@seams/wallet-server 0.6.1 → 0.7.1

package/dist/esm/core/WebAuthnCredentialBindingStore.js

@@ -1,14 +1,12 @@
 import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
-import { isObject as isObject$1 } from "../shared-ts/src/utils/validation.js";
+import { isObject } from "../shared-ts/src/utils/validation.js";
 import { normalizeRuntimePolicyScope } from "../shared-ts/src/threshold/signingRootScope.js";
-import { formatD1ExecStatement, parseD1JsonColumn, resolveD1DatabaseFromConfig } from "../storage/d1Sql.js";
-import "./defaultConfigsServer.js";
-import { RedisTcpClient, UpstashRedisRestClient, redisDel, redisGetJson, redisSetJson } from "./ThresholdService/kv.js";
+import { parseD1JsonColumn } from "../storage/d1Sql.js";
+import { D1TenantTable, ensureD1Schema, prepareD1TenantStatement } from "./d1TenantStore.js";
+import { webAuthnCredentialBindingRows } from "./webAuthnD1Statements.js";
+import { WebAuthnCredentialRecords, createWebAuthnStore, resolveWebAuthnStorePrefix, webAuthnD1Store } from "./webAuthnStoreBackends.js";
 //#region src/core/WebAuthnCredentialBindingStore.ts
-function prepareD1WebAuthnCredentialBindingPutStatement(input) {
-	const parsed = parseWebAuthnCredentialBindingRecord(input.record);
-	if (!parsed) throw new Error("Invalid credential binding record");
-	return input.database.prepare(`INSERT INTO webauthn_credential_bindings (
+const INSERT_CREDENTIAL_BINDING_SQL = `INSERT INTO webauthn_credential_bindings (
         namespace,
         org_id,
         project_id,
@@ -21,7 +19,22 @@ function prepareD1WebAuthnCredentialBindingPutStatement(input) {
         created_at_ms,
         updated_at_ms
       )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`;
+function prepareCredentialBindingWrite(input, sql) {
+	const parsed = parseWebAuthnCredentialBindingRecord(input.record);
+	if (!parsed) throw new Error("Invalid credential binding record");
+	return prepareD1TenantStatement(input.database, input.scope, sql, [
+		parsed.rpId,
+		parsed.credentialIdB64u,
+		parsed.userId,
+		parsed.signerSlot ?? null,
+		JSON.stringify(parsed),
+		parsed.createdAtMs,
+		parsed.updatedAtMs
+	]);
+}
+function prepareD1WebAuthnCredentialBindingPutStatement(input) {
+	return prepareCredentialBindingWrite(input, `${INSERT_CREDENTIAL_BINDING_SQL}
       ON CONFLICT (namespace, org_id, project_id, env_id, rp_id, credential_id_b64u)
       DO UPDATE SET
         user_id = EXCLUDED.user_id,
@@ -45,26 +58,11 @@ function prepareD1WebAuthnCredentialBindingPutStatement(input) {
         updated_at_ms = MAX(
           webauthn_credential_bindings.updated_at_ms,
           EXCLUDED.updated_at_ms
-        )`).bind(input.scope.namespace, input.scope.orgId, input.scope.projectId, input.scope.envId, parsed.rpId, parsed.credentialIdB64u, parsed.userId, parsed.signerSlot ?? null, JSON.stringify(parsed), parsed.createdAtMs, parsed.updatedAtMs);
+        )`);
 }
 /** Insert-only binding write for credential promotion. */
 function prepareD1WebAuthnCredentialBindingInsertStatement(input) {
-	const parsed = parseWebAuthnCredentialBindingRecord(input.record);
-	if (!parsed) throw new Error("Invalid credential binding record");
-	return input.database.prepare(`INSERT INTO webauthn_credential_bindings (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        rp_id,
-        credential_id_b64u,
-        user_id,
-        signer_slot,
-        record_json,
-        created_at_ms,
-        updated_at_ms
-      )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).bind(input.scope.namespace, input.scope.orgId, input.scope.projectId, input.scope.envId, parsed.rpId, parsed.credentialIdB64u, parsed.userId, parsed.signerSlot ?? null, JSON.stringify(parsed), parsed.createdAtMs, parsed.updatedAtMs);
+	return prepareCredentialBindingWrite(input, INSERT_CREDENTIAL_BINDING_SQL);
 }
 const WEBAUTHN_CREDENTIAL_BINDING_STORE_D1_SCHEMA_SQL = Object.freeze([`
     CREATE TABLE IF NOT EXISTS webauthn_credential_bindings (
@@ -102,20 +100,20 @@ const WEBAUTHN_CREDENTIAL_BINDING_STORE_D1_SCHEMA_SQL = Object.freeze([`
       )
   `]);
 async function ensureWebAuthnCredentialBindingStoreD1Schema(options) {
-	for (const statement of WEBAUTHN_CREDENTIAL_BINDING_STORE_D1_SCHEMA_SQL) await options.database.exec(formatD1ExecStatement(statement));
-}
-function isObject(v) {
-	return isObject$1(v);
-}
-function toPrefixWithColon(prefix, defaultPrefix) {
-	const p = normalizeOptionalTrimmedString(prefix);
-	if (!p) return defaultPrefix;
-	return p.endsWith(":") ? p : `${p}:`;
+	await ensureD1Schema(options.database, WEBAUTHN_CREDENTIAL_BINDING_STORE_D1_SCHEMA_SQL);
 }
+const CREDENTIAL_BINDING_STORE = {
+	label: "credential binding",
+	prefixConfigKey: "WEBAUTHN_CREDENTIAL_BINDING_PREFIX",
+	prefixName: "credential_binding",
+	parse: parseWebAuthnCredentialBindingRecord,
+	durableObjectLogSubject: "credential bindings",
+	connectionErrorSubject: "webauthn store",
+	unconfiguredNote: "no persistence configured",
+	d1ScopeLabel: "credential"
+};
 function resolveWebAuthnCredentialBindingStoreNamespace(config) {
-	const explicit = normalizeOptionalTrimmedString(config.WEBAUTHN_CREDENTIAL_BINDING_PREFIX);
-	if (explicit) return toPrefixWithColon(explicit, "");
-	return `${toPrefixWithColon(normalizeOptionalTrimmedString(config.THRESHOLD_PREFIX) || "w3a", `w3a:`)}webauthn:credential_binding:`;
+	return resolveWebAuthnStorePrefix(config, CREDENTIAL_BINDING_STORE);
 }
 function parseWebAuthnCredentialBindingRecord(raw) {
 	if (!isObject(raw)) return null;
@@ -185,60 +183,53 @@ function parseWebAuthnCredentialBindingRecord(raw) {
 		...ed25519Facts
 	} : base;
 }
-function requireD1ScopeString(input, field) {
-	const normalized = normalizeOptionalTrimmedString(input);
-	if (!normalized) throw new Error(`${field} is required for D1 WebAuthn credential store`);
-	return normalized;
-}
-function normalizeD1WebAuthnCredentialBindingStoreOptions(input) {
-	return {
-		database: input.database,
-		namespace: requireD1ScopeString(input.namespace, "namespace"),
-		orgId: requireD1ScopeString(input.orgId, "orgId"),
-		projectId: requireD1ScopeString(input.projectId, "projectId"),
-		envId: requireD1ScopeString(input.envId, "envId"),
-		ensureSchema: input.ensureSchema !== false
-	};
-}
-function d1ScopeFromConfig(input) {
+/** One user's bindings, on one RP ID when given. The scope binds ahead of `values`. */
+function userBindingsFilter(userId, rpId) {
+	const clauses = [
+		"namespace = ?",
+		"org_id = ?",
+		"project_id = ?",
+		"env_id = ?",
+		"user_id = ?"
+	];
+	const values = [userId];
+	if (rpId) {
+		clauses.push("rp_id = ?");
+		values.push(rpId);
+	}
 	return {
-		namespace: requireD1ScopeString(input.namespace, "namespace"),
-		orgId: requireD1ScopeString(input.config.orgId || input.config.ORG_ID, "orgId"),
-		projectId: requireD1ScopeString(input.config.projectId || input.config.PROJECT_ID, "projectId"),
-		envId: requireD1ScopeString(input.config.envId || input.config.ENV_ID, "envId")
+		where: clauses.join(" AND "),
+		values
 	};
 }
-var InMemoryWebAuthnCredentialBindingStore = class {
-	constructor(prefix) {
-		this.map = /* @__PURE__ */ new Map();
-		this.prefix = prefix;
-	}
-	key(rpId, credentialIdB64u) {
-		return `${this.prefix}${rpId}:${credentialIdB64u}`;
+var KeyValueWebAuthnCredentialBindingStore = class {
+	constructor(records, prefix) {
+		this.records = new WebAuthnCredentialRecords(records, prefix);
 	}
 	async get(rpId, credentialIdB64u) {
-		const r = normalizeOptionalTrimmedString(rpId);
-		const c = normalizeOptionalTrimmedString(credentialIdB64u);
-		if (!r || !c) return null;
-		return this.map.get(this.key(r, c)) || null;
+		return this.records.get(rpId, credentialIdB64u);
 	}
 	async put(record) {
 		const parsed = parseWebAuthnCredentialBindingRecord(record);
 		if (!parsed) throw new Error("Invalid credential binding record");
-		this.map.set(this.key(parsed.rpId, parsed.credentialIdB64u), parsed);
+		await this.records.set(parsed.rpId, parsed.credentialIdB64u, parsed);
 	}
 	async del(rpId, credentialIdB64u) {
-		const r = normalizeOptionalTrimmedString(rpId);
-		const c = normalizeOptionalTrimmedString(credentialIdB64u);
-		if (!r || !c) return;
-		this.map.delete(this.key(r, c));
+		await this.records.del(rpId, credentialIdB64u);
+	}
+};
+/** Only the in-memory backend can enumerate a user's bindings. */
+var InMemoryWebAuthnCredentialBindingStore = class extends KeyValueWebAuthnCredentialBindingStore {
+	constructor(memory, prefix) {
+		super(memory, prefix);
+		this.memory = memory;
 	}
 	async listByUserId(input) {
 		const uid = normalizeOptionalTrimmedString(input.userId);
 		const rpId = normalizeOptionalTrimmedString(input.rpId);
 		if (!uid) return [];
 		const out = [];
-		for (const v of this.map.values()) {
+		for (const v of this.memory.map.values()) {
 			const parsed = parseWebAuthnCredentialBindingRecord(v);
 			if (!parsed) continue;
 			if (parsed.userId !== uid) continue;
@@ -252,114 +243,57 @@ var InMemoryWebAuthnCredentialBindingStore = class {
 var D1WebAuthnCredentialBindingStore = class {
 	constructor(input) {
 		this.adapterKind = "d1";
-		this.schemaReady = false;
-		const normalized = normalizeD1WebAuthnCredentialBindingStoreOptions(input);
-		this.database = normalized.database;
-		this.scope = {
-			namespace: normalized.namespace,
-			orgId: normalized.orgId,
-			projectId: normalized.projectId,
-			envId: normalized.envId
-		};
-		this.ensureSchemaOnUse = normalized.ensureSchema;
-	}
-	async ensureSchema() {
-		if (!this.ensureSchemaOnUse || this.schemaReady) return;
-		await ensureWebAuthnCredentialBindingStoreD1Schema({ database: this.database });
-		this.schemaReady = true;
+		this.prepare = (sql, values) => this.table.prepare(sql, values);
+		this.table = new D1TenantTable(input, webAuthnD1Store(CREDENTIAL_BINDING_STORE.d1ScopeLabel), WEBAUTHN_CREDENTIAL_BINDING_STORE_D1_SCHEMA_SQL);
 	}
 	async get(rpId, credentialIdB64u) {
-		await this.ensureSchema();
+		await this.table.ensureSchema();
 		const r = normalizeOptionalTrimmedString(rpId);
 		const c = normalizeOptionalTrimmedString(credentialIdB64u);
 		if (!r || !c) return null;
-		return parseWebAuthnCredentialBindingRecord(parseD1JsonColumn((await this.database.prepare(`SELECT record_json
-           FROM webauthn_credential_bindings
-          WHERE namespace = ?
-            AND org_id = ?
-            AND project_id = ?
-            AND env_id = ?
-            AND rp_id = ?
-            AND credential_id_b64u = ?
-          LIMIT 1`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, r, c).first())?.record_json));
+		return parseWebAuthnCredentialBindingRecord(parseD1JsonColumn((await webAuthnCredentialBindingRows.select(this.prepare, r, c).first())?.record_json));
 	}
 	async put(record) {
-		await this.ensureSchema();
+		await this.table.ensureSchema();
 		await prepareD1WebAuthnCredentialBindingPutStatement({
-			database: this.database,
-			scope: this.scope,
+			database: this.table.database,
+			scope: this.table.scope,
 			record
 		}).run();
 	}
 	async del(rpId, credentialIdB64u) {
-		await this.ensureSchema();
+		await this.table.ensureSchema();
 		const r = normalizeOptionalTrimmedString(rpId);
 		const c = normalizeOptionalTrimmedString(credentialIdB64u);
 		if (!r || !c) return;
-		await this.database.prepare(`DELETE FROM webauthn_credential_bindings
+		await this.table.prepare(`DELETE FROM webauthn_credential_bindings
           WHERE namespace = ?
             AND org_id = ?
             AND project_id = ?
             AND env_id = ?
             AND rp_id = ?
-            AND credential_id_b64u = ?`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, r, c).run();
+            AND credential_id_b64u = ?`, [r, c]).run();
 	}
 	async getMaxSignerSlot(input) {
-		await this.ensureSchema();
+		await this.table.ensureSchema();
 		const userId = normalizeOptionalTrimmedString(input.userId);
 		if (!userId) return null;
-		const rpId = normalizeOptionalTrimmedString(input.rpId);
-		const clauses = [
-			"namespace = ?",
-			"org_id = ?",
-			"project_id = ?",
-			"env_id = ?",
-			"user_id = ?"
-		];
-		const values = [
-			this.scope.namespace,
-			this.scope.orgId,
-			this.scope.projectId,
-			this.scope.envId,
-			userId
-		];
-		if (rpId) {
-			clauses.push("rp_id = ?");
-			values.push(rpId);
-		}
-		const row = await this.database.prepare(`SELECT MAX(signer_slot) AS max_signer_slot
+		const filter = userBindingsFilter(userId, normalizeOptionalTrimmedString(input.rpId));
+		const row = await this.table.prepare(`SELECT MAX(signer_slot) AS max_signer_slot
            FROM webauthn_credential_bindings
-          WHERE ${clauses.join(" AND ")}`).bind(...values).first();
+          WHERE ${filter.where}`, filter.values).first();
 		const maxSignerSlot = Number(row?.max_signer_slot);
 		return Number.isFinite(maxSignerSlot) && maxSignerSlot > 0 ? Math.floor(maxSignerSlot) : null;
 	}
 	async listByUserId(input) {
-		await this.ensureSchema();
+		await this.table.ensureSchema();
 		const userId = normalizeOptionalTrimmedString(input.userId);
 		if (!userId) return [];
-		const rpId = normalizeOptionalTrimmedString(input.rpId);
-		const clauses = [
-			"namespace = ?",
-			"org_id = ?",
-			"project_id = ?",
-			"env_id = ?",
-			"user_id = ?"
-		];
-		const values = [
-			this.scope.namespace,
-			this.scope.orgId,
-			this.scope.projectId,
-			this.scope.envId,
-			userId
-		];
-		if (rpId) {
-			clauses.push("rp_id = ?");
-			values.push(rpId);
-		}
-		const result = await this.database.prepare(`SELECT record_json
+		const filter = userBindingsFilter(userId, normalizeOptionalTrimmedString(input.rpId));
+		const result = await this.table.prepare(`SELECT record_json
            FROM webauthn_credential_bindings
-          WHERE ${clauses.join(" AND ")}
-          ORDER BY signer_slot ASC`).bind(...values).all();
+          WHERE ${filter.where}
+          ORDER BY signer_slot ASC`, filter.values).all();
 		const records = [];
 		for (const row of result.results || []) {
 			const parsed = parseWebAuthnCredentialBindingRecord(parseD1JsonColumn(row.record_json));
@@ -368,225 +302,12 @@ var D1WebAuthnCredentialBindingStore = class {
 		return records;
 	}
 };
-var UpstashRedisRestWebAuthnCredentialBindingStore = class {
-	constructor(input) {
-		this.client = new UpstashRedisRestClient({
-			url: input.url,
-			token: input.token
-		});
-		this.prefix = input.prefix;
-	}
-	key(rpId, credentialIdB64u) {
-		return `${this.prefix}${rpId}:${credentialIdB64u}`;
-	}
-	async get(rpId, credentialIdB64u) {
-		const r = normalizeOptionalTrimmedString(rpId);
-		const c = normalizeOptionalTrimmedString(credentialIdB64u);
-		if (!r || !c) return null;
-		return parseWebAuthnCredentialBindingRecord(await this.client.getJson(this.key(r, c)));
-	}
-	async put(record) {
-		const parsed = parseWebAuthnCredentialBindingRecord(record);
-		if (!parsed) throw new Error("Invalid credential binding record");
-		await this.client.setJson(this.key(parsed.rpId, parsed.credentialIdB64u), parsed);
-	}
-	async del(rpId, credentialIdB64u) {
-		const r = normalizeOptionalTrimmedString(rpId);
-		const c = normalizeOptionalTrimmedString(credentialIdB64u);
-		if (!r || !c) return;
-		await this.client.del(this.key(r, c));
-	}
-};
-var RedisTcpWebAuthnCredentialBindingStore = class {
-	constructor(input) {
-		this.client = new RedisTcpClient(input.redisUrl);
-		this.prefix = input.prefix;
-	}
-	key(rpId, credentialIdB64u) {
-		return `${this.prefix}${rpId}:${credentialIdB64u}`;
-	}
-	async get(rpId, credentialIdB64u) {
-		const r = normalizeOptionalTrimmedString(rpId);
-		const c = normalizeOptionalTrimmedString(credentialIdB64u);
-		if (!r || !c) return null;
-		return parseWebAuthnCredentialBindingRecord(await redisGetJson(this.client, this.key(r, c)));
-	}
-	async put(record) {
-		const parsed = parseWebAuthnCredentialBindingRecord(record);
-		if (!parsed) throw new Error("Invalid credential binding record");
-		await redisSetJson(this.client, this.key(parsed.rpId, parsed.credentialIdB64u), parsed);
-	}
-	async del(rpId, credentialIdB64u) {
-		const r = normalizeOptionalTrimmedString(rpId);
-		const c = normalizeOptionalTrimmedString(credentialIdB64u);
-		if (!r || !c) return;
-		await redisDel(this.client, this.key(r, c));
-	}
-};
-function isDurableObjectNamespaceLike(v) {
-	return Boolean(v) && typeof v === "object" && !Array.isArray(v) && typeof v.idFromName === "function" && typeof v.get === "function";
-}
-function resolveDoNamespaceFromConfig(config) {
-	const direct = config.namespace;
-	if (isDurableObjectNamespaceLike(direct)) return direct;
-	const alt = config.durableObjectNamespace;
-	if (isDurableObjectNamespaceLike(alt)) return alt;
-	const envStyle = config.THRESHOLD_DO_NAMESPACE;
-	if (isDurableObjectNamespaceLike(envStyle)) return envStyle;
-	return null;
-}
-function resolveDoStub(input) {
-	const id = input.namespace.idFromName(input.objectName);
-	return input.namespace.get(id);
-}
-async function callDo(stub, req) {
-	const resp = await stub.fetch("https://threshold-store.invalid/", {
-		method: "POST",
-		headers: { "content-type": "application/json" },
-		body: JSON.stringify(req)
-	});
-	const text = await resp.text();
-	if (!resp.ok) throw new Error(`WebAuthn DO store HTTP ${resp.status}: ${text}`);
-	let json;
-	try {
-		json = text ? JSON.parse(text) : null;
-	} catch {
-		throw new Error(`WebAuthn DO store returned non-JSON response: ${text.slice(0, 200)}`);
-	}
-	if (!isObject(json)) throw new Error("WebAuthn DO store returned invalid JSON shape");
-	if (json.ok === true) return json;
-	const code = normalizeOptionalTrimmedString(json.code);
-	const message = normalizeOptionalTrimmedString(json.message);
-	return {
-		ok: false,
-		code: code || "internal",
-		message: message || "WebAuthn DO store error"
-	};
-}
-var CloudflareDurableObjectWebAuthnCredentialBindingStore = class {
-	constructor(input) {
-		this.stub = resolveDoStub({
-			namespace: input.namespace,
-			objectName: input.objectName
-		});
-		this.prefix = input.prefix;
-	}
-	key(rpId, credentialIdB64u) {
-		return `${this.prefix}${rpId}:${credentialIdB64u}`;
-	}
-	async get(rpId, credentialIdB64u) {
-		const r = normalizeOptionalTrimmedString(rpId);
-		const c = normalizeOptionalTrimmedString(credentialIdB64u);
-		if (!r || !c) return null;
-		const resp = await callDo(this.stub, {
-			op: "get",
-			key: this.key(r, c)
-		});
-		if (!resp.ok) return null;
-		return parseWebAuthnCredentialBindingRecord(resp.value);
-	}
-	async put(record) {
-		const parsed = parseWebAuthnCredentialBindingRecord(record);
-		if (!parsed) throw new Error("Invalid credential binding record");
-		const resp = await callDo(this.stub, {
-			op: "set",
-			key: this.key(parsed.rpId, parsed.credentialIdB64u),
-			value: parsed
-		});
-		if (!resp.ok) throw new Error(resp.message);
-	}
-	async del(rpId, credentialIdB64u) {
-		const r = normalizeOptionalTrimmedString(rpId);
-		const c = normalizeOptionalTrimmedString(credentialIdB64u);
-		if (!r || !c) return;
-		const resp = await callDo(this.stub, {
-			op: "del",
-			key: this.key(r, c)
-		});
-		if (!resp.ok) throw new Error(resp.message);
-	}
-};
 function createWebAuthnCredentialBindingStore(input) {
-	const config = isObject(input.config) ? input.config : {};
-	const prefix = resolveWebAuthnCredentialBindingStoreNamespace(config);
-	const kind = normalizeOptionalTrimmedString(config.kind);
-	if (kind === "d1") {
-		const database = resolveD1DatabaseFromConfig(config);
-		if (!database) throw new Error("[webauthn] D1 credential binding store selected but no D1 database was provided");
-		input.logger.info("[webauthn] Using D1 credential binding store");
-		return new D1WebAuthnCredentialBindingStore({
-			database,
-			...d1ScopeFromConfig({
-				config,
-				namespace: prefix
-			})
-		});
-	}
-	if (kind === "cloudflare-do") {
-		const namespace = resolveDoNamespaceFromConfig(config);
-		if (!namespace) throw new Error("cloudflare-do webauthn store selected but no Durable Object namespace was provided (expected config.namespace)");
-		const objectName = normalizeOptionalTrimmedString(config.objectName) || normalizeOptionalTrimmedString(config.name) || "threshold-store";
-		input.logger.info("[webauthn] Using Cloudflare Durable Object store for credential bindings");
-		return new CloudflareDurableObjectWebAuthnCredentialBindingStore({
-			namespace,
-			objectName,
-			prefix
-		});
-	}
-	if (kind === "in-memory") {
-		input.logger.info("[webauthn] Using in-memory credential binding store (non-persistent)");
-		return new InMemoryWebAuthnCredentialBindingStore(prefix);
-	}
-	if (kind === "upstash-redis-rest") {
-		const url = normalizeOptionalTrimmedString(config.url) || normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_URL);
-		const token = normalizeOptionalTrimmedString(config.token) || normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_TOKEN);
-		if (!url || !token) throw new Error("Upstash webauthn store enabled but url/token are not both set");
-		input.logger.info("[webauthn] Using Upstash REST credential binding store");
-		return new UpstashRedisRestWebAuthnCredentialBindingStore({
-			url,
-			token,
-			prefix
-		});
-	}
-	if (kind === "redis-tcp") {
-		if (!input.isNode) {
-			input.logger.warn("[webauthn] redis-tcp credential binding store is not supported in this runtime; falling back to in-memory");
-			return new InMemoryWebAuthnCredentialBindingStore(prefix);
-		}
-		const redisUrl = normalizeOptionalTrimmedString(config.redisUrl) || normalizeOptionalTrimmedString(config.REDIS_URL);
-		if (!redisUrl) throw new Error("redis-tcp webauthn store enabled but redisUrl is not set");
-		input.logger.info("[webauthn] Using redis-tcp credential binding store");
-		return new RedisTcpWebAuthnCredentialBindingStore({
-			redisUrl,
-			prefix
-		});
-	}
-	if (kind) throw new Error(`[webauthn] Unknown credential binding store kind: ${kind}`);
-	const upstashUrl = normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_URL);
-	const upstashToken = normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_TOKEN);
-	if (upstashUrl || upstashToken) {
-		if (!upstashUrl || !upstashToken) throw new Error("Upstash webauthn store enabled but UPSTASH_REDIS_REST_URL / UPSTASH_REDIS_REST_TOKEN are not both set");
-		input.logger.info("[webauthn] Using Upstash REST credential binding store");
-		return new UpstashRedisRestWebAuthnCredentialBindingStore({
-			url: upstashUrl,
-			token: upstashToken,
-			prefix
-		});
-	}
-	const redisUrl = normalizeOptionalTrimmedString(config.REDIS_URL);
-	if (redisUrl) {
-		if (!input.isNode) {
-			input.logger.warn("[webauthn] REDIS_URL is set but TCP Redis is not supported in this runtime; falling back to in-memory");
-			return new InMemoryWebAuthnCredentialBindingStore(prefix);
-		}
-		input.logger.info("[webauthn] Using redis-tcp credential binding store");
-		return new RedisTcpWebAuthnCredentialBindingStore({
-			redisUrl,
-			prefix
-		});
-	}
-	input.logger.info("[webauthn] Using in-memory credential binding store (no persistence configured)");
-	return new InMemoryWebAuthnCredentialBindingStore(prefix);
+	return createWebAuthnStore(input, CREDENTIAL_BINDING_STORE, {
+		d1: (options) => new D1WebAuthnCredentialBindingStore(options),
+		keyValue: (records, prefix) => new KeyValueWebAuthnCredentialBindingStore(records, prefix),
+		inMemory: (records, prefix) => new InMemoryWebAuthnCredentialBindingStore(records, prefix)
+	});
 }
 //#endregion
 export { D1WebAuthnCredentialBindingStore, WEBAUTHN_CREDENTIAL_BINDING_STORE_D1_SCHEMA_SQL, createWebAuthnCredentialBindingStore, ensureWebAuthnCredentialBindingStoreD1Schema, prepareD1WebAuthnCredentialBindingInsertStatement, prepareD1WebAuthnCredentialBindingPutStatement, resolveWebAuthnCredentialBindingStoreNamespace };