@seams/wallet-server 0.7.1 → 0.7.3

package/dist/esm/router/cloudflare/d1/authorization/d1AuthorizationStore.js

@@ -2,11 +2,15 @@ import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/
 import { CAPABILITY_KINDS, parseAuthorizationAuditEventId, parseAuthorizationGrantRef, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parseCapabilityOperationRef, parseMpcWalletSigningQuotaId, parsePrincipalId, parseTenantId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { buildCapabilityOperationEnvelope, computeCapabilityOperationFingerprintDigest, parseCapabilityOperationFingerprintDigest } from "../../../../shared-ts/src/authorization/operationFingerprint.js";
-import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { buildActiveWalletSessionQuota, buildAuthorizedOperation, buildExactWalletSessionQuotaProjectionV1, computeAuthorizedOperationResultDigest, exactWalletSessionCapabilitySubjectsResolveAuthority, parseAuthorizedOperationReplayResponse, parseHostedWalletSessionCredentialId, parseSessionOrigin, parseWalletSessionAuthorizationV2, walletSessionAuthorizationV2RecordsEqual } from "../../../../authorization/domain.js";
+import { ECDSA_INSTALLATION_SNAPSHOT_COLUMNS } from "../../../../core/ecdsaMaterialReadSnapshot.js";
 import { d1ChangedRows, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
+import { EcdsaMaterialRead } from "../../../../core/d1EcdsaSignerRead.js";
 import { D1WalletStore } from "../../../../core/d1WalletStore.js";
 import { normalizeWalletAuthMethodV2 } from "../../../../core/d1WalletAuthMethodStore.js";
+import { D1EcdsaAdmissionPolicyRead, ECDSA_CREDENTIAL_POLICY_PROJECTION } from "../signingAdmission/d1RouterAbNormalSigningAdmissionStore.js";
+import { parseInstalledEcdsaCustodySnapshotV1 } from "../deviceLinking/d1LinkedDeviceAuthorityInstallService.js";
 import { prepareAuthorizedOperationAdmissionRead, prepareAuthorizedOperationCommittedRead, prepareAuthorizedOperationInsert, prepareAuthorizedOperationRead } from "./authorizedOperationStatements.js";
 import { prepareD1WalletSessionAuthorityProjectionStatements } from "./walletSessionAuthorityProjection.js";
 import { parseD1WalletAuthorityRow } from "../wallet/d1WalletAuthorityStore.js";
@@ -931,6 +935,7 @@ var CloudflareD1AuthorizationStore = class {
 	}
 	async readLiveWalletSessionAuthorizationProjectionV2(input) {
 		const row = await this.readJoinedWalletSessionAuthorizationV2Row({
+			projection: { kind: "session" },
 			lookupColumn: "authorization_id",
 			tenantId: input.expected.tenantId,
 			lookupValue: input.expected.authorizationId
@@ -989,26 +994,42 @@ var CloudflareD1AuthorizationStore = class {
 	*/
 	async readWalletSessionAdmissionSnapshotByOperationCredential(input) {
 		const row = await this.readJoinedWalletSessionAuthorizationV2Row({
+			projection: { kind: "session" },
 			lookupColumn: "operation_credential_hash",
 			tenantId: input.tenantId,
 			lookupValue: input.tokenHash
 		});
 		if (!row) return null;
-		const session = parseLiveWalletSessionAuthorizationV2Row(row, {
-			operationCredentialHash: input.tokenHash,
+		return parseWalletSessionAdmissionRow(row, input);
+	}
+	async readEcdsaWalletSessionAdmissionSnapshotByOperationCredential(input) {
+		const row = await this.readJoinedWalletSessionAuthorizationV2Row({
+			projection: {
+				kind: "ecdsa_material",
+				materialActivation: input.materialActivation
+			},
+			lookupColumn: "operation_credential_hash",
 			tenantId: input.tenantId,
-			nowMs: input.nowMs
+			lookupValue: input.tokenHash
 		});
+		if (!row) return null;
+		const snapshot = await parseWalletSessionAdmissionRow(row, input);
+		const session = snapshot.kind === "active" ? snapshot.authorization.session : snapshot.session;
 		return {
-			authorization: {
-				session,
-				quota: parseWalletSessionAuthorizationV2QuotaRow(row, session)
-			},
-			...await joinedAuthorityAndMethod(row)
+			snapshot,
+			materialRead: EcdsaMaterialRead.fromRows(this.walletSignerScope, session.walletId, input.materialActivation, parseD1JsonColumn(row.ecdsa_material_records_json), await parseInstalledEcdsaCustodySnapshotV1({
+				scope: this.walletSignerScope,
+				walletId: session.walletId,
+				materialActivation: routerAbMpcMaterialActivationRefFromWire(input.materialActivation),
+				installations: parseD1JsonColumn(row.ecdsa_installations_json),
+				signers: parseD1JsonColumn(row.ecdsa_source_signers_json)
+			})),
+			policyRead: D1EcdsaAdmissionPolicyRead.fromRows(this.database, this.namespace, session.walletId, input.materialActivation.activation_id, parseD1JsonColumn(row.ecdsa_policy_records_json))
 		};
 	}
 	async readWalletSessionExactOperationContextByCredential(input) {
 		const row = await this.readJoinedWalletSessionAuthorizationV2Row({
+			projection: { kind: "session" },
 			lookupColumn: "operation_credential_hash",
 			tenantId: input.tenantId,
 			lookupValue: input.tokenHash
@@ -1058,6 +1079,7 @@ var CloudflareD1AuthorizationStore = class {
 		});
 		const nowMs = requirePositiveInteger(input.nowMs, "exact Wallet Session status time");
 		const row = await this.readJoinedWalletSessionAuthorizationV2Row({
+			projection: { kind: "session_status" },
 			lookupColumn: "operation_credential_hash",
 			tenantId: input.tenantId,
 			lookupValue: input.tokenHash
@@ -1120,7 +1142,7 @@ var CloudflareD1AuthorizationStore = class {
 			session,
 			quota
 		});
-		if (!await this.exactWalletSessionCapabilitySubjectsResolveMaterial(session)) return judged({
+		if (!await this.exactWalletSessionCapabilitySubjectsResolveMaterial(session, parseD1JsonColumn(row.status_ecdsa_material_records_json))) return judged({
 			kind: "capability_unavailable",
 			session,
 			quota
@@ -1131,15 +1153,20 @@ var CloudflareD1AuthorizationStore = class {
 			quota
 		});
 	}
-	async exactWalletSessionCapabilitySubjectsResolveMaterial(session) {
+	async exactWalletSessionCapabilitySubjectsResolveMaterial(session, ecdsaMaterialRows) {
 		const materials = [];
 		for (const subject of session.capabilitySubjects) switch (subject.kind) {
 			case "sign":
 			case "export_keys":
-				if (!materials.some((material) => material.keyFamily === subject.keyFamily && mpcMaterialActivationRefsEqual(material.materialActivation, subject.materialActivation))) materials.push({
-					keyFamily: subject.keyFamily,
+				if (!materials.some((material) => material.keyFamily === subject.keyFamily && mpcMaterialActivationRefsEqual(material.materialActivation, subject.materialActivation))) if (subject.keyFamily === "ed25519") materials.push({
+					keyFamily: "ed25519",
 					materialActivation: subject.materialActivation
 				});
+				else materials.push({
+					keyFamily: "ecdsa_secp256k1",
+					materialActivation: subject.materialActivation,
+					materialRead: EcdsaMaterialRead.fromRows(this.walletSignerScope, session.walletId, routerAbMpcMaterialActivationRefToWire(subject.materialActivation), ecdsaMaterialRows, null)
+				});
 				break;
 			case "link_devices":
 			case "revoke_devices": break;
@@ -1152,10 +1179,7 @@ var CloudflareD1AuthorizationStore = class {
 		const signer = subject.keyFamily === "ed25519" ? await this.walletStore.getEd25519SignerByMaterialActivation({
 			walletId,
 			materialActivation
-		}) : await this.walletStore.getEcdsaSignerByMaterialActivation({
-			walletId,
-			materialActivation
-		});
+		}) : subject.materialRead.resolve(this.walletSignerScope, walletId, materialActivation)?.signer;
 		if (!signer) return await this.readLinkedAuthorityMaterial(walletId, subject) !== null;
 		if (signer.walletId !== walletId) throw new Error("Stored wallet signer material identity does not match the session");
 		return true;
@@ -1176,8 +1200,64 @@ var CloudflareD1AuthorizationStore = class {
 		return projection;
 	}
 	async readJoinedWalletSessionAuthorizationV2Row(input) {
-		return await this.database.prepare(`SELECT
+		const installationProjection = ECDSA_INSTALLATION_SNAPSHOT_COLUMNS.map(installationJsonColumn).join(", ");
+		let materialProjection = "";
+		let materialBindings = [];
+		if (input.projection.kind === "ecdsa_material") {
+			materialProjection = `
+           (SELECT json_group_array(json_object('record_json', signer.record_json))
+              FROM wallet_signers AS signer
+             WHERE signer.namespace = session.namespace
+               AND signer.org_id = session.org_id
+               AND signer.project_id = session.project_id
+               AND signer.env_id = session.env_id
+               AND signer.wallet_id = session.wallet_id
+               AND signer.signer_family = 'ecdsa'
+               AND CASE WHEN json_valid(signer.record_json) THEN
+                 json_extract(signer.record_json,
+                   '$.walletKey.publicCapability.material_activation.activation_id') = ?
+                 ELSE 1 END
+           ) AS ecdsa_material_records_json,
+           CASE WHEN authority.provenance_kind = 'device_link' THEN
+             (SELECT json_group_array(json_object(${installationProjection}))
+                FROM linked_device_authority_installations AS installation
+               WHERE installation.namespace = session.namespace
+                 AND installation.org_id = session.org_id
+                 AND installation.project_id = session.project_id
+                 AND installation.env_id = session.env_id
+                 AND installation.wallet_id = session.wallet_id)
+           END AS ecdsa_installations_json,
+           CASE WHEN authority.provenance_kind = 'device_link' THEN
+             (SELECT json_group_array(json_object('record_json', source_signer.record_json))
+                FROM wallet_signers AS source_signer
+               WHERE source_signer.namespace = session.namespace
+                 AND source_signer.org_id = session.org_id
+                 AND source_signer.project_id = session.project_id
+                 AND source_signer.env_id = session.env_id
+                 AND source_signer.wallet_id = session.wallet_id
+                 AND source_signer.signer_family = 'ecdsa')
+           END AS ecdsa_source_signers_json,
+           ${ECDSA_CREDENTIAL_POLICY_PROJECTION}`;
+			materialBindings = [input.projection.materialActivation.activation_id, input.projection.materialActivation.activation_id];
+		} else if (input.projection.kind === "session_status") {
+			materialProjection = `
+        (SELECT json_group_array(json_object('record_json', signer.record_json))
+           FROM wallet_signers AS signer
+          WHERE signer.namespace = ? AND signer.org_id = ?
+            AND signer.project_id = ? AND signer.env_id = ?
+            AND signer.wallet_id = session.wallet_id
+            AND signer.signer_family = 'ecdsa'
+        ) AS status_ecdsa_material_records_json,`;
+			materialBindings = [
+				this.walletSignerScope.namespace,
+				this.walletSignerScope.orgId,
+				this.walletSignerScope.projectId,
+				this.walletSignerScope.envId
+			];
+		}
+		return await this.database.prepare(`SELECT ${materialProjection}
            authority.*,
+           session.namespace AS session_namespace,
            session.record_json AS session_record_json,
            session.capability_subjects_json AS session_capability_subjects_json,
            session.tenant_id AS session_tenant_id,
@@ -1240,12 +1320,13 @@ var CloudflareD1AuthorizationStore = class {
           AND session.env_id = ?
           AND session.tenant_id = ?
           AND session.${input.lookupColumn} = ?
-        LIMIT 1`).bind(this.walletSignerScope.orgId, this.walletSignerScope.projectId, this.walletSignerScope.envId, this.walletSignerScope.orgId, this.walletSignerScope.projectId, this.walletSignerScope.envId, this.namespace, this.walletSignerScope.orgId, this.walletSignerScope.projectId, this.walletSignerScope.envId, input.tenantId, input.lookupValue).first();
+        LIMIT 1`).bind(...materialBindings, this.walletSignerScope.orgId, this.walletSignerScope.projectId, this.walletSignerScope.envId, this.walletSignerScope.orgId, this.walletSignerScope.projectId, this.walletSignerScope.envId, this.namespace, this.walletSignerScope.orgId, this.walletSignerScope.projectId, this.walletSignerScope.envId, input.tenantId, input.lookupValue).first();
 	}
 	async readWalletSessionAuthorizationV2(input, lookupColumn) {
 		const lookup = "expected" in input ? input.expected : "identity" in input ? input.identity : null;
 		const operationCredentialHash = "operationCredentialHash" in input ? input.operationCredentialHash : null;
 		const row = await this.readJoinedWalletSessionAuthorizationV2Row({
+			projection: { kind: "session" },
 			lookupColumn,
 			tenantId: "operationCredentialHash" in input ? input.tenantId : lookup?.tenantId,
 			lookupValue: lookupColumn === "mint_id" ? String("expected" in input ? input.expected.mintId : lookup?.authorizationId) : lookupColumn === "authorization_id" ? String(lookup?.authorizationId) : operationCredentialHash
@@ -1296,20 +1377,16 @@ var CloudflareD1AuthorizationStore = class {
 			database: this.database,
 			namespace: this.namespace,
 			walletSignerScope: this.walletSignerScope,
+			materialSnapshot: input.materialSnapshot,
 			tenantId: input.tenantId,
 			operationFingerprintDigest: input.operationFingerprintDigest,
 			nowMs: requirePositiveInteger(input.nowMs, "operation replay time")
 		}).first();
-		if (!row) return null;
-		if (row.authorization_source_active !== 0 && row.authorization_source_active !== 1) throw new Error("Authorized operation source status must be a SQL boolean");
-		return {
-			row,
-			operation: await parseAuthorizedOperationRow(row),
-			sourceActive: row.authorization_source_active === 1
-		};
+		return row ? parseAuthorizedOperationAdmissionRecord(row) : null;
 	}
 	/** How an operation already admitted for this fingerprint answers another admission. */
 	answerExistingAuthorizedOperation(existing, operation, material) {
+		if (!existing.materialActive) return { kind: "material_mismatch" };
 		const replayMismatch = authorizedOperationReplayMismatch({
 			existing: existing.row,
 			incoming: operation,
@@ -1343,7 +1420,8 @@ var CloudflareD1AuthorizationStore = class {
 		const existing = await this.readAuthorizedOperationForAdmission({
 			tenantId: operation.tenantId,
 			operationFingerprintDigest: operation.operationFingerprintDigest,
-			nowMs: operation.claimedAtMs
+			nowMs: operation.claimedAtMs,
+			materialSnapshot: null
 		});
 		if (existing) {
 			const result = this.answerExistingAuthorizedOperation(existing, operation, void 0);
@@ -1360,7 +1438,9 @@ var CloudflareD1AuthorizationStore = class {
 				namespace: this.namespace,
 				walletSignerScope: this.walletSignerScope,
 				operation,
-				material: null
+				material: null,
+				materialSnapshot: null,
+				existingOperation: "reject"
 			})]
 		};
 	}
@@ -1368,17 +1448,50 @@ var CloudflareD1AuthorizationStore = class {
 		return classifyAuthorizedOperationAdmissionError(error);
 	}
 	async admitAuthorizedOperation(input) {
-		const result = await this.admitAuthorizedOperationRecord(input);
+		const result = await this.admitAuthorizedOperationRecord({
+			operation: input.operation,
+			material: input.material,
+			materialSnapshot: null
+		});
 		if (result.kind === "claimed" || result.kind === "replayed" || result.kind === "operation_in_progress") return {
 			kind: result.kind,
 			operation: result.operation
 		};
 		return result;
 	}
+	async resolveEcdsaWalletSessionOperation(input) {
+		const operation = await buildAuthorizedOperation(input.operation);
+		if (!authorizedOperationMaterialScopeMatches(operation, input.material, input.material.readSnapshot)) return { kind: "material_mismatch" };
+		const existing = await this.readAuthorizedOperationForAdmission({
+			tenantId: operation.tenantId,
+			operationFingerprintDigest: operation.operationFingerprintDigest,
+			nowMs: operation.claimedAtMs,
+			materialSnapshot: input.material.readSnapshot
+		});
+		if (!existing) return { kind: "authorized_operation_missing" };
+		const result = this.answerExistingAuthorizedOperation(existing, operation, input.material);
+		if (result.kind === "operation_in_progress") return {
+			kind: result.kind,
+			operation: result.operation,
+			ownerScope: this.pinnedWalletSessionOwnerScope(result.row, input.material.walletId)
+		};
+		if (result.kind === "replayed") return {
+			kind: result.kind,
+			operation: result.operation
+		};
+		switch (result.kind) {
+			case "authorization_grant_rejected":
+			case "verified_step_up_rejected":
+			case "wallet_session_quota_exhausted":
+			case "material_mismatch": return result;
+			default: throw new Error("Unexpected ECDSA operation resolution");
+		}
+	}
 	async admitEcdsaWalletSessionOperation(input) {
 		const result = await this.admitAuthorizedOperationRecord({
 			operation: input.operation,
-			material: input.material
+			material: input.material,
+			materialSnapshot: input.material.readSnapshot
 		});
 		switch (result.kind) {
 			case "claimed":
@@ -1403,42 +1516,52 @@ var CloudflareD1AuthorizationStore = class {
 	}
 	async admitAuthorizedOperationRecord(input) {
 		const operation = await buildAuthorizedOperation(input.operation);
-		if (operation.operation.operation.capabilityKind === CAPABILITY_KINDS.evmEcdsaMpcSigning && !input.material) return { kind: "material_mismatch" };
-		if (input.material && input.material.kind === "ecdsa_material_activation" && (operation.operation.operation.capabilityKind !== CAPABILITY_KINDS.evmEcdsaMpcSigning || input.material.runtimePolicyScope.orgId !== operation.tenantId || input.material.materialActivation.capability !== operation.operation.capabilityId || input.material.materialActivation.material_owner !== input.material.walletId)) return { kind: "material_mismatch" };
-		const existing = await this.readAuthorizedOperationForAdmission({
-			tenantId: operation.tenantId,
-			operationFingerprintDigest: operation.operationFingerprintDigest,
-			nowMs: operation.claimedAtMs
-		});
-		if (existing) return this.answerExistingAuthorizedOperation(existing, operation, input.material);
+		if (!authorizedOperationMaterialScopeMatches(operation, input.material, input.materialSnapshot)) return { kind: "material_mismatch" };
 		let committedRow;
+		let claimed;
 		try {
 			const statement = prepareAuthorizedOperationInsert({
 				database: this.database,
 				namespace: this.namespace,
 				walletSignerScope: this.walletSignerScope,
 				operation,
-				material: input.material ?? null
+				material: input.material ?? null,
+				materialSnapshot: input.materialSnapshot,
+				existingOperation: "preserve"
 			});
-			const [result, readback] = await this.database.batch([statement, prepareAuthorizedOperationCommittedRead(this.database, this.namespace, operation)]);
+			const [result, readback] = await this.database.batch([statement, prepareAuthorizedOperationAdmissionRead({
+				database: this.database,
+				namespace: this.namespace,
+				walletSignerScope: this.walletSignerScope,
+				tenantId: operation.tenantId,
+				operationFingerprintDigest: operation.operationFingerprintDigest,
+				nowMs: operation.claimedAtMs,
+				materialSnapshot: input.materialSnapshot
+			})]);
 			if (!result?.success || !readback?.success) throw new Error("authorized operation admission batch returned incomplete results");
-			if (input.material && d1ChangedRows(result) === 0) return { kind: "material_mismatch" };
+			claimed = d1ChangedRows(result) !== 0;
 			committedRow = readback.results?.[0] ?? null;
 		} catch (error) {
 			const raced = await this.readAuthorizedOperationForAdmission({
 				tenantId: operation.tenantId,
 				operationFingerprintDigest: operation.operationFingerprintDigest,
-				nowMs: operation.claimedAtMs
+				nowMs: operation.claimedAtMs,
+				materialSnapshot: input.materialSnapshot
 			});
 			if (raced) return this.answerExistingAuthorizedOperation(raced, operation, input.material);
 			const triggerFailure = classifyAuthorizedOperationAdmissionError(error);
 			if (triggerFailure) return triggerFailure;
 			throw error;
 		}
-		if (!committedRow) throw new Error("authorized operation admission could not be read back");
+		if (!committedRow) {
+			if (!claimed && input.material) return { kind: "material_mismatch" };
+			throw new Error("authorized operation admission could not be read back");
+		}
+		const admitted = await parseAuthorizedOperationAdmissionRecord(committedRow);
+		if (!claimed) return this.answerExistingAuthorizedOperation(admitted, operation, input.material);
 		return {
 			kind: "claimed",
-			operation: await parseAuthorizedOperationRow(committedRow),
+			operation: admitted.operation,
 			row: committedRow
 		};
 	}
@@ -1498,6 +1621,21 @@ var CloudflareD1AuthorizationStore = class {
           LIMIT 1`).bind(this.namespace, this.walletSignerScope.orgId, this.walletSignerScope.projectId, this.walletSignerScope.envId, codeHash).first();
 	}
 };
+async function parseAuthorizedOperationAdmissionRecord(row) {
+	if (row.authorization_source_active !== 0 && row.authorization_source_active !== 1) throw new Error("Authorized operation source status must be a SQL boolean");
+	return {
+		row,
+		operation: await parseAuthorizedOperationRow(row),
+		sourceActive: row.authorization_source_active === 1,
+		materialActive: row.material_snapshot_active === 1
+	};
+}
+function authorizedOperationMaterialScopeMatches(operation, material, snapshot) {
+	if (snapshot && snapshot.walletId !== material?.walletId) return false;
+	const requiresMaterial = operation.operation.operation.capabilityKind === CAPABILITY_KINDS.evmEcdsaMpcSigning;
+	if (!material) return !requiresMaterial;
+	return requiresMaterial && material.runtimePolicyScope.orgId === operation.tenantId && material.materialActivation.capability === operation.operation.capabilityId && material.materialActivation.material_owner === material.walletId;
+}
 function classifyAuthorizedOperationAdmissionError(error) {
 	const message = error instanceof Error ? error.message : String(error);
 	if (message.includes("authorization_wallet_session_quota_rejected")) return { kind: "wallet_session_quota_exhausted" };
@@ -1805,6 +1943,33 @@ function parseExactWalletSessionQuotaProjectionRow(row, session) {
 function assertNeverDirectV2CommitMode(value) {
 	throw new Error(`Unsupported direct V2 Wallet Session commit mode: ${String(value)}`);
 }
+async function parseWalletSessionAdmissionRow(row, input) {
+	const session = parseLiveWalletSessionAuthorizationV2Row(row, {
+		operationCredentialHash: input.tokenHash,
+		tenantId: input.tenantId,
+		nowMs: input.nowMs
+	});
+	const { authority, authMethod } = await joinedAuthorityAndMethod(row);
+	if (row.quota_lifecycle_kind === "exhausted") return {
+		kind: "exhausted",
+		session,
+		quota: parseExactWalletSessionQuotaProjectionRow(row, session),
+		authority,
+		authMethod
+	};
+	return {
+		kind: "active",
+		authorization: {
+			session,
+			quota: parseWalletSessionAuthorizationV2QuotaRow(row, session)
+		},
+		authority,
+		authMethod
+	};
+}
+function installationJsonColumn(column) {
+	return `'${column}', installation.${column}`;
+}
 //#endregion
 export { CloudflareD1AuthorizationStore };
 

package/dist/esm/router/cloudflare/d1/authorization/d1VaultProxyStore.js

@@ -2,6 +2,7 @@ import { parseCapabilityId, parseTenantId, parseVaultId, parseVaultItemId } from
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
 import { parseVaultProxyDestination } from "../../../../authorization/vaultProxyUse.js";
+import { toArrayBufferCopy } from "../../../../core/authService/portableCrypto.js";
 //#region src/router/cloudflare/d1/authorization/d1VaultProxyStore.ts
 const VAULT_PROXY_SECRET_AAD_DOMAIN_V1 = "seams:vault:proxy-secret:v1";
 const AES_GCM_NONCE_BYTES = 12;
@@ -21,10 +22,10 @@ var CloudflareD1VaultProxyStore = class {
 		try {
 			const ciphertext = await crypto.subtle.encrypt({
 				name: "AES-GCM",
-				iv: toArrayBuffer(nonce),
-				additionalData: toArrayBuffer(aad(input)),
+				iv: toArrayBufferCopy(nonce),
+				additionalData: toArrayBufferCopy(aad(input)),
 				tagLength: 128
-			}, await this.key, toArrayBuffer(plaintext));
+			}, await this.key, toArrayBufferCopy(plaintext));
 			await this.database.prepare(`INSERT INTO vault_proxy_secrets (
             namespace,
             tenant_id,
@@ -65,10 +66,10 @@ var CloudflareD1VaultProxyStore = class {
 		try {
 			return new Uint8Array(await crypto.subtle.decrypt({
 				name: "AES-GCM",
-				iv: toArrayBuffer(nonce),
-				additionalData: toArrayBuffer(aad(input)),
+				iv: toArrayBufferCopy(nonce),
+				additionalData: toArrayBufferCopy(aad(input)),
 				tagLength: 128
-			}, await this.key, toArrayBuffer(ciphertext)));
+			}, await this.key, toArrayBufferCopy(ciphertext)));
 		} finally {
 			nonce.fill(0);
 			ciphertext.fill(0);
@@ -77,7 +78,7 @@ var CloudflareD1VaultProxyStore = class {
 };
 async function importEncryptionKey(bytes) {
 	try {
-		return await crypto.subtle.importKey("raw", toArrayBuffer(bytes), { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+		return await crypto.subtle.importKey("raw", toArrayBufferCopy(bytes), { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
 	} finally {
 		bytes.fill(0);
 	}
@@ -111,11 +112,6 @@ function requireCompactString(value, label) {
 	if (typeof value !== "string" || !value || value.trim() !== value) throw new Error(`vault proxy ${label} is invalid`);
 	return value;
 }
-function toArrayBuffer(bytes) {
-	const copy = new ArrayBuffer(bytes.byteLength);
-	new Uint8Array(copy).set(bytes);
-	return copy;
-}
 //#endregion
 export { CloudflareD1VaultProxyStore };
 

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.js

@@ -3,8 +3,9 @@ import { parseDeviceId, parsePrincipalId, parseTenantId, parseWalletSessionMintI
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
 import { buildDelegatedWalletAuthorityV1, parseDelegatedWalletPermissionSetV1, validateDelegatedWalletAuthorityAttenuationV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
-import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseRouterAbEd25519YaoApplicationBindingFactsV1, parseRouterAbEd25519YaoCeremonyBindingV1, sameRouterAbEd25519YaoActivationBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { assertLinkedDeviceOrdinaryMaterialSourceContributionMatchesContextV1, parseLinkedDeviceEcdsaSourceContributionPackageV1, parseLinkedDeviceEcdsaSourceDerivationV1, parseLinkedDeviceOrdinaryMaterialSourceContributionV1 } from "../../../../shared-ts/src/device-linking/sourceContribution.js";
 import { buildWalletAuthMethodRecordV2, sameWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
@@ -17,12 +18,14 @@ import { computeWalletSessionInstallationReceiptDigestB64u, computeWalletSession
 import { computeLinkedDevicePublicKeyDigestV1 } from "../../../../shared-ts/src/device-linking/requestProof.js";
 import { buildPersistedActiveWalletSessionAuthorizationV2, walletSessionAuthorizationV2RecordsEqual } from "../../../../authorization/domain.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
+import { EcdsaMaterialReadSnapshot } from "../../../../core/ecdsaMaterialReadSnapshot.js";
 import { parseD1JsonColumn } from "../../../../storage/d1Sql.js";
+import { parseWalletEcdsaSignerRows, prepareWalletEcdsaSignersRead } from "../../../../core/d1EcdsaSignerRead.js";
 import "../../../../core/deviceLinking/requestProof.js";
 import { prepareD1WebAuthnCredentialBindingInsertStatement } from "../../../../core/WebAuthnCredentialBindingStore.js";
 import { prepareD1WebAuthnAuthenticatorInsertStatement } from "../webauthn/d1WebAuthnStore.js";
-import { buildAuthorityActiveSessionRecordV1, buildAuthorityPendingLocalInstallSessionRecordV1 } from "../../../../core/deviceLinking/linkedDeviceSessionRecord.js";
 import { findInstalledEcdsaAuthority, installedEcdsaAuthorityChain, projectInstalledEcdsaAuthority } from "./installedEcdsaAuthority.js";
+import { buildAuthorityActiveSessionRecordV1, buildAuthorityPendingLocalInstallSessionRecordV1 } from "../../../../core/deviceLinking/linkedDeviceSessionRecord.js";
 import { linkedDeviceX25519RecipientPublicKeyB64uV1 } from "./d1LinkedDeviceSourceContributionPreparationPlanner.js";
 //#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceAuthorityInstallService.ts
 var LinkedDeviceActivationIntegrityErrorV1 = class extends Error {
@@ -471,11 +474,20 @@ var D1LinkedDeviceAuthorityInstallServiceV1 = class {
 			return null;
 		}
 	}
-	async readInstalledEcdsaAuthorityChainByMaterialActivationV1(input) {
+	async readInstalledEcdsaCustodySnapshotV1(input) {
 		try {
-			return installedEcdsaAuthorityChain(await this.readVerifiedEcdsaInstallations(input.walletId), input.materialActivation);
+			if (input.source.kind === "credential_snapshot") return input.source.materialRead.resolveLinked(this.options.scope, input.walletId, routerAbMpcMaterialActivationRefToWire(input.materialActivation));
+			const [installations, signers] = await this.options.database.batch([this.prepareInstallationsByWalletRead(input.walletId), prepareWalletEcdsaSignersRead(this.options.database, this.options.scope, input.walletId)]);
+			if (!installations?.success || !signers?.success) throw new Error("Linked ECDSA custody snapshot is incomplete");
+			return await parseInstalledEcdsaCustodySnapshotV1({
+				scope: this.options.scope,
+				walletId: input.walletId,
+				materialActivation: input.materialActivation,
+				installations: installations.results ?? [],
+				signers: signers.results ?? []
+			});
 		} catch {
-			return [];
+			return null;
 		}
 	}
 	async readVerifiedEcdsaInstallations(walletId) {
@@ -1023,12 +1035,42 @@ var D1LinkedDeviceAuthorityInstallServiceV1 = class {
 		return await readStoredInstallationByAuthorityV1(this.options, authorityId);
 	}
 	async readInstallationsByWallet(walletId) {
-		return ((await this.options.database.prepare(`SELECT * FROM linked_device_authority_installations
+		return ((await this.prepareInstallationsByWalletRead(walletId).all()).results ?? []).map(parseStoredInstallationRow);
+	}
+	prepareInstallationsByWalletRead(walletId) {
+		return this.options.database.prepare(`SELECT * FROM linked_device_authority_installations
           WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
             AND wallet_id = ?
-          ORDER BY link_session_id ASC`).bind(this.options.scope.namespace, this.options.scope.orgId, this.options.scope.projectId, this.options.scope.envId, String(walletId)).all()).results ?? []).map(parseStoredInstallationRow);
+          ORDER BY link_session_id ASC`).bind(this.options.scope.namespace, this.options.scope.orgId, this.options.scope.projectId, this.options.scope.envId, String(walletId));
 	}
 };
+async function parseInstalledEcdsaCustodySnapshotV1(input) {
+	try {
+		if (!Array.isArray(input.installations) || !Array.isArray(input.signers)) return null;
+		const installations = [];
+		const signers = [];
+		for (const row of input.installations) {
+			if (!isPlainObject(row)) return null;
+			installations.push(row);
+		}
+		for (const row of input.signers) {
+			if (!isPlainObject(row)) return null;
+			signers.push(row);
+		}
+		const rows = installations.map(parseStoredInstallationRow);
+		for (const row of rows) {
+			if (row.walletId !== input.walletId) return null;
+			await assertStoredPackageDigest(row);
+		}
+		return {
+			readSnapshot: EcdsaMaterialReadSnapshot.linked(input.scope, input.walletId, installations, signers),
+			chain: installedEcdsaAuthorityChain(rows, input.materialActivation),
+			signers: parseWalletEcdsaSignerRows(signers, input.walletId)
+		};
+	} catch {
+		return null;
+	}
+}
 async function readStoredInstallationByAuthorityV1(sql, authorityId) {
 	const row = await sql.database.prepare(`SELECT * FROM linked_device_authority_installations
         WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
@@ -1825,6 +1867,6 @@ function errorMessage(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 //#endregion
-export { D1LinkedDeviceAuthorityInstallServiceV1, readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1 };
+export { D1LinkedDeviceAuthorityInstallServiceV1, parseInstalledEcdsaCustodySnapshotV1, readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1 };
 
 //# sourceMappingURL=d1LinkedDeviceAuthorityInstallService.js.map

package/dist/esm/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetCredentialProvider.js

@@ -10,10 +10,10 @@ import { assertLinkedDeviceTargetCredentialRegistrationMatchesPreparationV1, com
 import { d1ChangedRows } from "../../../../storage/d1Sql.js";
 import { errorMessage } from "../../../../shared-ts/src/utils/errors.js";
 import { parseClientDataJsonBase64url } from "../../../../core/authService/webauthnOidcHelpers.js";
+import { linkedDeviceX25519RecipientPublicKeyB64uV1 } from "./d1LinkedDeviceSourceContributionPreparationPlanner.js";
 import { verifyWebAuthnRegistrationCredentialForIntent } from "../../../../core/authService/webauthn.js";
 import { SESSION_CAS_GUARD_SQL } from "./d1LinkedDeviceSessionStore.js";
 import { linkedDeviceEmailOtpDescriptorCredentialIdV1 } from "../../../../core/deviceLinking/linkedDeviceEmailOtpGrant.js";
-import { linkedDeviceX25519RecipientPublicKeyB64uV1 } from "./d1LinkedDeviceSourceContributionPreparationPlanner.js";
 import { buildVerifiedLinkInputV1, buildVerifiedTargetFactorV1 } from "./d1LinkedDeviceVerifiedLinkBuilder.js";
 //#region src/router/cloudflare/d1/deviceLinking/d1LinkedDeviceTargetCredentialProvider.ts
 /** Verifies the browser-signed ceremony origin against the configured RP ID. */

package/dist/esm/router/cloudflare/d1/deviceLinking/index.js

@@ -1,15 +1,15 @@
+import { D1LinkedDeviceSourceContributionPreparationPlannerV1, createD1LinkedDeviceSourceContributionPreparationPlannerV1, linkedDeviceX25519RecipientPublicKeyB64uV1 } from "./d1LinkedDeviceSourceContributionPreparationPlanner.js";
+import { D1LinkedDeviceAuthorityInstallServiceV1, parseInstalledEcdsaCustodySnapshotV1, readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1 } from "./d1LinkedDeviceAuthorityInstallService.js";
 import { D1LinkedDeviceEd25519ExportRootStoreV1 } from "./d1LinkedDeviceEd25519ExportRootStore.js";
 import { D1LinkedDeviceRequestProofNonceStoreV1 } from "./d1LinkedDeviceRequestProofNonceStore.js";
 import { createD1LinkedDeviceSessionServiceV1 } from "./d1LinkedDeviceSessionService.js";
 import { parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1 } from "./d1LinkedDeviceSessionRecords.js";
 import { D1LinkedDeviceSessionStoreV1, SESSION_CAS_GUARD_SQL } from "./d1LinkedDeviceSessionStore.js";
 import { createD1LinkedDeviceRouteServiceV1 } from "./d1LinkedDeviceRouteService.js";
-import { D1LinkedDeviceSourceContributionPreparationPlannerV1, createD1LinkedDeviceSourceContributionPreparationPlannerV1, linkedDeviceX25519RecipientPublicKeyB64uV1 } from "./d1LinkedDeviceSourceContributionPreparationPlanner.js";
-import { D1LinkedDeviceAuthorityInstallServiceV1, readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1 } from "./d1LinkedDeviceAuthorityInstallService.js";
 import { LinkedDeviceSourceFamilyUnavailableErrorV1, createD1LinkedDeviceVerifiedLinkSourceReaderV1 } from "./d1LinkedDeviceVerifiedLinkSourceReader.js";
 import { buildVerifiedLinkInputV1, buildVerifiedTargetFactorV1, computeVerifiedTargetFactorVerificationDigestV1, linkedDeviceSignerManifestsEqualV1 } from "./d1LinkedDeviceVerifiedLinkBuilder.js";
 import { D1LinkedDeviceTargetCredentialProviderV1, LinkedDeviceRetiredTargetRegistrationShapeErrorV1, LinkedDeviceWebAuthnRegistrationVerifierV1 } from "./d1LinkedDeviceTargetCredentialProvider.js";
 import { D1LinkedDeviceTargetPlannerV1 } from "./d1LinkedDeviceTargetPlanner.js";
 import { createD1LinkedDeviceOwnerAuthorizationMetadataSourceV1, createD1LinkedDeviceOwnerAuthorizationProviderV1, createD1LinkedDeviceOwnerSourceChildReaderV1 } from "./d1LinkedDeviceOwnerAuthorizationProvider.js";
 import { D1LinkedDeviceTargetAuthenticatorStoreV1 } from "./d1LinkedDeviceTargetAuthenticatorStore.js";
-export { D1LinkedDeviceAuthorityInstallServiceV1, D1LinkedDeviceEd25519ExportRootStoreV1, D1LinkedDeviceRequestProofNonceStoreV1, D1LinkedDeviceSessionStoreV1, D1LinkedDeviceSourceContributionPreparationPlannerV1, D1LinkedDeviceTargetAuthenticatorStoreV1, D1LinkedDeviceTargetCredentialProviderV1, D1LinkedDeviceTargetPlannerV1, LinkedDeviceRetiredTargetRegistrationShapeErrorV1, LinkedDeviceSourceFamilyUnavailableErrorV1, LinkedDeviceWebAuthnRegistrationVerifierV1, SESSION_CAS_GUARD_SQL, buildVerifiedLinkInputV1, buildVerifiedTargetFactorV1, computeVerifiedTargetFactorVerificationDigestV1, createD1LinkedDeviceOwnerAuthorizationMetadataSourceV1, createD1LinkedDeviceOwnerAuthorizationProviderV1, createD1LinkedDeviceOwnerSourceChildReaderV1, createD1LinkedDeviceRouteServiceV1, createD1LinkedDeviceSessionServiceV1, createD1LinkedDeviceSourceContributionPreparationPlannerV1, createD1LinkedDeviceVerifiedLinkSourceReaderV1, linkedDeviceSignerManifestsEqualV1, linkedDeviceX25519RecipientPublicKeyB64uV1, parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1, readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1 };
+export { D1LinkedDeviceAuthorityInstallServiceV1, D1LinkedDeviceEd25519ExportRootStoreV1, D1LinkedDeviceRequestProofNonceStoreV1, D1LinkedDeviceSessionStoreV1, D1LinkedDeviceSourceContributionPreparationPlannerV1, D1LinkedDeviceTargetAuthenticatorStoreV1, D1LinkedDeviceTargetCredentialProviderV1, D1LinkedDeviceTargetPlannerV1, LinkedDeviceRetiredTargetRegistrationShapeErrorV1, LinkedDeviceSourceFamilyUnavailableErrorV1, LinkedDeviceWebAuthnRegistrationVerifierV1, SESSION_CAS_GUARD_SQL, buildVerifiedLinkInputV1, buildVerifiedTargetFactorV1, computeVerifiedTargetFactorVerificationDigestV1, createD1LinkedDeviceOwnerAuthorizationMetadataSourceV1, createD1LinkedDeviceOwnerAuthorizationProviderV1, createD1LinkedDeviceOwnerSourceChildReaderV1, createD1LinkedDeviceRouteServiceV1, createD1LinkedDeviceSessionServiceV1, createD1LinkedDeviceSourceContributionPreparationPlannerV1, createD1LinkedDeviceVerifiedLinkSourceReaderV1, linkedDeviceSignerManifestsEqualV1, linkedDeviceX25519RecipientPublicKeyB64uV1, parseD1LinkedDeviceSessionRowV1, parseD1LinkedDeviceSessionTranscriptRowV1, parseInstalledEcdsaCustodySnapshotV1, readD1LinkedDeviceEcdsaSourceV1, readD1LinkedDeviceEd25519SourceV1 };