cosignerT : null,\n      cosignerCount,\n    });\n  } catch {\n    // Ignore logging issues; never block service creation.\n  }\n\n  const keyStore = createThresholdEd25519KeyStore({ config, logger, isNode });\n  const sessionStore = createThresholdEd25519SessionStore({ config, logger, isNode });\n  const authSessionStore = createThresholdEd25519AuthSessionStore({ config, logger, isNode });\n\n  const ensureReady = async (): Promise<void> => {\n    await input.authService.getRelayerAccount();\n  };\n\n  return new ThresholdSigningService({\n    logger,\n    keyStore,\n    sessionStore,\n    authSessionStore,\n    config,\n    ensureReady,\n    ensureSignerWasm: ensureReady,\n    verifyAuthenticationResponse: (req) => input.authService.verifyAuthenticationResponse(req),\n    viewAccessKeyList: (accountId) => input.authService.viewAccessKeyList(accountId),\n    txStatus: (txHash, senderAccountId) => input.authService.txStatus(txHash, senderAccountId),\n    webAuthnContractId: input.authService.getWebAuthnContractId(),\n  });\n}\n"],"mappings":";;;;;;;;AAUA,SAAS,oBAA6B;CACpC,MAAM,aAAc,WAAyE;CAC7F,MAAM,SAAS,QAAQ,YAAY,UAAU;CAC7C,MAAM,gBAAiB,WAAsD;CAC7E,MAAM,qBAAqB,OAAO,kBAAkB,eAC9C,OAAO,cAAc,eAAe,OAAO,UAAU,aAAa,IAAI,SAAS;AACrF,QAAO,UAAU,CAAC;;AAGpB,SAAgB,8BAA8B,OAKlB;CAC1B,MAAM,SAAS,aAAa,MAAM;CAClC,MAAM,SAAS,MAAM,UAAU;CAC/B,MAAM,MAAM,SACP,WAAqF,SAAS,MAC/F;CACJ,MAAMA,cAA0D,MAC5D;EACA,wBAAwB,IAAI;EAC5B,0BAA0B,IAAI;EAC9B,WAAW,IAAI;EACf,mCAAmC,IAAI;EACvC,kCAAkC,IAAI;EACtC,+BAA+B,IAAI;EACnC,yCAAyC,IAAI;EAC7C,0CAA0C,IAAI;EAC9C,sCAAsC,IAAI;EAC1C,8BAA8B,IAAI;EAClC,qBAAqB,IAAI;EACzB,0CAA0C,IAAI;EAC9C,qCAAqC,IAAI;EACzC,uCAAuC,IAAI;EAC3C,sCAAsC,IAAI;KAE1C;CAIJ,MAAM,SAAU,SAAS,gBAAgB,SAAS,MAAM,4BACnD;EAAE,GAAG;EAAa,GAAG,MAAM;KAC3B,MAAM,4BAA4B;AAGvC,KAAI;EACF,MAAM,eAAgB,QAA8D;EACpF,MAAM,uBAAuB;AAC3B,OAAI,OAAO,iBAAiB,SAAU,QAAO;GAC7C,MAAM,SAAS,KAAK,MAAM;AAC1B,UAAO,MAAM,QAAQ,UAAU,OAAO,SAAS;;EAEjD,MAAM,YAAa,QAAuD;EAC1E,MAAM,WAAY,QAA8C;EAChE,MAAM,aAAc,QAAgE;EACpF,MAAM,YAAa,QAA+D;EAClF,MAAM,kBAAkB,QACtB,OAAQ,QAA+D,yCAAyC,YAC5G,QAA8D,sCAAsC;AAG1G,SAAO,KAAK,4BAA4B;GACtC;GACA,UAAU,OAAO,aAAa,WAAW,WAAW;GACpD,WAAW,OAAO,cAAc,WAAW,YAAY;GACvD;GACA,YAAY,OAAO,eAAe,WAAW,aAAa;GAC1D,WAAW,OAAO,cAAc,WAAW,YAAY;GACvD;;SAEI;CAIR,MAAM,WAAW,+BAA+B;EAAE;EAAQ;EAAQ;;CAClE,MAAM,eAAe,mCAAmC;EAAE;EAAQ;EAAQ;;CAC1E,MAAM,mBAAmB,uCAAuC;EAAE;EAAQ;EAAQ;;CAElF,MAAM,cAAc,YAA2B;AAC7C,QAAM,MAAM,YAAY;;AAG1B,QAAO,IAAI,wBAAwB;EACjC;EACA;EACA;EACA;EACA;EACA;EACA,kBAAkB;EAClB,+BAA+B,QAAQ,MAAM,YAAY,6BAA6B;EACtF,oBAAoB,cAAc,MAAM,YAAY,kBAAkB;EACtE,WAAW,QAAQ,oBAAoB,MAAM,YAAY,SAAS,QAAQ;EAC1E,oBAAoB,MAAM,YAAY"}

package/dist/esm/server/core/ThresholdService/keygenStrategy.js

@@ -0,0 +1,114 @@
+import { ensureEd25519Prefix, toOptionalTrimmedString } from "../../sdk/src/utils/validation.js";
+import { threshold_ed25519_keygen_from_client_verifying_share, threshold_ed25519_keygen_from_master_secret_and_client_verifying_share } from "../../../wasm_signer_worker/pkg/wasm_signer_worker.js";
+
+//#region src/server/core/ThresholdService/keygenStrategy.ts
+function expectThresholdEd25519KeygenWasmOutput(out) {
+	const parsed = out;
+	if (!parsed?.relayerSigningShareB64u || !parsed?.relayerVerifyingShareB64u || !parsed?.publicKey) throw new Error("threshold-ed25519 keygen returned incomplete output");
+	return parsed;
+}
+var ThresholdEd25519KeygenStrategyV1 = class {
+	useDerivedShares;
+	relayerMasterSecretB64u;
+	clientParticipantId;
+	relayerParticipantId;
+	ensureSignerWasm;
+	constructor(input) {
+		this.useDerivedShares = input.useDerivedShares;
+		this.relayerMasterSecretB64u = input.relayerMasterSecretB64u;
+		this.clientParticipantId = input.clientParticipantId;
+		this.relayerParticipantId = input.relayerParticipantId;
+		this.ensureSignerWasm = input.ensureSignerWasm;
+	}
+	usesDerivedRelayerShares() {
+		return this.useDerivedShares;
+	}
+	async keygenFromClientVerifyingShare(input) {
+		const nearAccountId = toOptionalTrimmedString(input.nearAccountId);
+		if (!nearAccountId) return {
+			ok: false,
+			code: "invalid_body",
+			message: "nearAccountId is required"
+		};
+		const rpId = toOptionalTrimmedString(input.rpId);
+		const clientVerifyingShareB64u = toOptionalTrimmedString(input.clientVerifyingShareB64u);
+		if (!clientVerifyingShareB64u) return {
+			ok: false,
+			code: "invalid_body",
+			message: "clientVerifyingShareB64u is required"
+		};
+		await this.ensureSignerWasm();
+		let out;
+		if (this.useDerivedShares) {
+			if (!rpId) return {
+				ok: false,
+				code: "invalid_body",
+				message: "rpId is required"
+			};
+			const masterSecretB64u = toOptionalTrimmedString(this.relayerMasterSecretB64u);
+			if (!masterSecretB64u) return {
+				ok: false,
+				code: "missing_config",
+				message: "Missing THRESHOLD_ED25519_MASTER_SECRET_B64U for derived share mode"
+			};
+			out = expectThresholdEd25519KeygenWasmOutput(threshold_ed25519_keygen_from_master_secret_and_client_verifying_share({
+				masterSecretB64u,
+				nearAccountId,
+				rpId,
+				clientVerifyingShareB64u,
+				clientParticipantId: this.clientParticipantId,
+				relayerParticipantId: this.relayerParticipantId
+			}));
+		} else out = expectThresholdEd25519KeygenWasmOutput(threshold_ed25519_keygen_from_client_verifying_share({
+			clientVerifyingShareB64u,
+			clientParticipantId: this.clientParticipantId,
+			relayerParticipantId: this.relayerParticipantId
+		}));
+		const publicKey = ensureEd25519Prefix(out.publicKey);
+		const relayerKeyId = toOptionalTrimmedString(out.relayerKeyId) || publicKey;
+		return {
+			ok: true,
+			keyMaterial: {
+				relayerKeyId,
+				publicKey,
+				relayerSigningShareB64u: out.relayerSigningShareB64u,
+				relayerVerifyingShareB64u: out.relayerVerifyingShareB64u
+			}
+		};
+	}
+	async deriveRelayerKeyMaterial(input) {
+		if (!this.useDerivedShares) return {
+			ok: false,
+			code: "missing_config",
+			message: "Derived relayer shares are not enabled"
+		};
+		const expectedRelayerKeyId = toOptionalTrimmedString(input.expectedRelayerKeyId);
+		if (!expectedRelayerKeyId) return {
+			ok: false,
+			code: "invalid_body",
+			message: "relayerKeyId is required"
+		};
+		const out = await this.keygenFromClientVerifyingShare({
+			nearAccountId: input.nearAccountId,
+			rpId: input.rpId,
+			clientVerifyingShareB64u: input.clientVerifyingShareB64u
+		});
+		if (!out.ok) return out;
+		const publicKey = out.keyMaterial.publicKey;
+		if (publicKey !== expectedRelayerKeyId) return {
+			ok: false,
+			code: "group_pk_mismatch",
+			message: "clientVerifyingShareB64u does not match relayerKeyId"
+		};
+		return {
+			ok: true,
+			publicKey,
+			relayerSigningShareB64u: out.keyMaterial.relayerSigningShareB64u,
+			relayerVerifyingShareB64u: out.keyMaterial.relayerVerifyingShareB64u
+		};
+	}
+};
+
+//#endregion
+export { ThresholdEd25519KeygenStrategyV1 };
+//# sourceMappingURL=keygenStrategy.js.map

package/dist/esm/server/core/ThresholdService/keygenStrategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keygenStrategy.js","names":["out: ThresholdEd25519KeygenWasmOutput"],"sources":["../../../../../src/server/core/ThresholdService/keygenStrategy.ts"],"sourcesContent":["import { ensureEd25519Prefix, toOptionalTrimmedString } from '../../../utils/validation';\nimport {\n  threshold_ed25519_keygen_from_client_verifying_share,\n  threshold_ed25519_keygen_from_master_secret_and_client_verifying_share,\n} from '../../../wasm_signer_worker/pkg/wasm_signer_worker.js';\n\nexport type ThresholdEd25519KeygenMaterial = {\n  relayerKeyId: string;\n  publicKey: string;\n  relayerSigningShareB64u: string;\n  relayerVerifyingShareB64u: string;\n};\n\nexport interface ThresholdEd25519KeygenStrategy {\n  usesDerivedRelayerShares(): boolean;\n\n  keygenFromClientVerifyingShare(input: {\n    nearAccountId: string;\n    rpId?: string | null;\n    clientVerifyingShareB64u: string;\n  }): Promise<\n    | { ok: true; keyMaterial: ThresholdEd25519KeygenMaterial }\n    | { ok: false; code: string; message: string }\n  >;\n\n  deriveRelayerKeyMaterial(input: {\n    nearAccountId: string;\n    rpId: string;\n    clientVerifyingShareB64u: string;\n    expectedRelayerKeyId: string;\n  }): Promise<\n    | { ok: true; publicKey: string; relayerSigningShareB64u: string; relayerVerifyingShareB64u: string }\n    | { ok: false; code: string; message: string }\n  >;\n}\n\ntype ThresholdEd25519KeygenWasmOutput = {\n  relayerKeyId?: string;\n  publicKey: string;\n  relayerSigningShareB64u: string;\n  relayerVerifyingShareB64u: string;\n};\n\nfunction expectThresholdEd25519KeygenWasmOutput(out: unknown): ThresholdEd25519KeygenWasmOutput {\n  const parsed = out as ThresholdEd25519KeygenWasmOutput;\n  if (!parsed?.relayerSigningShareB64u || !parsed?.relayerVerifyingShareB64u || !parsed?.publicKey) {\n    throw new Error('threshold-ed25519 keygen returned incomplete output');\n  }\n  return parsed;\n}\n\nexport class ThresholdEd25519KeygenStrategyV1 implements ThresholdEd25519KeygenStrategy {\n  private readonly useDerivedShares: boolean;\n  private readonly relayerMasterSecretB64u: string | null;\n  private readonly clientParticipantId: number;\n  private readonly relayerParticipantId: number;\n  private readonly ensureSignerWasm: () => Promise<void>;\n\n  constructor(input: {\n    useDerivedShares: boolean;\n    relayerMasterSecretB64u: string | null;\n    clientParticipantId: number;\n    relayerParticipantId: number;\n    ensureSignerWasm: () => Promise<void>;\n  }) {\n    this.useDerivedShares = input.useDerivedShares;\n    this.relayerMasterSecretB64u = input.relayerMasterSecretB64u;\n    this.clientParticipantId = input.clientParticipantId;\n    this.relayerParticipantId = input.relayerParticipantId;\n    this.ensureSignerWasm = input.ensureSignerWasm;\n  }\n\n  usesDerivedRelayerShares(): boolean {\n    return this.useDerivedShares;\n  }\n\n  async keygenFromClientVerifyingShare(input: {\n    nearAccountId: string;\n    rpId?: string | null;\n    clientVerifyingShareB64u: string;\n  }): Promise<\n    | { ok: true; keyMaterial: ThresholdEd25519KeygenMaterial }\n    | { ok: false; code: string; message: string }\n  > {\n    const nearAccountId = toOptionalTrimmedString(input.nearAccountId);\n    if (!nearAccountId) return { ok: false, code: 'invalid_body', message: 'nearAccountId is required' };\n    const rpId = toOptionalTrimmedString(input.rpId);\n    const clientVerifyingShareB64u = toOptionalTrimmedString(input.clientVerifyingShareB64u);\n    if (!clientVerifyingShareB64u) return { ok: false, code: 'invalid_body', message: 'clientVerifyingShareB64u is required' };\n\n    await this.ensureSignerWasm();\n\n    let out: ThresholdEd25519KeygenWasmOutput;\n    if (this.useDerivedShares) {\n      if (!rpId) return { ok: false, code: 'invalid_body', message: 'rpId is required' };\n      const masterSecretB64u = toOptionalTrimmedString(this.relayerMasterSecretB64u);\n      if (!masterSecretB64u) {\n        return {\n          ok: false,\n          code: 'missing_config',\n          message: 'Missing THRESHOLD_ED25519_MASTER_SECRET_B64U for derived share mode',\n        };\n      }\n\n      out = expectThresholdEd25519KeygenWasmOutput(\n        threshold_ed25519_keygen_from_master_secret_and_client_verifying_share({\n          masterSecretB64u,\n          nearAccountId,\n          rpId,\n          clientVerifyingShareB64u,\n          clientParticipantId: this.clientParticipantId,\n          relayerParticipantId: this.relayerParticipantId,\n        }),\n      );\n    } else {\n      out = expectThresholdEd25519KeygenWasmOutput(\n        threshold_ed25519_keygen_from_client_verifying_share({\n          clientVerifyingShareB64u,\n          clientParticipantId: this.clientParticipantId,\n          relayerParticipantId: this.relayerParticipantId,\n        } as any),\n      );\n    }\n\n    const publicKey = ensureEd25519Prefix(out.publicKey);\n    const relayerKeyId = toOptionalTrimmedString(out.relayerKeyId) || publicKey; // default: relayerKeyId := publicKey\n\n    return {\n      ok: true,\n      keyMaterial: {\n        relayerKeyId,\n        publicKey,\n        relayerSigningShareB64u: out.relayerSigningShareB64u,\n        relayerVerifyingShareB64u: out.relayerVerifyingShareB64u,\n      },\n    };\n  }\n\n  async deriveRelayerKeyMaterial(input: {\n    nearAccountId: string;\n    rpId: string;\n    clientVerifyingShareB64u: string;\n    expectedRelayerKeyId: string;\n  }): Promise<\n    | { ok: true; publicKey: string; relayerSigningShareB64u: string; relayerVerifyingShareB64u: string }\n    | { ok: false; code: string; message: string }\n  > {\n    if (!this.useDerivedShares) {\n      return { ok: false, code: 'missing_config', message: 'Derived relayer shares are not enabled' };\n    }\n\n    const expectedRelayerKeyId = toOptionalTrimmedString(input.expectedRelayerKeyId);\n    if (!expectedRelayerKeyId) {\n      return { ok: false, code: 'invalid_body', message: 'relayerKeyId is required' };\n    }\n\n    const out = await this.keygenFromClientVerifyingShare({\n      nearAccountId: input.nearAccountId,\n      rpId: input.rpId,\n      clientVerifyingShareB64u: input.clientVerifyingShareB64u,\n    });\n    if (!out.ok) return out;\n\n    const publicKey = out.keyMaterial.publicKey;\n    if (publicKey !== expectedRelayerKeyId) {\n      return {\n        ok: false,\n        code: 'group_pk_mismatch',\n        message: 'clientVerifyingShareB64u does not match relayerKeyId',\n      };\n    }\n\n    return {\n      ok: true,\n      publicKey,\n      relayerSigningShareB64u: out.keyMaterial.relayerSigningShareB64u,\n      relayerVerifyingShareB64u: out.keyMaterial.relayerVerifyingShareB64u,\n    };\n  }\n}\n"],"mappings":";;;;AA2CA,SAAS,uCAAuC,KAAgD;CAC9F,MAAM,SAAS;AACf,KAAI,CAAC,QAAQ,2BAA2B,CAAC,QAAQ,6BAA6B,CAAC,QAAQ,UACrF,OAAM,IAAI,MAAM;AAElB,QAAO;;AAGT,IAAa,mCAAb,MAAwF;CACtF,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAEjB,YAAY,OAMT;AACD,OAAK,mBAAmB,MAAM;AAC9B,OAAK,0BAA0B,MAAM;AACrC,OAAK,sBAAsB,MAAM;AACjC,OAAK,uBAAuB,MAAM;AAClC,OAAK,mBAAmB,MAAM;;CAGhC,2BAAoC;AAClC,SAAO,KAAK;;CAGd,MAAM,+BAA+B,OAOnC;EACA,MAAM,gBAAgB,wBAAwB,MAAM;AACpD,MAAI,CAAC,cAAe,QAAO;GAAE,IAAI;GAAO,MAAM;GAAgB,SAAS;;EACvE,MAAM,OAAO,wBAAwB,MAAM;EAC3C,MAAM,2BAA2B,wBAAwB,MAAM;AAC/D,MAAI,CAAC,yBAA0B,QAAO;GAAE,IAAI;GAAO,MAAM;GAAgB,SAAS;;AAElF,QAAM,KAAK;EAEX,IAAIA;AACJ,MAAI,KAAK,kBAAkB;AACzB,OAAI,CAAC,KAAM,QAAO;IAAE,IAAI;IAAO,MAAM;IAAgB,SAAS;;GAC9D,MAAM,mBAAmB,wBAAwB,KAAK;AACtD,OAAI,CAAC,iBACH,QAAO;IACL,IAAI;IACJ,MAAM;IACN,SAAS;;AAIb,SAAM,uCACJ,uEAAuE;IACrE;IACA;IACA;IACA;IACA,qBAAqB,KAAK;IAC1B,sBAAsB,KAAK;;QAI/B,OAAM,uCACJ,qDAAqD;GACnD;GACA,qBAAqB,KAAK;GAC1B,sBAAsB,KAAK;;EAKjC,MAAM,YAAY,oBAAoB,IAAI;EAC1C,MAAM,eAAe,wBAAwB,IAAI,iBAAiB;AAElE,SAAO;GACL,IAAI;GACJ,aAAa;IACX;IACA;IACA,yBAAyB,IAAI;IAC7B,2BAA2B,IAAI;;;;CAKrC,MAAM,yBAAyB,OAQ7B;AACA,MAAI,CAAC,KAAK,iBACR,QAAO;GAAE,IAAI;GAAO,MAAM;GAAkB,SAAS;;EAGvD,MAAM,uBAAuB,wBAAwB,MAAM;AAC3D,MAAI,CAAC,qBACH,QAAO;GAAE,IAAI;GAAO,MAAM;GAAgB,SAAS;;EAGrD,MAAM,MAAM,MAAM,KAAK,+BAA+B;GACpD,eAAe,MAAM;GACrB,MAAM,MAAM;GACZ,0BAA0B,MAAM;;AAElC,MAAI,CAAC,IAAI,GAAI,QAAO;EAEpB,MAAM,YAAY,IAAI,YAAY;AAClC,MAAI,cAAc,qBAChB,QAAO;GACL,IAAI;GACJ,MAAM;GACN,SAAS;;AAIb,SAAO;GACL,IAAI;GACJ;GACA,yBAAyB,IAAI,YAAY;GACzC,2BAA2B,IAAI,YAAY"}