@kubun/store-credential 0.17.4 → 0.18.0

package/lib/definition.js

@@ -3,5 +3,7 @@ import { getCredentialMigrations } from './migrations.js';
 export const credentialStoreDefinition = {
     name: 'credential',
     migrations: getCredentialMigrations,
-    createAPI: createCredentialStore
+    // Only the db and adapter: KubunDB passes a store context third, and this
+    // factory's third parameter means something else.
+    createAPI: (db, adapter)=>createCredentialStore(db, adapter)
 };

package/lib/index.d.ts

@@ -1,8 +1,9 @@
 import type { StoreProvider } from '@kubun/db';
 import type { CredentialStoreAPI } from './api.js';
-export type { CredentialManifestRecord, CredentialOpInput, CredentialStoreAPI, CredentialTombstoneInput, HeldCredentialSubject, ListManifestsParams, NextGrantorSequenceParams, PutCredentialEntryParams, PutCredentialKeyParams, PutCredentialWrappingParams, PutWrappingAuthorityParams, StoredCredentialManifest, WrappingAuthority, } from './api.js';
+export type { CredentialAliasKey, CredentialDeviceAliasAPI, CredentialManifestRecord, CredentialStoreAPI, DeleteDeviceAliasIfEntryParams, ListDeviceAliasOwnersParams, ListManifestsParams, NextGrantorSequenceParams, PutCredentialEntryParams, PutCredentialKeyParams, PutCredentialManifestParams, PutCredentialWrappingParams, PutWrappingAuthorityParams, SetDeviceAliasParams, StoredCredentialManifest, UpdateStoredEntryIfUnchangedParams, WrappingAuthority, } from './api.js';
 export { createCredentialStore, UNBOUNDED_REFRESH_SEQ } from './api.js';
 export { credentialStoreDefinition } from './definition.js';
+export { CREDENTIAL_RECORD_TYPES, type CredentialRecordAdapterOptions, CredentialRecordError, type CredentialRecordMetas, CredentialRecordPayloadError, type CredentialRecordPayloads, CredentialRecordRowError, CredentialRecordSignatureError, type CredentialRecordType, credentialManifestRecordID, credentialRecordAdapter, credentialRecordFromRow, credentialRevocationRecordID, credentialStoreOf, type DecodedCredentialRecord, decodeCredentialRecord, encodeCredentialRecordPayload, } from './records.js';
 export declare const CREDENTIAL_STORE: "credential";
 export declare function getCredentialStore(provider: StoreProvider): Promise<CredentialStoreAPI>;
-export type { CredentialAlias, CredentialEntry, CredentialEntryTable, CredentialEntryWithProvenance, CredentialFactorDescriptor, CredentialGrantorCounter, CredentialGrantorCounterTable, CredentialKey, CredentialKeyBranch, CredentialKeyBranchTable, CredentialKeyOwnerDelegation, CredentialKeyOwnerDelegationTable, CredentialKeyState, CredentialKeyTable, CredentialManifest, CredentialManifestKey, CredentialManifestTable, CredentialOp, CredentialOpSubjectKind, CredentialOpTable, CredentialTables, CredentialWrapping, CredentialWrappingAuthority, CredentialWrappingAuthorityTable, CredentialWrappingTable, CredentialWrappingWithBranch, InsertCredentialAlias, InsertCredentialEntry, InsertCredentialGrantorCounter, InsertCredentialKey, InsertCredentialKeyOwnerDelegation, InsertCredentialManifest, InsertCredentialOp, InsertCredentialWrapping, InsertCredentialWrappingAuthority, KubunCredentialAliasTable, } from './tables.js';
+export type { CredentialDeviceAlias, CredentialDeviceAliasTable, CredentialEntry, CredentialEntryCandidateTable, CredentialEntryTable, CredentialEntryWithProvenance, CredentialFactorDescriptor, CredentialGrantorCounter, CredentialGrantorCounterTable, CredentialKey, CredentialKeyBranch, CredentialKeyBranchTable, CredentialKeyOwnerDelegation, CredentialKeyOwnerDelegationTable, CredentialKeyState, CredentialKeyTable, CredentialManifest, CredentialManifestKey, CredentialManifestTable, CredentialRecordRow, CredentialRecordTable, CredentialRevocation, CredentialRevocationTable, CredentialTables, CredentialWrapping, CredentialWrappingAuthority, CredentialWrappingAuthorityTable, CredentialWrappingTable, CredentialWrappingWithBranch, InsertCredentialEntry, InsertCredentialGrantorCounter, InsertCredentialKey, InsertCredentialKeyOwnerDelegation, InsertCredentialManifest, InsertCredentialWrapping, InsertCredentialWrappingAuthority, } from './tables.js';

package/lib/index.js

@@ -1,5 +1,6 @@
 export { createCredentialStore, UNBOUNDED_REFRESH_SEQ } from './api.js';
 export { credentialStoreDefinition } from './definition.js';
+export { CREDENTIAL_RECORD_TYPES, CredentialRecordError, CredentialRecordPayloadError, CredentialRecordRowError, CredentialRecordSignatureError, credentialManifestRecordID, credentialRecordAdapter, credentialRecordFromRow, credentialRevocationRecordID, credentialStoreOf, decodeCredentialRecord, encodeCredentialRecordPayload } from './records.js';
 export const CREDENTIAL_STORE = 'credential';
 export function getCredentialStore(provider) {
     return provider.getStore(CREDENTIAL_STORE);

package/lib/migrations.js

@@ -4,9 +4,13 @@ export function getCredentialMigrations(ctx) {
     const init = {
         async up (db) {
             // Credential keys: public record only, no key material.
-            await db.schema.createTable('kubun_credential_keys').ifNotExists().addColumn('key_id', t.text, (col)=>col.notNull().primaryKey()).addColumn('owner_did', t.text, (col)=>col.notNull()).addColumn('suite', 'integer', (col)=>col.notNull()).addColumn('version', 'integer', (col)=>col.notNull()).addColumn('state', t.text, (col)=>col.notNull()).addColumn('created_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).execute();
+            await db.schema.createTable('kubun_credential_keys').ifNotExists().addColumn('key_id', t.text, (col)=>col.notNull()).addColumn('owner_did', t.text, (col)=>col.notNull()).addColumn('suite', 'integer', (col)=>col.notNull()).addColumn('version', 'integer', (col)=>col.notNull()).addColumn('state', t.text, (col)=>col.notNull()).addColumn('created_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).addPrimaryKeyConstraint('pk_kubun_credential_keys', [
+                'owner_did',
+                'key_id'
+            ]).execute();
             // Key-op history is retained so a branch label can be re-authenticated.
-            await db.schema.createTable('kubun_credential_key_branches').ifNotExists().addColumn('key_id', t.text, (col)=>col.notNull()).addColumn('key_version', 'integer', (col)=>col.notNull()).addColumn('op_hash', t.text, (col)=>col.notNull()).addColumn('author_did', t.text, (col)=>col.notNull()).addColumn('hlc', t.text, (col)=>col.notNull()).addColumn('op_jwt', t.text, (col)=>col.notNull()).addColumn('branch_id', t.text, (col)=>col.notNull()).addColumn('created_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).addPrimaryKeyConstraint('pk_kubun_credential_key_branches', [
+            await db.schema.createTable('kubun_credential_key_branches').ifNotExists().addColumn('owner_did', t.text, (col)=>col.notNull()).addColumn('key_id', t.text, (col)=>col.notNull()).addColumn('key_version', 'integer', (col)=>col.notNull()).addColumn('op_hash', t.text, (col)=>col.notNull()).addColumn('author_did', t.text, (col)=>col.notNull()).addColumn('hlc', t.text, (col)=>col.notNull()).addColumn('op_jwt', t.text, (col)=>col.notNull()).addColumn('branch_id', t.text, (col)=>col.notNull()).addColumn('created_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).addPrimaryKeyConstraint('pk_kubun_credential_key_branches', [
+                'owner_did',
                 'key_id',
                 'key_version',
                 'op_hash'
@@ -14,45 +18,30 @@ export function getCredentialMigrations(ctx) {
             // Wrappings: one row per way of opening one version of one key. Keyed on
             // its own id rather than (key, recipient) — a key can carry several
             // wrappings for the same recipient, differing in their factor lists.
-            await db.schema.createTable('kubun_credential_wrappings').ifNotExists().addColumn('wrapping_id', t.text, (col)=>col.notNull().primaryKey()).addColumn('key_id', t.text, (col)=>col.notNull()).addColumn('key_version', 'integer', (col)=>col.notNull()).addColumn('factors', t.json, (col)=>col.notNull()).addColumn('iv', t.binary, (col)=>col.notNull()).addColumn('wrapped_key', t.binary, (col)=>col.notNull()).addColumn('recipient_did', t.text).addColumn('created_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).execute();
+            await db.schema.createTable('kubun_credential_wrappings').ifNotExists().addColumn('wrapping_id', t.text, (col)=>col.notNull()).addColumn('owner_did', t.text, (col)=>col.notNull()).addColumn('key_id', t.text, (col)=>col.notNull()).addColumn('key_version', 'integer', (col)=>col.notNull()).addColumn('factors', t.json, (col)=>col.notNull()).addColumn('iv', t.binary, (col)=>col.notNull()).addColumn('wrapped_key', t.binary, (col)=>col.notNull()).addColumn('recipient_did', t.text)// The branch of the op that wrote the row, so a fork-aware read needs no op row.
+            .addColumn('branch_id', t.text, (col)=>col.notNull().defaultTo('')).addColumn('created_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).addPrimaryKeyConstraint('pk_kubun_credential_wrappings', [
+                'owner_did',
+                'wrapping_id'
+            ]).execute();
             await db.schema.createIndex('idx_kubun_credential_wrappings_key').ifNotExists().on('kubun_credential_wrappings').columns([
+                'owner_did',
                 'key_id',
                 'key_version'
             ]).execute();
             // Entries: opaque ciphertext under a key version.
-            await db.schema.createTable('kubun_credential_entries').ifNotExists().addColumn('entry_id', t.text, (col)=>col.notNull().primaryKey()).addColumn('key_id', t.text, (col)=>col.notNull()).addColumn('key_version', 'integer', (col)=>col.notNull()).addColumn('iv', t.binary, (col)=>col.notNull()).addColumn('ciphertext', t.binary, (col)=>col.notNull()).addColumn('hlc', t.text, (col)=>col.notNull()).addColumn('created_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).execute();
-            await db.schema.createIndex('idx_kubun_credential_entries_key').ifNotExists().on('kubun_credential_entries').columns([
-                'key_id'
+            await db.schema.createTable('kubun_credential_entries').ifNotExists().addColumn('entry_id', t.text, (col)=>col.notNull()).addColumn('owner_did', t.text, (col)=>col.notNull()).addColumn('key_id', t.text, (col)=>col.notNull()).addColumn('key_version', 'integer', (col)=>col.notNull()).addColumn('iv', t.binary, (col)=>col.notNull()).addColumn('ciphertext', t.binary, (col)=>col.notNull()).addColumn('hlc', t.text, (col)=>col.notNull()).addColumn('branch_id', t.text, (col)=>col.notNull().defaultTo('')).addColumn('created_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).addPrimaryKeyConstraint('pk_kubun_credential_entries', [
+                'owner_did',
+                'entry_id'
             ]).execute();
-            // Ops: the latest signed op per subject, and the only place a deletion is
-            // recorded. Keyed on (kind, id) rather than on the subject id alone —
-            // nothing guarantees a key id cannot equal an entry id, and a collision
-            // would let one subject's op tombstone another's.
-            await db.schema.createTable('kubun_credential_ops').ifNotExists().addColumn('subject_kind', t.text, (col)=>col.notNull()).addColumn('subject_id', t.text, (col)=>col.notNull()).addColumn('key_id', t.text, (col)=>col.notNull()).addColumn('author_did', t.text, (col)=>col.notNull()).addColumn('hlc', t.text, (col)=>col.notNull()).addColumn('op_jwt', t.text, (col)=>col.notNull()).addColumn('op_hash', t.text, (col)=>col.notNull())// The content-key branch this op joins. No index yet: partitioning by
-            // branch is a later slice, and the merkle scan still orders by hlc.
-            .addColumn('branch_id', t.text, (col)=>col.notNull().defaultTo('')).addColumn('deleted', 'integer', (col)=>col.notNull().defaultTo(0)).addColumn('created_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).addPrimaryKeyConstraint('pk_kubun_credential_ops', [
-                'subject_kind',
-                'subject_id'
-            ]).execute();
-            await db.schema.createIndex('idx_kubun_credential_ops_key').ifNotExists().on('kubun_credential_ops').columns([
+            await db.schema.createIndex('idx_kubun_credential_entries_key').ifNotExists().on('kubun_credential_entries').columns([
+                'owner_did',
                 'key_id'
             ]).execute();
-            // The merkle lane buckets leaves by time and reads them in stamp order, so
-            // the scan that builds a tree is this index rather than a sort of the table.
-            await db.schema.createIndex('idx_kubun_credential_ops_hlc').ifNotExists().on('kubun_credential_ops').columns([
-                'hlc'
-            ]).execute();
-            // A plain local pointer, not an op subject — no hlc, no ops row, no
-            // merkle scan. Devices that resolve the same (namespace, key) converge on
-            // it locally, so it carries nothing to replicate.
-            await db.schema.createTable('kubun_credential_aliases').ifNotExists().addColumn('namespace', t.text, (col)=>col.notNull()).addColumn('alias_key', t.text, (col)=>col.notNull()).addColumn('entry_id', t.text, (col)=>col.notNull()).addColumn('created_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).addPrimaryKeyConstraint('pk_kubun_credential_aliases', [
-                'namespace',
-                'alias_key'
-            ]).addUniqueConstraint('uq_kubun_credential_aliases_entry', [
-                'entry_id'
-            ]).execute();
             // Grantor-authority envelope for a wrapping; `refresh_seq` gates every upsert strictly-greater.
-            await db.schema.createTable('kubun_credential_wrapping_authority').ifNotExists().addColumn('wrapping_id', t.text, (col)=>col.notNull().primaryKey()).addColumn('authority_token', t.text, (col)=>col.notNull()).addColumn('refresh_seq', 'integer', (col)=>col.notNull()).execute();
+            await db.schema.createTable('kubun_credential_wrapping_authority').ifNotExists().addColumn('wrapping_id', t.text, (col)=>col.notNull()).addColumn('owner_did', t.text, (col)=>col.notNull()).addColumn('authority_token', t.text, (col)=>col.notNull()).addColumn('refresh_seq', 'integer', (col)=>col.notNull()).addPrimaryKeyConstraint('pk_kubun_credential_wrapping_authority', [
+                'owner_did',
+                'wrapping_id'
+            ]).execute();
             // Persisted counter minting strictly-increasing refreshSeq, one per (owner, recipient, grantor) triple.
             await db.schema.createTable('kubun_credential_grantor_counters').ifNotExists().addColumn('owner_did', t.text, (col)=>col.notNull()).addColumn('recipient_did', t.text, (col)=>col.notNull()).addColumn('grantor_did', t.text, (col)=>col.notNull()).addColumn('seq', 'integer', (col)=>col.notNull()).addPrimaryKeyConstraint('pk_kubun_credential_grantor_counters', [
                 'owner_did',
@@ -84,11 +73,50 @@ export function getCredentialMigrations(ctx) {
             ]).execute();
             // A controller-owned key's administer delegation chain, keyed on the key
             // itself; `refresh_seq` gates every upsert strictly-greater.
-            await db.schema.createTable('kubun_credential_key_owner_delegation').ifNotExists().addColumn('key_id', t.text, (col)=>col.notNull().primaryKey()).addColumn('delegation_tokens', t.json, (col)=>col.notNull()).addColumn('refresh_seq', t.bigint, (col)=>col.notNull())// Per-write revision for the replace CAS; `refresh_seq` is not a unique
+            await db.schema.createTable('kubun_credential_key_owner_delegation').ifNotExists().addColumn('key_id', t.text, (col)=>col.notNull()).addColumn('owner_did', t.text, (col)=>col.notNull()).addColumn('delegation_tokens', t.json, (col)=>col.notNull()).addColumn('refresh_seq', t.bigint, (col)=>col.notNull())// Per-write revision for the replace CAS; `refresh_seq` is not a unique
             // version (see CredentialKeyOwnerDelegationTable).
-            .addColumn('revision', t.bigint, (col)=>col.notNull()).execute();
+            .addColumn('revision', t.bigint, (col)=>col.notNull()).addPrimaryKeyConstraint('pk_kubun_credential_key_owner_delegation', [
+                'owner_did',
+                'key_id'
+            ]).execute();
+            // Replicated records: every held signed copy of the selected owner-qualified decision.
+            await db.schema.createTable('kubun_credential_records').ifNotExists().addColumn('type', t.text, (col)=>col.notNull()).addColumn('id', t.text, (col)=>col.notNull()).addColumn('owner', t.text, (col)=>col.notNull()).addColumn('hlc', t.text, (col)=>col.notNull()).addColumn('op_jwt', t.text, (col)=>col.notNull()).addColumn('op_hash', t.text, (col)=>col.notNull()).addColumn('payload_digest', t.text).addColumn('payload', t.binary).addColumn('deleted', 'integer', (col)=>col.notNull()).addColumn('meta', t.json, (col)=>col.notNull()).addColumn('created_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).addPrimaryKeyConstraint('pk_kubun_credential_records', [
+                'type',
+                'owner',
+                'id',
+                'op_hash'
+            ]).execute();
+            await db.schema.createTable('kubun_credential_entry_candidates').ifNotExists().addColumn('owner_did', t.text, (col)=>col.notNull()).addColumn('key_id', t.text, (col)=>col.notNull()).addColumn('key_version', 'integer', (col)=>col.notNull()).addColumn('branch_id', t.text, (col)=>col.notNull()).addColumn('entry_id', t.text, (col)=>col.notNull()).addColumn('owner', t.text, (col)=>col.notNull()).addColumn('hlc', t.text, (col)=>col.notNull()).addColumn('op_jwt', t.text, (col)=>col.notNull()).addColumn('op_hash', t.text, (col)=>col.notNull()).addColumn('payload', t.binary).addColumn('created_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).addPrimaryKeyConstraint('pk_kubun_credential_entry_candidates', [
+                'owner_did',
+                'entry_id',
+                'op_hash'
+            ]).execute();
+            await db.schema.createIndex('idx_kubun_credential_entry_candidates_key_branch').on('kubun_credential_entry_candidates').columns([
+                'owner_did',
+                'key_id',
+                'key_version',
+                'branch_id'
+            ]).execute();
+            // Revoked recipients per key; only a revocation record writes here.
+            await db.schema.createTable('kubun_credential_revocations').ifNotExists().addColumn('key_id', t.text, (col)=>col.notNull()).addColumn('recipient_did', t.text, (col)=>col.notNull()).addColumn('owner_did', t.text, (col)=>col.notNull()).addColumn('created_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).addPrimaryKeyConstraint('pk_kubun_credential_revocations', [
+                'owner_did',
+                'key_id',
+                'recipient_did'
+            ]).execute();
+            // Per-device grant pointers.
+            await db.schema.createTable('kubun_credential_device_aliases').ifNotExists().addColumn('provider_name', t.text, (col)=>col.notNull()).addColumn('owner_did', t.text, (col)=>col.notNull()).addColumn('device_did', t.text, (col)=>col.notNull()).addColumn('entry_id', t.text, (col)=>col.notNull()).addColumn('entry_owner_did', t.text, (col)=>col.notNull()).addColumn('created_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).addPrimaryKeyConstraint('pk_kubun_credential_device_aliases', [
+                'provider_name',
+                'owner_did',
+                'device_did'
+            ]).addUniqueConstraint('uq_kubun_credential_device_aliases_entry', [
+                'entry_id'
+            ]).execute();
         },
         async down (db) {
+            await db.schema.dropTable('kubun_credential_device_aliases').ifExists().execute();
+            await db.schema.dropTable('kubun_credential_revocations').ifExists().execute();
+            await db.schema.dropTable('kubun_credential_entry_candidates').ifExists().execute();
+            await db.schema.dropTable('kubun_credential_records').ifExists().execute();
             await db.schema.dropTable('kubun_credential_key_owner_delegation').ifExists().execute();
             await db.schema.dropTable('kubun_credential_manifests').ifExists().execute();
             await db.schema.dropTable('kubun_credential_provisioning_attempts').ifExists().execute();
@@ -96,8 +124,6 @@ export function getCredentialMigrations(ctx) {
             await db.schema.dropTable('kubun_credential_provisioning_epochs').ifExists().execute();
             await db.schema.dropTable('kubun_credential_grantor_counters').ifExists().execute();
             await db.schema.dropTable('kubun_credential_wrapping_authority').ifExists().execute();
-            await db.schema.dropTable('kubun_credential_aliases').ifExists().execute();
-            await db.schema.dropTable('kubun_credential_ops').ifExists().execute();
             await db.schema.dropTable('kubun_credential_entries').ifExists().execute();
             await db.schema.dropTable('kubun_credential_wrappings').ifExists().execute();
             await db.schema.dropTable('kubun_credential_key_branches').ifExists().execute();

package/lib/records.d.ts

@@ -0,0 +1,206 @@
+import { type MethodRegistry } from '@kokuin/token';
+import type { Adapter } from '@kubun/db-adapter';
+import { type RecordClaim, type RecordStoreAdapter, type SignedRecord, type VerifiedRecordOp } from '@kubun/records';
+import type { Kysely } from 'kysely';
+import type { CredentialStoreAPI } from './api.js';
+import type { CredentialFactorDescriptor, CredentialKeyState, CredentialManifestKey, CredentialRecordRow, CredentialTables } from './tables.js';
+/** The replicated credential record types, each projected onto one indexed table. */
+export declare const CREDENTIAL_RECORD_TYPES: readonly ["credential.key", "credential.key-branch", "credential.wrapping", "credential.wrapping-authority", "credential.entry", "credential.manifest", "credential.revocation"];
+export type CredentialRecordType = (typeof CREDENTIAL_RECORD_TYPES)[number];
+/**
+ * What each record type's payload holds, as the store decodes it. On the wire and in the
+ * store a payload is the canonical JSON of this object (keys sorted, UTF-8), with every
+ * byte string spelled as unpadded base64url; {@link encodeCredentialRecordPayload} writes
+ * exactly those bytes, and the store refuses any other spelling.
+ */
+export type CredentialRecordPayloads = {
+    'credential.key': {
+        suite: number;
+        state: CredentialKeyState;
+    };
+    /** The key op that introduced the branch, retained verbatim as provenance. */
+    'credential.key-branch': {
+        authorDID: string;
+        hlc: string;
+        opJWT: string;
+        opHash: string;
+        suite: number;
+    };
+    'credential.wrapping': {
+        factors: Array<CredentialFactorDescriptor>;
+        iv: Uint8Array;
+        wrappedKey: Uint8Array;
+    };
+    'credential.wrapping-authority': {
+        envelope: string;
+    };
+    'credential.entry': {
+        iv: Uint8Array;
+        ciphertext: Uint8Array;
+    };
+    'credential.manifest': {
+        keys: Array<CredentialManifestKey>;
+        token: string;
+        delegationTokens: Array<string>;
+    };
+    'credential.revocation': Record<string, never>;
+};
+/**
+ * The claim `meta` fields the store reads to address each type's indexed row. A claim may
+ * carry more fields for its policy or visibility; the store ignores them.
+ *
+ * - `credential.key`: `keyID` equals the record id.
+ * - `credential.key-branch`: the record id is the payload digest.
+ * - `credential.wrapping`: `recipient`, when present, is indexed normalized. `branchID`, the
+ *   introducing key op's `${hlc}:${opHash}` label, is indexed so the fork-aware read path
+ *   sees the record's branch; it is never empty, since an empty label reads as
+ *   branch-agnostic and would slip past the fork filter.
+ * - `credential.entry`: `branchID` as for a wrapping.
+ * - `credential.wrapping-authority`: `wrappingID` equals the record id.
+ * - `credential.manifest`: the record id is {@link credentialManifestRecordID} of `recipient`
+ *   and `grantor`; the owner is the record's owner.
+ * - `credential.revocation`: the record id is {@link credentialRevocationRecordID} of `keyID`
+ *   and `revokedDID`.
+ */
+export type CredentialRecordMetas = {
+    'credential.key': {
+        keyID: string;
+        version: number;
+    };
+    'credential.key-branch': {
+        keyID: string;
+        keyVersion: number;
+        branchID: string;
+    };
+    'credential.wrapping': {
+        keyID: string;
+        keyVersion: number;
+        branchID: string;
+        recipient?: string | null;
+    };
+    'credential.wrapping-authority': {
+        wrappingID: string;
+        refreshSeq: number;
+    };
+    'credential.entry': {
+        keyID: string;
+        keyVersion: number;
+        branchID: string;
+    };
+    'credential.manifest': {
+        recipient: string;
+        grantor: string;
+        epoch: number;
+        sequence: number;
+    };
+    'credential.revocation': {
+        keyID: string;
+        revokedDID: string;
+    };
+};
+/** A live credential record with its payload and addressing meta decoded. */
+export type DecodedCredentialRecord = {
+    [T in CredentialRecordType]: {
+        type: T;
+        id: string;
+        owner: string;
+        hlc: string;
+        meta: CredentialRecordMetas[T];
+        payload: CredentialRecordPayloads[T];
+    };
+}[CredentialRecordType];
+/** A failure about one credential record, naming it by `(type, id)`. */
+export declare class CredentialRecordError extends Error {
+    #private;
+    constructor(type: string, id: string, message: string, options?: ErrorOptions);
+    get type(): string;
+    get id(): string;
+}
+/** Thrown when a record's payload or addressing meta does not have its type's shape. */
+export declare class CredentialRecordPayloadError extends CredentialRecordError {
+    constructor(type: string, id: string, reason: string, options?: ErrorOptions);
+}
+/** Thrown when a record's op does not verify, or does not sign its payload. */
+export declare class CredentialRecordSignatureError extends CredentialRecordError {
+    constructor(type: string, id: string);
+}
+/**
+ * Thrown when a stored record row cannot be read back as a record. A corrupt row is never
+ * reported as absent: an absent record admits any first write, so an older op would replace
+ * the one the row held.
+ */
+export declare class CredentialRecordRowError extends CredentialRecordError {
+    constructor(type: string, id: string, reason: string);
+}
+/** The id of the revocation of `revokedDID` from key `keyID`. */
+export declare function credentialRevocationRecordID(keyID: string, revokedDID: string): string;
+/** The id of the manifest a grantor records for one recipient, under the record's owner. */
+export declare function credentialManifestRecordID(recipientDID: string, grantorDID: string): string;
+/** The payload bytes of a credential record: canonical JSON, byte strings as base64url. */
+export declare function encodeCredentialRecordPayload<T extends CredentialRecordType>(type: T, payload: CredentialRecordPayloads[T]): Uint8Array;
+/**
+ * Decode a live credential record's payload and the meta fields that address its indexed
+ * row. DIDs the store keys on are returned normalized. A type's authorizer can call this to
+ * refuse a record the store would not accept.
+ *
+ * @throws CredentialRecordPayloadError when the type is not a credential type, the record is
+ * a tombstone, or its payload or meta does not have the type's shape.
+ */
+export declare function decodeCredentialRecord(record: Pick<SignedRecord, 'type' | 'id' | 'owner' | 'hlc' | 'payload'>, meta: Record<string, unknown>): DecodedCredentialRecord;
+/**
+ * A stored row as the record it holds. The signature is not checked here — apply verifies
+ * every stored op it reads — but everything the row repeats must agree with itself.
+ *
+ * @throws CredentialRecordRowError when it does not.
+ */
+export declare function credentialRecordFromRow(row: CredentialRecordRow): SignedRecord;
+/** Keep every authenticated entry operation for branch comparison, including a losing op. */
+export declare function retainCredentialEntryCandidate(tx: Kysely<CredentialTables>, record: SignedRecord, claim: RecordClaim, adapter: Adapter): Promise<void>;
+export type VerifiedRecordCopies = Map<string, Map<string, {
+    copy: SignedRecord;
+    op: VerifiedRecordOp;
+}>>;
+/**
+ * Store a copy of the selected decision of its `(type, owner, id)`, and
+ * bring its indexed row along in the same transaction: a live record writes its row, a
+ * tombstone removes the row the previous op projected, and a record whose index address
+ * moved removes its old row. Merge decisions are the caller's; this only checks that the
+ * record is signed and has its type's shape, before anything is written.
+ *
+ * @throws CredentialRecordSignatureError when the op does not verify or sign the payload.
+ * @throws CredentialRecordPayloadError when a live record does not have its type's shape.
+ * @throws CredentialRecordRowError when the row it replaces is corrupt.
+ */
+export declare function putCredentialRecord(params: {
+    record: SignedRecord;
+    methods?: MethodRegistry;
+    verifiedCopies: VerifiedRecordCopies;
+    adapter: Adapter;
+    write: (fn: (tx: Kysely<CredentialTables>) => Promise<void>) => Promise<void>;
+    lockKey: (tx: Kysely<CredentialTables>, keyID: string) => Promise<void>;
+}): Promise<void>;
+export type CredentialRecordAdapterOptions = {
+    methods?: MethodRegistry;
+    /** Called for each stored row `list` skips because it cannot be read back as a record. */
+    onCorruptRow?: (info: {
+        type: string;
+        id: string;
+        error: unknown;
+    }) => void;
+};
+/**
+ * The records primitive's view of the credential store.
+ *
+ * `get` throws {@link CredentialRecordRowError} on a corrupt row rather than answering
+ * absent, so apply fails closed on it. `list` skips such a row, reporting it through
+ * `onCorruptRow`, so one bad row does not hide every other record of its type. Rows the
+ * legacy verbs wrote into the indexed tables are not records and never appear.
+ */
+export declare function credentialRecordAdapter(store: CredentialStoreAPI, options?: CredentialRecordAdapterOptions): RecordStoreAdapter;
+/**
+ * The credential store behind an adapter {@link credentialRecordAdapter} made, bound to the
+ * same transaction, or `null` for any other adapter. A record type's hooks receive only the
+ * adapter; this lets them reach the indexed tables inside the transaction they run in,
+ * rather than through a store bound outside it.
+ */
+export declare function credentialStoreOf(adapter: RecordStoreAdapter): CredentialStoreAPI | null;