@seams/wallet-server 0.7.1 → 0.7.3

package/dist/esm/localHostedWalletGatewayHandler.js

@@ -2,7 +2,9 @@ import "./shared-ts/src/utils/routerAbEd25519Yao.js";
 import { WALLET_CONSOLE_OP_PATHS_V1 } from "./router/cloudflare/runtime/walletConsoleOps.js";
 import { createStaticWalletConsoleBindingV1, parseStaticWalletConsoleBindingConfigV1 } from "./router/cloudflare/runtime/staticWalletConsoleBinding.js";
 import { handleSplitGatewayRequest } from "./hosted-wallet-gateway.js";
+import { localPresignCancellationProbe } from "./localIntendedPresignCancellation.js";
 import { LOCAL_INTENDED_YAO_FAULT_HEADER_V1, LOCAL_INTENDED_YAO_FAULT_TOKEN_HEADER_V1, LocalIntendedYaoFaultControllerV1, parseLocalIntendedYaoFaultModeV1, parseLocalIntendedYaoFaultTokenV1, requestWithoutLocalIntendedYaoFaultHeadersV1, responseWithLocalIntendedYaoFaultOutcomeV1 } from "./localIntendedYaoFault.js";
+import { localMaterialAdmissionFault } from "./localIntendedMaterialAdmissionFault.js";
 import { LOCAL_INTENDED_ECDSA_FINALIZE_FAULT_HEADER_V1, LOCAL_INTENDED_ECDSA_FINALIZE_FAULT_TOKEN_HEADER_V1, LocalIntendedEcdsaFinalizeFaultControllerV1, parseLocalIntendedEcdsaFinalizeFaultModeV1, parseLocalIntendedEcdsaFinalizeFaultTokenV1, requestWithoutLocalIntendedEcdsaFinalizeFaultHeadersV1, responseWithLocalIntendedEcdsaFinalizeFaultOutcomeV1 } from "./localIntendedEcdsaFinalizeFault.js";
 import { LOCAL_INTENDED_YAO_FINALIZE_FAULT_HEADER_V1, LOCAL_INTENDED_YAO_FINALIZE_FAULT_TOKEN_HEADER_V1, LocalIntendedYaoFinalizeFaultDatabaseV1, parseLocalIntendedYaoFinalizeFaultModeV1, parseLocalIntendedYaoFinalizeFaultTokenV1, requestWithoutLocalIntendedYaoFinalizeFaultHeadersV1, responseWithLocalIntendedYaoFinalizeFaultOutcomeV1 } from "./localIntendedYaoFinalizeFault.js";
 import { LOCAL_INTENDED_YAO_RECOVERY_FAULT_HEADER_V1, LOCAL_INTENDED_YAO_RECOVERY_FAULT_TOKEN_HEADER_V1, LocalIntendedYaoRecoveryFaultControllerV1, parseLocalIntendedYaoRecoveryFaultModeV1, parseLocalIntendedYaoRecoveryFaultTokenV1, releaseLocalIntendedYaoRecoveryExecuteV1, requestWithoutLocalIntendedYaoRecoveryFaultHeadersV1, responseWithLocalIntendedYaoRecoveryFaultOutcomeV1 } from "./localIntendedYaoRecoveryFault.js";
@@ -104,6 +106,8 @@ async function handleLocalHostedWalletGatewayRequestV1(request, env, ctx, depend
 		...env,
 		WALLET_CONSOLE: createStaticWalletConsoleBindingV1(config)
 	};
+	const canceledPresign = await localPresignCancellationProbe(request, gatewayEnv, ctx, dependencies);
+	if (canceledPresign) return canceledPresign;
 	const ecdsaFault = request.headers.get(ECDSA_RESPOND_FAULT_HEADER);
 	if (ecdsaFault !== null) return await handleEcdsaRespondFault(request, gatewayEnv, ctx, dependencies, ecdsaFault, config.deployment.environmentKey, config.deployment.environmentId);
 	const ecdsaFinalizeMode = request.headers.get(LOCAL_INTENDED_ECDSA_FINALIZE_FAULT_HEADER_V1);
@@ -127,6 +131,15 @@ async function handleLocalHostedWalletGatewayRequestV1(request, env, ctx, depend
 	const revokeMode = request.headers.get(LOCAL_INTENDED_REVOKE_FAULT_HEADER_V1);
 	const revokeToken = request.headers.get(LOCAL_INTENDED_REVOKE_FAULT_TOKEN_HEADER_V1);
 	if (revokeMode !== null || revokeToken !== null) return await handleRevokeFault(request, gatewayEnv, ctx, dependencies, revokeMode, revokeToken);
+	const materialFault = localMaterialAdmissionFault(request, gatewayEnv.SIGNER_DB);
+	if (materialFault instanceof Response) return materialFault;
+	if (materialFault) {
+		const response = await handleSplitGatewayRequest(materialFault.request, {
+			...gatewayEnv,
+			SIGNER_DB: materialFault.database
+		}, ctx, dependencies);
+		return materialFault.database.response(response, materialFault.token);
+	}
 	const admissionMode = request.headers.get(LOCAL_INTENDED_SESSION_ADMISSION_FAULT_HEADER_V1);
 	const admissionToken = request.headers.get(LOCAL_INTENDED_SESSION_ADMISSION_FAULT_TOKEN_HEADER_V1);
 	if (admissionMode !== null || admissionToken !== null) return await handleSessionAdmissionFault(request, gatewayEnv, ctx, dependencies, admissionMode, admissionToken);

package/dist/esm/localIntendedMaterialAdmissionFault.js

@@ -0,0 +1,176 @@
+import { isPlainObject } from "./shared-ts/src/utils/validation.js";
+import { isLocalIntendedYaoFaultTokenV1 } from "./localIntendedYaoFault.js";
+//#region src/localIntendedMaterialAdmissionFault.ts
+const MODE_HEADER = "x-seams-intended-material-admission-fault-v1";
+const TOKEN_HEADER = "x-seams-intended-material-admission-token-v1";
+const PROOF_HEADER = "x-seams-intended-material-admission-proof-v1";
+const SCOPE_PREDICATE = "namespace = ? AND org_id = ? AND project_id = ? AND env_id = ? AND wallet_id = ?";
+function localMaterialAdmissionFault(request, database) {
+	const raw = request.headers.get(MODE_HEADER);
+	const token = request.headers.get(TOKEN_HEADER);
+	if (raw === null && token === null) return null;
+	const url = new URL(request.url);
+	if (url.protocol !== "http:" || url.hostname !== "127.0.0.1" || request.method !== "POST" || !["/router-ab/ecdsa-derivation/sign/prepare", "/router-ab/ecdsa-derivation/sign"].includes(url.pathname) || !isLocalIntendedYaoFaultTokenV1(token) || raw !== "canonical_claim" && raw !== "canonical_existing" && raw !== "linked_claim" && raw !== "linked_existing") return Response.json({ code: "invalid_intended_material_admission_fault" }, { status: 400 });
+	const headers = new Headers(request.headers);
+	headers.delete(MODE_HEADER);
+	headers.delete(TOKEN_HEADER);
+	return {
+		database: new LocalMaterialAdmissionFaultDatabase(database, raw),
+		request: new Request(request, { headers }),
+		token
+	};
+}
+/** Retire material after resolution and before one admission statement, then restore it. */
+var LocalMaterialAdmissionFaultDatabase = class {
+	constructor(base, mode) {
+		this.base = base;
+		this.mode = mode;
+		this.scope = null;
+		this.state = { kind: "armed" };
+	}
+	prepare(query) {
+		const inner = this.base.prepare(query);
+		if (/^\s*INSERT INTO authorized_operations/.test(query)) return new FaultStatement(this, inner, "claim");
+		if (query.includes("AS material_snapshot_active")) return new FaultStatement(this, inner, "existing");
+		if (query.includes("AS ecdsa_material_records_json")) return new FaultStatement(this, inner, "material");
+		return inner;
+	}
+	captureScope(values) {
+		const scope = values.slice(0, 5);
+		const strings = [];
+		for (const value of scope) {
+			if (typeof value !== "string" || value.length === 0) throw new Error("Invalid material fault scope");
+			strings.push(value);
+		}
+		if (strings.length !== 5) throw new Error("Material fault did not observe a scoped material read");
+		this.scope = strings;
+	}
+	async batch(statements) {
+		const roles = statements.filter(isFaultStatement).map(statementRole);
+		const boundary = this.mode.endsWith("_claim") ? "claim" : "existing";
+		return this.execute(statements.map(unwrap), roles.includes(boundary) ? boundary : "material");
+	}
+	exec(query) {
+		return this.base.exec(query);
+	}
+	async first(statement, columnName) {
+		if (statement.role === "material") {
+			const row = await statement.inner.first(columnName);
+			if (isPlainObject(row)) this.captureScope([
+				row.session_namespace,
+				row.session_org_id,
+				row.session_project_id,
+				row.session_env_id,
+				row.session_wallet_id
+			]);
+			return row;
+		}
+		if (!this.shouldRetire(statement.role)) return statement.inner.first(columnName);
+		if (columnName !== void 0) throw new Error("Material admission reads must return a row");
+		const [result] = await this.execute([statement.inner], statement.role);
+		return result?.results?.[0] ?? null;
+	}
+	shouldRetire(role) {
+		return role === (this.mode.endsWith("_claim") ? "claim" : "existing") && this.state.kind === "armed";
+	}
+	async execute(statements, role) {
+		if (!this.shouldRetire(role)) return this.base.batch(statements);
+		if (!this.scope) throw new Error("Material fault has no scoped read");
+		const { table, key, column } = this.target();
+		const predicate = this.mode.startsWith("canonical") ? `${SCOPE_PREDICATE} AND signer_family = 'ecdsa'` : SCOPE_PREDICATE;
+		const result = await this.base.prepare(`SELECT ${key} AS record_key, ${column} AS record_value FROM ${table} WHERE ${predicate}`).bind(...this.scope).all();
+		const records = [];
+		for (const row of result.results ?? []) {
+			const value = row.record_value;
+			if (typeof row.record_key !== "string" || value !== null && typeof value !== "number" && typeof value !== "string") throw new Error("Invalid material fault backup");
+			records.push({
+				key: row.record_key,
+				value
+			});
+		}
+		if (records.length === 0) throw new Error("Material fault did not find custody records");
+		const replacement = this.mode.startsWith("canonical") ? "json_set(record_json, '$.walletKey.publicCapability.material_activation.lifecycle_binding', 'retired-by-intended-test')" : "NULL";
+		const retire = this.base.prepare(`UPDATE ${table} SET ${column} = ${replacement} WHERE ${predicate}`).bind(...this.scope);
+		const restore = [];
+		for (const record of records) restore.push(this.base.prepare(`UPDATE ${table} SET ${column} = ? WHERE ${predicate} AND ${key} = ?`).bind(record.value, ...this.scope, record.key));
+		const quota = this.base.prepare(`SELECT COALESCE(SUM(quota.remaining_uses), 0) AS remaining
+         FROM authorization_wallet_session_quotas AS quota
+         JOIN wallet_session_authorizations_v2 AS session
+           ON session.namespace = quota.namespace AND session.tenant_id = quota.tenant_id
+          AND session.quota_id = quota.quota_id
+        WHERE session.namespace = ? AND session.org_id = ? AND session.project_id = ?
+          AND session.env_id = ? AND session.wallet_id = ?`).bind(...this.scope);
+		const results = await this.base.batch([
+			quota,
+			retire,
+			...statements,
+			...restore,
+			quota
+		]);
+		this.state = {
+			kind: "restored",
+			rows: records.length,
+			quotaBefore: quotaTotal(results[0]),
+			quotaAfter: quotaTotal(results.at(-1))
+		};
+		return results.slice(2, 2 + statements.length);
+	}
+	response(response, token) {
+		const headers = new Headers(response.headers);
+		headers.set(PROOF_HEADER, this.state.kind === "restored" ? `${token}:${this.mode}:${this.state.rows}:${this.state.quotaBefore}:${this.state.quotaAfter}` : `${token}:not_observed`);
+		return new Response(response.body, {
+			status: response.status,
+			statusText: response.statusText,
+			headers
+		});
+	}
+	target() {
+		return this.mode.startsWith("canonical") ? {
+			table: "wallet_signers",
+			key: "signer_id",
+			column: "record_json"
+		} : {
+			table: "linked_device_authority_installations",
+			key: "link_session_id",
+			column: "activated_at_ms"
+		};
+	}
+};
+var FaultStatement = class FaultStatement {
+	constructor(database, inner, role) {
+		this.database = database;
+		this.inner = inner;
+		this.role = role;
+	}
+	bind(...values) {
+		return new FaultStatement(this.database, this.inner.bind(...values), this.role);
+	}
+	async first(columnName) {
+		return this.database.first(this, columnName);
+	}
+	all() {
+		return this.inner.all();
+	}
+	run() {
+		return this.inner.run();
+	}
+};
+function unwrap(statement) {
+	return statement instanceof FaultStatement ? statement.inner : statement;
+}
+function isFaultStatement(statement) {
+	return statement instanceof FaultStatement;
+}
+function statementRole(statement) {
+	return statement.role;
+}
+function quotaTotal(result) {
+	if (!isPlainObject(result) || !Array.isArray(result.results)) throw new Error("Material fault quota result is unavailable");
+	const row = result.results[0];
+	if (!isPlainObject(row) || typeof row.remaining !== "number" || !Number.isSafeInteger(row.remaining)) throw new Error("Material fault quota total is invalid");
+	return row.remaining;
+}
+//#endregion
+export { localMaterialAdmissionFault };
+
+//# sourceMappingURL=localIntendedMaterialAdmissionFault.js.map

package/dist/esm/localIntendedPresignCancellation.js

@@ -0,0 +1,44 @@
+import { handleSplitGatewayRequest } from "./hosted-wallet-gateway.js";
+//#region src/localIntendedPresignCancellation.ts
+const held = /* @__PURE__ */ new Set();
+const header = "x-seams-intended-presign-cancellation";
+const initPath = "/router-ab/ecdsa-derivation/presignature-pool/fill/init";
+var HeldPresignProxy = class {
+	constructor(token) {
+		this.token = token;
+	}
+	async fetch() {
+		held.add(this.token);
+		await new Promise(resolveHeldPresign);
+		held.delete(this.token);
+		return Response.json({
+			ok: false,
+			code: "temporarily_unavailable"
+		}, { status: 503 });
+	}
+};
+function resolveHeldPresign(resolve) {
+	setTimeout(resolve, 3e4);
+}
+async function localPresignCancellationProbe(request, env, ctx, dependencies) {
+	const token = request.headers.get(header);
+	if (token === null) return null;
+	const url = new URL(request.url);
+	if (url.protocol !== "http:" || url.hostname !== "127.0.0.1" || url.pathname !== initPath || !/^[0-9a-f-]{36}$/u.test(token)) return Response.json({ code: "invalid_presign_cancellation_probe" }, { status: 400 });
+	if (request.method === "GET") return Response.json({ held: held.has(token) });
+	if (request.method === "DELETE") {
+		held.delete(token);
+		return new Response(null, { status: 204 });
+	}
+	if (request.method !== "POST") return new Response(null, { status: 405 });
+	const headers = new Headers(request.headers);
+	headers.delete(header);
+	return handleSplitGatewayRequest(new Request(request, { headers }), {
+		...env,
+		SIGNING_WORKER: new HeldPresignProxy(token)
+	}, ctx, dependencies);
+}
+//#endregion
+export { localPresignCancellationProbe };
+
+//# sourceMappingURL=localIntendedPresignCancellation.js.map

package/dist/esm/router/auth/commonRouterUtils.js

@@ -191,32 +191,46 @@ async function validateRouterAbEcdsaDerivationWalletSessionInputs(input) {
 	const token = extractBearerCredential(input.headers);
 	if (!token) return walletSessionFailure("wallet_session_missing");
 	const nowMs = input.nowMs || Date.now;
-	let resolution;
+	let candidate;
 	try {
-		resolution = await resolveWalletSessionOperationCredentialAdmission({
-			authorizationSessions,
+		candidate = await authorizationSessions.readWalletSessionSigningCandidateByOperationCredential({
+			tenantId: authorizationSessions.tenantId,
 			token,
 			nowMs: nowMs(),
-			operation: {
-				keyFamily: "ecdsa_secp256k1",
-				operationKind: input.operationKind
-			}
+			materialActivation: input.materialActivation
 		});
 	} catch {
 		return walletSessionFailure("wallet_session_unavailable");
 	}
-	if (resolution.kind === "rejected") return walletSessionFailure("wallet_session_scope_mismatch");
-	if (resolution.kind === "not_found") return {
+	if (!candidate) return {
 		ok: false,
 		code: "wallet_session_invalid",
 		message: walletSessionFailureMessage("wallet_session_invalid")
 	};
+	if (candidate.kind === "exhausted") return {
+		ok: true,
+		kind: "wallet_session_operation_credential_exhausted_candidate_v1",
+		candidate: candidate.candidate,
+		materialRead: candidate.materialRead,
+		policyRead: candidate.policyRead
+	};
+	const resolution = resolveWalletSessionOperationCredentialAdmissionFromContext({
+		context: candidate.context,
+		nowMs: nowMs(),
+		operation: {
+			keyFamily: "ecdsa_secp256k1",
+			operationKind: input.operationKind
+		}
+	});
+	if (resolution.kind === "rejected") return walletSessionFailure("wallet_session_scope_mismatch");
 	if (resolution.admission.curve !== "ecdsa") return walletSessionFailure("wallet_session_scope_mismatch");
 	return {
 		ok: true,
 		kind: "wallet_session_operation_credential_v1",
 		admission: resolution.admission,
-		context: resolution.admission.context
+		context: resolution.admission.context,
+		materialRead: candidate.materialRead,
+		policyRead: candidate.policyRead
 	};
 }
 async function resolveThresholdRuntimePolicyScope(input) {

package/dist/esm/router/auth/walletSessionFailure.js

@@ -1,3 +1,4 @@
+import { failure } from "../../shared-ts/src/utils/failure.js";
 //#region src/router/auth/walletSessionFailure.ts
 function walletSessionFailureMessage(code) {
 	switch (code) {
@@ -24,11 +25,7 @@ function walletSessionFailureStatus(code) {
 	}
 }
 function walletSessionFailure(code) {
-	return {
-		ok: false,
-		code,
-		message: walletSessionFailureMessage(code)
-	};
+	return failure(code, walletSessionFailureMessage(code));
 }
 //#endregion
 export { walletSessionFailure, walletSessionFailureMessage, walletSessionFailureStatus };

package/dist/esm/router/auth/webAuthnCredentialCodecs.js

@@ -2,6 +2,7 @@ import { base64Decode, base64UrlDecode, base64UrlEncode } from "../../shared-ts/
 import "../../shared-ts/src/utils/encoders.js";
 import { normalizeOptionalTrimmedString } from "../../shared-ts/src/utils/normalize.js";
 import "../../shared-ts/src/utils/validation.js";
+import { failure } from "../../shared-ts/src/utils/failure.js";
 import { errorMessage } from "../../shared-ts/src/utils/errors.js";
 //#region src/router/auth/webAuthnCredentialCodecs.ts
 function decodeWebAuthnBase64UrlOrBase64(input, fieldName) {
@@ -45,30 +46,18 @@ function webAuthnOriginHostnameOrEmpty(origin) {
 	}
 }
 function webAuthnCredentialIdB64uFromCredential(input) {
-	if (input === null || typeof input !== "object" || Array.isArray(input)) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Missing webauthn_authentication.id/rawId"
-	};
+	if (input === null || typeof input !== "object" || Array.isArray(input)) return failure("invalid_body", "Missing webauthn_authentication.id/rawId");
 	const rawId = normalizeOptionalTrimmedString(Reflect.get(input, "rawId"));
 	const id = normalizeOptionalTrimmedString(Reflect.get(input, "id"));
 	const selected = rawId || id;
-	if (!selected) return {
-		ok: false,
-		code: "invalid_body",
-		message: "Missing webauthn_authentication.id/rawId"
-	};
+	if (!selected) return failure("invalid_body", "Missing webauthn_authentication.id/rawId");
 	try {
 		return {
 			ok: true,
 			credentialIdB64u: base64UrlEncode(decodeWebAuthnBase64UrlOrBase64(selected, "webauthn_authentication.rawId"))
 		};
 	} catch (error) {
-		return {
-			ok: false,
-			code: "invalid_body",
-			message: errorMessage(error) || "Invalid credential rawId"
-		};
+		return failure("invalid_body", errorMessage(error) || "Invalid credential rawId");
 	}
 }
 function parseWebAuthnAuthenticationCredential(input) {

package/dist/esm/router/cloudflare/d1/auth/d1AuthorizedOperationRouteService.js

@@ -5,6 +5,7 @@ function createD1AuthorizedOperationRouteService(assembly) {
 	if (!tenantId.ok) throw new Error(`orgId cannot identify an authorization tenant: ${tenantId.error.message}`);
 	return {
 		tenantId: tenantId.value,
+		resolveEcdsaWalletSessionOperation: assembly.authorizationStore.resolveEcdsaWalletSessionOperation.bind(assembly.authorizationStore),
 		admitEcdsaWalletSessionOperation: assembly.authorizationStore.admitEcdsaWalletSessionOperation.bind(assembly.authorizationStore),
 		readPinnedOwnerWalletScope: assembly.authorizationStore.readPinnedOwnerWalletScope.bind(assembly.authorizationStore),
 		buildVerifiedOwnerProof: assembly.authorizationService.buildVerifiedOwnerProof.bind(assembly.authorizationService),

package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthBoundary.js

@@ -1,4 +1,5 @@
 import { hasWhitespaceOrControlCharacters, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { toArrayBufferCopy } from "../../../../core/authService/portableCrypto.js";
 //#region src/router/cloudflare/d1/auth/d1RouterApiAuthBoundary.ts
 function parseD1BoundaryWalletIdResult(raw) {
 	const parsed = parseWalletId(raw);
@@ -64,11 +65,6 @@ function d1MutationChanges(result) {
 	const meta = result.meta;
 	return parseD1NonNegativeCount(meta?.changes ?? meta?.rows_written);
 }
-function toArrayBufferCopy(bytes) {
-	const out = new ArrayBuffer(bytes.byteLength);
-	new Uint8Array(out).set(bytes);
-	return out;
-}
 async function sha256BytesPortable(input) {
 	const subtle = globalThis.crypto?.subtle;
 	if (subtle && typeof subtle.digest === "function") return new Uint8Array(await subtle.digest("SHA-256", toArrayBufferCopy(input)));
@@ -79,6 +75,6 @@ async function sha256BytesPortable(input) {
 	throw new Error("SHA-256 digest is unavailable in this runtime");
 }
 //#endregion
-export { d1MutationChanges, isB64uString, nonNegativeSafeInteger, optionalNonNegativeInteger, parseD1BoundaryWalletId, parseD1BoundaryWalletIdResult, parseD1NonNegativeCount, parseJsonObject, positiveInteger, positiveSafeInteger, sha256BytesPortable, toArrayBufferCopy, toRecordValue };
+export { d1MutationChanges, isB64uString, nonNegativeSafeInteger, optionalNonNegativeInteger, parseD1BoundaryWalletId, parseD1BoundaryWalletIdResult, parseD1NonNegativeCount, parseJsonObject, positiveInteger, positiveSafeInteger, sha256BytesPortable, toRecordValue };
 
 //# sourceMappingURL=d1RouterApiAuthBoundary.js.map

package/dist/esm/router/cloudflare/d1/auth/d1RouterApiAuthService.js

@@ -19,12 +19,14 @@ import { sha256BytesPortable, toRecordValue } from "./d1RouterApiAuthBoundary.js
 import { CloudflareD1WebAuthnStore } from "../webauthn/d1WebAuthnStore.js";
 import { verifyD1LinkedDeviceFreshRevokeProofV1 } from "../wallet/d1WalletAuthMethodBoundary.js";
 import { CloudflareD1WebAuthnAuthService } from "../webauthn/d1WebAuthnAuthService.js";
+import { D1LinkedDeviceAuthorityInstallServiceV1 } from "../deviceLinking/d1LinkedDeviceAuthorityInstallService.js";
 import { D1WalletAuthorityStore } from "../wallet/d1WalletAuthorityStore.js";
 import { CloudflareD1AuthorizationStore } from "../authorization/d1AuthorizationStore.js";
 import { createCloudflareD1VersionedJsonRecordStore } from "../versionedJson/d1VersionedJsonRecordStore.js";
 import { parseRouterAbEd25519YaoRegistrationSideEffectRecordV2, runRouterAbEd25519YaoRegistrationSideEffectV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
 import { createCloudflareOrdinaryInactiveSignerMaterialActivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialDeactivationPortV1, createCloudflareOrdinaryInactiveSignerMaterialReservationServiceV1 } from "../../signingLanes/cloudflareOrdinaryInactiveSignerMaterialReservation.js";
 import { normalizeD1RouterApiAuthOptions } from "./d1RouterApiAuthConfig.js";
+import { readActiveWalletSessionCredential, readExhaustedWalletSessionCredential, readWalletSessionSigningCandidate } from "./walletSessionCredentialReaders.js";
 import { createD1AuthorizedOperationRouteService } from "./d1AuthorizedOperationRouteService.js";
 import { parseRegistrationEstablishedSessionProjectionV2 } from "../../../../shared-ts/src/utils/registrationEstablishedSession.js";
 import { D1IdentityStore } from "../../../../core/d1IdentityStore.js";
@@ -68,7 +70,6 @@ import { createD1LinkedDeviceSessionServiceV1 } from "../deviceLinking/d1LinkedD
 import { D1LinkedDeviceSessionStoreV1 } from "../deviceLinking/d1LinkedDeviceSessionStore.js";
 import { createD1LinkedDeviceRouteServiceV1 } from "../deviceLinking/d1LinkedDeviceRouteService.js";
 import { D1LinkedDeviceEmailOtpGrantStoreV1 } from "../deviceLinking/d1LinkedDeviceEmailOtpGrantStore.js";
-import { D1LinkedDeviceAuthorityInstallServiceV1 } from "../deviceLinking/d1LinkedDeviceAuthorityInstallService.js";
 import { createD1LinkedDeviceManagementServiceV1 } from "../deviceLinking/d1LinkedDeviceManagementService.js";
 import { createD1LinkedDeviceRevocationV1 } from "../deviceLinking/d1LinkedDeviceRevocation.js";
 import { createD1LinkedDeviceVerifiedLinkSourceReaderV1 } from "../deviceLinking/d1LinkedDeviceVerifiedLinkSourceReader.js";
@@ -1490,39 +1491,16 @@ function createD1IdentityRouteService(assembly) {
 		verifyGithubOAuthCode: assembly.oidcVerification.verifyGithubOAuthCode.bind(assembly.oidcVerification)
 	};
 }
-function isExhaustedWalletSessionStatus(status) {
-	return status.kind === "exhausted";
-}
 function createD1AuthorizationSessionRouteService(assembly) {
 	const tenantId = parseTenantId(assembly.options.orgId);
 	if (!tenantId.ok) throw new Error(`orgId cannot identify an authorization tenant: ${tenantId.error.message}`);
 	return {
 		tenantId: tenantId.value,
 		issueDirectWalletSessionAuthorizationV2: assembly.authorizationService.issueDirectWalletSessionAuthorizationV2.bind(assembly.authorizationService),
-		readWalletSessionAuthorizationV2ByOperationCredential: async (input) => {
-			const snapshot = await assembly.authorizationService.readWalletSessionAdmissionSnapshotByOperationCredential(input);
-			if (!snapshot) return null;
-			const { authorization, authority, authMethod } = snapshot;
-			if (!authority || authority.state !== "active" || !authMethod || authMethod.status !== "active") return null;
-			return {
-				authorization,
-				authority,
-				authMethod,
-				retiredAtMs: null
-			};
-		},
+		readWalletSessionAuthorizationV2ByOperationCredential: readActiveWalletSessionCredential.bind(null, assembly.authorizationService),
+		readWalletSessionSigningCandidateByOperationCredential: readWalletSessionSigningCandidate.bind(null, assembly.authorizationService),
 		readWalletSessionExactOperationContextByCredential: assembly.authorizationService.readWalletSessionExactOperationContextByCredential.bind(assembly.authorizationService),
-		readExhaustedWalletSessionAuthorizationV2CandidateByOperationCredential: async (input) => {
-			const { status, authority, authMethod } = await assembly.authorizationService.readExactWalletSessionStatusSnapshotByOperationCredential(input);
-			if (!isExhaustedWalletSessionStatus(status)) return null;
-			if (!authority || authority.state !== "active" || !authMethod || authMethod.status !== "active" || authority.walletId !== status.session.walletId || authority.authorityDigestB64u !== status.session.authorityDigestB64u || authority.revocationEpoch !== status.session.authorityRevocationEpoch || authMethod.walletId !== status.session.walletId || authMethod.walletAuthorityId !== status.session.authorityId || authMethod.walletAuthMethodId !== status.session.walletAuthMethodId) return null;
-			return {
-				status,
-				authority,
-				authMethod,
-				retiredAtMs: null
-			};
-		},
+		readExhaustedWalletSessionAuthorizationV2CandidateByOperationCredential: readExhaustedWalletSessionCredential.bind(null, assembly.authorizationService),
 		readExactWalletSessionStatusByOperationCredential: assembly.authorizationService.readExactWalletSessionStatusByOperationCredential.bind(assembly.authorizationService),
 		mintHostedWalletSeamsSessionExchange: assembly.authorizationService.mintHostedWalletSeamsSessionExchange.bind(assembly.authorizationService),
 		redeemHostedWalletSeamsSessionExchange: assembly.authorizationService.redeemHostedWalletSeamsSessionExchange.bind(assembly.authorizationService),

package/dist/esm/router/cloudflare/d1/auth/walletSessionCredentialReaders.js

@@ -0,0 +1,76 @@
+//#region src/router/cloudflare/d1/auth/walletSessionCredentialReaders.ts
+function activeContext(snapshot) {
+	const { authorization, authority, authMethod } = snapshot;
+	if (!authority || authority.state !== "active" || !authMethod || authMethod.status !== "active") return null;
+	return {
+		authorization,
+		authority,
+		authMethod,
+		retiredAtMs: null
+	};
+}
+function exhaustedContext(snapshot) {
+	const { session, quota, authority, authMethod } = snapshot;
+	if (!authority || authority.state !== "active" || !authMethod || authMethod.status !== "active" || authority.walletId !== session.walletId || authority.authorityDigestB64u !== session.authorityDigestB64u || authority.revocationEpoch !== session.authorityRevocationEpoch || authMethod.walletId !== session.walletId || authMethod.walletAuthorityId !== session.authorityId || authMethod.walletAuthMethodId !== session.walletAuthMethodId) return null;
+	return {
+		status: {
+			kind: "exhausted",
+			session,
+			quota
+		},
+		authority,
+		authMethod,
+		retiredAtMs: null
+	};
+}
+async function readActiveWalletSessionCredential(service, input) {
+	const snapshot = await service.readWalletSessionAdmissionSnapshotByOperationCredential(input);
+	if (!snapshot) return null;
+	if (snapshot.kind === "exhausted") throw new Error("Stored V2 Wallet Session quota is no longer active");
+	return activeContext(snapshot);
+}
+async function readWalletSessionSigningCandidate(service, input) {
+	const read = await service.readEcdsaWalletSessionAdmissionSnapshotByOperationCredential(input);
+	if (!read) return null;
+	const { snapshot, materialRead, policyRead } = read;
+	switch (snapshot.kind) {
+		case "active": {
+			const context = activeContext(snapshot);
+			return context ? {
+				kind: "active",
+				context,
+				materialRead,
+				policyRead
+			} : null;
+		}
+		case "exhausted": {
+			const candidate = exhaustedContext(snapshot);
+			if (!candidate) throw new Error("Exhausted Wallet Session authority is unavailable");
+			return {
+				kind: "exhausted",
+				candidate,
+				materialRead,
+				policyRead
+			};
+		}
+		default: {
+			const unexpected = snapshot;
+			throw new Error(`Unsupported Wallet Session snapshot: ${unexpected}`);
+		}
+	}
+}
+async function readExhaustedWalletSessionCredential(service, input) {
+	const { status, authority, authMethod } = await service.readExactWalletSessionStatusSnapshotByOperationCredential(input);
+	if (status.kind !== "exhausted") return null;
+	return exhaustedContext({
+		kind: "exhausted",
+		session: status.session,
+		quota: status.quota,
+		authority,
+		authMethod
+	});
+}
+//#endregion
+export { readActiveWalletSessionCredential, readExhaustedWalletSessionCredential, readWalletSessionSigningCandidate };
+
+//# sourceMappingURL=walletSessionCredentialReaders.js.map

package/dist/esm/router/cloudflare/d1/authorization/authorizedOperationStatements.js

@@ -61,7 +61,11 @@ function prepareAuthorizedOperationRead(database, namespace, input) {
       LIMIT 1`).bind(namespace, input.tenantId, input.operationFingerprintDigest);
 }
 function prepareAuthorizedOperationAdmissionRead(input) {
-	return input.database.prepare(`SELECT operation.*, ${PINNED_OWNER_WALLET},
+	const material = input.materialSnapshot?.condition(input.walletSignerScope) ?? {
+		sql: "1",
+		bindings: []
+	};
+	return input.database.prepare(`SELECT operation.*, ${PINNED_OWNER_WALLET}, (${material.sql}) AS material_snapshot_active,
             CASE operation.authorization_source_kind
               WHEN 'authorization_grant' THEN EXISTS (
                 SELECT 1
@@ -117,7 +121,7 @@ function prepareAuthorizedOperationAdmissionRead(input) {
        FROM authorized_operations AS operation
       WHERE operation.namespace = ? AND operation.tenant_id = ?
         AND operation.operation_fingerprint_digest = ?
-      LIMIT 1`).bind(input.walletSignerScope.orgId, input.walletSignerScope.projectId, input.walletSignerScope.envId, input.nowMs, input.nowMs, input.namespace, input.tenantId, input.operationFingerprintDigest);
+      LIMIT 1`).bind(...material.bindings, input.walletSignerScope.orgId, input.walletSignerScope.projectId, input.walletSignerScope.envId, input.nowMs, input.nowMs, input.namespace, input.tenantId, input.operationFingerprintDigest);
 }
 function prepareAuthorizedOperationInsert(input) {
 	const { database, namespace, walletSignerScope, operation, material } = input;
@@ -165,7 +169,27 @@ function prepareAuthorizedOperationInsert(input) {
 		source.kind === "authorization_grant" ? walletSignerScope.projectId : null,
 		source.kind === "authorization_grant" ? walletSignerScope.envId : null
 	];
-	return material?.kind === "ecdsa_material_activation" ? database.prepare(`INSERT INTO authorized_operations (
+	let condition = input.materialSnapshot?.condition(walletSignerScope) ?? null;
+	if (condition === null) condition = material?.kind === "ecdsa_material_activation" ? {
+		sql: ECDSA_SIGNER_MATCH,
+		bindings: ecdsaSignerMatchBindings(walletSignerScope, material)
+	} : {
+		sql: "1",
+		bindings: []
+	};
+	const absence = input.existingOperation === "preserve" ? {
+		sql: `NOT EXISTS (SELECT 1 FROM authorized_operations
+               WHERE namespace = ? AND tenant_id = ? AND operation_fingerprint_digest = ?)`,
+		bindings: [
+			namespace,
+			operation.tenantId,
+			operation.operationFingerprintDigest
+		]
+	} : {
+		sql: "1",
+		bindings: []
+	};
+	return database.prepare(`INSERT INTO authorized_operations (
           namespace, tenant_id, authorized_operation_id, audit_event_id,
           principal_id, capability_id, capability_kind, operation_kind, operation_id,
           operation_fingerprint_digest, lane_digest, intent_digest, display_digest,
@@ -183,24 +207,7 @@ function prepareAuthorizedOperationInsert(input) {
         ) SELECT ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?,
                   'claimed', 'pending', NULL, NULL, NULL, NULL, ?, NULL, ?,
                   ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?
-           WHERE ${ECDSA_SIGNER_MATCH}`).bind(...values, ...ecdsaSignerMatchBindings(walletSignerScope, material)) : database.prepare(`INSERT INTO authorized_operations (
-          namespace, tenant_id, authorized_operation_id, audit_event_id,
-          principal_id, capability_id, capability_kind, operation_kind, operation_id,
-          operation_fingerprint_digest, lane_digest, intent_digest, display_digest,
-          authorization_source_kind, authorization_id, evidence_set_digest,
-          quota_id, quota_kind, authorization_grant_kind, lifecycle_kind, result_kind,
-          result_digest, result_status, result_content_type, result_body_text,
-          claimed_at_ms, completed_at_ms,
-          material_activation_id, material_activation_capability,
-          material_activation_owner, material_activation_key_binding,
-          material_activation_lifecycle_binding, material_activation_signing_worker,
-          linked_wallet_id, linked_enrollment_id, linked_device_id,
-          linked_wallet_key_id, linked_lane_id, linked_lane_share_epoch,
-          linked_revocation_epoch, linked_scope_org_id, linked_scope_project_id,
-          linked_scope_env_id
-        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?,
-                  'claimed', 'pending', NULL, NULL, NULL, NULL, ?, NULL, ?,
-                  ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).bind(...values);
+           WHERE (${condition.sql}) AND (${absence.sql})`).bind(...values, ...condition.bindings, ...absence.bindings);
 }
 //#endregion
 export { prepareAuthorizedOperationAdmissionRead, prepareAuthorizedOperationCommittedRead, prepareAuthorizedOperationInsert, prepareAuthorizedOperationRead };