@seams/wallet-server 0.5.0

package/dist/esm/core/WebAuthnCredentialBindingStore.js

@@ -0,0 +1,594 @@
+import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
+import { isObject as isObject$1 } from "../shared-ts/src/utils/validation.js";
+import { normalizeRuntimePolicyScope } from "../shared-ts/src/threshold/signingRootScope.js";
+import { formatD1ExecStatement, parseD1JsonColumn, resolveD1DatabaseFromConfig } from "../storage/d1Sql.js";
+import "./defaultConfigsServer.js";
+import { RedisTcpClient, UpstashRedisRestClient, redisDel, redisGetJson, redisSetJson } from "./ThresholdService/kv.js";
+//#region src/core/WebAuthnCredentialBindingStore.ts
+function prepareD1WebAuthnCredentialBindingPutStatement(input) {
+	const parsed = parseWebAuthnCredentialBindingRecord(input.record);
+	if (!parsed) throw new Error("Invalid credential binding record");
+	return input.database.prepare(`INSERT INTO webauthn_credential_bindings (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        rp_id,
+        credential_id_b64u,
+        user_id,
+        signer_slot,
+        record_json,
+        created_at_ms,
+        updated_at_ms
+      )
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT (namespace, org_id, project_id, env_id, rp_id, credential_id_b64u)
+      DO UPDATE SET
+        user_id = EXCLUDED.user_id,
+        signer_slot = EXCLUDED.signer_slot,
+        -- Reads parse record_json, not the columns, so the JSON has to carry
+        -- the same reconciled timestamps the columns do. Replacing it wholesale
+        -- let a second write (the Ed25519 commit, or an out-of-order replay)
+        -- appear to reset createdAtMs and regress updatedAtMs while the columns
+        -- stayed correct.
+        record_json = json_set(
+          EXCLUDED.record_json,
+          '$.createdAtMs',
+          MIN(webauthn_credential_bindings.created_at_ms, EXCLUDED.created_at_ms),
+          '$.updatedAtMs',
+          MAX(webauthn_credential_bindings.updated_at_ms, EXCLUDED.updated_at_ms)
+        ),
+        created_at_ms = MIN(
+          webauthn_credential_bindings.created_at_ms,
+          EXCLUDED.created_at_ms
+        ),
+        updated_at_ms = MAX(
+          webauthn_credential_bindings.updated_at_ms,
+          EXCLUDED.updated_at_ms
+        )`).bind(input.scope.namespace, input.scope.orgId, input.scope.projectId, input.scope.envId, parsed.rpId, parsed.credentialIdB64u, parsed.userId, parsed.signerSlot ?? null, JSON.stringify(parsed), parsed.createdAtMs, parsed.updatedAtMs);
+}
+/** Insert-only binding write for credential promotion. */
+function prepareD1WebAuthnCredentialBindingInsertStatement(input) {
+	const parsed = parseWebAuthnCredentialBindingRecord(input.record);
+	if (!parsed) throw new Error("Invalid credential binding record");
+	return input.database.prepare(`INSERT INTO webauthn_credential_bindings (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        rp_id,
+        credential_id_b64u,
+        user_id,
+        signer_slot,
+        record_json,
+        created_at_ms,
+        updated_at_ms
+      )
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).bind(input.scope.namespace, input.scope.orgId, input.scope.projectId, input.scope.envId, parsed.rpId, parsed.credentialIdB64u, parsed.userId, parsed.signerSlot ?? null, JSON.stringify(parsed), parsed.createdAtMs, parsed.updatedAtMs);
+}
+const WEBAUTHN_CREDENTIAL_BINDING_STORE_D1_SCHEMA_SQL = Object.freeze([`
+    CREATE TABLE IF NOT EXISTS webauthn_credential_bindings (
+      namespace TEXT NOT NULL,
+      org_id TEXT NOT NULL,
+      project_id TEXT NOT NULL,
+      env_id TEXT NOT NULL,
+      rp_id TEXT NOT NULL,
+      credential_id_b64u TEXT NOT NULL,
+      user_id TEXT NOT NULL,
+      -- Nullable until the wallet's Ed25519 Yao ceremony settles.
+      signer_slot INTEGER,
+      record_json TEXT NOT NULL,
+      created_at_ms INTEGER NOT NULL,
+      updated_at_ms INTEGER NOT NULL,
+      PRIMARY KEY (namespace, org_id, project_id, env_id, rp_id, credential_id_b64u),
+      CHECK (length(rp_id) > 0),
+      CHECK (length(credential_id_b64u) > 0),
+      CHECK (length(user_id) > 0),
+      CHECK (signer_slot IS NULL OR signer_slot >= 1),
+      CHECK (json_valid(record_json)),
+      CHECK (created_at_ms > 0),
+      CHECK (updated_at_ms > 0)
+    )
+  `, `
+    CREATE INDEX IF NOT EXISTS webauthn_credential_bindings_user_idx
+      ON webauthn_credential_bindings (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        user_id,
+        rp_id,
+        signer_slot
+      )
+  `]);
+async function ensureWebAuthnCredentialBindingStoreD1Schema(options) {
+	for (const statement of WEBAUTHN_CREDENTIAL_BINDING_STORE_D1_SCHEMA_SQL) await options.database.exec(formatD1ExecStatement(statement));
+}
+function isObject(v) {
+	return isObject$1(v);
+}
+function toPrefixWithColon(prefix, defaultPrefix) {
+	const p = normalizeOptionalTrimmedString(prefix);
+	if (!p) return defaultPrefix;
+	return p.endsWith(":") ? p : `${p}:`;
+}
+function resolveWebAuthnCredentialBindingStoreNamespace(config) {
+	const explicit = normalizeOptionalTrimmedString(config.WEBAUTHN_CREDENTIAL_BINDING_PREFIX);
+	if (explicit) return toPrefixWithColon(explicit, "");
+	return `${toPrefixWithColon(normalizeOptionalTrimmedString(config.THRESHOLD_PREFIX) || "w3a", `w3a:`)}webauthn:credential_binding:`;
+}
+function parseWebAuthnCredentialBindingRecord(raw) {
+	if (!isObject(raw)) return null;
+	const version = normalizeOptionalTrimmedString(raw.version);
+	const rpId = normalizeOptionalTrimmedString(raw.rpId);
+	const credentialIdB64u = normalizeOptionalTrimmedString(raw.credentialIdB64u);
+	const userId = normalizeOptionalTrimmedString(raw.userId);
+	const nearAccountId = normalizeOptionalTrimmedString(raw.nearAccountId);
+	const nearEd25519SigningKeyId = normalizeOptionalTrimmedString(raw.nearEd25519SigningKeyId);
+	const publicKey = normalizeOptionalTrimmedString(raw.publicKey);
+	const signerSlotRaw = raw.signerSlot;
+	const signerSlot = typeof signerSlotRaw === "number" ? signerSlotRaw : Number(signerSlotRaw);
+	const createdAtMsRaw = raw.createdAtMs;
+	const updatedAtMsRaw = raw.updatedAtMs;
+	const createdAtMs = typeof createdAtMsRaw === "number" ? createdAtMsRaw : Number(createdAtMsRaw);
+	const updatedAtMs = typeof updatedAtMsRaw === "number" ? updatedAtMsRaw : Number(updatedAtMsRaw);
+	if (version !== "webauthn_credential_binding_v1") return null;
+	if (!rpId || !credentialIdB64u || !userId) return null;
+	const hasAnyEd25519Fact = Boolean(nearAccountId || nearEd25519SigningKeyId || publicKey) || Number.isFinite(signerSlot);
+	let ed25519Facts = null;
+	if (hasAnyEd25519Fact) {
+		if (!nearAccountId || !nearEd25519SigningKeyId || !publicKey) return null;
+		if (!Number.isFinite(signerSlot) || signerSlot < 1) return null;
+		ed25519Facts = {
+			nearAccountId,
+			nearEd25519SigningKeyId,
+			signerSlot: Math.floor(signerSlot),
+			publicKey
+		};
+	}
+	if (!Number.isFinite(createdAtMs) || createdAtMs <= 0) return null;
+	if (!Number.isFinite(updatedAtMs) || updatedAtMs <= 0) return null;
+	const relayerKeyId = normalizeOptionalTrimmedString(raw.relayerKeyId);
+	const keyVersion = normalizeOptionalTrimmedString(raw.keyVersion);
+	const recoveryExportCapable = typeof raw.recoveryExportCapable === "boolean" ? Boolean(raw.recoveryExportCapable) : void 0;
+	const clientParticipantIdRaw = raw.clientParticipantId;
+	const relayerParticipantIdRaw = raw.relayerParticipantId;
+	const clientParticipantId = typeof clientParticipantIdRaw === "number" ? clientParticipantIdRaw : Number(clientParticipantIdRaw);
+	const relayerParticipantId = typeof relayerParticipantIdRaw === "number" ? relayerParticipantIdRaw : Number(relayerParticipantIdRaw);
+	const participantIdsRaw = raw.participantIds;
+	const participantIds = Array.isArray(participantIdsRaw) ? participantIdsRaw.map((v) => typeof v === "number" ? v : Number(v)).filter((n) => Number.isFinite(n) && n >= 1).map((n) => Math.floor(n)) : null;
+	const runtimePolicyScopeRaw = raw.runtimePolicyScope;
+	const runtimePolicyScope = isObject(runtimePolicyScopeRaw) ? (() => {
+		try {
+			return normalizeRuntimePolicyScope(runtimePolicyScopeRaw);
+		} catch {
+			return null;
+		}
+	})() : null;
+	const base = {
+		version: "webauthn_credential_binding_v1",
+		rpId,
+		credentialIdB64u,
+		userId,
+		...relayerKeyId ? { relayerKeyId } : {},
+		...keyVersion ? { keyVersion } : {},
+		...typeof recoveryExportCapable === "boolean" ? { recoveryExportCapable } : {},
+		...Number.isFinite(clientParticipantId) && clientParticipantId >= 1 ? { clientParticipantId: Math.floor(clientParticipantId) } : {},
+		...Number.isFinite(relayerParticipantId) && relayerParticipantId >= 1 ? { relayerParticipantId: Math.floor(relayerParticipantId) } : {},
+		...participantIds && participantIds.length ? { participantIds } : {},
+		...runtimePolicyScope ? { runtimePolicyScope } : {},
+		createdAtMs: Math.floor(createdAtMs),
+		updatedAtMs: Math.floor(updatedAtMs)
+	};
+	return ed25519Facts ? {
+		...base,
+		...ed25519Facts
+	} : base;
+}
+function requireD1ScopeString(input, field) {
+	const normalized = normalizeOptionalTrimmedString(input);
+	if (!normalized) throw new Error(`${field} is required for D1 WebAuthn credential store`);
+	return normalized;
+}
+function normalizeD1WebAuthnCredentialBindingStoreOptions(input) {
+	return {
+		database: input.database,
+		namespace: requireD1ScopeString(input.namespace, "namespace"),
+		orgId: requireD1ScopeString(input.orgId, "orgId"),
+		projectId: requireD1ScopeString(input.projectId, "projectId"),
+		envId: requireD1ScopeString(input.envId, "envId"),
+		ensureSchema: input.ensureSchema !== false
+	};
+}
+function d1ScopeFromConfig(input) {
+	return {
+		namespace: requireD1ScopeString(input.namespace, "namespace"),
+		orgId: requireD1ScopeString(input.config.orgId || input.config.ORG_ID, "orgId"),
+		projectId: requireD1ScopeString(input.config.projectId || input.config.PROJECT_ID, "projectId"),
+		envId: requireD1ScopeString(input.config.envId || input.config.ENV_ID, "envId")
+	};
+}
+var InMemoryWebAuthnCredentialBindingStore = class {
+	constructor(prefix) {
+		this.map = /* @__PURE__ */ new Map();
+		this.prefix = prefix;
+	}
+	key(rpId, credentialIdB64u) {
+		return `${this.prefix}${rpId}:${credentialIdB64u}`;
+	}
+	async get(rpId, credentialIdB64u) {
+		const r = normalizeOptionalTrimmedString(rpId);
+		const c = normalizeOptionalTrimmedString(credentialIdB64u);
+		if (!r || !c) return null;
+		return this.map.get(this.key(r, c)) || null;
+	}
+	async put(record) {
+		const parsed = parseWebAuthnCredentialBindingRecord(record);
+		if (!parsed) throw new Error("Invalid credential binding record");
+		this.map.set(this.key(parsed.rpId, parsed.credentialIdB64u), parsed);
+	}
+	async del(rpId, credentialIdB64u) {
+		const r = normalizeOptionalTrimmedString(rpId);
+		const c = normalizeOptionalTrimmedString(credentialIdB64u);
+		if (!r || !c) return;
+		this.map.delete(this.key(r, c));
+	}
+	async listByUserId(input) {
+		const uid = normalizeOptionalTrimmedString(input.userId);
+		const rpId = normalizeOptionalTrimmedString(input.rpId);
+		if (!uid) return [];
+		const out = [];
+		for (const v of this.map.values()) {
+			const parsed = parseWebAuthnCredentialBindingRecord(v);
+			if (!parsed) continue;
+			if (parsed.userId !== uid) continue;
+			if (rpId && parsed.rpId !== rpId) continue;
+			out.push(parsed);
+		}
+		out.sort((a, b) => (a.signerSlot ?? Number.MAX_SAFE_INTEGER) - (b.signerSlot ?? Number.MAX_SAFE_INTEGER));
+		return out;
+	}
+};
+var D1WebAuthnCredentialBindingStore = class {
+	constructor(input) {
+		this.adapterKind = "d1";
+		this.schemaReady = false;
+		const normalized = normalizeD1WebAuthnCredentialBindingStoreOptions(input);
+		this.database = normalized.database;
+		this.scope = {
+			namespace: normalized.namespace,
+			orgId: normalized.orgId,
+			projectId: normalized.projectId,
+			envId: normalized.envId
+		};
+		this.ensureSchemaOnUse = normalized.ensureSchema;
+	}
+	async ensureSchema() {
+		if (!this.ensureSchemaOnUse || this.schemaReady) return;
+		await ensureWebAuthnCredentialBindingStoreD1Schema({ database: this.database });
+		this.schemaReady = true;
+	}
+	async get(rpId, credentialIdB64u) {
+		await this.ensureSchema();
+		const r = normalizeOptionalTrimmedString(rpId);
+		const c = normalizeOptionalTrimmedString(credentialIdB64u);
+		if (!r || !c) return null;
+		return parseWebAuthnCredentialBindingRecord(parseD1JsonColumn((await this.database.prepare(`SELECT record_json
+           FROM webauthn_credential_bindings
+          WHERE namespace = ?
+            AND org_id = ?
+            AND project_id = ?
+            AND env_id = ?
+            AND rp_id = ?
+            AND credential_id_b64u = ?
+          LIMIT 1`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, r, c).first())?.record_json));
+	}
+	async put(record) {
+		await this.ensureSchema();
+		await prepareD1WebAuthnCredentialBindingPutStatement({
+			database: this.database,
+			scope: this.scope,
+			record
+		}).run();
+	}
+	async del(rpId, credentialIdB64u) {
+		await this.ensureSchema();
+		const r = normalizeOptionalTrimmedString(rpId);
+		const c = normalizeOptionalTrimmedString(credentialIdB64u);
+		if (!r || !c) return;
+		await this.database.prepare(`DELETE FROM webauthn_credential_bindings
+          WHERE namespace = ?
+            AND org_id = ?
+            AND project_id = ?
+            AND env_id = ?
+            AND rp_id = ?
+            AND credential_id_b64u = ?`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, r, c).run();
+	}
+	async getMaxSignerSlot(input) {
+		await this.ensureSchema();
+		const userId = normalizeOptionalTrimmedString(input.userId);
+		if (!userId) return null;
+		const rpId = normalizeOptionalTrimmedString(input.rpId);
+		const clauses = [
+			"namespace = ?",
+			"org_id = ?",
+			"project_id = ?",
+			"env_id = ?",
+			"user_id = ?"
+		];
+		const values = [
+			this.scope.namespace,
+			this.scope.orgId,
+			this.scope.projectId,
+			this.scope.envId,
+			userId
+		];
+		if (rpId) {
+			clauses.push("rp_id = ?");
+			values.push(rpId);
+		}
+		const row = await this.database.prepare(`SELECT MAX(signer_slot) AS max_signer_slot
+           FROM webauthn_credential_bindings
+          WHERE ${clauses.join(" AND ")}`).bind(...values).first();
+		const maxSignerSlot = Number(row?.max_signer_slot);
+		return Number.isFinite(maxSignerSlot) && maxSignerSlot > 0 ? Math.floor(maxSignerSlot) : null;
+	}
+	async listByUserId(input) {
+		await this.ensureSchema();
+		const userId = normalizeOptionalTrimmedString(input.userId);
+		if (!userId) return [];
+		const rpId = normalizeOptionalTrimmedString(input.rpId);
+		const clauses = [
+			"namespace = ?",
+			"org_id = ?",
+			"project_id = ?",
+			"env_id = ?",
+			"user_id = ?"
+		];
+		const values = [
+			this.scope.namespace,
+			this.scope.orgId,
+			this.scope.projectId,
+			this.scope.envId,
+			userId
+		];
+		if (rpId) {
+			clauses.push("rp_id = ?");
+			values.push(rpId);
+		}
+		const result = await this.database.prepare(`SELECT record_json
+           FROM webauthn_credential_bindings
+          WHERE ${clauses.join(" AND ")}
+          ORDER BY signer_slot ASC`).bind(...values).all();
+		const records = [];
+		for (const row of result.results || []) {
+			const parsed = parseWebAuthnCredentialBindingRecord(parseD1JsonColumn(row.record_json));
+			if (parsed) records.push(parsed);
+		}
+		return records;
+	}
+};
+var UpstashRedisRestWebAuthnCredentialBindingStore = class {
+	constructor(input) {
+		this.client = new UpstashRedisRestClient({
+			url: input.url,
+			token: input.token
+		});
+		this.prefix = input.prefix;
+	}
+	key(rpId, credentialIdB64u) {
+		return `${this.prefix}${rpId}:${credentialIdB64u}`;
+	}
+	async get(rpId, credentialIdB64u) {
+		const r = normalizeOptionalTrimmedString(rpId);
+		const c = normalizeOptionalTrimmedString(credentialIdB64u);
+		if (!r || !c) return null;
+		return parseWebAuthnCredentialBindingRecord(await this.client.getJson(this.key(r, c)));
+	}
+	async put(record) {
+		const parsed = parseWebAuthnCredentialBindingRecord(record);
+		if (!parsed) throw new Error("Invalid credential binding record");
+		await this.client.setJson(this.key(parsed.rpId, parsed.credentialIdB64u), parsed);
+	}
+	async del(rpId, credentialIdB64u) {
+		const r = normalizeOptionalTrimmedString(rpId);
+		const c = normalizeOptionalTrimmedString(credentialIdB64u);
+		if (!r || !c) return;
+		await this.client.del(this.key(r, c));
+	}
+};
+var RedisTcpWebAuthnCredentialBindingStore = class {
+	constructor(input) {
+		this.client = new RedisTcpClient(input.redisUrl);
+		this.prefix = input.prefix;
+	}
+	key(rpId, credentialIdB64u) {
+		return `${this.prefix}${rpId}:${credentialIdB64u}`;
+	}
+	async get(rpId, credentialIdB64u) {
+		const r = normalizeOptionalTrimmedString(rpId);
+		const c = normalizeOptionalTrimmedString(credentialIdB64u);
+		if (!r || !c) return null;
+		return parseWebAuthnCredentialBindingRecord(await redisGetJson(this.client, this.key(r, c)));
+	}
+	async put(record) {
+		const parsed = parseWebAuthnCredentialBindingRecord(record);
+		if (!parsed) throw new Error("Invalid credential binding record");
+		await redisSetJson(this.client, this.key(parsed.rpId, parsed.credentialIdB64u), parsed);
+	}
+	async del(rpId, credentialIdB64u) {
+		const r = normalizeOptionalTrimmedString(rpId);
+		const c = normalizeOptionalTrimmedString(credentialIdB64u);
+		if (!r || !c) return;
+		await redisDel(this.client, this.key(r, c));
+	}
+};
+function isDurableObjectNamespaceLike(v) {
+	return Boolean(v) && typeof v === "object" && !Array.isArray(v) && typeof v.idFromName === "function" && typeof v.get === "function";
+}
+function resolveDoNamespaceFromConfig(config) {
+	const direct = config.namespace;
+	if (isDurableObjectNamespaceLike(direct)) return direct;
+	const alt = config.durableObjectNamespace;
+	if (isDurableObjectNamespaceLike(alt)) return alt;
+	const envStyle = config.THRESHOLD_DO_NAMESPACE;
+	if (isDurableObjectNamespaceLike(envStyle)) return envStyle;
+	return null;
+}
+function resolveDoStub(input) {
+	const id = input.namespace.idFromName(input.objectName);
+	return input.namespace.get(id);
+}
+async function callDo(stub, req) {
+	const resp = await stub.fetch("https://threshold-store.invalid/", {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify(req)
+	});
+	const text = await resp.text();
+	if (!resp.ok) throw new Error(`WebAuthn DO store HTTP ${resp.status}: ${text}`);
+	let json;
+	try {
+		json = text ? JSON.parse(text) : null;
+	} catch {
+		throw new Error(`WebAuthn DO store returned non-JSON response: ${text.slice(0, 200)}`);
+	}
+	if (!isObject(json)) throw new Error("WebAuthn DO store returned invalid JSON shape");
+	if (json.ok === true) return json;
+	const code = normalizeOptionalTrimmedString(json.code);
+	const message = normalizeOptionalTrimmedString(json.message);
+	return {
+		ok: false,
+		code: code || "internal",
+		message: message || "WebAuthn DO store error"
+	};
+}
+var CloudflareDurableObjectWebAuthnCredentialBindingStore = class {
+	constructor(input) {
+		this.stub = resolveDoStub({
+			namespace: input.namespace,
+			objectName: input.objectName
+		});
+		this.prefix = input.prefix;
+	}
+	key(rpId, credentialIdB64u) {
+		return `${this.prefix}${rpId}:${credentialIdB64u}`;
+	}
+	async get(rpId, credentialIdB64u) {
+		const r = normalizeOptionalTrimmedString(rpId);
+		const c = normalizeOptionalTrimmedString(credentialIdB64u);
+		if (!r || !c) return null;
+		const resp = await callDo(this.stub, {
+			op: "get",
+			key: this.key(r, c)
+		});
+		if (!resp.ok) return null;
+		return parseWebAuthnCredentialBindingRecord(resp.value);
+	}
+	async put(record) {
+		const parsed = parseWebAuthnCredentialBindingRecord(record);
+		if (!parsed) throw new Error("Invalid credential binding record");
+		const resp = await callDo(this.stub, {
+			op: "set",
+			key: this.key(parsed.rpId, parsed.credentialIdB64u),
+			value: parsed
+		});
+		if (!resp.ok) throw new Error(resp.message);
+	}
+	async del(rpId, credentialIdB64u) {
+		const r = normalizeOptionalTrimmedString(rpId);
+		const c = normalizeOptionalTrimmedString(credentialIdB64u);
+		if (!r || !c) return;
+		const resp = await callDo(this.stub, {
+			op: "del",
+			key: this.key(r, c)
+		});
+		if (!resp.ok) throw new Error(resp.message);
+	}
+};
+function createWebAuthnCredentialBindingStore(input) {
+	const config = isObject(input.config) ? input.config : {};
+	const prefix = resolveWebAuthnCredentialBindingStoreNamespace(config);
+	const kind = normalizeOptionalTrimmedString(config.kind);
+	if (kind === "d1") {
+		const database = resolveD1DatabaseFromConfig(config);
+		if (!database) throw new Error("[webauthn] D1 credential binding store selected but no D1 database was provided");
+		input.logger.info("[webauthn] Using D1 credential binding store");
+		return new D1WebAuthnCredentialBindingStore({
+			database,
+			...d1ScopeFromConfig({
+				config,
+				namespace: prefix
+			})
+		});
+	}
+	if (kind === "cloudflare-do") {
+		const namespace = resolveDoNamespaceFromConfig(config);
+		if (!namespace) throw new Error("cloudflare-do webauthn store selected but no Durable Object namespace was provided (expected config.namespace)");
+		const objectName = normalizeOptionalTrimmedString(config.objectName) || normalizeOptionalTrimmedString(config.name) || "threshold-store";
+		input.logger.info("[webauthn] Using Cloudflare Durable Object store for credential bindings");
+		return new CloudflareDurableObjectWebAuthnCredentialBindingStore({
+			namespace,
+			objectName,
+			prefix
+		});
+	}
+	if (kind === "in-memory") {
+		input.logger.info("[webauthn] Using in-memory credential binding store (non-persistent)");
+		return new InMemoryWebAuthnCredentialBindingStore(prefix);
+	}
+	if (kind === "upstash-redis-rest") {
+		const url = normalizeOptionalTrimmedString(config.url) || normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_URL);
+		const token = normalizeOptionalTrimmedString(config.token) || normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_TOKEN);
+		if (!url || !token) throw new Error("Upstash webauthn store enabled but url/token are not both set");
+		input.logger.info("[webauthn] Using Upstash REST credential binding store");
+		return new UpstashRedisRestWebAuthnCredentialBindingStore({
+			url,
+			token,
+			prefix
+		});
+	}
+	if (kind === "redis-tcp") {
+		if (!input.isNode) {
+			input.logger.warn("[webauthn] redis-tcp credential binding store is not supported in this runtime; falling back to in-memory");
+			return new InMemoryWebAuthnCredentialBindingStore(prefix);
+		}
+		const redisUrl = normalizeOptionalTrimmedString(config.redisUrl) || normalizeOptionalTrimmedString(config.REDIS_URL);
+		if (!redisUrl) throw new Error("redis-tcp webauthn store enabled but redisUrl is not set");
+		input.logger.info("[webauthn] Using redis-tcp credential binding store");
+		return new RedisTcpWebAuthnCredentialBindingStore({
+			redisUrl,
+			prefix
+		});
+	}
+	if (kind) throw new Error(`[webauthn] Unknown credential binding store kind: ${kind}`);
+	const upstashUrl = normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_URL);
+	const upstashToken = normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_TOKEN);
+	if (upstashUrl || upstashToken) {
+		if (!upstashUrl || !upstashToken) throw new Error("Upstash webauthn store enabled but UPSTASH_REDIS_REST_URL / UPSTASH_REDIS_REST_TOKEN are not both set");
+		input.logger.info("[webauthn] Using Upstash REST credential binding store");
+		return new UpstashRedisRestWebAuthnCredentialBindingStore({
+			url: upstashUrl,
+			token: upstashToken,
+			prefix
+		});
+	}
+	const redisUrl = normalizeOptionalTrimmedString(config.REDIS_URL);
+	if (redisUrl) {
+		if (!input.isNode) {
+			input.logger.warn("[webauthn] REDIS_URL is set but TCP Redis is not supported in this runtime; falling back to in-memory");
+			return new InMemoryWebAuthnCredentialBindingStore(prefix);
+		}
+		input.logger.info("[webauthn] Using redis-tcp credential binding store");
+		return new RedisTcpWebAuthnCredentialBindingStore({
+			redisUrl,
+			prefix
+		});
+	}
+	input.logger.info("[webauthn] Using in-memory credential binding store (no persistence configured)");
+	return new InMemoryWebAuthnCredentialBindingStore(prefix);
+}
+//#endregion
+export { D1WebAuthnCredentialBindingStore, WEBAUTHN_CREDENTIAL_BINDING_STORE_D1_SCHEMA_SQL, createWebAuthnCredentialBindingStore, ensureWebAuthnCredentialBindingStoreD1Schema, prepareD1WebAuthnCredentialBindingInsertStatement, prepareD1WebAuthnCredentialBindingPutStatement, resolveWebAuthnCredentialBindingStoreNamespace };
+
+//# sourceMappingURL=WebAuthnCredentialBindingStore.js.map