@seams/wallet-server 0.6.2 → 0.7.1

package/dist/esm/router/cloudflare/d1/authorization/d1AuthorizationStore.js

@@ -1,4 +1,4 @@
-import { mpcMaterialActivationRefsEqual, parseWalletAuthorityId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
 import { CAPABILITY_KINDS, parseAuthorizationAuditEventId, parseAuthorizationGrantRef, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parseCapabilityOperationRef, parseMpcWalletSigningQuotaId, parsePrincipalId, parseTenantId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { buildCapabilityOperationEnvelope, computeCapabilityOperationFingerprintDigest, parseCapabilityOperationFingerprintDigest } from "../../../../shared-ts/src/authorization/operationFingerprint.js";
@@ -7,47 +7,11 @@ import { buildActiveWalletSessionQuota, buildAuthorizedOperation, buildExactWall
 import { d1ChangedRows, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
 import { D1WalletStore } from "../../../../core/d1WalletStore.js";
 import { normalizeWalletAuthMethodV2 } from "../../../../core/d1WalletAuthMethodStore.js";
-import { D1WalletAuthorityStore, parseD1WalletAuthorityRow } from "../wallet/d1WalletAuthorityStore.js";
+import { prepareAuthorizedOperationAdmissionRead, prepareAuthorizedOperationCommittedRead, prepareAuthorizedOperationInsert, prepareAuthorizedOperationRead } from "./authorizedOperationStatements.js";
 import { prepareD1WalletSessionAuthorityProjectionStatements } from "./walletSessionAuthorityProjection.js";
+import { parseD1WalletAuthorityRow } from "../wallet/d1WalletAuthorityStore.js";
+import { parsePersistedWalletSessionAuthorizationV2 } from "./persistedWalletSessionAuthorization.js";
 //#region src/router/cloudflare/d1/authorization/d1AuthorizationStore.ts
-const ECDSA_SIGNER_MATCH = `
-  EXISTS (
-    SELECT 1
-      FROM wallet_signers AS signer
-     WHERE signer.namespace = ?
-       AND signer.org_id = ?
-       AND signer.project_id = ?
-       AND signer.env_id = ?
-       AND signer.wallet_id = ?
-       AND signer.signer_family = 'ecdsa'
-       AND json_extract(signer.record_json, '$.walletKey.publicCapability.material_activation.material_owner') = signer.wallet_id
-       AND json_extract(signer.record_json, '$.walletKey.keyHandle') = ?
-       AND json_extract(signer.record_json, '$.walletKey.publicCapability.material_activation.kind') = ?
-       AND json_extract(signer.record_json, '$.walletKey.publicCapability.material_activation.activation_id') = ?
-       AND json_extract(signer.record_json, '$.walletKey.publicCapability.material_activation.capability') = ?
-       AND json_extract(signer.record_json, '$.walletKey.publicCapability.material_activation.material_owner') = ?
-       AND json_extract(signer.record_json, '$.walletKey.publicCapability.material_activation.key_binding') = ?
-       AND json_extract(signer.record_json, '$.walletKey.publicCapability.material_activation.lifecycle_binding') = ?
-       AND json_extract(signer.record_json, '$.walletKey.publicCapability.material_activation.signing_worker') = ?
-  )`;
-function ecdsaSignerMatchBindings(walletSignerScope, material) {
-	const activation = material.materialActivation;
-	return [
-		walletSignerScope.namespace,
-		walletSignerScope.orgId,
-		walletSignerScope.projectId,
-		walletSignerScope.envId,
-		material.walletId,
-		material.keyHandle,
-		activation.kind,
-		activation.activation_id,
-		activation.capability,
-		activation.material_owner,
-		activation.key_binding,
-		activation.lifecycle_binding,
-		activation.signing_worker
-	];
-}
 const ACTIVE_V2_AUTHORITY_METHOD_EXISTS_SQL = `
   EXISTS (
     SELECT 1
@@ -118,11 +82,6 @@ var CloudflareD1AuthorizationStore = class {
 			projectId: requireOpaqueString(options.walletSignerScope.projectId, "walletSignerScope.projectId"),
 			envId: requireOpaqueString(options.walletSignerScope.envId, "walletSignerScope.envId")
 		};
-		this.walletAuthorityStore = new D1WalletAuthorityStore({
-			database: this.database,
-			scope: this.walletSignerScope,
-			ensureSchema: false
-		});
 		this.walletStore = new D1WalletStore({
 			database: this.database,
 			namespace: this.walletSignerScope.namespace,
@@ -618,7 +577,7 @@ var CloudflareD1AuthorizationStore = class {
 		const walletOrigin = parseSessionOrigin(row.wallet_origin);
 		if (walletOrigin !== input.requestOrigin) return null;
 		if (row.session_record_json === null || row.session_record_json === void 0 || row.session_operation_credential_hash === null || row.session_operation_credential_hash === void 0 || row.session_retired_at_ms !== null && row.session_retired_at_ms !== void 0 || row.credential_retired_at_ms !== null && row.credential_retired_at_ms !== void 0 || row.quota_lifecycle_kind !== "active" || integerColumn(row.quota_remaining_uses, "hosted credential quota remaining uses") <= 0 || integerColumn(row.expires_at_ms, "hosted credential expiry") <= input.nowMs || integerColumn(row.session_expires_at_ms, "hosted parent expiry") <= input.nowMs || integerColumn(row.session_expires_at_ms, "hosted parent expiry") < integerColumn(row.expires_at_ms, "hosted credential expiry") || integerColumn(row.quota_expires_at_ms, "hosted quota expiry") <= input.nowMs || integerColumn(row.quota_expires_at_ms, "hosted quota expiry") < integerColumn(row.expires_at_ms, "hosted credential expiry")) return null;
-		const expected = parseWalletSessionAuthorizationV2(parseD1JsonColumn(row.session_record_json));
+		const expected = parsePersistedWalletSessionAuthorizationV2(parseD1JsonColumn(row.session_record_json));
 		let authorization;
 		try {
 			authorization = await this.readWalletSessionAuthorizationV2ByAuthorizationId({
@@ -899,22 +858,6 @@ var CloudflareD1AuthorizationStore = class {
 			}
 		});
 	}
-	async existingWalletSessionAuthorizationV2QuotaMatches(quota) {
-		const row = await this.database.prepare(`SELECT
-           tenant_id,
-           principal_id,
-           wallet_session_id,
-           quota_id,
-           remaining_uses,
-           lifecycle_kind,
-           expires_at_ms
-         FROM authorization_wallet_session_quotas
-        WHERE namespace = ?
-          AND tenant_id = ?
-          AND quota_id = ?
-        LIMIT 1`).bind(this.namespace, quota.tenantId, String(quota.quotaId)).first();
-		return row !== null && row.tenant_id === String(quota.tenantId) && row.principal_id === String(quota.principalId) && row.wallet_session_id === String(quota.walletSessionId) && row.quota_id === String(quota.quotaId) && row.lifecycle_kind === "active" && integerColumn(row.remaining_uses, "V2 quota.remainingUses") === quota.remainingUses && integerColumn(row.expires_at_ms, "V2 quota.expiresAtMs") === quota.expiresAtMs;
-	}
 	async readWalletSessionAuthorizationV2ByMint(input) {
 		const row = await this.database.prepare(`SELECT
            record_json,
@@ -947,7 +890,7 @@ var CloudflareD1AuthorizationStore = class {
           AND mint_id = ?
         LIMIT 1`).bind(this.namespace, this.walletSignerScope.orgId, this.walletSignerScope.projectId, this.walletSignerScope.envId, input.tenantId, String(input.principalId), String(input.walletId), String(input.authorityId), String(input.walletAuthMethodId), String(input.mintId)).first();
 		if (!row) return null;
-		const session = parseWalletSessionAuthorizationV2(parseD1JsonColumn(row.record_json));
+		const session = parsePersistedWalletSessionAuthorizationV2(parseD1JsonColumn(row.record_json));
 		if (!walletSessionAuthorizationV2RowMatches({
 			session_tenant_id: row.tenant_id,
 			session_authorization_id: row.authorization_id,
@@ -1027,7 +970,7 @@ var CloudflareD1AuthorizationStore = class {
           LIMIT 1`).bind(this.namespace, this.walletSignerScope.orgId, this.walletSignerScope.projectId, this.walletSignerScope.envId, input.tenantId, input.walletId, input.walletSessionId, input.authorizationId).first();
 		if (!row) return null;
 		if (row.retired_at_ms !== null && row.retired_at_ms !== void 0) return null;
-		const session = parseWalletSessionAuthorizationV2(parseD1JsonColumn(row.record_json));
+		const session = parsePersistedWalletSessionAuthorizationV2(parseD1JsonColumn(row.record_json));
 		if (session.tenantId !== input.tenantId || session.walletId !== input.walletId || session.walletSessionId !== input.walletSessionId || session.authorizationId !== input.authorizationId) throw new Error("Stored V2 Wallet Session identity does not match the request");
 		const nowMs = requirePositiveInteger(input.nowMs, "V2 authorization read time");
 		return session.expiresAtMs > nowMs ? session : null;
@@ -1039,6 +982,31 @@ var CloudflareD1AuthorizationStore = class {
 			nowMs: input.nowMs
 		}, "operation_credential_hash");
 	}
+	/**
+	* The live session, its authority and its auth method from one joined read.
+	* A commit between separate reads could pair the session with an authority
+	* it was never bound to; one statement cannot.
+	*/
+	async readWalletSessionAdmissionSnapshotByOperationCredential(input) {
+		const row = await this.readJoinedWalletSessionAuthorizationV2Row({
+			lookupColumn: "operation_credential_hash",
+			tenantId: input.tenantId,
+			lookupValue: input.tokenHash
+		});
+		if (!row) return null;
+		const session = parseLiveWalletSessionAuthorizationV2Row(row, {
+			operationCredentialHash: input.tokenHash,
+			tenantId: input.tenantId,
+			nowMs: input.nowMs
+		});
+		return {
+			authorization: {
+				session,
+				quota: parseWalletSessionAuthorizationV2QuotaRow(row, session)
+			},
+			...await joinedAuthorityAndMethod(row)
+		};
+	}
 	async readWalletSessionExactOperationContextByCredential(input) {
 		const row = await this.readJoinedWalletSessionAuthorizationV2Row({
 			lookupColumn: "operation_credential_hash",
@@ -1059,7 +1027,13 @@ var CloudflareD1AuthorizationStore = class {
 			session,
 			authority,
 			authMethod,
-			retiredAtMs: null
+			retiredAtMs: null,
+			ownerWalletScope: {
+				orgId: requireString(row.session_org_id, "session.ownerWalletScope.orgId"),
+				projectId: requireString(row.session_project_id, "session.ownerWalletScope.projectId"),
+				projectEnvironmentId: requireString(row.session_env_id, "session.ownerWalletScope.projectEnvironmentId"),
+				walletId: session.walletId
+			}
 		};
 	}
 	/**
@@ -1070,85 +1044,92 @@ var CloudflareD1AuthorizationStore = class {
 	* their record, and broken foreign-key identity still throw.
 	*/
 	async readExactWalletSessionStatusByOperationCredential(input) {
+		return (await this.readExactWalletSessionStatusSnapshotByOperationCredential(input)).status;
+	}
+	/**
+	* The exact status with the authority and auth method it was judged
+	* against, all from the one joined read.
+	*/
+	async readExactWalletSessionStatusSnapshotByOperationCredential(input) {
+		const unjudged = (status) => ({
+			status,
+			authority: null,
+			authMethod: null
+		});
 		const nowMs = requirePositiveInteger(input.nowMs, "exact Wallet Session status time");
 		const row = await this.readJoinedWalletSessionAuthorizationV2Row({
 			lookupColumn: "operation_credential_hash",
 			tenantId: input.tenantId,
 			lookupValue: input.tokenHash
 		});
-		if (!row) return { kind: "missing" };
-		const session = parseWalletSessionAuthorizationV2(parseD1JsonColumn(row.session_record_json));
+		if (!row) return unjudged({ kind: "missing" });
+		const session = parsePersistedWalletSessionAuthorizationV2(parseD1JsonColumn(row.session_record_json));
 		if (!walletSessionAuthorizationV2RowMatches(row, session)) throw new Error("Stored V2 Wallet Session authorization columns disagree with record");
 		if (!walletSessionAuthorizationV2RecordsEqual(parseWalletSessionAuthorizationV2WithSubjects(row, parseD1JsonColumn(row.session_capability_subjects_json)), session)) throw new Error("Stored V2 Wallet Session capability subjects disagree with record");
 		if (session.tenantId !== input.tenantId) throw new Error("Stored V2 Wallet Session tenant does not match the request");
 		const quota = parseExactWalletSessionQuotaProjectionRow(row, session);
-		if (session.expiresAtMs <= nowMs) return {
+		if (session.expiresAtMs <= nowMs) return unjudged({
 			kind: "expired",
 			session,
 			quota
-		};
-		if (row.session_retired_at_ms !== null && row.session_retired_at_ms !== void 0) return {
+		});
+		if (row.session_retired_at_ms !== null && row.session_retired_at_ms !== void 0) return unjudged({
 			kind: "retired",
 			session,
 			quota,
 			retiredAtMs: requirePositiveInteger(row.session_retired_at_ms, "V2 session.retiredAtMs")
-		};
-		if (quota.lifecycle === "exhausted") return {
+		});
+		const joined = await joinedAuthorityAndMethod(row);
+		const judged = (status) => ({
+			status,
+			...joined
+		});
+		if (quota.lifecycle === "exhausted") return judged({
 			kind: "exhausted",
 			session,
 			quota
-		};
-		if (row.authority_id === null || row.authority_id === void 0) return {
-			kind: "authority_unavailable",
-			session,
-			quota
-		};
-		const authority = await this.readExactStatusAuthority(row);
-		if (!authority) return {
+		});
+		const authority = joined.authority;
+		if (!authority) return judged({
 			kind: "authority_unavailable",
 			session,
 			quota
-		};
+		});
 		if (authority.authorityId !== session.authorityId || authority.walletId !== session.walletId || authority.state !== row.authority_lifecycle_state || authority.authorityDigestB64u !== row.authority_digest_b64u || authority.revocationEpoch !== integerColumn(row.authority_revocation_epoch, "authority.revocationEpoch")) throw new Error("Stored V2 Wallet Session authority identity does not match the record");
-		if (authority.authorityId !== session.authorityId || authority.walletId !== session.walletId || authority.authorityDigestB64u !== session.authorityDigestB64u || authority.revocationEpoch !== session.authorityRevocationEpoch || authority.state !== "active") return {
+		if (authority.authorityId !== session.authorityId || authority.walletId !== session.walletId || authority.authorityDigestB64u !== session.authorityDigestB64u || authority.revocationEpoch !== session.authorityRevocationEpoch || authority.state !== "active") return judged({
 			kind: "authority_unavailable",
 			session,
 			quota
-		};
-		if (row.auth_method_id === null || row.auth_method_id === void 0) return {
+		});
+		if (row.auth_method_id === null || row.auth_method_id === void 0) return judged({
 			kind: "method_unavailable",
 			session,
 			quota
-		};
+		});
 		if (row.auth_method_id !== String(session.walletAuthMethodId) || row.auth_method_wallet_id !== String(session.walletId) || row.auth_method_authority_id !== String(session.authorityId)) throw new Error("Stored V2 Wallet Session auth method identity does not match the record");
-		if (row.auth_method_status !== "active") return {
+		if (row.auth_method_status !== "active") return judged({
 			kind: "method_unavailable",
 			session,
 			quota
-		};
+		});
 		if (!exactWalletSessionCapabilitySubjectsResolveAuthority({
 			session,
 			signerActivations: authority.signerActivations
-		})) return {
+		})) return judged({
 			kind: "capability_unavailable",
 			session,
 			quota
-		};
-		if (!await this.exactWalletSessionCapabilitySubjectsResolveMaterial(session)) return {
+		});
+		if (!await this.exactWalletSessionCapabilitySubjectsResolveMaterial(session)) return judged({
 			kind: "capability_unavailable",
 			session,
 			quota
-		};
-		return {
+		});
+		return judged({
 			kind: "active",
 			session,
 			quota
-		};
-	}
-	async readExactStatusAuthority(row) {
-		const authorityId = parseWalletAuthorityId(row.authority_id);
-		if (!authorityId.ok) throw new Error("Stored V2 Wallet Session authority identity is invalid");
-		return await this.walletAuthorityStore.readById(authorityId.value);
+		});
 	}
 	async exactWalletSessionCapabilitySubjectsResolveMaterial(session) {
 		const materials = [];
@@ -1206,6 +1187,9 @@ var CloudflareD1AuthorizationStore = class {
            session.quota_id AS session_quota_id,
            session.principal_id AS session_principal_id,
            session.wallet_id AS session_wallet_id,
+           session.org_id AS session_org_id,
+           session.project_id AS session_project_id,
+           session.env_id AS session_env_id,
            session.authority_id AS session_authority_id,
            session.wallet_auth_method_id AS session_wallet_auth_method_id,
            session.authority_digest_b64u AS session_authority_digest_b64u,
@@ -1274,7 +1258,8 @@ var CloudflareD1AuthorizationStore = class {
 		};
 	}
 	async readAuthorizedOperation(input) {
-		return (await this.readAuthorizedOperationRecord(input))?.operation ?? null;
+		const row = await prepareAuthorizedOperationRead(this.database, this.namespace, input).first();
+		return row ? await parseAuthorizedOperationRow(row) : null;
 	}
 	async readAuthorizedOperationById(input) {
 		const row = await this.database.prepare(`SELECT * FROM authorized_operations
@@ -1282,223 +1267,181 @@ var CloudflareD1AuthorizationStore = class {
           LIMIT 1`).bind(this.namespace, input.tenantId, input.authorizedOperationId).first();
 		return row ? await parseAuthorizedOperationRow(row) : null;
 	}
-	async readAuthorizedOperationRecord(input) {
-		const row = await this.database.prepare(`SELECT * FROM authorized_operations
-          WHERE namespace = ? AND tenant_id = ? AND operation_fingerprint_digest = ?
-          LIMIT 1`).bind(this.namespace, input.tenantId, input.operationFingerprintDigest).first();
-		return row ? {
+	async readPinnedOwnerWalletScope(input) {
+		const { operation, walletId } = input;
+		if (operation.operation.operation.capabilityKind !== CAPABILITY_KINDS.nearEd25519MpcSigning && operation.operation.operation.capabilityKind !== CAPABILITY_KINDS.evmEcdsaMpcSigning) throw new Error("Pinned owner wallet scope requires a signing operation");
+		const row = await prepareAuthorizedOperationCommittedRead(this.database, this.namespace, operation).first();
+		if (!row || row.authorized_operation_id !== operation.authorizedOperationId || row.authorization_source_kind !== operation.authorization.kind) throw new Error("Pinned owner operation is not claimed");
+		if (operation.authorization.kind === "verified_step_up") {
+			if (row.evidence_set_digest !== operation.authorization.evidenceSetDigest) throw new Error("Verified step-up operation is not claimed");
+			return {
+				orgId: this.walletSignerScope.orgId,
+				projectId: this.walletSignerScope.projectId,
+				projectEnvironmentId: this.walletSignerScope.envId
+			};
+		}
+		if (row.authorization_id !== operation.authorization.authorizationGrantRef.authorizationId) throw new Error("Pinned owner Wallet Session scope is unavailable");
+		return this.pinnedWalletSessionOwnerScope(row, walletId);
+	}
+	pinnedWalletSessionOwnerScope(row, walletId) {
+		if (row.pinned_owner_wallet_id !== walletId) throw new Error("Pinned owner Wallet Session scope is unavailable");
+		return {
+			orgId: requireString(row.linked_scope_org_id, "operation.ownerScope.orgId"),
+			projectId: requireString(row.linked_scope_project_id, "operation.ownerScope.projectId"),
+			projectEnvironmentId: requireString(row.linked_scope_env_id, "operation.ownerScope.projectEnvironmentId")
+		};
+	}
+	async readAuthorizedOperationForAdmission(input) {
+		const row = await prepareAuthorizedOperationAdmissionRead({
+			database: this.database,
+			namespace: this.namespace,
+			walletSignerScope: this.walletSignerScope,
+			tenantId: input.tenantId,
+			operationFingerprintDigest: input.operationFingerprintDigest,
+			nowMs: requirePositiveInteger(input.nowMs, "operation replay time")
+		}).first();
+		if (!row) return null;
+		if (row.authorization_source_active !== 0 && row.authorization_source_active !== 1) throw new Error("Authorized operation source status must be a SQL boolean");
+		return {
 			row,
-			operation: await parseAuthorizedOperationRow(row)
-		} : null;
+			operation: await parseAuthorizedOperationRow(row),
+			sourceActive: row.authorization_source_active === 1
+		};
 	}
-	async admitAuthorizedOperation(input) {
+	/** How an operation already admitted for this fingerprint answers another admission. */
+	answerExistingAuthorizedOperation(existing, operation, material) {
+		const replayMismatch = authorizedOperationReplayMismatch({
+			existing: existing.row,
+			incoming: operation,
+			material,
+			scope: this.walletSignerScope
+		});
+		if (replayMismatch) return replayMismatch;
+		if (existing.operation.lifecycle === "completed") {
+			if (existing.operation.authorization.kind === "authorization_grant" && !existing.sourceActive) return { kind: "authorization_grant_rejected" };
+			return {
+				kind: "replayed",
+				operation: existing.operation,
+				row: existing.row
+			};
+		}
+		if (!existing.sourceActive) return authorizationSourceRejected(operation.authorization);
+		return {
+			kind: "operation_in_progress",
+			operation: existing.operation,
+			row: existing.row
+		};
+	}
+	/**
+	* The admission `admitAuthorizedOperation` would make, prepared for a batch
+	* another store owns, after the same reads. It admits no ECDSA material:
+	* that admission is conditional on the signer row, not a plain insert.
+	*/
+	async prepareAuthorizedOperationAdmission(input) {
 		const operation = await buildAuthorizedOperation(input.operation);
-		if (operation.operation.operation.capabilityKind === CAPABILITY_KINDS.evmEcdsaMpcSigning && !input.material) return { kind: "material_mismatch" };
-		if (input.material && input.material.kind === "ecdsa_material_activation" && (operation.operation.operation.capabilityKind !== CAPABILITY_KINDS.evmEcdsaMpcSigning || input.material.runtimePolicyScope.orgId !== operation.tenantId || input.material.materialActivation.capability !== operation.operation.capabilityId || input.material.materialActivation.material_owner !== input.material.walletId)) return { kind: "material_mismatch" };
-		const existing = await this.readAuthorizedOperationRecord({
+		if (operation.operation.operation.capabilityKind === CAPABILITY_KINDS.evmEcdsaMpcSigning) return { kind: "material_mismatch" };
+		const existing = await this.readAuthorizedOperationForAdmission({
 			tenantId: operation.tenantId,
-			operationFingerprintDigest: operation.operationFingerprintDigest
+			operationFingerprintDigest: operation.operationFingerprintDigest,
+			nowMs: operation.claimedAtMs
 		});
 		if (existing) {
-			const replayMismatch = authorizedOperationReplayMismatch({
-				existing: existing.row,
-				incoming: operation,
-				material: input.material,
-				scope: this.walletSignerScope
-			});
-			if (replayMismatch) return replayMismatch;
-			if (existing.operation.lifecycle === "completed") {
-				if (existing.operation.authorization.kind === "authorization_grant" && !await this.isAuthorizedOperationSourceActive(existing.row, operation.claimedAtMs)) return { kind: "authorization_grant_rejected" };
-				return {
-					kind: "replayed",
-					operation: existing.operation
-				};
-			}
-			if (!await this.isAuthorizedOperationSourceActive(existing.row, operation.claimedAtMs)) return authorizationSourceRejected(operation.authorization);
-			return {
-				kind: "operation_in_progress",
-				operation: existing.operation
+			const result = this.answerExistingAuthorizedOperation(existing, operation, void 0);
+			if (result.kind === "replayed" || result.kind === "operation_in_progress") return {
+				kind: result.kind,
+				operation: result.operation
+			};
+			return result;
+		}
+		return {
+			kind: "prepared",
+			statements: [prepareAuthorizedOperationInsert({
+				database: this.database,
+				namespace: this.namespace,
+				walletSignerScope: this.walletSignerScope,
+				operation,
+				material: null
+			})]
+		};
+	}
+	classifyAuthorizedOperationAdmissionFailure(error) {
+		return classifyAuthorizedOperationAdmissionError(error);
+	}
+	async admitAuthorizedOperation(input) {
+		const result = await this.admitAuthorizedOperationRecord(input);
+		if (result.kind === "claimed" || result.kind === "replayed" || result.kind === "operation_in_progress") return {
+			kind: result.kind,
+			operation: result.operation
+		};
+		return result;
+	}
+	async admitEcdsaWalletSessionOperation(input) {
+		const result = await this.admitAuthorizedOperationRecord({
+			operation: input.operation,
+			material: input.material
+		});
+		switch (result.kind) {
+			case "claimed":
+			case "operation_in_progress": return {
+				kind: result.kind,
+				operation: result.operation,
+				ownerScope: this.pinnedWalletSessionOwnerScope(result.row, input.material.walletId)
 			};
+			case "replayed": return {
+				kind: "replayed",
+				operation: result.operation
+			};
+			case "authorization_grant_rejected":
+			case "verified_step_up_rejected":
+			case "wallet_session_quota_exhausted":
+			case "material_mismatch": return result;
+			default: {
+				const unexpected = result;
+				throw new Error(`Unexpected ECDSA admission: ${unexpected}`);
+			}
 		}
-		const source = operation.authorization;
-		const quota = operation.quota;
-		const materialActivationId = input.material?.materialActivation.activation_id ?? null;
+	}
+	async admitAuthorizedOperationRecord(input) {
+		const operation = await buildAuthorizedOperation(input.operation);
+		if (operation.operation.operation.capabilityKind === CAPABILITY_KINDS.evmEcdsaMpcSigning && !input.material) return { kind: "material_mismatch" };
+		if (input.material && input.material.kind === "ecdsa_material_activation" && (operation.operation.operation.capabilityKind !== CAPABILITY_KINDS.evmEcdsaMpcSigning || input.material.runtimePolicyScope.orgId !== operation.tenantId || input.material.materialActivation.capability !== operation.operation.capabilityId || input.material.materialActivation.material_owner !== input.material.walletId)) return { kind: "material_mismatch" };
+		const existing = await this.readAuthorizedOperationForAdmission({
+			tenantId: operation.tenantId,
+			operationFingerprintDigest: operation.operationFingerprintDigest,
+			nowMs: operation.claimedAtMs
+		});
+		if (existing) return this.answerExistingAuthorizedOperation(existing, operation, input.material);
+		let committedRow;
 		try {
-			const values = [
-				this.namespace,
-				operation.tenantId,
-				operation.authorizedOperationId,
-				operation.auditEventId,
-				operation.operation.principalId,
-				operation.operation.capabilityId,
-				operation.operation.operation.capabilityKind,
-				operation.operation.operation.operationKind,
-				operation.operation.operationId,
-				operation.operationFingerprintDigest,
-				operation.operation.digests.laneDigest,
-				operation.operation.digests.intentDigest,
-				operation.operation.digests.displayDigest,
-				source.kind,
-				source.kind === "authorization_grant" ? source.authorizationGrantRef.authorizationId : null,
-				source.kind === "verified_step_up" ? source.evidenceSetDigest : null,
-				quota.kind === "consume_reusable_wallet_session" ? quota.quotaId : null,
-				quota.kind,
-				source.kind === "authorization_grant" ? source.authorizationGrantRef.kind : null,
-				requirePositiveInteger(input.operation.claimedAtMs, "operation.claimedAtMs"),
-				materialActivationId,
-				input.material?.materialActivation.capability ?? null,
-				input.material?.materialActivation.material_owner ?? null,
-				input.material?.materialActivation.key_binding ?? null,
-				input.material?.materialActivation.lifecycle_binding ?? null,
-				input.material?.materialActivation.signing_worker ?? null,
-				null,
-				null,
-				null,
-				null,
-				null,
-				null,
-				null,
-				source.kind === "authorization_grant" ? this.walletSignerScope.orgId : null,
-				source.kind === "authorization_grant" ? this.walletSignerScope.projectId : null,
-				source.kind === "authorization_grant" ? this.walletSignerScope.envId : null
-			];
-			const result = await (input.material?.kind === "ecdsa_material_activation" ? this.database.prepare(`INSERT INTO authorized_operations (
-                namespace, tenant_id, authorized_operation_id, audit_event_id,
-                principal_id, capability_id, capability_kind, operation_kind, operation_id,
-                operation_fingerprint_digest, lane_digest, intent_digest, display_digest,
-                authorization_source_kind, authorization_id, evidence_set_digest,
-                quota_id, quota_kind, authorization_grant_kind, lifecycle_kind, result_kind,
-                result_digest, result_status, result_content_type, result_body_text,
-                claimed_at_ms, completed_at_ms,
-                material_activation_id, material_activation_capability,
-                material_activation_owner, material_activation_key_binding,
-                material_activation_lifecycle_binding, material_activation_signing_worker,
-                linked_wallet_id, linked_enrollment_id, linked_device_id,
-                linked_wallet_key_id, linked_lane_id, linked_lane_share_epoch,
-                linked_revocation_epoch, linked_scope_org_id, linked_scope_project_id,
-                linked_scope_env_id
-              ) SELECT ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?,
-                        'claimed', 'pending', NULL, NULL, NULL, NULL, ?, NULL, ?,
-                        ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?
-                 WHERE ${ECDSA_SIGNER_MATCH}`).bind(...values, ...ecdsaSignerMatchBindings(this.walletSignerScope, input.material)) : this.database.prepare(`INSERT INTO authorized_operations (
-                namespace, tenant_id, authorized_operation_id, audit_event_id,
-                principal_id, capability_id, capability_kind, operation_kind, operation_id,
-                operation_fingerprint_digest, lane_digest, intent_digest, display_digest,
-                authorization_source_kind, authorization_id, evidence_set_digest,
-                quota_id, quota_kind, authorization_grant_kind, lifecycle_kind, result_kind,
-                result_digest, result_status, result_content_type, result_body_text,
-                claimed_at_ms, completed_at_ms,
-                material_activation_id, material_activation_capability,
-                material_activation_owner, material_activation_key_binding,
-                material_activation_lifecycle_binding, material_activation_signing_worker,
-                linked_wallet_id, linked_enrollment_id, linked_device_id,
-                linked_wallet_key_id, linked_lane_id, linked_lane_share_epoch,
-                linked_revocation_epoch, linked_scope_org_id, linked_scope_project_id,
-                linked_scope_env_id
-              ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?,
-                        'claimed', 'pending', NULL, NULL, NULL, NULL, ?, NULL, ?,
-                        ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).bind(...values)).run();
+			const statement = prepareAuthorizedOperationInsert({
+				database: this.database,
+				namespace: this.namespace,
+				walletSignerScope: this.walletSignerScope,
+				operation,
+				material: input.material ?? null
+			});
+			const [result, readback] = await this.database.batch([statement, prepareAuthorizedOperationCommittedRead(this.database, this.namespace, operation)]);
+			if (!result?.success || !readback?.success) throw new Error("authorized operation admission batch returned incomplete results");
 			if (input.material && d1ChangedRows(result) === 0) return { kind: "material_mismatch" };
+			committedRow = readback.results?.[0] ?? null;
 		} catch (error) {
-			const raced = await this.readAuthorizedOperationRecord({
+			const raced = await this.readAuthorizedOperationForAdmission({
 				tenantId: operation.tenantId,
-				operationFingerprintDigest: operation.operationFingerprintDigest
+				operationFingerprintDigest: operation.operationFingerprintDigest,
+				nowMs: operation.claimedAtMs
 			});
-			if (raced) {
-				const replayMismatch = authorizedOperationReplayMismatch({
-					existing: raced.row,
-					incoming: operation,
-					material: input.material,
-					scope: this.walletSignerScope
-				});
-				if (replayMismatch) return replayMismatch;
-				if (raced.operation.lifecycle === "completed") {
-					if (raced.operation.authorization.kind === "authorization_grant" && !await this.isAuthorizedOperationSourceActive(raced.row, operation.claimedAtMs)) return { kind: "authorization_grant_rejected" };
-					return {
-						kind: "replayed",
-						operation: raced.operation
-					};
-				}
-				if (!await this.isAuthorizedOperationSourceActive(raced.row, operation.claimedAtMs)) return authorizationSourceRejected(operation.authorization);
-				return {
-					kind: "operation_in_progress",
-					operation: raced.operation
-				};
-			}
+			if (raced) return this.answerExistingAuthorizedOperation(raced, operation, input.material);
 			const triggerFailure = classifyAuthorizedOperationAdmissionError(error);
 			if (triggerFailure) return triggerFailure;
 			throw error;
 		}
-		const committed = await this.readAuthorizedOperationRecord({
-			tenantId: operation.tenantId,
-			operationFingerprintDigest: operation.operationFingerprintDigest
-		});
-		if (!committed) throw new Error("authorized operation admission could not be read back");
+		if (!committedRow) throw new Error("authorized operation admission could not be read back");
 		return {
 			kind: "claimed",
-			operation: committed.operation
+			operation: await parseAuthorizedOperationRow(committedRow),
+			row: committedRow
 		};
 	}
-	async isAuthorizedOperationSourceActive(row, nowMs) {
-		const sourceKind = requireString(row.authorization_source_kind, "operation.authorization.kind");
-		if (sourceKind === "authorization_grant") {
-			const scope = [
-				row.linked_scope_org_id,
-				row.linked_scope_project_id,
-				row.linked_scope_env_id
-			];
-			if (scope.some((value) => typeof value !== "string" || value.length === 0)) return false;
-			if (scope[0] !== this.walletSignerScope.orgId || scope[1] !== this.walletSignerScope.projectId || scope[2] !== this.walletSignerScope.envId) return false;
-			return await this.database.prepare(`SELECT 1 AS active
-             FROM wallet_session_authorizations_v2 AS session
-             JOIN wallet_authorities AS authority
-               ON authority.namespace = session.namespace
-              AND authority.org_id = session.org_id
-              AND authority.project_id = session.project_id
-              AND authority.env_id = session.env_id
-              AND authority.authority_id = session.authority_id
-              AND authority.wallet_id = session.wallet_id
-             JOIN wallet_auth_methods AS auth_method
-               ON auth_method.namespace = session.namespace
-              AND auth_method.org_id = session.org_id
-              AND auth_method.project_id = session.project_id
-              AND auth_method.env_id = session.env_id
-              AND auth_method.wallet_auth_method_id = session.wallet_auth_method_id
-              AND auth_method.wallet_id = session.wallet_id
-              AND auth_method.wallet_authority_id = session.authority_id
-            WHERE session.namespace = ?
-              AND session.org_id = ?
-              AND session.project_id = ?
-              AND session.env_id = ?
-              AND session.tenant_id = ?
-              AND session.authorization_id = ?
-              AND session.principal_id = ?
-              AND (? = 'quota_neutral' OR session.quota_id = ?)
-              AND session.retired_at_ms IS NULL
-              AND session.expires_at_ms > ?
-              AND authority.lifecycle_state = 'active'
-              AND authority.authority_digest_b64u = session.authority_digest_b64u
-              AND authority.revocation_epoch = session.authority_revocation_epoch
-              AND auth_method.status = 'active'
-            LIMIT 1`).bind(this.namespace, ...scope, requireString(row.tenant_id, "operation.tenantId"), requireString(row.authorization_id, "operation.authorizationId"), requireString(row.principal_id, "operation.principalId"), requireString(row.quota_kind, "operation.quota.kind"), row.quota_id, requirePositiveInteger(nowMs, "operation replay time")).first() !== null;
-		}
-		if (sourceKind !== "verified_step_up") return false;
-		const capabilityKind = requireString(row.capability_kind, "operation.capabilityKind");
-		return await this.database.prepare(`SELECT 1 AS active
-           FROM verified_wallet_operation_evidence_sets AS evidence
-          WHERE evidence.namespace = ?
-            AND evidence.tenant_id = ?
-            AND evidence.evidence_set_digest = ?
-            AND evidence.principal_id = ?
-            AND evidence.capability_kind = ?
-            AND evidence.operation_kind = ?
-            AND evidence.lane_digest = ?
-            AND evidence.intent_digest = ?
-            AND evidence.display_digest = ?
-            AND evidence.assurance = 'step_up'
-            AND evidence.expires_at_ms > ?
-          LIMIT 1`).bind(this.namespace, requireString(row.tenant_id, "operation.tenantId"), requireString(row.evidence_set_digest, "operation.evidenceSetDigest"), requireString(row.principal_id, "operation.principalId"), capabilityKind, requireString(row.operation_kind, "operation.operationKind"), requireString(row.lane_digest, "operation.laneDigest"), requireString(row.intent_digest, "operation.intentDigest"), requireString(row.display_digest, "operation.displayDigest"), requirePositiveInteger(nowMs, "operation replay time")).first() !== null;
-	}
 	async completeAuthorizedOperation(input) {
 		const operation = input.operation;
 		const response = parseAuthorizedOperationReplayResponse(input.response);
@@ -1797,9 +1740,16 @@ function parseWalletSessionAuthorizationV2WithSubjects(row, capabilitySubjects)
 		expiresAtMs: row.session_expires_at_ms
 	});
 }
+/** The authority and auth method a joined session row carries, as read with it. */
+async function joinedAuthorityAndMethod(row) {
+	return {
+		authority: row.authority_id === null || row.authority_id === void 0 ? null : await parseD1WalletAuthorityRow(row),
+		authMethod: row.auth_method_record_json === null || row.auth_method_record_json === void 0 ? null : normalizeWalletAuthMethodV2(parseD1JsonColumn(row.auth_method_record_json))
+	};
+}
 function parseLiveWalletSessionAuthorizationV2Row(row, input) {
 	if (row.session_retired_at_ms !== null && row.session_retired_at_ms !== void 0) throw new Error("Stored V2 Wallet Session authorization is retired");
-	const session = parseWalletSessionAuthorizationV2(parseD1JsonColumn(row.session_record_json));
+	const session = parsePersistedWalletSessionAuthorizationV2(parseD1JsonColumn(row.session_record_json));
 	if (!walletSessionAuthorizationV2RowMatches(row, session)) throw new Error("Stored V2 Wallet Session authorization columns disagree with record");
 	if (!walletSessionAuthorizationV2RecordsEqual(parseWalletSessionAuthorizationV2WithSubjects(row, parseD1JsonColumn(row.session_capability_subjects_json)), session)) throw new Error("Stored V2 Wallet Session capability subjects disagree with record");
 	if (row.authority_id !== String(session.authorityId) || row.authority_wallet_id !== String(session.walletId) || row.authority_lifecycle_state !== "active" || row.authority_digest_b64u !== String(session.authorityDigestB64u) || integerColumn(row.authority_revocation_epoch, "authority.revocationEpoch") !== session.authorityRevocationEpoch || row.auth_method_id !== String(session.walletAuthMethodId) || row.auth_method_wallet_id !== String(session.walletId) || row.auth_method_authority_id !== String(session.authorityId) || row.auth_method_status !== "active") throw new Error("Stored V2 Wallet Session authority provenance is no longer active");