@seams/wallet-server 0.6.2 → 0.7.3

package/dist/esm/core/authService/webauthnOidcHelpers.js

@@ -66,11 +66,6 @@ function parseCacheControlMaxAgeSec(cacheControl) {
 	if (!Number.isFinite(n) || n <= 0) return null;
 	return Math.floor(n);
 }
-function normalizeOidcIssuer(input) {
-	const trimmed = String(input || "").trim();
-	if (!trimmed) return "";
-	return trimmed.endsWith("/") ? trimmed.slice(0, -1) : trimmed;
-}
 function parseJwtSegmentJson(input) {
 	try {
 		const raw = new TextDecoder().decode(base64UrlDecode(input));
@@ -86,6 +81,6 @@ function parseJwtAud(input) {
 	return single ? [single] : [];
 }
 //#endregion
-export { decodeBase64UrlOrBase64, isHostWithinRpId, loadSimpleWebAuthnServer, normalizeOidcIssuer, originHostnameOrEmpty, parseCacheControlMaxAgeSec, parseClientDataJsonBase64url, parseJwtAud, parseJwtSegmentJson };
+export { decodeBase64UrlOrBase64, isHostWithinRpId, loadSimpleWebAuthnServer, originHostnameOrEmpty, parseCacheControlMaxAgeSec, parseClientDataJsonBase64url, parseJwtAud, parseJwtSegmentJson };
 
 //# sourceMappingURL=webauthnOidcHelpers.js.map

package/dist/esm/core/authService/webauthnVerificationOutcomes.js

@@ -0,0 +1,41 @@
+import { failedVerification } from "../../shared-ts/src/utils/failure.js";
+//#region src/core/authService/webauthnVerificationOutcomes.ts
+/** The failure a login or sync returns when its assertion did not verify; null when it did. */
+function webAuthnAuthenticationFailure(verification) {
+	if (!verification.success || !verification.verified) return failedVerification(verification.code || "not_verified", verification.message || "Authentication verification failed");
+	return null;
+}
+/**
+* The logged-in credential's Ed25519 signer. It is active only when the binding carries every
+* fact signing needs, and absent while the wallet's Ed25519 signer has not settled.
+*/
+function webAuthnLoginEd25519(binding, walletBinding) {
+	const firstParticipantId = binding?.participantIds?.[0];
+	const secondParticipantId = binding?.participantIds?.[1];
+	if (!binding) return failedVerification("unknown_credential", "Credential has no wallet binding");
+	return {
+		ok: true,
+		ed25519: walletBinding && binding.publicKey && binding.relayerKeyId && firstParticipantId !== void 0 && secondParticipantId !== void 0 ? {
+			kind: "active",
+			nearAccountId: walletBinding.nearAccountId,
+			nearEd25519SigningKeyId: walletBinding.nearEd25519SigningKeyId,
+			signerSlot: walletBinding.signerSlot,
+			publicKey: binding.publicKey,
+			relayerKeyId: binding.relayerKeyId,
+			participantIds: [firstParticipantId, secondParticipantId]
+		} : { kind: "absent" }
+	};
+}
+/** The sync credential's binding, if it exists and belongs to the account the challenge expects. */
+function webAuthnSyncCredentialBinding(binding, challenge) {
+	if (!binding) return failedVerification("unknown_credential", "Credential is not registered on this relay");
+	if (challenge.expectedUserId && binding.userId !== challenge.expectedUserId) return failedVerification("unknown_credential", `Credential is not registered for account ${challenge.expectedUserId}`);
+	return {
+		ok: true,
+		binding
+	};
+}
+//#endregion
+export { webAuthnAuthenticationFailure, webAuthnLoginEd25519, webAuthnSyncCredentialBinding };
+
+//# sourceMappingURL=webauthnVerificationOutcomes.js.map

package/dist/esm/core/authService/webauthnWalletBinding.js

@@ -1,20 +1,7 @@
-import { parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../shared-ts/src/utils/domainIds.js";
-import { walletIdFromString } from "../../shared-ts/src/utils/registrationIntent.js";
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import "../../shared-ts/src/utils/validation.js";
-import { isPasskeyWalletAuthAuthority, parseWalletAuthAuthority, walletAuthAuthoritiesMatch } from "../../shared-ts/src/utils/walletAuthAuthority.js";
-import { parseRouterAbEd25519NormalSigningState } from "../../shared-ts/src/utils/signingSessionSeal.js";
-import { normalizeThresholdRuntimePolicyScope } from "./thresholdRuntimePolicy.js";
+import { walletIdFromString } from "../../shared-ts/src/utils/registrationIds.js";
 //#region src/core/authService/webauthnWalletBinding.ts
-async function resolveExistingThresholdEd25519Binding(args) {
-	if (typeof args.bindingStore.listByUserId !== "function") return void 0;
-	return (await args.bindingStore.listByUserId({
-		userId: args.userId,
-		rpId: args.rpId
-	})).find((binding) => {
-		return Boolean(normalizeOptionalTrimmedString(binding.relayerKeyId) && normalizeOptionalTrimmedString(binding.publicKey) && normalizeOptionalTrimmedString(binding.keyVersion) && binding.recoveryExportCapable === true);
-	});
-}
 function parseBoundaryWalletId(raw) {
 	const value = normalizeOptionalTrimmedString(raw);
 	if (!value) return null;
@@ -44,114 +31,7 @@ function resolvedEd25519WalletBindingFromCredentialBinding(args) {
 		signerSlot: Number(resolvedSignerSlot)
 	};
 }
-function resolveThresholdEd25519SessionPolicyForBinding(args) {
-	if (Object.prototype.hasOwnProperty.call(args.requestedSessionPolicy, "rpId")) throw new Error("threshold-ed25519 session policy rpId belongs in authority");
-	if (Object.prototype.hasOwnProperty.call(args.requestedSessionPolicy, "authorityScope")) throw new Error("threshold-ed25519 session policy authorityScope is obsolete; use authority");
-	const requestedWalletId = normalizeOptionalTrimmedString(args.requestedSessionPolicy.walletId);
-	if (requestedWalletId && requestedWalletId !== args.binding.walletId) throw new Error("threshold-ed25519 session policy walletId mismatch");
-	const requestedNearAccountId = normalizeOptionalTrimmedString(args.requestedSessionPolicy.nearAccountId);
-	if (requestedNearAccountId && requestedNearAccountId !== args.binding.nearAccountId) throw new Error("threshold-ed25519 session policy nearAccountId mismatch");
-	const requestedNearEd25519SigningKeyId = normalizeOptionalTrimmedString(args.requestedSessionPolicy.nearEd25519SigningKeyId);
-	if (requestedNearEd25519SigningKeyId && requestedNearEd25519SigningKeyId !== args.binding.nearEd25519SigningKeyId) throw new Error("threshold-ed25519 session policy nearEd25519SigningKeyId mismatch");
-	const runtimePolicyScope = normalizeThresholdRuntimePolicyScope(args.requestedSessionPolicy.runtimePolicyScope) || args.persistedRuntimePolicyScope;
-	const rpId = parseWebAuthnRpId(args.binding.rpId);
-	if (!rpId.ok) throw new Error("threshold-ed25519 session binding rpId is invalid");
-	const thresholdSessionId = normalizeOptionalTrimmedString(args.requestedSessionPolicy.thresholdSessionId);
-	const ttlMs = Number(args.requestedSessionPolicy.ttlMs);
-	const remainingUses = Number(args.requestedSessionPolicy.remainingUses);
-	const participantIds = Array.isArray(args.requestedSessionPolicy.participantIds) ? args.requestedSessionPolicy.participantIds.map((participantId) => Number(participantId)).filter((participantId) => Number.isSafeInteger(participantId) && participantId > 0) : void 0;
-	const routerAbNormalSigning = parseRouterAbEd25519NormalSigningState(args.requestedSessionPolicy.routerAbNormalSigning);
-	const expectedAuthority = passkeyWalletAuthAuthorityForBinding({
-		walletAuthMethodId: args.walletAuthMethodId,
-		walletId: parseRequiredWalletId(args.binding.walletId),
-		rpId: rpId.value,
-		credentialIdB64u: parseRequiredCredentialId(args.binding.credentialIdB64u)
-	});
-	const requestedAuthority = parseWalletAuthAuthority(args.requestedSessionPolicy.authority);
-	if (!requestedAuthority) throw new Error("threshold-ed25519 session policy authority is required");
-	if (!walletAuthAuthoritiesMatch(requestedAuthority, expectedAuthority)) throw new Error("threshold-ed25519 session policy authority mismatch");
-	if (args.requestedSessionPolicy.version !== "threshold_session_v1" || !thresholdSessionId || !Number.isFinite(ttlMs) || ttlMs <= 0 || !Number.isFinite(remainingUses) || remainingUses <= 0) throw new Error("threshold-ed25519 session policy is incomplete");
-	return {
-		sessionPolicy: {
-			version: "threshold_session_v1",
-			nearAccountId: args.binding.nearAccountId,
-			nearEd25519SigningKeyId: args.binding.nearEd25519SigningKeyId,
-			authority: expectedAuthority,
-			relayerKeyId: args.relayerKeyId,
-			thresholdSessionId,
-			...runtimePolicyScope ? { runtimePolicyScope } : {},
-			...routerAbNormalSigning ? { routerAbNormalSigning } : {},
-			...participantIds && participantIds.length > 0 ? { participantIds } : {},
-			ttlMs: Math.floor(ttlMs),
-			remainingUses: Math.floor(remainingUses)
-		},
-		...runtimePolicyScope ? { runtimePolicyScope } : {}
-	};
-}
-function resolveRecoveryThresholdEd25519SessionPolicyForBinding(args) {
-	if (Object.prototype.hasOwnProperty.call(args.requestedSessionPolicy, "rpId")) throw new Error("threshold-ed25519 session policy rpId belongs in authority");
-	if (Object.prototype.hasOwnProperty.call(args.requestedSessionPolicy, "authorityScope")) throw new Error("threshold-ed25519 session policy authorityScope is obsolete; use authority");
-	const requestedWalletId = normalizeOptionalTrimmedString(args.requestedSessionPolicy.walletId);
-	if (requestedWalletId && requestedWalletId !== args.binding.walletId) throw new Error("threshold-ed25519 session policy walletId mismatch");
-	const requestedNearAccountId = normalizeOptionalTrimmedString(args.requestedSessionPolicy.nearAccountId);
-	if (requestedNearAccountId && requestedNearAccountId !== args.binding.nearAccountId) throw new Error("threshold-ed25519 session policy nearAccountId mismatch");
-	const requestedNearEd25519SigningKeyId = normalizeOptionalTrimmedString(args.requestedSessionPolicy.nearEd25519SigningKeyId);
-	if (requestedNearEd25519SigningKeyId && requestedNearEd25519SigningKeyId !== args.binding.nearEd25519SigningKeyId) throw new Error("threshold-ed25519 session policy nearEd25519SigningKeyId mismatch");
-	const requestedAuthority = parseWalletAuthAuthority(args.requestedSessionPolicy.authority);
-	if (!requestedAuthority) throw new Error("threshold-ed25519 session policy authority is required");
-	if (!isPasskeyWalletAuthAuthority(requestedAuthority)) throw new Error("wallet recovery threshold session authority must be passkey");
-	if (requestedAuthority.walletId !== args.binding.walletId) throw new Error("wallet recovery threshold session authority walletId mismatch");
-	if (requestedAuthority.bindingId !== args.walletAuthMethodId) throw new Error("wallet recovery threshold session authority auth method mismatch");
-	if (requestedAuthority.verifier.rpId !== args.binding.rpId) throw new Error("wallet recovery threshold session authority rpId mismatch");
-	const runtimePolicyScope = normalizeThresholdRuntimePolicyScope(args.requestedSessionPolicy.runtimePolicyScope) || args.persistedRuntimePolicyScope;
-	const thresholdSessionId = normalizeOptionalTrimmedString(args.requestedSessionPolicy.thresholdSessionId);
-	const ttlMs = Number(args.requestedSessionPolicy.ttlMs);
-	const remainingUses = Number(args.requestedSessionPolicy.remainingUses);
-	const participantIds = Array.isArray(args.requestedSessionPolicy.participantIds) ? args.requestedSessionPolicy.participantIds.map((participantId) => Number(participantId)).filter((participantId) => Number.isSafeInteger(participantId) && participantId > 0) : void 0;
-	const routerAbNormalSigning = parseRouterAbEd25519NormalSigningState(args.requestedSessionPolicy.routerAbNormalSigning);
-	if (args.requestedSessionPolicy.version !== "threshold_session_v1" || !thresholdSessionId || !Number.isFinite(ttlMs) || ttlMs <= 0 || !Number.isFinite(remainingUses) || remainingUses <= 0) throw new Error("threshold-ed25519 session policy is incomplete");
-	return {
-		sessionPolicy: {
-			version: "threshold_session_v1",
-			nearAccountId: args.binding.nearAccountId,
-			nearEd25519SigningKeyId: args.binding.nearEd25519SigningKeyId,
-			authority: requestedAuthority,
-			relayerKeyId: args.relayerKeyId,
-			thresholdSessionId,
-			...runtimePolicyScope ? { runtimePolicyScope } : {},
-			...routerAbNormalSigning ? { routerAbNormalSigning } : {},
-			...participantIds && participantIds.length > 0 ? { participantIds } : {},
-			ttlMs: Math.floor(ttlMs),
-			remainingUses: Math.floor(remainingUses)
-		},
-		...runtimePolicyScope ? { runtimePolicyScope } : {}
-	};
-}
-function parseRequiredWalletId(raw) {
-	const parsed = parseWalletId(raw);
-	if (!parsed.ok) throw new Error("threshold-ed25519 session binding walletId is invalid");
-	return parsed.value;
-}
-function parseRequiredCredentialId(raw) {
-	const parsed = parseWebAuthnCredentialIdB64u(raw);
-	if (!parsed.ok) throw new Error("threshold-ed25519 session binding credentialId is invalid");
-	return parsed.value;
-}
-function passkeyWalletAuthAuthorityForBinding(input) {
-	return {
-		walletId: input.walletId,
-		factor: {
-			kind: "passkey",
-			credentialIdB64u: input.credentialIdB64u
-		},
-		verifier: {
-			kind: "webauthn",
-			rpId: input.rpId
-		},
-		bindingId: input.walletAuthMethodId
-	};
-}
 //#endregion
-export { parseBoundaryWalletId, resolveExistingThresholdEd25519Binding, resolveRecoveryThresholdEd25519SessionPolicyForBinding, resolveThresholdEd25519SessionPolicyForBinding, resolvedEd25519WalletBindingFromCredentialBinding };
+export { parseBoundaryWalletId, resolvedEd25519WalletBindingFromCredentialBinding };
 
 //# sourceMappingURL=webauthnWalletBinding.js.map

package/dist/esm/core/d1EcdsaSignerRead.js

@@ -0,0 +1,76 @@
+import { isPlainObject } from "../shared-ts/src/utils/validation.js";
+import { sameRouterAbMpcMaterialActivationRef } from "../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { EcdsaMaterialReadSnapshot } from "./ecdsaMaterialReadSnapshot.js";
+import { parseD1JsonColumn } from "../storage/d1Sql.js";
+import { parseWalletEcdsaSignerRecord } from "./WalletStore.js";
+//#region src/core/d1EcdsaSignerRead.ts
+function prepareWalletEcdsaSignersRead(database, scope, walletId) {
+	return database.prepare(`SELECT record_json FROM wallet_signers
+      WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
+        AND wallet_id = ? AND signer_family = 'ecdsa'
+      ORDER BY signer_id`).bind(scope.namespace, scope.orgId, scope.projectId, scope.envId, walletId);
+}
+function parseWalletEcdsaSignerRows(rows, walletId) {
+	const signers = [];
+	for (const row of rows) {
+		const signer = parseWalletEcdsaSignerRecord(parseD1JsonColumn(row.record_json));
+		if (!signer || signer.walletId !== walletId) throw new Error("Wallet ECDSA signer record is invalid");
+		signers.push(signer);
+	}
+	return signers;
+}
+/** Parsed persistence evidence; material failures are surfaced after session validation. */
+var EcdsaMaterialRead = class EcdsaMaterialRead {
+	#result;
+	constructor(walletId, scope, activation, result, linkedSnapshot) {
+		this.walletId = walletId;
+		this.scope = scope;
+		this.activation = activation;
+		this.linkedSnapshot = linkedSnapshot;
+		this.#result = result;
+	}
+	static fromRows(scope, walletId, activation, rows, linkedSnapshot) {
+		try {
+			if (!Array.isArray(rows)) throw new Error("ECDSA material rows are invalid");
+			const storedRows = [];
+			const matches = [];
+			for (const raw of rows) {
+				if (!isPlainObject(raw) || typeof raw.record_json !== "string") throw new Error("ECDSA material row is invalid");
+				storedRows.push({ record_json: raw.record_json });
+				const signer = parseWalletEcdsaSignerRecord(parseD1JsonColumn(raw.record_json));
+				if (signer && signer.walletId === walletId && sameRouterAbMpcMaterialActivationRef(signer.walletKey.publicCapability.material_activation, activation)) matches.push(signer);
+			}
+			const signer = matches[0];
+			if (!signer) return new EcdsaMaterialRead(walletId, scope, activation, {
+				ok: true,
+				value: null
+			}, linkedSnapshot);
+			for (const other of matches) if (!signer.walletKey.keyHandle || other.walletKey.keyHandle !== signer.walletKey.keyHandle) throw new Error("Wallet has conflicting ECDSA material activations");
+			return new EcdsaMaterialRead(walletId, scope, activation, {
+				ok: true,
+				value: {
+					signer,
+					readSnapshot: EcdsaMaterialReadSnapshot.canonical(scope, walletId, activation.activation_id, storedRows)
+				}
+			}, linkedSnapshot);
+		} catch (error) {
+			return new EcdsaMaterialRead(walletId, scope, activation, {
+				ok: false,
+				message: error instanceof Error ? error.message : "ECDSA material read failed"
+			}, linkedSnapshot);
+		}
+	}
+	resolveLinked(scope, walletId, activation) {
+		this.resolve(scope, walletId, activation);
+		return this.linkedSnapshot;
+	}
+	resolve(scope, walletId, activation) {
+		if (walletId !== this.walletId || !sameRouterAbMpcMaterialActivationRef(activation, this.activation) || scope.namespace !== this.scope.namespace || scope.orgId !== this.scope.orgId || scope.projectId !== this.scope.projectId || scope.envId !== this.scope.envId) throw new Error("ECDSA material read scope does not match");
+		if (!this.#result.ok) throw new Error(this.#result.message);
+		return this.#result.value;
+	}
+};
+//#endregion
+export { EcdsaMaterialRead, parseWalletEcdsaSignerRows, prepareWalletEcdsaSignersRead };
+
+//# sourceMappingURL=d1EcdsaSignerRead.js.map

package/dist/esm/core/d1IdentityStore.js

@@ -1,7 +1,19 @@
 import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
 import "../shared-ts/src/utils/validation.js";
-import { d1ChangedRows, formatD1ExecStatement } from "../storage/d1Sql.js";
+import { failure } from "../shared-ts/src/utils/failure.js";
+import { d1ChangedRows } from "../storage/d1Sql.js";
+import { D1TenantTable, ensureD1Schema } from "./d1TenantStore.js";
 //#region src/core/d1IdentityStore.ts
+/** Names the identity store in D1 scope errors. */
+const IDENTITY_D1_STORE = "identity store";
+/** How many subjects the user has; binds the scope, then the user. */
+const SUBJECT_COUNT_SQL = `SELECT COUNT(*) AS subject_count
+         FROM identity_links
+        WHERE namespace = ?
+          AND org_id = ?
+          AND project_id = ?
+          AND env_id = ?
+          AND user_id = ?`;
 const IDENTITY_STORE_D1_SCHEMA_SQL = Object.freeze([`
     CREATE TABLE IF NOT EXISTS identity_links (
       namespace TEXT NOT NULL,
@@ -41,27 +53,11 @@ const IDENTITY_STORE_D1_SCHEMA_SQL = Object.freeze([`
       )
   `]);
 async function ensureIdentityStoreD1Schema(options) {
-	for (const statement of IDENTITY_STORE_D1_SCHEMA_SQL) await options.database.exec(formatD1ExecStatement(statement));
+	await ensureD1Schema(options.database, IDENTITY_STORE_D1_SCHEMA_SQL);
 }
 function defaultNow() {
 	return /* @__PURE__ */ new Date();
 }
-function requireD1ScopeString(input, field) {
-	const normalized = normalizeOptionalTrimmedString(input);
-	if (!normalized) throw new Error(`${field} is required for D1 identity store`);
-	return normalized;
-}
-function normalizeD1IdentityStoreOptions(input) {
-	return {
-		database: input.database,
-		namespace: requireD1ScopeString(input.namespace, "namespace"),
-		orgId: requireD1ScopeString(input.orgId, "orgId"),
-		projectId: requireD1ScopeString(input.projectId, "projectId"),
-		envId: requireD1ScopeString(input.envId, "envId"),
-		ensureSchema: input.ensureSchema !== false,
-		now: input.now || defaultNow
-	};
-}
 function parseSubjectCount(raw) {
 	const count = Number(raw);
 	return Number.isFinite(count) && count >= 0 ? Math.floor(count) : 0;
@@ -84,31 +80,14 @@ function buildIdentitySubjectRecord(input) {
 var D1IdentityStore = class {
 	constructor(input) {
 		this.adapterKind = "d1";
-		this.schemaReady = false;
-		const normalized = normalizeD1IdentityStoreOptions(input);
-		this.database = normalized.database;
-		this.scope = {
-			namespace: normalized.namespace,
-			orgId: normalized.orgId,
-			projectId: normalized.projectId,
-			envId: normalized.envId
-		};
-		this.ensureSchemaOnUse = normalized.ensureSchema;
-		this.now = normalized.now;
-	}
-	async ensureSchema() {
-		if (!this.ensureSchemaOnUse || this.schemaReady) return;
-		await ensureIdentityStoreD1Schema({ database: this.database });
-		this.schemaReady = true;
-	}
-	bindScope(statement, values = []) {
-		return this.database.prepare(statement).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, ...values);
+		this.table = new D1TenantTable(input, IDENTITY_D1_STORE, IDENTITY_STORE_D1_SCHEMA_SQL);
+		this.now = input.now || defaultNow;
 	}
 	async getUserIdBySubject(subject) {
-		await this.ensureSchema();
+		await this.table.ensureSchema();
 		const normalizedSubject = normalizeOptionalTrimmedString(subject);
 		if (!normalizedSubject) return null;
-		return normalizeOptionalTrimmedString((await this.bindScope(`SELECT user_id
+		return normalizeOptionalTrimmedString((await this.table.prepare(`SELECT user_id
          FROM identity_links
         WHERE namespace = ?
           AND org_id = ?
@@ -118,10 +97,10 @@ var D1IdentityStore = class {
         LIMIT 1`, [normalizedSubject]).first())?.user_id) || null;
 	}
 	async listSubjectsByUserId(userId) {
-		await this.ensureSchema();
+		await this.table.ensureSchema();
 		const normalizedUserId = normalizeOptionalTrimmedString(userId);
 		if (!normalizedUserId) return [];
-		return ((await this.bindScope(`SELECT subject
+		return ((await this.table.prepare(`SELECT subject
          FROM identity_links
         WHERE namespace = ?
           AND org_id = ?
@@ -131,21 +110,13 @@ var D1IdentityStore = class {
         ORDER BY created_at_ms ASC`, [normalizedUserId]).all()).results || []).map(subjectFromIdentityLinkRow).filter(isPresentString);
 	}
 	async linkSubjectToUserId(input) {
-		await this.ensureSchema();
+		await this.table.ensureSchema();
 		const userId = normalizeOptionalTrimmedString(input.userId);
 		const subject = normalizeOptionalTrimmedString(input.subject);
-		if (!userId) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing userId"
-		};
-		if (!subject) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing subject"
-		};
+		if (!userId) return failure("invalid_args", "Missing userId");
+		if (!subject) return failure("invalid_args", "Missing subject");
 		const now = this.now().getTime();
-		const existing = await this.bindScope(`SELECT user_id, created_at_ms
+		const existing = await this.table.prepare(`SELECT user_id, created_at_ms
          FROM identity_links
         WHERE namespace = ?
           AND org_id = ?
@@ -157,12 +128,8 @@ var D1IdentityStore = class {
 		const existingCreatedAtMs = Number(existing?.created_at_ms);
 		const createdAtMs = Number.isFinite(existingCreatedAtMs) && existingCreatedAtMs > 0 ? Math.floor(existingCreatedAtMs) : now;
 		if (existingUserId && existingUserId !== userId) {
-			if (!input.allowMoveIfSoleIdentity) return {
-				ok: false,
-				code: "already_linked",
-				message: "Subject is already linked to a different user"
-			};
-			if (d1ChangedRows(await this.database.prepare(`UPDATE identity_links
+			if (!input.allowMoveIfSoleIdentity) return failure("already_linked", "Subject is already linked to a different user");
+			if (d1ChangedRows(await this.table.database.prepare(`UPDATE identity_links
             SET user_id = ?,
                 record_json = ?,
                 updated_at_ms = ?
@@ -185,28 +152,14 @@ var D1IdentityStore = class {
 				userId,
 				createdAtMs,
 				updatedAtMs: now
-			})), now, this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, subject, existingUserId, this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, existingUserId).run()) > 0) return {
+			})), now, this.table.scope.namespace, this.table.scope.orgId, this.table.scope.projectId, this.table.scope.envId, subject, existingUserId, this.table.scope.namespace, this.table.scope.orgId, this.table.scope.projectId, this.table.scope.envId, existingUserId).run()) > 0) return {
 				ok: true,
 				movedFromUserId: existingUserId
 			};
-			if (parseSubjectCount((await this.bindScope(`SELECT COUNT(*) AS subject_count
-           FROM identity_links
-          WHERE namespace = ?
-            AND org_id = ?
-            AND project_id = ?
-            AND env_id = ?
-            AND user_id = ?`, [existingUserId]).first())?.subject_count) !== 1) return {
-				ok: false,
-				code: "already_linked",
-				message: "Subject is linked to a different user with other identities; merge is not allowed"
-			};
-			return {
-				ok: false,
-				code: "already_linked",
-				message: "Subject is already linked to a different user"
-			};
+			if (parseSubjectCount((await this.table.prepare(SUBJECT_COUNT_SQL, [existingUserId]).first())?.subject_count) !== 1) return failure("already_linked", "Subject is linked to a different user with other identities; merge is not allowed");
+			return failure("already_linked", "Subject is already linked to a different user");
 		}
-		await this.bindScope(`INSERT INTO identity_links (
+		await this.table.prepare(`INSERT INTO identity_links (
         namespace,
         org_id,
         project_id,
@@ -237,32 +190,16 @@ var D1IdentityStore = class {
 		]).run();
 		const finalUserId = await this.getUserIdBySubject(subject);
 		if (finalUserId === userId) return { ok: true };
-		if (finalUserId) return {
-			ok: false,
-			code: "already_linked",
-			message: "Subject is already linked to a different user"
-		};
-		return {
-			ok: false,
-			code: "internal",
-			message: "Failed to link identity"
-		};
+		if (finalUserId) return failure("already_linked", "Subject is already linked to a different user");
+		return failure("internal", "Failed to link identity");
 	}
 	async unlinkSubjectFromUserId(input) {
-		await this.ensureSchema();
+		await this.table.ensureSchema();
 		const userId = normalizeOptionalTrimmedString(input.userId);
 		const subject = normalizeOptionalTrimmedString(input.subject);
-		if (!userId) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing userId"
-		};
-		if (!subject) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing subject"
-		};
-		if (d1ChangedRows(await this.database.prepare(`DELETE FROM identity_links
+		if (!userId) return failure("invalid_args", "Missing userId");
+		if (!subject) return failure("invalid_args", "Missing subject");
+		if (d1ChangedRows(await this.table.database.prepare(`DELETE FROM identity_links
             WHERE namespace = ?
               AND org_id = ?
               AND project_id = ?
@@ -277,55 +214,25 @@ var D1IdentityStore = class {
                    AND project_id = ?
                    AND env_id = ?
                    AND user_id = ?
-              ) > 1`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, subject, userId, this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, userId).run()) > 0) return { ok: true };
-		if (await this.getUserIdBySubject(subject) !== userId) return {
-			ok: false,
-			code: "not_found",
-			message: "Subject is not linked to this user"
-		};
-		if (parseSubjectCount((await this.bindScope(`SELECT COUNT(*) AS subject_count
-         FROM identity_links
-        WHERE namespace = ?
-          AND org_id = ?
-          AND project_id = ?
-          AND env_id = ?
-          AND user_id = ?`, [userId]).first())?.subject_count) <= 1) return {
-			ok: false,
-			code: "cannot_unlink_last_identity",
-			message: "Refusing to remove the last remaining identity"
-		};
-		return {
-			ok: false,
-			code: "internal",
-			message: "Failed to unlink identity"
-		};
+              ) > 1`).bind(this.table.scope.namespace, this.table.scope.orgId, this.table.scope.projectId, this.table.scope.envId, subject, userId, this.table.scope.namespace, this.table.scope.orgId, this.table.scope.projectId, this.table.scope.envId, userId).run()) > 0) return { ok: true };
+		if (await this.getUserIdBySubject(subject) !== userId) return failure("not_found", "Subject is not linked to this user");
+		if (parseSubjectCount((await this.table.prepare(SUBJECT_COUNT_SQL, [userId]).first())?.subject_count) <= 1) return failure("cannot_unlink_last_identity", "Refusing to remove the last remaining identity");
+		return failure("internal", "Failed to unlink identity");
 	}
 	async deleteSubjectLinkForDevCleanup(input) {
-		await this.ensureSchema();
+		await this.table.ensureSchema();
 		const userId = normalizeOptionalTrimmedString(input.userId);
 		const subject = normalizeOptionalTrimmedString(input.subject);
-		if (!userId) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing userId"
-		};
-		if (!subject) return {
-			ok: false,
-			code: "invalid_args",
-			message: "Missing subject"
-		};
+		if (!userId) return failure("invalid_args", "Missing userId");
+		if (!subject) return failure("invalid_args", "Missing subject");
 		if (await this.deleteIdentityLink({
 			userId,
 			subject
-		}) === 0) return {
-			ok: false,
-			code: "not_found",
-			message: "Subject is not linked to this user"
-		};
+		}) === 0) return failure("not_found", "Subject is not linked to this user");
 		return { ok: true };
 	}
 	async deleteIdentityLink(input) {
-		return d1ChangedRows(await this.bindScope(`DELETE FROM identity_links
+		return d1ChangedRows(await this.table.prepare(`DELETE FROM identity_links
         WHERE namespace = ?
           AND org_id = ?
           AND project_id = ?
@@ -335,6 +242,6 @@ var D1IdentityStore = class {
 	}
 };
 //#endregion
-export { D1IdentityStore, IDENTITY_STORE_D1_SCHEMA_SQL, ensureIdentityStoreD1Schema };
+export { D1IdentityStore, IDENTITY_D1_STORE, IDENTITY_STORE_D1_SCHEMA_SQL, ensureIdentityStoreD1Schema };
 
 //# sourceMappingURL=d1IdentityStore.js.map

package/dist/esm/core/d1TenantStore.js

@@ -0,0 +1,82 @@
+import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
+import "../shared-ts/src/utils/validation.js";
+import "./defaultConfigsServer.js";
+import { toPrefixWithColon } from "./ThresholdService/validation.js";
+import { formatD1ExecStatement } from "../storage/d1Sql.js";
+//#region src/core/d1TenantStore.ts
+/**
+* A store's key prefix, which is also its D1 namespace: the first of `explicitKeys` set in
+* `config`, else `<THRESHOLD_PREFIX>:<segment>`. It always ends with a colon.
+*/
+function resolveStorePrefix(config, explicitKeys, segment) {
+	for (const key of explicitKeys) {
+		const explicit = normalizeOptionalTrimmedString(config[key]);
+		if (explicit) return toPrefixWithColon(explicit, "");
+	}
+	return `${toPrefixWithColon(normalizeOptionalTrimmedString(config.THRESHOLD_PREFIX) || "w3a", `w3a:`)}${segment}`;
+}
+/** Requires each part of the scope; `store` ends the error, e.g. `identity store`. */
+function requireD1TenantScope(input, store) {
+	const field = (value, name) => {
+		const normalized = normalizeOptionalTrimmedString(value);
+		if (!normalized) throw new Error(`${name} is required for D1 ${store}`);
+		return normalized;
+	};
+	return {
+		namespace: field(input.namespace, "namespace"),
+		orgId: field(input.orgId, "orgId"),
+		projectId: field(input.projectId, "projectId"),
+		envId: field(input.envId, "envId")
+	};
+}
+/** The scope env-shaped store config names (`orgId` or `ORG_ID`, and so on) under `namespace`. */
+function d1TenantScopeFromConfig(config, namespace, store) {
+	return requireD1TenantScope({
+		namespace,
+		orgId: config.orgId || config.ORG_ID,
+		projectId: config.projectId || config.PROJECT_ID,
+		envId: config.envId || config.ENV_ID
+	}, store);
+}
+async function ensureD1Schema(database, statements) {
+	for (const statement of statements) await database.exec(formatD1ExecStatement(statement));
+}
+/** A schema a store creates once, on first use, unless its caller manages it (`enabled: false`). */
+var D1Schema = class {
+	constructor(database, statements, enabled = true) {
+		this.database = database;
+		this.statements = statements;
+		this.enabled = enabled;
+		this.ready = false;
+	}
+	async ensure() {
+		if (!this.enabled || this.ready) return;
+		await ensureD1Schema(this.database, this.statements);
+		this.ready = true;
+	}
+};
+/** Prepares `sql` with the scope bound to its first four parameters and `values` after them. */
+function prepareD1TenantStatement(database, scope, sql, values = []) {
+	return database.prepare(sql).bind(scope.namespace, scope.orgId, scope.projectId, scope.envId, ...values);
+}
+/**
+* A store's tables in one tenant scope. `store` names it in scope errors, e.g. `identity store`,
+* and the schema is created on first use unless the caller manages it (`ensureSchema: false`).
+*/
+var D1TenantTable = class {
+	constructor(input, store, schema) {
+		this.database = input.database;
+		this.scope = requireD1TenantScope(input, store);
+		this.schema = new D1Schema(input.database, schema, input.ensureSchema !== false);
+	}
+	ensureSchema() {
+		return this.schema.ensure();
+	}
+	prepare(sql, values = []) {
+		return prepareD1TenantStatement(this.database, this.scope, sql, values);
+	}
+};
+//#endregion
+export { D1Schema, D1TenantTable, d1TenantScopeFromConfig, ensureD1Schema, prepareD1TenantStatement, resolveStorePrefix };
+
+//# sourceMappingURL=d1TenantStore.js.map