crypto-aio 0.0.2 → 0.1.0

package/dist/core/signing/types.d.ts

@@ -0,0 +1,64 @@
+import type { FeeEstimateDraft } from '../model/fee';
+import type { IntentSummary } from '../model/intent';
+import type { Secret } from '../secret/secret';
+export interface KeyRef {
+    /** Routes a request to a specific signer through `WalletConfig.signers`. */
+    readonly id?: string;
+    /** HD derivation path for mnemonic-backed signers. */
+    readonly path?: string;
+}
+export interface SigningParams {
+    /** BIP341 key-path tweak for `secp256k1-schnorr`. */
+    readonly tweak?: Uint8Array;
+}
+export interface SigningRequest {
+    readonly id: string;
+    readonly scheme: string;
+    readonly payload: Uint8Array;
+    readonly payloadKind: 'digest' | 'message';
+    readonly publicKey: Uint8Array;
+    readonly keyRef?: KeyRef;
+    readonly params?: SigningParams;
+}
+/** `secp256k1-ecdsa`: 64-byte compact r‖s (low-s) plus `recovery`; others: raw signature. */
+export interface SignatureBundle {
+    readonly requestId: string;
+    readonly bytes: Uint8Array;
+    readonly recovery?: number;
+}
+export type SigningResult = {
+    readonly status: 'signed';
+    readonly signatures: readonly SignatureBundle[];
+} | {
+    readonly status: 'pending';
+    readonly ticket?: string;
+};
+/** A pending signer's ticket, kept with the signer that issued it (only it can cancel it). */
+export interface SignerTicket {
+    readonly signerId: string;
+    readonly ticket: string;
+}
+export type SigningPurpose = 'original' | 'replacement' | 'cancel' | 'rebuild';
+/** Context handed to signers and policy hooks. Never contains secrets or SDK objects. */
+export interface SigningContext {
+    readonly operationId: string;
+    readonly namespace: string;
+    readonly chain: string;
+    readonly network: string;
+    readonly wallet: string;
+    readonly tier?: string;
+    readonly purpose: SigningPurpose;
+    readonly summary: IntentSummary;
+    readonly fee: FeeEstimateDraft;
+    readonly unsignedHash: string;
+}
+export interface Signer {
+    readonly id: string;
+    readonly schemes: readonly string[];
+    getPublicKey(scheme: string, keyRef?: KeyRef): Promise<Uint8Array>;
+    sign(requests: readonly SigningRequest[], ctx: SigningContext): Promise<SigningResult>;
+    /** Best-effort cancellation of a pending request (used by `abandon`). */
+    cancelRequest?(ticket: string): Promise<void>;
+    /** Only available on signers created as exportable. */
+    exportKey?(scheme: string, keyRef?: KeyRef): Promise<Secret<Uint8Array>>;
+}

package/dist/core/signing/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/core/signing/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/core/signing/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { FeeEstimateDraft } from '../model/fee';\nimport type { IntentSummary } from '../model/intent';\nimport type { Secret } from '../secret/secret';\n\nexport interface KeyRef {\n  /** Routes a request to a specific signer through `WalletConfig.signers`. */\n  readonly id?: string;\n  /** HD derivation path for mnemonic-backed signers. */\n  readonly path?: string;\n}\n\nexport interface SigningParams {\n  /** BIP341 key-path tweak for `secp256k1-schnorr`. */\n  readonly tweak?: Uint8Array;\n}\n\nexport interface SigningRequest {\n  readonly id: string;\n  readonly scheme: string;\n  readonly payload: Uint8Array;\n  readonly payloadKind: 'digest' | 'message';\n  readonly publicKey: Uint8Array;\n  readonly keyRef?: KeyRef;\n  readonly params?: SigningParams;\n}\n\n/** `secp256k1-ecdsa`: 64-byte compact r‖s (low-s) plus `recovery`; others: raw signature. */\nexport interface SignatureBundle {\n  readonly requestId: string;\n  readonly bytes: Uint8Array;\n  readonly recovery?: number;\n}\n\nexport type SigningResult =\n  | { readonly status: 'signed'; readonly signatures: readonly SignatureBundle[] }\n  | { readonly status: 'pending'; readonly ticket?: string };\n\n/** A pending signer's ticket, kept with the signer that issued it (only it can cancel it). */\nexport interface SignerTicket {\n  readonly signerId: string;\n  readonly ticket: string;\n}\n\nexport type SigningPurpose = 'original' | 'replacement' | 'cancel' | 'rebuild';\n\n/** Context handed to signers and policy hooks. Never contains secrets or SDK objects. */\nexport interface SigningContext {\n  readonly operationId: string;\n  readonly namespace: string;\n  readonly chain: string;\n  readonly network: string;\n  readonly wallet: string;\n  readonly tier?: string;\n  readonly purpose: SigningPurpose;\n  readonly summary: IntentSummary;\n  readonly fee: FeeEstimateDraft;\n  readonly unsignedHash: string;\n}\n\nexport interface Signer {\n  readonly id: string;\n  readonly schemes: readonly string[];\n  getPublicKey(scheme: string, keyRef?: KeyRef): Promise<Uint8Array>;\n  sign(requests: readonly SigningRequest[], ctx: SigningContext): Promise<SigningResult>;\n  /** Best-effort cancellation of a pending request (used by `abandon`). */\n  cancelRequest?(ticket: string): Promise<void>;\n  /** Only available on signers created as exportable. */\n  exportKey?(scheme: string, keyRef?: KeyRef): Promise<Secret<Uint8Array>>;\n}\n"]}

package/dist/core/signing/wallet.d.ts

@@ -0,0 +1,48 @@
+import type { ResolvedSelection, WalletConfig } from '../config/types';
+import type { ChainDriver, WalletKey, WalletOptions } from '../driver/types';
+import { Address } from '../model/address';
+import type { SchemeCatalog } from '../registry/schemes';
+import { type SignerDeadline } from './guard';
+import { type ExtendedKeyVersions } from './hd';
+import type { KeyRef, Signer } from './types';
+export interface ResolvedWallet {
+    readonly name: string;
+    readonly config: WalletConfig;
+    readonly address: Address;
+    /** One key per chain scheme the signer supports; `keys[0]` defines the address. */
+    readonly keys: readonly WalletKey[];
+    readonly options: WalletOptions;
+    readonly watchOnly: boolean;
+    readonly tier?: string;
+    signerFor(keyRef?: KeyRef): {
+        readonly id: string;
+        readonly signer: Signer;
+    } | undefined;
+    /** The signer with this id (own keys only), e.g. to cancel a ticket through its issuer. */
+    signerById(id: string): {
+        readonly id: string;
+        readonly signer: Signer;
+    } | undefined;
+}
+/**
+ * The wallet's extended public key as drivers receive it, `WalletOptions.hd`: plain,
+ * frozen data, present only when the wallet configures a non-empty `xpub` (an empty
+ * one counts as none, as in `deriveAddress`), which must be a readable PUBLIC extended key
+ * (`CONFIG_INVALID` otherwise, naming no key).
+ */
+export interface WalletHdOptions {
+    readonly xpub: string;
+    /** Child path template relative to the xpub; `{index}` is replaced. Default `0/{index}`. */
+    readonly xpubPath?: string;
+    readonly xpubVersions?: ExtendedKeyVersions;
+}
+export declare function walletOptionsOf(config: WalletConfig): WalletOptions;
+/**
+ * The wallet's `xpubPath`, `undefined` when absent (`undefined` or `null`, as
+ * `deriveAddress` reads it). One that is present but not a string is `CONFIG_INVALID` with a
+ * fixed text. Wallet resolution and `deriveAddress` share this check.
+ */
+export declare function xpubPathOf(config: WalletConfig): string | undefined;
+export declare function resolveWallet(selection: ResolvedSelection, driver: ChainDriver, signers: Readonly<Record<string, Signer>>, schemes: SchemeCatalog, 
+/** Bounds each public-key read (`lifecycle.signTimeoutMs`). */
+deadline?: SignerDeadline): Promise<ResolvedWallet>;

package/dist/core/signing/wallet.js

@@ -0,0 +1,153 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.walletOptionsOf = walletOptionsOf;
+exports.xpubPathOf = xpubPathOf;
+exports.resolveWallet = resolveWallet;
+const error_1 = require("../errors/error");
+const address_1 = require("../model/address");
+const bytes_1 = require("../util/bytes");
+const guard_1 = require("./guard");
+const hd_1 = require("./hd");
+function walletOptionsOf(config) {
+    // `hd` is the core's own key: the wallet's xpub or nothing, never a user option, since
+    // a driver trusts it to validate change addresses.
+    const { hd: _ignored, ...options } = config.options ?? {};
+    return {
+        ...options,
+        ...(config.utxo ? { utxo: config.utxo } : {}),
+        ...(config.ton ? { ton: config.ton } : {}),
+        // A falsy `xpub` ('', null) is no xpub, as `deriveAddress` reads it.
+        ...(config.xpub ? { hd: hdOptionsOf(config) } : {}),
+    };
+}
+/**
+ * The wallet's `xpubPath`, `undefined` when absent (`undefined` or `null`, as
+ * `deriveAddress` reads it). One that is present but not a string is `CONFIG_INVALID` with a
+ * fixed text. Wallet resolution and `deriveAddress` share this check.
+ */
+function xpubPathOf(config) {
+    const path = config.xpubPath;
+    if (path === undefined || path === null)
+        return undefined;
+    if (typeof path !== 'string') {
+        throw new error_1.ConfigError('CONFIG_INVALID', 'xpubPath must be a string');
+    }
+    return path;
+}
+function hdOptionsOf(config) {
+    const xpubPath = xpubPathOf(config);
+    const versions = config.xpubVersions;
+    // The frozen copy comes first, reading each field once, and the key is read against
+    // it, so it is checked against exactly the versions a driver receives.
+    const hd = Object.freeze({
+        xpub: config.xpub,
+        ...(xpubPath !== undefined ? { xpubPath } : {}),
+        // The version pair only, never other keys of the caller's object.
+        ...(versions
+            ? {
+                xpubVersions: Object.freeze({
+                    private: versions.private,
+                    public: versions.public,
+                }),
+            }
+            : {}),
+    });
+    // Only a readable, PUBLIC extended key ever reaches a driver.
+    (0, hd_1.parseExtendedPublicKey)(hd.xpub, hd.xpubVersions);
+    return hd;
+}
+/**
+ * A watch-only wallet's `publicKey` is checked as a signer's key is: hex of
+ * exactly the length its scheme defines. Any other key fails here, never later: an
+ * uncompressed secp256k1 key derives an address but never verifies a signature.
+ */
+function watchOnlyKey(name, hex, scheme, length) {
+    let key;
+    try {
+        key = typeof hex === 'string' ? (0, bytes_1.fromHex)(hex) : undefined;
+    }
+    catch {
+        key = undefined;
+    }
+    if (key === undefined || key.length !== length) {
+        throw new error_1.ConfigError('CONFIG_INVALID', `wallet '${name}': publicKey must be ${length} bytes of hex for ${scheme}`);
+    }
+    return key;
+}
+async function resolveWallet(selection, driver, signers, schemes, 
+/** Bounds each public-key read (`lifecycle.signTimeoutMs`). */
+deadline) {
+    const wallet = selection.wallet;
+    if (!wallet) {
+        throw new error_1.ConfigError('CONFIG_INVALID', `no wallet selected for ${selection.chain.id}; pass { wallet } or set chains.${selection.chain.id}.wallet`);
+    }
+    const { config } = wallet;
+    const options = walletOptionsOf(config);
+    const keyRef = config.keyRef;
+    const keys = [];
+    if (selection.signer) {
+        // The signer is user-supplied code; its scheme list and keys are guarded.
+        const { id, instance } = selection.signer;
+        const supported = (0, guard_1.signerSchemes)(id, instance);
+        for (const scheme of selection.chain.schemes) {
+            if (!supported.includes(scheme))
+                continue;
+            const { publicKeyLength } = schemes.get(scheme);
+            const publicKey = await (0, guard_1.signerPublicKey)(id, instance, scheme, keyRef, publicKeyLength, deadline);
+            keys.push({ scheme, publicKey, ...(keyRef ? { keyRef } : {}) });
+        }
+    }
+    else if (config.publicKey) {
+        const scheme = selection.chain.schemes[0];
+        keys.push({
+            scheme,
+            publicKey: watchOnlyKey(wallet.name, config.publicKey, scheme, schemes.get(scheme).publicKeyLength),
+            ...(keyRef ? { keyRef } : {}),
+        });
+    }
+    const first = keys[0];
+    const derived = first
+        ? driver.address.fromPublicKey(first.publicKey, options)
+        : undefined;
+    const configured = config.address !== undefined ? driver.address.normalize(config.address) : undefined;
+    if (derived && configured && derived.canonical !== configured.canonical) {
+        throw new error_1.ConfigError('CONFIG_INVALID', `wallet '${wallet.name}': configured address does not match its public key`);
+    }
+    const normalized = configured ?? derived;
+    if (!normalized) {
+        throw new error_1.ConfigError('CONFIG_INVALID', `wallet '${wallet.name}' needs a signer, a publicKey or an address`);
+    }
+    const primary = selection.signer;
+    return {
+        name: wallet.name,
+        config,
+        address: new address_1.Address(selection.chain.id, normalized, driver.address.format),
+        keys,
+        options,
+        watchOnly: !primary,
+        ...(config.tier !== undefined ? { tier: config.tier } : {}),
+        signerFor: (ref) => {
+            // Own keys only: a key ref named `toString` routes nowhere.
+            const routes = config.signers ?? {};
+            const routed = ref?.id !== undefined && Object.hasOwn(routes, ref.id)
+                ? routes[ref.id]
+                : undefined;
+            const id = routed ?? primary?.id;
+            if (id === undefined)
+                return undefined;
+            const signer = id === primary?.id
+                ? primary.instance
+                : Object.hasOwn(signers, id)
+                    ? signers[id]
+                    : undefined;
+            return signer ? { id, signer } : undefined;
+        },
+        signerById: (id) => {
+            if (id === primary?.id)
+                return { id, signer: primary.instance };
+            const signer = Object.hasOwn(signers, id) ? signers[id] : undefined;
+            return signer ? { id, signer } : undefined;
+        },
+    };
+}
+//# sourceMappingURL=wallet.js.map

package/dist/core/signing/wallet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wallet.js","sourceRoot":"","sources":["../../../src/core/signing/wallet.ts"],"names":[],"mappings":";;AAuCA,0CAWC;AAOD,gCAOC;AAmDD,sCAoGC;AArND,2CAA8C;AAC9C,8CAA2C;AAE3C,yCAAwC;AACxC,mCAA8E;AAC9E,6BAAwE;AAgCxE,SAAgB,eAAe,CAAC,MAAoB;IAClD,uFAAuF;IACvF,mDAAmD;IACnD,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IAC1D,OAAO;QACL,GAAG,OAAO;QACV,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,qEAAqE;QACrE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,UAAU,CAAC,MAAoB;IAC7C,MAAM,IAAI,GAAY,MAAM,CAAC,QAAQ,CAAC;IACtC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC1D,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,mBAAW,CAAC,gBAAgB,EAAE,2BAA2B,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,MAAoB;IACvC,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC;IACrC,oFAAoF;IACpF,uEAAuE;IACvE,MAAM,EAAE,GAAoB,MAAM,CAAC,MAAM,CAAC;QACxC,IAAI,EAAE,MAAM,CAAC,IAAc;QAC3B,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,kEAAkE;QAClE,GAAG,CAAC,QAAQ;YACV,CAAC,CAAC;gBACE,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC;oBAC1B,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;iBACxB,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IACH,8DAA8D;IAC9D,IAAA,2BAAsB,EAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC;IACjD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CACnB,IAAY,EACZ,GAAY,EACZ,MAAc,EACd,MAAc;IAEd,IAAI,GAA2B,CAAC;IAChC,IAAI,CAAC;QACH,GAAG,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAA,eAAO,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,GAAG,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC/C,MAAM,IAAI,mBAAW,CACnB,gBAAgB,EAChB,WAAW,IAAI,wBAAwB,MAAM,qBAAqB,MAAM,EAAE,CAC3E,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAEM,KAAK,UAAU,aAAa,CACjC,SAA4B,EAC5B,MAAmB,EACnB,OAAyC,EACzC,OAAsB;AACtB,+DAA+D;AAC/D,QAAyB;IAEzB,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;IAChC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,mBAAW,CACnB,gBAAgB,EAChB,0BAA0B,SAAS,CAAC,KAAK,CAAC,EAAE,mCAAmC,SAAS,CAAC,KAAK,CAAC,EAAE,SAAS,CAC3G,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC1B,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,MAAM,IAAI,GAAgB,EAAE,CAAC;IAC7B,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACrB,0EAA0E;QAC1E,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAA,qBAAa,EAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC9C,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YAC7C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,SAAS;YAC1C,MAAM,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAChD,MAAM,SAAS,GAAG,MAAM,IAAA,uBAAe,EACrC,EAAE,EACF,QAAQ,EACR,MAAM,EACN,MAAM,EACN,eAAe,EACf,QAAQ,CACT,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAW,CAAC;QACpD,IAAI,CAAC,IAAI,CAAC;YACR,MAAM;YACN,SAAS,EAAE,YAAY,CACrB,MAAM,CAAC,IAAI,EACX,MAAM,CAAC,SAAS,EAChB,MAAM,EACN,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,eAAe,CACpC;YACD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,MAAM,OAAO,GAAG,KAAK;QACnB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC;QACxD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,UAAU,GACd,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtF,IAAI,OAAO,IAAI,UAAU,IAAI,OAAO,CAAC,SAAS,KAAK,UAAU,CAAC,SAAS,EAAE,CAAC;QACxE,MAAM,IAAI,mBAAW,CACnB,gBAAgB,EAChB,WAAW,MAAM,CAAC,IAAI,qDAAqD,CAC5E,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,UAAU,IAAI,OAAO,CAAC;IACzC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,mBAAW,CACnB,gBAAgB,EAChB,WAAW,MAAM,CAAC,IAAI,6CAA6C,CACpE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC;IACjC,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM;QACN,OAAO,EAAE,IAAI,iBAAO,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAC3E,IAAI;QACJ,OAAO;QACP,SAAS,EAAE,CAAC,OAAO;QACnB,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;YACjB,4DAA4D;YAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;YACpC,MAAM,MAAM,GACV,GAAG,EAAE,EAAE,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;gBACpD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChB,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,EAAE,GAAG,MAAM,IAAI,OAAO,EAAE,EAAE,CAAC;YACjC,IAAI,EAAE,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YACvC,MAAM,MAAM,GACV,EAAE,KAAK,OAAO,EAAE,EAAE;gBAChB,CAAC,CAAC,OAAO,CAAC,QAAQ;gBAClB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;oBAC1B,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;oBACb,CAAC,CAAC,SAAS,CAAC;YAClB,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7C,CAAC;QACD,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE;YACjB,IAAI,EAAE,KAAK,OAAO,EAAE,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;YAChE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7C,CAAC;KACF,CAAC;AACJ,CAAC","sourcesContent":["import type { ResolvedSelection, WalletConfig } from '../config/types';\nimport type { ChainDriver, WalletKey, WalletOptions } from '../driver/types';\nimport { ConfigError } from '../errors/error';\nimport { Address } from '../model/address';\nimport type { SchemeCatalog } from '../registry/schemes';\nimport { fromHex } from '../util/bytes';\nimport { signerPublicKey, signerSchemes, type SignerDeadline } from './guard';\nimport { parseExtendedPublicKey, type ExtendedKeyVersions } from './hd';\nimport type { KeyRef, Signer } from './types';\n\nexport interface ResolvedWallet {\n  readonly name: string;\n  readonly config: WalletConfig;\n  readonly address: Address;\n  /** One key per chain scheme the signer supports; `keys[0]` defines the address. */\n  readonly keys: readonly WalletKey[];\n  readonly options: WalletOptions;\n  readonly watchOnly: boolean;\n  readonly tier?: string;\n  signerFor(\n    keyRef?: KeyRef,\n  ): { readonly id: string; readonly signer: Signer } | undefined;\n  /** The signer with this id (own keys only), e.g. to cancel a ticket through its issuer. */\n  signerById(id: string): { readonly id: string; readonly signer: Signer } | undefined;\n}\n\n/**\n * The wallet's extended public key as drivers receive it, `WalletOptions.hd`: plain,\n * frozen data, present only when the wallet configures a non-empty `xpub` (an empty\n * one counts as none, as in `deriveAddress`), which must be a readable PUBLIC extended key\n * (`CONFIG_INVALID` otherwise, naming no key).\n */\nexport interface WalletHdOptions {\n  readonly xpub: string;\n  /** Child path template relative to the xpub; `{index}` is replaced. Default `0/{index}`. */\n  readonly xpubPath?: string;\n  readonly xpubVersions?: ExtendedKeyVersions;\n}\n\nexport function walletOptionsOf(config: WalletConfig): WalletOptions {\n  // `hd` is the core's own key: the wallet's xpub or nothing, never a user option, since\n  // a driver trusts it to validate change addresses.\n  const { hd: _ignored, ...options } = config.options ?? {};\n  return {\n    ...options,\n    ...(config.utxo ? { utxo: config.utxo } : {}),\n    ...(config.ton ? { ton: config.ton } : {}),\n    // A falsy `xpub` ('', null) is no xpub, as `deriveAddress` reads it.\n    ...(config.xpub ? { hd: hdOptionsOf(config) } : {}),\n  };\n}\n\n/**\n * The wallet's `xpubPath`, `undefined` when absent (`undefined` or `null`, as\n * `deriveAddress` reads it). One that is present but not a string is `CONFIG_INVALID` with a\n * fixed text. Wallet resolution and `deriveAddress` share this check.\n */\nexport function xpubPathOf(config: WalletConfig): string | undefined {\n  const path: unknown = config.xpubPath;\n  if (path === undefined || path === null) return undefined;\n  if (typeof path !== 'string') {\n    throw new ConfigError('CONFIG_INVALID', 'xpubPath must be a string');\n  }\n  return path;\n}\n\nfunction hdOptionsOf(config: WalletConfig): WalletHdOptions {\n  const xpubPath = xpubPathOf(config);\n  const versions = config.xpubVersions;\n  // The frozen copy comes first, reading each field once, and the key is read against\n  // it, so it is checked against exactly the versions a driver receives.\n  const hd: WalletHdOptions = Object.freeze({\n    xpub: config.xpub as string,\n    ...(xpubPath !== undefined ? { xpubPath } : {}),\n    // The version pair only, never other keys of the caller's object.\n    ...(versions\n      ? {\n          xpubVersions: Object.freeze({\n            private: versions.private,\n            public: versions.public,\n          }),\n        }\n      : {}),\n  });\n  // Only a readable, PUBLIC extended key ever reaches a driver.\n  parseExtendedPublicKey(hd.xpub, hd.xpubVersions);\n  return hd;\n}\n\n/**\n * A watch-only wallet's `publicKey` is checked as a signer's key is: hex of\n * exactly the length its scheme defines. Any other key fails here, never later: an\n * uncompressed secp256k1 key derives an address but never verifies a signature.\n */\nfunction watchOnlyKey(\n  name: string,\n  hex: unknown,\n  scheme: string,\n  length: number,\n): Uint8Array {\n  let key: Uint8Array | undefined;\n  try {\n    key = typeof hex === 'string' ? fromHex(hex) : undefined;\n  } catch {\n    key = undefined;\n  }\n  if (key === undefined || key.length !== length) {\n    throw new ConfigError(\n      'CONFIG_INVALID',\n      `wallet '${name}': publicKey must be ${length} bytes of hex for ${scheme}`,\n    );\n  }\n  return key;\n}\n\nexport async function resolveWallet(\n  selection: ResolvedSelection,\n  driver: ChainDriver,\n  signers: Readonly<Record<string, Signer>>,\n  schemes: SchemeCatalog,\n  /** Bounds each public-key read (`lifecycle.signTimeoutMs`). */\n  deadline?: SignerDeadline,\n): Promise<ResolvedWallet> {\n  const wallet = selection.wallet;\n  if (!wallet) {\n    throw new ConfigError(\n      'CONFIG_INVALID',\n      `no wallet selected for ${selection.chain.id}; pass { wallet } or set chains.${selection.chain.id}.wallet`,\n    );\n  }\n  const { config } = wallet;\n  const options = walletOptionsOf(config);\n  const keyRef = config.keyRef;\n  const keys: WalletKey[] = [];\n  if (selection.signer) {\n    // The signer is user-supplied code; its scheme list and keys are guarded.\n    const { id, instance } = selection.signer;\n    const supported = signerSchemes(id, instance);\n    for (const scheme of selection.chain.schemes) {\n      if (!supported.includes(scheme)) continue;\n      const { publicKeyLength } = schemes.get(scheme);\n      const publicKey = await signerPublicKey(\n        id,\n        instance,\n        scheme,\n        keyRef,\n        publicKeyLength,\n        deadline,\n      );\n      keys.push({ scheme, publicKey, ...(keyRef ? { keyRef } : {}) });\n    }\n  } else if (config.publicKey) {\n    const scheme = selection.chain.schemes[0] as string;\n    keys.push({\n      scheme,\n      publicKey: watchOnlyKey(\n        wallet.name,\n        config.publicKey,\n        scheme,\n        schemes.get(scheme).publicKeyLength,\n      ),\n      ...(keyRef ? { keyRef } : {}),\n    });\n  }\n  const first = keys[0];\n  const derived = first\n    ? driver.address.fromPublicKey(first.publicKey, options)\n    : undefined;\n  const configured =\n    config.address !== undefined ? driver.address.normalize(config.address) : undefined;\n  if (derived && configured && derived.canonical !== configured.canonical) {\n    throw new ConfigError(\n      'CONFIG_INVALID',\n      `wallet '${wallet.name}': configured address does not match its public key`,\n    );\n  }\n  const normalized = configured ?? derived;\n  if (!normalized) {\n    throw new ConfigError(\n      'CONFIG_INVALID',\n      `wallet '${wallet.name}' needs a signer, a publicKey or an address`,\n    );\n  }\n  const primary = selection.signer;\n  return {\n    name: wallet.name,\n    config,\n    address: new Address(selection.chain.id, normalized, driver.address.format),\n    keys,\n    options,\n    watchOnly: !primary,\n    ...(config.tier !== undefined ? { tier: config.tier } : {}),\n    signerFor: (ref) => {\n      // Own keys only: a key ref named `toString` routes nowhere.\n      const routes = config.signers ?? {};\n      const routed =\n        ref?.id !== undefined && Object.hasOwn(routes, ref.id)\n          ? routes[ref.id]\n          : undefined;\n      const id = routed ?? primary?.id;\n      if (id === undefined) return undefined;\n      const signer =\n        id === primary?.id\n          ? primary.instance\n          : Object.hasOwn(signers, id)\n            ? signers[id]\n            : undefined;\n      return signer ? { id, signer } : undefined;\n    },\n    signerById: (id) => {\n      if (id === primary?.id) return { id, signer: primary.instance };\n      const signer = Object.hasOwn(signers, id) ? signers[id] : undefined;\n      return signer ? { id, signer } : undefined;\n    },\n  };\n}\n"]}

package/dist/core/store/clone.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Deep-clones plain JSON-like data: objects, arrays, `bigint`, `Uint8Array` and other
+ * primitives.
+ *
+ * Deliberately not `structuredClone`: under a sandboxed test runtime (e.g. Jest's
+ * per-file VM context), `structuredClone` rebuilds objects against the *host*
+ * realm's `Object`/`Array`, so a cloned plain object's prototype ends up `!==` the
+ * caller's own `Object.prototype` and `assert.deepStrictEqual` reports a spurious
+ * mismatch. This clone is realm-safe: it never uses `instanceof` against this
+ * module's own constructors, only `Array.isArray`, `Object.prototype.toString` and
+ * prototype-chain shape, so it works the same regardless of which realm the input
+ * came from.
+ *
+ * Only plain data is accepted. A future serialized store (Redis/Postgres) round-trips
+ * exactly two non-JSON shapes over the wire — `bigint` and `Uint8Array` — via a
+ * tagged encoding. Anything else (`Date`, `Map`, `Set`, `RegExp`, a class instance
+ * such as `Amount`/`Address`, a function, a symbol, or a typed array other than
+ * `Uint8Array`) has no such encoding, so it is rejected loudly here rather than
+ * silently corrupted (as a naive recursive clone would do to a `Uint8Array`, turning
+ * its bytes into a `{0: ..., 1: ...}` object) or silently dropped. This also covers
+ * symbol-keyed own properties on an otherwise plain object: `Object.entries` skips
+ * them silently, so they are rejected explicitly instead of being dropped without
+ * a trace.
+ */
+export declare function clone<T>(value: T): T;

package/dist/core/store/clone.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.clone = clone;
+/**
+ * Deep-clones plain JSON-like data: objects, arrays, `bigint`, `Uint8Array` and other
+ * primitives.
+ *
+ * Deliberately not `structuredClone`: under a sandboxed test runtime (e.g. Jest's
+ * per-file VM context), `structuredClone` rebuilds objects against the *host*
+ * realm's `Object`/`Array`, so a cloned plain object's prototype ends up `!==` the
+ * caller's own `Object.prototype` and `assert.deepStrictEqual` reports a spurious
+ * mismatch. This clone is realm-safe: it never uses `instanceof` against this
+ * module's own constructors, only `Array.isArray`, `Object.prototype.toString` and
+ * prototype-chain shape, so it works the same regardless of which realm the input
+ * came from.
+ *
+ * Only plain data is accepted. A future serialized store (Redis/Postgres) round-trips
+ * exactly two non-JSON shapes over the wire — `bigint` and `Uint8Array` — via a
+ * tagged encoding. Anything else (`Date`, `Map`, `Set`, `RegExp`, a class instance
+ * such as `Amount`/`Address`, a function, a symbol, or a typed array other than
+ * `Uint8Array`) has no such encoding, so it is rejected loudly here rather than
+ * silently corrupted (as a naive recursive clone would do to a `Uint8Array`, turning
+ * its bytes into a `{0: ..., 1: ...}` object) or silently dropped. This also covers
+ * symbol-keyed own properties on an otherwise plain object: `Object.entries` skips
+ * them silently, so they are rejected explicitly instead of being dropped without
+ * a trace.
+ */
+function clone(value) {
+    if (value === null || value === undefined)
+        return value;
+    const kind = typeof value;
+    if (kind === 'string' || kind === 'number' || kind === 'boolean' || kind === 'bigint') {
+        return value;
+    }
+    if (kind === 'function' || kind === 'symbol')
+        return reject(value);
+    // kind === 'object' from here on.
+    if (Array.isArray(value)) {
+        // `Array.from` (called on this realm's own `Array`) always builds a this-realm
+        // array; `value.map(...)` would not — a foreign-realm array's inherited `.map`
+        // uses species-based construction and returns a result still rooted in the
+        // *foreign* `Array.prototype`, reintroducing the same realm mismatch this
+        // function exists to avoid.
+        return Array.from(value, (item) => clone(item));
+    }
+    if (Object.prototype.toString.call(value) === '[object Uint8Array]') {
+        return new Uint8Array(value);
+    }
+    if (isPlainObject(value)) {
+        if (Object.getOwnPropertySymbols(value).length > 0)
+            return reject(value);
+        const out = Object.getPrototypeOf(value) === null ? Object.create(null) : {};
+        for (const [key, item] of Object.entries(value)) {
+            out[key] = clone(item);
+        }
+        return out;
+    }
+    return reject(value);
+}
+/** True for `{}`/`Object.create(null)`-shaped objects, from any realm. */
+function isPlainObject(value) {
+    const proto = Object.getPrototypeOf(value);
+    if (proto === null)
+        return true;
+    return Object.getPrototypeOf(proto) === null;
+}
+function reject(value) {
+    throw new TypeError('memory store accepts only plain data (objects, arrays, primitives, bigint, ' +
+        `Uint8Array); got ${Object.prototype.toString.call(value)}`);
+}
+//# sourceMappingURL=clone.js.map

package/dist/core/store/clone.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clone.js","sourceRoot":"","sources":["../../../src/core/store/clone.ts"],"names":[],"mappings":";;AAwBA,sBA+BC;AAvDD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAgB,KAAK,CAAI,KAAQ;IAC/B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAExD,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC;IAC1B,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAEnE,kCAAkC;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,+EAA+E;QAC/E,+EAA+E;QAC/E,2EAA2E;QAC3E,0EAA0E;QAC1E,4BAA4B;QAC5B,OAAO,KAAK,CAAC,IAAI,CAAC,KAAkB,EAAE,CAAC,IAAa,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAiB,CAAC;IACxF,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,qBAAqB,EAAE,CAAC;QACpE,OAAO,IAAI,UAAU,CAAC,KAA8B,CAAiB,CAAC;IACxE,CAAC;IACD,IAAI,aAAa,CAAC,KAAe,CAAC,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,qBAAqB,CAAC,KAAe,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;QACnF,MAAM,GAAG,GACP,MAAM,CAAC,cAAc,CAAC,KAAe,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,GAAQ,CAAC;IAClB,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,0EAA0E;AAC1E,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,KAAK,GAAkB,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC1D,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AAC/C,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,MAAM,IAAI,SAAS,CACjB,6EAA6E;QAC3E,oBAAoB,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAC9D,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Deep-clones plain JSON-like data: objects, arrays, `bigint`, `Uint8Array` and other\n * primitives.\n *\n * Deliberately not `structuredClone`: under a sandboxed test runtime (e.g. Jest's\n * per-file VM context), `structuredClone` rebuilds objects against the *host*\n * realm's `Object`/`Array`, so a cloned plain object's prototype ends up `!==` the\n * caller's own `Object.prototype` and `assert.deepStrictEqual` reports a spurious\n * mismatch. This clone is realm-safe: it never uses `instanceof` against this\n * module's own constructors, only `Array.isArray`, `Object.prototype.toString` and\n * prototype-chain shape, so it works the same regardless of which realm the input\n * came from.\n *\n * Only plain data is accepted. A future serialized store (Redis/Postgres) round-trips\n * exactly two non-JSON shapes over the wire — `bigint` and `Uint8Array` — via a\n * tagged encoding. Anything else (`Date`, `Map`, `Set`, `RegExp`, a class instance\n * such as `Amount`/`Address`, a function, a symbol, or a typed array other than\n * `Uint8Array`) has no such encoding, so it is rejected loudly here rather than\n * silently corrupted (as a naive recursive clone would do to a `Uint8Array`, turning\n * its bytes into a `{0: ..., 1: ...}` object) or silently dropped. This also covers\n * symbol-keyed own properties on an otherwise plain object: `Object.entries` skips\n * them silently, so they are rejected explicitly instead of being dropped without\n * a trace.\n */\nexport function clone<T>(value: T): T {\n  if (value === null || value === undefined) return value;\n\n  const kind = typeof value;\n  if (kind === 'string' || kind === 'number' || kind === 'boolean' || kind === 'bigint') {\n    return value;\n  }\n  if (kind === 'function' || kind === 'symbol') return reject(value);\n\n  // kind === 'object' from here on.\n  if (Array.isArray(value)) {\n    // `Array.from` (called on this realm's own `Array`) always builds a this-realm\n    // array; `value.map(...)` would not — a foreign-realm array's inherited `.map`\n    // uses species-based construction and returns a result still rooted in the\n    // *foreign* `Array.prototype`, reintroducing the same realm mismatch this\n    // function exists to avoid.\n    return Array.from(value as unknown[], (item: unknown) => clone(item)) as unknown as T;\n  }\n  if (Object.prototype.toString.call(value) === '[object Uint8Array]') {\n    return new Uint8Array(value as unknown as Uint8Array) as unknown as T;\n  }\n  if (isPlainObject(value as object)) {\n    if (Object.getOwnPropertySymbols(value as object).length > 0) return reject(value);\n    const out: Record<string, unknown> =\n      Object.getPrototypeOf(value as object) === null ? Object.create(null) : {};\n    for (const [key, item] of Object.entries(value as Record<string, unknown>)) {\n      out[key] = clone(item);\n    }\n    return out as T;\n  }\n  return reject(value);\n}\n\n/** True for `{}`/`Object.create(null)`-shaped objects, from any realm. */\nfunction isPlainObject(value: object): boolean {\n  const proto: object | null = Object.getPrototypeOf(value);\n  if (proto === null) return true;\n  return Object.getPrototypeOf(proto) === null;\n}\n\nfunction reject(value: unknown): never {\n  throw new TypeError(\n    'memory store accepts only plain data (objects, arrays, primitives, bigint, ' +\n      `Uint8Array); got ${Object.prototype.toString.call(value)}`,\n  );\n}\n"]}

package/dist/core/store/memory.d.ts

@@ -0,0 +1,38 @@
+import { type Clock } from '../util/clock';
+import type { AttemptObservation, AttemptRecord, CreateResult, CursorStore, Fence, Lease, LockManager, NewOperation, OperationFilter, OperationPatch, OperationRecord, OperationStore, ScanCursor, SequenceState, SequenceStore, Stores, StoredCursor } from './types';
+export declare class MemoryLockManager implements LockManager {
+    #private;
+    private readonly clock;
+    constructor(clock?: Clock);
+    acquire(key: string, owner: string, ttlMs: number): Promise<Lease | null>;
+    renew(lease: Lease, ttlMs: number): Promise<Lease | null>;
+    release(lease: Lease): Promise<void>;
+}
+export declare class MemorySequenceStore implements SequenceStore {
+    #private;
+    get(key: string): Promise<SequenceState | null>;
+    put(key: string, state: Omit<SequenceState, 'version'>, expectedVersion: number | null): Promise<void>;
+}
+export declare class MemoryCursorStore implements CursorStore {
+    #private;
+    get(key: string): Promise<StoredCursor | null>;
+    put(key: string, cursor: ScanCursor, expectedVersion: number | null): Promise<number>;
+}
+export declare class MemoryOperationStore implements OperationStore {
+    #private;
+    private readonly clock;
+    constructor(clock?: Clock);
+    create(operation: NewOperation): Promise<CreateResult>;
+    get(namespace: string, id: string): Promise<OperationRecord | null>;
+    getByKey(namespace: string, idempotencyKey: string): Promise<OperationRecord | null>;
+    findByRef(namespace: string, refOrTxHash: string): Promise<OperationRecord | null>;
+    update(namespace: string, id: string, patch: OperationPatch, expectedVersion: number, fence?: Fence): Promise<OperationRecord>;
+    appendAttempt(namespace: string, id: string, attempt: AttemptRecord, patch: OperationPatch, expectedVersion: number, fence?: Fence): Promise<OperationRecord>;
+    getObservation(attemptId: string): Promise<AttemptObservation | null>;
+    putObservation(observation: Omit<AttemptObservation, 'version'>, expectedVersion: number | null): Promise<AttemptObservation>;
+    claimDue(namespace: string, workerId: string, now: number, leaseMs: number, limit: number): Promise<OperationRecord[]>;
+    releaseClaim(namespace: string, id: string, fence: Fence): Promise<void>;
+    list(filter: OperationFilter): Promise<OperationRecord[]>;
+    purge(filter: OperationFilter): Promise<number>;
+}
+export declare function createMemoryStores(clock?: Clock): Stores;