@seams/wallet-server 0.6.2 → 0.7.3

package/dist/esm/router/auth/webAuthnCredentialCodecs.js

@@ -2,6 +2,7 @@ import { base64Decode, base64UrlDecode, base64UrlEncode } from "../../shared-ts/
 import "../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import "../../shared-ts/src/utils/validation.js";
+import { failure } from "../../shared-ts/src/utils/failure.js";
 import { errorMessage } from "../../shared-ts/src/utils/errors.js";
 //#region src/router/auth/webAuthnCredentialCodecs.ts
 function decodeWebAuthnBase64UrlOrBase64(input, fieldName) {
@@ -45,30 +46,18 @@ function webAuthnOriginHostnameOrEmpty(origin) {
 	}
 }
 function webAuthnCredentialIdB64uFromCredential(input) {
-	if (input === null || typeof input !== "object" || Array.isArray(input)) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Missing webauthn_authentication.id/rawId"
-	};
+	if (input === null || typeof input !== "object" || Array.isArray(input)) return failure("invalid_body", "Missing webauthn_authentication.id/rawId");
 	const rawId = normalizeOptionalTrimmedString(Reflect.get(input, "rawId"));
 	const id = normalizeOptionalTrimmedString(Reflect.get(input, "id"));
 	const selected = rawId || id;
-	if (!selected) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Missing webauthn_authentication.id/rawId"
-	};
+	if (!selected) return failure("invalid_body", "Missing webauthn_authentication.id/rawId");
 	try {
 		return {
 			ok: true,
 			credentialIdB64u: base64UrlEncode(decodeWebAuthnBase64UrlOrBase64(selected, "webauthn_authentication.rawId"))
 		};
 	} catch (error) {
-		return {
-			ok: false,
-			code: "invalid_body",
-			message: errorMessage(error) || "Invalid credential rawId"
-		};
+		return failure("invalid_body", errorMessage(error) || "Invalid credential rawId");
 	}
 }
 function parseWebAuthnAuthenticationCredential(input) {

package/dist/esm/router/cloudflare/d1/auth/d1AuthorizedOperationRouteService.js

@@ -0,0 +1,24 @@
+import { parseTenantId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+//#region src/router/cloudflare/d1/auth/d1AuthorizedOperationRouteService.ts
+function createD1AuthorizedOperationRouteService(assembly) {
+	const tenantId = parseTenantId(assembly.options.orgId);
+	if (!tenantId.ok) throw new Error(`orgId cannot identify an authorization tenant: ${tenantId.error.message}`);
+	return {
+		tenantId: tenantId.value,
+		resolveEcdsaWalletSessionOperation: assembly.authorizationStore.resolveEcdsaWalletSessionOperation.bind(assembly.authorizationStore),
+		admitEcdsaWalletSessionOperation: assembly.authorizationStore.admitEcdsaWalletSessionOperation.bind(assembly.authorizationStore),
+		readPinnedOwnerWalletScope: assembly.authorizationStore.readPinnedOwnerWalletScope.bind(assembly.authorizationStore),
+		buildVerifiedOwnerProof: assembly.authorizationService.buildVerifiedOwnerProof.bind(assembly.authorizationService),
+		recordVerifiedWalletOperationFactorEvidenceSet: assembly.authorizationService.recordVerifiedWalletOperationFactorEvidenceSet.bind(assembly.authorizationService),
+		readAuthorizedOperationById: assembly.authorizationService.readAuthorizedOperationById.bind(assembly.authorizationService),
+		readAuthorizedOperation: assembly.authorizationService.readAuthorizedOperation.bind(assembly.authorizationService),
+		admitAuthorizedOperation: assembly.authorizationService.admitAuthorizedOperation.bind(assembly.authorizationService),
+		prepareAuthorizedOperationAdmission: assembly.authorizationService.prepareAuthorizedOperationAdmission.bind(assembly.authorizationService),
+		classifyAuthorizedOperationAdmissionFailure: assembly.authorizationService.classifyAuthorizedOperationAdmissionFailure.bind(assembly.authorizationService),
+		completeAuthorizedOperation: assembly.authorizationService.completeAuthorizedOperation.bind(assembly.authorizationService)
+	};
+}
+//#endregion
+export { createD1AuthorizedOperationRouteService };
+
+//# sourceMappingURL=d1AuthorizedOperationRouteService.js.map

package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthBoundary.js

@@ -1,4 +1,5 @@
 import { hasWhitespaceOrControlCharacters, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { toArrayBufferCopy } from "../../../../core/authService/portableCrypto.js";
 //#region src/router/cloudflare/d1/auth/d1RouterApiAuthBoundary.ts
 function parseD1BoundaryWalletIdResult(raw) {
 	const parsed = parseWalletId(raw);
@@ -64,11 +65,6 @@ function d1MutationChanges(result) {
 	const meta = result.meta;
 	return parseD1NonNegativeCount(meta?.changes ?? meta?.rows_written);
 }
-function toArrayBufferCopy(bytes) {
-	const out = new ArrayBuffer(bytes.byteLength);
-	new Uint8Array(out).set(bytes);
-	return out;
-}
 async function sha256BytesPortable(input) {
 	const subtle = globalThis.crypto?.subtle;
 	if (subtle && typeof subtle.digest === "function") return new Uint8Array(await subtle.digest("SHA-256", toArrayBufferCopy(input)));
@@ -79,6 +75,6 @@ async function sha256BytesPortable(input) {
 	throw new Error("SHA-256 digest is unavailable in this runtime");
 }
 //#endregion
-export { d1MutationChanges, isB64uString, nonNegativeSafeInteger, optionalNonNegativeInteger, parseD1BoundaryWalletId, parseD1BoundaryWalletIdResult, parseD1NonNegativeCount, parseJsonObject, positiveInteger, positiveSafeInteger, sha256BytesPortable, toArrayBufferCopy, toRecordValue };
+export { d1MutationChanges, isB64uString, nonNegativeSafeInteger, optionalNonNegativeInteger, parseD1BoundaryWalletId, parseD1BoundaryWalletIdResult, parseD1NonNegativeCount, parseJsonObject, positiveInteger, positiveSafeInteger, sha256BytesPortable, toRecordValue };
 
 //# sourceMappingURL=d1RouterApiAuthBoundary.js.map

package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthService.js

@@ -4,7 +4,6 @@ import { capabilityPolicyPort } from "../../../../authorization/capabilityPolicy
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8, sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import "../../../../shared-ts/src/utils/encoders.js";
-import { computeWalletAuthMethodRevokeOperationFingerprintV1 } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { parseRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { AuthorizationService } from "../../../../authorization/service.js";
 import { D1WalletStore } from "../../../../core/d1WalletStore.js";
@@ -20,12 +19,15 @@ import { sha256BytesPortable, toRecordValue } from "./d1RouterApiAuthBoundary.js
 import { CloudflareD1WebAuthnStore } from "../webauthn/d1WebAuthnStore.js";
 import { verifyD1LinkedDeviceFreshRevokeProofV1 } from "../wallet/d1WalletAuthMethodBoundary.js";
 import { CloudflareD1WebAuthnAuthService } from "../webauthn/d1WebAuthnAuthService.js";
+import { D1LinkedDeviceAuthorityInstallServiceV1 } from "../deviceLinking/d1LinkedDeviceAuthorityInstallService.js";
 import { D1WalletAuthorityStore } from "../wallet/d1WalletAuthorityStore.js";
 import { CloudflareD1AuthorizationStore } from "../authorization/d1AuthorizationStore.js";
 import { createCloudflareD1VersionedJsonRecordStore } from "../versionedJson/d1VersionedJsonRecordStore.js";
 import { parseRouterAbEd25519YaoRegistrationSideEffectRecordV2, runRouterAbEd25519YaoRegistrationSideEffectV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
 import { createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1 } from "../../signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.js";
 import { normalizeD1RouterApiAuthOptions } from "./d1RouterApiAuthConfig.js";
+import { readActiveWalletSessionCredential, readExhaustedWalletSessionCredential, readWalletSessionSigningCandidate } from "./walletSessionCredentialReaders.js";
+import { createD1AuthorizedOperationRouteService } from "./d1AuthorizedOperationRouteService.js";
 import { parseRegistrationEstablishedSessionProjectionV2 } from "../../../../shared-ts/src/utils/registrationEstablishedSession.js";
 import { D1IdentityStore } from "../../../../core/d1IdentityStore.js";
 import { toPublicKeyStringFromSecretKey } from "../../../../core/nearKeys.js";
@@ -50,10 +52,12 @@ import { CloudflareD1GoogleEmailOtpRegistrationAttemptStore } from "../emailOtp/
 import { CloudflareD1GoogleEmailOtpSessionResolver } from "../emailOtp/d1GoogleEmailOtpSessionResolver.js";
 import { CloudflareD1IdentityService } from "../identity/d1IdentityService.js";
 import { CloudflareD1OidcVerificationService } from "../oidc/d1OidcVerificationService.js";
+import { D1WalletAuthMethodRevocationReplayStoreV1 } from "../wallet/d1WalletAuthMethodRevocationReplayStore.js";
 import { CloudflareD1WalletAuthMethodService } from "../wallet/d1WalletAuthMethodService.js";
 import { parseWalletRegistrationSessionCommitReceiptV2 } from "../registration/walletRegistrationSessionCommitReceipt.js";
 import { CloudflareD1WalletRegistrationService } from "../registration/d1WalletRegistrationService.js";
 import { CloudflareD1WalletRegistrationCommitStore } from "../registration/d1WalletRegistrationCommitStore.js";
+import { CloudflareD1Ed25519YaoLifecycleDecisionStoreV1 } from "../ed25519Yao/d1Ed25519YaoLifecycleDecisionStore.js";
 import { CloudflareD1PasskeyCustodyEnvelopeStore } from "../passkeyCustody/d1PasskeyCustodyEnvelopeStore.js";
 import { CloudflareD1WalletCustodyCommitStore } from "../passkeyCustody/d1WalletCustodyCommitStore.js";
 import { createD1PasskeyCustodyRouteService } from "../passkeyCustody/d1PasskeyCustodyRouteService.js";
@@ -66,8 +70,8 @@ import { createD1LinkedDeviceSessionServiceV1 } from "../deviceLinking/d1LinkedD
 import { D1LinkedDeviceSessionStoreV1 } from "../deviceLinking/d1LinkedDeviceSessionStore.js";
 import { createD1LinkedDeviceRouteServiceV1 } from "../deviceLinking/d1LinkedDeviceRouteService.js";
 import { D1LinkedDeviceEmailOtpGrantStoreV1 } from "../deviceLinking/d1LinkedDeviceEmailOtpGrantStore.js";
-import { D1LinkedDeviceAuthorityInstallServiceV1 } from "../deviceLinking/d1LinkedDeviceAuthorityInstallService.js";
 import { createD1LinkedDeviceManagementServiceV1 } from "../deviceLinking/d1LinkedDeviceManagementService.js";
+import { createD1LinkedDeviceRevocationV1 } from "../deviceLinking/d1LinkedDeviceRevocation.js";
 import { createD1LinkedDeviceVerifiedLinkSourceReaderV1 } from "../deviceLinking/d1LinkedDeviceVerifiedLinkSourceReader.js";
 import { LinkedDeviceWebAuthnRegistrationVerifierV1 } from "../deviceLinking/d1LinkedDeviceTargetCredentialProvider.js";
 import { D1LinkedDeviceEmailOtpTargetFactorV1, linkedDeviceEmailOtpGrantRegistrationPortV1 } from "../deviceLinking/d1LinkedDeviceEmailOtpTargetFactor.js";
@@ -108,57 +112,70 @@ function createD1LinkedDeviceComposition(input) {
 	if (sessionConfig) deactivationEndpoint = sessionConfig.authorityInstallation.deactivationEndpoint;
 	else if (managementConfig) deactivationEndpoint = managementConfig.deactivationEndpoint;
 	else return {};
-	const deviceManagement = {
-		management: createD1LinkedDeviceManagementServiceV1({
-			scope,
-			tenantId: tenantId.value,
-			authorityStore,
-			authMethodStore: input.walletAuthMethodStore,
-			authorizationService: input.authorizationService,
-			walletSessionAuthorizations: input.authorizationStore,
-			webAuthnStore: input.webAuthnStore,
-			...input.emailOtpLinkedDevice === void 0 ? {} : { emailOtpEnrollments: input.emailOtpLinkedDevice.enrollments },
-			materialDeactivation: createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1({ endpoint: deactivationEndpoint })
+	const deviceManagementService = createD1LinkedDeviceManagementServiceV1({
+		scope,
+		tenantId: tenantId.value,
+		authorityStore,
+		authMethodStore: input.walletAuthMethodStore,
+		authorizationService: input.authorizationService,
+		walletSessionAuthorizations: input.authorizationStore,
+		webAuthnStore: input.webAuthnStore,
+		...input.emailOtpLinkedDevice === void 0 ? {} : { emailOtpEnrollments: input.emailOtpLinkedDevice.enrollments },
+		materialDeactivation: createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1({ endpoint: deactivationEndpoint })
+	});
+	const revokeLinkedDeviceWithFreshProof = createD1LinkedDeviceRevocationV1({
+		management: deviceManagementService,
+		replays: new D1WalletAuthMethodRevocationReplayStoreV1({
+			database: input.options.database,
+			scope
 		}),
+		authMethodStore: input.walletAuthMethodStore,
+		authorityStore,
+		nowV1,
+		verifyProofForBatch: async (proofInput) => await verifyD1LinkedDeviceFreshRevokeProofV1({
+			walletId: proofInput.walletId,
+			orgId: String(input.options.orgId),
+			targetWalletAuthMethodId: proofInput.targetWalletAuthMethodId,
+			proof: proofInput.proof,
+			expectedOrigin: proofInput.expectedOrigin,
+			verifiedAtMs: proofInput.verifiedAtMs,
+			operationFingerprintDigest: proofInput.operationFingerprintDigest,
+			walletAuthMethodStore: input.walletAuthMethodStore,
+			verifyWebAuthnAuthenticationLite: async (verifyInput) => {
+				const credential = parseWebAuthnAuthenticationCredential(verifyInput.webauthn_authentication);
+				if (!credential) return {
+					success: false,
+					verified: false,
+					code: "invalid_body",
+					message: "Invalid WebAuthn authentication credential"
+				};
+				return await input.webAuthnAuthService.verifyWebAuthnAuthenticationLite({
+					...verifyInput,
+					webauthn_authentication: credential
+				});
+			},
+			...input.emailOtpLinkedDevice === void 0 ? {} : {
+				verifyEmailOtpExistingForBatch: input.emailOtpLinkedDevice.verifier.verifyExistingForBatch.bind(input.emailOtpLinkedDevice.verifier),
+				readEmailOtpEnrollment: input.emailOtpLinkedDevice.enrollments.readEnrollment.bind(input.emailOtpLinkedDevice.enrollments)
+			}
+		})
+	});
+	const deviceManagement = {
+		management: deviceManagementService,
 		nowV1,
 		authenticateOwnerRequestV1: ownerRequestAuthenticator,
-		verifyFreshRevokeProofV1: async (proofInput) => {
-			const expectedOrigin = String(proofInput.request.headers.get("origin") || "").trim();
+		revokeLinkedDeviceWithFreshProofV1: async (revokeInput) => {
+			const expectedOrigin = String(revokeInput.httpRequest.headers.get("origin") || "").trim();
 			if (!expectedOrigin) return {
 				kind: "denied",
 				code: "invalid",
 				message: "Fresh revocation proof requires an Origin header"
 			};
-			return await verifyD1LinkedDeviceFreshRevokeProofV1({
-				walletId: proofInput.walletId,
-				orgId: String(input.options.orgId),
-				targetWalletAuthMethodId: proofInput.targetWalletAuthMethodId,
-				proof: proofInput.proof,
-				expectedOrigin,
-				verifiedAtMs: proofInput.requestedAtMs,
-				operationFingerprintDigest: await computeWalletAuthMethodRevokeOperationFingerprintV1({
-					walletId: proofInput.walletId,
-					targetWalletAuthMethodId: proofInput.targetWalletAuthMethodId,
-					requestedAtMs: proofInput.requestedAtMs
-				}),
-				walletAuthMethodStore: input.walletAuthMethodStore,
-				verifyWebAuthnAuthenticationLite: async (verifyInput) => {
-					const credential = parseWebAuthnAuthenticationCredential(verifyInput.webauthn_authentication);
-					if (!credential) return {
-						success: false,
-						verified: false,
-						code: "invalid_body",
-						message: "Invalid WebAuthn authentication credential"
-					};
-					return await input.webAuthnAuthService.verifyWebAuthnAuthenticationLite({
-						...verifyInput,
-						webauthn_authentication: credential
-					});
-				},
-				...input.emailOtpLinkedDevice === void 0 ? {} : {
-					verifyEmailOtpExisting: input.emailOtpLinkedDevice.verifier.verifyExisting.bind(input.emailOtpLinkedDevice.verifier),
-					readEmailOtpEnrollment: input.emailOtpLinkedDevice.enrollments.readEnrollment.bind(input.emailOtpLinkedDevice.enrollments)
-				}
+			return await revokeLinkedDeviceWithFreshProof({
+				request: revokeInput.request,
+				owner: revokeInput.owner,
+				proof: revokeInput.proof,
+				expectedOrigin
 			});
 		}
 	};
@@ -1012,6 +1029,15 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 		webAuthnStore,
 		listWalletEd25519Signers: (walletId) => walletStore.listEd25519SignersForWallet({ walletId }),
 		walletAuthorityStore,
+		revocationReplays: new D1WalletAuthMethodRevocationReplayStoreV1({
+			database: options.database,
+			scope: {
+				namespace: options.namespace,
+				orgId: options.orgId,
+				projectId: options.projectId,
+				envId: options.envId
+			}
+		}),
 		orgId: options.orgId,
 		verifyWebAuthnAuthenticationLite: async (verifyInput) => {
 			const credential = parseWebAuthnAuthenticationCredential(verifyInput.webauthn_authentication);
@@ -1027,6 +1053,13 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 			});
 		}
 	});
+	const yaoLifecycleDecisions = new CloudflareD1Ed25519YaoLifecycleDecisionStoreV1({
+		database: options.database,
+		namespace: options.namespace,
+		orgId: options.orgId,
+		projectId: options.projectId,
+		envId: options.envId
+	});
 	const walletRegistrationCommitStore = new CloudflareD1WalletRegistrationCommitStore({
 		database: options.database,
 		namespace: options.namespace,
@@ -1059,7 +1092,8 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 		walletRegistrationCommitStore,
 		walletCustodyCommitStore,
 		walletAuthMethods,
-		getLinkedDeviceEd25519AuthorityReader
+		getLinkedDeviceEd25519AuthorityReader,
+		yaoLifecycleDecisions
 	});
 	const walletAddSigners = new CloudflareD1WalletAddSignerService({
 		getRegistrationCeremonyIntentStore,
@@ -1070,7 +1104,8 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 		walletAuthMethods,
 		passkeyCustodyEnvelopes,
 		startSideEffects: walletAddSignerStartSideEffectStore(options),
-		finalizeSideEffects: walletAddSignerFinalizeSideEffectStore(options)
+		finalizeSideEffects: walletAddSignerFinalizeSideEffectStore(options),
+		yaoLifecycleDecisions
 	});
 	const registrationIntents = new CloudflareD1RegistrationIntentService({ getRegistrationCeremonyIntentStore });
 	const emailOtpChallengeIssuer = new CloudflareD1EmailOtpChallengeIssuer({
@@ -1161,6 +1196,7 @@ function createCloudflareD1RouterApiAuthAssembly(input) {
 		identityService,
 		oidcVerification,
 		authorizationService,
+		authorizationStore,
 		googleEmailOtpSessions,
 		nearPublicKeys,
 		webAuthnAuthService,
@@ -1245,7 +1281,7 @@ function createD1WalletRegistrationRouteService(assembly) {
 function createD1WalletAuthMethodRouteService(assembly) {
 	return {
 		resolveActiveWalletSessionAuthority: assembly.walletAuthMethods.resolveActiveWalletSessionAuthority.bind(assembly.walletAuthMethods),
-		verifyWalletAuthMethodRevokeProof: assembly.walletAuthMethods.verifyWalletAuthMethodRevokeProof.bind(assembly.walletAuthMethods),
+		revokeWalletAuthMethodWithFreshProof: assembly.walletAuthMethods.revokeWalletAuthMethodWithFreshProof.bind(assembly.walletAuthMethods),
 		verifyActivePasskeyAuthority: assembly.walletAuthMethods.verifyActivePasskeyAuthority.bind(assembly.walletAuthMethods),
 		resolveActivePasskeyAuthorityForVerifiedCredential: assembly.walletAuthMethods.resolveActivePasskeyAuthorityForVerifiedCredential.bind(assembly.walletAuthMethods),
 		verifyActiveEmailOtpAuthority: assembly.walletAuthMethods.verifyActiveEmailOtpAuthority.bind(assembly.walletAuthMethods),
@@ -1258,7 +1294,6 @@ function createD1WalletAuthMethodRouteService(assembly) {
 		respondWalletAddSignerEcdsaDerivation: assembly.walletAddSigners.respondWalletAddSignerEcdsaDerivation.bind(assembly.walletAddSigners),
 		activateWalletAddSignerEcdsa: assembly.walletAddSigners.activateWalletAddSignerEcdsa.bind(assembly.walletAddSigners),
 		getWalletAddSignerRuntimePolicyScope: assembly.walletAddSigners.getWalletAddSignerRuntimePolicyScope.bind(assembly.walletAddSigners),
-		revokeWalletAuthMethod: assembly.walletAuthMethods.revokeWalletAuthMethod.bind(assembly.walletAuthMethods),
 		createAddAuthMethodEmailOtpChallenge: assembly.walletAuthMethods.createAddAuthMethodEmailOtpChallenge.bind(assembly.walletAuthMethods),
 		verifyAddAuthMethodEmailOtpSourceProof: assembly.walletAuthMethods.verifyAddAuthMethodEmailOtpSourceProof.bind(assembly.walletAuthMethods),
 		startWalletAddAuthMethod: assembly.walletAuthMethods.startWalletAddAuthMethod.bind(assembly.walletAuthMethods),
@@ -1456,40 +1491,16 @@ function createD1IdentityRouteService(assembly) {
 		verifyGithubOAuthCode: assembly.oidcVerification.verifyGithubOAuthCode.bind(assembly.oidcVerification)
 	};
 }
-function isExhaustedWalletSessionStatus(status) {
-	return status.kind === "exhausted";
-}
 function createD1AuthorizationSessionRouteService(assembly) {
 	const tenantId = parseTenantId(assembly.options.orgId);
 	if (!tenantId.ok) throw new Error(`orgId cannot identify an authorization tenant: ${tenantId.error.message}`);
 	return {
 		tenantId: tenantId.value,
 		issueDirectWalletSessionAuthorizationV2: assembly.authorizationService.issueDirectWalletSessionAuthorizationV2.bind(assembly.authorizationService),
-		readWalletSessionAuthorizationV2ByOperationCredential: async (input) => {
-			const authorization = await assembly.authorizationService.readWalletSessionAuthorizationV2ByOperationCredential(input);
-			if (!authorization) return null;
-			const [authority, authMethod] = await Promise.all([assembly.walletAuthorityStore.readById(authorization.session.authorityId), assembly.walletAuthMethodStore.readByIdV2({ walletAuthMethodId: authorization.session.walletAuthMethodId })]);
-			if (!authority || authority.state !== "active" || !authMethod || authMethod.status !== "active") return null;
-			return {
-				authorization,
-				authority,
-				authMethod,
-				retiredAtMs: null
-			};
-		},
+		readWalletSessionAuthorizationV2ByOperationCredential: readActiveWalletSessionCredential.bind(null, assembly.authorizationService),
+		readWalletSessionSigningCandidateByOperationCredential: readWalletSessionSigningCandidate.bind(null, assembly.authorizationService),
 		readWalletSessionExactOperationContextByCredential: assembly.authorizationService.readWalletSessionExactOperationContextByCredential.bind(assembly.authorizationService),
-		readExhaustedWalletSessionAuthorizationV2CandidateByOperationCredential: async (input) => {
-			const status = await assembly.authorizationService.readExactWalletSessionStatusByOperationCredential(input);
-			if (!isExhaustedWalletSessionStatus(status)) return null;
-			const [authority, authMethod] = await Promise.all([assembly.walletAuthorityStore.readById(status.session.authorityId), assembly.walletAuthMethodStore.readByIdV2({ walletAuthMethodId: status.session.walletAuthMethodId })]);
-			if (!authority || authority.state !== "active" || !authMethod || authMethod.status !== "active" || authority.walletId !== status.session.walletId || authority.authorityDigestB64u !== status.session.authorityDigestB64u || authority.revocationEpoch !== status.session.authorityRevocationEpoch || authMethod.walletId !== status.session.walletId || authMethod.walletAuthorityId !== status.session.authorityId || authMethod.walletAuthMethodId !== status.session.walletAuthMethodId) return null;
-			return {
-				status,
-				authority,
-				authMethod,
-				retiredAtMs: null
-			};
-		},
+		readExhaustedWalletSessionAuthorizationV2CandidateByOperationCredential: readExhaustedWalletSessionCredential.bind(null, assembly.authorizationService),
 		readExactWalletSessionStatusByOperationCredential: assembly.authorizationService.readExactWalletSessionStatusByOperationCredential.bind(assembly.authorizationService),
 		mintHostedWalletSeamsSessionExchange: assembly.authorizationService.mintHostedWalletSeamsSessionExchange.bind(assembly.authorizationService),
 		redeemHostedWalletSeamsSessionExchange: assembly.authorizationService.redeemHostedWalletSeamsSessionExchange.bind(assembly.authorizationService),
@@ -1512,19 +1523,6 @@ function createD1AuthorizationSessionRouteService(assembly) {
 		}
 	};
 }
-function createD1AuthorizedOperationRouteService(assembly) {
-	const tenantId = parseTenantId(assembly.options.orgId);
-	if (!tenantId.ok) throw new Error(`orgId cannot identify an authorization tenant: ${tenantId.error.message}`);
-	return {
-		tenantId: tenantId.value,
-		buildVerifiedOwnerProof: assembly.authorizationService.buildVerifiedOwnerProof.bind(assembly.authorizationService),
-		recordVerifiedWalletOperationFactorEvidenceSet: assembly.authorizationService.recordVerifiedWalletOperationFactorEvidenceSet.bind(assembly.authorizationService),
-		readAuthorizedOperationById: assembly.authorizationService.readAuthorizedOperationById.bind(assembly.authorizationService),
-		readAuthorizedOperation: assembly.authorizationService.readAuthorizedOperation.bind(assembly.authorizationService),
-		admitAuthorizedOperation: assembly.authorizationService.admitAuthorizedOperation.bind(assembly.authorizationService),
-		completeAuthorizedOperation: assembly.authorizationService.completeAuthorizedOperation.bind(assembly.authorizationService)
-	};
-}
 function createD1ThresholdRuntimeRouteService(assembly) {
 	return { getRouterAbEcdsaPresignRuntime: () => assembly.options.routerAbEcdsaPresignRuntime || null };
 }

package/dist/esm/router/cloudflare/d1/auth/walletSessionCredentialReaders.js

@@ -0,0 +1,76 @@
+//#region src/router/cloudflare/d1/auth/walletSessionCredentialReaders.ts
+function activeContext(snapshot) {
+	const { authorization, authority, authMethod } = snapshot;
+	if (!authority || authority.state !== "active" || !authMethod || authMethod.status !== "active") return null;
+	return {
+		authorization,
+		authority,
+		authMethod,
+		retiredAtMs: null
+	};
+}
+function exhaustedContext(snapshot) {
+	const { session, quota, authority, authMethod } = snapshot;
+	if (!authority || authority.state !== "active" || !authMethod || authMethod.status !== "active" || authority.walletId !== session.walletId || authority.authorityDigestB64u !== session.authorityDigestB64u || authority.revocationEpoch !== session.authorityRevocationEpoch || authMethod.walletId !== session.walletId || authMethod.walletAuthorityId !== session.authorityId || authMethod.walletAuthMethodId !== session.walletAuthMethodId) return null;
+	return {
+		status: {
+			kind: "exhausted",
+			session,
+			quota
+		},
+		authority,
+		authMethod,
+		retiredAtMs: null
+	};
+}
+async function readActiveWalletSessionCredential(service, input) {
+	const snapshot = await service.readWalletSessionAdmissionSnapshotByOperationCredential(input);
+	if (!snapshot) return null;
+	if (snapshot.kind === "exhausted") throw new Error("Stored V2 Wallet Session quota is no longer active");
+	return activeContext(snapshot);
+}
+async function readWalletSessionSigningCandidate(service, input) {
+	const read = await service.readEcdsaWalletSessionAdmissionSnapshotByOperationCredential(input);
+	if (!read) return null;
+	const { snapshot, materialRead, policyRead } = read;
+	switch (snapshot.kind) {
+		case "active": {
+			const context = activeContext(snapshot);
+			return context ? {
+				kind: "active",
+				context,
+				materialRead,
+				policyRead
+			} : null;
+		}
+		case "exhausted": {
+			const candidate = exhaustedContext(snapshot);
+			if (!candidate) throw new Error("Exhausted Wallet Session authority is unavailable");
+			return {
+				kind: "exhausted",
+				candidate,
+				materialRead,
+				policyRead
+			};
+		}
+		default: {
+			const unexpected = snapshot;
+			throw new Error(`Unsupported Wallet Session snapshot: ${unexpected}`);
+		}
+	}
+}
+async function readExhaustedWalletSessionCredential(service, input) {
+	const { status, authority, authMethod } = await service.readExactWalletSessionStatusSnapshotByOperationCredential(input);
+	if (status.kind !== "exhausted") return null;
+	return exhaustedContext({
+		kind: "exhausted",
+		session: status.session,
+		quota: status.quota,
+		authority,
+		authMethod
+	});
+}
+//#endregion
+export { readActiveWalletSessionCredential, readExhaustedWalletSessionCredential, readWalletSessionSigningCandidate };
+
+//# sourceMappingURL=walletSessionCredentialReaders.js.map