@kubun/store-credential 0.17.4 → 0.18.0

package/lib/advisory-locks.d.ts

@@ -0,0 +1,5 @@
+/** PostgreSQL advisory IDs are signed bigint values, not key-name order. */
+export declare function orderAdvisoryLockIDs(keys: ReadonlyArray<{
+    keyID: string;
+    advisoryID: bigint;
+}>): Array<bigint>;

package/lib/advisory-locks.js

@@ -0,0 +1,12 @@
+/** PostgreSQL advisory IDs are signed bigint values, not key-name order. */ export function orderAdvisoryLockIDs(keys) {
+    const seenKeys = new Set();
+    const ids = new Set();
+    for (const { keyID, advisoryID } of keys){
+        if (seenKeys.has(keyID)) continue;
+        seenKeys.add(keyID);
+        ids.add(advisoryID);
+    }
+    return [
+        ...ids
+    ].sort((left, right)=>left < right ? -1 : left > right ? 1 : 0);
+}

package/lib/api-aliases.d.ts

@@ -0,0 +1,3 @@
+import type { CredentialStoreAPI } from './api-types.js';
+import type { StoreContext } from './store-context.js';
+export declare function createAliasesApi(ctx: StoreContext): Pick<CredentialStoreAPI, 'getDeviceAliasEntry' | 'getDeviceAliasEntryID' | 'setDeviceAliasEntryID' | 'deleteDeviceAliasEntryID' | 'deleteDeviceAliasIfEntry' | 'listDeviceAliasOwnersForProvider' | 'listDeviceAliasesForOwner'>;

package/lib/api-aliases.js

@@ -0,0 +1,58 @@
+export function createAliasesApi(ctx) {
+    const { db, gatedIfAmbient } = ctx;
+    return {
+        async getDeviceAliasEntry ({ providerName, ownerDID, deviceDID }) {
+            const row = await db.selectFrom('kubun_credential_device_aliases').select([
+                'entry_id',
+                'entry_owner_did'
+            ]).where('provider_name', '=', providerName).where('owner_did', '=', ownerDID).where('device_did', '=', deviceDID).executeTakeFirst();
+            return row == null ? null : {
+                entryID: row.entry_id,
+                entryOwnerDID: row.entry_owner_did
+            };
+        },
+        async getDeviceAliasEntryID (key) {
+            return (await ctx.api().getDeviceAliasEntry(key))?.entryID ?? null;
+        },
+        async setDeviceAliasEntryID ({ providerName, ownerDID, deviceDID, entryID, entryOwnerDID }) {
+            await gatedIfAmbient(()=>db.insertInto('kubun_credential_device_aliases').values({
+                    provider_name: providerName,
+                    owner_did: ownerDID,
+                    device_did: deviceDID,
+                    entry_id: entryID,
+                    entry_owner_did: entryOwnerDID ?? ownerDID
+                }).onConflict((oc)=>oc.columns([
+                        'provider_name',
+                        'owner_did',
+                        'device_did'
+                    ]).doUpdateSet({
+                        entry_id: entryID,
+                        entry_owner_did: entryOwnerDID ?? ownerDID
+                    })).execute());
+        },
+        async deleteDeviceAliasEntryID ({ providerName, ownerDID, deviceDID }) {
+            await gatedIfAmbient(()=>db.deleteFrom('kubun_credential_device_aliases').where('provider_name', '=', providerName).where('owner_did', '=', ownerDID).where('device_did', '=', deviceDID).execute());
+        },
+        async deleteDeviceAliasIfEntry ({ providerName, ownerDID, deviceDID, entryID }) {
+            await gatedIfAmbient(()=>db.deleteFrom('kubun_credential_device_aliases').where('provider_name', '=', providerName).where('owner_did', '=', ownerDID).where('device_did', '=', deviceDID).where('entry_id', '=', entryID).execute());
+        },
+        async listDeviceAliasOwnersForProvider ({ providerName, deviceDID }) {
+            const rows = await db.selectFrom('kubun_credential_device_aliases').select('owner_did').where('provider_name', '=', providerName).where('device_did', '=', deviceDID).orderBy('owner_did', 'asc').execute();
+            return rows.map((row)=>row.owner_did);
+        },
+        async listDeviceAliasesForOwner (ownerDID) {
+            const rows = await db.selectFrom('kubun_credential_device_aliases').select([
+                'provider_name',
+                'owner_did',
+                'device_did',
+                'entry_id'
+            ]).where('owner_did', '=', ownerDID).orderBy('provider_name', 'asc').orderBy('device_did', 'asc').execute();
+            return rows.map((row)=>({
+                    providerName: row.provider_name,
+                    ownerDID: row.owner_did,
+                    deviceDID: row.device_did,
+                    entryID: row.entry_id
+                }));
+        }
+    };
+}

package/lib/api-entries.d.ts

@@ -0,0 +1,3 @@
+import type { CredentialStoreAPI } from './api-types.js';
+import type { StoreContext } from './store-context.js';
+export declare function createEntriesApi(ctx: StoreContext): Pick<CredentialStoreAPI, 'putEntry' | 'moveEntry' | 'updateEntryIfPresent' | 'updateEntryIfUnchanged' | 'getEntry' | 'listEntryOwners' | 'getEntryWithProvenance' | 'listEntries' | 'deleteEntry' | 'getMaxEntryHLC' | 'listEntryCandidates' | 'listPriorEntryTombstones'>;

package/lib/api-entries.js

@@ -0,0 +1,157 @@
+import { verifyRecordOp } from '@kubun/records';
+export function createEntriesApi(ctx) {
+    const { db, adapter, oneOwner, ownerForKey, writeSubject, deleteSubject, writeAmbient, lockKeyRowInTransaction } = ctx;
+    async function writeEntry(params, allowMove) {
+        const owner = await ownerForKey(params.keyID, params.ownerDID);
+        const source = allowMove ? await ctx.api().getEntry(params.entryID, owner) : undefined;
+        const sourceKeyID = source?.key_id;
+        const values = {
+            owner_did: owner,
+            entry_id: params.entryID,
+            key_id: params.keyID,
+            key_version: params.keyVersion,
+            iv: adapter.encodeBinary(params.iv),
+            ciphertext: adapter.encodeBinary(params.ciphertext),
+            hlc: params.hlc
+        };
+        await writeSubject({
+            keyID: params.keyID,
+            keyIDs: sourceKeyID == null ? [
+                params.keyID
+            ] : [
+                sourceKeyID,
+                params.keyID
+            ],
+            accept: allowMove ? async (tx)=>source !== undefined && (await tx.selectFrom('kubun_credential_entries').select('key_id').where('owner_did', '=', source.owner_did).where('entry_id', '=', params.entryID).executeTakeFirst())?.key_id === sourceKeyID : undefined,
+            write: async (tx)=>{
+                if (!allowMove) {
+                    const existing = await tx.selectFrom('kubun_credential_entries').select('key_id').where('owner_did', '=', owner).where('entry_id', '=', params.entryID).executeTakeFirst();
+                    if (existing != null && existing.key_id !== params.keyID) {
+                        throw new Error(`Credential entry ${params.entryID} already belongs to key ${existing.key_id}`);
+                    }
+                }
+                if (source !== undefined && source.owner_did !== owner) {
+                    await tx.deleteFrom('kubun_credential_entries').where('owner_did', '=', source.owner_did).where('entry_id', '=', params.entryID).execute();
+                }
+                const result = await tx.insertInto('kubun_credential_entries').values(values).onConflict((oc)=>{
+                    const update = oc.columns([
+                        'owner_did',
+                        'entry_id'
+                    ]).doUpdateSet({
+                        key_id: values.key_id,
+                        key_version: values.key_version,
+                        iv: values.iv,
+                        ciphertext: values.ciphertext,
+                        hlc: values.hlc
+                    });
+                    return allowMove ? update : update.where('kubun_credential_entries.key_id', '=', values.key_id);
+                }).executeTakeFirst();
+                if (!allowMove && (result.numInsertedOrUpdatedRows ?? 0n) === 0n) {
+                    throw new Error(`Credential entry ${params.entryID} belongs to another key`);
+                }
+            }
+        });
+    }
+    const updateEntryConditionally = async (params, expectedHLC)=>{
+        let outcome = 'absent';
+        const owner = await ownerForKey(params.keyID, params.ownerDID);
+        await writeAmbient(db, async (tx)=>{
+            await lockKeyRowInTransaction(tx, params.keyID);
+            const result = await tx.updateTable('kubun_credential_entries').set({
+                key_version: params.keyVersion,
+                iv: adapter.encodeBinary(params.iv),
+                ciphertext: adapter.encodeBinary(params.ciphertext),
+                hlc: params.hlc
+            }).where('entry_id', '=', params.entryID).where('owner_did', '=', owner).where('key_id', '=', params.keyID).$if(expectedHLC != null, (update)=>update.where('hlc', '=', expectedHLC)).executeTakeFirst();
+            if ((result.numUpdatedRows ?? 0n) !== 0n) {
+                outcome = 'updated';
+            } else if (expectedHLC != null) {
+                const row = await tx.selectFrom('kubun_credential_entries').select('hlc').where('entry_id', '=', params.entryID).where('owner_did', '=', owner).where('key_id', '=', params.keyID).executeTakeFirst();
+                if (row != null && row.hlc !== expectedHLC) outcome = 'superseded';
+            }
+        });
+        return outcome;
+    };
+    return {
+        async putEntry (params) {
+            await writeEntry(params, false);
+        },
+        async moveEntry (params) {
+            await writeEntry(params, true);
+        },
+        async updateEntryIfPresent (params) {
+            // Unconditional, so never superseded.
+            return await updateEntryConditionally(params, null);
+        },
+        async updateEntryIfUnchanged (params) {
+            return await updateEntryConditionally(params, params.expectedHLC);
+        },
+        async getEntry (entryID, ownerDID) {
+            let query = db.selectFrom('kubun_credential_entries').selectAll().where('entry_id', '=', entryID);
+            if (ownerDID !== undefined) query = query.where('owner_did', '=', ownerDID);
+            return oneOwner(await query.execute(), `entry ${entryID}`)[0];
+        },
+        async listEntryOwners (entryID) {
+            const rows = await db.selectFrom('kubun_credential_entries').select('owner_did').where('entry_id', '=', entryID).orderBy('owner_did', 'asc').execute();
+            return rows.map((row)=>row.owner_did);
+        },
+        async getEntryWithProvenance (entryID, ownerDID) {
+            const entry = await ctx.api().getEntry(entryID, ownerDID);
+            if (entry == null) return undefined;
+            const record = await db.selectFrom('kubun_credential_records').select('op_jwt').where('type', '=', 'credential.entry').where('owner', '=', entry.owner_did).where('id', '=', entryID).where('deleted', '=', 0).executeTakeFirst();
+            const op = record == null ? null : await verifyRecordOp(record.op_jwt);
+            return {
+                ...entry,
+                author_did: op?.issuer ?? null
+            };
+        },
+        async listEntries (keyID, ownerDID) {
+            let query = db.selectFrom('kubun_credential_entries').selectAll().where('key_id', '=', keyID);
+            if (ownerDID !== undefined) query = query.where('owner_did', '=', ownerDID);
+            return oneOwner(await query.orderBy('created_at', 'asc').orderBy('entry_id', 'asc').execute(), `entries ${keyID}`);
+        },
+        async deleteEntry (entryID, ownerDID) {
+            const entry = await ctx.api().getEntry(entryID, ownerDID);
+            if (entry === undefined) return;
+            const keyID = entry.key_id;
+            await deleteSubject({
+                keyID,
+                remove: async (tx)=>{
+                    await tx.deleteFrom('kubun_credential_entries').where('owner_did', '=', entry.owner_did).where('entry_id', '=', entryID).where('key_id', '=', keyID).execute();
+                }
+            });
+        },
+        async getMaxEntryHLC () {
+            const row = await db.selectFrom('kubun_credential_entries').select((eb)=>eb.fn.max('hlc').as('max_hlc')).executeTakeFirst();
+            return row?.max_hlc ?? null;
+        },
+        async listEntryCandidates (keyID, keyVersion, ownerDID) {
+            let query = db.selectFrom('kubun_credential_entry_candidates').selectAll().where('key_id', '=', keyID).where('key_version', '=', keyVersion);
+            if (ownerDID !== undefined) query = query.where('owner_did', '=', ownerDID);
+            const rows = oneOwner(await query.orderBy('entry_id', 'asc').orderBy('op_hash', 'asc').execute(), `entry candidates ${keyID}`);
+            return rows.map((row)=>({
+                    type: 'credential.entry',
+                    id: row.entry_id,
+                    owner: row.owner,
+                    hlc: row.hlc,
+                    opJWT: row.op_jwt,
+                    opHash: row.op_hash,
+                    payload: row.payload === null ? null : Uint8Array.from(row.payload)
+                }));
+        },
+        async listPriorEntryTombstones (keyID, beforeVersion, ownerDID) {
+            let query = db.selectFrom('kubun_credential_entry_candidates').selectAll().where('key_id', '=', keyID).where('key_version', '<', beforeVersion).where('payload', 'is', null);
+            if (ownerDID !== undefined) query = query.where('owner_did', '=', ownerDID);
+            const rows = oneOwner(await query.orderBy('entry_id', 'asc').orderBy('op_hash', 'asc').execute(), `entry tombstones ${keyID}`);
+            return rows.map((row)=>({
+                    type: 'credential.entry',
+                    id: row.entry_id,
+                    owner: row.owner,
+                    hlc: row.hlc,
+                    opJWT: row.op_jwt,
+                    opHash: row.op_hash,
+                    payload: null
+                }));
+        }
+    };
+}

package/lib/api-keys.d.ts

@@ -0,0 +1,3 @@
+import type { CredentialStoreAPI } from './api-types.js';
+import type { StoreContext } from './store-context.js';
+export declare function createKeysApi(ctx: StoreContext): Pick<CredentialStoreAPI, 'putKey' | 'getKey' | 'listKeys' | 'setKeyState' | 'setKeyVersion' | 'deleteKey' | 'listKeyBranches' | 'putWrapping' | 'getWrapping' | 'listWrappings' | 'listWrappingsWithBranch' | 'deleteWrapping' | 'deleteWrappingsBelowVersion' | 'putWrappingAuthority' | 'getWrappingAuthority' | 'refreshKeyOwnerDelegation' | 'replaceKeyOwnerDelegationIfUnchanged' | 'getKeyOwnerDelegation'>;

package/lib/api-keys.js

@@ -0,0 +1,249 @@
+/**
+ * The strictly-greater-`refreshSeq` upsert shared by {@link CredentialStoreAPI.putWrappingAuthority}
+ * and `putWrapping`'s own-transaction variant — one predicate, so the two entry
+ * points cannot drift on what "newer" means.
+ */ async function upsertWrappingAuthority(db, params) {
+    const values = {
+        owner_did: params.ownerDID,
+        wrapping_id: params.wrappingID,
+        authority_token: params.envelope,
+        refresh_seq: params.refreshSeq
+    };
+    await db.insertInto('kubun_credential_wrapping_authority').values(values).onConflict((oc)=>oc.columns([
+            'owner_did',
+            'wrapping_id'
+        ]).doUpdateSet({
+            authority_token: values.authority_token,
+            refresh_seq: values.refresh_seq
+        }).where('kubun_credential_wrapping_authority.refresh_seq', '<', values.refresh_seq)).execute();
+}
+export function createKeysApi(ctx) {
+    const { db, adapter, oneOwner, ownerForKey, writeSubject, deleteSubject, writeAmbient, lockKeyRowInTransaction } = ctx;
+    return {
+        async putKey (params) {
+            await writeSubject({
+                keyID: params.keyID,
+                write: async (tx)=>{
+                    await tx.insertInto('kubun_credential_keys').values({
+                        key_id: params.keyID,
+                        owner_did: params.ownerDID,
+                        suite: params.suite,
+                        version: params.version,
+                        state: params.state
+                    }).onConflict((oc)=>oc.columns([
+                            'owner_did',
+                            'key_id'
+                        ]).doUpdateSet({
+                            suite: params.suite,
+                            version: params.version,
+                            state: params.state
+                        })).execute();
+                },
+                accept: async (tx)=>{
+                    const existing = await tx.selectFrom('kubun_credential_keys').select('version').where('owner_did', '=', params.ownerDID).where('key_id', '=', params.keyID).executeTakeFirst();
+                    return existing == null || params.version >= existing.version;
+                }
+            });
+        },
+        async getKey (keyID, ownerDID) {
+            let query = db.selectFrom('kubun_credential_keys').selectAll().where('key_id', '=', keyID);
+            if (ownerDID !== undefined) query = query.where('owner_did', '=', ownerDID);
+            return oneOwner(await query.execute(), `key ${keyID}`)[0];
+        },
+        async listKeys (ownerDID) {
+            return await db.selectFrom('kubun_credential_keys').selectAll().where('owner_did', '=', ownerDID).orderBy('created_at', 'asc').orderBy('key_id', 'asc').execute();
+        },
+        async setKeyState (keyID, state, ownerDID) {
+            const owner = await ownerForKey(keyID, ownerDID);
+            await writeSubject({
+                keyID,
+                write: async (tx)=>{
+                    await tx.updateTable('kubun_credential_keys').set({
+                        state
+                    }).where('owner_did', '=', owner).where('key_id', '=', keyID).execute();
+                }
+            });
+        },
+        async setKeyVersion (keyID, version, ownerDID) {
+            const owner = await ownerForKey(keyID, ownerDID);
+            await writeSubject({
+                keyID,
+                write: async (tx)=>{
+                    await tx.updateTable('kubun_credential_keys').set({
+                        version
+                    }).where('owner_did', '=', owner).where('key_id', '=', keyID).execute();
+                },
+                accept: async (tx)=>{
+                    const existing = await tx.selectFrom('kubun_credential_keys').select('version').where('owner_did', '=', owner).where('key_id', '=', keyID).executeTakeFirst();
+                    return existing == null || version >= existing.version;
+                }
+            });
+        },
+        async deleteKey (keyID, ownerDID) {
+            const owner = await ownerForKey(keyID, ownerDID);
+            await deleteSubject({
+                keyID,
+                remove: async (tx)=>{
+                    await tx.deleteFrom('kubun_credential_keys').where('owner_did', '=', owner).where('key_id', '=', keyID).execute();
+                }
+            });
+        },
+        async listKeyBranches (keyID, keyVersion, ownerDID) {
+            let query = db.selectFrom('kubun_credential_key_branches').selectAll().where('key_id', '=', keyID).where('key_version', '=', keyVersion);
+            if (ownerDID !== undefined) query = query.where('owner_did', '=', ownerDID);
+            return oneOwner(await query.orderBy('branch_id', 'asc').execute(), `branches ${keyID}`);
+        },
+        async putWrapping (params) {
+            const { authority } = params;
+            const owner = await ownerForKey(params.keyID, params.ownerDID);
+            const values = {
+                owner_did: owner,
+                wrapping_id: params.wrappingID,
+                key_id: params.keyID,
+                key_version: params.keyVersion,
+                factors: adapter.encodeJSON(params.factors),
+                iv: adapter.encodeBinary(params.iv),
+                wrapped_key: adapter.encodeBinary(params.wrappedKey),
+                recipient_did: params.recipientDID ?? null
+            };
+            await writeSubject({
+                keyID: params.keyID,
+                write: async (tx)=>{
+                    const existing = await tx.selectFrom('kubun_credential_wrappings').select('key_id').where('owner_did', '=', owner).where('wrapping_id', '=', params.wrappingID).executeTakeFirst();
+                    if (existing != null && existing.key_id !== params.keyID) {
+                        throw new Error(`Credential wrapping ${params.wrappingID} already belongs to key ${existing.key_id}`);
+                    }
+                    const result = await tx.insertInto('kubun_credential_wrappings').values(values).onConflict((oc)=>oc.columns([
+                            'owner_did',
+                            'wrapping_id'
+                        ]).doUpdateSet({
+                            key_id: values.key_id,
+                            key_version: values.key_version,
+                            factors: values.factors,
+                            iv: values.iv,
+                            wrapped_key: values.wrapped_key,
+                            recipient_did: values.recipient_did
+                        }).where('kubun_credential_wrappings.key_id', '=', values.key_id)).executeTakeFirst();
+                    if ((result.numInsertedOrUpdatedRows ?? 0n) === 0n) {
+                        throw new Error(`Credential wrapping ${params.wrappingID} belongs to another key`);
+                    }
+                    if (authority != null) {
+                        await upsertWrappingAuthority(tx, {
+                            wrappingID: params.wrappingID,
+                            ownerDID: owner,
+                            envelope: authority.envelope,
+                            refreshSeq: authority.refreshSeq
+                        });
+                    }
+                }
+            });
+        },
+        async getWrapping (wrappingID, ownerDID) {
+            let query = db.selectFrom('kubun_credential_wrappings').selectAll().where('wrapping_id', '=', wrappingID);
+            if (ownerDID !== undefined) query = query.where('owner_did', '=', ownerDID);
+            return oneOwner(await query.execute(), `wrapping ${wrappingID}`)[0];
+        },
+        async listWrappings (keyID, keyVersion, ownerDID) {
+            let query = db.selectFrom('kubun_credential_wrappings').selectAll().where('key_id', '=', keyID);
+            if (ownerDID !== undefined) query = query.where('owner_did', '=', ownerDID);
+            if (keyVersion != null) {
+                query = query.where('key_version', '=', keyVersion);
+            }
+            return oneOwner(await query.orderBy('created_at', 'asc').orderBy('wrapping_id', 'asc').execute(), `wrappings ${keyID}`);
+        },
+        async listWrappingsWithBranch (keyID, keyVersion, ownerDID) {
+            // The row keeps its own label, so a wrapping a replicated record wrote,
+            // which has no op row, still reports its branch rather than the empty one.
+            let query = db.selectFrom('kubun_credential_wrappings').selectAll().where('key_id', '=', keyID);
+            if (ownerDID !== undefined) query = query.where('owner_did', '=', ownerDID);
+            if (keyVersion != null) {
+                query = query.where('key_version', '=', keyVersion);
+            }
+            return oneOwner(await query.orderBy('created_at', 'asc').orderBy('wrapping_id', 'asc').execute(), `wrappings ${keyID}`);
+        },
+        async deleteWrapping (wrappingID, ownerDID) {
+            const wrapping = await ctx.api().getWrapping(wrappingID, ownerDID);
+            if (wrapping === undefined) return;
+            const keyID = wrapping.key_id;
+            await deleteSubject({
+                keyID,
+                remove: async (tx)=>{
+                    await tx.deleteFrom('kubun_credential_wrappings').where('owner_did', '=', wrapping.owner_did).where('wrapping_id', '=', wrappingID).where('key_id', '=', keyID).execute();
+                }
+            });
+        },
+        async deleteWrappingsBelowVersion (keyID, keyVersion, ownerDID) {
+            const owner = await ownerForKey(keyID, ownerDID);
+            await writeAmbient(db, async (tx)=>{
+                await lockKeyRowInTransaction(tx, keyID);
+                await tx.deleteFrom('kubun_credential_wrappings').where('owner_did', '=', owner).where('key_id', '=', keyID).where('key_version', '<', keyVersion).execute();
+            });
+        },
+        async putWrappingAuthority (params) {
+            const owner = params.ownerDID ?? (await ctx.api().getWrapping(params.wrappingID))?.owner_did ?? '';
+            await upsertWrappingAuthority(db, {
+                ...params,
+                ownerDID: owner
+            });
+        },
+        async getWrappingAuthority (wrappingID, ownerDID) {
+            let query = db.selectFrom('kubun_credential_wrapping_authority').select([
+                'owner_did',
+                'authority_token',
+                'refresh_seq'
+            ]).where('wrapping_id', '=', wrappingID);
+            if (ownerDID !== undefined) query = query.where('owner_did', '=', ownerDID);
+            const row = oneOwner(await query.execute(), `wrapping authority ${wrappingID}`)[0];
+            if (row == null) return undefined;
+            return {
+                envelope: row.authority_token,
+                refreshSeq: row.refresh_seq
+            };
+        },
+        async refreshKeyOwnerDelegation (params) {
+            const owner = await ownerForKey(params.keyID, params.ownerDID);
+            const values = {
+                owner_did: owner,
+                key_id: params.keyID,
+                delegation_tokens: adapter.encodeJSON(params.delegationTokens),
+                refresh_seq: params.refreshSeq,
+                revision: 1
+            };
+            const result = await db.insertInto('kubun_credential_key_owner_delegation').values(values).onConflict((oc)=>oc.columns([
+                    'owner_did',
+                    'key_id'
+                ]).doUpdateSet({
+                    delegation_tokens: values.delegation_tokens,
+                    refresh_seq: values.refresh_seq,
+                    // Bump so a concurrent replace CAS on the pre-refresh revision fails.
+                    revision: (eb)=>eb('kubun_credential_key_owner_delegation.revision', '+', 1)
+                }).where('kubun_credential_key_owner_delegation.refresh_seq', '<', values.refresh_seq)).executeTakeFirst();
+            return (result.numInsertedOrUpdatedRows ?? 0n) > 0n;
+        },
+        async replaceKeyOwnerDelegationIfUnchanged (params) {
+            const owner = await ownerForKey(params.keyID, params.ownerDID);
+            const result = await db.updateTable('kubun_credential_key_owner_delegation').set({
+                delegation_tokens: adapter.encodeJSON(params.delegationTokens),
+                refresh_seq: params.refreshSeq,
+                revision: (eb)=>eb('kubun_credential_key_owner_delegation.revision', '+', 1)
+            }).where('key_id', '=', params.keyID).where('owner_did', '=', owner).where('revision', '=', params.expectedRevision).executeTakeFirst();
+            return (result.numUpdatedRows ?? 0n) > 0n;
+        },
+        async getKeyOwnerDelegation (keyID, ownerDID) {
+            let query = db.selectFrom('kubun_credential_key_owner_delegation').select([
+                'owner_did',
+                'delegation_tokens',
+                'refresh_seq',
+                'revision'
+            ]).where('key_id', '=', keyID);
+            if (ownerDID !== undefined) query = query.where('owner_did', '=', ownerDID);
+            const row = oneOwner(await query.execute(), `key delegation ${keyID}`)[0];
+            if (row == null) return undefined;
+            return {
+                delegationTokens: row.delegation_tokens,
+                refreshSeq: row.refresh_seq,
+                revision: row.revision
+            };
+        }
+    };
+}

package/lib/api-provisioning.d.ts

@@ -0,0 +1,3 @@
+import type { CredentialStoreAPI } from './api-types.js';
+import type { StoreContext } from './store-context.js';
+export declare function createProvisioningApi(ctx: StoreContext): Pick<CredentialStoreAPI, 'nextGrantorSequence' | 'nextProvisioningEpoch' | 'putManifest' | 'lockManifestRow' | 'listManifests' | 'listDistributableKeys' | 'beginProvisioningAttempt' | 'recordProvisioningAttempt' | 'abandonProvisioningAttempt' | 'abandonProvisioningAttempts' | 'listProvisioningExpectations' | 'listProvisioningExpectationOwners'>;