@seams/wallet-server 0.6.2 → 0.7.3

package/dist/esm/localIntendedLinkExecuteFault.js

@@ -0,0 +1,140 @@
+//#region src/localIntendedLinkExecuteFault.ts
+const LOCAL_INTENDED_LINK_EXECUTE_FAULT_HEADER_V1 = "x-seams-intended-link-execute-fault-v1";
+const LOCAL_INTENDED_LINK_EXECUTE_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-link-execute-fault-token-v1";
+const LOCAL_INTENDED_LINK_EXECUTE_FAULT_PROOF_HEADER_V1 = "x-seams-intended-link-execute-fault-proof-v1";
+const ROUTER_AB_YAO_REPLAY_HEADER_V1 = "x-seams-yao-replay";
+const ROUTER_AB_SOURCE_PRESERVING_EXECUTE_PATH_V1 = "/router-ab/router/ed25519-yao/execute-source-preserving";
+const LOCAL_INTENDED_LINK_EXECUTE_FAULT_TOKEN_PATTERN_V1 = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+function equalBytes(left, right) {
+	if (left.length !== right.length) return false;
+	for (let index = 0; index < left.length; index += 1) if (left[index] !== right[index]) return false;
+	return true;
+}
+function parseLocalIntendedLinkExecuteFaultModeV1(value) {
+	return value === "drop_router_response_once" ? value : null;
+}
+function parseLocalIntendedLinkExecuteFaultTokenV1(value) {
+	if (!value || !LOCAL_INTENDED_LINK_EXECUTE_FAULT_TOKEN_PATTERN_V1.test(value)) return null;
+	return { value };
+}
+var LocalIntendedLinkExecuteFaultControllerV1 = class {
+	constructor(baseFetch) {
+		this.baseFetch = baseFetch;
+		this.state = { kind: "armed" };
+	}
+	async fetch(input, init) {
+		const request = new Request(input, init);
+		const url = new URL(request.url);
+		if (request.method !== "POST" || url.pathname !== ROUTER_AB_SOURCE_PRESERVING_EXECUTE_PATH_V1) return await this.baseFetch.call(globalThis, request);
+		switch (this.state.kind) {
+			case "armed": return await this.handleFirstExecute(request);
+			case "awaiting_replay": return await this.handleReplay(request, this.state);
+			case "proved":
+			case "violated":
+				this.state = {
+					kind: "violated",
+					violation: "unexpected_additional_execute"
+				};
+				throw new Error("Local intended linking fault observed an additional Router execute");
+		}
+	}
+	outcome() {
+		switch (this.state.kind) {
+			case "proved":
+			case "violated": return this.state;
+			case "armed": return {
+				kind: "violated",
+				violation: "router_execute_not_observed"
+			};
+			case "awaiting_replay": return {
+				kind: "violated",
+				violation: "router_retry_not_observed"
+			};
+		}
+	}
+	async handleFirstExecute(request) {
+		if (request.headers.has(ROUTER_AB_YAO_REPLAY_HEADER_V1)) {
+			this.state = {
+				kind: "violated",
+				violation: "router_first_marked_as_replay"
+			};
+			throw new Error("Local intended linking fault saw a first execute marked as a replay");
+		}
+		const body = new Uint8Array(await request.clone().arrayBuffer());
+		const response = await this.baseFetch.call(globalThis, request);
+		const answer = new Uint8Array(await response.arrayBuffer());
+		if (!response.ok) {
+			this.state = {
+				kind: "violated",
+				violation: "router_first_response_failed"
+			};
+			return new Response(answer, {
+				status: response.status,
+				statusText: response.statusText,
+				headers: response.headers
+			});
+		}
+		this.state = {
+			kind: "awaiting_replay",
+			body,
+			answer
+		};
+		throw new Error("Local intended linking fault dropped the completed Router response");
+	}
+	async handleReplay(request, expected) {
+		const body = new Uint8Array(await request.clone().arrayBuffer());
+		if (!equalBytes(expected.body, body)) {
+			this.state = {
+				kind: "violated",
+				violation: "router_retry_body_changed"
+			};
+			throw new Error("Local intended linking retry changed the Router request body");
+		}
+		if (request.headers.get(ROUTER_AB_YAO_REPLAY_HEADER_V1) !== "1") {
+			this.state = {
+				kind: "violated",
+				violation: "router_retry_not_marked_as_replay"
+			};
+			throw new Error("Local intended linking retry was not marked as the Router replay");
+		}
+		const response = await this.baseFetch.call(globalThis, request);
+		const answer = new Uint8Array(await response.arrayBuffer());
+		if (!response.ok) this.state = {
+			kind: "violated",
+			violation: "router_retry_response_failed"
+		};
+		else if (!equalBytes(expected.answer, answer)) this.state = {
+			kind: "violated",
+			violation: "router_retry_answer_changed"
+		};
+		else this.state = {
+			kind: "proved",
+			proof: "replay_answered_same_reservation"
+		};
+		return new Response(answer, {
+			status: response.status,
+			statusText: response.statusText,
+			headers: response.headers
+		});
+	}
+};
+function requestWithoutLocalIntendedLinkExecuteFaultHeadersV1(request) {
+	const headers = new Headers(request.headers);
+	headers.delete(LOCAL_INTENDED_LINK_EXECUTE_FAULT_HEADER_V1);
+	headers.delete(LOCAL_INTENDED_LINK_EXECUTE_FAULT_TOKEN_HEADER_V1);
+	return new Request(request, { headers });
+}
+function responseWithLocalIntendedLinkExecuteFaultOutcomeV1(response, outcome, token) {
+	const headers = new Headers(response.headers);
+	const proof = outcome.kind === "proved" ? outcome.proof : `violation:${outcome.violation}`;
+	headers.set(LOCAL_INTENDED_LINK_EXECUTE_FAULT_PROOF_HEADER_V1, `${token.value}:${proof}`);
+	return new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers
+	});
+}
+//#endregion
+export { LOCAL_INTENDED_LINK_EXECUTE_FAULT_HEADER_V1, LOCAL_INTENDED_LINK_EXECUTE_FAULT_TOKEN_HEADER_V1, LocalIntendedLinkExecuteFaultControllerV1, parseLocalIntendedLinkExecuteFaultModeV1, parseLocalIntendedLinkExecuteFaultTokenV1, requestWithoutLocalIntendedLinkExecuteFaultHeadersV1, responseWithLocalIntendedLinkExecuteFaultOutcomeV1 };
+
+//# sourceMappingURL=localIntendedLinkExecuteFault.js.map

package/dist/esm/localIntendedMaterialAdmissionFault.js

@@ -0,0 +1,176 @@
+import { isPlainObject } from "./shared-ts/src/utils/validation.js";
+import { isLocalIntendedYaoFaultTokenV1 } from "./localIntendedYaoFault.js";
+//#region src/localIntendedMaterialAdmissionFault.ts
+const MODE_HEADER = "x-seams-intended-material-admission-fault-v1";
+const TOKEN_HEADER = "x-seams-intended-material-admission-token-v1";
+const PROOF_HEADER = "x-seams-intended-material-admission-proof-v1";
+const SCOPE_PREDICATE = "namespace = ? AND org_id = ? AND project_id = ? AND env_id = ? AND wallet_id = ?";
+function localMaterialAdmissionFault(request, database) {
+	const raw = request.headers.get(MODE_HEADER);
+	const token = request.headers.get(TOKEN_HEADER);
+	if (raw === null && token === null) return null;
+	const url = new URL(request.url);
+	if (url.protocol !== "http:" || url.hostname !== "127.0.0.1" || request.method !== "POST" || !["/router-ab/ecdsa-derivation/sign/prepare", "/router-ab/ecdsa-derivation/sign"].includes(url.pathname) || !isLocalIntendedYaoFaultTokenV1(token) || raw !== "canonical_claim" && raw !== "canonical_existing" && raw !== "linked_claim" && raw !== "linked_existing") return Response.json({ code: "invalid_intended_material_admission_fault" }, { status: 400 });
+	const headers = new Headers(request.headers);
+	headers.delete(MODE_HEADER);
+	headers.delete(TOKEN_HEADER);
+	return {
+		database: new LocalMaterialAdmissionFaultDatabase(database, raw),
+		request: new Request(request, { headers }),
+		token
+	};
+}
+/** Retire material after resolution and before one admission statement, then restore it. */
+var LocalMaterialAdmissionFaultDatabase = class {
+	constructor(base, mode) {
+		this.base = base;
+		this.mode = mode;
+		this.scope = null;
+		this.state = { kind: "armed" };
+	}
+	prepare(query) {
+		const inner = this.base.prepare(query);
+		if (/^\s*INSERT INTO authorized_operations/.test(query)) return new FaultStatement(this, inner, "claim");
+		if (query.includes("AS material_snapshot_active")) return new FaultStatement(this, inner, "existing");
+		if (query.includes("AS ecdsa_material_records_json")) return new FaultStatement(this, inner, "material");
+		return inner;
+	}
+	captureScope(values) {
+		const scope = values.slice(0, 5);
+		const strings = [];
+		for (const value of scope) {
+			if (typeof value !== "string" || value.length === 0) throw new Error("Invalid material fault scope");
+			strings.push(value);
+		}
+		if (strings.length !== 5) throw new Error("Material fault did not observe a scoped material read");
+		this.scope = strings;
+	}
+	async batch(statements) {
+		const roles = statements.filter(isFaultStatement).map(statementRole);
+		const boundary = this.mode.endsWith("_claim") ? "claim" : "existing";
+		return this.execute(statements.map(unwrap), roles.includes(boundary) ? boundary : "material");
+	}
+	exec(query) {
+		return this.base.exec(query);
+	}
+	async first(statement, columnName) {
+		if (statement.role === "material") {
+			const row = await statement.inner.first(columnName);
+			if (isPlainObject(row)) this.captureScope([
+				row.session_namespace,
+				row.session_org_id,
+				row.session_project_id,
+				row.session_env_id,
+				row.session_wallet_id
+			]);
+			return row;
+		}
+		if (!this.shouldRetire(statement.role)) return statement.inner.first(columnName);
+		if (columnName !== void 0) throw new Error("Material admission reads must return a row");
+		const [result] = await this.execute([statement.inner], statement.role);
+		return result?.results?.[0] ?? null;
+	}
+	shouldRetire(role) {
+		return role === (this.mode.endsWith("_claim") ? "claim" : "existing") && this.state.kind === "armed";
+	}
+	async execute(statements, role) {
+		if (!this.shouldRetire(role)) return this.base.batch(statements);
+		if (!this.scope) throw new Error("Material fault has no scoped read");
+		const { table, key, column } = this.target();
+		const predicate = this.mode.startsWith("canonical") ? `${SCOPE_PREDICATE} AND signer_family = 'ecdsa'` : SCOPE_PREDICATE;
+		const result = await this.base.prepare(`SELECT ${key} AS record_key, ${column} AS record_value FROM ${table} WHERE ${predicate}`).bind(...this.scope).all();
+		const records = [];
+		for (const row of result.results ?? []) {
+			const value = row.record_value;
+			if (typeof row.record_key !== "string" || value !== null && typeof value !== "number" && typeof value !== "string") throw new Error("Invalid material fault backup");
+			records.push({
+				key: row.record_key,
+				value
+			});
+		}
+		if (records.length === 0) throw new Error("Material fault did not find custody records");
+		const replacement = this.mode.startsWith("canonical") ? "json_set(record_json, '$.walletKey.publicCapability.material_activation.lifecycle_binding', 'retired-by-intended-test')" : "NULL";
+		const retire = this.base.prepare(`UPDATE ${table} SET ${column} = ${replacement} WHERE ${predicate}`).bind(...this.scope);
+		const restore = [];
+		for (const record of records) restore.push(this.base.prepare(`UPDATE ${table} SET ${column} = ? WHERE ${predicate} AND ${key} = ?`).bind(record.value, ...this.scope, record.key));
+		const quota = this.base.prepare(`SELECT COALESCE(SUM(quota.remaining_uses), 0) AS remaining
+         FROM authorization_wallet_session_quotas AS quota
+         JOIN wallet_session_authorizations_v2 AS session
+           ON session.namespace = quota.namespace AND session.tenant_id = quota.tenant_id
+          AND session.quota_id = quota.quota_id
+        WHERE session.namespace = ? AND session.org_id = ? AND session.project_id = ?
+          AND session.env_id = ? AND session.wallet_id = ?`).bind(...this.scope);
+		const results = await this.base.batch([
+			quota,
+			retire,
+			...statements,
+			...restore,
+			quota
+		]);
+		this.state = {
+			kind: "restored",
+			rows: records.length,
+			quotaBefore: quotaTotal(results[0]),
+			quotaAfter: quotaTotal(results.at(-1))
+		};
+		return results.slice(2, 2 + statements.length);
+	}
+	response(response, token) {
+		const headers = new Headers(response.headers);
+		headers.set(PROOF_HEADER, this.state.kind === "restored" ? `${token}:${this.mode}:${this.state.rows}:${this.state.quotaBefore}:${this.state.quotaAfter}` : `${token}:not_observed`);
+		return new Response(response.body, {
+			status: response.status,
+			statusText: response.statusText,
+			headers
+		});
+	}
+	target() {
+		return this.mode.startsWith("canonical") ? {
+			table: "wallet_signers",
+			key: "signer_id",
+			column: "record_json"
+		} : {
+			table: "linked_device_authority_installations",
+			key: "link_session_id",
+			column: "activated_at_ms"
+		};
+	}
+};
+var FaultStatement = class FaultStatement {
+	constructor(database, inner, role) {
+		this.database = database;
+		this.inner = inner;
+		this.role = role;
+	}
+	bind(...values) {
+		return new FaultStatement(this.database, this.inner.bind(...values), this.role);
+	}
+	async first(columnName) {
+		return this.database.first(this, columnName);
+	}
+	all() {
+		return this.inner.all();
+	}
+	run() {
+		return this.inner.run();
+	}
+};
+function unwrap(statement) {
+	return statement instanceof FaultStatement ? statement.inner : statement;
+}
+function isFaultStatement(statement) {
+	return statement instanceof FaultStatement;
+}
+function statementRole(statement) {
+	return statement.role;
+}
+function quotaTotal(result) {
+	if (!isPlainObject(result) || !Array.isArray(result.results)) throw new Error("Material fault quota result is unavailable");
+	const row = result.results[0];
+	if (!isPlainObject(row) || typeof row.remaining !== "number" || !Number.isSafeInteger(row.remaining)) throw new Error("Material fault quota total is invalid");
+	return row.remaining;
+}
+//#endregion
+export { localMaterialAdmissionFault };
+
+//# sourceMappingURL=localIntendedMaterialAdmissionFault.js.map

package/dist/esm/localIntendedPresignCancellation.js

@@ -0,0 +1,44 @@
+import { handleSplitGatewayRequest } from "./hosted-wallet-gateway.js";
+//#region src/localIntendedPresignCancellation.ts
+const held = /* @__PURE__ */ new Set();
+const header = "x-seams-intended-presign-cancellation";
+const initPath = "/router-ab/ecdsa-derivation/presignature-pool/fill/init";
+var HeldPresignProxy = class {
+	constructor(token) {
+		this.token = token;
+	}
+	async fetch() {
+		held.add(this.token);
+		await new Promise(resolveHeldPresign);
+		held.delete(this.token);
+		return Response.json({
+			ok: false,
+			code: "temporarily_unavailable"
+		}, { status: 503 });
+	}
+};
+function resolveHeldPresign(resolve) {
+	setTimeout(resolve, 3e4);
+}
+async function localPresignCancellationProbe(request, env, ctx, dependencies) {
+	const token = request.headers.get(header);
+	if (token === null) return null;
+	const url = new URL(request.url);
+	if (url.protocol !== "http:" || url.hostname !== "127.0.0.1" || url.pathname !== initPath || !/^[0-9a-f-]{36}$/u.test(token)) return Response.json({ code: "invalid_presign_cancellation_probe" }, { status: 400 });
+	if (request.method === "GET") return Response.json({ held: held.has(token) });
+	if (request.method === "DELETE") {
+		held.delete(token);
+		return new Response(null, { status: 204 });
+	}
+	if (request.method !== "POST") return new Response(null, { status: 405 });
+	const headers = new Headers(request.headers);
+	headers.delete(header);
+	return handleSplitGatewayRequest(new Request(request, { headers }), {
+		...env,
+		SIGNING_WORKER: new HeldPresignProxy(token)
+	}, ctx, dependencies);
+}
+//#endregion
+export { localPresignCancellationProbe };
+
+//# sourceMappingURL=localIntendedPresignCancellation.js.map

package/dist/esm/localIntendedRevokeFault.js

@@ -0,0 +1,106 @@
+import { isLocalIntendedYaoFaultTokenV1 } from "./localIntendedYaoFault.js";
+//#region src/localIntendedRevokeFault.ts
+const LOCAL_INTENDED_REVOKE_FAULT_HEADER_V1 = "x-seams-intended-revoke-fault-v1";
+const LOCAL_INTENDED_REVOKE_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-revoke-fault-token-v1";
+const LOCAL_INTENDED_REVOKE_FAULT_PROOF_HEADER_V1 = "x-seams-intended-revoke-fault-proof-v1";
+const WALLET_REVOKE_AUTH_METHOD_PATH_PATTERN_V1 = /^\/wallets\/[^/]+\/auth-methods\/[^/]+\/revoke$/;
+/** A linked device's method, revoked through device management. */
+const LINKED_DEVICE_REVOKE_PATH_PATTERN_V1 = /^\/wallet\/device-linking\/v1\/devices\/[^/]+\/revoke$/;
+const RECORD_ANSWER_PATTERN = /^\s*INSERT OR IGNORE INTO wallet_auth_method_revocation_replays\b/;
+const SPEND_CODE_PATTERN = /^\s*DELETE FROM email_otp_challenges\b[\s\S]*\bchallenge_id = \?/;
+function parseLocalIntendedRevokeFaultModeV1(value) {
+	return value === "refuse_revocation_batch_once" ? value : null;
+}
+function parseLocalIntendedRevokeFaultTokenV1(value) {
+	return isLocalIntendedYaoFaultTokenV1(value) ? value : null;
+}
+/** The signer database, refusing one auth-method revocation's batch. */
+var LocalIntendedRevokeFaultDatabaseV1 = class {
+	constructor(base) {
+		this.base = base;
+		this.state = { kind: "armed" };
+	}
+	prepare(query) {
+		return new LocalIntendedRevokeFaultStatementV1(this, RECORD_ANSWER_PATTERN.test(query), SPEND_CODE_PATTERN.test(query), this.base.prepare(query));
+	}
+	async batch(statements) {
+		const faulted = statements.filter((statement) => statement instanceof LocalIntendedRevokeFaultStatementV1);
+		if (!faulted.some((statement) => statement.recordsAnswer)) return await this.base.batch(statements.map(unwrapStatement));
+		if (this.state.kind === "armed") this.state = {
+			kind: "proved",
+			proof: faulted.some((statement) => statement.spendsCode) ? "refused_revocation_with_its_code" : "refused_revocation_without_code"
+		};
+		else if (this.state.kind === "proved") this.state = {
+			kind: "violated",
+			violation: "additional_revocation_batch"
+		};
+		throw new Error("Local intended fault: the auth-method revocation batch did not commit");
+	}
+	async exec(query) {
+		return await this.base.exec(query);
+	}
+	spentCodeOutsideRevocation() {
+		this.state = {
+			kind: "violated",
+			violation: "code_spent_outside_revocation"
+		};
+	}
+	outcome() {
+		switch (this.state.kind) {
+			case "proved":
+			case "violated": return this.state;
+			case "armed": return {
+				kind: "violated",
+				violation: "revocation_batch_not_observed"
+			};
+		}
+	}
+};
+var LocalIntendedRevokeFaultStatementV1 = class LocalIntendedRevokeFaultStatementV1 {
+	constructor(database, recordsAnswer, spendsCode, inner) {
+		this.database = database;
+		this.recordsAnswer = recordsAnswer;
+		this.spendsCode = spendsCode;
+		this.inner = inner;
+	}
+	bind(...values) {
+		return new LocalIntendedRevokeFaultStatementV1(this.database, this.recordsAnswer, this.spendsCode, this.inner.bind(...values));
+	}
+	async first(columnName) {
+		this.observeOwnRun();
+		return await this.inner.first(columnName);
+	}
+	async all() {
+		this.observeOwnRun();
+		return await this.inner.all();
+	}
+	async run() {
+		this.observeOwnRun();
+		return await this.inner.run();
+	}
+	observeOwnRun() {
+		if (this.spendsCode) this.database.spentCodeOutsideRevocation();
+	}
+};
+function unwrapStatement(statement) {
+	return statement instanceof LocalIntendedRevokeFaultStatementV1 ? statement.inner : statement;
+}
+function requestWithoutLocalIntendedRevokeFaultHeadersV1(request) {
+	const headers = new Headers(request.headers);
+	headers.delete(LOCAL_INTENDED_REVOKE_FAULT_HEADER_V1);
+	headers.delete(LOCAL_INTENDED_REVOKE_FAULT_TOKEN_HEADER_V1);
+	return new Request(request, { headers });
+}
+function responseWithLocalIntendedRevokeFaultOutcomeV1(response, outcome, token) {
+	const headers = new Headers(response.headers);
+	headers.set(LOCAL_INTENDED_REVOKE_FAULT_PROOF_HEADER_V1, outcome.kind === "proved" ? `${token}:${outcome.proof}` : `${token}:violation:${outcome.violation}`);
+	return new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers
+	});
+}
+//#endregion
+export { LINKED_DEVICE_REVOKE_PATH_PATTERN_V1, LOCAL_INTENDED_REVOKE_FAULT_HEADER_V1, LOCAL_INTENDED_REVOKE_FAULT_TOKEN_HEADER_V1, LocalIntendedRevokeFaultDatabaseV1, WALLET_REVOKE_AUTH_METHOD_PATH_PATTERN_V1, parseLocalIntendedRevokeFaultModeV1, parseLocalIntendedRevokeFaultTokenV1, requestWithoutLocalIntendedRevokeFaultHeadersV1, responseWithLocalIntendedRevokeFaultOutcomeV1 };
+
+//# sourceMappingURL=localIntendedRevokeFault.js.map

package/dist/esm/localIntendedSessionAdmissionFault.js

@@ -0,0 +1,139 @@
+import { isLocalIntendedYaoFaultTokenV1 } from "./localIntendedYaoFault.js";
+//#region src/localIntendedSessionAdmissionFault.ts
+const LOCAL_INTENDED_SESSION_ADMISSION_FAULT_HEADER_V1 = "x-seams-intended-session-admission-fault-v1";
+const LOCAL_INTENDED_SESSION_ADMISSION_FAULT_TOKEN_HEADER_V1 = "x-seams-intended-session-admission-fault-token-v1";
+const LOCAL_INTENDED_SESSION_ADMISSION_FAULT_PROOF_HEADER_V1 = "x-seams-intended-session-admission-fault-proof-v1";
+/** The ECDSA signing prepare: it admits the Wallet Session's operation credential. */
+const ECDSA_SIGN_PREPARE_PATH_V1 = "/router-ab/ecdsa-derivation/sign/prepare";
+const SESSION_READ_PATTERN = /FROM wallet_session_authorizations_v2 AS session[\s\S]*\bsession\.operation_credential_hash = \?/;
+const HOLD_LIMIT_MS = 6e4;
+const POLL_INTERVAL_MS = 50;
+function parseLocalIntendedSessionAdmissionFaultModeV1(value) {
+	return value === "hold_after_session_read_until_authority_changes" ? value : null;
+}
+function parseLocalIntendedSessionAdmissionFaultTokenV1(value) {
+	return isLocalIntendedYaoFaultTokenV1(value) ? value : null;
+}
+/** The signer database, holding one request after its session read. */
+var LocalIntendedSessionAdmissionFaultDatabaseV1 = class {
+	constructor(base) {
+		this.base = base;
+		this.state = { kind: "armed" };
+	}
+	prepare(query) {
+		const inner = this.base.prepare(query);
+		return SESSION_READ_PATTERN.test(query) ? new LocalIntendedSessionReadStatementV1(this, inner) : inner;
+	}
+	async batch(statements) {
+		return await this.base.batch(statements.map(unwrapStatement));
+	}
+	async exec(query) {
+		return await this.base.exec(query);
+	}
+	async holdAfterSessionRead(row) {
+		if (this.state.kind !== "armed") return;
+		const authority = readAuthorityOfSessionRow(row);
+		if (!authority) {
+			this.state = {
+				kind: "violated",
+				violation: "session_read_not_observed"
+			};
+			return;
+		}
+		const deadline = Date.now() + HOLD_LIMIT_MS;
+		while (Date.now() < deadline) {
+			await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
+			const current = await this.base.prepare(`SELECT authority_digest_b64u
+             FROM wallet_authorities
+            WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
+              AND authority_id = ?
+            LIMIT 1`).bind(authority.namespace, authority.orgId, authority.projectId, authority.envId, authority.authorityId).first();
+			if (current && current.authority_digest_b64u !== authority.digest) {
+				this.state = {
+					kind: "proved",
+					proof: "held_until_authority_changed"
+				};
+				return;
+			}
+		}
+		this.state = {
+			kind: "violated",
+			violation: "authority_unchanged"
+		};
+	}
+	outcome() {
+		switch (this.state.kind) {
+			case "proved":
+			case "violated": return this.state;
+			case "armed": return {
+				kind: "violated",
+				violation: "session_read_not_observed"
+			};
+		}
+	}
+};
+var LocalIntendedSessionReadStatementV1 = class LocalIntendedSessionReadStatementV1 {
+	constructor(database, inner) {
+		this.database = database;
+		this.inner = inner;
+	}
+	bind(...values) {
+		return new LocalIntendedSessionReadStatementV1(this.database, this.inner.bind(...values));
+	}
+	async first(columnName) {
+		const row = await this.inner.first(columnName);
+		await this.database.holdAfterSessionRead(row);
+		return row;
+	}
+	async all() {
+		return await this.inner.all();
+	}
+	async run() {
+		return await this.inner.run();
+	}
+};
+/** The joined row carries the authority as it was read with the session. */
+function readAuthorityOfSessionRow(row) {
+	if (!row || typeof row !== "object") return null;
+	const value = row;
+	const fields = [
+		value.namespace,
+		value.org_id,
+		value.project_id,
+		value.env_id,
+		value.authority_id,
+		value.authority_digest_b64u
+	];
+	if (!fields.every((field) => typeof field === "string" && field.length > 0)) return null;
+	const [namespace, orgId, projectId, envId, authorityId, digest] = fields;
+	return {
+		namespace,
+		orgId,
+		projectId,
+		envId,
+		authorityId,
+		digest
+	};
+}
+function unwrapStatement(statement) {
+	return statement instanceof LocalIntendedSessionReadStatementV1 ? statement.inner : statement;
+}
+function requestWithoutLocalIntendedSessionAdmissionFaultHeadersV1(request) {
+	const headers = new Headers(request.headers);
+	headers.delete(LOCAL_INTENDED_SESSION_ADMISSION_FAULT_HEADER_V1);
+	headers.delete(LOCAL_INTENDED_SESSION_ADMISSION_FAULT_TOKEN_HEADER_V1);
+	return new Request(request, { headers });
+}
+function responseWithLocalIntendedSessionAdmissionFaultOutcomeV1(response, outcome, token) {
+	const headers = new Headers(response.headers);
+	headers.set(LOCAL_INTENDED_SESSION_ADMISSION_FAULT_PROOF_HEADER_V1, outcome.kind === "proved" ? `${token}:${outcome.proof}` : `${token}:violation:${outcome.violation}`);
+	return new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers
+	});
+}
+//#endregion
+export { ECDSA_SIGN_PREPARE_PATH_V1, LOCAL_INTENDED_SESSION_ADMISSION_FAULT_HEADER_V1, LOCAL_INTENDED_SESSION_ADMISSION_FAULT_PROOF_HEADER_V1, LOCAL_INTENDED_SESSION_ADMISSION_FAULT_TOKEN_HEADER_V1, LocalIntendedSessionAdmissionFaultDatabaseV1, parseLocalIntendedSessionAdmissionFaultModeV1, parseLocalIntendedSessionAdmissionFaultTokenV1, requestWithoutLocalIntendedSessionAdmissionFaultHeadersV1, responseWithLocalIntendedSessionAdmissionFaultOutcomeV1 };
+
+//# sourceMappingURL=localIntendedSessionAdmissionFault.js.map