@seams/wallet-server 0.5.0

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionStore.js

@@ -0,0 +1,732 @@
+import { hasControlCharacter, parseLinkDeviceSessionId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { assertNeverLinkSessionStateV1 } from "../../../../shared-ts/src/device-linking/contracts.js";
+import { parseLinkedDeviceApprovalV1, parseLinkedDeviceSessionClaimV1 } from "../../../../shared-ts/src/device-linking/parsers.js";
+import { computeLinkedDeviceApprovalDigestV1, computeLinkedDeviceSessionClaimDigestV1 } from "../../../../shared-ts/src/device-linking/digests.js";
+import { d1ChangedRows, queryD1All } from "../../../../storage/d1Sql.js";
+import { LinkedDeviceRetiredSessionShapeErrorV1, linkedDeviceQrPayloadsEqualV1, parseLinkedDeviceSessionRecordV1 } from "../../../../core/deviceLinking/linkedDeviceSession.js";
+import { parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1 } from "./d1LinkedDeviceSessionRecords.js";
+//#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceSessionStore.ts
+const SESSION_TABLE = "linked_device_sessions";
+const TRANSCRIPT_TABLE = "linked_device_session_transcripts";
+const SESSION_SCOPED_TABLES = [
+	"linked_device_email_otp_grants",
+	"linked_device_ed25519_export_root_transfers",
+	"linked_device_request_proof_nonces",
+	TRANSCRIPT_TABLE,
+	"linked_device_target_commit_reservations",
+	"linked_device_target_credentials"
+];
+const SESSION_CAS_GUARD_SQL = `INSERT INTO linked_device_session_cas_guard (guard_id)
+SELECT 1 WHERE changes() = 0`;
+var D1LinkedDeviceSessionStoreV1 = class {
+	constructor(options) {
+		this.database = options.database;
+		this.scope = normalizeScope(options.scope);
+		this.now = options.now ?? Date.now;
+	}
+	async createUnclaimedSessionV1(record) {
+		const normalized = parseLinkedDeviceSessionRecordV1(record);
+		if (normalized.state.state !== "displaying_qr" || normalized.revision !== 1) return invalidStateResult(normalized);
+		let insertError;
+		try {
+			if (d1ChangedRows(await this.database.prepare(`INSERT INTO ${SESSION_TABLE} (
+             namespace, org_id, project_id, env_id, link_session_id,
+             link_public_key_b64u, device_public_key_b64u, state, record_json,
+             revision, expires_at_ms, claim_expires_at_ms, claim_digest_b64u,
+             approval_digest_b64u, authority_id, package_set_digest_b64u,
+             created_at_ms, updated_at_ms
+           ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).bind(...scopeValues(this.scope), ...sessionColumnValues(normalized)).run()) === 1) return {
+				outcome: "applied",
+				record: normalized
+			};
+		} catch (error) {
+			insertError = error;
+		}
+		const existing = await this.getSessionV1(normalized.linkSessionId);
+		if (!existing) {
+			if (insertError) throw insertError;
+			throw new Error("linked-device session insert did not persist");
+		}
+		if (linkedDeviceQrPayloadsEqualV1(existing.qrPayload, normalized.qrPayload)) return {
+			outcome: "replayed",
+			record: existing
+		};
+		return conflictResult(1, existing);
+	}
+	async getSessionV1(linkSessionId) {
+		const row = await this.database.prepare(`SELECT link_session_id, link_public_key_b64u, device_public_key_b64u,
+                state, record_json, revision, expires_at_ms, claim_expires_at_ms,
+                claim_digest_b64u, approval_digest_b64u, authority_id,
+                package_set_digest_b64u, created_at_ms, updated_at_ms
+           FROM ${SESSION_TABLE}
+          WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
+            AND link_session_id = ?
+          LIMIT 1`).bind(...scopeValues(this.scope), String(linkSessionId)).first();
+		if (!row) return null;
+		let parsed;
+		try {
+			parsed = parseD1LinkedDeviceSessionRowV1(row);
+		} catch (error) {
+			if (!(error instanceof LinkedDeviceRetiredSessionShapeErrorV1)) throw error;
+			await this.deleteRetiredShapeSessionRowV1(linkSessionId);
+			return null;
+		}
+		await this.verifyImmutableTranscripts(parsed.record);
+		return parsed.record;
+	}
+	async deleteRetiredShapeSessionRowV1(linkSessionId) {
+		await this.database.batch([...buildSessionScopedDeleteStatements({
+			database: this.database,
+			scope: this.scope,
+			linkSessionId
+		}), this.database.prepare(`DELETE FROM ${SESSION_TABLE}
+             WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
+               AND link_session_id = ?`).bind(...scopeValues(this.scope), String(linkSessionId))]);
+	}
+	async listSessionsForWalletV1(input) {
+		if (!Number.isSafeInteger(input.limit) || input.limit < 1) throw new Error("linked-device session list limit is invalid");
+		const cursorClause = input.cursor ? ` AND (updated_at_ms < ?6 OR (updated_at_ms = ?6 AND link_session_id > ?7))` : "";
+		const limitParameter = input.cursor ? "?8" : "?6";
+		const rows = await queryD1All(this.database, `SELECT link_session_id, link_public_key_b64u, device_public_key_b64u,
+              state, record_json, revision, expires_at_ms, claim_expires_at_ms,
+              claim_digest_b64u, approval_digest_b64u, authority_id,
+              package_set_digest_b64u, created_at_ms, updated_at_ms
+         FROM ${SESSION_TABLE}
+        WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+          AND json_extract(record_json, '$.approvalTranscript.value.walletId') = ?5
+          ${cursorClause}
+        ORDER BY updated_at_ms DESC, link_session_id ASC
+        LIMIT ${limitParameter}`, [
+			...scopeValues(this.scope),
+			String(input.walletId),
+			...input.cursor ? [input.cursor.updatedAtMs, String(input.cursor.linkSessionId)] : [],
+			input.limit + 1
+		]);
+		if (rows.length === 0) return {
+			records: [],
+			nextCursor: null
+		};
+		const sessionIds = rows.map((row) => requiredSessionId(row.link_session_id));
+		const transcripts = await queryD1All(this.database, `SELECT transcript.link_session_id, transcript.transcript_kind,
+              transcript.digest_b64u, transcript.transcript_json, transcript.created_at_ms
+         FROM ${TRANSCRIPT_TABLE} AS transcript
+         JOIN ${SESSION_TABLE} AS session
+           ON session.namespace = transcript.namespace
+          AND session.org_id = transcript.org_id
+          AND session.project_id = transcript.project_id
+          AND session.env_id = transcript.env_id
+          AND session.link_session_id = transcript.link_session_id
+        WHERE transcript.namespace = ?1 AND transcript.org_id = ?2
+          AND transcript.project_id = ?3 AND transcript.env_id = ?4
+          AND transcript.link_session_id IN (${sessionIds.map((_, index) => `?${index + 5}`).join(", ")})
+        ORDER BY transcript.link_session_id ASC, transcript.transcript_kind ASC`, [...scopeValues(this.scope), ...sessionIds]);
+		const transcriptBySession = /* @__PURE__ */ new Map();
+		for (const row of transcripts) {
+			const sessionId = requiredSessionId(row.link_session_id);
+			const existing = transcriptBySession.get(sessionId);
+			if (existing) existing.push(row);
+			else transcriptBySession.set(sessionId, [row]);
+		}
+		const records = [];
+		for (const row of rows) {
+			let parsed;
+			try {
+				parsed = parseD1LinkedDeviceSessionRowV1(row);
+			} catch (error) {
+				if (!(error instanceof LinkedDeviceRetiredSessionShapeErrorV1)) throw error;
+				continue;
+			}
+			await this.verifyImmutableTranscriptsForRows(parsed.record, transcriptBySession.get(String(parsed.record.linkSessionId)) ?? []);
+			records.push(parsed.record);
+		}
+		const boundary = rows.length > input.limit ? rows[input.limit - 1] : void 0;
+		return {
+			records: records.slice(0, input.limit),
+			nextCursor: boundary ? {
+				updatedAtMs: requiredTimestamp(boundary.updated_at_ms, "updated_at_ms"),
+				linkSessionId: requiredLinkSessionId(boundary.link_session_id)
+			} : null
+		};
+	}
+	async claimSessionV1(input) {
+		const current = await this.getSessionV1(input.linkSessionId);
+		if (!current) return conflictResult(input.expectedRevision, null);
+		if (claimTranscriptMatchesDigest(current, input.claimDigestB64u)) return {
+			outcome: "replayed",
+			record: current
+		};
+		if (current.state.state !== "displaying_qr") return invalidStateResult(current);
+		if (input.nowMs >= current.qrPayload.expiresAtMs) return {
+			outcome: "expired",
+			record: current
+		};
+		return this.applyTranscriptCas({
+			kind: "claim",
+			linkSessionId: input.linkSessionId,
+			expectedRevision: input.expectedRevision,
+			digestB64u: input.claimDigestB64u,
+			transcript: input.claim,
+			nextRecord: input.nextRecord,
+			nowMs: input.nowMs,
+			nextStates: ["claimed"],
+			current
+		});
+	}
+	async recordOwnerApprovalV1(input) {
+		const current = await this.getSessionV1(input.linkSessionId);
+		if (!current) return conflictResult(input.expectedRevision, null);
+		if (approvalTranscriptMatchesDigest(current, input.approvalDigestB64u)) return {
+			outcome: "replayed",
+			record: current
+		};
+		if (current.state.state !== "claimed") return invalidStateResult(current);
+		if (!current.claimTranscript || input.nowMs >= current.claimTranscript.value.claimExpiresAtMs) return {
+			outcome: "expired",
+			record: current
+		};
+		return this.applyTranscriptCas({
+			kind: "approval",
+			linkSessionId: input.linkSessionId,
+			expectedRevision: input.expectedRevision,
+			digestB64u: input.approvalDigestB64u,
+			transcript: input.approval,
+			nextRecord: input.nextRecord,
+			nowMs: input.nowMs,
+			nextStates: ["awaiting_target_factor"],
+			current
+		});
+	}
+	async recordTargetCredentialV1(input) {
+		return this.applyStateCas({
+			linkSessionId: input.linkSessionId,
+			expectedRevision: input.expectedRevision,
+			nextRecord: input.nextRecord,
+			nowMs: input.nowMs,
+			expectedStates: ["awaiting_target_factor"],
+			nextStates: ["awaiting_source_contribution"],
+			replay: isAwaitingSourceContributionRecord
+		});
+	}
+	async recordSourceContributionV1(input) {
+		const current = await this.getSessionV1(input.linkSessionId);
+		if (!current) return conflictResult(input.expectedRevision, null);
+		if (sourceContributionTranscriptMatchesDigest(current, input.approvalDigestB64u)) return {
+			outcome: "replayed",
+			record: current
+		};
+		if (current.state.state !== "awaiting_source_contribution") return invalidStateResult(current);
+		return this.applyTranscriptCas({
+			kind: "source_contribution",
+			linkSessionId: input.linkSessionId,
+			expectedRevision: input.expectedRevision,
+			digestB64u: input.approvalDigestB64u,
+			transcript: input.approval,
+			nextRecord: input.nextRecord,
+			nowMs: input.nowMs,
+			nextStates: ["provisioning"],
+			current
+		});
+	}
+	async recordEmailOtpChallengeStateV1(input) {
+		return this.applyStateCas({
+			linkSessionId: input.linkSessionId,
+			expectedRevision: input.expectedRevision,
+			nextRecord: input.nextRecord,
+			nowMs: input.nowMs,
+			expectedStates: ["awaiting_target_factor"],
+			nextStates: ["awaiting_target_factor"],
+			replay: sameEmailOtpChallenge
+		});
+	}
+	buildTargetCredentialCasStatementsV1(input) {
+		if (normalizeMutationRecordV1(input).revision !== input.expectedRevision + 1) throw new Error("linked-device mutation revision is invalid");
+		return [this.updateStatement(input), this.database.prepare(SESSION_CAS_GUARD_SQL)];
+	}
+	/**
+	* Builds the session half of the pending-authority transaction. The caller
+	* supplies the already validated next record; the CAS guard keeps the
+	* authority and session writes in one D1 batch.
+	*/
+	buildAuthorityPendingLocalInstallCasStatementsV1(input) {
+		const nextRecord = normalizeMutationRecordV1(input);
+		if (nextRecord.revision !== input.expectedRevision + 1 || nextRecord.state.state !== "authority_pending_local_install") throw new Error("linked-device pending-authority session CAS input is invalid");
+		return [this.updateStatement(input), this.database.prepare(SESSION_CAS_GUARD_SQL)];
+	}
+	/** Builds the session half of the pending-to-active authority transaction. */
+	buildAuthorityActivationCasStatementsV1(input) {
+		const nextRecord = normalizeMutationRecordV1(input);
+		if (nextRecord.revision !== input.expectedRevision + 1 || nextRecord.state.state !== "active") throw new Error("linked-device active-authority session CAS input is invalid");
+		return [this.updateStatement(input), this.database.prepare(SESSION_CAS_GUARD_SQL)];
+	}
+	async markAuthorityPendingLocalInstallV1(input) {
+		return this.applyStateCas({
+			linkSessionId: input.linkSessionId,
+			expectedRevision: input.expectedRevision,
+			nextRecord: input.nextRecord,
+			nowMs: input.nowMs,
+			expectedStates: ["provisioning"],
+			nextStates: ["authority_pending_local_install"],
+			replay: (record) => record.state.state === "authority_pending_local_install" && record.state.authorityId === input.authorityId && record.state.packageSetDigestB64u === input.packageSetDigestB64u
+		});
+	}
+	async activateSessionV1(input) {
+		const current = await this.getSessionV1(input.linkSessionId);
+		if (!current) return conflictResult(input.expectedRevision, null);
+		if (current.state.state === "active" && current.state.authorityId === input.authorityId && current.packageSetDigestB64u === input.packageSetDigestB64u) return {
+			outcome: "replayed",
+			record: current
+		};
+		if (current.state.state !== "authority_pending_local_install") return invalidStateResult(current);
+		if (current.state.authorityId !== input.authorityId || current.state.packageSetDigestB64u !== input.packageSetDigestB64u) return integrityResult(current, current.state.authorityId !== input.authorityId ? "authority_id_mismatch" : "package_set_digest_mismatch");
+		return this.applyStateCas({
+			linkSessionId: input.linkSessionId,
+			expectedRevision: input.expectedRevision,
+			nextRecord: input.nextRecord,
+			nowMs: input.nowMs,
+			expectedStates: ["authority_pending_local_install"],
+			nextStates: ["active"],
+			replay: isActiveRecord
+		});
+	}
+	async failBeforeCommitV1(input) {
+		return this.applyTerminalStateCas({
+			linkSessionId: input.linkSessionId,
+			expectedRevision: input.expectedRevision,
+			nextRecord: input.nextRecord,
+			nowMs: input.nowMs,
+			expectedStates: [
+				"displaying_qr",
+				"claimed",
+				"awaiting_target_factor",
+				"awaiting_source_contribution",
+				"provisioning"
+			],
+			nextStates: ["failed_before_commit"],
+			replay: isFailedRecord
+		});
+	}
+	async cancelSessionV1(input) {
+		return this.applyTerminalStateCas({
+			linkSessionId: input.linkSessionId,
+			expectedRevision: input.expectedRevision,
+			nextRecord: input.nextRecord,
+			nowMs: input.nowMs,
+			expectedStates: [
+				"displaying_qr",
+				"claimed",
+				"awaiting_target_factor",
+				"awaiting_source_contribution",
+				"provisioning"
+			],
+			nextStates: ["cancelled"],
+			replay: isCancelledRecord
+		});
+	}
+	async expireSessionV1(input) {
+		const current = await this.getSessionV1(input.linkSessionId);
+		if (!current) return conflictResult(input.expectedRevision, null);
+		if (current.state.state === "expired") return {
+			outcome: "replayed",
+			record: current
+		};
+		if (!isExpirableState(current.state)) return invalidStateResult(current);
+		if (input.nowMs < expiryMs(current)) return invalidStateResult(current);
+		return this.applyTerminalStateCas({
+			linkSessionId: input.linkSessionId,
+			expectedRevision: input.expectedRevision,
+			nextRecord: input.nextRecord,
+			nowMs: input.nowMs,
+			expectedStates: [
+				"displaying_qr",
+				"claimed",
+				"awaiting_target_factor",
+				"awaiting_source_contribution",
+				"provisioning"
+			],
+			nextStates: ["expired"],
+			replay: isExpiredRecord
+		});
+	}
+	async deleteActiveSessionV1(input) {
+		return await this.deleteActiveSessionWithStatementsV1({
+			...input,
+			beforeDeleteStatements: [],
+			afterDeleteStatements: []
+		});
+	}
+	async deleteActiveSessionWithStatementsV1(input) {
+		const current = await this.getSessionV1(input.linkSessionId);
+		if (!current) return {
+			outcome: "deleted",
+			record: null
+		};
+		if (current.state.state !== "active") return invalidStateResult(current);
+		if (current.state.authorityId !== input.authorityId) return integrityResult(current, "authority_id_mismatch");
+		if (current.packageSetDigestB64u !== input.packageSetDigestB64u) return integrityResult(current, "package_set_digest_mismatch");
+		if (current.revision !== input.expectedRevision) return conflictResult(input.expectedRevision, current);
+		const guardEachStatement = (statements) => statements.flatMap((statement) => [statement, this.database.prepare(SESSION_CAS_GUARD_SQL)]);
+		await this.database.batch([
+			...guardEachStatement(input.beforeDeleteStatements),
+			...buildSessionScopedDeleteStatements({
+				database: this.database,
+				scope: this.scope,
+				linkSessionId: input.linkSessionId
+			}),
+			this.database.prepare(`DELETE FROM ${SESSION_TABLE}
+             WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
+               AND link_session_id = ? AND revision = ?`).bind(...scopeValues(this.scope), String(input.linkSessionId), input.expectedRevision),
+			this.database.prepare(SESSION_CAS_GUARD_SQL),
+			...guardEachStatement(input.afterDeleteStatements)
+		]);
+		const persisted = await this.getSessionV1(input.linkSessionId);
+		return persisted ? resolveMutationRace(input.expectedRevision, persisted) : {
+			outcome: "deleted",
+			record: null
+		};
+	}
+	async applyTranscriptCas(input) {
+		const nextRecord = normalizeMutationRecordV1(input);
+		if (nextRecord.revision !== input.current.revision + 1) throw new Error("linked-device mutation revision is invalid");
+		if (!input.nextStates.includes(nextRecord.state.state)) throw new Error("linked-device transcript transition is invalid");
+		const transcript = input.kind === "claim" ? nextRecord.claimTranscript : input.kind === "approval" ? nextRecord.approvalTranscript : nextRecord.sourceContributionTranscript;
+		const inputDigestB64u = await computeLinkedDeviceTranscriptDigestV1(input.kind, input.transcript);
+		if (!transcript || transcript.digestB64u !== input.digestB64u || inputDigestB64u !== input.digestB64u) throw new Error("linked-device transcript does not match the next record");
+		const update = this.updateStatement({
+			linkSessionId: input.linkSessionId,
+			expectedRevision: input.expectedRevision,
+			nextRecord,
+			nowMs: input.nowMs
+		});
+		const transcriptInsert = this.database.prepare(`INSERT INTO ${TRANSCRIPT_TABLE} (
+           namespace, org_id, project_id, env_id, link_session_id,
+           transcript_kind, digest_b64u, transcript_json, created_at_ms
+         ) SELECT ?, ?, ?, ?, ?, ?, ?, ?, ? WHERE changes() = 1`).bind(...scopeValues(this.scope), String(input.linkSessionId), input.kind, input.digestB64u, JSON.stringify(transcript.value), input.nowMs);
+		try {
+			await this.database.batch([
+				update,
+				transcriptInsert,
+				this.database.prepare(SESSION_CAS_GUARD_SQL)
+			]);
+		} catch {
+			const raced = await this.getSessionV1(input.linkSessionId);
+			if (!raced) throw new Error("linked-device session disappeared after transcript CAS");
+			if (input.kind === "claim" ? claimTranscriptMatchesDigest(raced, input.digestB64u) : input.kind === "approval" ? approvalTranscriptMatchesDigest(raced, input.digestB64u) : sourceContributionTranscriptMatchesDigest(raced, input.digestB64u)) return {
+				outcome: "replayed",
+				record: raced
+			};
+			return conflictResult(input.expectedRevision, raced);
+		}
+		const persisted = await this.getSessionV1(input.linkSessionId);
+		if (!persisted) throw new Error("linked-device session disappeared after CAS");
+		return persisted.revision === nextRecord.revision ? {
+			outcome: "applied",
+			record: persisted
+		} : resolveMutationRace(input.expectedRevision, persisted);
+	}
+	async applyStateCas(input) {
+		const current = await this.getSessionV1(input.linkSessionId);
+		if (!current) return conflictResult(input.expectedRevision, null);
+		const normalized = normalizeMutationRecordV1(input);
+		const nextRecord = input.terminal ? minimalTerminalRecordV1(normalized) : normalized;
+		if (nextRecord.revision !== current.revision + 1) throw new Error("linked-device mutation revision is invalid");
+		if (!input.nextStates.includes(nextRecord.state.state)) throw new Error(input.terminal ? "linked-device terminal transition is invalid" : "linked-device state transition is invalid");
+		if (input.replay(current, nextRecord)) return {
+			outcome: "replayed",
+			record: current
+		};
+		if (!input.expectedStates.includes(current.state.state)) return invalidStateResult(current);
+		if (input.terminal) try {
+			await this.database.batch([
+				this.updateStatement({
+					linkSessionId: input.linkSessionId,
+					expectedRevision: input.expectedRevision,
+					nextRecord,
+					nowMs: input.nowMs
+				}),
+				this.database.prepare(SESSION_CAS_GUARD_SQL),
+				...buildSessionScopedDeleteStatements({
+					database: this.database,
+					scope: this.scope,
+					linkSessionId: input.linkSessionId
+				})
+			]);
+		} catch {
+			const raced = await this.getSessionV1(input.linkSessionId);
+			if (!raced) throw new Error("linked-device session disappeared after terminal CAS");
+			if (input.replay(raced, nextRecord)) return {
+				outcome: "replayed",
+				record: raced
+			};
+			return conflictResult(input.expectedRevision, raced);
+		}
+		else if (d1ChangedRows(await this.updateStatement({
+			linkSessionId: input.linkSessionId,
+			expectedRevision: input.expectedRevision,
+			nextRecord,
+			nowMs: input.nowMs
+		}).run()) !== 1) {
+			const raced = await this.getSessionV1(input.linkSessionId);
+			if (!raced) throw new Error("linked-device session disappeared after state CAS");
+			if (input.replay(raced, nextRecord)) return {
+				outcome: "replayed",
+				record: raced
+			};
+			return resolveMutationRace(input.expectedRevision, raced);
+		}
+		const persisted = await this.getSessionV1(input.linkSessionId);
+		if (!persisted) throw new Error("linked-device session disappeared after state CAS");
+		return persisted.revision === nextRecord.revision ? {
+			outcome: "applied",
+			record: persisted
+		} : resolveMutationRace(input.expectedRevision, persisted);
+	}
+	async applyTerminalStateCas(input) {
+		return await this.applyStateCas({
+			...input,
+			terminal: true
+		});
+	}
+	updateStatement(input) {
+		const record = normalizeMutationRecordV1(input);
+		return this.database.prepare(`UPDATE ${SESSION_TABLE}
+            SET state = ?, record_json = ?, revision = ?, expires_at_ms = ?,
+                claim_expires_at_ms = ?, claim_digest_b64u = ?,
+                approval_digest_b64u = ?, authority_id = ?,
+                package_set_digest_b64u = ?, updated_at_ms = ?
+          WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
+            AND link_session_id = ? AND revision = ?`).bind(record.state.state, JSON.stringify(record), record.revision, record.qrPayload.expiresAtMs, record.claimTranscript?.value.claimExpiresAtMs ?? null, record.claimTranscript?.digestB64u ?? null, record.approvalTranscript?.digestB64u ?? null, record.authorityId ? String(record.authorityId) : null, record.packageSetDigestB64u ?? null, input.nowMs, ...scopeValues(this.scope), String(input.linkSessionId), input.expectedRevision);
+	}
+	async verifyImmutableTranscripts(record) {
+		const rows = await this.database.prepare(`SELECT transcript_kind, digest_b64u, transcript_json, created_at_ms
+           FROM ${TRANSCRIPT_TABLE}
+          WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
+            AND link_session_id = ?
+          ORDER BY transcript_kind ASC`).bind(...scopeValues(this.scope), String(record.linkSessionId)).all();
+		await this.verifyImmutableTranscriptsForRows(record, rows.results ?? []);
+	}
+	async verifyImmutableTranscriptsForRows(record, rows) {
+		const expected = /* @__PURE__ */ new Map();
+		if (record.claimTranscript) {
+			if (await computeLinkedDeviceSessionClaimDigestV1(record.claimTranscript.value) !== record.claimTranscript.digestB64u) throw new Error("claim transcript digest is invalid");
+			expected.set("claim", record.claimTranscript.digestB64u);
+		}
+		if (record.approvalTranscript) {
+			if (await computeLinkedDeviceApprovalDigestV1(record.approvalTranscript.value) !== record.approvalTranscript.digestB64u) throw new Error("approval transcript digest is invalid");
+			expected.set("approval", record.approvalTranscript.digestB64u);
+		}
+		if (record.sourceContributionTranscript) {
+			if (await computeLinkedDeviceApprovalDigestV1(record.sourceContributionTranscript.value) !== record.sourceContributionTranscript.digestB64u) throw new Error("source contribution transcript digest is invalid");
+			expected.set("source_contribution", record.sourceContributionTranscript.digestB64u);
+		}
+		const actual = /* @__PURE__ */ new Map();
+		for (const row of rows) {
+			const parsed = parseD1LinkedDeviceSessionTranscriptRowV1(row);
+			if (actual.has(parsed.kind)) throw new Error("duplicate linked-device transcript");
+			const transcript = parsed.kind === "claim" ? parseLinkedDeviceSessionClaimV1(parsed.transcriptJson) : parseLinkedDeviceApprovalV1(parsed.transcriptJson);
+			if (await computeLinkedDeviceTranscriptDigestV1(parsed.kind, transcript) !== parsed.digestB64u) throw new Error(`${parsed.kind} transcript ledger digest is invalid`);
+			actual.set(parsed.kind, parsed.digestB64u);
+		}
+		if (actual.size !== expected.size) throw new Error("linked-device transcript ledger is incomplete");
+		for (const [kind, digestB64u] of expected) if (actual.get(kind) !== digestB64u) throw new Error("linked-device transcript ledger is immutable and mismatched");
+	}
+};
+async function computeLinkedDeviceTranscriptDigestV1(kind, transcript) {
+	switch (kind) {
+		case "claim":
+			if (transcript.kind !== "linked_device_session_claim_v1") throw new Error("linked-device claim transcript kind is invalid");
+			return computeLinkedDeviceSessionClaimDigestV1(transcript);
+		case "approval":
+		case "source_contribution":
+			if (transcript.kind !== "linked_device_approval_v1") throw new Error("linked-device approval transcript kind is invalid");
+			return computeLinkedDeviceApprovalDigestV1(transcript);
+		default: return assertNeverLinkedDeviceTranscriptKindV1(kind);
+	}
+}
+function assertNeverLinkedDeviceTranscriptKindV1(value) {
+	throw new Error(`unsupported linked-device transcript kind: ${String(value)}`);
+}
+function buildSessionScopedDeleteStatements(input) {
+	return SESSION_SCOPED_TABLES.map((table) => input.database.prepare(`DELETE FROM ${table}
+           WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
+             AND link_session_id = ?`).bind(...scopeValues(input.scope), String(input.linkSessionId)));
+}
+function normalizeScope(scope) {
+	return {
+		namespace: requiredScope(scope.namespace, "namespace"),
+		orgId: requiredScope(scope.orgId, "orgId"),
+		projectId: requiredScope(scope.projectId, "projectId"),
+		envId: requiredScope(scope.envId, "envId")
+	};
+}
+function requiredScope(value, field) {
+	if (typeof value !== "string" || value.length === 0 || value.trim() !== value || hasControlCharacter(value)) throw new Error(`${field} is invalid`);
+	return value;
+}
+function scopeValues(scope) {
+	return [
+		scope.namespace,
+		scope.orgId,
+		scope.projectId,
+		scope.envId
+	];
+}
+function requiredSessionId(raw) {
+	const parsed = parseLinkDeviceSessionId(raw);
+	if (!parsed.ok) throw new Error("linked-device session id is invalid");
+	return String(parsed.value);
+}
+function requiredLinkSessionId(raw) {
+	const parsed = parseLinkDeviceSessionId(raw);
+	if (!parsed.ok) throw new Error("linked-device session id is invalid");
+	return parsed.value;
+}
+function requiredTimestamp(raw, field) {
+	if (!Number.isSafeInteger(raw) || Number(raw) < 0) throw new Error(`${field} is invalid`);
+	return Number(raw);
+}
+function sessionColumnValues(record) {
+	return [
+		record.linkSessionId,
+		record.qrPayload.linkPublicKeyB64u,
+		record.qrPayload.devicePublicKeyB64u,
+		record.state.state,
+		JSON.stringify(record),
+		record.revision,
+		record.qrPayload.expiresAtMs,
+		record.claimTranscript?.value.claimExpiresAtMs ?? null,
+		record.claimTranscript?.digestB64u ?? null,
+		record.approvalTranscript?.digestB64u ?? null,
+		record.authorityId ? String(record.authorityId) : null,
+		record.packageSetDigestB64u ?? null,
+		record.createdAtMs,
+		record.updatedAtMs
+	];
+}
+function normalizeMutationRecordV1(input) {
+	const record = parseLinkedDeviceSessionRecordV1(input.nextRecord);
+	if (String(record.linkSessionId) !== String(input.linkSessionId)) throw new Error("linked-device mutation session id does not match");
+	if (!Number.isSafeInteger(record.revision) || record.revision < 1) throw new Error("linked-device mutation revision is invalid");
+	if (record.updatedAtMs !== input.nowMs) throw new Error("linked-device mutation timestamp is invalid");
+	return record;
+}
+function minimalTerminalRecordV1(record) {
+	switch (record.state.state) {
+		case "failed_before_commit":
+		case "cancelled":
+		case "expired": return parseLinkedDeviceSessionRecordV1({
+			version: record.version,
+			linkSessionId: record.linkSessionId,
+			qrPayload: record.qrPayload,
+			state: record.state,
+			revision: record.revision,
+			createdAtMs: record.createdAtMs,
+			updatedAtMs: record.updatedAtMs
+		});
+		case "displaying_qr":
+		case "claimed":
+		case "awaiting_target_factor":
+		case "awaiting_source_contribution":
+		case "provisioning":
+		case "authority_pending_local_install":
+		case "active": return record;
+		default: return assertNeverLinkSessionStateV1(record.state);
+	}
+}
+function claimTranscriptMatchesDigest(record, digest) {
+	return record.claimTranscript?.digestB64u === digest;
+}
+function approvalTranscriptMatchesDigest(record, digest) {
+	return record.approvalTranscript?.digestB64u === digest;
+}
+function isAwaitingSourceContributionRecord(record) {
+	return record.state.state === "awaiting_source_contribution";
+}
+function sourceContributionTranscriptMatchesDigest(record, digest) {
+	return record.sourceContributionTranscript?.digestB64u === digest;
+}
+function sameEmailOtpChallenge(record, nextRecord) {
+	if (record.state.state !== "awaiting_target_factor" || nextRecord.state.state !== "awaiting_target_factor") return false;
+	const left = record.emailOtpChallenge;
+	const right = nextRecord.emailOtpChallenge;
+	if (left === void 0 || right === void 0) return left === right;
+	switch (left.state) {
+		case "available": return right.state === "available" && left.maskedEmailHint === right.maskedEmailHint;
+		case "sent": return right.state === "sent" && left.challengeId === right.challengeId && left.workerEphemeralPublicKey65B64u === right.workerEphemeralPublicKey65B64u && left.maskedEmailHint === right.maskedEmailHint && left.expiresAtMs === right.expiresAtMs && left.resendAvailableAtMs === right.resendAvailableAtMs;
+		default: return assertNeverLinkedDeviceEmailOtpChallengeV1(left);
+	}
+}
+function assertNeverLinkedDeviceEmailOtpChallengeV1(value) {
+	throw new Error(`unsupported linked-device email OTP challenge: ${String(value)}`);
+}
+function isActiveRecord(record) {
+	return record.state.state === "active";
+}
+function isFailedRecord(record) {
+	return record.state.state === "failed_before_commit";
+}
+function isCancelledRecord(record) {
+	return record.state.state === "cancelled";
+}
+function isExpiredRecord(record) {
+	return record.state.state === "expired";
+}
+function isExpirableState(state) {
+	switch (state.state) {
+		case "displaying_qr":
+		case "claimed":
+		case "awaiting_target_factor":
+		case "awaiting_source_contribution":
+		case "provisioning": return true;
+		case "authority_pending_local_install":
+		case "active":
+		case "failed_before_commit":
+		case "cancelled":
+		case "expired": return false;
+		default: return assertNeverLinkSessionStateV1(state);
+	}
+}
+function expiryMs(record) {
+	switch (record.state.state) {
+		case "displaying_qr": return record.qrPayload.expiresAtMs;
+		case "claimed": return record.claimTranscript?.value.claimExpiresAtMs ?? record.qrPayload.expiresAtMs;
+		case "awaiting_target_factor":
+		case "awaiting_source_contribution":
+		case "provisioning": return record.approvalTranscript?.value.expiresAtMs ?? record.qrPayload.expiresAtMs;
+		case "authority_pending_local_install":
+		case "active":
+		case "failed_before_commit":
+		case "cancelled":
+		case "expired": return Number.POSITIVE_INFINITY;
+		default: return assertNeverLinkSessionStateV1(record.state);
+	}
+}
+function resolveMutationRace(expectedRevision, record) {
+	if (record.revision === expectedRevision) return invalidStateResult(record);
+	return conflictResult(expectedRevision, record);
+}
+function conflictResult(expectedRevision, record) {
+	return {
+		outcome: "conflict",
+		expectedRevision,
+		actualRevision: record?.revision ?? null,
+		record
+	};
+}
+function invalidStateResult(record) {
+	return {
+		outcome: "invalid_state",
+		state: record.state.state,
+		record
+	};
+}
+function integrityResult(record, reason) {
+	return {
+		outcome: "integrity_error",
+		reason,
+		record
+	};
+}
+//#endregion
+export { D1LinkedDeviceSessionStoreV1 };
+
+//# sourceMappingURL=d1LinkedDeviceSessionStore.js.map