@seams/wallet-server 0.6.1 → 0.7.1

package/dist/esm/core/IdentityStore.js

@@ -1,22 +1,11 @@
 import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
-import { isObject as isObject$1 } from "../shared-ts/src/utils/validation.js";
-import { resolveD1DatabaseFromConfig } from "../storage/d1Sql.js";
-import "./defaultConfigsServer.js";
-import { RedisTcpClient, UpstashRedisRestClient, redisDel, redisGetJson, redisSetJson } from "./ThresholdService/kv.js";
-import { D1IdentityStore, IDENTITY_STORE_D1_SCHEMA_SQL, ensureIdentityStoreD1Schema } from "./d1IdentityStore.js";
+import { isObject } from "../shared-ts/src/utils/validation.js";
+import { resolveStorePrefix } from "./d1TenantStore.js";
+import { createKeyValueStore } from "./storeBackends.js";
+import { D1IdentityStore, IDENTITY_D1_STORE, IDENTITY_STORE_D1_SCHEMA_SQL, ensureIdentityStoreD1Schema } from "./d1IdentityStore.js";
 //#region src/core/IdentityStore.ts
-function isObject(v) {
-	return isObject$1(v);
-}
-function toPrefixWithColon(prefix, defaultPrefix) {
-	const p = normalizeOptionalTrimmedString(prefix);
-	if (!p) return defaultPrefix;
-	return p.endsWith(":") ? p : `${p}:`;
-}
 function resolveIdentityStoreNamespace(config) {
-	const explicit = normalizeOptionalTrimmedString(config.IDENTITY_PREFIX) || normalizeOptionalTrimmedString(config.IDENTITY_MAP_PREFIX);
-	if (explicit) return toPrefixWithColon(explicit, "");
-	return `${toPrefixWithColon(normalizeOptionalTrimmedString(config.THRESHOLD_PREFIX) || "w3a", `w3a:`)}identity:`;
+	return resolveStorePrefix(config, ["IDENTITY_PREFIX", "IDENTITY_MAP_PREFIX"], "identity:");
 }
 function parseIdentitySubjectRecord(raw) {
 	if (!isObject(raw)) return null;
@@ -63,19 +52,6 @@ function parseIdentityUserRecord(raw) {
 		updatedAtMs: Math.floor(updatedAtMs)
 	};
 }
-function requireD1ScopeString(input, field) {
-	const normalized = normalizeOptionalTrimmedString(input);
-	if (!normalized) throw new Error(`${field} is required for D1 identity store`);
-	return normalized;
-}
-function d1ScopeFromConfig(input) {
-	return {
-		namespace: requireD1ScopeString(input.namespace, "namespace"),
-		orgId: requireD1ScopeString(input.config.orgId || input.config.ORG_ID, "orgId"),
-		projectId: requireD1ScopeString(input.config.projectId || input.config.PROJECT_ID, "projectId"),
-		envId: requireD1ScopeString(input.config.envId || input.config.ENV_ID, "envId")
-	};
-}
 var InMemoryIdentityStore = class {
 	constructor(prefix) {
 		this.subjectToUser = /* @__PURE__ */ new Map();
@@ -254,48 +230,10 @@ var InMemoryIdentityStore = class {
 		return { ok: true };
 	}
 };
-function isDurableObjectNamespaceLike(v) {
-	return Boolean(v) && typeof v === "object" && !Array.isArray(v) && typeof v.idFromName === "function" && typeof v.get === "function";
-}
-function resolveDoNamespaceFromConfig(config) {
-	const direct = config.namespace;
-	if (isDurableObjectNamespaceLike(direct)) return direct;
-	const alt = config.durableObjectNamespace;
-	if (isDurableObjectNamespaceLike(alt)) return alt;
-	const envStyle = config.THRESHOLD_DO_NAMESPACE;
-	if (isDurableObjectNamespaceLike(envStyle)) return envStyle;
-	return null;
-}
-function resolveDoStub(input) {
-	const id = input.namespace.idFromName(input.objectName);
-	return input.namespace.get(id);
-}
-async function callDo(stub, req) {
-	const resp = await stub.fetch("https://threshold-store.invalid/", {
-		method: "POST",
-		headers: { "content-type": "application/json" },
-		body: JSON.stringify(req)
-	});
-	const text = await resp.text();
-	if (!resp.ok) throw new Error(`Identity DO store HTTP ${resp.status}: ${text}`);
-	let json;
-	try {
-		json = text ? JSON.parse(text) : null;
-	} catch {
-		throw new Error(`Identity DO store returned non-JSON response: ${text.slice(0, 200)}`);
-	}
-	if (!isObject(json)) throw new Error("Identity DO store returned invalid JSON shape");
-	if (json.ok === true) return json;
-	const code = normalizeOptionalTrimmedString(json.code);
-	const message = normalizeOptionalTrimmedString(json.message);
-	return {
-		ok: false,
-		code: code || "internal",
-		message: message || "Identity DO store error"
-	};
-}
-var KvBackedIdentityStore = class {
-	constructor(prefix) {
+/** Upstash REST, Redis TCP and Durable Object backends, which hold records unparsed. */
+var KeyValueIdentityStore = class {
+	constructor(records, prefix) {
+		this.records = records;
 		this.prefix = prefix;
 	}
 	subjectKey(subject) {
@@ -307,12 +245,12 @@ var KvBackedIdentityStore = class {
 	async getUserIdBySubject(subject) {
 		const s = normalizeOptionalTrimmedString(subject);
 		if (!s) return null;
-		return parseIdentitySubjectRecord(await this.getJson(this.subjectKey(s)))?.userId || null;
+		return parseIdentitySubjectRecord(await this.records.get(this.subjectKey(s)))?.userId || null;
 	}
 	async listSubjectsByUserId(userId) {
 		const uid = normalizeOptionalTrimmedString(userId);
 		if (!uid) return [];
-		return parseIdentityUserRecord(await this.getJson(this.userKey(uid)))?.subjects || [];
+		return parseIdentityUserRecord(await this.records.get(this.userKey(uid)))?.subjects || [];
 	}
 	async linkSubjectToUserId(input) {
 		const userId = normalizeOptionalTrimmedString(input.userId);
@@ -328,7 +266,7 @@ var KvBackedIdentityStore = class {
 			message: "Missing subject"
 		};
 		const now = Date.now();
-		const existingSubject = parseIdentitySubjectRecord(await this.getJson(this.subjectKey(subject)));
+		const existingSubject = parseIdentitySubjectRecord(await this.records.get(this.subjectKey(subject)));
 		if (existingSubject && existingSubject.userId !== userId) {
 			if (!input.allowMoveIfSoleIdentity) return {
 				ok: false,
@@ -336,31 +274,31 @@ var KvBackedIdentityStore = class {
 				message: "Subject is already linked to a different user"
 			};
 			const sourceUser = existingSubject.userId;
-			const sourceUserRec = parseIdentityUserRecord(await this.getJson(this.userKey(sourceUser)));
+			const sourceUserRec = parseIdentityUserRecord(await this.records.get(this.userKey(sourceUser)));
 			const sourceSubjects = sourceUserRec?.subjects || [];
 			if (sourceSubjects.length !== 1 || sourceSubjects[0] !== subject) return {
 				ok: false,
 				code: "already_linked",
 				message: "Subject is linked to a different user with other identities; merge is not allowed"
 			};
-			const destUserRec = parseIdentityUserRecord(await this.getJson(this.userKey(userId)));
+			const destUserRec = parseIdentityUserRecord(await this.records.get(this.userKey(userId)));
 			const destSubjects = Array.from(new Set([...destUserRec?.subjects || [], subject]));
 			destSubjects.sort();
-			await this.setJson(this.userKey(userId), {
+			await this.records.set(this.userKey(userId), {
 				version: "identity_user_v1",
 				userId,
 				subjects: destSubjects,
 				createdAtMs: destUserRec?.createdAtMs || now,
 				updatedAtMs: now
 			});
-			await this.setJson(this.userKey(sourceUser), {
+			await this.records.set(this.userKey(sourceUser), {
 				version: "identity_user_v1",
 				userId: sourceUser,
 				subjects: [],
 				createdAtMs: sourceUserRec?.createdAtMs || existingSubject.createdAtMs || now,
 				updatedAtMs: now
 			});
-			await this.setJson(this.subjectKey(subject), {
+			await this.records.set(this.subjectKey(subject), {
 				version: "identity_subject_v1",
 				subject,
 				userId,
@@ -372,17 +310,17 @@ var KvBackedIdentityStore = class {
 				movedFromUserId: sourceUser
 			};
 		}
-		await this.setJson(this.subjectKey(subject), {
+		await this.records.set(this.subjectKey(subject), {
 			version: "identity_subject_v1",
 			subject,
 			userId,
 			createdAtMs: existingSubject?.createdAtMs || now,
 			updatedAtMs: now
 		});
-		const userRec = parseIdentityUserRecord(await this.getJson(this.userKey(userId)));
+		const userRec = parseIdentityUserRecord(await this.records.get(this.userKey(userId)));
 		const subjects = Array.from(new Set([...userRec?.subjects || [], subject]));
 		subjects.sort();
-		await this.setJson(this.userKey(userId), {
+		await this.records.set(this.userKey(userId), {
 			version: "identity_user_v1",
 			userId,
 			subjects,
@@ -404,13 +342,13 @@ var KvBackedIdentityStore = class {
 			code: "invalid_args",
 			message: "Missing subject"
 		};
-		const subjectRec = parseIdentitySubjectRecord(await this.getJson(this.subjectKey(subject)));
+		const subjectRec = parseIdentitySubjectRecord(await this.records.get(this.subjectKey(subject)));
 		if (!subjectRec || subjectRec.userId !== userId) return {
 			ok: false,
 			code: "not_found",
 			message: "Subject is not linked to this user"
 		};
-		const userRec = parseIdentityUserRecord(await this.getJson(this.userKey(userId)));
+		const userRec = parseIdentityUserRecord(await this.records.get(this.userKey(userId)));
 		const subjects = userRec?.subjects || [];
 		if (subjects.length <= 1) return {
 			ok: false,
@@ -419,14 +357,14 @@ var KvBackedIdentityStore = class {
 		};
 		const nextSubjects = subjects.filter((s) => s !== subject);
 		nextSubjects.sort();
-		await this.setJson(this.userKey(userId), {
+		await this.records.set(this.userKey(userId), {
 			version: "identity_user_v1",
 			userId,
 			subjects: nextSubjects,
 			createdAtMs: userRec?.createdAtMs || Date.now(),
 			updatedAtMs: Date.now()
 		});
-		await this.del(this.subjectKey(subject));
+		await this.records.del(this.subjectKey(subject));
 		return { ok: true };
 	}
 	async deleteSubjectLinkForDevCleanup(input) {
@@ -442,174 +380,45 @@ var KvBackedIdentityStore = class {
 			code: "invalid_args",
 			message: "Missing subject"
 		};
-		const subjectRec = parseIdentitySubjectRecord(await this.getJson(this.subjectKey(subject)));
+		const subjectRec = parseIdentitySubjectRecord(await this.records.get(this.subjectKey(subject)));
 		if (!subjectRec || subjectRec.userId !== userId) return {
 			ok: false,
 			code: "not_found",
 			message: "Subject is not linked to this user"
 		};
-		const userRec = parseIdentityUserRecord(await this.getJson(this.userKey(userId)));
+		const userRec = parseIdentityUserRecord(await this.records.get(this.userKey(userId)));
 		const nextSubjects = (userRec?.subjects || []).filter((s) => s !== subject);
 		if (nextSubjects.length > 0) {
 			nextSubjects.sort();
-			await this.setJson(this.userKey(userId), {
+			await this.records.set(this.userKey(userId), {
 				version: "identity_user_v1",
 				userId,
 				subjects: nextSubjects,
 				createdAtMs: userRec?.createdAtMs || Date.now(),
 				updatedAtMs: Date.now()
 			});
-		} else await this.del(this.userKey(userId));
-		await this.del(this.subjectKey(subject));
+		} else await this.records.del(this.userKey(userId));
+		await this.records.del(this.subjectKey(subject));
 		return { ok: true };
 	}
 };
-var UpstashRedisRestIdentityStore = class extends KvBackedIdentityStore {
-	constructor(input) {
-		super(input.prefix);
-		this.client = new UpstashRedisRestClient({
-			url: input.url,
-			token: input.token
-		});
-	}
-	getJson(key) {
-		return this.client.getJson(key);
-	}
-	setJson(key, value) {
-		return this.client.setJson(key, value);
-	}
-	del(key) {
-		return this.client.del(key);
-	}
-};
-var RedisTcpIdentityStore = class extends KvBackedIdentityStore {
-	constructor(input) {
-		super(input.prefix);
-		this.client = new RedisTcpClient(input.redisUrl);
-	}
-	getJson(key) {
-		return redisGetJson(this.client, key);
-	}
-	setJson(key, value) {
-		return redisSetJson(this.client, key, value);
-	}
-	del(key) {
-		return redisDel(this.client, key);
-	}
-};
-var CloudflareDurableObjectIdentityStore = class extends KvBackedIdentityStore {
-	constructor(input) {
-		super(input.prefix);
-		this.stub = resolveDoStub({
-			namespace: input.namespace,
-			objectName: input.objectName
-		});
-	}
-	async getJson(key) {
-		const resp = await callDo(this.stub, {
-			op: "get",
-			key
-		});
-		if (!resp.ok) return null;
-		return resp.value;
-	}
-	async setJson(key, value) {
-		const resp = await callDo(this.stub, {
-			op: "set",
-			key,
-			value
-		});
-		if (!resp.ok) throw new Error(resp.message);
-	}
-	async del(key) {
-		const resp = await callDo(this.stub, {
-			op: "del",
-			key
-		});
-		if (!resp.ok) throw new Error(resp.message);
-	}
+const IDENTITY_STORE = {
+	tag: "identity",
+	label: "identity",
+	connectionErrorSubject: "identity store",
+	durableObjectLog: "identity store",
+	durableObjectErrorName: "Identity",
+	unconfiguredNote: "non-persistent",
+	d1StoreName: IDENTITY_D1_STORE,
+	resolvePrefix: resolveIdentityStoreNamespace,
+	parse: (raw) => raw
 };
 function createIdentityStore(input) {
-	const config = isObject(input.config) ? input.config : {};
-	const prefix = resolveIdentityStoreNamespace(config);
-	const kind = normalizeOptionalTrimmedString(config.kind);
-	if (kind === "d1") {
-		const database = resolveD1DatabaseFromConfig(config);
-		if (!database) throw new Error("[identity] D1 identity store selected but no D1 database was provided");
-		input.logger.info("[identity] Using D1 identity store");
-		return new D1IdentityStore({
-			database,
-			...d1ScopeFromConfig({
-				config,
-				namespace: prefix
-			})
-		});
-	}
-	if (kind === "cloudflare-do") {
-		const namespace = resolveDoNamespaceFromConfig(config);
-		if (!namespace) throw new Error("cloudflare-do identity store selected but no Durable Object namespace was provided (expected config.namespace)");
-		const objectName = normalizeOptionalTrimmedString(config.objectName) || normalizeOptionalTrimmedString(config.name) || "threshold-store";
-		input.logger.info("[identity] Using Cloudflare Durable Object identity store");
-		return new CloudflareDurableObjectIdentityStore({
-			namespace,
-			objectName,
-			prefix
-		});
-	}
-	if (kind === "in-memory") {
-		input.logger.info("[identity] Using in-memory identity store (non-persistent)");
-		return new InMemoryIdentityStore(prefix);
-	}
-	if (kind === "upstash-redis-rest") {
-		const url = normalizeOptionalTrimmedString(config.url) || normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_URL);
-		const token = normalizeOptionalTrimmedString(config.token) || normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_TOKEN);
-		if (!url || !token) throw new Error("Upstash identity store enabled but url/token are not both set");
-		input.logger.info("[identity] Using Upstash REST identity store");
-		return new UpstashRedisRestIdentityStore({
-			url,
-			token,
-			prefix
-		});
-	}
-	if (kind === "redis-tcp") {
-		if (!input.isNode) {
-			input.logger.warn("[identity] redis-tcp identity store is not supported in this runtime; falling back to in-memory");
-			return new InMemoryIdentityStore(prefix);
-		}
-		const redisUrl = normalizeOptionalTrimmedString(config.redisUrl) || normalizeOptionalTrimmedString(config.REDIS_URL);
-		if (!redisUrl) throw new Error("redis-tcp identity store enabled but redisUrl is not set");
-		input.logger.info("[identity] Using redis-tcp identity store");
-		return new RedisTcpIdentityStore({
-			redisUrl,
-			prefix
-		});
-	}
-	if (kind) throw new Error(`[identity] Unknown identity store kind: ${kind}`);
-	const upstashUrl = normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_URL);
-	const upstashToken = normalizeOptionalTrimmedString(config.UPSTASH_REDIS_REST_TOKEN);
-	if (upstashUrl || upstashToken) {
-		if (!upstashUrl || !upstashToken) throw new Error("Upstash identity store enabled but UPSTASH_REDIS_REST_URL / UPSTASH_REDIS_REST_TOKEN are not both set");
-		input.logger.info("[identity] Using Upstash REST identity store");
-		return new UpstashRedisRestIdentityStore({
-			url: upstashUrl,
-			token: upstashToken,
-			prefix
-		});
-	}
-	const redisUrl = normalizeOptionalTrimmedString(config.REDIS_URL);
-	if (redisUrl) {
-		if (!input.isNode) {
-			input.logger.warn("[identity] REDIS_URL is set but TCP Redis is not supported in this runtime; falling back to in-memory");
-			return new InMemoryIdentityStore(prefix);
-		}
-		input.logger.info("[identity] Using redis-tcp identity store");
-		return new RedisTcpIdentityStore({
-			redisUrl,
-			prefix
-		});
-	}
-	input.logger.info("[identity] Using in-memory identity store (non-persistent)");
-	return new InMemoryIdentityStore(prefix);
+	return createKeyValueStore(input, IDENTITY_STORE, {
+		d1: (options) => new D1IdentityStore(options),
+		keyValue: (records, prefix) => new KeyValueIdentityStore(records, prefix),
+		inMemory: (prefix) => new InMemoryIdentityStore(prefix)
+	});
 }
 //#endregion
 export { D1IdentityStore, IDENTITY_STORE_D1_SCHEMA_SQL, createIdentityStore, ensureIdentityStoreD1Schema, resolveIdentityStoreNamespace };

package/dist/esm/core/NearPublicKeyStore.js

@@ -1,8 +1,10 @@
 import { parseWebAuthnRpId } from "../shared-ts/src/utils/domainIds.js";
 import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
-import { isObject as isObject$1 } from "../shared-ts/src/utils/validation.js";
-import { formatD1ExecStatement, parseD1JsonColumn, resolveD1DatabaseFromConfig } from "../storage/d1Sql.js";
+import { isObject } from "../shared-ts/src/utils/validation.js";
+import { parseD1JsonColumn, resolveD1DatabaseFromConfig } from "../storage/d1Sql.js";
+import { D1TenantTable, d1TenantScopeFromConfig, ensureD1Schema } from "./d1TenantStore.js";
 //#region src/core/NearPublicKeyStore.ts
+const NEAR_PUBLIC_KEY_D1_STORE = "NEAR public key store";
 const NEAR_PUBLIC_KEY_STORE_D1_SCHEMA_SQL = Object.freeze([`
     CREATE TABLE IF NOT EXISTS near_public_keys (
       namespace TEXT NOT NULL,
@@ -40,10 +42,7 @@ const NEAR_PUBLIC_KEY_STORE_D1_SCHEMA_SQL = Object.freeze([`
       )
   `]);
 async function ensureNearPublicKeyStoreD1Schema(options) {
-	for (const statement of NEAR_PUBLIC_KEY_STORE_D1_SCHEMA_SQL) await options.database.exec(formatD1ExecStatement(statement));
-}
-function isObject(v) {
-	return isObject$1(v);
+	await ensureD1Schema(options.database, NEAR_PUBLIC_KEY_STORE_D1_SCHEMA_SQL);
 }
 function parseNearPublicKeyKind(input) {
 	const k = normalizeOptionalTrimmedString(input);
@@ -98,29 +97,6 @@ function parseNearPublicKeyRecord(raw) {
 		...Number.isFinite(removedAtMs) && removedAtMs > 0 ? { removedAtMs: Math.floor(removedAtMs) } : {}
 	};
 }
-function requireD1ScopeString(input, field) {
-	const normalized = normalizeOptionalTrimmedString(input);
-	if (!normalized) throw new Error(`${field} is required for D1 NEAR public key store`);
-	return normalized;
-}
-function normalizeD1NearPublicKeyStoreOptions(input) {
-	return {
-		database: input.database,
-		namespace: requireD1ScopeString(input.namespace, "namespace"),
-		orgId: requireD1ScopeString(input.orgId, "orgId"),
-		projectId: requireD1ScopeString(input.projectId, "projectId"),
-		envId: requireD1ScopeString(input.envId, "envId"),
-		ensureSchema: input.ensureSchema !== false
-	};
-}
-function d1ScopeFromConfig(input) {
-	return {
-		namespace: requireD1ScopeString(input.namespace, "namespace"),
-		orgId: requireD1ScopeString(input.config.orgId || input.config.ORG_ID, "orgId"),
-		projectId: requireD1ScopeString(input.config.projectId || input.config.PROJECT_ID, "projectId"),
-		envId: requireD1ScopeString(input.config.envId || input.config.ENV_ID, "envId")
-	};
-}
 var InMemoryNearPublicKeyStore = class {
 	constructor() {
 		this.byUser = /* @__PURE__ */ new Map();
@@ -143,33 +119,25 @@ var InMemoryNearPublicKeyStore = class {
 		return out;
 	}
 };
+/** A user's NEAR public keys, in signer-slot order; binds the scope, then the user. */
+const NEAR_PUBLIC_KEYS_BY_USER_SQL = `SELECT record_json
+         FROM near_public_keys
+        WHERE namespace = ?
+          AND org_id = ?
+          AND project_id = ?
+          AND env_id = ?
+          AND user_id = ?
+        ORDER BY COALESCE(signer_slot, 0) ASC, created_at_ms ASC, public_key ASC`;
 var D1NearPublicKeyStore = class {
 	constructor(input) {
 		this.adapterKind = "d1";
-		this.schemaReady = false;
-		const normalized = normalizeD1NearPublicKeyStoreOptions(input);
-		this.database = normalized.database;
-		this.scope = {
-			namespace: normalized.namespace,
-			orgId: normalized.orgId,
-			projectId: normalized.projectId,
-			envId: normalized.envId
-		};
-		this.ensureSchemaOnUse = normalized.ensureSchema;
-	}
-	async ensureSchema() {
-		if (!this.ensureSchemaOnUse || this.schemaReady) return;
-		await ensureNearPublicKeyStoreD1Schema({ database: this.database });
-		this.schemaReady = true;
-	}
-	bindScope(statement, values = []) {
-		return this.database.prepare(statement).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, ...values);
+		this.table = new D1TenantTable(input, NEAR_PUBLIC_KEY_D1_STORE, NEAR_PUBLIC_KEY_STORE_D1_SCHEMA_SQL);
 	}
 	async put(record) {
-		await this.ensureSchema();
+		await this.table.ensureSchema();
 		const parsed = parseNearPublicKeyRecord(record);
 		if (!parsed) throw new Error("Invalid near public key record");
-		await this.bindScope(`INSERT INTO near_public_keys (
+		await this.table.prepare(`INSERT INTO near_public_keys (
         namespace,
         org_id,
         project_id,
@@ -203,17 +171,10 @@ var D1NearPublicKeyStore = class {
 		]).run();
 	}
 	async listByUserId(userId) {
-		await this.ensureSchema();
+		await this.table.ensureSchema();
 		const uid = normalizeOptionalTrimmedString(userId);
 		if (!uid) return [];
-		return ((await this.bindScope(`SELECT record_json
-         FROM near_public_keys
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND user_id = ?
-        ORDER BY COALESCE(signer_slot, 0) ASC, created_at_ms ASC, public_key ASC`, [uid]).all()).results || []).map((row) => parseNearPublicKeyRecord(parseD1JsonColumn(row.record_json))).filter((record) => Boolean(record));
+		return ((await this.table.prepare(NEAR_PUBLIC_KEYS_BY_USER_SQL, [uid]).all()).results || []).map((row) => parseNearPublicKeyRecord(parseD1JsonColumn(row.record_json))).filter((record) => Boolean(record));
 	}
 };
 function createNearPublicKeyStore(input) {
@@ -226,10 +187,7 @@ function createNearPublicKeyStore(input) {
 		input.logger.info("[near-public-keys] Using D1 store for NEAR public key metadata");
 		return new D1NearPublicKeyStore({
 			database,
-			...d1ScopeFromConfig({
-				config,
-				namespace
-			})
+			...d1TenantScopeFromConfig(config, namespace, NEAR_PUBLIC_KEY_D1_STORE)
 		});
 	}
 	if (kind) throw new Error(`[near-public-keys] Unknown NEAR public key store kind: ${kind}`);
@@ -237,6 +195,6 @@ function createNearPublicKeyStore(input) {
 	return new InMemoryNearPublicKeyStore();
 }
 //#endregion
-export { D1NearPublicKeyStore, NEAR_PUBLIC_KEY_STORE_D1_SCHEMA_SQL, createNearPublicKeyStore, ensureNearPublicKeyStoreD1Schema };
+export { D1NearPublicKeyStore, NEAR_PUBLIC_KEYS_BY_USER_SQL, NEAR_PUBLIC_KEY_STORE_D1_SCHEMA_SQL, createNearPublicKeyStore, ensureNearPublicKeyStoreD1Schema };
 
 //# sourceMappingURL=NearPublicKeyStore.js.map