@seams/wallet-server 0.7.1 → 0.8.0

package/dist/esm/core/WalletStore.js

@@ -1,14 +1,12 @@
 import { parseWalletId } from "../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../shared-ts/src/utils/validation.js";
-import { sameRouterAbMpcMaterialActivationRef } from "../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { derivationClientSharePublicKey33B64uFromString, ecdsaClientRootPublicKey33B64uFromString, parseSdkEcdsaDerivationThresholdKeyId } from "../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { normalizeRuntimePolicyScope } from "../shared-ts/src/threshold/signingRootScope.js";
-import { parseRouterAbEcdsaDerivationActivationRefreshRequestV1, parseRouterAbEcdsaDerivationActivationRefreshResponseV1, parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaDerivationPublicIdentityV1, sameRouterAbServerIdentityV1 } from "../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { thresholdEcdsaChainTargetFromValue, thresholdEcdsaChainTargetKey } from "./thresholdEcdsaChainTarget.js";
-import { resolveStorePrefix } from "./d1TenantStore.js";
-import { createDurableObjectStore, postDurableObjectRequest } from "./storeBackends.js";
-import { D1WalletStore, WALLET_STORE_D1_SCHEMA_SQL, buildWalletEcdsaSignerRecord, ensureWalletStoreD1Schema, parseWalletEd25519SignerRecord } from "./d1WalletStore.js";
+import { parseRouterAbEcdsaDerivationActivationRefreshRequestV1, parseRouterAbEcdsaDerivationActivationRefreshResponseV1, parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaRegistrationActivationReceiptV1, sameRegistrationSignerSet, sameRouterAbEcdsaDerivationPublicIdentityV1 } from "../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { thresholdEcdsaChainTargetKey } from "../shared-ts/src/utils/thresholdEcdsaChainTarget.js";
+import { thresholdEcdsaChainTargetFromValue } from "./thresholdEcdsaChainTarget.js";
+import { D1WalletStore, WALLET_STORE_D1_SCHEMA_SQL, buildWalletEcdsaSignerRecord, ensureWalletStoreD1Schema } from "./d1WalletStore.js";
 //#region src/core/WalletStore.ts
 function parseWalletEcdsaPendingSessionActivationRecord(raw) {
 	if (!isPlainObject(raw) || raw.version !== "wallet_ecdsa_pending_session_activation_v1") return null;
@@ -44,40 +42,14 @@ function parseForwardedEcdsaRefreshResponse(raw) {
 	if (response.result !== "forwarded") throw new Error("Persisted ECDSA refresh proof must be forwarded");
 	return response;
 }
-function ecdsaPublicCapabilitiesEqual(left, right) {
-	return sameRouterAbEcdsaDerivationPublicCapabilityV1(left, right);
-}
-function sameWalletEcdsaSignerSetV1(left, right) {
-	return left.signer_set_id === right.signer_set_id && left.policy === right.policy && left.signer_a.role === right.signer_a.role && left.signer_a.signer_id === right.signer_a.signer_id && left.signer_a.key_epoch === right.signer_a.key_epoch && left.signer_b.role === right.signer_b.role && left.signer_b.signer_id === right.signer_b.signer_id && left.signer_b.key_epoch === right.signer_b.key_epoch && sameRouterAbServerIdentityV1(left.selected_server, right.selected_server);
-}
 function ecdsaPostRegistrationRequestMatchesCapability(input) {
-	return input.request.client_id === input.capability.client_id && input.request.router_id === input.capability.router_id && input.request.context.application_binding_digest_b64u === input.capability.context.application_binding_digest_b64u && sameRouterAbEcdsaDerivationPublicIdentityV1(input.request.public_identity, input.capability.public_identity) && sameWalletEcdsaSignerSetV1(input.request.signer_set, input.capability.signer_set);
-}
-function resolveWalletStoreNamespace(config) {
-	return resolveStorePrefix(config, ["WALLET_PREFIX"], "wallet:");
-}
-function signerFamily(record) {
-	return record.version === "wallet_signer_ed25519_v1" ? "ed25519" : "ecdsa";
+	return input.request.client_id === input.capability.client_id && input.request.router_id === input.capability.router_id && input.request.context.application_binding_digest_b64u === input.capability.context.application_binding_digest_b64u && sameRouterAbEcdsaDerivationPublicIdentityV1(input.request.public_identity, input.capability.public_identity) && sameRegistrationSignerSet(input.request.signer_set, input.capability.signer_set);
 }
 function normalizeTimestampMs(value) {
 	const numberValue = Number(value);
 	if (!Number.isFinite(numberValue) || numberValue < 0) return null;
 	return Math.floor(numberValue);
 }
-function parseWalletRecord(raw) {
-	if (!isPlainObject(raw)) return null;
-	if (raw.version !== "wallet_v1") return null;
-	const walletId = parseWalletId(raw.walletId);
-	const createdAtMs = normalizeTimestampMs(raw.createdAtMs);
-	const updatedAtMs = normalizeTimestampMs(raw.updatedAtMs);
-	if (!walletId.ok || createdAtMs == null || updatedAtMs == null) return null;
-	return {
-		version: "wallet_v1",
-		walletId: walletId.value,
-		createdAtMs,
-		updatedAtMs
-	};
-}
 function parseWalletEcdsaSignerRecord(raw) {
 	if (!isPlainObject(raw) || raw.version !== "wallet_signer_ecdsa_v1") return null;
 	if ("evmFamilySigningKeySlotId" in raw) return null;
@@ -182,187 +154,7 @@ function buildWalletEd25519SignerId(input) {
 	if (!Number.isSafeInteger(signerSlot) || signerSlot < 1) throw new Error("Ed25519 signer ID requires an exact signerSlot");
 	return `ed25519:${nearAccountId}:${signerSlot}`;
 }
-var InMemoryWalletStore = class {
-	constructor(prefix) {
-		this.prefix = prefix;
-		this.subjects = /* @__PURE__ */ new Map();
-		this.signers = /* @__PURE__ */ new Map();
-		this.pendingEcdsaActivations = /* @__PURE__ */ new Map();
-	}
-	async getWallet(input) {
-		const walletId = normalizeOptionalTrimmedString(input.walletId);
-		if (!walletId) return null;
-		return this.subjects.get(`${this.prefix}${walletId}`) ?? null;
-	}
-	async getEcdsaSignerByKeyHandle(input) {
-		const walletId = normalizeOptionalTrimmedString(input.walletId);
-		const keyHandle = normalizeOptionalTrimmedString(input.keyHandle);
-		if (!walletId || !keyHandle) return null;
-		const chainTargetKey = thresholdEcdsaChainTargetKey(input.chainTarget);
-		const matches = [...this.signers.values()].filter((record) => record.version === "wallet_signer_ecdsa_v1" && record.walletId === walletId && record.walletKey.keyHandle === keyHandle && record.chainTargetKey === chainTargetKey);
-		return matches.length === 1 ? matches[0] : null;
-	}
-	async getEd25519SignerBySlot(input) {
-		const matches = [...this.signers.values()].filter((record) => record.version === "wallet_signer_ed25519_v1" && record.walletId === input.walletId && record.signerSlot === input.signerSlot);
-		return matches.length === 1 ? matches[0] ?? null : null;
-	}
-	async getEcdsaSignerByPublicCapability(input) {
-		const matches = [...this.signers.values()].filter((record) => record.version === "wallet_signer_ecdsa_v1" && record.walletId === input.walletId && ecdsaPublicCapabilitiesEqual(record.walletKey.publicCapability, input.publicCapability));
-		if (matches.length === 0) return null;
-		const keyHandle = matches[0]?.walletKey.keyHandle;
-		if (!keyHandle || matches.some((record) => record.walletKey.keyHandle !== keyHandle)) throw new Error("Wallet has conflicting ECDSA public capabilities");
-		return matches[0] ?? null;
-	}
-	async getEcdsaSignerByMaterialActivation(input) {
-		const matches = [...this.signers.values()].filter((record) => record.version === "wallet_signer_ecdsa_v1" && record.walletId === input.walletId && sameRouterAbMpcMaterialActivationRef(record.walletKey.publicCapability.material_activation, input.materialActivation));
-		if (matches.length === 0) return null;
-		const keyHandle = matches[0]?.walletKey.keyHandle;
-		if (!keyHandle || matches.some((record) => record.walletKey.keyHandle !== keyHandle)) throw new Error("Wallet has conflicting ECDSA material activations");
-		return matches[0] ?? null;
-	}
-	async getEcdsaSignerByPostRegistrationRequest(input) {
-		const matches = [...this.signers.values()].filter((record) => record.version === "wallet_signer_ecdsa_v1" && record.walletId === input.walletId && ecdsaPostRegistrationRequestMatchesCapability({
-			request: input.request,
-			capability: record.walletKey.publicCapability
-		}));
-		if (matches.length === 0) return null;
-		const keyHandle = matches[0]?.walletKey.keyHandle;
-		if (!keyHandle || matches.some((record) => record.walletKey.keyHandle !== keyHandle)) throw new Error("Wallet has conflicting ECDSA post-registration identities");
-		return matches[0] ?? null;
-	}
-	async listEcdsaSignersForWallet(input) {
-		return [...this.signers.values()].filter((record) => record.version === "wallet_signer_ecdsa_v1" && record.walletId === input.walletId);
-	}
-	async putEcdsaPendingSessionActivation(record) {
-		this.pendingEcdsaActivations.set(`${record.walletId}:${record.lifecycleId}:${record.requestId}`, record);
-	}
-	async putSubject(record) {
-		this.subjects.set(`${this.prefix}${record.walletId}`, record);
-	}
-	async putSigner(record) {
-		this.signers.set(`${this.prefix}${record.walletId}:${signerFamily(record)}:${record.signerId}`, record);
-	}
-	async putSigners(records) {
-		for (const record of records) await this.putSigner(record);
-	}
-};
-var CloudflareDurableObjectWalletStore = class {
-	constructor(stub, prefix) {
-		this.stub = stub;
-		this.prefix = prefix;
-	}
-	key(scope, id) {
-		return `${this.prefix}${scope}:${id}`;
-	}
-	/** The object's reply to a `get`, or `undefined` when it answers with an HTTP error. */
-	async get(key) {
-		const response = await postDurableObjectRequest(this.stub, {
-			op: "get",
-			key
-		});
-		if (!response.ok) return void 0;
-		return await response.json().catch(() => null);
-	}
-	async put(key, value) {
-		const response = await postDurableObjectRequest(this.stub, {
-			op: "set",
-			key,
-			value
-		});
-		if (!response.ok) throw new Error(`Wallet DO store HTTP ${response.status}: ${await response.text()}`);
-	}
-	async putSubject(record) {
-		await this.put(this.key("subject", record.walletId), record);
-	}
-	async getWallet(input) {
-		const walletId = normalizeOptionalTrimmedString(input.walletId);
-		if (!walletId) return null;
-		const current = await this.get(this.key("subject", walletId));
-		if (current === void 0) return null;
-		return parseWalletRecord(current?.value);
-	}
-	async getEcdsaSignerByKeyHandle(input) {
-		const walletId = normalizeOptionalTrimmedString(input.walletId);
-		const keyHandle = normalizeOptionalTrimmedString(input.keyHandle);
-		if (!walletId || !keyHandle) return null;
-		const chainTargetKey = thresholdEcdsaChainTargetKey(input.chainTarget);
-		const current = await this.get(this.key("signer", `${walletId}:ecdsa-key-handle:${keyHandle}:${chainTargetKey}`));
-		if (current === void 0) return null;
-		return parseWalletEcdsaSignerRecord(current?.value);
-	}
-	async getEd25519SignerBySlot(input) {
-		const current = await this.get(this.key("signer", `${input.walletId}:ed25519-slot:${input.signerSlot}`));
-		if (current === void 0) return null;
-		return parseWalletEd25519SignerRecord(current?.value);
-	}
-	async getEcdsaSignerByPublicCapability(input) {
-		const current = await this.get(this.key("signer", `${input.walletId}:ecdsa-public-capability:${input.publicCapability.registration_request_digest_b64u}`));
-		if (current === void 0) return null;
-		const signer = parseWalletEcdsaSignerRecord(current?.value);
-		return signer && ecdsaPublicCapabilitiesEqual(signer.walletKey.publicCapability, input.publicCapability) ? signer : null;
-	}
-	async getEcdsaSignerByMaterialActivation(input) {
-		const current = await this.get(this.key("signer", `${input.walletId}:ecdsa-material-activation:${input.materialActivation.activation_id}`));
-		if (current === void 0) return null;
-		const signer = parseWalletEcdsaSignerRecord(current?.value);
-		return signer && signer.walletId === input.walletId && sameRouterAbMpcMaterialActivationRef(signer.walletKey.publicCapability.material_activation, input.materialActivation) ? signer : null;
-	}
-	async getEcdsaSignerByPostRegistrationRequest(input) {
-		const capabilityDigest = input.request.public_identity.context_binding_b64u;
-		const current = await this.get(this.key("signer", `${input.walletId}:ecdsa-context-binding:${capabilityDigest}`));
-		if (current === void 0) return null;
-		const signer = parseWalletEcdsaSignerRecord(current?.value);
-		return signer && ecdsaPostRegistrationRequestMatchesCapability({
-			request: input.request,
-			capability: signer.walletKey.publicCapability
-		}) ? signer : null;
-	}
-	async listEcdsaSignersForWallet(input) {
-		const current = await this.get(this.key("signer", `${input.walletId}:ecdsa-list`));
-		if (current?.value === void 0 || current.value === null) return [];
-		if (!Array.isArray(current.value)) throw new Error("Wallet ECDSA signer list is invalid");
-		const signers = [];
-		for (const raw of current.value) {
-			const signer = parseWalletEcdsaSignerRecord(raw);
-			if (!signer || signer.walletId !== input.walletId) throw new Error("Wallet ECDSA signer list contains an invalid record");
-			signers.push(signer);
-		}
-		return signers;
-	}
-	async putEcdsaPendingSessionActivation(record) {
-		await this.put(this.key("ecdsa-session-activation", `${record.walletId}:${record.lifecycleId}:${record.requestId}`), record);
-	}
-	async putSigner(record) {
-		await this.put(this.key("signer", `${record.walletId}:${signerFamily(record)}:${record.signerId}`), record);
-		if (record.version === "wallet_signer_ecdsa_v1") {
-			await this.put(this.key("signer", `${record.walletId}:ecdsa-key-handle:${record.walletKey.keyHandle}:${record.chainTargetKey}`), record);
-			await this.put(this.key("signer", `${record.walletId}:ecdsa-public-capability:${record.walletKey.publicCapability.registration_request_digest_b64u}`), record);
-			await this.put(this.key("signer", `${record.walletId}:ecdsa-material-activation:${record.walletKey.publicCapability.material_activation.activation_id}`), record);
-			await this.put(this.key("signer", `${record.walletId}:ecdsa-context-binding:${record.walletKey.publicCapability.public_identity.context_binding_b64u}`), record);
-			const next = (await this.listEcdsaSignersForWallet({ walletId: record.walletId })).filter((signer) => signer.chainTargetKey !== record.chainTargetKey);
-			await this.put(this.key("signer", `${record.walletId}:ecdsa-list`), [...next, record]);
-		}
-		if (record.version === "wallet_signer_ed25519_v1") await this.put(this.key("signer", `${record.walletId}:ed25519-slot:${record.signerSlot}`), record);
-	}
-	async putSigners(records) {
-		for (const record of records) await this.putSigner(record);
-	}
-};
-const WALLET_STORE = {
-	tag: "wallet",
-	name: "wallet",
-	inMemoryLog: "Using in-memory store (non-persistent)",
-	d1StoreName: "wallet store",
-	resolvePrefix: resolveWalletStoreNamespace
-};
-function createWalletStore(input) {
-	return createDurableObjectStore(input, WALLET_STORE, {
-		d1: (options) => new D1WalletStore(options),
-		durableObject: (stub, prefix) => new CloudflareDurableObjectWalletStore(stub, prefix),
-		inMemory: (prefix) => new InMemoryWalletStore(prefix)
-	});
-}
 //#endregion
-export { D1WalletStore, WALLET_STORE_D1_SCHEMA_SQL, buildWalletEcdsaSignerRecord, buildWalletEd25519SignerId, createWalletStore, ecdsaPostRegistrationRequestMatchesCapability, ensureWalletStoreD1Schema, parseWalletEcdsaPendingSessionActivationRecord, parseWalletEcdsaSignerRecord, resolveWalletStoreNamespace };
+export { D1WalletStore, WALLET_STORE_D1_SCHEMA_SQL, buildWalletEcdsaSignerRecord, buildWalletEd25519SignerId, ecdsaPostRegistrationRequestMatchesCapability, ensureWalletStoreD1Schema, parseWalletEcdsaPendingSessionActivationRecord, parseWalletEcdsaSignerRecord };
 
 //# sourceMappingURL=WalletStore.js.map

package/dist/esm/core/WebAuthnAuthenticatorStore.js

@@ -1,202 +0,0 @@
-import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
-import { isObject } from "../shared-ts/src/utils/validation.js";
-import { parseWebAuthnAuthenticatorDeviceInfo, parseWebAuthnAuthenticatorDeviceInfoJson, unknownWebAuthnAuthenticatorDeviceInfo } from "../shared-ts/src/utils/webauthnDeviceInfo.js";
-import { D1TenantTable, ensureD1Schema } from "./d1TenantStore.js";
-import { UPSERT_WEBAUTHN_AUTHENTICATOR_SQL, webAuthnAuthenticatorRows } from "./webAuthnD1Statements.js";
-import { WebAuthnCredentialRecords, createWebAuthnStore, resolveWebAuthnStorePrefix, webAuthnD1Store } from "./webAuthnStoreBackends.js";
-//#region src/core/WebAuthnAuthenticatorStore.ts
-const WEBAUTHN_AUTHENTICATOR_STORE_D1_SCHEMA_SQL = Object.freeze([`
-    CREATE TABLE IF NOT EXISTS webauthn_authenticators (
-      namespace TEXT NOT NULL,
-      org_id TEXT NOT NULL,
-      project_id TEXT NOT NULL,
-      env_id TEXT NOT NULL,
-      user_id TEXT NOT NULL,
-      credential_id_b64u TEXT NOT NULL,
-      credential_public_key_b64u TEXT NOT NULL,
-      counter INTEGER NOT NULL,
-      created_at_ms INTEGER NOT NULL,
-      updated_at_ms INTEGER NOT NULL,
-      device_info_json TEXT NOT NULL DEFAULT '{}',
-      PRIMARY KEY (namespace, org_id, project_id, env_id, user_id, credential_id_b64u),
-      CHECK (length(user_id) > 0),
-      CHECK (length(credential_id_b64u) > 0),
-      CHECK (length(credential_public_key_b64u) > 0),
-      CHECK (counter >= 0),
-      CHECK (created_at_ms > 0),
-      CHECK (updated_at_ms > 0)
-    )
-  `, `
-    CREATE INDEX IF NOT EXISTS webauthn_authenticators_user_idx
-      ON webauthn_authenticators (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        user_id,
-        created_at_ms
-      )
-  `]);
-async function ensureWebAuthnAuthenticatorStoreD1Schema(options) {
-	await ensureD1Schema(options.database, WEBAUTHN_AUTHENTICATOR_STORE_D1_SCHEMA_SQL);
-}
-const AUTHENTICATOR_STORE = {
-	label: "authenticator",
-	prefixConfigKey: "WEBAUTHN_AUTHENTICATOR_PREFIX",
-	prefixName: "authenticator",
-	parse: parseWebAuthnAuthenticatorRecord,
-	durableObjectLogSubject: "authenticator persistence",
-	connectionErrorSubject: "webauthn store",
-	unconfiguredNote: "non-persistent",
-	d1ScopeLabel: "authenticator"
-};
-function resolveWebAuthnAuthenticatorStoreNamespace(config) {
-	return resolveWebAuthnStorePrefix(config, AUTHENTICATOR_STORE);
-}
-function parseWebAuthnAuthenticatorRecord(raw) {
-	if (!isObject(raw)) return null;
-	const version = normalizeOptionalTrimmedString(raw.version);
-	const credentialIdB64u = normalizeOptionalTrimmedString(raw.credentialIdB64u);
-	const credentialPublicKeyB64u = normalizeOptionalTrimmedString(raw.credentialPublicKeyB64u);
-	const counter = typeof raw.counter === "number" ? raw.counter : Number(raw.counter);
-	const createdAtMs = typeof raw.createdAtMs === "number" ? raw.createdAtMs : Number(raw.createdAtMs);
-	const updatedAtMs = typeof raw.updatedAtMs === "number" ? raw.updatedAtMs : Number(raw.updatedAtMs);
-	if (version !== "webauthn_authenticator_v1") return null;
-	if (!credentialIdB64u || !credentialPublicKeyB64u) return null;
-	if (!Number.isFinite(counter) || counter < 0) return null;
-	if (!Number.isFinite(createdAtMs) || createdAtMs <= 0) return null;
-	if (!Number.isFinite(updatedAtMs) || updatedAtMs <= 0) return null;
-	return {
-		version: "webauthn_authenticator_v1",
-		credentialIdB64u,
-		credentialPublicKeyB64u,
-		counter: Math.floor(counter),
-		createdAtMs: Math.floor(createdAtMs),
-		updatedAtMs: Math.floor(updatedAtMs),
-		deviceInfo: parseWebAuthnAuthenticatorDeviceInfo(raw.deviceInfo) ?? unknownWebAuthnAuthenticatorDeviceInfo()
-	};
-}
-function parseD1WebAuthnAuthenticatorRow(row) {
-	if (!row) return null;
-	return parseWebAuthnAuthenticatorRecord({
-		version: "webauthn_authenticator_v1",
-		credentialIdB64u: row.credential_id_b64u,
-		credentialPublicKeyB64u: row.credential_public_key_b64u,
-		counter: row.counter,
-		createdAtMs: row.created_at_ms,
-		updatedAtMs: row.updated_at_ms,
-		deviceInfo: parseWebAuthnAuthenticatorDeviceInfoJson(row.device_info_json)
-	});
-}
-var KeyValueWebAuthnAuthenticatorStore = class {
-	constructor(records, prefix) {
-		this.records = new WebAuthnCredentialRecords(records, prefix);
-	}
-	async get(userId, credentialIdB64u) {
-		return this.records.get(userId, credentialIdB64u);
-	}
-	async put(userId, record) {
-		const uid = normalizeOptionalTrimmedString(userId);
-		if (!uid) throw new Error("Missing userId");
-		const parsed = parseWebAuthnAuthenticatorRecord(record);
-		if (!parsed) throw new Error("Invalid authenticator record");
-		await this.records.set(uid, parsed.credentialIdB64u, parsed);
-	}
-	async del(userId, credentialIdB64u) {
-		await this.records.del(userId, credentialIdB64u);
-	}
-};
-/** Only the in-memory backend can enumerate a user's authenticators. */
-var InMemoryWebAuthnAuthenticatorStore = class extends KeyValueWebAuthnAuthenticatorStore {
-	constructor(memory, prefix) {
-		super(memory, prefix);
-		this.memory = memory;
-		this.prefix = prefix;
-	}
-	async list(userId) {
-		const uid = normalizeOptionalTrimmedString(userId);
-		if (!uid) return [];
-		const keyPrefix = `${this.prefix}${uid}:`;
-		const out = [];
-		for (const [k, v] of this.memory.map.entries()) {
-			if (!k.startsWith(keyPrefix)) continue;
-			const parsed = parseWebAuthnAuthenticatorRecord(v);
-			if (parsed) out.push(parsed);
-		}
-		out.sort((a, b) => a.createdAtMs - b.createdAtMs);
-		return out;
-	}
-};
-var D1WebAuthnAuthenticatorStore = class {
-	constructor(input) {
-		this.adapterKind = "d1";
-		this.prepare = (sql, values) => this.table.prepare(sql, values);
-		this.table = new D1TenantTable(input, webAuthnD1Store(AUTHENTICATOR_STORE.d1ScopeLabel), WEBAUTHN_AUTHENTICATOR_STORE_D1_SCHEMA_SQL);
-	}
-	async get(userId, credentialIdB64u) {
-		await this.table.ensureSchema();
-		const uid = normalizeOptionalTrimmedString(userId);
-		const cid = normalizeOptionalTrimmedString(credentialIdB64u);
-		if (!uid || !cid) return null;
-		return parseD1WebAuthnAuthenticatorRow(await webAuthnAuthenticatorRows.select(this.prepare, uid, cid).first());
-	}
-	async put(userId, record) {
-		await this.table.ensureSchema();
-		const uid = normalizeOptionalTrimmedString(userId);
-		if (!uid) throw new Error("Missing userId");
-		const parsed = parseWebAuthnAuthenticatorRecord(record);
-		if (!parsed) throw new Error("Invalid authenticator record");
-		await this.table.prepare(UPSERT_WEBAUTHN_AUTHENTICATOR_SQL, [
-			uid,
-			parsed.credentialIdB64u,
-			parsed.credentialPublicKeyB64u,
-			parsed.counter,
-			parsed.createdAtMs,
-			parsed.updatedAtMs,
-			JSON.stringify(parsed.deviceInfo)
-		]).run();
-	}
-	async del(userId, credentialIdB64u) {
-		await this.table.ensureSchema();
-		const uid = normalizeOptionalTrimmedString(userId);
-		const cid = normalizeOptionalTrimmedString(credentialIdB64u);
-		if (!uid || !cid) return;
-		await this.table.prepare(`DELETE FROM webauthn_authenticators
-          WHERE namespace = ?
-            AND org_id = ?
-            AND project_id = ?
-            AND env_id = ?
-            AND user_id = ?
-            AND credential_id_b64u = ?`, [uid, cid]).run();
-	}
-	async list(userId) {
-		await this.table.ensureSchema();
-		const uid = normalizeOptionalTrimmedString(userId);
-		if (!uid) return [];
-		const result = await this.table.prepare(`SELECT credential_id_b64u, credential_public_key_b64u, counter, created_at_ms, updated_at_ms, device_info_json
-           FROM webauthn_authenticators
-          WHERE namespace = ?
-            AND org_id = ?
-            AND project_id = ?
-            AND env_id = ?
-            AND user_id = ?
-          ORDER BY created_at_ms ASC`, [uid]).all();
-		const records = [];
-		for (const row of result.results || []) {
-			const parsed = parseD1WebAuthnAuthenticatorRow(row);
-			if (parsed) records.push(parsed);
-		}
-		return records;
-	}
-};
-function createWebAuthnAuthenticatorStore(input) {
-	return createWebAuthnStore(input, AUTHENTICATOR_STORE, {
-		d1: (options) => new D1WebAuthnAuthenticatorStore(options),
-		keyValue: (records, prefix) => new KeyValueWebAuthnAuthenticatorStore(records, prefix),
-		inMemory: (records, prefix) => new InMemoryWebAuthnAuthenticatorStore(records, prefix)
-	});
-}
-//#endregion
-export { D1WebAuthnAuthenticatorStore, WEBAUTHN_AUTHENTICATOR_STORE_D1_SCHEMA_SQL, createWebAuthnAuthenticatorStore, ensureWebAuthnAuthenticatorStoreD1Schema, resolveWebAuthnAuthenticatorStoreNamespace };
-
-//# sourceMappingURL=WebAuthnAuthenticatorStore.js.map

package/dist/esm/core/WebAuthnCredentialBindingStore.js

@@ -1,10 +1,7 @@
 import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
 import { isObject } from "../shared-ts/src/utils/validation.js";
 import { normalizeRuntimePolicyScope } from "../shared-ts/src/threshold/signingRootScope.js";
-import { parseD1JsonColumn } from "../storage/d1Sql.js";
-import { D1TenantTable, ensureD1Schema, prepareD1TenantStatement } from "./d1TenantStore.js";
-import { webAuthnCredentialBindingRows } from "./webAuthnD1Statements.js";
-import { WebAuthnCredentialRecords, createWebAuthnStore, resolveWebAuthnStorePrefix, webAuthnD1Store } from "./webAuthnStoreBackends.js";
+import { prepareD1TenantStatement } from "./d1TenantStore.js";
 //#region src/core/WebAuthnCredentialBindingStore.ts
 const INSERT_CREDENTIAL_BINDING_SQL = `INSERT INTO webauthn_credential_bindings (
         namespace,
@@ -64,57 +61,6 @@ function prepareD1WebAuthnCredentialBindingPutStatement(input) {
 function prepareD1WebAuthnCredentialBindingInsertStatement(input) {
 	return prepareCredentialBindingWrite(input, INSERT_CREDENTIAL_BINDING_SQL);
 }
-const WEBAUTHN_CREDENTIAL_BINDING_STORE_D1_SCHEMA_SQL = Object.freeze([`
-    CREATE TABLE IF NOT EXISTS webauthn_credential_bindings (
-      namespace TEXT NOT NULL,
-      org_id TEXT NOT NULL,
-      project_id TEXT NOT NULL,
-      env_id TEXT NOT NULL,
-      rp_id TEXT NOT NULL,
-      credential_id_b64u TEXT NOT NULL,
-      user_id TEXT NOT NULL,
-      -- Nullable until the wallet's Ed25519 Yao ceremony settles.
-      signer_slot INTEGER,
-      record_json TEXT NOT NULL,
-      created_at_ms INTEGER NOT NULL,
-      updated_at_ms INTEGER NOT NULL,
-      PRIMARY KEY (namespace, org_id, project_id, env_id, rp_id, credential_id_b64u),
-      CHECK (length(rp_id) > 0),
-      CHECK (length(credential_id_b64u) > 0),
-      CHECK (length(user_id) > 0),
-      CHECK (signer_slot IS NULL OR signer_slot >= 1),
-      CHECK (json_valid(record_json)),
-      CHECK (created_at_ms > 0),
-      CHECK (updated_at_ms > 0)
-    )
-  `, `
-    CREATE INDEX IF NOT EXISTS webauthn_credential_bindings_user_idx
-      ON webauthn_credential_bindings (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        user_id,
-        rp_id,
-        signer_slot
-      )
-  `]);
-async function ensureWebAuthnCredentialBindingStoreD1Schema(options) {
-	await ensureD1Schema(options.database, WEBAUTHN_CREDENTIAL_BINDING_STORE_D1_SCHEMA_SQL);
-}
-const CREDENTIAL_BINDING_STORE = {
-	label: "credential binding",
-	prefixConfigKey: "WEBAUTHN_CREDENTIAL_BINDING_PREFIX",
-	prefixName: "credential_binding",
-	parse: parseWebAuthnCredentialBindingRecord,
-	durableObjectLogSubject: "credential bindings",
-	connectionErrorSubject: "webauthn store",
-	unconfiguredNote: "no persistence configured",
-	d1ScopeLabel: "credential"
-};
-function resolveWebAuthnCredentialBindingStoreNamespace(config) {
-	return resolveWebAuthnStorePrefix(config, CREDENTIAL_BINDING_STORE);
-}
 function parseWebAuthnCredentialBindingRecord(raw) {
 	if (!isObject(raw)) return null;
 	const version = normalizeOptionalTrimmedString(raw.version);
@@ -183,133 +129,7 @@ function parseWebAuthnCredentialBindingRecord(raw) {
 		...ed25519Facts
 	} : base;
 }
-/** One user's bindings, on one RP ID when given. The scope binds ahead of `values`. */
-function userBindingsFilter(userId, rpId) {
-	const clauses = [
-		"namespace = ?",
-		"org_id = ?",
-		"project_id = ?",
-		"env_id = ?",
-		"user_id = ?"
-	];
-	const values = [userId];
-	if (rpId) {
-		clauses.push("rp_id = ?");
-		values.push(rpId);
-	}
-	return {
-		where: clauses.join(" AND "),
-		values
-	};
-}
-var KeyValueWebAuthnCredentialBindingStore = class {
-	constructor(records, prefix) {
-		this.records = new WebAuthnCredentialRecords(records, prefix);
-	}
-	async get(rpId, credentialIdB64u) {
-		return this.records.get(rpId, credentialIdB64u);
-	}
-	async put(record) {
-		const parsed = parseWebAuthnCredentialBindingRecord(record);
-		if (!parsed) throw new Error("Invalid credential binding record");
-		await this.records.set(parsed.rpId, parsed.credentialIdB64u, parsed);
-	}
-	async del(rpId, credentialIdB64u) {
-		await this.records.del(rpId, credentialIdB64u);
-	}
-};
-/** Only the in-memory backend can enumerate a user's bindings. */
-var InMemoryWebAuthnCredentialBindingStore = class extends KeyValueWebAuthnCredentialBindingStore {
-	constructor(memory, prefix) {
-		super(memory, prefix);
-		this.memory = memory;
-	}
-	async listByUserId(input) {
-		const uid = normalizeOptionalTrimmedString(input.userId);
-		const rpId = normalizeOptionalTrimmedString(input.rpId);
-		if (!uid) return [];
-		const out = [];
-		for (const v of this.memory.map.values()) {
-			const parsed = parseWebAuthnCredentialBindingRecord(v);
-			if (!parsed) continue;
-			if (parsed.userId !== uid) continue;
-			if (rpId && parsed.rpId !== rpId) continue;
-			out.push(parsed);
-		}
-		out.sort((a, b) => (a.signerSlot ?? Number.MAX_SAFE_INTEGER) - (b.signerSlot ?? Number.MAX_SAFE_INTEGER));
-		return out;
-	}
-};
-var D1WebAuthnCredentialBindingStore = class {
-	constructor(input) {
-		this.adapterKind = "d1";
-		this.prepare = (sql, values) => this.table.prepare(sql, values);
-		this.table = new D1TenantTable(input, webAuthnD1Store(CREDENTIAL_BINDING_STORE.d1ScopeLabel), WEBAUTHN_CREDENTIAL_BINDING_STORE_D1_SCHEMA_SQL);
-	}
-	async get(rpId, credentialIdB64u) {
-		await this.table.ensureSchema();
-		const r = normalizeOptionalTrimmedString(rpId);
-		const c = normalizeOptionalTrimmedString(credentialIdB64u);
-		if (!r || !c) return null;
-		return parseWebAuthnCredentialBindingRecord(parseD1JsonColumn((await webAuthnCredentialBindingRows.select(this.prepare, r, c).first())?.record_json));
-	}
-	async put(record) {
-		await this.table.ensureSchema();
-		await prepareD1WebAuthnCredentialBindingPutStatement({
-			database: this.table.database,
-			scope: this.table.scope,
-			record
-		}).run();
-	}
-	async del(rpId, credentialIdB64u) {
-		await this.table.ensureSchema();
-		const r = normalizeOptionalTrimmedString(rpId);
-		const c = normalizeOptionalTrimmedString(credentialIdB64u);
-		if (!r || !c) return;
-		await this.table.prepare(`DELETE FROM webauthn_credential_bindings
-          WHERE namespace = ?
-            AND org_id = ?
-            AND project_id = ?
-            AND env_id = ?
-            AND rp_id = ?
-            AND credential_id_b64u = ?`, [r, c]).run();
-	}
-	async getMaxSignerSlot(input) {
-		await this.table.ensureSchema();
-		const userId = normalizeOptionalTrimmedString(input.userId);
-		if (!userId) return null;
-		const filter = userBindingsFilter(userId, normalizeOptionalTrimmedString(input.rpId));
-		const row = await this.table.prepare(`SELECT MAX(signer_slot) AS max_signer_slot
-           FROM webauthn_credential_bindings
-          WHERE ${filter.where}`, filter.values).first();
-		const maxSignerSlot = Number(row?.max_signer_slot);
-		return Number.isFinite(maxSignerSlot) && maxSignerSlot > 0 ? Math.floor(maxSignerSlot) : null;
-	}
-	async listByUserId(input) {
-		await this.table.ensureSchema();
-		const userId = normalizeOptionalTrimmedString(input.userId);
-		if (!userId) return [];
-		const filter = userBindingsFilter(userId, normalizeOptionalTrimmedString(input.rpId));
-		const result = await this.table.prepare(`SELECT record_json
-           FROM webauthn_credential_bindings
-          WHERE ${filter.where}
-          ORDER BY signer_slot ASC`, filter.values).all();
-		const records = [];
-		for (const row of result.results || []) {
-			const parsed = parseWebAuthnCredentialBindingRecord(parseD1JsonColumn(row.record_json));
-			if (parsed) records.push(parsed);
-		}
-		return records;
-	}
-};
-function createWebAuthnCredentialBindingStore(input) {
-	return createWebAuthnStore(input, CREDENTIAL_BINDING_STORE, {
-		d1: (options) => new D1WebAuthnCredentialBindingStore(options),
-		keyValue: (records, prefix) => new KeyValueWebAuthnCredentialBindingStore(records, prefix),
-		inMemory: (records, prefix) => new InMemoryWebAuthnCredentialBindingStore(records, prefix)
-	});
-}
 //#endregion
-export { D1WebAuthnCredentialBindingStore, WEBAUTHN_CREDENTIAL_BINDING_STORE_D1_SCHEMA_SQL, createWebAuthnCredentialBindingStore, ensureWebAuthnCredentialBindingStoreD1Schema, prepareD1WebAuthnCredentialBindingInsertStatement, prepareD1WebAuthnCredentialBindingPutStatement, resolveWebAuthnCredentialBindingStoreNamespace };
+export { prepareD1WebAuthnCredentialBindingInsertStatement, prepareD1WebAuthnCredentialBindingPutStatement };
 
 //# sourceMappingURL=WebAuthnCredentialBindingStore.js.map