@seams/wallet-server 0.6.2 → 0.7.3

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAddSignerService.js

@@ -1,17 +1,20 @@
-import { parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { mpcMaterialActivationRefsEqual, parseWalletKeyId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import "../../../../shared-ts/src/utils/encoders.js";
-import { addSignerIntentGrantFromString, computeAddSignerIntentDigestB64u, sameAddSignerIntentV1 } from "../../../../shared-ts/src/utils/registrationIntent.js";
-import { parseRouterAbEd25519YaoRegistrationAdmissionRequestV1, sameRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
-import { ecdsaClientRootPublicKey33B64uFromString } from "../../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
+import { parseSecp256k1CompressedPublicKeyB64u } from "../../../../shared-ts/src/passkey-custody/primitives.js";
+import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { parseRouterAbEd25519YaoRegistrationAdmissionRequestV1, sameRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { ecdsaClientRootPublicKey33B64uFromString } from "../../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { deriveSigningRootId } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { buildRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaRegistrationRequestFactsV1, sameRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbEcdsaRegistrationRequestFactsV1, sameRouterAbEcdsaVerifiedClientActivationFactsV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { sameWalletEd25519SignerRecordV1 } from "../../../../core/WalletStore.js";
+import { buildWalletEcdsaSignerActivationV1, extendEd25519WalletAuthorityWithEcdsa, isActiveEd25519WalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { registrationPreparationIdFromString } from "../../../../core/types.js";
 import { buildTenantRootIdentityFromAuthenticatedDeploymentV1 } from "../../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
+import { addSignerIntentGrantFromString, computeAddSignerIntentDigestB64u, sameAddSignerIntentV1 } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { WalletAuthorityCommitConflictError } from "./d1WalletAuthorityStore.js";
 import { buildRouterAbEd25519YaoRegistrationCapabilityRecordV1 } from "../../../domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.js";
 import { buildRouterAbEd25519YaoAddSignerAdmissionRequestV1, createRouterAbEd25519YaoMaterialActivationRefV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js";
 import { parseRouterAbEd25519YaoRegistrationSideEffectRecordV1, runRouterAbEd25519YaoRegistrationSideEffectV1, throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
@@ -19,6 +22,7 @@ import { buildYaoEd25519WalletSignerRecord, ed25519NearPublicKeyFromBytes, impli
 import { routerAbEcdsaStrictRegistrationRequestMatchesFacts } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
 import { buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, normalizeThresholdEcdsaChainTargets, parseD1AddSignerIntent, parseD1RuntimePolicyScope, parseD1StoredAddSignerAuth, parseD1StoredAddSignerIntent, parseD1StoredWalletAddSignerCeremony, parseD1WalletAddSignerFinalizeTerminalResponse, parseWalletIdForIntent, positiveIntegerArraysEqual, runtimePolicyScopeMatches, thresholdEcdsaChainTargetsEqual } from "../registration/d1RegistrationCeremonyRecords.js";
 import { buildD1EvmFamilyEcdsaRegistrationPrepare } from "../registration/d1EvmFamilyEcdsaRegistrationBranch.js";
+import { routerAbEd25519YaoLifecycleDecisionLookupV1, routerAbEd25519YaoLifecycleDecisionV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision.js";
 import { buildActivatedEcdsaFamilyBootstrap, ecdsaStrictRegistrationAuthority, exactEcdsaParticipantPair } from "../registration/d1WalletRegistrationService.js";
 import { computeWalletAddSignerEcdsaActivationRequestDigestB64u } from "../../../../shared-ts/src/utils/walletAddSignerActivation.js";
 //#region src/router/cloudflare/d1/wallet/d1WalletAddSignerService.ts
@@ -412,6 +416,9 @@ function storedEcdsaAddSignerBootstrap(bootstrap) {
 		routerAbEcdsaDerivationNormalSigning: bootstrap.routerAbEcdsaDerivationNormalSigning
 	};
 }
+function sameEcdsaSignerActivation(left, right) {
+	return left.signer.walletId === right.signer.walletId && left.signer.walletKeyId === right.signer.walletKeyId && left.signer.thresholdPublicKey33B64u === right.signer.thresholdPublicKey33B64u && left.signer.evmAddress === right.signer.evmAddress && mpcMaterialActivationRefsEqual(left.materialActivation, right.materialActivation);
+}
 var CloudflareD1WalletAddSignerService = class {
 	constructor(input) {
 		this.getRegistrationCeremonyIntentStore = input.getRegistrationCeremonyIntentStore;
@@ -423,6 +430,86 @@ var CloudflareD1WalletAddSignerService = class {
 		this.passkeyCustodyEnvelopes = input.passkeyCustodyEnvelopes;
 		this.startSideEffects = input.startSideEffects;
 		this.finalizeSideEffects = input.finalizeSideEffects;
+		this.yaoLifecycleDecisions = input.yaoLifecycleDecisions;
+	}
+	/**
+	* Commits an added ECDSA signer onto the authority whose passkey authorized
+	* the ceremony: its signer records, the authority extended with the new
+	* activation, and that authority's live Wallet Sessions promoted to it, so the
+	* wallet signs with the new key at once. A retry after the commit finds the
+	* authority already carrying this activation and commits nothing.
+	*/
+	async extendOwnerAuthorityWithAddedEcdsaSigner(input) {
+		const rpId = parseWebAuthnRpId(input.ceremony.auth.rpId);
+		const credentialId = parseWebAuthnCredentialIdB64u(input.ceremony.auth.credentialIdB64u);
+		if (!rpId.ok || !credentialId.ok) return {
+			ok: false,
+			code: "invalid_state",
+			message: "ECDSA add-signer has an invalid factor identity"
+		};
+		const walletId = input.ceremony.intent.walletId;
+		const owner = await this.walletAuthMethods.resolveActivePasskeyAuthorityForVerifiedCredential({
+			walletId,
+			rpId: rpId.value,
+			credentialIdB64u: credentialId.value
+		});
+		if (!owner.ok) return owner;
+		const walletKeyId = parseWalletKeyId(`wallet-key:ecdsa:${walletId}:${input.walletKey.evmFamilySigningKeySlotId}`);
+		if (!walletKeyId.ok || !/^0x[0-9a-fA-F]{40}$/.test(input.walletKey.thresholdOwnerAddress)) return {
+			ok: false,
+			code: "invalid_state",
+			message: "ECDSA add-signer wallet key identity is invalid"
+		};
+		const ecdsa = buildWalletEcdsaSignerActivationV1({
+			signer: {
+				kind: "exact_administered_ecdsa_signer_v1",
+				keyFamily: "ecdsa_secp256k1",
+				walletId,
+				walletKeyId: walletKeyId.value,
+				thresholdPublicKey33B64u: parseSecp256k1CompressedPublicKeyB64u(input.walletKey.thresholdEcdsaPublicKeyB64u),
+				evmAddress: input.walletKey.thresholdOwnerAddress
+			},
+			materialActivation: routerAbMpcMaterialActivationRefFromWire(input.activation.ecdsa_activation.material_activation)
+		});
+		const current = owner.walletAuthority;
+		const currentEcdsa = current.signerActivations.ecdsa;
+		if (currentEcdsa) return sameEcdsaSignerActivation(currentEcdsa, ecdsa) ? {
+			ok: true,
+			authority: current
+		} : {
+			ok: false,
+			code: "signer_conflict",
+			message: "the wallet authority already holds a different ECDSA signer"
+		};
+		if (!isActiveEd25519WalletAuthorityV1(current)) return {
+			ok: false,
+			code: "invalid_state",
+			message: "ECDSA add-signer requires an active NEAR-only wallet authority"
+		};
+		const next = await extendEd25519WalletAuthorityWithEcdsa({
+			authority: current,
+			ecdsa,
+			now: input.now
+		});
+		try {
+			await this.walletAuthMethods.extendActiveWalletAuthority({
+				expected: current,
+				next,
+				walletSigners: input.walletSigners,
+				promotionAtMs: input.now
+			});
+		} catch (error) {
+			if (error instanceof WalletAuthorityCommitConflictError) return {
+				ok: false,
+				code: "conflict",
+				message: "the wallet authority changed while its ECDSA signer was added; retry"
+			};
+			throw error;
+		}
+		return {
+			ok: true,
+			authority: next
+		};
 	}
 	async getWalletAddSignerRuntimePolicyScope(addSignerCeremonyId) {
 		const ceremony = await this.getRegistrationCeremonyIntentStore().getAddSignerCeremony(addSignerCeremonyId);
@@ -1096,6 +1183,44 @@ var CloudflareD1WalletAddSignerService = class {
 		const response = await this.executeWalletAddSignerFinalize(input, prepared);
 		return response.ok ? response : throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1(response);
 	}
+	/**
+	* Makes an added Ed25519 signer visible with its lifecycle's decision, in
+	* one batch. A finalize that finds its own decision has nothing left to
+	* write. Another decision for the lifecycle, or another signer in the slot,
+	* refuses it.
+	*/
+	async decideEd25519YaoSignerVisibility(input) {
+		const decisions = this.yaoLifecycleDecisions;
+		const settled = (stored) => {
+			switch (routerAbEd25519YaoLifecycleDecisionLookupV1(input.decision, stored).kind) {
+				case "undecided": return null;
+				case "decided": return { ok: true };
+				case "decided_otherwise": return {
+					ok: false,
+					code: "invalid_state",
+					message: "Ed25519 Yao add-signer lifecycle was finalized by another request"
+				};
+			}
+		};
+		const before = settled(await decisions.read(input.decision.lifecycleId));
+		if (before) return before;
+		try {
+			await decisions.decide(input.decision, await input.walletStore.prepareEd25519SignerIfSlotAvailableStatements(input.signer), Date.now());
+			return { ok: true };
+		} catch (error) {
+			const after = settled(await decisions.read(input.decision.lifecycleId));
+			if (after) return after;
+			if (await input.walletStore.getEd25519SignerBySlot({
+				walletId: input.signer.walletId,
+				signerSlot: input.signer.signerSlot
+			})) return {
+				ok: false,
+				code: "signer_conflict",
+				message: "Ed25519 signer slot is already occupied"
+			};
+			throw error;
+		}
+	}
 	async executeWalletAddSignerFinalize(input, prepared) {
 		const store = input.store;
 		const finalizeRequest = input.finalizeRequest;
@@ -1291,17 +1416,18 @@ var CloudflareD1WalletAddSignerService = class {
 				code: "scope_mismatch",
 				message: "stored Ed25519 Yao add-signer finalize plan is invalid"
 			};
-			if (!await walletStore.putEd25519SignerIfSlotAvailable(signer)) {
-				const existing = await walletStore.getEd25519SignerBySlot({
+			const visible = await this.decideEd25519YaoSignerVisibility({
+				decision: await routerAbEd25519YaoLifecycleDecisionV1({
+					kind: "add_signer_finalized",
+					lifecycleId: activation.activation.admissionRequest.scope.lifecycle_id,
 					walletId: ceremony.intent.walletId,
-					signerSlot: selection.signerSlot
-				});
-				if (!existing || !sameWalletEd25519SignerRecordV1(existing, signer)) return {
-					ok: false,
-					code: "signer_conflict",
-					message: "Ed25519 signer slot is already occupied"
-				};
-			}
+					consumerBinding: input.consumerBinding,
+					capability: signer.activeYaoCapability
+				}),
+				signer,
+				walletStore
+			});
+			if (!visible.ok) return visible;
 			const installed = await yaoRuntime.installPersistedActiveCapability(signer.activeYaoCapability);
 			if (!installed.ok) return throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1(installed);
 			await store.putAddSignerFinalizeReplay({
@@ -1345,8 +1471,7 @@ var CloudflareD1WalletAddSignerService = class {
 			message: "ECDSA add-signer scope is invalid"
 		};
 		const signerWriteNow = prepared.signerWriteAtMs;
-		const walletStore = this.getWalletStore();
-		if (!await walletStore.getWallet({ walletId: ceremony.intent.walletId })) return {
+		if (!await this.getWalletStore().getWallet({ walletId: ceremony.intent.walletId })) return {
 			ok: false,
 			code: "not_found",
 			message: "wallet not found"
@@ -1370,13 +1495,27 @@ var CloudflareD1WalletAddSignerService = class {
 			custodyClientRootPublicKey33B64u,
 			now: signerWriteNow
 		});
-		await walletStore.putSigners(walletSigners);
+		const primaryWalletKey = walletKeys[0];
+		if (!primaryWalletKey) return {
+			ok: false,
+			code: "invalid_state",
+			message: "ECDSA add-signer produced no wallet key"
+		};
+		const owner = await this.extendOwnerAuthorityWithAddedEcdsaSigner({
+			ceremony,
+			walletKey: primaryWalletKey,
+			activation: ceremony.signerState.activation,
+			walletSigners,
+			now: signerWriteNow
+		});
+		if (!owner.ok) return owner;
 		const response = {
 			ok: true,
 			kind: "evm_family_ecdsa",
 			walletId: ceremony.intent.walletId,
 			...ceremony.auth.kind === "webauthn_assertion" ? { rpId: ceremony.auth.rpId } : {},
-			ecdsa: { walletKeys }
+			ecdsa: { walletKeys },
+			authority: owner.authority
 		};
 		await store.putAddSignerFinalizeReplay({
 			kind: "wallet_add_signer_finalize_replay_v1",

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthMethodBoundary.js

@@ -1,10 +1,8 @@
-import { parseWebAuthnCredentialIdB64u } from "../../../../shared-ts/src/utils/domainIds.js";
 import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
-import { buildWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { buildEmailOtpWalletAuthAuthority, buildPasskeyWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { webAuthnCredentialIdB64uFromCredential } from "../../../auth/webAuthnCredentialCodecs.js";
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_ACTIONS, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 //#region src/router/cloudflare/d1/wallet/d1WalletAuthMethodBoundary.ts
 function walletRegistrationFinalizeAuthMethodFromAuthority(authority) {
 	switch (authority.kind) {
@@ -42,53 +40,12 @@ function walletAuthAuthorityFromRegistrationAuthority(input) {
 	}
 	return unreachableRegistrationAuthority(input.authority);
 }
-function walletAuthMethodRecordFromRegistrationAuthority(input) {
-	switch (input.authority.kind) {
-		case "passkey": {
-			const credentialIdB64u = parseWebAuthnCredentialIdB64u(input.authority.credentialIdB64u);
-			if (!credentialIdB64u.ok) throw new Error(`Registration credential ID is invalid: ${credentialIdB64u.error.message}`);
-			return requireActiveWalletAuthMethodRecordV2(buildWalletAuthMethodRecordV2({
-				version: "wallet_auth_method_v2",
-				walletAuthMethodId: input.walletAuthMethodId,
-				kind: "passkey",
-				status: "active",
-				walletId: input.authority.walletId,
-				walletAuthorityId: input.walletAuthorityId,
-				rpId: input.authority.rpId,
-				credentialIdB64u: credentialIdB64u.value,
-				credentialPublicKeyB64u: input.authority.credentialPublicKeyB64u,
-				counter: input.authority.counter,
-				createdAtMs: input.now,
-				updatedAtMs: input.now,
-				activatedAtMs: input.now
-			}));
-		}
-		case "email_otp": return requireActiveWalletAuthMethodRecordV2(buildWalletAuthMethodRecordV2({
-			version: "wallet_auth_method_v2",
-			walletAuthMethodId: input.walletAuthMethodId,
-			kind: "email_otp",
-			status: "active",
-			walletId: input.authority.walletId,
-			walletAuthorityId: input.walletAuthorityId,
-			emailHashHex: input.authority.emailHashHex,
-			registrationAuthorityId: input.authority.registrationAuthorityId,
-			createdAtMs: input.now,
-			updatedAtMs: input.now,
-			activatedAtMs: input.now
-		}));
-	}
-	return unreachableRegistrationAuthority(input.authority);
-}
-function requireActiveWalletAuthMethodRecordV2(record) {
-	if (record.status !== "active") throw new Error("Wallet auth method must be active");
-	return record;
-}
 function unreachableRegistrationAuthority(value) {
 	throw new Error(`Unhandled registration authority kind: ${String(value)}`);
 }
 async function verifyD1LinkedDeviceFreshRevokeProofV1(input) {
 	if (input.proof.kind === "email_otp") {
-		if (!input.verifyEmailOtpExisting || !input.readEmailOtpEnrollment) return {
+		if (!input.verifyEmailOtpExisting && !input.verifyEmailOtpExistingForBatch || !input.readEmailOtpEnrollment) return {
 			kind: "denied",
 			code: "invalid",
 			message: "Email OTP revocation proof is not configured"
@@ -145,7 +102,7 @@ async function verifyD1LinkedDeviceFreshRevokeProofV1(input) {
 			code: "unauthorized",
 			message: "Fresh Email OTP proof is bound to another revoke operation"
 		};
-		const verified = await input.verifyEmailOtpExisting({
+		const challenge = {
 			userId: enrollment.providerUserId,
 			walletId: String(input.walletId),
 			orgId: input.orgId,
@@ -155,7 +112,19 @@ async function verifyD1LinkedDeviceFreshRevokeProofV1(input) {
 			ownerProofBindingDigest: input.proof.ownerProofBindingDigest,
 			action: WALLET_EMAIL_OTP_ACTIONS.login,
 			operation: WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION
-		});
+		};
+		let verified;
+		let emailOtpConsumeInBatch;
+		if (input.verifyEmailOtpExistingForBatch) {
+			const batchVerified = await input.verifyEmailOtpExistingForBatch(challenge);
+			if (batchVerified.ok) emailOtpConsumeInBatch = batchVerified.consumeInBatch;
+			verified = batchVerified;
+		} else if (input.verifyEmailOtpExisting) verified = await input.verifyEmailOtpExisting(challenge);
+		else return {
+			kind: "denied",
+			code: "invalid",
+			message: "Email OTP revocation proof is not configured"
+		};
 		if (!verified.ok) return {
 			kind: "denied",
 			code: "unauthorized",
@@ -164,7 +133,8 @@ async function verifyD1LinkedDeviceFreshRevokeProofV1(input) {
 		return {
 			kind: "authorized",
 			walletAuthMethodId: sourceMethod.walletAuthMethodId,
-			verifiedAtMs: input.verifiedAtMs
+			verifiedAtMs: input.verifiedAtMs,
+			...emailOtpConsumeInBatch ? { emailOtpConsumeInBatch } : {}
 		};
 	}
 	if (input.proof.kind !== "webauthn_assertion") return {
@@ -280,6 +250,6 @@ async function resolveD1WebAuthnExistingWalletAuth(input) {
 	};
 }
 //#endregion
-export { d1HostIsWithinWebAuthnRpId, resolveD1AddAuthMethodExistingAuth, resolveD1AddSignerExistingAuth, verifyD1LinkedDeviceFreshRevokeProofV1, walletAuthAuthorityFromRegistrationAuthority, walletAuthMethodRecordFromRegistrationAuthority, walletRegistrationFinalizeAuthMethodFromAuthority };
+export { d1HostIsWithinWebAuthnRpId, resolveD1AddAuthMethodExistingAuth, resolveD1AddSignerExistingAuth, verifyD1LinkedDeviceFreshRevokeProofV1, walletAuthAuthorityFromRegistrationAuthority, walletRegistrationFinalizeAuthMethodFromAuthority };
 
 //# sourceMappingURL=d1WalletAuthMethodBoundary.js.map

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAuthMethodRevocationReplayStore.js

@@ -0,0 +1,100 @@
+import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
+import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import "../../../../shared-ts/src/utils/encoders.js";
+import { parseLinkedDeviceRevokeResultV1 } from "../../../../shared-ts/src/device-linking/deviceManagement.js";
+import { D1_BATCH_CAS_GUARD_SQL } from "../../../../storage/d1Sql.js";
+//#region src/router/cloudflare/d1/wallet/d1WalletAuthMethodRevocationReplayStore.ts
+const REVOCATION_PROOF_DIGEST_DOMAIN_V1 = "seams/wallet-auth-method-revocation-proof/v1";
+/**
+* A digest of the proof a revocation request presents. The recorded answer
+* is bound to it, so no proof, and no one-time code, is kept.
+*/
+async function computeWalletAuthMethodRevocationProofDigestV1(proof) {
+	return base64UrlEncode(await sha256BytesUtf8(`${REVOCATION_PROOF_DIGEST_DOMAIN_V1}\n${alphabetizeStringify(proof)}`));
+}
+/**
+* Each auth-method revocation's committed answer, in the signer database. The
+* row is inserted in the batch that revokes the method, and never changes.
+*/
+var D1WalletAuthMethodRevocationReplayStoreV1 = class {
+	constructor(input) {
+		this.database = input.database;
+		this.scope = input.scope;
+	}
+	/**
+	* The committed answer to exactly this request: the same operation, proven
+	* by the same proof. Null for a method no revocation committed, or one a
+	* different request revoked.
+	*/
+	async readExactAnswerV1(identity) {
+		const json = await this.readExactAnswerJson(identity, "wallet_auth_method_revocation_v1");
+		return json === null ? null : JSON.parse(json);
+	}
+	/** The committed answer to exactly this linked-device revocation request. */
+	async readExactLinkedDeviceAnswerV1(identity) {
+		const json = await this.readExactAnswerJson(identity, "linked_device_revocation_v1");
+		return json === null ? null : parseLinkedDeviceRevokeResultV1(JSON.parse(json));
+	}
+	async readExactAnswerJson(identity, answerKind) {
+		const row = await this.database.prepare(`SELECT operation_fingerprint_digest_b64u, source_proof_digest_b64u, response_json,
+                answer_kind
+           FROM wallet_auth_method_revocation_replays
+          WHERE namespace = ?1
+            AND org_id = ?2
+            AND project_id = ?3
+            AND env_id = ?4
+            AND wallet_id = ?5
+            AND target_wallet_auth_method_id = ?6`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, String(identity.walletId), String(identity.targetWalletAuthMethodId)).first();
+		if (!row || row.answer_kind !== answerKind || row.operation_fingerprint_digest_b64u !== identity.operationFingerprintDigestB64u || row.source_proof_digest_b64u !== identity.sourceProofDigestB64u) return null;
+		return row.response_json;
+	}
+	/**
+	* The statements that record `response` as the answer to this request, for
+	* the batch that revokes the method. They abort the batch unless they
+	* insert it: a method whose revocation already committed commits nothing
+	* more.
+	*/
+	prepareRecordAnswerStatements(input) {
+		return [this.database.prepare(`INSERT OR IGNORE INTO wallet_auth_method_revocation_replays (
+             namespace, org_id, project_id, env_id, wallet_id,
+             target_wallet_auth_method_id, operation_fingerprint_digest_b64u,
+             source_wallet_auth_method_id, source_proof_digest_b64u,
+             response_json, committed_at_ms, answer_kind
+           ) VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11,
+                     'wallet_auth_method_revocation_v1')`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, String(input.identity.walletId), String(input.identity.targetWalletAuthMethodId), input.identity.operationFingerprintDigestB64u, String(input.sourceWalletAuthMethodId), input.identity.sourceProofDigestB64u, JSON.stringify(input.response), input.committedAtMs), this.database.prepare(D1_BATCH_CAS_GUARD_SQL)];
+	}
+	/**
+	* The statements that record a linked-device revocation's answer, for the
+	* end of the batch that revokes the device's method. The answer names the
+	* device's authority and its revocation epoch, which the batch itself sets,
+	* so the statement reads them from the row the batch wrote: the record is
+	* the answer that committed. They abort the batch unless they insert it.
+	*/
+	prepareRecordLinkedDeviceAnswerStatements(input) {
+		return [this.database.prepare(`INSERT OR IGNORE INTO wallet_auth_method_revocation_replays (
+             namespace, org_id, project_id, env_id, wallet_id,
+             target_wallet_auth_method_id, operation_fingerprint_digest_b64u,
+             source_wallet_auth_method_id, source_proof_digest_b64u,
+             response_json, committed_at_ms, answer_kind
+           )
+           SELECT ?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9,
+                  json_object(
+                    'kind', 'revoked',
+                    'walletAuthMethodId', ?6,
+                    'authorityId', authority.authority_id,
+                    'revocationEpoch', authority.revocation_epoch
+                  ),
+                  ?10, 'linked_device_revocation_v1'
+             FROM wallet_authorities AS authority
+            WHERE authority.namespace = ?1
+              AND authority.org_id = ?2
+              AND authority.project_id = ?3
+              AND authority.env_id = ?4
+              AND authority.wallet_id = ?5
+              AND authority.authority_id = ?11`).bind(this.scope.namespace, this.scope.orgId, this.scope.projectId, this.scope.envId, String(input.identity.walletId), String(input.identity.targetWalletAuthMethodId), input.identity.operationFingerprintDigestB64u, String(input.sourceWalletAuthMethodId), input.identity.sourceProofDigestB64u, input.committedAtMs, String(input.authorityId)), this.database.prepare(D1_BATCH_CAS_GUARD_SQL)];
+	}
+};
+//#endregion
+export { D1WalletAuthMethodRevocationReplayStoreV1, computeWalletAuthMethodRevocationProofDigestV1 };
+
+//# sourceMappingURL=d1WalletAuthMethodRevocationReplayStore.js.map