@seams/wallet-server 0.7.1 → 0.7.3

package/dist/esm/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.js

@@ -1,5 +1,6 @@
-import { requireNonEmptyString } from "../../../../shared-ts/src/utils/validation.js";
-import { isD1DatabaseLike } from "../../../../storage/d1Sql.js";
+import { isPlainObject, requireNonEmptyString } from "../../../../shared-ts/src/utils/validation.js";
+import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
+import { isD1DatabaseLike, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
 import { abusePrincipalKey, runtimePolicyScopeKey } from "../../../domains/signingOperations/routerAbNormalSigningAdmissionCore.js";
 //#region src/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.ts
 const ROUTER_AB_NORMAL_SIGNING_ADMISSION_TABLE = "router_ab_normal_signing_admission_records";
@@ -11,8 +12,12 @@ var CloudflareD1RouterAbNormalSigningAdmissionStore = class {
 		this.now = options.now || Date.now;
 	}
 	async evaluatePolicy(input) {
+		if (input.curve === "ecdsa" && input.policyReadSource.kind === "credential_snapshot") {
+			const decision = input.policyReadSource.policyRead.resolve(this.database, this.storageNamespace, input);
+			if (decision) return decision;
+		}
 		const scope = input.runtimePolicyScope;
-		const row = await this.database.prepare(`WITH scope(namespace, org_id, project_id, env_id, signing_root_version,
+		return parsePolicyRow(await this.database.prepare(`WITH scope(namespace, org_id, project_id, env_id, signing_root_version,
                   project_key, abuse_key) AS (VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7))
        SELECT project.record_key AS project_key, project.decision AS project_decision,
               project.retry_after_ms AS project_retry_after_ms,
@@ -28,27 +33,7 @@ var CloudflareD1RouterAbNormalSigningAdmissionStore = class {
            ON abuse.namespace = scope.namespace AND abuse.org_id = scope.org_id
           AND abuse.project_id = scope.project_id AND abuse.env_id = scope.env_id
           AND abuse.signing_root_version = scope.signing_root_version
-          AND abuse.record_kind = 'abuse' AND abuse.record_key = scope.abuse_key`).bind(this.storageNamespace, scope.orgId, scope.projectId, scope.envId, scope.signingRootVersion, runtimePolicyScopeKey(scope), abusePrincipalKey(input)).first();
-		if (!row) throw new Error("Router A/B admission policy snapshot is missing");
-		if (row.project_key !== null) {
-			const project = parseProjectPolicyDecision({
-				decision: row.project_decision,
-				retry_after_ms: row.project_retry_after_ms
-			});
-			if (project.kind === "rejected") return {
-				kind: "project_policy_rejected",
-				retryAfterMs: project.retryAfterMs
-			};
-		}
-		if (row.abuse_key === null) return { kind: "allowed" };
-		const abuse = parseAbuseDecision({
-			decision: row.abuse_decision,
-			retry_after_ms: row.abuse_retry_after_ms
-		});
-		return abuse.kind === "rejected" ? {
-			kind: "abuse_rejected",
-			retryAfterMs: abuse.retryAfterMs
-		} : abuse;
+          AND abuse.record_kind = 'abuse' AND abuse.record_key = scope.abuse_key`).bind(this.storageNamespace, scope.orgId, scope.projectId, scope.envId, scope.signingRootVersion, runtimePolicyScopeKey(scope), abusePrincipalKey(input)).first());
 	}
 	async setProjectPolicy(scope, decision) {
 		const normalized = normalizeProjectPolicyDecision(decision);
@@ -158,7 +143,116 @@ function requirePositiveInteger(label, value) {
 function assertNever(value) {
 	throw new Error(`Unexpected Router A/B normal-signing admission branch: ${String(value)}`);
 }
+function parsePolicyRow(row) {
+	if (!row) throw new Error("Router A/B admission policy snapshot is missing");
+	if (row.project_key !== null) {
+		const project = parseProjectPolicyDecision({
+			decision: row.project_decision,
+			retry_after_ms: row.project_retry_after_ms
+		});
+		if (project.kind === "rejected") return {
+			kind: "project_policy_rejected",
+			retryAfterMs: project.retryAfterMs
+		};
+	}
+	if (row.abuse_key === null) return { kind: "allowed" };
+	const abuse = parseAbuseDecision({
+		decision: row.abuse_decision,
+		retry_after_ms: row.abuse_retry_after_ms
+	});
+	return abuse.kind === "rejected" ? {
+		kind: "abuse_rejected",
+		retryAfterMs: abuse.retryAfterMs
+	} : abuse;
+}
+var D1EcdsaAdmissionPolicyRead = class D1EcdsaAdmissionPolicyRead {
+	#decisions;
+	constructor(database, namespace, walletId, activationId, decisions) {
+		this.database = database;
+		this.namespace = namespace;
+		this.walletId = walletId;
+		this.activationId = activationId;
+		this.#decisions = decisions;
+	}
+	static fromRows(database, namespace, walletId, activationId, rows) {
+		if (!Array.isArray(rows)) throw new Error("ECDSA policy candidates are invalid");
+		const decisions = /* @__PURE__ */ new Map();
+		for (const row of rows) {
+			if (!isPlainObject(row)) throw new Error("ECDSA policy candidate is invalid");
+			const key = runtimePolicyScopeKey(normalizeRuntimePolicyScope(parseD1JsonColumn(row.scope_json)));
+			if (decisions.has(key)) throw new Error("ECDSA policy scope is ambiguous");
+			try {
+				const decision = parsePolicyRow({
+					project_key: row.project_key,
+					project_decision: row.project_decision,
+					project_retry_after_ms: row.project_retry_after_ms,
+					abuse_key: row.abuse_key,
+					abuse_decision: row.abuse_decision,
+					abuse_retry_after_ms: row.abuse_retry_after_ms
+				});
+				decisions.set(key, {
+					ok: true,
+					decision
+				});
+			} catch (error) {
+				decisions.set(key, {
+					ok: false,
+					message: error instanceof Error ? error.message : "ECDSA policy read failed"
+				});
+			}
+		}
+		return new D1EcdsaAdmissionPolicyRead(database, namespace, walletId, activationId, decisions);
+	}
+	resolve(database, namespace, input) {
+		if (database !== this.database || namespace !== this.namespace) return null;
+		if (input.walletId !== this.walletId || input.materialActivationId !== this.activationId) throw new Error("ECDSA policy credential scope does not match");
+		const result = this.#decisions.get(runtimePolicyScopeKey(input.runtimePolicyScope));
+		if (!result) throw new Error("Verified ECDSA material policy scope is missing");
+		if (!result.ok) throw new Error(result.message);
+		return result.decision;
+	}
+};
+const ECDSA_CREDENTIAL_POLICY_PROJECTION = `
+  (WITH candidates AS (
+     SELECT DISTINCT json_extract(signer.record_json, '$.runtimePolicyScope') AS scope_json
+       FROM wallet_signers AS signer
+      WHERE signer.namespace = session.namespace AND signer.org_id = session.org_id
+        AND signer.project_id = session.project_id AND signer.env_id = session.env_id
+        AND signer.wallet_id = session.wallet_id AND signer.signer_family = 'ecdsa'
+        AND json_valid(signer.record_json)
+   ), scopes AS (
+     SELECT scope_json,
+            json_extract(scope_json, '$.orgId') AS org_id,
+            json_extract(scope_json, '$.projectId') AS project_id,
+            json_extract(scope_json, '$.envId') AS env_id,
+            json_extract(scope_json, '$.signingRootVersion') AS signing_root_version,
+            json_extract(scope_json, '$.orgId') || char(31) ||
+            json_extract(scope_json, '$.projectId') || char(31) ||
+            json_extract(scope_json, '$.envId') || char(31) ||
+            json_extract(scope_json, '$.signingRootVersion') AS project_key
+       FROM candidates
+   )
+   SELECT json_group_array(json_object(
+     'scope_json', scopes.scope_json,
+     'project_key', project.record_key, 'project_decision', project.decision,
+     'project_retry_after_ms', project.retry_after_ms,
+     'abuse_key', abuse.record_key, 'abuse_decision', abuse.decision,
+     'abuse_retry_after_ms', abuse.retry_after_ms))
+     FROM scopes
+     LEFT JOIN router_ab_normal_signing_admission_records AS project
+       ON project.namespace = session.namespace AND project.org_id = scopes.org_id
+      AND project.project_id = scopes.project_id AND project.env_id = scopes.env_id
+      AND project.signing_root_version = scopes.signing_root_version
+      AND project.record_kind = 'project_policy' AND project.record_key = scopes.project_key
+     LEFT JOIN router_ab_normal_signing_admission_records AS abuse
+       ON abuse.namespace = session.namespace AND abuse.org_id = scopes.org_id
+      AND abuse.project_id = scopes.project_id AND abuse.env_id = scopes.env_id
+      AND abuse.signing_root_version = scopes.signing_root_version
+      AND abuse.record_kind = 'abuse'
+      AND abuse.record_key = scopes.project_key || char(31) || session.wallet_id || char(31) ||
+          'material_activation:' || ? || char(31) || 'ecdsa'
+  ) AS ecdsa_policy_records_json,`;
 //#endregion
-export { CloudflareD1RouterAbNormalSigningAdmissionStore, createCloudflareD1RouterAbNormalSigningAdmissionStore };
+export { CloudflareD1RouterAbNormalSigningAdmissionStore, D1EcdsaAdmissionPolicyRead, ECDSA_CREDENTIAL_POLICY_PROJECTION, createCloudflareD1RouterAbNormalSigningAdmissionStore };
 
 //# sourceMappingURL=d1RouterAbNormalSigningAdmissionStore.js.map

package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnAuthService.js

@@ -3,6 +3,7 @@ import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimit
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
+import { failedVerification, failure } from "../../../../shared-ts/src/utils/failure.js";
 import { decodeWebAuthnBase64UrlOrBase64, parseWebAuthnAuthenticationCredential, parseWebAuthnClientDataJsonBase64url, webAuthnCredentialIdB64uFromCredential, webAuthnOriginHostnameOrEmpty } from "../../../auth/webAuthnCredentialCodecs.js";
 import { nonNegativeSafeInteger, optionalNonNegativeInteger, parseD1BoundaryWalletId, parseD1BoundaryWalletIdResult, parseJsonObject } from "../auth/d1RouterApiAuthBoundary.js";
 import { parseWebAuthnAuthenticatorRowDeviceInfo, webAuthnSyncWalletBindingFromCredentialBinding } from "./d1WebAuthnRecords.js";
@@ -21,11 +22,7 @@ var CloudflareD1WebAuthnAuthService = class {
 	async listWebAuthnAuthenticatorsForUser(input) {
 		try {
 			const userId = parseD1BoundaryWalletIdResult(input.userId);
-			if (!userId.ok) return {
-				ok: false,
-				code: "invalid_args",
-				message: userId.code === "missing" ? "Missing userId" : "Invalid userId"
-			};
+			if (!userId.ok) return failure("invalid_args", userId.code === "missing" ? "Missing userId" : "Invalid userId");
 			const rpId = normalizeOptionalTrimmedString(input.rpId);
 			const authRows = await this.webAuthnStore.readAuthenticatorRows(userId.value);
 			const bindings = await this.webAuthnStore.readBindingRows({
@@ -55,27 +52,15 @@ var CloudflareD1WebAuthnAuthService = class {
 				authenticators
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: errorMessage(error) || "Failed to list authenticators"
-			};
+			return failure("internal", errorMessage(error) || "Failed to list authenticators");
 		}
 	}
 	async createWebAuthnLoginOptions(input) {
 		try {
 			const userId = parseD1BoundaryWalletIdResult(input.userId ?? input.user_id);
 			const rpId = normalizeOptionalTrimmedString(input.rpId ?? input.rp_id);
-			if (!userId.ok) return {
-				ok: false,
-				code: "invalid_body",
-				message: userId.code === "missing" ? "Missing userId" : "Invalid userId"
-			};
-			if (!rpId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Missing rpId"
-			};
+			if (!userId.ok) return failure("invalid_body", userId.code === "missing" ? "Missing userId" : "Invalid userId");
+			if (!rpId) return failure("invalid_body", "Missing rpId");
 			const createdAtMs = Date.now();
 			const expiresAtMs = createdAtMs + webAuthnLoginChallengeTtlMs(input.ttlMs ?? input.ttl_ms);
 			const challengeId = secureRandomBase64Url(16, "WebAuthn login challenge id");
@@ -96,11 +81,7 @@ var CloudflareD1WebAuthnAuthService = class {
 				seenCredentialIds.add(credentialId);
 				credentialIds.push(credentialId);
 			}
-			if (credentialIds.length === 0) return {
-				ok: false,
-				code: "unknown_credential",
-				message: "Wallet has no registered passkey credential"
-			};
+			if (credentialIds.length === 0) return failure("unknown_credential", "Wallet has no registered passkey credential");
 			const record = {
 				version: "webauthn_login_challenge_v1",
 				challengeId,
@@ -125,28 +106,16 @@ var CloudflareD1WebAuthnAuthService = class {
 				expiresAtMs
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: errorMessage(error) || "Failed to create login options"
-			};
+			return failure("internal", errorMessage(error) || "Failed to create login options");
 		}
 	}
 	async createWebAuthnSyncAccountOptions(input) {
 		try {
 			const rpId = normalizeOptionalTrimmedString(input.rp_id);
-			if (!rpId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Missing rp_id"
-			};
+			if (!rpId) return failure("invalid_body", "Missing rp_id");
 			const expectedUserIdRaw = normalizeOptionalTrimmedString(input.account_id);
 			const expectedUserId = expectedUserIdRaw ? parseD1BoundaryWalletId(expectedUserIdRaw) : null;
-			if (expectedUserIdRaw && !expectedUserId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Invalid wallet account_id"
-			};
+			if (expectedUserIdRaw && !expectedUserId) return failure("invalid_body", "Invalid wallet account_id");
 			const createdAtMs = Date.now();
 			const expiresAtMs = createdAtMs + webAuthnLoginChallengeTtlMs(input.ttlMs ?? input.ttl_ms);
 			const challengeId = secureRandomBase64Url(16, "WebAuthn sync challenge id");
@@ -172,11 +141,7 @@ var CloudflareD1WebAuthnAuthService = class {
 					}
 					if (credentialId && activeCredentialIds.has(credentialId) && !walletBinding) walletBinding = webAuthnSyncWalletBindingFromCredentialBinding(binding) || void 0;
 				}
-				if (credentialIds.length === 0) return {
-					ok: false,
-					code: "unknown_credential",
-					message: "Wallet has no registered active passkey credential"
-				};
+				if (credentialIds.length === 0) return failure("unknown_credential", "Wallet has no registered active passkey credential");
 			}
 			const record = {
 				version: "webauthn_sync_challenge_v1",
@@ -203,11 +168,7 @@ var CloudflareD1WebAuthnAuthService = class {
 				expiresAtMs
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: errorMessage(error) || "Failed to create sync account options"
-			};
+			return failure("internal", errorMessage(error) || "Failed to create sync account options");
 		}
 	}
 	async verifyWebAuthnAuthenticationLite(input) {
@@ -349,56 +310,22 @@ var CloudflareD1WebAuthnAuthService = class {
 	async verifyWebAuthnLogin(input) {
 		try {
 			const challengeId = normalizeOptionalTrimmedString(input.challengeId ?? input.challenge_id);
-			if (!challengeId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Missing challengeId"
-			};
+			if (!challengeId) return failure("invalid_body", "Missing challengeId");
 			const challenge = await this.webAuthnStore.consumeLoginChallenge(challengeId);
-			if (!challenge) return {
-				ok: false,
-				verified: false,
-				code: "challenge_expired_or_invalid",
-				message: "Login challenge expired or invalid"
-			};
+			if (!challenge) return failedVerification("challenge_expired_or_invalid", "Login challenge expired or invalid");
 			const expectedOrigin = normalizeOptionalTrimmedString(input.expected_origin);
-			if (!expectedOrigin) return {
-				ok: false,
-				verified: false,
-				code: "invalid_body",
-				message: "expected_origin is required for WebAuthn authentication verification"
-			};
+			if (!expectedOrigin) return failedVerification("invalid_body", "expected_origin is required for WebAuthn authentication verification");
 			const rpId = parseWebAuthnRpId(challenge.rpId);
-			if (!rpId.ok) return {
-				ok: false,
-				verified: false,
-				code: "internal",
-				message: `Stored login challenge rpId is invalid: ${rpId.error.message}`
-			};
+			if (!rpId.ok) return failedVerification("internal", `Stored login challenge rpId is invalid: ${rpId.error.message}`);
 			const credential = parseWebAuthnAuthenticationCredential(input.webauthn_authentication);
-			if (!credential) return {
-				ok: false,
-				verified: false,
-				code: "invalid_body",
-				message: "Missing webauthn_authentication"
-			};
+			if (!credential) return failedVerification("invalid_body", "Missing webauthn_authentication");
 			const credentialId = webAuthnCredentialIdB64uFromCredential(credential);
-			if (!credentialId.ok) return {
-				ok: false,
-				verified: false,
-				code: credentialId.code,
-				message: credentialId.message
-			};
+			if (!credentialId.ok) return failedVerification(credentialId.code, credentialId.message);
 			const activeMethod = await this.walletAuthMethodStore.getPasskeyV2({
 				rpId: challenge.rpId,
 				credentialIdB64u: credentialId.credentialIdB64u
 			});
-			if (!activeMethod || activeMethod.kind !== "passkey" || activeMethod.status !== "active" || String(activeMethod.walletId) !== String(challenge.userId) || String(activeMethod.rpId) !== String(challenge.rpId) || String(activeMethod.credentialIdB64u) !== String(credentialId.credentialIdB64u)) return {
-				ok: false,
-				verified: false,
-				code: "unknown_credential",
-				message: "Credential is not active for this wallet"
-			};
+			if (!activeMethod || activeMethod.kind !== "passkey" || activeMethod.status !== "active" || String(activeMethod.walletId) !== String(challenge.userId) || String(activeMethod.rpId) !== String(challenge.rpId) || String(activeMethod.credentialIdB64u) !== String(credentialId.credentialIdB64u)) return failedVerification("unknown_credential", "Credential is not active for this wallet");
 			const verificationFailure = webAuthnAuthenticationFailure(await this.verifyWebAuthnAuthenticationLite({
 				userId: challenge.userId,
 				rpId: rpId.value,
@@ -424,43 +351,19 @@ var CloudflareD1WebAuthnAuthService = class {
 				ed25519: loginSigner.ed25519
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				verified: false,
-				code: "internal",
-				message: errorMessage(error) || "Login verification failed"
-			};
+			return failedVerification("internal", errorMessage(error) || "Login verification failed");
 		}
 	}
 	async verifyWebAuthnSyncAccount(input) {
 		try {
 			const challengeId = normalizeOptionalTrimmedString(input.challengeId ?? input.challenge_id);
-			if (!challengeId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "Missing challengeId"
-			};
+			if (!challengeId) return failure("invalid_body", "Missing challengeId");
 			const challenge = await this.webAuthnStore.consumeSyncChallenge(challengeId);
-			if (!challenge) return {
-				ok: false,
-				verified: false,
-				code: "challenge_expired_or_invalid",
-				message: "Sync challenge expired or invalid"
-			};
+			if (!challenge) return failedVerification("challenge_expired_or_invalid", "Sync challenge expired or invalid");
 			const credential = parseWebAuthnAuthenticationCredential(input.webauthn_authentication);
-			if (!credential) return {
-				ok: false,
-				verified: false,
-				code: "invalid_body",
-				message: "Missing webauthn_authentication"
-			};
+			if (!credential) return failedVerification("invalid_body", "Missing webauthn_authentication");
 			const credentialId = webAuthnCredentialIdB64uFromCredential(credential);
-			if (!credentialId.ok) return {
-				ok: false,
-				verified: false,
-				code: credentialId.code,
-				message: credentialId.message
-			};
+			if (!credentialId.ok) return failedVerification(credentialId.code, credentialId.message);
 			const syncBinding = webAuthnSyncCredentialBinding(await this.webAuthnStore.readBindingByCredential({
 				rpId: challenge.rpId,
 				credentialIdB64u: credentialId.credentialIdB64u
@@ -471,26 +374,11 @@ var CloudflareD1WebAuthnAuthService = class {
 				rpId: challenge.rpId,
 				credentialIdB64u: credentialId.credentialIdB64u
 			});
-			if (!activeMethod || activeMethod.kind !== "passkey" || activeMethod.status !== "active" || String(activeMethod.walletId) !== String(binding.userId) || String(activeMethod.rpId) !== String(challenge.rpId) || String(activeMethod.credentialIdB64u) !== String(credentialId.credentialIdB64u)) return {
-				ok: false,
-				verified: false,
-				code: "unknown_credential",
-				message: "Credential is not active for this wallet"
-			};
+			if (!activeMethod || activeMethod.kind !== "passkey" || activeMethod.status !== "active" || String(activeMethod.walletId) !== String(binding.userId) || String(activeMethod.rpId) !== String(challenge.rpId) || String(activeMethod.credentialIdB64u) !== String(credentialId.credentialIdB64u)) return failedVerification("unknown_credential", "Credential is not active for this wallet");
 			const expectedOrigin = normalizeOptionalTrimmedString(input.expected_origin);
-			if (!expectedOrigin) return {
-				ok: false,
-				verified: false,
-				code: "invalid_body",
-				message: "expected_origin is required for WebAuthn authentication verification"
-			};
+			if (!expectedOrigin) return failedVerification("invalid_body", "expected_origin is required for WebAuthn authentication verification");
 			const rpId = parseWebAuthnRpId(binding.rpId);
-			if (!rpId.ok) return {
-				ok: false,
-				verified: false,
-				code: "internal",
-				message: `Stored sync credential binding rpId is invalid: ${rpId.error.message}`
-			};
+			if (!rpId.ok) return failedVerification("internal", `Stored sync credential binding rpId is invalid: ${rpId.error.message}`);
 			const verificationFailure = webAuthnAuthenticationFailure(await this.verifyWebAuthnAuthenticationLite({
 				userId: binding.userId,
 				rpId: rpId.value,
@@ -503,36 +391,16 @@ var CloudflareD1WebAuthnAuthService = class {
 				userId: binding.userId,
 				credentialIdB64u: credentialId.credentialIdB64u
 			});
-			if (!authenticator) return {
-				ok: false,
-				verified: false,
-				code: "unknown_credential",
-				message: "Credential is not registered for user"
-			};
+			if (!authenticator) return failedVerification("unknown_credential", "Credential is not registered for user");
 			const walletBinding = webAuthnSyncWalletBindingFromCredentialBinding(binding);
-			if (!walletBinding) return {
-				ok: false,
-				verified: false,
-				code: "internal",
-				message: "Credential binding is missing wallet identity fields"
-			};
+			if (!walletBinding) return failedVerification("internal", "Credential binding is missing wallet identity fields");
 			const walletId = parseD1BoundaryWalletId(walletBinding.walletId);
-			if (!walletId) return {
-				ok: false,
-				verified: false,
-				code: "internal",
-				message: "Credential binding contains an invalid wallet ID"
-			};
+			if (!walletId) return failedVerification("internal", "Credential binding contains an invalid wallet ID");
 			const ed25519Manifest = await this.walletManifestSource.getEd25519KeyManifestBySlot({
 				walletId,
 				signerSlot: walletBinding.signerSlot
 			});
-			if (!ed25519Manifest) return {
-				ok: false,
-				verified: false,
-				code: "ed25519_not_provisioned",
-				message: "Wallet has no Ed25519 signer yet; NEAR provisioning has not completed"
-			};
+			if (!ed25519Manifest) return failedVerification("ed25519_not_provisioned", "Wallet has no Ed25519 signer yet; NEAR provisioning has not completed");
 			const thresholdEd25519 = binding.relayerKeyId && binding.publicKey ? {
 				relayerKeyId: binding.relayerKeyId,
 				authorityScope: {
@@ -566,12 +434,7 @@ var CloudflareD1WebAuthnAuthService = class {
 				...thresholdEd25519 ? { thresholdEd25519 } : {}
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				verified: false,
-				code: "internal",
-				message: errorMessage(error) || "Sync verification failed"
-			};
+			return failedVerification("internal", errorMessage(error) || "Sync verification failed");
 		}
 	}
 };

package/dist/esm/router/cloudflare/d1/webauthn/d1WebAuthnRecords.js

@@ -7,6 +7,7 @@ import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold
 import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { parseWebAuthnAuthenticatorDeviceInfoJson } from "../../../../shared-ts/src/utils/webauthnDeviceInfo.js";
+import { hasExactKeys } from "../../../../shared-ts/src/utils/exactKeys.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
 import { parseRecoveryCodeReservationId } from "../../../../shared-ts/src/wallet-recovery/recoveryCodeReservation.js";
 import { nonNegativeSafeInteger, optionalNonNegativeInteger, positiveInteger } from "../auth/d1RouterApiAuthBoundary.js";
@@ -25,7 +26,7 @@ function parseWebAuthnLoginChallengeRecord(input) {
 	}
 	if (prototype !== Object.prototype && prototype !== null) return null;
 	const record = candidate;
-	if (!hasExactFields(record, [
+	if (!hasExactKeys(record, [
 		"version",
 		"challengeId",
 		"userId",
@@ -65,7 +66,7 @@ function parseWebAuthnSyncChallengeRecord(input) {
 	}
 	if (prototype !== Object.prototype && prototype !== null) return null;
 	const record = candidate;
-	if (!hasExactFields(record, Object.hasOwn(record, "expectedUserId") ? [
+	if (!hasExactKeys(record, Object.hasOwn(record, "expectedUserId") ? [
 		"version",
 		"challengeId",
 		"rpId",
@@ -263,7 +264,7 @@ function parseWebAuthnRecoveryContinuityEnvelopeAnchor(input) {
 	const updatedAtMs = positiveInteger(record.updatedAtMs);
 	if (!kind || !envelopeId.ok || !walletId.ok || !envelopeRevision || updatedAtMs === null || record.bindingKind !== "wallet_custody_seed_v1") return null;
 	if (kind === "passkey") {
-		if (!hasExactFields(record, [
+		if (!hasExactKeys(record, [
 			"kind",
 			"envelopeId",
 			"walletId",
@@ -288,7 +289,7 @@ function parseWebAuthnRecoveryContinuityEnvelopeAnchor(input) {
 		};
 	}
 	if (kind === "email_otp") {
-		if (!hasExactFields(record, [
+		if (!hasExactKeys(record, [
 			"kind",
 			"envelopeId",
 			"walletId",
@@ -321,10 +322,6 @@ function parseRecoveryEnvelopeRevision(input) {
 		return null;
 	}
 }
-function hasExactFields(record, expectedFields) {
-	const fields = Object.keys(record);
-	return fields.length === expectedFields.length && expectedFields.every((field) => fields.includes(field));
-}
 function parseWebAuthnAuthenticator(row) {
 	const credentialIdB64u = normalizeOptionalTrimmedString(row?.credential_id_b64u);
 	const credentialPublicKeyB64u = normalizeOptionalTrimmedString(row?.credential_public_key_b64u);
@@ -478,7 +475,7 @@ function parseWebAuthnRuntimePolicyScope(raw) {
 	}
 	if (prototype !== Object.prototype && prototype !== null) return void 0;
 	const record = raw;
-	if (!hasExactFields(record, [
+	if (!hasExactKeys(record, [
 		"orgId",
 		"projectId",
 		"envId",