@seams/wallet-server 0.6.2 → 0.7.1

package/dist/esm/core/d1WalletAuthMethodStore.js

@@ -1,9 +1,13 @@
 import { parseWebAuthnRpId } from "../shared-ts/src/utils/domainIds.js";
-import { parseWalletAuthMethodRecordV2, walletAuthMethodRecordId, walletIdFromString } from "../shared-ts/src/utils/registrationIntent.js";
 import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
-import "../shared-ts/src/utils/validation.js";
-import { formatD1ExecStatement, parseD1JsonColumn } from "../storage/d1Sql.js";
+import { isPlainObject } from "../shared-ts/src/utils/validation.js";
+import { parseWalletAuthMethodRecordV2, walletAuthMethodRecordId } from "../shared-ts/src/utils/walletAuthMethodRecord.js";
+import { D1_BATCH_CAS_GUARD_SQL, parseD1JsonColumn } from "../storage/d1Sql.js";
+import { D1Schema, D1TenantTable, ensureD1Schema } from "./d1TenantStore.js";
+import { walletIdFromString } from "../shared-ts/src/utils/registrationIds.js";
 //#region src/core/d1WalletAuthMethodStore.ts
+/** Names the wallet auth-method store in D1 scope errors. */
+const WALLET_AUTH_METHOD_D1_STORE = "wallet auth-method store";
 const WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL = Object.freeze([
 	`
     CREATE TABLE IF NOT EXISTS wallet_auth_methods (
@@ -237,13 +241,10 @@ const WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL = Object.freeze([
   `
 ]);
 async function ensureWalletAuthMethodStoreD1Schema(options) {
-	for (const statement of WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL) await options.database.exec(formatD1ExecStatement(statement));
+	await ensureD1Schema(options.database, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL);
 }
 async function ensureWalletAuthMethodStoreD1SchemaV2(options) {
-	for (const statement of WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL) await options.database.exec(formatD1ExecStatement(statement));
-}
-function isObject(value) {
-	return Boolean(value && typeof value === "object" && !Array.isArray(value));
+	await ensureD1Schema(options.database, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL);
 }
 function trimString(value) {
 	return typeof value === "string" ? value.trim() : "";
@@ -252,7 +253,7 @@ function walletAuthMethodId(record) {
 	return walletAuthMethodRecordId(record);
 }
 function normalizeWalletAuthMethod(raw) {
-	if (!isObject(raw)) return null;
+	if (!isPlainObject(raw)) return null;
 	const version = trimString(raw.version);
 	const kind = trimString(raw.kind);
 	const status = trimString(raw.status);
@@ -393,21 +394,6 @@ function prepareD1WalletAuthMethodV2PutStatement(input) {
       ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
       ${conflictClause}`).bind(input.scope.namespace, input.scope.orgId, input.scope.projectId, input.scope.envId, columns.walletId, columns.walletAuthorityId, columns.rpId, columns.kind, columns.status, columns.walletAuthMethodId, columns.authIdentifierKey, columns.credentialIdB64u, columns.credentialPublicKeyB64u, columns.emailHashHex, columns.registrationAuthorityId, columns.recordJson, columns.createdAtMs, columns.updatedAtMs, columns.activatedAtMs, columns.revokedAtMs);
 }
-function requireD1ScopeString(input, field) {
-	const normalized = normalizeOptionalTrimmedString(input);
-	if (!normalized) throw new Error(`${field} is required for D1 wallet auth-method store`);
-	return normalized;
-}
-function normalizeD1WalletAuthMethodStoreOptions(input) {
-	return {
-		database: input.database,
-		namespace: requireD1ScopeString(input.namespace, "namespace"),
-		orgId: requireD1ScopeString(input.orgId, "orgId"),
-		projectId: requireD1ScopeString(input.projectId, "projectId"),
-		envId: requireD1ScopeString(input.envId, "envId"),
-		ensureSchema: input.ensureSchema !== false
-	};
-}
 function bindWalletAuthMethodIdentity(record) {
 	switch (record.kind) {
 		case "passkey": return {
@@ -429,30 +415,11 @@ function bindWalletAuthMethodIdentity(record) {
 		default: return assertNeverWalletAuthMethod(record);
 	}
 }
-function prepareD1WalletAuthMethodPutStatement(input) {
+function prepareD1WalletAuthMethodWriteStatement(input, insertOnly) {
 	const parsed = normalizeWalletAuthMethod(input.record);
 	if (!parsed) throw new Error("Invalid wallet auth method record");
 	const identity = bindWalletAuthMethodIdentity(parsed);
-	return input.database.prepare(`INSERT INTO wallet_auth_methods (
-        namespace,
-        org_id,
-        project_id,
-        env_id,
-        wallet_id,
-        rp_id,
-        kind,
-        status,
-        wallet_auth_method_id,
-        auth_identifier_key,
-        credential_id_b64u,
-        credential_public_key_b64u,
-        email_hash_hex,
-        registration_authority_id,
-        record_json,
-        created_at_ms,
-        updated_at_ms
-      )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+	const conflictClause = insertOnly ? "" : `
       ON CONFLICT (namespace, org_id, project_id, env_id, wallet_auth_method_id)
       DO UPDATE SET
         wallet_id = EXCLUDED.wallet_id,
@@ -472,15 +439,7 @@ function prepareD1WalletAuthMethodPutStatement(input) {
         updated_at_ms = MAX(
           wallet_auth_methods.updated_at_ms,
           EXCLUDED.updated_at_ms
-        )`).bind(input.scope.namespace, input.scope.orgId, input.scope.projectId, input.scope.envId, parsed.walletId, identity.rpId, parsed.kind, parsed.status, walletAuthMethodId(parsed), identity.authIdentifierKey, identity.credentialIdB64u, identity.credentialPublicKeyB64u, identity.emailHashHex, identity.registrationAuthorityId, JSON.stringify(parsed), parsed.createdAtMs, parsed.updatedAtMs);
-}
-/** Insert-only auth-method write used when a new factor and its envelope are
-* committed together. A credential collision must abort the enclosing D1
-* batch instead of updating an existing factor's identity. */
-function prepareD1WalletAuthMethodInsertStatement(input) {
-	const parsed = normalizeWalletAuthMethod(input.record);
-	if (!parsed) throw new Error("Invalid wallet auth method record");
-	const identity = bindWalletAuthMethodIdentity(parsed);
+        )`;
 	return input.database.prepare(`INSERT INTO wallet_auth_methods (
         namespace,
         org_id,
@@ -500,41 +459,46 @@ function prepareD1WalletAuthMethodInsertStatement(input) {
         created_at_ms,
         updated_at_ms
       )
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).bind(input.scope.namespace, input.scope.orgId, input.scope.projectId, input.scope.envId, parsed.walletId, identity.rpId, parsed.kind, parsed.status, walletAuthMethodId(parsed), identity.authIdentifierKey, identity.credentialIdB64u, identity.credentialPublicKeyB64u, identity.emailHashHex, identity.registrationAuthorityId, JSON.stringify(parsed), parsed.createdAtMs, parsed.updatedAtMs);
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)${conflictClause}`).bind(input.scope.namespace, input.scope.orgId, input.scope.projectId, input.scope.envId, parsed.walletId, identity.rpId, parsed.kind, parsed.status, walletAuthMethodId(parsed), identity.authIdentifierKey, identity.credentialIdB64u, identity.credentialPublicKeyB64u, identity.emailHashHex, identity.registrationAuthorityId, JSON.stringify(parsed), parsed.createdAtMs, parsed.updatedAtMs);
+}
+function prepareD1WalletAuthMethodPutStatement(input) {
+	return prepareD1WalletAuthMethodWriteStatement(input, false);
+}
+/** Insert-only auth-method write used when a new factor and its envelope are
+* committed together. A credential collision must abort the enclosing D1
+* batch instead of updating an existing factor's identity. */
+function prepareD1WalletAuthMethodInsertStatement(input) {
+	return prepareD1WalletAuthMethodWriteStatement(input, true);
 }
 function assertNeverWalletAuthMethod(record) {
 	throw new Error(`Unexpected wallet auth method record: ${JSON.stringify(record)}`);
 }
+/** Reads one method's stored JSON by id; the caller picks the record version to parse. */
+async function readD1WalletAuthMethodJsonById(database, scope, walletAuthMethodId) {
+	return parseD1JsonColumn((await database.prepare(`SELECT record_json
+           FROM wallet_auth_methods
+          WHERE namespace = ?
+            AND org_id = ?
+            AND project_id = ?
+            AND env_id = ?
+            AND wallet_auth_method_id = ?
+          LIMIT 1`).bind(scope.namespace, scope.orgId, scope.projectId, scope.envId, walletAuthMethodId).first())?.record_json);
+}
+/** Aborts the enclosing batch when the statement just before it changed no row. */
+function prepareD1InsertCasGuardStatement(database) {
+	return database.prepare(D1_BATCH_CAS_GUARD_SQL);
+}
 var D1WalletAuthMethodStore = class {
 	constructor(input) {
 		this.adapterKind = "d1";
-		this.schemaReady = false;
-		this.v2SchemaReady = false;
-		const normalized = normalizeD1WalletAuthMethodStoreOptions(input);
-		this.database = normalized.database;
-		this.scope = {
-			namespace: normalized.namespace,
-			orgId: normalized.orgId,
-			projectId: normalized.projectId,
-			envId: normalized.envId
-		};
-		this.ensureSchemaOnUse = normalized.ensureSchema;
-	}
-	async ensureSchema() {
-		if (!this.ensureSchemaOnUse || this.schemaReady) return;
-		await ensureWalletAuthMethodStoreD1Schema({ database: this.database });
-		this.schemaReady = true;
-	}
-	async ensureV2Schema() {
-		if (!this.ensureSchemaOnUse || this.v2SchemaReady) return;
-		await ensureWalletAuthMethodStoreD1SchemaV2({ database: this.database });
-		this.v2SchemaReady = true;
+		this.table = new D1TenantTable(input, WALLET_AUTH_METHOD_D1_STORE, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL);
+		this.v2Schema = new D1Schema(input.database, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL, input.ensureSchema !== false);
 	}
 	async put(record) {
-		await this.ensureSchema();
+		await this.table.ensureSchema();
 		await prepareD1WalletAuthMethodPutStatement({
-			database: this.database,
-			scope: this.scope,
+			database: this.table.database,
+			scope: this.table.scope,
 			record
 		}).run();
 	}
@@ -546,49 +510,31 @@ var D1WalletAuthMethodStore = class {
 	preparePasskeyRegistrationStatements(record) {
 		if (record.kind !== "passkey" || record.status !== "active") throw new Error("Passkey registration statements require an active passkey record");
 		return [prepareD1WalletAuthMethodInsertStatement({
-			database: this.database,
-			scope: this.scope,
+			database: this.table.database,
+			scope: this.table.scope,
 			record
-		}), this.database.prepare(`
-      INSERT INTO router_ab_yao_versioned_json_cas_guard (guard_id)
-      SELECT 1
-       WHERE changes() = 0
-    `)];
+		}), prepareD1InsertCasGuardStatement(this.table.database)];
 	}
 	async getPasskey(input) {
-		await this.ensureSchema();
+		await this.table.ensureSchema();
 		const rpId = normalizeOptionalTrimmedString(input.rpId);
 		const credentialIdB64u = normalizeOptionalTrimmedString(input.credentialIdB64u);
 		if (!rpId || !credentialIdB64u) return null;
-		return normalizeWalletAuthMethod(parseD1JsonColumn((await this.database.prepare(`SELECT record_json
-           FROM wallet_auth_methods
-          WHERE namespace = ?
-            AND org_id = ?
-            AND project_id = ?
-            AND env_id = ?
-            AND wallet_auth_method_id = ?
-          LIMIT 1`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, `passkey:${rpId}:${credentialIdB64u}`).first())?.record_json));
+		return normalizeWalletAuthMethod(await readD1WalletAuthMethodJsonById(this.table.database, this.table.scope, `passkey:${rpId}:${credentialIdB64u}`));
 	}
 	async getEmailOtp(input) {
-		await this.ensureSchema();
+		await this.table.ensureSchema();
 		const walletId = normalizeOptionalTrimmedString(input.walletId);
 		const emailHashHex = normalizeOptionalTrimmedString(input.emailHashHex);
 		if (!walletId || !emailHashHex) return null;
-		return normalizeWalletAuthMethod(parseD1JsonColumn((await this.database.prepare(`SELECT record_json
-           FROM wallet_auth_methods
-          WHERE namespace = ?
-            AND org_id = ?
-            AND project_id = ?
-            AND env_id = ?
-            AND wallet_auth_method_id = ?
-          LIMIT 1`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, `email_otp:${walletId}:${emailHashHex}`).first())?.record_json));
+		return normalizeWalletAuthMethod(await readD1WalletAuthMethodJsonById(this.table.database, this.table.scope, `email_otp:${walletId}:${emailHashHex}`));
 	}
 	async listForWallet(input) {
-		await this.ensureSchema();
+		await this.table.ensureSchema();
 		const walletId = normalizeOptionalTrimmedString(input.walletId);
 		if (!walletId) return [];
 		const rpId = normalizeOptionalTrimmedString(input.rpId);
-		const result = await this.database.prepare(`SELECT record_json
+		const result = await this.table.prepare(`SELECT record_json
            FROM wallet_auth_methods
           WHERE namespace = ?
             AND org_id = ?
@@ -596,7 +542,11 @@ var D1WalletAuthMethodStore = class {
             AND env_id = ?
             AND wallet_id = ?
             AND (kind = 'email_otp' OR ? = '' OR rp_id = ?)
-          ORDER BY created_at_ms ASC`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, walletId, rpId, rpId).all();
+          ORDER BY created_at_ms ASC`, [
+			walletId,
+			rpId,
+			rpId
+		]).all();
 		const records = [];
 		for (const row of result.results || []) {
 			const parsed = normalizeWalletAuthMethod(parseD1JsonColumn(row.record_json));
@@ -605,18 +555,18 @@ var D1WalletAuthMethodStore = class {
 		return records;
 	}
 	async putV2(record) {
-		await this.ensureV2Schema();
+		await this.v2Schema.ensure();
 		await prepareD1WalletAuthMethodV2PutStatement({
-			database: this.database,
-			scope: this.scope,
+			database: this.table.database,
+			scope: this.table.scope,
 			record
 		}).run();
 	}
 	async insertActiveV2Atomically(input) {
-		await this.ensureV2Schema();
+		await this.v2Schema.ensure();
 		try {
 			const statements = [...input.prerequisiteStatements, ...this.prepareV2InsertStatements(input.record)];
-			const results = await this.database.batch(statements);
+			const results = await this.table.database.batch(statements);
 			return results.length === statements.length && results.every((result) => result.success);
 		} catch {
 			return false;
@@ -624,7 +574,7 @@ var D1WalletAuthMethodStore = class {
 	}
 	prepareActiveV2SourceGuardStatements(input) {
 		if (!Number.isSafeInteger(input.authorityRevocationEpoch) || input.authorityRevocationEpoch < 0) throw new Error("Source authority revocation epoch is invalid");
-		return [this.database.prepare(`UPDATE wallet_auth_methods
+		return [this.table.database.prepare(`UPDATE wallet_auth_methods
             SET updated_at_ms = updated_at_ms
           WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
             AND wallet_auth_method_id = ? AND wallet_id = ?
@@ -641,7 +591,7 @@ var D1WalletAuthMethodStore = class {
                  AND source_authority.lifecycle_state = 'active'
                  AND source_authority.authority_digest_b64u = ?
                  AND source_authority.revocation_epoch = ?
-            )`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, String(input.walletAuthMethodId), String(input.walletId), String(input.walletAuthorityId), this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, String(input.walletAuthorityId), String(input.walletId), String(input.authorityDigestB64u), input.authorityRevocationEpoch), this.database.prepare(`
+            )`).bind(this.table.scope.namespace, this.table.scope.orgId, this.table.scope.projectId, this.table.scope.envId, String(input.walletAuthMethodId), String(input.walletId), String(input.walletAuthorityId), this.table.scope.namespace, this.table.scope.orgId, this.table.scope.projectId, this.table.scope.envId, String(input.walletAuthorityId), String(input.walletId), String(input.authorityDigestB64u), input.authorityRevocationEpoch), this.table.database.prepare(`
       INSERT INTO wallet_authority_cas_guard (guard_id)
       SELECT 1
        WHERE changes() = 0
@@ -651,7 +601,7 @@ var D1WalletAuthMethodStore = class {
 	* Aborts the surrounding batch if the authority already holds an active
 	* method of this family.
 	*
-	* Refactor 109C's admission answers `already_configured` before a ceremony
+	* Add-auth-method admission answers `already_configured` before a ceremony
 	* starts, but an admission read cannot close a race: two ceremonies can pass
 	* it concurrently and both insert. The auth-method insert's own guard covers
 	* only the allocated method id, and migration `0011` deliberately dropped
@@ -664,7 +614,7 @@ var D1WalletAuthMethodStore = class {
 	* collides, which aborts the batch.
 	*/
 	prepareActiveV2TargetFamilyAbsentGuardStatements(input) {
-		return [this.database.prepare(`INSERT INTO wallet_authority_cas_guard (guard_id)
+		return [this.table.prepare(`INSERT INTO wallet_authority_cas_guard (guard_id)
          SELECT 1
           WHERE EXISTS (
             SELECT 1
@@ -672,7 +622,11 @@ var D1WalletAuthMethodStore = class {
              WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
                AND wallet_id = ? AND wallet_authority_id = ?
                AND kind = ? AND status = 'active'
-          )`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, String(input.walletId), String(input.walletAuthorityId), input.kind)];
+          )`, [
+			String(input.walletId),
+			String(input.walletAuthorityId),
+			input.kind
+		])];
 	}
 	/**
 	* Prepares an insert-only active V2 method mutation. A credential or opaque
@@ -683,33 +637,22 @@ var D1WalletAuthMethodStore = class {
 		if (!parsed || parsed.status !== "active") throw new Error("V2 insert requires an active V2 auth-method record");
 		if (!String(parsed.walletAuthMethodId).startsWith("wallet-auth-method:")) throw new Error("V2 insert requires an opaque auth-method id");
 		return [prepareD1WalletAuthMethodV2PutStatement({
-			database: this.database,
-			scope: this.scope,
+			database: this.table.database,
+			scope: this.table.scope,
 			record: parsed,
 			insertOnly: true
-		}), this.database.prepare(`
-      INSERT INTO router_ab_yao_versioned_json_cas_guard (guard_id)
-      SELECT 1
-       WHERE changes() = 0
-    `)];
+		}), prepareD1InsertCasGuardStatement(this.table.database)];
 	}
 	async readByIdV2(input) {
-		await this.ensureV2Schema();
-		return normalizeWalletAuthMethodV2(parseD1JsonColumn((await this.database.prepare(`SELECT record_json
-           FROM wallet_auth_methods
-          WHERE namespace = ?
-            AND org_id = ?
-            AND project_id = ?
-            AND env_id = ?
-            AND wallet_auth_method_id = ?
-          LIMIT 1`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, String(input.walletAuthMethodId)).first())?.record_json));
+		await this.v2Schema.ensure();
+		return normalizeWalletAuthMethodV2(await readD1WalletAuthMethodJsonById(this.table.database, this.table.scope, String(input.walletAuthMethodId)));
 	}
 	async getPasskeyV2(input) {
-		await this.ensureV2Schema();
+		await this.v2Schema.ensure();
 		const rpId = normalizeOptionalTrimmedString(input.rpId);
 		const credentialIdB64u = normalizeOptionalTrimmedString(input.credentialIdB64u);
 		if (!rpId || !credentialIdB64u) return null;
-		return normalizeWalletAuthMethodV2(parseD1JsonColumn((await this.database.prepare(`SELECT record_json
+		return normalizeWalletAuthMethodV2(parseD1JsonColumn((await this.table.prepare(`SELECT record_json
            FROM wallet_auth_methods
           WHERE namespace = ?
             AND org_id = ?
@@ -719,14 +662,14 @@ var D1WalletAuthMethodStore = class {
             AND rp_id = ?
             AND credential_id_b64u = ?
           ORDER BY created_at_ms ASC
-          LIMIT 1`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, rpId, credentialIdB64u).first())?.record_json));
+          LIMIT 1`, [rpId, credentialIdB64u]).first())?.record_json));
 	}
 	async getEmailOtpV2(input) {
-		await this.ensureV2Schema();
+		await this.v2Schema.ensure();
 		const walletId = normalizeOptionalTrimmedString(input.walletId);
 		const emailHashHex = normalizeOptionalTrimmedString(input.emailHashHex);
 		if (!walletId || !emailHashHex) return null;
-		return normalizeWalletAuthMethodV2(parseD1JsonColumn((await this.database.prepare(`SELECT record_json
+		return normalizeWalletAuthMethodV2(parseD1JsonColumn((await this.table.prepare(`SELECT record_json
            FROM wallet_auth_methods
           WHERE namespace = ?
             AND org_id = ?
@@ -736,15 +679,15 @@ var D1WalletAuthMethodStore = class {
             AND wallet_id = ?
             AND email_hash_hex = ?
           ORDER BY created_at_ms ASC
-          LIMIT 1`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, walletId, emailHashHex).first())?.record_json));
+          LIMIT 1`, [walletId, emailHashHex]).first())?.record_json));
 	}
 	async listForWalletV2(input) {
-		await this.ensureV2Schema();
+		await this.v2Schema.ensure();
 		const walletId = normalizeOptionalTrimmedString(input.walletId);
 		if (!walletId) return [];
 		const authorityId = input.walletAuthorityId ? String(input.walletAuthorityId) : "";
 		const rpId = normalizeOptionalTrimmedString(input.rpId);
-		const result = await this.database.prepare(`SELECT record_json
+		const result = await this.table.prepare(`SELECT record_json
            FROM wallet_auth_methods
           WHERE namespace = ?
             AND org_id = ?
@@ -753,7 +696,13 @@ var D1WalletAuthMethodStore = class {
             AND wallet_id = ?
             AND (? = '' OR wallet_authority_id = ?)
             AND (kind = 'email_otp' OR ? = '' OR rp_id = ?)
-          ORDER BY created_at_ms ASC, wallet_auth_method_id ASC`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, walletId, authorityId, authorityId, rpId, rpId).all();
+          ORDER BY created_at_ms ASC, wallet_auth_method_id ASC`, [
+			walletId,
+			authorityId,
+			authorityId,
+			rpId,
+			rpId
+		]).all();
 		const records = [];
 		for (const row of result.results || []) {
 			const parsed = normalizeWalletAuthMethodV2(parseD1JsonColumn(row.record_json));
@@ -763,6 +712,6 @@ var D1WalletAuthMethodStore = class {
 	}
 };
 //#endregion
-export { D1WalletAuthMethodStore, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL, bindWalletAuthMethodIdentity, bindWalletAuthMethodIdentityV2, ensureWalletAuthMethodStoreD1Schema, ensureWalletAuthMethodStoreD1SchemaV2, normalizeWalletAuthMethod, normalizeWalletAuthMethodV2, prepareD1WalletAuthMethodInsertStatement, prepareD1WalletAuthMethodPutStatement, prepareD1WalletAuthMethodV2PutStatement, walletAuthMethodId, walletAuthMethodV2Id };
+export { D1WalletAuthMethodStore, WALLET_AUTH_METHOD_D1_STORE, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_SQL, WALLET_AUTH_METHOD_STORE_D1_SCHEMA_V2_SQL, bindWalletAuthMethodIdentity, bindWalletAuthMethodIdentityV2, ensureWalletAuthMethodStoreD1Schema, ensureWalletAuthMethodStoreD1SchemaV2, normalizeWalletAuthMethod, normalizeWalletAuthMethodV2, prepareD1WalletAuthMethodInsertStatement, prepareD1WalletAuthMethodPutStatement, prepareD1WalletAuthMethodV2PutStatement, walletAuthMethodId, walletAuthMethodV2Id };
 
 //# sourceMappingURL=d1WalletAuthMethodStore.js.map

package/dist/esm/core/d1WalletStore.js

@@ -1,11 +1,11 @@
 import { parseWalletId } from "../shared-ts/src/utils/domainIds.js";
+import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
+import { isPlainObject } from "../shared-ts/src/utils/validation.js";
 import { sameRouterAbMpcMaterialActivationRef } from "../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseRouterAbEd25519YaoRecoveryActivationResultV1, parseRouterAbEd25519YaoRecoveryAdmissionRequestV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../shared-ts/src/utils/routerAbEd25519Yao.js";
-import { normalizeOptionalTrimmedString } from "../shared-ts/src/utils/normalize.js";
-import "../shared-ts/src/utils/validation.js";
 import { normalizeRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope } from "../shared-ts/src/threshold/signingRootScope.js";
 import { sameRouterAbEcdsaDerivationPublicCapabilityV1 } from "../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { d1ChangedRows, formatD1ExecStatement, parseD1JsonColumn } from "../storage/d1Sql.js";
+import { D1_BATCH_CAS_GUARD_SQL, formatD1ExecStatement, parseD1JsonColumn } from "../storage/d1Sql.js";
 import { thresholdEcdsaChainTargetKey } from "./thresholdEcdsaChainTarget.js";
 import { normalizeThresholdEd25519ParticipantIds } from "../shared-ts/src/threshold/participants.js";
 import { ecdsaPostRegistrationRequestMatchesCapability, parseWalletEcdsaPendingSessionActivationRecord, parseWalletEcdsaSignerRecord } from "./WalletStore.js";
@@ -152,16 +152,13 @@ const WALLET_STORE_D1_SCHEMA_SQL = Object.freeze([
 async function ensureWalletStoreD1Schema(options) {
 	for (const statement of WALLET_STORE_D1_SCHEMA_SQL) await options.database.exec(formatD1ExecStatement(statement));
 }
-function isObject(value) {
-	return Boolean(value && typeof value === "object" && !Array.isArray(value));
-}
 function normalizeTimestampMs(value) {
 	const numberValue = Number(value);
 	if (!Number.isFinite(numberValue) || numberValue < 0) return null;
 	return Math.floor(numberValue);
 }
 function parseWalletRecord(raw) {
-	if (!isObject(raw)) return null;
+	if (!isPlainObject(raw)) return null;
 	if (raw.version !== "wallet_v1") return null;
 	const walletId = parseWalletId(raw.walletId);
 	const createdAtMs = normalizeTimestampMs(raw.createdAtMs);
@@ -180,7 +177,7 @@ function equalBytes(left, right) {
 	return true;
 }
 function parseWalletEd25519YaoActiveCapabilityRecord(raw) {
-	if (!isObject(raw)) return null;
+	if (!isPlainObject(raw)) return null;
 	const nearAccountId = normalizeOptionalTrimmedString(raw.nearAccountId);
 	if (!nearAccountId) return null;
 	let runtimePolicyScope;
@@ -222,7 +219,7 @@ function parseWalletEd25519YaoActiveCapabilityRecord(raw) {
 	}
 }
 function parseWalletEd25519SignerRecord(raw) {
-	if (!isObject(raw) || raw.version !== "wallet_signer_ed25519_v1") return null;
+	if (!isPlainObject(raw) || raw.version !== "wallet_signer_ed25519_v1") return null;
 	const walletId = parseWalletId(raw.walletId);
 	const signerId = normalizeOptionalTrimmedString(raw.signerId);
 	const nearAccountId = normalizeOptionalTrimmedString(raw.nearAccountId);
@@ -684,11 +681,16 @@ var D1WalletStore = class {
 			record
 		}).run();
 	}
-	async putEd25519SignerIfSlotAvailable(record) {
+	/**
+	* The statements that insert an Ed25519 signer into its slot, for a batch
+	* owned elsewhere. The batch aborts unless the slot was free: slot
+	* uniqueness rests on this check alone.
+	*/
+	async prepareEd25519SignerIfSlotAvailableStatements(record) {
 		await this.ensureSchema();
 		const parsed = parseWalletEd25519SignerRecord(record);
 		if (!parsed) throw new Error("Invalid Ed25519 wallet signer record");
-		return d1ChangedRows(await this.database.prepare(`INSERT INTO wallet_signers (
+		return [this.database.prepare(`INSERT INTO wallet_signers (
           namespace,
           org_id,
           project_id,
@@ -712,7 +714,7 @@ var D1WalletStore = class {
              AND wallet_id = ?
              AND signer_family = 'ed25519'
              AND json_extract(record_json, '$.signerSlot') = ?
-        )`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, parsed.walletId, parsed.signerId, JSON.stringify(parsed), parsed.createdAtMs, parsed.updatedAtMs, this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, parsed.walletId, parsed.signerSlot).run()) === 1;
+        )`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, parsed.walletId, parsed.signerId, JSON.stringify(parsed), parsed.createdAtMs, parsed.updatedAtMs, this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, parsed.walletId, parsed.signerSlot), this.database.prepare(D1_BATCH_CAS_GUARD_SQL)];
 	}
 	async putSigners(records) {
 		for (const record of records) await this.putSigner(record);

package/dist/esm/core/deviceLinking/linkedDeviceEmailOtpGrant.js

@@ -1,11 +1,13 @@
 import { parseLinkDeviceSessionId, parseLinkedDeviceEnrollmentId, parseLinkedDeviceId, parseVerifiedEmailAddress, parseWalletAuthMethodId, parseWalletId, parseWebAuthnCredentialIdB64u } from "../../shared-ts/src/utils/domainIds.js";
 import { base64UrlEncode } from "../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
 import { sha256BytesUtf8 } from "../../shared-ts/src/utils/digests.js";
-import { parseUnixMs, rejectUnknownFields, requireRecord } from "../../shared-ts/src/passkey-custody/primitives.js";
+import { parseDigestB64u, sha256Utf8DigestB64u } from "../../shared-ts/src/utils/canonicalPrimitives.js";
+import { requireRecord } from "../../shared-ts/src/utils/validation.js";
+import { rejectUnknownFields } from "../../shared-ts/src/utils/exactRecord.js";
+import { parseUnixMs } from "../../shared-ts/src/passkey-custody/primitives.js";
 //#region src/core/deviceLinking/linkedDeviceEmailOtpGrant.ts
 /**
-* Refactor 103 Phase 6 — the durable one-time Email OTP verification grant.
+* The durable one-time Email OTP verification grant.
 *
 * Verifying the emailed code proves the person holding Device 2 controls the
 * wallet's base Email OTP destination. That proof must authorize exactly one
@@ -32,7 +34,7 @@ const CHALLENGE_BINDING_DOMAIN = "seams:linked-device-email-otp-challenge-bindin
 */
 async function computeLinkedDeviceEmailOtpChallengeBindingDigestV1(input) {
 	const baseWalletAuthMethodId = input.enrollment.kind === "existing_enrollment" ? requirePresentBaseMethod(input.baseWalletAuthMethodId) : "";
-	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8([
+	return sha256Utf8DigestB64u([
 		CHALLENGE_BINDING_DOMAIN,
 		String(input.walletId),
 		String(input.linkSessionId),
@@ -44,7 +46,7 @@ async function computeLinkedDeviceEmailOtpChallengeBindingDigestV1(input) {
 		input.enrollment.kind,
 		String(baseWalletAuthMethodId),
 		String(input.walletAuthMethodId)
-	].join("\\u0000"))));
+	].join("\\u0000"));
 }
 const GRANT_RECORD_FIELDS = [
 	"kind",
@@ -141,7 +143,7 @@ function linkedDeviceEmailOtpGrantAdmitsUseV1(record, nowMs) {
 */
 async function computeLinkedDeviceEmailOtpGrantTokenDigestV1(grantToken) {
 	if (!grantToken || grantToken.trim() !== grantToken) throw new Error("linked-device email OTP grant token is invalid");
-	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(`${GRANT_TOKEN_DIGEST_DOMAIN}\u0000${grantToken}`)));
+	return sha256Utf8DigestB64u(`${GRANT_TOKEN_DIGEST_DOMAIN}\u0000${grantToken}`);
 }
 /**
 * The digest every Wallet Session and admission surface compares to name this
@@ -152,7 +154,7 @@ async function computeLinkedDeviceEmailOtpGrantTokenDigestV1(grantToken) {
 */
 async function computeLinkedDeviceEmailOtpAuthorityDigestV1(input) {
 	const baseWalletAuthMethodId = input.enrollment.kind === "existing_enrollment" ? requirePresentBaseMethod(input.baseWalletAuthMethodId) : "";
-	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8([
+	return sha256Utf8DigestB64u([
 		AUTHORITY_DIGEST_DOMAIN,
 		String(input.walletId),
 		String(input.enrollmentId),
@@ -161,7 +163,7 @@ async function computeLinkedDeviceEmailOtpAuthorityDigestV1(input) {
 		input.targetEmail,
 		input.enrollment.kind,
 		String(baseWalletAuthMethodId)
-	].join("\0"))));
+	].join("\0"));
 }
 /**
 * The target-deployment descriptor binds each child to the target credential

package/dist/esm/core/deviceLinking/linkedDeviceManagement.js

@@ -40,7 +40,7 @@ var LinkedDeviceManagementServiceV1 = class {
 			nextCursor: page.nextCursor ? encodeLinkedDeviceListCursorV1(page.nextCursor) : null
 		};
 	}
-	async revokeLinkedDeviceV1(request, source) {
+	async revokeLinkedDeviceV1(request, source, commit) {
 		const resolved = await this.resolveSourceV1(source, request.requestedAtMs);
 		if (!resolved || !hasFullOwnerPermissionsV1(resolved.authority)) return { kind: "unauthorized" };
 		if (request.walletId !== resolved.session.walletId) return { kind: "unauthorized" };
@@ -76,7 +76,11 @@ var LinkedDeviceManagementServiceV1 = class {
 			authorityId: targetAuthority.authorityId,
 			walletAuthMethodId: targetMethod.walletAuthMethodId,
 			expectedAuthorityRevocationEpoch: targetAuthority.revocationEpoch,
-			requestedAtMs: request.requestedAtMs
+			requestedAtMs: request.requestedAtMs,
+			...commit === void 0 ? {} : { commit: {
+				statements: commit.prerequisites,
+				trailingStatements: commit.recordAnswer({ authorityId: targetAuthority.authorityId })
+			} }
 		});
 		if (result.kind === "would_remove_last_wallet_auth_method" || result.kind === "conflict") return { kind: "conflict" };
 		await this.options.sessions.retireWalletSessionAuthorizationsForAuthMethod({
@@ -93,6 +97,24 @@ var LinkedDeviceManagementServiceV1 = class {
 			revocationEpoch: result.authority.revocationEpoch
 		};
 	}
+	/**
+	* Finishes, again, what follows a committed revocation: the method's
+	* sessions retired and a revoked authority's signer material deactivated.
+	* Both are idempotent, so an exact retry answered from the record completes
+	* whatever its first attempt left undone.
+	*/
+	async finishLinkedDeviceRevocationV1(input) {
+		const method = await this.options.authMethod.readByIdV1({ walletAuthMethodId: input.walletAuthMethodId });
+		if (!method || method.walletId !== input.walletId || method.status !== "revoked") return;
+		await this.options.sessions.retireWalletSessionAuthorizationsForAuthMethod({
+			tenantId: this.options.tenantId,
+			walletId: input.walletId,
+			walletAuthMethodId: method.walletAuthMethodId,
+			nowMs: input.requestedAtMs
+		});
+		const authority = await this.options.authority.readByIdV1(method.walletAuthorityId);
+		if (authority?.state === "revoked" && authority.walletId === input.walletId && authority.provenance.kind === "device_link") await this.deactivateSignerMaterialV1(authority, input.requestedAtMs);
+	}
 	async resolveSourceV1(source, requestedAtMs) {
 		if (source.expiresAtMs <= requestedAtMs) return null;
 		const session = await this.options.authenticator.readActiveOwnerWalletSessionV1({
@@ -274,6 +296,6 @@ function isCursorRecordV1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) && Object.keys(value).sort().join(",") === "authorityId,kind,updatedAtMs";
 }
 //#endregion
-export { LinkedDeviceListCursorError, LinkedDeviceManagementServiceV1, MAX_LINKED_DEVICE_LIST_LIMIT_V1, decodeLinkedDeviceListCursorV1, encodeLinkedDeviceListCursorV1 };
+export { LinkedDeviceListCursorError, LinkedDeviceManagementServiceV1, MAX_LINKED_DEVICE_LIST_LIMIT_V1 };
 
 //# sourceMappingURL=linkedDeviceManagement.js.map