@seams/wallet-server 0.6.2 → 0.7.3

package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnAuthService.js

@@ -3,10 +3,12 @@ import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimit
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
+import { failedVerification, failure } from "../../../../shared-ts/src/utils/failure.js";
 import { decodeWebAuthnBase64UrlOrBase64, parseWebAuthnAuthenticationCredential, parseWebAuthnClientDataJsonBase64url, webAuthnCredentialIdB64uFromCredential, webAuthnOriginHostnameOrEmpty } from "../../../auth/webAuthnCredentialCodecs.js";
 import { nonNegativeSafeInteger, optionalNonNegativeInteger, parseD1BoundaryWalletId, parseD1BoundaryWalletIdResult, parseJsonObject } from "../auth/d1RouterApiAuthBoundary.js";
 import { parseWebAuthnAuthenticatorRowDeviceInfo, webAuthnSyncWalletBindingFromCredentialBinding } from "./d1WebAuthnRecords.js";
 import { d1HostIsWithinWebAuthnRpId } from "../wallet/d1WalletAuthMethodBoundary.js";
+import { webAuthnAuthenticationFailure, webAuthnLoginEd25519, webAuthnSyncCredentialBinding } from "../../../../core/authService/webauthnVerificationOutcomes.js";
 //#region src/router/cloudflare/d1/webauthn/d1WebAuthnAuthService.ts
 function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error || "");
@@ -20,11 +22,7 @@ var CloudflareD1WebAuthnAuthService = class {
 	async listWebAuthnAuthenticatorsForUser(input) {
 		try {
 			const userId = parseD1BoundaryWalletIdResult(input.userId);
-			if (!userId.ok) return {
-				ok: false,
-				code: "invalid_args",
-				message: userId.code === "missing" ? "Missing userId" : "Invalid userId"
-			};
+			if (!userId.ok) return failure("invalid_args", userId.code === "missing" ? "Missing userId" : "Invalid userId");
 			const rpId = normalizeOptionalTrimmedString(input.rpId);
 			const authRows = await this.webAuthnStore.readAuthenticatorRows(userId.value);
 			const bindings = await this.webAuthnStore.readBindingRows({
@@ -54,27 +52,15 @@ var CloudflareD1WebAuthnAuthService = class {
 				authenticators
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: errorMessage(error) || "Failed to list authenticators"
-			};
+			return failure("internal", errorMessage(error) || "Failed to list authenticators");
 		}
 	}
 	async createWebAuthnLoginOptions(input) {
 		try {
 			const userId = parseD1BoundaryWalletIdResult(input.userId ?? input.user_id);
 			const rpId = normalizeOptionalTrimmedString(input.rpId ?? input.rp_id);
-			if (!userId.ok) return {
-				ok: false,
-				code: "invalid_body",
-				message: userId.code === "missing" ? "Missing userId" : "Invalid userId"
-			};
-			if (!rpId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Missing rpId"
-			};
+			if (!userId.ok) return failure("invalid_body", userId.code === "missing" ? "Missing userId" : "Invalid userId");
+			if (!rpId) return failure("invalid_body", "Missing rpId");
 			const createdAtMs = Date.now();
 			const expiresAtMs = createdAtMs + webAuthnLoginChallengeTtlMs(input.ttlMs ?? input.ttl_ms);
 			const challengeId = secureRandomBase64Url(16, "WebAuthn login challenge id");
@@ -95,11 +81,7 @@ var CloudflareD1WebAuthnAuthService = class {
 				seenCredentialIds.add(credentialId);
 				credentialIds.push(credentialId);
 			}
-			if (credentialIds.length === 0) return {
-				ok: false,
-				code: "unknown_credential",
-				message: "Wallet has no registered passkey credential"
-			};
+			if (credentialIds.length === 0) return failure("unknown_credential", "Wallet has no registered passkey credential");
 			const record = {
 				version: "webauthn_login_challenge_v1",
 				challengeId,
@@ -124,28 +106,16 @@ var CloudflareD1WebAuthnAuthService = class {
 				expiresAtMs
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: errorMessage(error) || "Failed to create login options"
-			};
+			return failure("internal", errorMessage(error) || "Failed to create login options");
 		}
 	}
 	async createWebAuthnSyncAccountOptions(input) {
 		try {
 			const rpId = normalizeOptionalTrimmedString(input.rp_id);
-			if (!rpId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Missing rp_id"
-			};
+			if (!rpId) return failure("invalid_body", "Missing rp_id");
 			const expectedUserIdRaw = normalizeOptionalTrimmedString(input.account_id);
 			const expectedUserId = expectedUserIdRaw ? parseD1BoundaryWalletId(expectedUserIdRaw) : null;
-			if (expectedUserIdRaw && !expectedUserId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Invalid wallet account_id"
-			};
+			if (expectedUserIdRaw && !expectedUserId) return failure("invalid_body", "Invalid wallet account_id");
 			const createdAtMs = Date.now();
 			const expiresAtMs = createdAtMs + webAuthnLoginChallengeTtlMs(input.ttlMs ?? input.ttl_ms);
 			const challengeId = secureRandomBase64Url(16, "WebAuthn sync challenge id");
@@ -171,11 +141,7 @@ var CloudflareD1WebAuthnAuthService = class {
 					}
 					if (credentialId && activeCredentialIds.has(credentialId) && !walletBinding) walletBinding = webAuthnSyncWalletBindingFromCredentialBinding(binding) || void 0;
 				}
-				if (credentialIds.length === 0) return {
-					ok: false,
-					code: "unknown_credential",
-					message: "Wallet has no registered active passkey credential"
-				};
+				if (credentialIds.length === 0) return failure("unknown_credential", "Wallet has no registered active passkey credential");
 			}
 			const record = {
 				version: "webauthn_sync_challenge_v1",
@@ -202,11 +168,7 @@ var CloudflareD1WebAuthnAuthService = class {
 				expiresAtMs
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: errorMessage(error) || "Failed to create sync account options"
-			};
+			return failure("internal", errorMessage(error) || "Failed to create sync account options");
 		}
 	}
 	async verifyWebAuthnAuthenticationLite(input) {
@@ -348,91 +310,36 @@ var CloudflareD1WebAuthnAuthService = class {
 	async verifyWebAuthnLogin(input) {
 		try {
 			const challengeId = normalizeOptionalTrimmedString(input.challengeId ?? input.challenge_id);
-			if (!challengeId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Missing challengeId"
-			};
+			if (!challengeId) return failure("invalid_body", "Missing challengeId");
 			const challenge = await this.webAuthnStore.consumeLoginChallenge(challengeId);
-			if (!challenge) return {
-				ok: false,
-				verified: false,
-				code: "challenge_expired_or_invalid",
-				message: "Login challenge expired or invalid"
-			};
+			if (!challenge) return failedVerification("challenge_expired_or_invalid", "Login challenge expired or invalid");
 			const expectedOrigin = normalizeOptionalTrimmedString(input.expected_origin);
-			if (!expectedOrigin) return {
-				ok: false,
-				verified: false,
-				code: "invalid_body",
-				message: "expected_origin is required for WebAuthn authentication verification"
-			};
+			if (!expectedOrigin) return failedVerification("invalid_body", "expected_origin is required for WebAuthn authentication verification");
 			const rpId = parseWebAuthnRpId(challenge.rpId);
-			if (!rpId.ok) return {
-				ok: false,
-				verified: false,
-				code: "internal",
-				message: `Stored login challenge rpId is invalid: ${rpId.error.message}`
-			};
+			if (!rpId.ok) return failedVerification("internal", `Stored login challenge rpId is invalid: ${rpId.error.message}`);
 			const credential = parseWebAuthnAuthenticationCredential(input.webauthn_authentication);
-			if (!credential) return {
-				ok: false,
-				verified: false,
-				code: "invalid_body",
-				message: "Missing webauthn_authentication"
-			};
+			if (!credential) return failedVerification("invalid_body", "Missing webauthn_authentication");
 			const credentialId = webAuthnCredentialIdB64uFromCredential(credential);
-			if (!credentialId.ok) return {
-				ok: false,
-				verified: false,
-				code: credentialId.code,
-				message: credentialId.message
-			};
+			if (!credentialId.ok) return failedVerification(credentialId.code, credentialId.message);
 			const activeMethod = await this.walletAuthMethodStore.getPasskeyV2({
 				rpId: challenge.rpId,
 				credentialIdB64u: credentialId.credentialIdB64u
 			});
-			if (!activeMethod || activeMethod.kind !== "passkey" || activeMethod.status !== "active" || String(activeMethod.walletId) !== String(challenge.userId) || String(activeMethod.rpId) !== String(challenge.rpId) || String(activeMethod.credentialIdB64u) !== String(credentialId.credentialIdB64u)) return {
-				ok: false,
-				verified: false,
-				code: "unknown_credential",
-				message: "Credential is not active for this wallet"
-			};
-			const verification = await this.verifyWebAuthnAuthenticationLite({
+			if (!activeMethod || activeMethod.kind !== "passkey" || activeMethod.status !== "active" || String(activeMethod.walletId) !== String(challenge.userId) || String(activeMethod.rpId) !== String(challenge.rpId) || String(activeMethod.credentialIdB64u) !== String(credentialId.credentialIdB64u)) return failedVerification("unknown_credential", "Credential is not active for this wallet");
+			const verificationFailure = webAuthnAuthenticationFailure(await this.verifyWebAuthnAuthenticationLite({
 				userId: challenge.userId,
 				rpId: rpId.value,
 				expectedChallenge: challenge.challengeB64u,
 				webauthn_authentication: credential,
 				expected_origin: expectedOrigin
-			});
-			if (!verification.success || !verification.verified) return {
-				ok: false,
-				verified: false,
-				code: verification.code || "not_verified",
-				message: verification.message || "Authentication verification failed"
-			};
+			}));
+			if (verificationFailure) return verificationFailure;
 			const binding = await this.webAuthnStore.readBindingByCredential({
 				rpId: challenge.rpId,
 				credentialIdB64u: credentialId.credentialIdB64u
 			});
-			const walletBinding = binding ? webAuthnSyncWalletBindingFromCredentialBinding(binding) : null;
-			const firstParticipantId = binding?.participantIds?.[0];
-			const secondParticipantId = binding?.participantIds?.[1];
-			if (!binding) return {
-				ok: false,
-				verified: false,
-				code: "unknown_credential",
-				message: "Credential has no wallet binding"
-			};
-			const ed25519 = walletBinding && binding.publicKey && binding.relayerKeyId && firstParticipantId !== void 0 && secondParticipantId !== void 0 ? {
-				kind: "active",
-				nearAccountId: walletBinding.nearAccountId,
-				nearEd25519SigningKeyId: walletBinding.nearEd25519SigningKeyId,
-				signerSlot: walletBinding.signerSlot,
-				publicKey: binding.publicKey,
-				relayerKeyId: binding.relayerKeyId,
-				participantIds: [firstParticipantId, secondParticipantId]
-			} : { kind: "absent" };
+			const loginSigner = webAuthnLoginEd25519(binding, binding ? webAuthnSyncWalletBindingFromCredentialBinding(binding) : null);
+			if (!loginSigner.ok) return loginSigner;
 			return {
 				ok: true,
 				verified: true,
@@ -441,133 +348,59 @@ var CloudflareD1WebAuthnAuthService = class {
 				credentialIdB64u: credentialId.credentialIdB64u,
 				walletAuthMethodId: activeMethod.walletAuthMethodId,
 				walletAuthorityId: activeMethod.walletAuthorityId,
-				ed25519
+				ed25519: loginSigner.ed25519
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				verified: false,
-				code: "internal",
-				message: errorMessage(error) || "Login verification failed"
-			};
+			return failedVerification("internal", errorMessage(error) || "Login verification failed");
 		}
 	}
 	async verifyWebAuthnSyncAccount(input) {
 		try {
 			const challengeId = normalizeOptionalTrimmedString(input.challengeId ?? input.challenge_id);
-			if (!challengeId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Missing challengeId"
-			};
+			if (!challengeId) return failure("invalid_body", "Missing challengeId");
 			const challenge = await this.webAuthnStore.consumeSyncChallenge(challengeId);
-			if (!challenge) return {
-				ok: false,
-				verified: false,
-				code: "challenge_expired_or_invalid",
-				message: "Sync challenge expired or invalid"
-			};
+			if (!challenge) return failedVerification("challenge_expired_or_invalid", "Sync challenge expired or invalid");
 			const credential = parseWebAuthnAuthenticationCredential(input.webauthn_authentication);
-			if (!credential) return {
-				ok: false,
-				verified: false,
-				code: "invalid_body",
-				message: "Missing webauthn_authentication"
-			};
+			if (!credential) return failedVerification("invalid_body", "Missing webauthn_authentication");
 			const credentialId = webAuthnCredentialIdB64uFromCredential(credential);
-			if (!credentialId.ok) return {
-				ok: false,
-				verified: false,
-				code: credentialId.code,
-				message: credentialId.message
-			};
-			const binding = await this.webAuthnStore.readBindingByCredential({
+			if (!credentialId.ok) return failedVerification(credentialId.code, credentialId.message);
+			const syncBinding = webAuthnSyncCredentialBinding(await this.webAuthnStore.readBindingByCredential({
 				rpId: challenge.rpId,
 				credentialIdB64u: credentialId.credentialIdB64u
-			});
-			if (!binding) return {
-				ok: false,
-				verified: false,
-				code: "unknown_credential",
-				message: "Credential is not registered on this relay"
-			};
-			if (challenge.expectedUserId && binding.userId !== challenge.expectedUserId) return {
-				ok: false,
-				verified: false,
-				code: "unknown_credential",
-				message: `Credential is not registered for account ${challenge.expectedUserId}`
-			};
+			}), challenge);
+			if (!syncBinding.ok) return syncBinding;
+			const binding = syncBinding.binding;
 			const activeMethod = await this.walletAuthMethodStore.getPasskeyV2({
 				rpId: challenge.rpId,
 				credentialIdB64u: credentialId.credentialIdB64u
 			});
-			if (!activeMethod || activeMethod.kind !== "passkey" || activeMethod.status !== "active" || String(activeMethod.walletId) !== String(binding.userId) || String(activeMethod.rpId) !== String(challenge.rpId) || String(activeMethod.credentialIdB64u) !== String(credentialId.credentialIdB64u)) return {
-				ok: false,
-				verified: false,
-				code: "unknown_credential",
-				message: "Credential is not active for this wallet"
-			};
+			if (!activeMethod || activeMethod.kind !== "passkey" || activeMethod.status !== "active" || String(activeMethod.walletId) !== String(binding.userId) || String(activeMethod.rpId) !== String(challenge.rpId) || String(activeMethod.credentialIdB64u) !== String(credentialId.credentialIdB64u)) return failedVerification("unknown_credential", "Credential is not active for this wallet");
 			const expectedOrigin = normalizeOptionalTrimmedString(input.expected_origin);
-			if (!expectedOrigin) return {
-				ok: false,
-				verified: false,
-				code: "invalid_body",
-				message: "expected_origin is required for WebAuthn authentication verification"
-			};
+			if (!expectedOrigin) return failedVerification("invalid_body", "expected_origin is required for WebAuthn authentication verification");
 			const rpId = parseWebAuthnRpId(binding.rpId);
-			if (!rpId.ok) return {
-				ok: false,
-				verified: false,
-				code: "internal",
-				message: `Stored sync credential binding rpId is invalid: ${rpId.error.message}`
-			};
-			const verification = await this.verifyWebAuthnAuthenticationLite({
+			if (!rpId.ok) return failedVerification("internal", `Stored sync credential binding rpId is invalid: ${rpId.error.message}`);
+			const verificationFailure = webAuthnAuthenticationFailure(await this.verifyWebAuthnAuthenticationLite({
 				userId: binding.userId,
 				rpId: rpId.value,
 				expectedChallenge: challenge.challengeB64u,
 				webauthn_authentication: credential,
 				expected_origin: expectedOrigin
-			});
-			if (!verification.success || !verification.verified) return {
-				ok: false,
-				verified: false,
-				code: verification.code || "not_verified",
-				message: verification.message || "Authentication verification failed"
-			};
+			}));
+			if (verificationFailure) return verificationFailure;
 			const authenticator = await this.webAuthnStore.readAuthenticator({
 				userId: binding.userId,
 				credentialIdB64u: credentialId.credentialIdB64u
 			});
-			if (!authenticator) return {
-				ok: false,
-				verified: false,
-				code: "unknown_credential",
-				message: "Credential is not registered for user"
-			};
+			if (!authenticator) return failedVerification("unknown_credential", "Credential is not registered for user");
 			const walletBinding = webAuthnSyncWalletBindingFromCredentialBinding(binding);
-			if (!walletBinding) return {
-				ok: false,
-				verified: false,
-				code: "internal",
-				message: "Credential binding is missing wallet identity fields"
-			};
+			if (!walletBinding) return failedVerification("internal", "Credential binding is missing wallet identity fields");
 			const walletId = parseD1BoundaryWalletId(walletBinding.walletId);
-			if (!walletId) return {
-				ok: false,
-				verified: false,
-				code: "internal",
-				message: "Credential binding contains an invalid wallet ID"
-			};
+			if (!walletId) return failedVerification("internal", "Credential binding contains an invalid wallet ID");
 			const ed25519Manifest = await this.walletManifestSource.getEd25519KeyManifestBySlot({
 				walletId,
 				signerSlot: walletBinding.signerSlot
 			});
-			if (!ed25519Manifest) return {
-				ok: false,
-				verified: false,
-				code: "ed25519_not_provisioned",
-				message: "Wallet has no Ed25519 signer yet; NEAR provisioning has not completed"
-			};
+			if (!ed25519Manifest) return failedVerification("ed25519_not_provisioned", "Wallet has no Ed25519 signer yet; NEAR provisioning has not completed");
 			const thresholdEd25519 = binding.relayerKeyId && binding.publicKey ? {
 				relayerKeyId: binding.relayerKeyId,
 				authorityScope: {
@@ -601,12 +434,7 @@ var CloudflareD1WebAuthnAuthService = class {
 				...thresholdEd25519 ? { thresholdEd25519 } : {}
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				verified: false,
-				code: "internal",
-				message: errorMessage(error) || "Sync verification failed"
-			};
+			return failedVerification("internal", errorMessage(error) || "Sync verification failed");
 		}
 	}
 };

package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnRecords.js

@@ -1,12 +1,13 @@
 import { parsePasskeyEnvelopeId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletRecoveryOperationId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
-import { parseEnvelopeRevision } from "../../../../shared-ts/src/passkey-custody/primitives.js";
-import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
-import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/registrationIntent.js";
-import { parseWebAuthnAuthenticatorDeviceInfoJson } from "../../../../shared-ts/src/utils/webauthnDeviceInfo.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
+import { parseEnvelopeRevision } from "../../../../shared-ts/src/passkey-custody/primitives.js";
 import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
+import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
+import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
+import { parseWebAuthnAuthenticatorDeviceInfoJson } from "../../../../shared-ts/src/utils/webauthnDeviceInfo.js";
+import { hasExactKeys } from "../../../../shared-ts/src/utils/exactKeys.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
 import { parseRecoveryCodeReservationId } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
 import { nonNegativeSafeInteger, optionalNonNegativeInteger, positiveInteger } from "../auth/d1RouterApiAuthBoundary.js";
@@ -25,7 +26,7 @@ function parseWebAuthnLoginChallengeRecord(input) {
 	}
 	if (prototype !== Object.prototype && prototype !== null) return null;
 	const record = candidate;
-	if (!hasExactFields(record, [
+	if (!hasExactKeys(record, [
 		"version",
 		"challengeId",
 		"userId",
@@ -65,7 +66,7 @@ function parseWebAuthnSyncChallengeRecord(input) {
 	}
 	if (prototype !== Object.prototype && prototype !== null) return null;
 	const record = candidate;
-	if (!hasExactFields(record, Object.hasOwn(record, "expectedUserId") ? [
+	if (!hasExactKeys(record, Object.hasOwn(record, "expectedUserId") ? [
 		"version",
 		"challengeId",
 		"rpId",
@@ -263,7 +264,7 @@ function parseWebAuthnRecoveryContinuityEnvelopeAnchor(input) {
 	const updatedAtMs = positiveInteger(record.updatedAtMs);
 	if (!kind || !envelopeId.ok || !walletId.ok || !envelopeRevision || updatedAtMs === null || record.bindingKind !== "wallet_custody_seed_v1") return null;
 	if (kind === "passkey") {
-		if (!hasExactFields(record, [
+		if (!hasExactKeys(record, [
 			"kind",
 			"envelopeId",
 			"walletId",
@@ -288,7 +289,7 @@ function parseWebAuthnRecoveryContinuityEnvelopeAnchor(input) {
 		};
 	}
 	if (kind === "email_otp") {
-		if (!hasExactFields(record, [
+		if (!hasExactKeys(record, [
 			"kind",
 			"envelopeId",
 			"walletId",
@@ -321,10 +322,6 @@ function parseRecoveryEnvelopeRevision(input) {
 		return null;
 	}
 }
-function hasExactFields(record, expectedFields) {
-	const fields = Object.keys(record);
-	return fields.length === expectedFields.length && expectedFields.every((field) => fields.includes(field));
-}
 function parseWebAuthnAuthenticator(row) {
 	const credentialIdB64u = normalizeOptionalTrimmedString(row?.credential_id_b64u);
 	const credentialPublicKeyB64u = normalizeOptionalTrimmedString(row?.credential_public_key_b64u);
@@ -478,7 +475,7 @@ function parseWebAuthnRuntimePolicyScope(raw) {
 	}
 	if (prototype !== Object.prototype && prototype !== null) return void 0;
 	const record = raw;
-	if (!hasExactFields(record, [
+	if (!hasExactKeys(record, [
 		"orgId",
 		"projectId",
 		"envId",

package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnStore.js

@@ -1,83 +1,35 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
+import { prepareD1TenantStatement } from "../../../../core/d1TenantStore.js";
+import { INSERT_WEBAUTHN_AUTHENTICATOR_SQL, UPSERT_WEBAUTHN_AUTHENTICATOR_SQL, webAuthnAuthenticatorRows, webAuthnChallengeRows, webAuthnCredentialBindingRows } from "../../../../core/webAuthnD1Statements.js";
 import { prepareD1WebAuthnCredentialBindingInsertStatement } from "../../../../core/WebAuthnCredentialBindingStore.js";
 import { parseWebAuthnAuthenticator, parseWebAuthnBinding, parseWebAuthnLoginChallengeRecord, parseWebAuthnRecoveryRegistrationChallengeRecord, parseWebAuthnSyncChallengeRecord } from "./d1WebAuthnRecords.js";
 //#region src/router/cloudflare/d1/webauthn/d1WebAuthnStore.ts
+function prepareAuthenticatorStatement(sql, input) {
+	return input.database.prepare(sql).bind(input.scope.namespace, input.scope.orgId, input.scope.projectId, input.scope.envId, input.userId, input.record.credentialIdB64u, input.record.credentialPublicKeyB64u, input.record.counter, input.record.createdAtMs, input.record.updatedAtMs, JSON.stringify(input.record.deviceInfo));
+}
 function prepareD1WebAuthnAuthenticatorPutStatement(input) {
-	return input.database.prepare(`INSERT INTO webauthn_authenticators (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        user_id,
-        credential_id_b64u,
-        credential_public_key_b64u,
-        counter,
-        created_at_ms,
-        updated_at_ms,
-        device_info_json
-      )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT (namespace, org_id, project_id, env_id, user_id, credential_id_b64u)
-      DO UPDATE SET
-        credential_public_key_b64u = EXCLUDED.credential_public_key_b64u,
-        counter = MAX(webauthn_authenticators.counter, EXCLUDED.counter),
-        created_at_ms = MIN(webauthn_authenticators.created_at_ms, EXCLUDED.created_at_ms),
-        updated_at_ms = MAX(webauthn_authenticators.updated_at_ms, EXCLUDED.updated_at_ms),
-        device_info_json = EXCLUDED.device_info_json`).bind(input.scope.namespace, input.scope.orgId, input.scope.projectId, input.scope.envId, input.userId, input.record.credentialIdB64u, input.record.credentialPublicKeyB64u, input.record.counter, input.record.createdAtMs, input.record.updatedAtMs, JSON.stringify(input.record.deviceInfo));
+	return prepareAuthenticatorStatement(UPSERT_WEBAUTHN_AUTHENTICATOR_SQL, input);
 }
 /** Insert-only variant used by recovery promotion. A credential collision must
 * abort the surrounding envelope/code transaction instead of reassigning an
 * existing authenticator's public key. */
 function prepareD1WebAuthnAuthenticatorInsertStatement(input) {
-	return input.database.prepare(`INSERT INTO webauthn_authenticators (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        user_id,
-        credential_id_b64u,
-        credential_public_key_b64u,
-        counter,
-        created_at_ms,
-        updated_at_ms,
-        device_info_json
-      )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).bind(input.scope.namespace, input.scope.orgId, input.scope.projectId, input.scope.envId, input.userId, input.record.credentialIdB64u, input.record.credentialPublicKeyB64u, input.record.counter, input.record.createdAtMs, input.record.updatedAtMs, JSON.stringify(input.record.deviceInfo));
+	return prepareAuthenticatorStatement(INSERT_WEBAUTHN_AUTHENTICATOR_SQL, input);
 }
 var CloudflareD1WebAuthnStore = class {
 	constructor(input) {
+		this.prepare = (sql, values) => prepareD1TenantStatement(this.database, this.scope, sql, values);
 		this.database = input.database;
-		this.namespace = input.namespace;
-		this.orgId = input.orgId;
-		this.projectId = input.projectId;
-		this.envId = input.envId;
+		this.scope = {
+			namespace: input.namespace,
+			orgId: input.orgId,
+			projectId: input.projectId,
+			envId: input.envId
+		};
 	}
 	async writeChallenge(input) {
-		await this.prepare(`INSERT INTO webauthn_challenges (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        challenge_id,
-        challenge_kind,
-        record_json,
-        created_at_ms,
-        expires_at_ms
-      )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-      ON CONFLICT (namespace, org_id, project_id, env_id, challenge_id)
-      DO UPDATE SET
-        challenge_kind = EXCLUDED.challenge_kind,
-        record_json = EXCLUDED.record_json,
-        created_at_ms = EXCLUDED.created_at_ms,
-        expires_at_ms = EXCLUDED.expires_at_ms`, [
-			input.challengeId,
-			input.challengeKind,
-			JSON.stringify(input.record),
-			input.createdAtMs,
-			input.expiresAtMs
-		]).run();
+		await webAuthnChallengeRows.upsert(this.prepare, input).run();
 	}
 	async consumeLoginChallenge(challengeId) {
 		return parseWebAuthnLoginChallengeRecord((await this.consumeChallenge({
@@ -120,25 +72,12 @@ var CloudflareD1WebAuthnStore = class {
 		]);
 	}
 	async readAuthenticator(input) {
-		return parseWebAuthnAuthenticator(await this.prepare(`SELECT credential_id_b64u, credential_public_key_b64u, counter, created_at_ms, updated_at_ms, device_info_json
-         FROM webauthn_authenticators
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND user_id = ?
-          AND credential_id_b64u = ?
-        LIMIT 1`, [input.userId, input.credentialIdB64u]).first());
+		return parseWebAuthnAuthenticator(await webAuthnAuthenticatorRows.select(this.prepare, input.userId, input.credentialIdB64u).first());
 	}
 	async writeAuthenticator(input) {
 		await prepareD1WebAuthnAuthenticatorPutStatement({
 			database: this.database,
-			scope: {
-				namespace: this.namespace,
-				orgId: this.orgId,
-				projectId: this.projectId,
-				envId: this.envId
-			},
+			scope: this.scope,
 			userId: input.userId,
 			record: input.record
 		}).run();
@@ -146,12 +85,7 @@ var CloudflareD1WebAuthnStore = class {
 	prepareAuthenticatorInsertStatement(input) {
 		return prepareD1WebAuthnAuthenticatorInsertStatement({
 			database: this.database,
-			scope: {
-				namespace: this.namespace,
-				orgId: this.orgId,
-				projectId: this.projectId,
-				envId: this.envId
-			},
+			scope: this.scope,
 			userId: input.userId,
 			record: input.record
 		});
@@ -159,12 +93,7 @@ var CloudflareD1WebAuthnStore = class {
 	prepareCredentialBindingInsertStatement(record) {
 		return prepareD1WebAuthnCredentialBindingInsertStatement({
 			database: this.database,
-			scope: {
-				namespace: this.namespace,
-				orgId: this.orgId,
-				projectId: this.projectId,
-				envId: this.envId
-			},
+			scope: this.scope,
 			record
 		});
 	}
@@ -178,18 +107,10 @@ var CloudflareD1WebAuthnStore = class {
           AND env_id = ?
           AND user_id = ?
           AND credential_id_b64u = ?
-          AND counter < ?`).bind(input.newCounter, input.updatedAtMs, this.namespace, this.orgId, this.projectId, this.envId, input.userId, input.credentialIdB64u, input.newCounter).run();
+          AND counter < ?`).bind(input.newCounter, input.updatedAtMs, this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, input.userId, input.credentialIdB64u, input.newCounter).run();
 	}
 	async readBindingByCredential(input) {
-		return parseWebAuthnBinding(await this.prepare(`SELECT record_json
-         FROM webauthn_credential_bindings
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND rp_id = ?
-          AND credential_id_b64u = ?
-        LIMIT 1`, [input.rpId, input.credentialIdB64u]).first() || {});
+		return parseWebAuthnBinding(await webAuthnCredentialBindingRows.select(this.prepare, input.rpId, input.credentialIdB64u).first() || {});
 	}
 	/** Resolves a credential without trusting a caller-supplied relying party. */
 	async readBindingByCredentialId(credentialIdB64u) {
@@ -240,22 +161,7 @@ var CloudflareD1WebAuthnStore = class {
 		return bindings;
 	}
 	async consumeChallenge(input) {
-		return await this.prepare(`DELETE FROM webauthn_challenges
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND challenge_id = ?
-          AND challenge_kind = ?
-          AND expires_at_ms > ?
-        RETURNING record_json`, [
-			input.challengeId,
-			input.challengeKind,
-			Date.now()
-		]).first();
-	}
-	prepare(sql, values) {
-		return this.database.prepare(sql).bind(this.namespace, this.orgId, this.projectId, this.envId, ...values);
+		return await webAuthnChallengeRows.consume(this.prepare, input.challengeId, input.challengeKind, Date.now()).first();
 	}
 };
 //#endregion