@seams/wallet-server 0.6.2 → 0.7.1

package/dist/esm/core/authService/webauthnVerificationOutcomes.js

@@ -0,0 +1,60 @@
+//#region src/core/authService/webauthnVerificationOutcomes.ts
+/** The failure a login or sync returns when its assertion did not verify; null when it did. */
+function webAuthnAuthenticationFailure(verification) {
+	if (!verification.success || !verification.verified) return {
+		ok: false,
+		verified: false,
+		code: verification.code || "not_verified",
+		message: verification.message || "Authentication verification failed"
+	};
+	return null;
+}
+/**
+* The logged-in credential's Ed25519 signer. It is active only when the binding carries every
+* fact signing needs, and absent while the wallet's Ed25519 signer has not settled.
+*/
+function webAuthnLoginEd25519(binding, walletBinding) {
+	const firstParticipantId = binding?.participantIds?.[0];
+	const secondParticipantId = binding?.participantIds?.[1];
+	if (!binding) return {
+		ok: false,
+		verified: false,
+		code: "unknown_credential",
+		message: "Credential has no wallet binding"
+	};
+	return {
+		ok: true,
+		ed25519: walletBinding && binding.publicKey && binding.relayerKeyId && firstParticipantId !== void 0 && secondParticipantId !== void 0 ? {
+			kind: "active",
+			nearAccountId: walletBinding.nearAccountId,
+			nearEd25519SigningKeyId: walletBinding.nearEd25519SigningKeyId,
+			signerSlot: walletBinding.signerSlot,
+			publicKey: binding.publicKey,
+			relayerKeyId: binding.relayerKeyId,
+			participantIds: [firstParticipantId, secondParticipantId]
+		} : { kind: "absent" }
+	};
+}
+/** The sync credential's binding, if it exists and belongs to the account the challenge expects. */
+function webAuthnSyncCredentialBinding(binding, challenge) {
+	if (!binding) return {
+		ok: false,
+		verified: false,
+		code: "unknown_credential",
+		message: "Credential is not registered on this relay"
+	};
+	if (challenge.expectedUserId && binding.userId !== challenge.expectedUserId) return {
+		ok: false,
+		verified: false,
+		code: "unknown_credential",
+		message: `Credential is not registered for account ${challenge.expectedUserId}`
+	};
+	return {
+		ok: true,
+		binding
+	};
+}
+//#endregion
+export { webAuthnAuthenticationFailure, webAuthnLoginEd25519, webAuthnSyncCredentialBinding };
+
+//# sourceMappingURL=webauthnVerificationOutcomes.js.map

package/dist/esm/core/authService/webauthnWalletBinding.js

@@ -1,20 +1,7 @@
-import { parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../shared-ts/src/utils/domainIds.js";
-import { walletIdFromString } from "../../shared-ts/src/utils/registrationIntent.js";
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import "../../shared-ts/src/utils/validation.js";
-import { isPasskeyWalletAuthAuthority, parseWalletAuthAuthority, walletAuthAuthoritiesMatch } from "../../shared-ts/src/utils/walletAuthAuthority.js";
-import { parseRouterAbEd25519NormalSigningState } from "../../shared-ts/src/utils/signingSessionSeal.js";
-import { normalizeThresholdRuntimePolicyScope } from "./thresholdRuntimePolicy.js";
+import { walletIdFromString } from "../../shared-ts/src/utils/registrationIds.js";
 //#region src/core/authService/webauthnWalletBinding.ts
-async function resolveExistingThresholdEd25519Binding(args) {
-	if (typeof args.bindingStore.listByUserId !== "function") return void 0;
-	return (await args.bindingStore.listByUserId({
-		userId: args.userId,
-		rpId: args.rpId
-	})).find((binding) => {
-		return Boolean(normalizeOptionalTrimmedString(binding.relayerKeyId) && normalizeOptionalTrimmedString(binding.publicKey) && normalizeOptionalTrimmedString(binding.keyVersion) && binding.recoveryExportCapable === true);
-	});
-}
 function parseBoundaryWalletId(raw) {
 	const value = normalizeOptionalTrimmedString(raw);
 	if (!value) return null;
@@ -44,114 +31,7 @@ function resolvedEd25519WalletBindingFromCredentialBinding(args) {
 		signerSlot: Number(resolvedSignerSlot)
 	};
 }
-function resolveThresholdEd25519SessionPolicyForBinding(args) {
-	if (Object.prototype.hasOwnProperty.call(args.requestedSessionPolicy, "rpId")) throw new Error("threshold-ed25519 session policy rpId belongs in authority");
-	if (Object.prototype.hasOwnProperty.call(args.requestedSessionPolicy, "authorityScope")) throw new Error("threshold-ed25519 session policy authorityScope is obsolete; use authority");
-	const requestedWalletId = normalizeOptionalTrimmedString(args.requestedSessionPolicy.walletId);
-	if (requestedWalletId && requestedWalletId !== args.binding.walletId) throw new Error("threshold-ed25519 session policy walletId mismatch");
-	const requestedNearAccountId = normalizeOptionalTrimmedString(args.requestedSessionPolicy.nearAccountId);
-	if (requestedNearAccountId && requestedNearAccountId !== args.binding.nearAccountId) throw new Error("threshold-ed25519 session policy nearAccountId mismatch");
-	const requestedNearEd25519SigningKeyId = normalizeOptionalTrimmedString(args.requestedSessionPolicy.nearEd25519SigningKeyId);
-	if (requestedNearEd25519SigningKeyId && requestedNearEd25519SigningKeyId !== args.binding.nearEd25519SigningKeyId) throw new Error("threshold-ed25519 session policy nearEd25519SigningKeyId mismatch");
-	const runtimePolicyScope = normalizeThresholdRuntimePolicyScope(args.requestedSessionPolicy.runtimePolicyScope) || args.persistedRuntimePolicyScope;
-	const rpId = parseWebAuthnRpId(args.binding.rpId);
-	if (!rpId.ok) throw new Error("threshold-ed25519 session binding rpId is invalid");
-	const thresholdSessionId = normalizeOptionalTrimmedString(args.requestedSessionPolicy.thresholdSessionId);
-	const ttlMs = Number(args.requestedSessionPolicy.ttlMs);
-	const remainingUses = Number(args.requestedSessionPolicy.remainingUses);
-	const participantIds = Array.isArray(args.requestedSessionPolicy.participantIds) ? args.requestedSessionPolicy.participantIds.map((participantId) => Number(participantId)).filter((participantId) => Number.isSafeInteger(participantId) && participantId > 0) : void 0;
-	const routerAbNormalSigning = parseRouterAbEd25519NormalSigningState(args.requestedSessionPolicy.routerAbNormalSigning);
-	const expectedAuthority = passkeyWalletAuthAuthorityForBinding({
-		walletAuthMethodId: args.walletAuthMethodId,
-		walletId: parseRequiredWalletId(args.binding.walletId),
-		rpId: rpId.value,
-		credentialIdB64u: parseRequiredCredentialId(args.binding.credentialIdB64u)
-	});
-	const requestedAuthority = parseWalletAuthAuthority(args.requestedSessionPolicy.authority);
-	if (!requestedAuthority) throw new Error("threshold-ed25519 session policy authority is required");
-	if (!walletAuthAuthoritiesMatch(requestedAuthority, expectedAuthority)) throw new Error("threshold-ed25519 session policy authority mismatch");
-	if (args.requestedSessionPolicy.version !== "threshold_session_v1" || !thresholdSessionId || !Number.isFinite(ttlMs) || ttlMs <= 0 || !Number.isFinite(remainingUses) || remainingUses <= 0) throw new Error("threshold-ed25519 session policy is incomplete");
-	return {
-		sessionPolicy: {
-			version: "threshold_session_v1",
-			nearAccountId: args.binding.nearAccountId,
-			nearEd25519SigningKeyId: args.binding.nearEd25519SigningKeyId,
-			authority: expectedAuthority,
-			relayerKeyId: args.relayerKeyId,
-			thresholdSessionId,
-			...runtimePolicyScope ? { runtimePolicyScope } : {},
-			...routerAbNormalSigning ? { routerAbNormalSigning } : {},
-			...participantIds && participantIds.length > 0 ? { participantIds } : {},
-			ttlMs: Math.floor(ttlMs),
-			remainingUses: Math.floor(remainingUses)
-		},
-		...runtimePolicyScope ? { runtimePolicyScope } : {}
-	};
-}
-function resolveRecoveryThresholdEd25519SessionPolicyForBinding(args) {
-	if (Object.prototype.hasOwnProperty.call(args.requestedSessionPolicy, "rpId")) throw new Error("threshold-ed25519 session policy rpId belongs in authority");
-	if (Object.prototype.hasOwnProperty.call(args.requestedSessionPolicy, "authorityScope")) throw new Error("threshold-ed25519 session policy authorityScope is obsolete; use authority");
-	const requestedWalletId = normalizeOptionalTrimmedString(args.requestedSessionPolicy.walletId);
-	if (requestedWalletId && requestedWalletId !== args.binding.walletId) throw new Error("threshold-ed25519 session policy walletId mismatch");
-	const requestedNearAccountId = normalizeOptionalTrimmedString(args.requestedSessionPolicy.nearAccountId);
-	if (requestedNearAccountId && requestedNearAccountId !== args.binding.nearAccountId) throw new Error("threshold-ed25519 session policy nearAccountId mismatch");
-	const requestedNearEd25519SigningKeyId = normalizeOptionalTrimmedString(args.requestedSessionPolicy.nearEd25519SigningKeyId);
-	if (requestedNearEd25519SigningKeyId && requestedNearEd25519SigningKeyId !== args.binding.nearEd25519SigningKeyId) throw new Error("threshold-ed25519 session policy nearEd25519SigningKeyId mismatch");
-	const requestedAuthority = parseWalletAuthAuthority(args.requestedSessionPolicy.authority);
-	if (!requestedAuthority) throw new Error("threshold-ed25519 session policy authority is required");
-	if (!isPasskeyWalletAuthAuthority(requestedAuthority)) throw new Error("wallet recovery threshold session authority must be passkey");
-	if (requestedAuthority.walletId !== args.binding.walletId) throw new Error("wallet recovery threshold session authority walletId mismatch");
-	if (requestedAuthority.bindingId !== args.walletAuthMethodId) throw new Error("wallet recovery threshold session authority auth method mismatch");
-	if (requestedAuthority.verifier.rpId !== args.binding.rpId) throw new Error("wallet recovery threshold session authority rpId mismatch");
-	const runtimePolicyScope = normalizeThresholdRuntimePolicyScope(args.requestedSessionPolicy.runtimePolicyScope) || args.persistedRuntimePolicyScope;
-	const thresholdSessionId = normalizeOptionalTrimmedString(args.requestedSessionPolicy.thresholdSessionId);
-	const ttlMs = Number(args.requestedSessionPolicy.ttlMs);
-	const remainingUses = Number(args.requestedSessionPolicy.remainingUses);
-	const participantIds = Array.isArray(args.requestedSessionPolicy.participantIds) ? args.requestedSessionPolicy.participantIds.map((participantId) => Number(participantId)).filter((participantId) => Number.isSafeInteger(participantId) && participantId > 0) : void 0;
-	const routerAbNormalSigning = parseRouterAbEd25519NormalSigningState(args.requestedSessionPolicy.routerAbNormalSigning);
-	if (args.requestedSessionPolicy.version !== "threshold_session_v1" || !thresholdSessionId || !Number.isFinite(ttlMs) || ttlMs <= 0 || !Number.isFinite(remainingUses) || remainingUses <= 0) throw new Error("threshold-ed25519 session policy is incomplete");
-	return {
-		sessionPolicy: {
-			version: "threshold_session_v1",
-			nearAccountId: args.binding.nearAccountId,
-			nearEd25519SigningKeyId: args.binding.nearEd25519SigningKeyId,
-			authority: requestedAuthority,
-			relayerKeyId: args.relayerKeyId,
-			thresholdSessionId,
-			...runtimePolicyScope ? { runtimePolicyScope } : {},
-			...routerAbNormalSigning ? { routerAbNormalSigning } : {},
-			...participantIds && participantIds.length > 0 ? { participantIds } : {},
-			ttlMs: Math.floor(ttlMs),
-			remainingUses: Math.floor(remainingUses)
-		},
-		...runtimePolicyScope ? { runtimePolicyScope } : {}
-	};
-}
-function parseRequiredWalletId(raw) {
-	const parsed = parseWalletId(raw);
-	if (!parsed.ok) throw new Error("threshold-ed25519 session binding walletId is invalid");
-	return parsed.value;
-}
-function parseRequiredCredentialId(raw) {
-	const parsed = parseWebAuthnCredentialIdB64u(raw);
-	if (!parsed.ok) throw new Error("threshold-ed25519 session binding credentialId is invalid");
-	return parsed.value;
-}
-function passkeyWalletAuthAuthorityForBinding(input) {
-	return {
-		walletId: input.walletId,
-		factor: {
-			kind: "passkey",
-			credentialIdB64u: input.credentialIdB64u
-		},
-		verifier: {
-			kind: "webauthn",
-			rpId: input.rpId
-		},
-		bindingId: input.walletAuthMethodId
-	};
-}
 //#endregion
-export { parseBoundaryWalletId, resolveExistingThresholdEd25519Binding, resolveRecoveryThresholdEd25519SessionPolicyForBinding, resolveThresholdEd25519SessionPolicyForBinding, resolvedEd25519WalletBindingFromCredentialBinding };
+export { parseBoundaryWalletId, resolvedEd25519WalletBindingFromCredentialBinding };
 
 //# sourceMappingURL=webauthnWalletBinding.js.map

package/dist/esm/core/d1IdentityStore.js

@@ -1,7 +1,18 @@
 import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
 import "../shared-ts/src/utils/validation.js";
-import { d1ChangedRows, formatD1ExecStatement } from "../storage/d1Sql.js";
+import { d1ChangedRows } from "../storage/d1Sql.js";
+import { D1TenantTable, ensureD1Schema } from "./d1TenantStore.js";
 //#region src/core/d1IdentityStore.ts
+/** Names the identity store in D1 scope errors. */
+const IDENTITY_D1_STORE = "identity store";
+/** How many subjects the user has; binds the scope, then the user. */
+const SUBJECT_COUNT_SQL = `SELECT COUNT(*) AS subject_count
+         FROM identity_links
+        WHERE namespace = ?
+          AND org_id = ?
+          AND project_id = ?
+          AND env_id = ?
+          AND user_id = ?`;
 const IDENTITY_STORE_D1_SCHEMA_SQL = Object.freeze([`
     CREATE TABLE IF NOT EXISTS identity_links (
       namespace TEXT NOT NULL,
@@ -41,27 +52,11 @@ const IDENTITY_STORE_D1_SCHEMA_SQL = Object.freeze([`
       )
   `]);
 async function ensureIdentityStoreD1Schema(options) {
-	for (const statement of IDENTITY_STORE_D1_SCHEMA_SQL) await options.database.exec(formatD1ExecStatement(statement));
+	await ensureD1Schema(options.database, IDENTITY_STORE_D1_SCHEMA_SQL);
 }
 function defaultNow() {
 	return /* @__PURE__ */ new Date();
 }
-function requireD1ScopeString(input, field) {
-	const normalized = normalizeOptionalTrimmedString(input);
-	if (!normalized) throw new Error(`${field} is required for D1 identity store`);
-	return normalized;
-}
-function normalizeD1IdentityStoreOptions(input) {
-	return {
-		database: input.database,
-		namespace: requireD1ScopeString(input.namespace, "namespace"),
-		orgId: requireD1ScopeString(input.orgId, "orgId"),
-		projectId: requireD1ScopeString(input.projectId, "projectId"),
-		envId: requireD1ScopeString(input.envId, "envId"),
-		ensureSchema: input.ensureSchema !== false,
-		now: input.now || defaultNow
-	};
-}
 function parseSubjectCount(raw) {
 	const count = Number(raw);
 	return Number.isFinite(count) && count >= 0 ? Math.floor(count) : 0;
@@ -84,31 +79,14 @@ function buildIdentitySubjectRecord(input) {
 var D1IdentityStore = class {
 	constructor(input) {
 		this.adapterKind = "d1";
-		this.schemaReady = false;
-		const normalized = normalizeD1IdentityStoreOptions(input);
-		this.database = normalized.database;
-		this.scope = {
-			namespace: normalized.namespace,
-			orgId: normalized.orgId,
-			projectId: normalized.projectId,
-			envId: normalized.envId
-		};
-		this.ensureSchemaOnUse = normalized.ensureSchema;
-		this.now = normalized.now;
-	}
-	async ensureSchema() {
-		if (!this.ensureSchemaOnUse || this.schemaReady) return;
-		await ensureIdentityStoreD1Schema({ database: this.database });
-		this.schemaReady = true;
-	}
-	bindScope(statement, values = []) {
-		return this.database.prepare(statement).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, ...values);
+		this.table = new D1TenantTable(input, IDENTITY_D1_STORE, IDENTITY_STORE_D1_SCHEMA_SQL);
+		this.now = input.now || defaultNow;
 	}
 	async getUserIdBySubject(subject) {
-		await this.ensureSchema();
+		await this.table.ensureSchema();
 		const normalizedSubject = normalizeOptionalTrimmedString(subject);
 		if (!normalizedSubject) return null;
-		return normalizeOptionalTrimmedString((await this.bindScope(`SELECT user_id
+		return normalizeOptionalTrimmedString((await this.table.prepare(`SELECT user_id
          FROM identity_links
         WHERE namespace = ?
           AND org_id = ?
@@ -118,10 +96,10 @@ var D1IdentityStore = class {
         LIMIT 1`, [normalizedSubject]).first())?.user_id) || null;
 	}
 	async listSubjectsByUserId(userId) {
-		await this.ensureSchema();
+		await this.table.ensureSchema();
 		const normalizedUserId = normalizeOptionalTrimmedString(userId);
 		if (!normalizedUserId) return [];
-		return ((await this.bindScope(`SELECT subject
+		return ((await this.table.prepare(`SELECT subject
          FROM identity_links
         WHERE namespace = ?
           AND org_id = ?
@@ -131,7 +109,7 @@ var D1IdentityStore = class {
         ORDER BY created_at_ms ASC`, [normalizedUserId]).all()).results || []).map(subjectFromIdentityLinkRow).filter(isPresentString);
 	}
 	async linkSubjectToUserId(input) {
-		await this.ensureSchema();
+		await this.table.ensureSchema();
 		const userId = normalizeOptionalTrimmedString(input.userId);
 		const subject = normalizeOptionalTrimmedString(input.subject);
 		if (!userId) return {
@@ -145,7 +123,7 @@ var D1IdentityStore = class {
 			message: "Missing subject"
 		};
 		const now = this.now().getTime();
-		const existing = await this.bindScope(`SELECT user_id, created_at_ms
+		const existing = await this.table.prepare(`SELECT user_id, created_at_ms
          FROM identity_links
         WHERE namespace = ?
           AND org_id = ?
@@ -162,7 +140,7 @@ var D1IdentityStore = class {
 				code: "already_linked",
 				message: "Subject is already linked to a different user"
 			};
-			if (d1ChangedRows(await this.database.prepare(`UPDATE identity_links
+			if (d1ChangedRows(await this.table.database.prepare(`UPDATE identity_links
             SET user_id = ?,
                 record_json = ?,
                 updated_at_ms = ?
@@ -185,17 +163,11 @@ var D1IdentityStore = class {
 				userId,
 				createdAtMs,
 				updatedAtMs: now
-			})), now, this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, subject, existingUserId, this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, existingUserId).run()) > 0) return {
+			})), now, this.table.scope.namespace, this.table.scope.orgId, this.table.scope.projectId, this.table.scope.envId, subject, existingUserId, this.table.scope.namespace, this.table.scope.orgId, this.table.scope.projectId, this.table.scope.envId, existingUserId).run()) > 0) return {
 				ok: true,
 				movedFromUserId: existingUserId
 			};
-			if (parseSubjectCount((await this.bindScope(`SELECT COUNT(*) AS subject_count
-           FROM identity_links
-          WHERE namespace = ?
-            AND org_id = ?
-            AND project_id = ?
-            AND env_id = ?
-            AND user_id = ?`, [existingUserId]).first())?.subject_count) !== 1) return {
+			if (parseSubjectCount((await this.table.prepare(SUBJECT_COUNT_SQL, [existingUserId]).first())?.subject_count) !== 1) return {
 				ok: false,
 				code: "already_linked",
 				message: "Subject is linked to a different user with other identities; merge is not allowed"
@@ -206,7 +178,7 @@ var D1IdentityStore = class {
 				message: "Subject is already linked to a different user"
 			};
 		}
-		await this.bindScope(`INSERT INTO identity_links (
+		await this.table.prepare(`INSERT INTO identity_links (
         namespace,
         org_id,
         project_id,
@@ -249,7 +221,7 @@ var D1IdentityStore = class {
 		};
 	}
 	async unlinkSubjectFromUserId(input) {
-		await this.ensureSchema();
+		await this.table.ensureSchema();
 		const userId = normalizeOptionalTrimmedString(input.userId);
 		const subject = normalizeOptionalTrimmedString(input.subject);
 		if (!userId) return {
@@ -262,7 +234,7 @@ var D1IdentityStore = class {
 			code: "invalid_args",
 			message: "Missing subject"
 		};
-		if (d1ChangedRows(await this.database.prepare(`DELETE FROM identity_links
+		if (d1ChangedRows(await this.table.database.prepare(`DELETE FROM identity_links
             WHERE namespace = ?
               AND org_id = ?
               AND project_id = ?
@@ -277,19 +249,13 @@ var D1IdentityStore = class {
                    AND project_id = ?
                    AND env_id = ?
                    AND user_id = ?
-              ) > 1`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, subject, userId, this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, userId).run()) > 0) return { ok: true };
+              ) > 1`).bind(this.table.scope.namespace, this.table.scope.orgId, this.table.scope.projectId, this.table.scope.envId, subject, userId, this.table.scope.namespace, this.table.scope.orgId, this.table.scope.projectId, this.table.scope.envId, userId).run()) > 0) return { ok: true };
 		if (await this.getUserIdBySubject(subject) !== userId) return {
 			ok: false,
 			code: "not_found",
 			message: "Subject is not linked to this user"
 		};
-		if (parseSubjectCount((await this.bindScope(`SELECT COUNT(*) AS subject_count
-         FROM identity_links
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND user_id = ?`, [userId]).first())?.subject_count) <= 1) return {
+		if (parseSubjectCount((await this.table.prepare(SUBJECT_COUNT_SQL, [userId]).first())?.subject_count) <= 1) return {
 			ok: false,
 			code: "cannot_unlink_last_identity",
 			message: "Refusing to remove the last remaining identity"
@@ -301,7 +267,7 @@ var D1IdentityStore = class {
 		};
 	}
 	async deleteSubjectLinkForDevCleanup(input) {
-		await this.ensureSchema();
+		await this.table.ensureSchema();
 		const userId = normalizeOptionalTrimmedString(input.userId);
 		const subject = normalizeOptionalTrimmedString(input.subject);
 		if (!userId) return {
@@ -325,7 +291,7 @@ var D1IdentityStore = class {
 		return { ok: true };
 	}
 	async deleteIdentityLink(input) {
-		return d1ChangedRows(await this.bindScope(`DELETE FROM identity_links
+		return d1ChangedRows(await this.table.prepare(`DELETE FROM identity_links
         WHERE namespace = ?
           AND org_id = ?
           AND project_id = ?
@@ -335,6 +301,6 @@ var D1IdentityStore = class {
 	}
 };
 //#endregion
-export { D1IdentityStore, IDENTITY_STORE_D1_SCHEMA_SQL, ensureIdentityStoreD1Schema };
+export { D1IdentityStore, IDENTITY_D1_STORE, IDENTITY_STORE_D1_SCHEMA_SQL, ensureIdentityStoreD1Schema };
 
 //# sourceMappingURL=d1IdentityStore.js.map

package/dist/esm/core/d1TenantStore.js

@@ -0,0 +1,82 @@
+import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
+import "../shared-ts/src/utils/validation.js";
+import { formatD1ExecStatement } from "../storage/d1Sql.js";
+import "./defaultConfigsServer.js";
+import { toPrefixWithColon } from "./ThresholdService/validation.js";
+//#region src/core/d1TenantStore.ts
+/**
+* A store's key prefix, which is also its D1 namespace: the first of `explicitKeys` set in
+* `config`, else `<THRESHOLD_PREFIX>:<segment>`. It always ends with a colon.
+*/
+function resolveStorePrefix(config, explicitKeys, segment) {
+	for (const key of explicitKeys) {
+		const explicit = normalizeOptionalTrimmedString(config[key]);
+		if (explicit) return toPrefixWithColon(explicit, "");
+	}
+	return `${toPrefixWithColon(normalizeOptionalTrimmedString(config.THRESHOLD_PREFIX) || "w3a", `w3a:`)}${segment}`;
+}
+/** Requires each part of the scope; `store` ends the error, e.g. `identity store`. */
+function requireD1TenantScope(input, store) {
+	const field = (value, name) => {
+		const normalized = normalizeOptionalTrimmedString(value);
+		if (!normalized) throw new Error(`${name} is required for D1 ${store}`);
+		return normalized;
+	};
+	return {
+		namespace: field(input.namespace, "namespace"),
+		orgId: field(input.orgId, "orgId"),
+		projectId: field(input.projectId, "projectId"),
+		envId: field(input.envId, "envId")
+	};
+}
+/** The scope env-shaped store config names (`orgId` or `ORG_ID`, and so on) under `namespace`. */
+function d1TenantScopeFromConfig(config, namespace, store) {
+	return requireD1TenantScope({
+		namespace,
+		orgId: config.orgId || config.ORG_ID,
+		projectId: config.projectId || config.PROJECT_ID,
+		envId: config.envId || config.ENV_ID
+	}, store);
+}
+async function ensureD1Schema(database, statements) {
+	for (const statement of statements) await database.exec(formatD1ExecStatement(statement));
+}
+/** A schema a store creates once, on first use, unless its caller manages it (`enabled: false`). */
+var D1Schema = class {
+	constructor(database, statements, enabled = true) {
+		this.database = database;
+		this.statements = statements;
+		this.enabled = enabled;
+		this.ready = false;
+	}
+	async ensure() {
+		if (!this.enabled || this.ready) return;
+		await ensureD1Schema(this.database, this.statements);
+		this.ready = true;
+	}
+};
+/** Prepares `sql` with the scope bound to its first four parameters and `values` after them. */
+function prepareD1TenantStatement(database, scope, sql, values = []) {
+	return database.prepare(sql).bind(scope.namespace, scope.orgId, scope.projectId, scope.envId, ...values);
+}
+/**
+* A store's tables in one tenant scope. `store` names it in scope errors, e.g. `identity store`,
+* and the schema is created on first use unless the caller manages it (`ensureSchema: false`).
+*/
+var D1TenantTable = class {
+	constructor(input, store, schema) {
+		this.database = input.database;
+		this.scope = requireD1TenantScope(input, store);
+		this.schema = new D1Schema(input.database, schema, input.ensureSchema !== false);
+	}
+	ensureSchema() {
+		return this.schema.ensure();
+	}
+	prepare(sql, values = []) {
+		return prepareD1TenantStatement(this.database, this.scope, sql, values);
+	}
+};
+//#endregion
+export { D1Schema, D1TenantTable, d1TenantScopeFromConfig, ensureD1Schema, prepareD1TenantStatement, resolveStorePrefix };
+
+//# sourceMappingURL=d1TenantStore.js.map