@seams/wallet-server 0.6.2 → 0.7.3

package/dist/esm/core/signingLanes/ecdsaServerRetirement.js

@@ -1,5 +1,6 @@
 import { mpcMaterialActivationRefsEqual } from "../../shared-ts/src/utils/domainIds.js";
 import { parseDigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
+import { isPlainObject } from "../../shared-ts/src/utils/validation.js";
 import { parseEcdsaServerRetirementReceiptV1 } from "../../shared-ts/src/signing-lanes/rotationParsers.js";
 import { computeEcdsaServerRetirementReceiptDigestV1 } from "../../shared-ts/src/signing-lanes/rotationDigests.js";
 import "../../shared-ts/src/signing-lanes/index.js";
@@ -39,9 +40,6 @@ async function parseAndVerifyEcdsaServerRetirementEffectV1(input) {
 		retirementReceiptDigestB64u: parseDigestB64u(receipt.receiptDigestB64u)
 	};
 }
-function assertEcdsaServerRetirementReceiptMatchesExpectationV1(receipt, expectation) {
-	assertReceiptMatchesExpectation(receipt, expectation);
-}
 function assertReceiptMatchesExpectation(receipt, expectation) {
 	if (receipt.manifest.manifestId !== expectation.manifest.manifestId || receipt.manifest.manifestRevision !== expectation.manifest.manifestRevision || !mpcMaterialActivationRefsEqual(receipt.materialActivation, expectation.materialActivation) || receipt.walletKeyId !== expectation.walletKeyId || receipt.laneId !== expectation.laneId || receipt.laneShareEpoch !== expectation.laneShareEpoch || receipt.revocationEpoch !== expectation.revocationEpoch || receipt.retirementReason !== expectation.retirementReason || receipt.retirementCorrelationId !== expectation.retirementCorrelationId || receipt.retirementRequestDigestB64u !== expectation.retirementRequestDigestB64u || receipt.serverGeneration !== expectation.serverGeneration || receipt.lifecycleId !== expectation.lifecycleId) throw new Error("ECDSA retirement receipt does not match the admitted lane binding");
 }
@@ -55,7 +53,7 @@ function retirementReasonForCommand(reason) {
 	}
 }
 function exactEffectEnvelope(value, label) {
-	if (!isObject(value)) throw new Error(`${label} must be an object`);
+	if (!isPlainObject(value)) throw new Error(`${label} must be an object`);
 	const fields = ["outcome", "receipt"];
 	const allowed = new Set(fields);
 	for (const key of Object.keys(value)) if (!allowed.has(key)) throw new Error(`${label}.${key} is unsupported`);
@@ -65,14 +63,11 @@ function exactEffectEnvelope(value, label) {
 		receipt: Reflect.get(value, "receipt")
 	};
 }
-function isObject(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function parseOutcome(value, label) {
 	if (value === "applied" || value === "replayed") return value;
 	throw new Error(`${label} is invalid`);
 }
 //#endregion
-export { assertEcdsaServerRetirementReceiptMatchesExpectationV1, buildEcdsaServerRetirementRequestV1, parseAndVerifyEcdsaServerRetirementEffectV1 };
+export { buildEcdsaServerRetirementRequestV1, parseAndVerifyEcdsaServerRetirementEffectV1 };
 
 //# sourceMappingURL=ecdsaServerRetirement.js.map

package/dist/esm/core/signingLanes/ed25519ServerRetirement.js

@@ -29,9 +29,6 @@ async function parseAndVerifyEd25519ServerRetirementEffectV1(input) {
 		retirementReceiptDigestB64u: canonicalDigest
 	};
 }
-function assertEd25519ServerRetirementReceiptMatchesRequestV1(receipt, request) {
-	assertReceiptMatchesRequest(receipt, request);
-}
 function assertIdentityMatchesCommand(identity, command) {
 	if (identity.keyFamily !== "ed25519" || identity.walletId !== command.walletId || identity.walletKeyId !== command.walletKeyId || identity.targetLaneId !== command.laneId || identity.targetLaneShareEpoch !== command.laneShareEpoch) throw new Error("Ed25519 retirement binding identity does not match the authorized command");
 }
@@ -66,6 +63,6 @@ function parseOutcome(value, label) {
 	throw new Error(`${label} is invalid`);
 }
 //#endregion
-export { assertEd25519ServerRetirementReceiptMatchesRequestV1, buildEd25519ServerRetirementRequestV1, parseAndVerifyEd25519ServerRetirementEffectV1 };
+export { buildEd25519ServerRetirementRequestV1, parseAndVerifyEd25519ServerRetirementEffectV1 };
 
 //# sourceMappingURL=ed25519ServerRetirement.js.map

package/dist/esm/core/signingMaterial/ordinaryInactiveSignerMaterialReservation.js

@@ -1,7 +1,7 @@
 import { hasWhitespaceOrControlCharacters, mpcMaterialActivationRefsEqual, parseMpcMaterialActivationRef } from "../../shared-ts/src/utils/domainIds.js";
 import { parseExactAdministeredSignerManifestV1 } from "../../shared-ts/src/device-linking/delegatedActivationPlan.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoParticipantIdsV1 } from "../../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { parseRouterAbEd25519YaoActivationPublicReceiptV1, parseRouterAbEd25519YaoCeremonyBindingV1, parseRouterAbEd25519YaoEncryptedPackageV1, parseRouterAbEd25519YaoParticipantIdsV1, sameRouterAbEd25519YaoByteSequence } from "../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { parseLinkedDeviceEcdsaEncryptedSourceContributionV1, parseLinkedDeviceEcdsaSourceContributionPackageV1, parseLinkedDeviceEcdsaSourceDerivationV1, parseLinkedDeviceEcdsaSourcePreservingActivationReceiptV1 } from "../../shared-ts/src/device-linking/sourceContribution.js";
 //#region src/core/signingMaterial/ordinaryInactiveSignerMaterialReservation.ts
 function validateOrdinaryInactiveSignerMaterialDeactivationRequestV1(request) {
@@ -130,7 +130,7 @@ function parseOrdinaryEd25519SignerMaterialWorkerReservationV1(request, raw) {
 	const activationReceipt = parseRouterAbEd25519YaoActivationPublicReceiptV1(reservation.activationReceipt);
 	assertMaterialActivationMatchesV1(request.plannedActivationRef, routerAbMpcMaterialActivationRefFromWire(activationReceipt.material_activation));
 	const clientMaterial = parseEd25519ClientMaterialV1(reservation.clientMaterial);
-	if (!sameBytes(activationReceipt.transcript, clientMaterial.deriver_a_client_package.transcript) || !sameBytes(activationReceipt.transcript, clientMaterial.deriver_b_client_package.transcript)) throw new Error("ordinary Ed25519 worker receipt transcript does not match client packages");
+	if (!sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, clientMaterial.deriver_a_client_package.transcript) || !sameRouterAbEd25519YaoByteSequence(activationReceipt.transcript, clientMaterial.deriver_b_client_package.transcript)) throw new Error("ordinary Ed25519 worker receipt transcript does not match client packages");
 	return {
 		kind: "ordinary_ed25519_signer_material_worker_reservation_v1",
 		keyFamily: "ed25519",
@@ -247,9 +247,6 @@ function sameEcdsaSourceSigner(left, right) {
 function sameEcdsaTarget(left, right) {
 	return mpcMaterialActivationRefsEqual(left.activation, right.activation) && String(left.targetDeviceId) === String(right.targetDeviceId) && left.targetFactorVerificationDigestB64u === right.targetFactorVerificationDigestB64u && left.clientRecipientPublicKeyB64u === right.clientRecipientPublicKeyB64u && left.signingWorkerRecipientPublicKeyB64u === right.signingWorkerRecipientPublicKeyB64u;
 }
-function sameBytes(left, right) {
-	return left.length === right.length && left.every((value, index) => value === right[index]);
-}
 function parseEd25519ClientPackageV1(raw, label, expectedRole) {
 	const parsed = parseRouterAbEd25519YaoEncryptedPackageV1(raw);
 	if (!parsed.ok) throw new Error(`${label} ${parsed.message}`);

package/dist/esm/core/storeBackends.js

@@ -0,0 +1,208 @@
+import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
+import { isObject, isPlainObject } from "../shared-ts/src/utils/validation.js";
+import "./defaultConfigsServer.js";
+import { resolveD1DatabaseFromConfig } from "../storage/d1Sql.js";
+import { d1TenantScopeFromConfig } from "./d1TenantStore.js";
+import { RedisTcpClient, UpstashRedisRestClient, redisDel, redisGetJson, redisGetdelJson, redisSetJson } from "./ThresholdService/kv.js";
+//#region src/core/storeBackends.ts
+function isDurableObjectNamespaceLike(value) {
+	return isPlainObject(value) && typeof value.idFromName === "function" && typeof value.get === "function";
+}
+/** The first of `namespace`, `durableObjectNamespace` and `THRESHOLD_DO_NAMESPACE` that is one. */
+function resolveDurableObjectNamespace(config) {
+	const direct = config.namespace;
+	if (isDurableObjectNamespaceLike(direct)) return direct;
+	const alt = config.durableObjectNamespace;
+	if (isDurableObjectNamespaceLike(alt)) return alt;
+	const envStyle = config.THRESHOLD_DO_NAMESPACE;
+	if (isDurableObjectNamespaceLike(envStyle)) return envStyle;
+	return null;
+}
+/** The object a store config names: `objectName`, else `name`, else the default. */
+function durableObjectName(config) {
+	return normalizeOptionalTrimmedString(config.objectName) || normalizeOptionalTrimmedString(config.name) || "threshold-store";
+}
+function durableObjectStub(namespace, objectName) {
+	return namespace.get(namespace.idFromName(objectName));
+}
+/** Posts one JSON request to a store's Durable Object. */
+function postDurableObjectRequest(stub, body) {
+	return stub.fetch("https://threshold-store.invalid/", {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify(body)
+	});
+}
+/**
+* Posts a request and parses the object's JSON reply; an empty reply reads as null. An HTTP error
+* or a reply that is not JSON throws, naming the store: `<storeName> DO store …`.
+*/
+async function requestDurableObjectJson(stub, body, storeName) {
+	const resp = await postDurableObjectRequest(stub, body);
+	const text = await resp.text();
+	if (!resp.ok) throw new Error(`${storeName} DO store HTTP ${resp.status}: ${text}`);
+	try {
+		return text ? JSON.parse(text) : null;
+	} catch {
+		throw new Error(`${storeName} DO store returned non-JSON response: ${text.slice(0, 200)}`);
+	}
+}
+async function callDo(stub, req, storeName) {
+	const json = await requestDurableObjectJson(stub, req, storeName);
+	if (!isObject(json)) throw new Error(`${storeName} DO store returned invalid JSON shape`);
+	if (json.ok === true) return json;
+	const code = normalizeOptionalTrimmedString(json.code);
+	const message = normalizeOptionalTrimmedString(json.message);
+	return {
+		ok: false,
+		code: code || "internal",
+		message: message || `${storeName} DO store error`
+	};
+}
+function upstashRecords(client, parse) {
+	return {
+		get: async (key) => parse(await client.getJson(key)),
+		take: async (key) => parse(await client.getdelJson(key)),
+		set: (key, record, ttlMs) => client.setJson(key, record, ttlMs),
+		del: (key) => client.del(key)
+	};
+}
+function redisTcpRecords(client, parse) {
+	return {
+		get: async (key) => parse(await redisGetJson(client, key)),
+		take: async (key) => parse(await redisGetdelJson(client, key)),
+		set: (key, record, ttlMs) => redisSetJson(client, key, record, ttlMs),
+		del: (key) => redisDel(client, key)
+	};
+}
+function durableObjectRecords(stub, parse, storeName) {
+	const read = async (op, key) => {
+		const resp = await callDo(stub, {
+			op,
+			key
+		}, storeName);
+		return parse(resp.ok ? resp.value : null);
+	};
+	const write = async (req) => {
+		const resp = await callDo(stub, req, storeName);
+		if (!resp.ok) throw new Error(resp.message);
+	};
+	return {
+		get: (key) => read("get", key),
+		take: (key) => read("getdel", key),
+		set: (key, record, ttlMs) => write({
+			op: "set",
+			key,
+			value: record,
+			ttlMs
+		}),
+		del: (key) => write({
+			op: "del",
+			key
+		})
+	};
+}
+/**
+* Selects a key-value store's backend: the config's explicit `kind`, else Upstash or Redis from
+* env-shaped config, else in memory. The store type `S` comes from the caller's return type.
+*/
+function createKeyValueStore(input, spec, build) {
+	const { tag, label, connectionErrorSubject, parse } = spec;
+	const config = isObject(input.config) ? input.config : {};
+	const prefix = spec.resolvePrefix(config);
+	const inMemory = () => build.inMemory(prefix);
+	const upstash = (url, token) => build.keyValue(upstashRecords(new UpstashRedisRestClient({
+		url,
+		token
+	}), parse), prefix);
+	const redisTcp = (redisUrl) => build.keyValue(redisTcpRecords(new RedisTcpClient(redisUrl), parse), prefix);
+	const kind = normalizeOptionalTrimmedString(config.kind);
+	if (kind === "d1") {
+		const database = resolveD1DatabaseFromConfig(config);
+		if (!database) throw new Error(`[${tag}] D1 ${label} store selected but no D1 database was provided`);
+		input.logger.info(`[${tag}] Using D1 ${label} store`);
+		const scope = d1TenantScopeFromConfig(config, prefix, spec.d1StoreName);
+		return build.d1({
+			database,
+			...scope
+		});
+	}
+	if (kind === "cloudflare-do") {
+		const namespace = resolveDurableObjectNamespace(config);
+		if (!namespace) throw new Error(`cloudflare-do ${tag} store selected but no Durable Object namespace was provided (expected config.namespace)`);
+		const objectName = durableObjectName(config);
+		input.logger.info(`[${tag}] Using Cloudflare Durable Object ${spec.durableObjectLog}`);
+		const stub = durableObjectStub(namespace, objectName);
+		return build.keyValue(durableObjectRecords(stub, parse, spec.durableObjectErrorName), prefix);
+	}
+	if (kind === "in-memory") {
+		input.logger.info(`[${tag}] Using in-memory ${label} store (non-persistent)`);
+		return inMemory();
+	}
+	if (kind === "upstash-redis-rest") {
+		const url = normalizeOptionalTrimmedString(config.url) || normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_URL);
+		const token = normalizeOptionalTrimmedString(config.token) || normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_TOKEN);
+		if (!url || !token) throw new Error(`Upstash ${connectionErrorSubject} enabled but url/token are not both set`);
+		input.logger.info(`[${tag}] Using Upstash REST ${label} store`);
+		return upstash(url, token);
+	}
+	if (kind === "redis-tcp") {
+		if (!input.isNode) {
+			input.logger.warn(`[${tag}] redis-tcp ${label} store is not supported in this runtime; falling back to in-memory`);
+			return inMemory();
+		}
+		const redisUrl = normalizeOptionalTrimmedString(config.redisUrl) || normalizeOptionalTrimmedString(config.REDIS_URL);
+		if (!redisUrl) throw new Error(`redis-tcp ${connectionErrorSubject} enabled but redisUrl is not set`);
+		input.logger.info(`[${tag}] Using redis-tcp ${label} store`);
+		return redisTcp(redisUrl);
+	}
+	if (kind) throw new Error(`[${tag}] Unknown ${label} store kind: ${kind}`);
+	const upstashUrl = normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_URL);
+	const upstashToken = normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_TOKEN);
+	if (upstashUrl || upstashToken) {
+		if (!upstashUrl || !upstashToken) throw new Error(`Upstash ${connectionErrorSubject} enabled but UPSTASH_REDIS_REST_URL / UPSTASH_REDIS_REST_TOKEN are not both set`);
+		input.logger.info(`[${tag}] Using Upstash REST ${label} store`);
+		return upstash(upstashUrl, upstashToken);
+	}
+	const redisUrl = normalizeOptionalTrimmedString(config.REDIS_URL);
+	if (redisUrl) {
+		if (!input.isNode) {
+			input.logger.warn(`[${tag}] REDIS_URL is set but TCP Redis is not supported in this runtime; falling back to in-memory`);
+			return inMemory();
+		}
+		input.logger.info(`[${tag}] Using redis-tcp ${label} store`);
+		return redisTcp(redisUrl);
+	}
+	input.logger.info(`[${tag}] Using in-memory ${label} store (${spec.unconfiguredNote})`);
+	return inMemory();
+}
+/** Selects the backend the config's `kind` names: D1, a Durable Object, or else memory. */
+function createDurableObjectStore(input, spec, build) {
+	const { tag } = spec;
+	const config = isPlainObject(input.config) ? input.config : {};
+	const prefix = spec.resolvePrefix(config);
+	const kind = normalizeOptionalTrimmedString(config.kind);
+	if (kind === "d1") {
+		const database = resolveD1DatabaseFromConfig(config);
+		if (!database) throw new Error(`[${tag}] D1 store selected but no D1 database was provided`);
+		input.logger.info(`[${tag}] Using D1 store`);
+		return build.d1({
+			database,
+			...d1TenantScopeFromConfig(config, prefix, spec.d1StoreName)
+		});
+	}
+	if (kind === "cloudflare-do") {
+		const namespace = resolveDurableObjectNamespace(config);
+		if (!namespace) throw new Error(`cloudflare-do ${spec.name} store selected but no Durable Object namespace was provided`);
+		const objectName = durableObjectName(config);
+		input.logger.info(`[${tag}] Using Cloudflare Durable Object store`);
+		return build.durableObject(durableObjectStub(namespace, objectName), prefix);
+	}
+	if (kind) throw new Error(`[${tag}] Unknown ${spec.name} store kind: ${kind}`);
+	input.logger.info(`[${tag}] ${spec.inMemoryLog}`);
+	return build.inMemory(prefix);
+}
+//#endregion
+export { createDurableObjectStore, createKeyValueStore, durableObjectName, durableObjectStub, postDurableObjectRequest, requestDurableObjectJson, resolveDurableObjectNamespace };
+
+//# sourceMappingURL=storeBackends.js.map

package/dist/esm/core/thresholdEcdsaChainTarget.js

@@ -1,3 +1,4 @@
+import { thresholdEcdsaChainTargetKey } from "../shared-ts/src/utils/thresholdEcdsaChainTarget.js";
 //#region src/core/thresholdEcdsaChainTarget.ts
 function positiveSafeInteger(value) {
 	return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : null;
@@ -31,19 +32,10 @@ function thresholdEcdsaChainTargetFromValue(value) {
 	}
 	return null;
 }
-function thresholdEcdsaChainTargetKey(target) {
-	return target.kind === "evm" ? `evm:eip155:${target.chainId}` : `tempo:${target.chainId}`;
-}
 function thresholdEcdsaChainTargetsEqual(left, right) {
 	return thresholdEcdsaChainTargetKey(left) === thresholdEcdsaChainTargetKey(right);
 }
-function thresholdEcdsaChainTargetsShareEvmFamilyAddress(left, right) {
-	return isEvmFamilyAddressTarget(left) && isEvmFamilyAddressTarget(right);
-}
-function isEvmFamilyAddressTarget(target) {
-	return target.kind === "evm" || target.kind === "tempo";
-}
 //#endregion
-export { thresholdEcdsaChainTargetFromValue, thresholdEcdsaChainTargetKey, thresholdEcdsaChainTargetsEqual, thresholdEcdsaChainTargetsShareEvmFamilyAddress };
+export { thresholdEcdsaChainTargetFromValue, thresholdEcdsaChainTargetKey, thresholdEcdsaChainTargetsEqual };
 
 //# sourceMappingURL=thresholdEcdsaChainTarget.js.map

package/dist/esm/core/webAuthnD1Statements.js

@@ -0,0 +1,92 @@
+//#region src/core/webAuthnD1Statements.ts
+/** Binds the scope, then the user and the record's seven columns. */
+const INSERT_WEBAUTHN_AUTHENTICATOR_SQL = `INSERT INTO webauthn_authenticators (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        user_id,
+        credential_id_b64u,
+        credential_public_key_b64u,
+        counter,
+        created_at_ms,
+        updated_at_ms,
+        device_info_json
+      )
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`;
+/**
+* The insert, which on a credential collision keeps the lowest creation time and the highest
+* counter and update time. Binds as the insert does.
+*/
+const UPSERT_WEBAUTHN_AUTHENTICATOR_SQL = `${INSERT_WEBAUTHN_AUTHENTICATOR_SQL}
+      ON CONFLICT (namespace, org_id, project_id, env_id, user_id, credential_id_b64u)
+      DO UPDATE SET
+        credential_public_key_b64u = EXCLUDED.credential_public_key_b64u,
+        counter = MAX(webauthn_authenticators.counter, EXCLUDED.counter),
+        created_at_ms = MIN(webauthn_authenticators.created_at_ms, EXCLUDED.created_at_ms),
+        updated_at_ms = MAX(webauthn_authenticators.updated_at_ms, EXCLUDED.updated_at_ms),
+        device_info_json = EXCLUDED.device_info_json`;
+/** Statements on `webauthn_authenticators`. */
+const webAuthnAuthenticatorRows = { select: (prepare, userId, credentialIdB64u) => prepare(`SELECT credential_id_b64u, credential_public_key_b64u, counter, created_at_ms, updated_at_ms, device_info_json
+         FROM webauthn_authenticators
+        WHERE namespace = ?
+          AND org_id = ?
+          AND project_id = ?
+          AND env_id = ?
+          AND user_id = ?
+          AND credential_id_b64u = ?
+        LIMIT 1`, [userId, credentialIdB64u]) };
+/** Statements on `webauthn_credential_bindings`. */
+const webAuthnCredentialBindingRows = { select: (prepare, rpId, credentialIdB64u) => prepare(`SELECT record_json
+         FROM webauthn_credential_bindings
+        WHERE namespace = ?
+          AND org_id = ?
+          AND project_id = ?
+          AND env_id = ?
+          AND rp_id = ?
+          AND credential_id_b64u = ?
+        LIMIT 1`, [rpId, credentialIdB64u]) };
+/** Statements on `webauthn_challenges`. */
+const webAuthnChallengeRows = {
+	upsert: (prepare, input) => prepare(`INSERT INTO webauthn_challenges (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        challenge_id,
+        challenge_kind,
+        record_json,
+        created_at_ms,
+        expires_at_ms
+      )
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT (namespace, org_id, project_id, env_id, challenge_id)
+      DO UPDATE SET
+        challenge_kind = EXCLUDED.challenge_kind,
+        record_json = EXCLUDED.record_json,
+        created_at_ms = EXCLUDED.created_at_ms,
+        expires_at_ms = EXCLUDED.expires_at_ms`, [
+		input.challengeId,
+		input.challengeKind,
+		JSON.stringify(input.record),
+		input.createdAtMs,
+		input.expiresAtMs
+	]),
+	consume: (prepare, challengeId, challengeKind, nowMs) => prepare(`DELETE FROM webauthn_challenges
+        WHERE namespace = ?
+          AND org_id = ?
+          AND project_id = ?
+          AND env_id = ?
+          AND challenge_id = ?
+          AND challenge_kind = ?
+          AND expires_at_ms > ?
+        RETURNING record_json`, [
+		challengeId,
+		challengeKind,
+		nowMs
+	])
+};
+//#endregion
+export { INSERT_WEBAUTHN_AUTHENTICATOR_SQL, UPSERT_WEBAUTHN_AUTHENTICATOR_SQL, webAuthnAuthenticatorRows, webAuthnChallengeRows, webAuthnCredentialBindingRows };
+
+//# sourceMappingURL=webAuthnD1Statements.js.map

package/dist/esm/core/webAuthnStoreBackends.js

@@ -0,0 +1,198 @@
+import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
+import "../shared-ts/src/utils/validation.js";
+import { parseD1JsonColumn } from "../storage/d1Sql.js";
+import { D1TenantTable, ensureD1Schema, resolveStorePrefix } from "./d1TenantStore.js";
+import { createKeyValueStore } from "./storeBackends.js";
+import { webAuthnChallengeRows } from "./webAuthnD1Statements.js";
+//#region src/core/webAuthnStoreBackends.ts
+/**
+* A store's key prefix, which is also its D1 namespace: `config[spec.prefixConfigKey]` when set,
+* else `<THRESHOLD_PREFIX>:webauthn:<spec.prefixName>:`. It always ends with a colon.
+*/
+function resolveWebAuthnStorePrefix(config, spec) {
+	return resolveStorePrefix(config, [spec.prefixConfigKey], `webauthn:${spec.prefixName}:`);
+}
+/**
+* Selects a WebAuthn store's backend: the config's explicit `kind`, else Upstash or Redis from
+* env-shaped config, else in memory. The store type `S` comes from the caller's return type.
+*/
+function createWebAuthnStore(input, spec, build) {
+	return createKeyValueStore(input, {
+		tag: "webauthn",
+		label: spec.label,
+		connectionErrorSubject: spec.connectionErrorSubject,
+		durableObjectLog: `store for ${spec.durableObjectLogSubject}`,
+		durableObjectErrorName: "WebAuthn",
+		unconfiguredNote: spec.unconfiguredNote,
+		d1StoreName: webAuthnD1Store(spec.d1ScopeLabel),
+		resolvePrefix: (config) => resolveWebAuthnStorePrefix(config, spec),
+		parse: spec.parse
+	}, {
+		d1: build.d1,
+		keyValue: build.keyValue,
+		inMemory: (prefix) => build.inMemory(new InMemoryWebAuthnRecords(), prefix)
+	});
+}
+/** Keeps each record as it was put, without expiry; reads return the stored object. */
+var InMemoryWebAuthnRecords = class {
+	constructor() {
+		this.map = /* @__PURE__ */ new Map();
+	}
+	async get(key) {
+		return this.map.get(key) ?? null;
+	}
+	async take(key) {
+		const record = this.map.get(key) ?? null;
+		this.map.delete(key);
+		return record;
+	}
+	async set(key, record) {
+		this.map.set(key, record);
+	}
+	async del(key) {
+		this.map.delete(key);
+	}
+};
+/**
+* Per-credential records under `${prefix}${ownerId}:${credentialIdB64u}`, where the owner is the
+* user for authenticators and the RP ID for credential bindings. A blank id reads as missing.
+*/
+var WebAuthnCredentialRecords = class {
+	constructor(records, prefix) {
+		this.records = records;
+		this.prefix = prefix;
+	}
+	async get(ownerId, credentialIdB64u) {
+		const key = this.trimmedKey(ownerId, credentialIdB64u);
+		return key ? this.records.get(key) : null;
+	}
+	async set(ownerId, credentialIdB64u, record) {
+		await this.records.set(this.key(ownerId, credentialIdB64u), record);
+	}
+	async del(ownerId, credentialIdB64u) {
+		const key = this.trimmedKey(ownerId, credentialIdB64u);
+		if (key) await this.records.del(key);
+	}
+	key(ownerId, credentialIdB64u) {
+		return `${this.prefix}${ownerId}:${credentialIdB64u}`;
+	}
+	trimmedKey(ownerId, credentialIdB64u) {
+		const owner = normalizeOptionalTrimmedString(ownerId);
+		const credential = normalizeOptionalTrimmedString(credentialIdB64u);
+		return owner && credential ? this.key(owner, credential) : null;
+	}
+};
+/** Names a WebAuthn store in D1 scope errors, e.g. `WebAuthn credential store`. */
+function webAuthnD1Store(d1ScopeLabel) {
+	return `WebAuthn ${d1ScopeLabel} store`;
+}
+const WEBAUTHN_CHALLENGE_STORE_D1_SCHEMA_SQL = Object.freeze([`
+    CREATE TABLE IF NOT EXISTS webauthn_challenges (
+      namespace TEXT NOT NULL,
+      org_id TEXT NOT NULL,
+      project_id TEXT NOT NULL,
+      env_id TEXT NOT NULL,
+      challenge_id TEXT NOT NULL,
+      challenge_kind TEXT NOT NULL,
+      record_json TEXT NOT NULL,
+      created_at_ms INTEGER NOT NULL,
+      expires_at_ms INTEGER NOT NULL,
+      PRIMARY KEY (namespace, org_id, project_id, env_id, challenge_id),
+      CHECK (length(challenge_id) > 0),
+      CHECK (challenge_kind IN ('login', 'sync', 'recovery_registration')),
+      CHECK (json_valid(record_json)),
+      CHECK (created_at_ms > 0),
+      CHECK (expires_at_ms > created_at_ms)
+    )
+  `, `
+    CREATE INDEX IF NOT EXISTS webauthn_challenges_expiry_idx
+      ON webauthn_challenges (
+        namespace,
+        org_id,
+        project_id,
+        env_id,
+        challenge_kind,
+        expires_at_ms
+      )
+  `]);
+async function ensureWebAuthnChallengeStoreD1Schema(options) {
+	await ensureD1Schema(options.database, WEBAUTHN_CHALLENGE_STORE_D1_SCHEMA_SQL);
+}
+function createWebAuthnChallengeStore(input, spec, d1) {
+	const keyValue = (records, prefix) => new KeyValueWebAuthnChallengeStore(records, prefix, spec);
+	return createWebAuthnStore(input, spec, {
+		d1,
+		keyValue,
+		inMemory: keyValue
+	});
+}
+var KeyValueWebAuthnChallengeStore = class {
+	constructor(records, prefix, spec) {
+		this.records = records;
+		this.prefix = prefix;
+		this.spec = spec;
+	}
+	async put(record) {
+		const parsed = this.spec.parse(record);
+		if (!parsed) throw new Error(`Invalid ${this.spec.label} record`);
+		const ttlMs = Math.max(1, parsed.expiresAtMs - Date.now());
+		await this.records.set(`${this.prefix}${parsed.challengeId}`, parsed, ttlMs);
+	}
+	async consume(challengeId) {
+		const id = normalizeOptionalTrimmedString(challengeId);
+		if (!id) return null;
+		const record = await this.records.take(`${this.prefix}${id}`);
+		if (!record) return null;
+		if (Date.now() > record.expiresAtMs) return null;
+		return record;
+	}
+	async del(challengeId) {
+		const id = normalizeOptionalTrimmedString(challengeId);
+		if (!id) return;
+		await this.records.del(`${this.prefix}${id}`);
+	}
+};
+var D1WebAuthnChallengeStore = class {
+	constructor(input, spec) {
+		this.spec = spec;
+		this.adapterKind = "d1";
+		this.prepare = (sql, values) => this.table.prepare(sql, values);
+		this.table = new D1TenantTable(input, webAuthnD1Store(spec.d1ScopeLabel), WEBAUTHN_CHALLENGE_STORE_D1_SCHEMA_SQL);
+		this.now = input.now || (() => /* @__PURE__ */ new Date());
+	}
+	async put(record) {
+		await this.table.ensureSchema();
+		const parsed = this.spec.parse(record);
+		if (!parsed) throw new Error(`Invalid ${this.spec.label} record`);
+		await webAuthnChallengeRows.upsert(this.prepare, {
+			challengeId: parsed.challengeId,
+			challengeKind: this.spec.challengeKind,
+			record: parsed,
+			createdAtMs: parsed.createdAtMs,
+			expiresAtMs: parsed.expiresAtMs
+		}).run();
+	}
+	async consume(challengeId) {
+		await this.table.ensureSchema();
+		const id = normalizeOptionalTrimmedString(challengeId);
+		if (!id) return null;
+		const row = await webAuthnChallengeRows.consume(this.prepare, id, this.spec.challengeKind, this.now().getTime()).first();
+		return this.spec.parse(parseD1JsonColumn(row?.record_json));
+	}
+	async del(challengeId) {
+		await this.table.ensureSchema();
+		const id = normalizeOptionalTrimmedString(challengeId);
+		if (!id) return;
+		await this.table.prepare(`DELETE FROM webauthn_challenges
+          WHERE namespace = ?
+            AND org_id = ?
+            AND project_id = ?
+            AND env_id = ?
+            AND challenge_id = ?
+            AND challenge_kind = ?`, [id, this.spec.challengeKind]).run();
+	}
+};
+//#endregion
+export { D1WebAuthnChallengeStore, InMemoryWebAuthnRecords, WEBAUTHN_CHALLENGE_STORE_D1_SCHEMA_SQL, WebAuthnCredentialRecords, createWebAuthnChallengeStore, createWebAuthnStore, ensureWebAuthnChallengeStoreD1Schema, resolveWebAuthnStorePrefix, webAuthnD1Store };
+
+//# sourceMappingURL=webAuthnStoreBackends.js.map