@seams/wallet-server 0.6.2 → 0.7.1

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthMethodBoundary.js

@@ -1,10 +1,8 @@
-import { parseWebAuthnCredentialIdB64u } from "../../../../shared-ts/src/utils/domainIds.js";
 import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
-import { buildWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { buildEmailOtpWalletAuthAuthority, buildPasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { webAuthnCredentialIdB64uFromCredential } from "../../../auth/webAuthnCredentialCodecs.js";
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 //#region src/router/cloudflare/d1/wallet/d1WalletAuthMethodBoundary.ts
 function walletRegistrationFinalizeAuthMethodFromAuthority(authority) {
 	switch (authority.kind) {
@@ -42,53 +40,12 @@ function walletAuthAuthorityFromRegistrationAuthority(input) {
 	}
 	return unreachableRegistrationAuthority(input.authority);
 }
-function walletAuthMethodRecordFromRegistrationAuthority(input) {
-	switch (input.authority.kind) {
-		case "passkey": {
-			const credentialIdB64u = parseWebAuthnCredentialIdB64u(input.authority.credentialIdB64u);
-			if (!credentialIdB64u.ok) throw new Error(`Registration credential ID is invalid: ${credentialIdB64u.error.message}`);
-			return requireActiveWalletAuthMethodRecordV2(buildWalletAuthMethodRecordV2({
-				version: "wallet_auth_method_v2",
-				walletAuthMethodId: input.walletAuthMethodId,
-				kind: "passkey",
-				status: "active",
-				walletId: input.authority.walletId,
-				walletAuthorityId: input.walletAuthorityId,
-				rpId: input.authority.rpId,
-				credentialIdB64u: credentialIdB64u.value,
-				credentialPublicKeyB64u: input.authority.credentialPublicKeyB64u,
-				counter: input.authority.counter,
-				createdAtMs: input.now,
-				updatedAtMs: input.now,
-				activatedAtMs: input.now
-			}));
-		}
-		case "email_otp": return requireActiveWalletAuthMethodRecordV2(buildWalletAuthMethodRecordV2({
-			version: "wallet_auth_method_v2",
-			walletAuthMethodId: input.walletAuthMethodId,
-			kind: "email_otp",
-			status: "active",
-			walletId: input.authority.walletId,
-			walletAuthorityId: input.walletAuthorityId,
-			emailHashHex: input.authority.emailHashHex,
-			registrationAuthorityId: input.authority.registrationAuthorityId,
-			createdAtMs: input.now,
-			updatedAtMs: input.now,
-			activatedAtMs: input.now
-		}));
-	}
-	return unreachableRegistrationAuthority(input.authority);
-}
-function requireActiveWalletAuthMethodRecordV2(record) {
-	if (record.status !== "active") throw new Error("Wallet auth method must be active");
-	return record;
-}
 function unreachableRegistrationAuthority(value) {
 	throw new Error(`Unhandled registration authority kind: ${String(value)}`);
 }
 async function verifyD1LinkedDeviceFreshRevokeProofV1(input) {
 	if (input.proof.kind === "email_otp") {
-		if (!input.verifyEmailOtpExisting || !input.readEmailOtpEnrollment) return {
+		if (!input.verifyEmailOtpExisting && !input.verifyEmailOtpExistingForBatch || !input.readEmailOtpEnrollment) return {
 			kind: "denied",
 			code: "invalid",
 			message: "Email OTP revocation proof is not configured"
@@ -145,7 +102,7 @@ async function verifyD1LinkedDeviceFreshRevokeProofV1(input) {
 			code: "unauthorized",
 			message: "Fresh Email OTP proof is bound to another revoke operation"
 		};
-		const verified = await input.verifyEmailOtpExisting({
+		const challenge = {
 			userId: enrollment.providerUserId,
 			walletId: String(input.walletId),
 			orgId: input.orgId,
@@ -155,7 +112,19 @@ async function verifyD1LinkedDeviceFreshRevokeProofV1(input) {
 			ownerProofBindingDigest: input.proof.ownerProofBindingDigest,
 			action: WALLET_EMAIL_OTP_ACTIONS.login,
 			operation: WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION
-		});
+		};
+		let verified;
+		let emailOtpConsumeInBatch;
+		if (input.verifyEmailOtpExistingForBatch) {
+			const batchVerified = await input.verifyEmailOtpExistingForBatch(challenge);
+			if (batchVerified.ok) emailOtpConsumeInBatch = batchVerified.consumeInBatch;
+			verified = batchVerified;
+		} else if (input.verifyEmailOtpExisting) verified = await input.verifyEmailOtpExisting(challenge);
+		else return {
+			kind: "denied",
+			code: "invalid",
+			message: "Email OTP revocation proof is not configured"
+		};
 		if (!verified.ok) return {
 			kind: "denied",
 			code: "unauthorized",
@@ -164,7 +133,8 @@ async function verifyD1LinkedDeviceFreshRevokeProofV1(input) {
 		return {
 			kind: "authorized",
 			walletAuthMethodId: sourceMethod.walletAuthMethodId,
-			verifiedAtMs: input.verifiedAtMs
+			verifiedAtMs: input.verifiedAtMs,
+			...emailOtpConsumeInBatch ? { emailOtpConsumeInBatch } : {}
 		};
 	}
 	if (input.proof.kind !== "webauthn_assertion") return {
@@ -280,6 +250,6 @@ async function resolveD1WebAuthnExistingWalletAuth(input) {
 	};
 }
 //#endregion
-export { d1HostIsWithinWebAuthnRpId, resolveD1AddAuthMethodExistingAuth, resolveD1AddSignerExistingAuth, verifyD1LinkedDeviceFreshRevokeProofV1, walletAuthAuthorityFromRegistrationAuthority, walletAuthMethodRecordFromRegistrationAuthority, walletRegistrationFinalizeAuthMethodFromAuthority };
+export { d1HostIsWithinWebAuthnRpId, resolveD1AddAuthMethodExistingAuth, resolveD1AddSignerExistingAuth, verifyD1LinkedDeviceFreshRevokeProofV1, walletAuthAuthorityFromRegistrationAuthority, walletRegistrationFinalizeAuthMethodFromAuthority };
 
 //# sourceMappingURL=d1WalletAuthMethodBoundary.js.map

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthMethodRevocationReplayStore.js

@@ -0,0 +1,100 @@
+import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
+import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import "../../../../shared-ts/src/utils/encoders.js";
+import { parseLinkedDeviceRevokeResultV1 } from "../../../../shared-ts/src/device-linking/deviceManagement.js";
+import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
+//#region src/router/cloudflare/d1/wallet/d1WalletAuthMethodRevocationReplayStore.ts
+const REVOCATION_PROOF_DIGEST_DOMAIN_V1 = "seams/wallet-auth-method-revocation-proof/v1";
+/**
+* A digest of the proof a revocation request presents. The recorded answer
+* is bound to it, so no proof, and no one-time code, is kept.
+*/
+async function computeWalletAuthMethodRevocationProofDigestV1(proof) {
+	return base64UrlEncode(await sha256BytesUtf8(`${REVOCATION_PROOF_DIGEST_DOMAIN_V1}\n${alphabetizeStringify(proof)}`));
+}
+/**
+* Each auth-method revocation's committed answer, in the signer database. The
+* row is inserted in the batch that revokes the method, and never changes.
+*/
+var D1WalletAuthMethodRevocationReplayStoreV1 = class {
+	constructor(input) {
+		this.database = input.database;
+		this.scope = input.scope;
+	}
+	/**
+	* The committed answer to exactly this request: the same operation, proven
+	* by the same proof. Null for a method no revocation committed, or one a
+	* different request revoked.
+	*/
+	async readExactAnswerV1(identity) {
+		const json = await this.readExactAnswerJson(identity, "wallet_auth_method_revocation_v1");
+		return json === null ? null : JSON.parse(json);
+	}
+	/** The committed answer to exactly this linked-device revocation request. */
+	async readExactLinkedDeviceAnswerV1(identity) {
+		const json = await this.readExactAnswerJson(identity, "linked_device_revocation_v1");
+		return json === null ? null : parseLinkedDeviceRevokeResultV1(JSON.parse(json));
+	}
+	async readExactAnswerJson(identity, answerKind) {
+		const row = await this.database.prepare(`SELECT operation_fingerprint_digest_b64u, source_proof_digest_b64u, response_json,
+                answer_kind
+           FROM wallet_auth_method_revocation_replays
+          WHERE namespace = ?1
+            AND org_id = ?2
+            AND project_id = ?3
+            AND env_id = ?4
+            AND wallet_id = ?5
+            AND target_wallet_auth_method_id = ?6`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, String(identity.walletId), String(identity.targetWalletAuthMethodId)).first();
+		if (!row || row.answer_kind !== answerKind || row.operation_fingerprint_digest_b64u !== identity.operationFingerprintDigestB64u || row.source_proof_digest_b64u !== identity.sourceProofDigestB64u) return null;
+		return row.response_json;
+	}
+	/**
+	* The statements that record `response` as the answer to this request, for
+	* the batch that revokes the method. They abort the batch unless they
+	* insert it: a method whose revocation already committed commits nothing
+	* more.
+	*/
+	prepareRecordAnswerStatements(input) {
+		return [this.database.prepare(`INSERT OR IGNORE INTO wallet_auth_method_revocation_replays (
+             namespace, org_id, project_id, env_id, wallet_id,
+             target_wallet_auth_method_id, operation_fingerprint_digest_b64u,
+             source_wallet_auth_method_id, source_proof_digest_b64u,
+             response_json, committed_at_ms, answer_kind
+           ) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11,
+                     'wallet_auth_method_revocation_v1')`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, String(input.identity.walletId), String(input.identity.targetWalletAuthMethodId), input.identity.operationFingerprintDigestB64u, String(input.sourceWalletAuthMethodId), input.identity.sourceProofDigestB64u, JSON.stringify(input.response), input.committedAtMs), this.database.prepare(D1_BATCH_CAS_GUARD_SQL)];
+	}
+	/**
+	* The statements that record a linked-device revocation's answer, for the
+	* end of the batch that revokes the device's method. The answer names the
+	* device's authority and its revocation epoch, which the batch itself sets,
+	* so the statement reads them from the row the batch wrote: the record is
+	* the answer that committed. They abort the batch unless they insert it.
+	*/
+	prepareRecordLinkedDeviceAnswerStatements(input) {
+		return [this.database.prepare(`INSERT OR IGNORE INTO wallet_auth_method_revocation_replays (
+             namespace, org_id, project_id, env_id, wallet_id,
+             target_wallet_auth_method_id, operation_fingerprint_digest_b64u,
+             source_wallet_auth_method_id, source_proof_digest_b64u,
+             response_json, committed_at_ms, answer_kind
+           )
+           SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9,
+                  json_object(
+                    'kind', 'revoked',
+                    'walletAuthMethodId', ?6,
+                    'authorityId', authority.authority_id,
+                    'revocationEpoch', authority.revocation_epoch
+                  ),
+                  ?10, 'linked_device_revocation_v1'
+             FROM wallet_authorities AS authority
+            WHERE authority.namespace = ?1
+              AND authority.org_id = ?2
+              AND authority.project_id = ?3
+              AND authority.env_id = ?4
+              AND authority.wallet_id = ?5
+              AND authority.authority_id = ?11`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, String(input.identity.walletId), String(input.identity.targetWalletAuthMethodId), input.identity.operationFingerprintDigestB64u, String(input.sourceWalletAuthMethodId), input.identity.sourceProofDigestB64u, input.committedAtMs, String(input.authorityId)), this.database.prepare(D1_BATCH_CAS_GUARD_SQL)];
+	}
+};
+//#endregion
+export { D1WalletAuthMethodRevocationReplayStoreV1, computeWalletAuthMethodRevocationProofDigestV1 };
+
+//# sourceMappingURL=d1WalletAuthMethodRevocationReplayStore.js.map

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthMethodService.js

@@ -2,27 +2,31 @@ import { parseChallengeSubjectId, parseEmailOtpChallengeId, parseOrgId, parsePro
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
 import "../../../../shared-ts/src/utils/encoders.js";
-import { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
-import { parseWalletAddAuthMethodRegistrationOptions } from "../../../../shared-ts/src/utils/addAuthMethodRegistration.js";
-import { addAuthMethodIntentGrantFromString, buildWalletAuthMethodRecordV2, computeAddAuthMethodIntentDigestB64u, computeWalletAuthMethodRevokeOperationFingerprintV1, normalizeEmailOtpRegistrationProof } from "../../../../shared-ts/src/utils/registrationIntent.js";
-import { deriveWebAuthnAuthenticatorDeviceInfo } from "../../../../shared-ts/src/utils/webauthnDeviceInfo.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
+import { buildDelegatedWalletAuthorityV1, buildFullOwnerPermissionsV1, sameDelegatedWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
+import { parseWalletAddAuthMethodRegistrationOptions } from "../../../../shared-ts/src/utils/addAuthMethodRegistration.js";
 import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { buildEmailOtpWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { normalizeEmailOtpRegistrationProof } from "../../../../shared-ts/src/utils/registrationAuthMethodInput.js";
+import { buildWalletAuthMethodRecordV2, computeWalletAuthMethodRevokeOperationFingerprintV1 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
+import { deriveWebAuthnAuthenticatorDeviceInfo } from "../../../../shared-ts/src/utils/webauthnDeviceInfo.js";
 import { parseSessionOrigin } from "../../../../authorization/domain.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { PASSKEY_PRF_FIRST_SALT_V1, PASSKEY_PRF_SECOND_SALT_V1 } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 import { parsePasskeyCustodyEnvelopeRecord } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
+import { addAuthMethodIntentGrantFromString, computeAddAuthMethodIntentDigestB64u } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { parseWebAuthnClientDataJsonBase64url, webAuthnOriginHostnameOrEmpty } from "../../../auth/webAuthnCredentialCodecs.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { resolveWalletAuthMethodIdForAuthority } from "../../../../core/signingLanes/WalletExecutionLaneProjection.js";
 import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
 import { d1HostIsWithinWebAuthnRpId, resolveD1AddAuthMethodExistingAuth, resolveD1AddSignerExistingAuth, verifyD1LinkedDeviceFreshRevokeProofV1, walletAuthAuthorityFromRegistrationAuthority } from "./d1WalletAuthMethodBoundary.js";
 import { parseWalletIdForIntent } from "../registration/d1RegistrationCeremonyRecords.js";
-import { expiredGoogleEmailOtpRegistrationAttemptRecord, pendingGoogleEmailOtpRegistrationAttemptWithSelectedCandidate, runtimePolicyScopeKey } from "../emailOtp/d1GoogleEmailOtpRegistrationRecords.js";
+import { runtimePolicyScopeKey } from "../../../../core/EmailOtpRecords.js";
+import { expiredGoogleEmailOtpRegistrationAttemptRecord, pendingGoogleEmailOtpRegistrationAttemptWithSelectedCandidate } from "../emailOtp/d1GoogleEmailOtpRegistrationRecords.js";
 import { admitAddWalletAuthMethod } from "../../../../shared-ts/src/utils/addWalletAuthMethod.js";
+import { computeWalletAuthMethodRevocationProofDigestV1 } from "./d1WalletAuthMethodRevocationReplayStore.js";
 //#region src/router/cloudflare/d1/wallet/d1WalletAuthMethodService.ts
 /** Long enough for a device to retry across a reload, short of ceremony scale. */
 const ADD_AUTH_METHOD_FINALIZE_REPLAY_TTL_MS = 1440 * 60 * 1e3;
@@ -115,6 +119,10 @@ function bindEmailOtpAuthorityToMethod(authority, walletAuthMethodId) {
 function isFullOwnerAuthorityV1(authority) {
 	return sameDelegatedWalletAuthorityV1(buildDelegatedWalletAuthorityV1({ permissions: authority.permissions }), buildDelegatedWalletAuthorityV1({ permissions: buildFullOwnerPermissionsV1() }));
 }
+/**
+* The answer to revoking `record`. Only its kind and relying party shape it,
+* so the answer can be recorded in the batch that revokes the method.
+*/
 function walletAuthMethodRevokedResponse(walletId, record) {
 	switch (record.kind) {
 		case "passkey": return {
@@ -256,6 +264,7 @@ var CloudflareD1WalletAuthMethodService = class {
 		this.orgId = input.orgId;
 		this.verifyWebAuthnAuthenticationLite = input.verifyWebAuthnAuthenticationLite;
 		this.prepareOwnerWalletSessionRevocation = input.prepareOwnerWalletSessionRevocation;
+		this.revocationReplays = input.revocationReplays;
 	}
 	/**
 	* Sends the enrollment code for an Email OTP addition.
@@ -1236,6 +1245,10 @@ var CloudflareD1WalletAuthMethodService = class {
 			authMethod
 		};
 	}
+	/** Commits an added signer onto its owner's authority. */
+	async extendActiveWalletAuthority(input) {
+		await this.walletAuthorityStore.extendActiveAuthority(input);
+	}
 	async resolveActivePasskeyAuthorityForVerifiedCredential(input) {
 		const record = await this.getWalletAuthMethodStore().getPasskeyV2({
 			rpId: input.rpId,
@@ -1485,13 +1498,14 @@ var CloudflareD1WalletAuthMethodService = class {
 			walletAuthMethodId: identity.walletAuthMethodId
 		};
 	}
-	async verifyWalletAuthMethodRevokeProof(input) {
+	/**
+	* Verifies a revocation's source proof: bound to this operation, and from a
+	* different active method on an active full-owner authority. An Email OTP
+	* proof's challenge is left unspent here. The result carries the statements
+	* that spend it, which commit only with the revocation.
+	*/
+	async verifyFreshRevokeProof(input) {
 		try {
-			const operationFingerprintDigest = await computeWalletAuthMethodRevokeOperationFingerprintV1({
-				walletId: input.walletId,
-				targetWalletAuthMethodId: input.targetWalletAuthMethodId,
-				requestedAtMs: input.requestedAtMs
-			});
 			const verified = await verifyD1LinkedDeviceFreshRevokeProofV1({
 				walletId: input.walletId,
 				orgId: this.orgId,
@@ -1499,13 +1513,19 @@ var CloudflareD1WalletAuthMethodService = class {
 				proof: input.sourceProof,
 				expectedOrigin: input.expectedOrigin,
 				verifiedAtMs: input.requestedAtMs,
-				operationFingerprintDigest,
+				operationFingerprintDigest: input.operationFingerprintDigest,
 				walletAuthMethodStore: this.getWalletAuthMethodStore(),
 				verifyWebAuthnAuthenticationLite: this.verifyWebAuthnAuthenticationLite,
-				verifyEmailOtpExisting: this.emailOtpChallengeVerifier.verifyExisting.bind(this.emailOtpChallengeVerifier),
+				verifyEmailOtpExistingForBatch: this.emailOtpChallengeVerifier.verifyExistingForBatch.bind(this.emailOtpChallengeVerifier),
 				readEmailOtpEnrollment: this.emailOtpChallengeVerifier.readEnrollmentForWallet.bind(this.emailOtpChallengeVerifier)
 			});
 			if (verified.kind === "denied") return verified;
+			const consumeInBatch = verified.emailOtpConsumeInBatch ?? [];
+			if (input.sourceProof.kind === "email_otp" && consumeInBatch.length === 0) return {
+				kind: "denied",
+				code: "invalid",
+				message: "Fresh Email OTP revocation proof cannot be spent with the revocation"
+			};
 			const sourceMethod = await this.getWalletAuthMethodStore().readByIdV2({ walletAuthMethodId: verified.walletAuthMethodId });
 			if (!sourceMethod || sourceMethod.status !== "active" || sourceMethod.walletId !== input.walletId || sourceMethod.walletAuthMethodId === input.targetWalletAuthMethodId) return {
 				kind: "denied",
@@ -1518,7 +1538,17 @@ var CloudflareD1WalletAuthMethodService = class {
 				code: "unauthorized",
 				message: "Fresh revocation proof requires a full-owner authority"
 			};
-			return verified;
+			return {
+				kind: "authorized",
+				walletAuthMethodId: verified.walletAuthMethodId,
+				commitPrerequisites: [...this.getWalletAuthMethodStore().prepareActiveV2SourceGuardStatements({
+					walletId: input.walletId,
+					walletAuthMethodId: sourceMethod.walletAuthMethodId,
+					walletAuthorityId: sourceMethod.walletAuthorityId,
+					authorityDigestB64u: sourceAuthority.authorityDigestB64u,
+					authorityRevocationEpoch: sourceAuthority.revocationEpoch
+				}), ...consumeInBatch]
+			};
 		} catch (error) {
 			return {
 				kind: "denied",
@@ -1561,30 +1591,91 @@ var CloudflareD1WalletAuthMethodService = class {
 			}))
 		});
 	}
-	async revokeWalletAuthMethod(input) {
+	/**
+	* Revokes one wallet auth method on a fresh proof from a different active
+	* full-owner method.
+	*
+	* The proof is spent, the method revoked and the answer recorded in one
+	* batch. The record binds the answer to the operation fingerprint and to a
+	* digest of the proof, never the proof or its code. An exact retry is
+	* answered from the record before its proof is examined again, so a request
+	* whose answer was lost receives what committed although its code is spent.
+	* A batch that does not commit spends nothing, so the same request can run
+	* again.
+	*/
+	async revokeWalletAuthMethodWithFreshProof(input) {
+		const walletId = input.subject.walletId;
+		let operationFingerprintDigest;
+		let replay;
 		try {
-			const walletId = input.subject.walletId;
-			const sourceWalletAuthMethodId = input.verifiedSource.walletAuthMethodId;
-			if (sourceWalletAuthMethodId === input.walletAuthMethodId) return {
-				ok: false,
-				code: "unauthorized",
-				message: "Revocation requires a different active source auth method"
+			operationFingerprintDigest = await computeWalletAuthMethodRevokeOperationFingerprintV1({
+				walletId,
+				targetWalletAuthMethodId: input.walletAuthMethodId,
+				requestedAtMs: input.requestedAtMs
+			});
+			replay = {
+				walletId,
+				targetWalletAuthMethodId: input.walletAuthMethodId,
+				operationFingerprintDigestB64u: String(operationFingerprintDigest),
+				sourceProofDigestB64u: await computeWalletAuthMethodRevocationProofDigestV1(input.sourceProof)
 			};
-			const walletAuthMethodStore = this.getWalletAuthMethodStore();
-			const sourceMethod = await walletAuthMethodStore.readByIdV2({ walletAuthMethodId: sourceWalletAuthMethodId });
-			const sourceAuthority = sourceMethod ? await this.walletAuthorityStore.readById(sourceMethod.walletAuthorityId) : null;
-			if (!sourceMethod || sourceMethod.status !== "active" || sourceMethod.walletId !== walletId || !sourceAuthority || sourceAuthority.state !== "active" || sourceAuthority.walletId !== walletId || !isFullOwnerAuthorityV1(sourceAuthority)) return {
-				ok: false,
-				code: "unauthorized",
-				message: "Fresh revocation proof requires a different active full-owner method"
+			const committed = await this.revocationReplays.readExactAnswerV1(replay);
+			if (committed) return {
+				kind: "answered",
+				response: committed
+			};
+		} catch (error) {
+			return {
+				kind: "answered",
+				response: {
+					ok: false,
+					code: "internal",
+					message: errorMessage(error) || "Failed to revoke wallet auth method"
+				}
 			};
-			const targetMethod = await walletAuthMethodStore.readByIdV2({ walletAuthMethodId: input.walletAuthMethodId });
+		}
+		const verified = await this.verifyFreshRevokeProof({
+			walletId,
+			targetWalletAuthMethodId: input.walletAuthMethodId,
+			requestedAtMs: input.requestedAtMs,
+			sourceProof: input.sourceProof,
+			expectedOrigin: input.expectedOrigin,
+			operationFingerprintDigest
+		});
+		if (verified.kind === "denied") {
+			const committed = await this.revocationReplays.readExactAnswerV1(replay).catch(() => null);
+			return committed ? {
+				kind: "answered",
+				response: committed
+			} : verified;
+		}
+		const response = await this.revokeWithVerifiedProof({
+			walletId,
+			targetWalletAuthMethodId: input.walletAuthMethodId,
+			requestedAtMs: input.requestedAtMs,
+			sourceWalletAuthMethodId: verified.walletAuthMethodId,
+			commitPrerequisites: verified.commitPrerequisites,
+			replay
+		});
+		if (response.ok) return {
+			kind: "answered",
+			response
+		};
+		return {
+			kind: "answered",
+			response: await this.revocationReplays.readExactAnswerV1(replay).catch(() => null) ?? response
+		};
+	}
+	async revokeWithVerifiedProof(input) {
+		try {
+			const walletId = input.walletId;
+			const targetMethod = await this.getWalletAuthMethodStore().readByIdV2({ walletAuthMethodId: input.targetWalletAuthMethodId });
 			if (!targetMethod || targetMethod.walletId !== walletId) return {
 				ok: false,
 				code: "not_found",
 				message: "wallet auth method not found"
 			};
-			if (targetMethod.status === "revoked") return walletAuthMethodRevokedResponse(walletId, targetMethod);
+			if (targetMethod.status === "revoked") return await this.revocationReplays.readExactAnswerV1(input.replay) ?? walletAuthMethodRevokedResponse(walletId, targetMethod);
 			if (targetMethod.status !== "active") return {
 				ok: false,
 				code: "invalid_state",
@@ -1611,19 +1702,27 @@ var CloudflareD1WalletAuthMethodService = class {
 				code: "conflict",
 				message: "wallet custody envelope changed; retry revocation"
 			};
+			const response = walletAuthMethodRevokedResponse(walletId, targetMethod);
 			const revoked = await this.walletAuthorityStore.revokeWalletAuthMethod({
 				walletId,
 				authorityId: targetAuthority.authorityId,
-				walletAuthMethodId: input.walletAuthMethodId,
+				walletAuthMethodId: input.targetWalletAuthMethodId,
 				expectedAuthorityRevocationEpoch: targetAuthority.revocationEpoch,
 				requestedAtMs: input.requestedAtMs,
 				sessionRevocationStatements: [
 					...this.prepareOwnerWalletSessionRevocation({
 						walletId,
-						walletAuthMethodId: input.walletAuthMethodId,
+						walletAuthMethodId: input.targetWalletAuthMethodId,
 						requestedAtMs: input.requestedAtMs
 					}),
 					...envelopeRevocation.statements,
+					...input.commitPrerequisites,
+					...this.revocationReplays.prepareRecordAnswerStatements({
+						identity: input.replay,
+						sourceWalletAuthMethodId: input.sourceWalletAuthMethodId,
+						response,
+						committedAtMs: Date.now()
+					}),
 					...targetMethod.kind === "email_otp" ? [this.emailOtpChallengeVerifier.prepareDeleteEnrollmentIfUnreferencedStatement(String(walletId))] : []
 				]
 			});
@@ -1637,7 +1736,7 @@ var CloudflareD1WalletAuthMethodService = class {
 				code: "conflict",
 				message: "wallet auth method changed; retry revocation"
 			};
-			return walletAuthMethodRevokedResponse(walletId, revoked.authMethod);
+			return response;
 		} catch (error) {
 			return {
 				ok: false,

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthorityStore.js

@@ -2,10 +2,13 @@ import { mpcMaterialActivationRefsEqual, parseLinkDeviceSessionId, parseLinkedDe
 import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { parseDelegatedWalletPermissionSetV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
+import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
 import { buildRevokedWalletAuthorityV1, computeWalletAuthorityDigestB64u, parseWalletAuthorityV1, parseWalletSignerActivationSetV1, walletAuthorityDigestsMatchV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
-import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { buildWalletSessionCapabilitySubjectsV1 } from "../../../../authorization/domain.js";
 import { d1ChangedRows, formatD1ExecStatement, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
+import { prepareD1WalletPutSignerStatement } from "../../../../core/d1WalletStore.js";
 import { ensureWalletAuthMethodStoreD1SchemaV2, prepareD1WalletAuthMethodV2PutStatement } from "../../../../core/d1WalletAuthMethodStore.js";
+import { prepareD1WalletSessionAuthorityProjectionStatements } from "../authorization/walletSessionAuthorityProjection.js";
 //#region src/router/cloudflare/d1/wallet/d1WalletAuthorityStore.ts
 const WALLET_AUTHORITY_STORE_D1_SCHEMA_SQL = Object.freeze([
 	`
@@ -342,6 +345,37 @@ function prepareAuthorityCasGuard(database) {
      WHERE changes() = 0
   `);
 }
+/**
+* Replaces one active authority with its extension, only if the stored row is
+* still exactly `expected`. Pair it with the CAS guard so a lost race aborts
+* the whole batch.
+*/
+function prepareD1WalletAuthorityExtensionStatement(input) {
+	return input.database.prepare(`UPDATE wallet_authorities
+          SET signer_activations_json = ?,
+              signer_activation_set_digest_b64u = ?,
+              authority_digest_b64u = ?,
+              record_json = ?,
+              updated_at_ms = ?
+        WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
+          AND authority_id = ?
+          AND wallet_id = ?
+          AND lifecycle_state = 'active'
+          AND signer_activation_set_digest_b64u = ?
+          AND authority_digest_b64u = ?
+          AND revocation_epoch = ?
+          AND created_at_ms = ?
+          AND updated_at_ms = ?
+          AND activated_at_ms = ?`).bind(JSON.stringify(input.next.signerActivations), String(input.next.signerActivationSetDigestB64u), String(input.next.authorityDigestB64u), JSON.stringify(input.next), input.next.updatedAtMs, input.scope.namespace, input.scope.orgId, input.scope.projectId, input.scope.envId, String(input.expected.authorityId), String(input.expected.walletId), String(input.expected.signerActivationSetDigestB64u), String(input.expected.authorityDigestB64u), input.expected.revocationEpoch, input.expected.createdAtMs, input.expected.updatedAtMs, input.expected.activatedAtMs);
+}
+/** Aborts the batch when the preceding authority extension changed no row. */
+function prepareD1WalletAuthorityExtensionCasGuard(database) {
+	return database.prepare(`
+    INSERT INTO wallet_authority_cas_guard (guard_id)
+    SELECT 1
+     WHERE changes() = 0
+  `);
+}
 var WalletAuthorityCommitConflictError = class extends Error {
 	constructor(authorityId) {
 		super(`wallet authority ${String(authorityId)} commit conflicts with an existing record`);
@@ -367,6 +401,51 @@ var D1WalletAuthorityStore = class {
 		await ensureWalletAuthMethodStoreD1SchemaV2({ database: this.database });
 		this.schemaReady = true;
 	}
+	/**
+	* Commits an added signer: its signer records, the authority extended with
+	* its activation, and every live Wallet Session of that authority promoted to
+	* the extended authority, all at once. Each session keeps its identity,
+	* quota and operation-credential hash; promotion retires its hosted
+	* credentials and deletes its unredeemed hosted exchange codes.
+	*/
+	async extendActiveAuthority(input) {
+		await this.ensureSchema();
+		const statements = [
+			...input.walletSigners.map((record) => prepareD1WalletPutSignerStatement({
+				database: this.database,
+				scope: this.scope,
+				record
+			})),
+			prepareD1WalletAuthorityExtensionStatement({
+				database: this.database,
+				scope: this.scope,
+				expected: input.expected,
+				next: input.next
+			}),
+			prepareD1WalletAuthorityExtensionCasGuard(this.database),
+			...prepareD1WalletSessionAuthorityProjectionStatements({
+				database: this.database,
+				scope: this.scope,
+				projection: {
+					walletId: input.next.walletId,
+					authorityId: input.next.authorityId,
+					authorityDigestB64u: input.next.authorityDigestB64u,
+					authorityRevocationEpoch: input.next.revocationEpoch,
+					capabilitySubjects: buildWalletSessionCapabilitySubjectsV1(input.next),
+					promotionAtMs: input.promotionAtMs
+				}
+			})
+		];
+		let results;
+		try {
+			results = await this.database.batch(statements);
+		} catch (error) {
+			const stored = await this.readById(input.expected.authorityId);
+			if (stored?.state === "active" && stored.authorityDigestB64u === input.expected.authorityDigestB64u && stored.revocationEpoch === input.expected.revocationEpoch && stored.updatedAtMs === input.expected.updatedAtMs) throw error;
+			throw new WalletAuthorityCommitConflictError(input.expected.authorityId);
+		}
+		if (results.length !== statements.length || results.some((result) => !result.success)) throw new Error("D1 wallet authority extension returned an incomplete batch result");
+	}
 	async readById(authorityId) {
 		await this.ensureSchema();
 		const row = await this.database.prepare(`SELECT *
@@ -626,7 +705,8 @@ var D1WalletAuthorityStore = class {
               WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
                 AND wallet_authority_id = ? AND status = 'active'
            )
-      `).bind(...scopeValues(this.scope), String(authority.authorityId))
+      `).bind(...scopeValues(this.scope), String(authority.authorityId)),
+			...input.trailingStatements ?? []
 		];
 		let results;
 		try {
@@ -782,8 +862,7 @@ async function buildRevokedAuthority(authority, revokedAtMs) {
 		revokedAtMs: draft.revokedAtMs
 	});
 }
-var D1WalletAuthorityStoreV1 = class extends D1WalletAuthorityStore {};
 //#endregion
-export { D1WalletAuthorityStore, D1WalletAuthorityStoreV1, WALLET_AUTHORITY_STORE_D1_SCHEMA_SQL, WalletAuthorityCommitConflictError, parseD1WalletAuthorityRow, prepareD1WalletAuthorityPutStatement };
+export { D1WalletAuthorityStore, WalletAuthorityCommitConflictError, parseD1WalletAuthorityRow, prepareD1WalletAuthorityExtensionCasGuard, prepareD1WalletAuthorityExtensionStatement, prepareD1WalletAuthorityPutStatement };
 
 //# sourceMappingURL=d1WalletAuthorityStore.js.map