@seams/wallet-server 0.7.1 → 0.8.0

package/dist/esm/router/cloudflare/d1/authorization/authorizedOperationStatements.js

@@ -38,16 +38,25 @@ function ecdsaSignerMatchBindings(walletSignerScope, material) {
 	];
 }
 const PINNED_OWNER_WALLET = `
-  (SELECT session.wallet_id
+  CASE operation.authorization_source_kind
+  WHEN 'verified_step_up' THEN (
+    SELECT evidence.wallet_id
+      FROM verified_wallet_operation_evidence_sets AS evidence
+     WHERE evidence.namespace = operation.namespace
+       AND evidence.tenant_id = operation.tenant_id
+       AND evidence.evidence_set_digest = operation.evidence_set_digest
+     LIMIT 1)
+  WHEN 'authorization_grant' THEN (
+    SELECT session.wallet_id
      FROM wallet_session_authorizations_v2 AS session
     WHERE session.namespace = operation.namespace
       AND session.tenant_id = operation.tenant_id
       AND session.authorization_id = operation.authorization_id
-      AND session.org_id = operation.linked_scope_org_id
-      AND session.project_id = operation.linked_scope_project_id
-      AND session.env_id = operation.linked_scope_env_id
-      AND operation.authorization_source_kind = 'authorization_grant'
-    LIMIT 1) AS pinned_owner_wallet_id`;
+      AND session.org_id = operation.owner_scope_org_id
+      AND session.project_id = operation.owner_scope_project_id
+      AND session.env_id = operation.owner_scope_env_id
+    LIMIT 1)
+  END AS pinned_owner_wallet_id`;
 function prepareAuthorizedOperationCommittedRead(database, namespace, input) {
 	return database.prepare(`SELECT operation.*, ${PINNED_OWNER_WALLET}
        FROM authorized_operations AS operation
@@ -61,7 +70,11 @@ function prepareAuthorizedOperationRead(database, namespace, input) {
       LIMIT 1`).bind(namespace, input.tenantId, input.operationFingerprintDigest);
 }
 function prepareAuthorizedOperationAdmissionRead(input) {
-	return input.database.prepare(`SELECT operation.*, ${PINNED_OWNER_WALLET},
+	const material = input.materialSnapshot?.condition(input.walletSignerScope) ?? {
+		sql: "1",
+		bindings: []
+	};
+	return input.database.prepare(`SELECT operation.*, ${PINNED_OWNER_WALLET}, (${material.sql}) AS material_snapshot_active,
             CASE operation.authorization_source_kind
               WHEN 'authorization_grant' THEN EXISTS (
                 SELECT 1
@@ -82,9 +95,9 @@ function prepareAuthorizedOperationAdmissionRead(input) {
                    AND auth_method.wallet_id = session.wallet_id
                    AND auth_method.wallet_authority_id = session.authority_id
                  WHERE session.namespace = operation.namespace
-                   AND session.org_id = operation.linked_scope_org_id
-                   AND session.project_id = operation.linked_scope_project_id
-                   AND session.env_id = operation.linked_scope_env_id
+                   AND session.org_id = operation.owner_scope_org_id
+                   AND session.project_id = operation.owner_scope_project_id
+                   AND session.env_id = operation.owner_scope_env_id
                    AND session.org_id = ? AND session.project_id = ? AND session.env_id = ?
                    AND session.tenant_id = operation.tenant_id
                    AND session.authorization_id = operation.authorization_id
@@ -110,14 +123,16 @@ function prepareAuthorizedOperationAdmissionRead(input) {
                    AND evidence.intent_digest = operation.intent_digest
                    AND evidence.display_digest = operation.display_digest
                    AND evidence.assurance = 'step_up'
-                   AND evidence.expires_at_ms > ?
+                   AND evidence.expires_at_ms > MAX(
+                     ?, CAST(round(unixepoch('subsec') * 1000) AS INTEGER)
+                   )
               )
               ELSE 0
             END AS authorization_source_active
        FROM authorized_operations AS operation
       WHERE operation.namespace = ? AND operation.tenant_id = ?
         AND operation.operation_fingerprint_digest = ?
-      LIMIT 1`).bind(input.walletSignerScope.orgId, input.walletSignerScope.projectId, input.walletSignerScope.envId, input.nowMs, input.nowMs, input.namespace, input.tenantId, input.operationFingerprintDigest);
+      LIMIT 1`).bind(...material.bindings, input.walletSignerScope.orgId, input.walletSignerScope.projectId, input.walletSignerScope.envId, input.nowMs, input.nowMs, input.namespace, input.tenantId, input.operationFingerprintDigest);
 }
 function prepareAuthorizedOperationInsert(input) {
 	const { database, namespace, walletSignerScope, operation, material } = input;
@@ -154,18 +169,31 @@ function prepareAuthorizedOperationInsert(input) {
 		material?.materialActivation.key_binding ?? null,
 		material?.materialActivation.lifecycle_binding ?? null,
 		material?.materialActivation.signing_worker ?? null,
-		null,
-		null,
-		null,
-		null,
-		null,
-		null,
-		null,
 		source.kind === "authorization_grant" ? walletSignerScope.orgId : null,
 		source.kind === "authorization_grant" ? walletSignerScope.projectId : null,
 		source.kind === "authorization_grant" ? walletSignerScope.envId : null
 	];
-	return material?.kind === "ecdsa_material_activation" ? database.prepare(`INSERT INTO authorized_operations (
+	let condition = input.materialSnapshot?.condition(walletSignerScope) ?? null;
+	if (condition === null) condition = material?.kind === "ecdsa_material_activation" ? {
+		sql: ECDSA_SIGNER_MATCH,
+		bindings: ecdsaSignerMatchBindings(walletSignerScope, material)
+	} : {
+		sql: "1",
+		bindings: []
+	};
+	const absence = input.existingOperation === "preserve" ? {
+		sql: `NOT EXISTS (SELECT 1 FROM authorized_operations
+               WHERE namespace = ? AND tenant_id = ? AND operation_fingerprint_digest = ?)`,
+		bindings: [
+			namespace,
+			operation.tenantId,
+			operation.operationFingerprintDigest
+		]
+	} : {
+		sql: "1",
+		bindings: []
+	};
+	return database.prepare(`INSERT INTO authorized_operations (
           namespace, tenant_id, authorized_operation_id, audit_event_id,
           principal_id, capability_id, capability_kind, operation_kind, operation_id,
           operation_fingerprint_digest, lane_digest, intent_digest, display_digest,
@@ -176,31 +204,12 @@ function prepareAuthorizedOperationInsert(input) {
           material_activation_id, material_activation_capability,
           material_activation_owner, material_activation_key_binding,
           material_activation_lifecycle_binding, material_activation_signing_worker,
-          linked_wallet_id, linked_enrollment_id, linked_device_id,
-          linked_wallet_key_id, linked_lane_id, linked_lane_share_epoch,
-          linked_revocation_epoch, linked_scope_org_id, linked_scope_project_id,
-          linked_scope_env_id
+          owner_scope_org_id, owner_scope_project_id,
+          owner_scope_env_id
         ) SELECT ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?,
                   'claimed', 'pending', NULL, NULL, NULL, NULL, ?, NULL, ?,
-                  ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?
-           WHERE ${ECDSA_SIGNER_MATCH}`).bind(...values, ...ecdsaSignerMatchBindings(walletSignerScope, material)) : database.prepare(`INSERT INTO authorized_operations (
-          namespace, tenant_id, authorized_operation_id, audit_event_id,
-          principal_id, capability_id, capability_kind, operation_kind, operation_id,
-          operation_fingerprint_digest, lane_digest, intent_digest, display_digest,
-          authorization_source_kind, authorization_id, evidence_set_digest,
-          quota_id, quota_kind, authorization_grant_kind, lifecycle_kind, result_kind,
-          result_digest, result_status, result_content_type, result_body_text,
-          claimed_at_ms, completed_at_ms,
-          material_activation_id, material_activation_capability,
-          material_activation_owner, material_activation_key_binding,
-          material_activation_lifecycle_binding, material_activation_signing_worker,
-          linked_wallet_id, linked_enrollment_id, linked_device_id,
-          linked_wallet_key_id, linked_lane_id, linked_lane_share_epoch,
-          linked_revocation_epoch, linked_scope_org_id, linked_scope_project_id,
-          linked_scope_env_id
-        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?,
-                  'claimed', 'pending', NULL, NULL, NULL, NULL, ?, NULL, ?,
-                  ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).bind(...values);
+                  ?, ?, ?, ?, ?, ?, ?, ?
+           WHERE (${condition.sql}) AND (${absence.sql})`).bind(...values, ...condition.bindings, ...absence.bindings);
 }
 //#endregion
 export { prepareAuthorizedOperationAdmissionRead, prepareAuthorizedOperationCommittedRead, prepareAuthorizedOperationInsert, prepareAuthorizedOperationRead };

package/dist/esm/router/cloudflare/d1/authorization/d1AuthorizationStore.js

@@ -2,11 +2,15 @@ import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/
 import { CAPABILITY_KINDS, parseAuthorizationAuditEventId, parseAuthorizationGrantRef, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parseCapabilityOperationRef, parseMpcWalletSigningQuotaId, parsePrincipalId, parseTenantId, parseWalletSessionAuthorizationId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { buildCapabilityOperationEnvelope, computeCapabilityOperationFingerprintDigest, parseCapabilityOperationFingerprintDigest } from "../../../../shared-ts/src/authorization/operationFingerprint.js";
-import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { buildActiveWalletSessionQuota, buildAuthorizedOperation, buildExactWalletSessionQuotaProjectionV1, computeAuthorizedOperationResultDigest, exactWalletSessionCapabilitySubjectsResolveAuthority, parseAuthorizedOperationReplayResponse, parseHostedWalletSessionCredentialId, parseSessionOrigin, parseWalletSessionAuthorizationV2, walletSessionAuthorizationV2RecordsEqual } from "../../../../authorization/domain.js";
+import { ECDSA_INSTALLATION_SNAPSHOT_COLUMNS } from "../../../../core/ecdsaMaterialReadSnapshot.js";
 import { d1ChangedRows, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
+import { EcdsaMaterialRead } from "../../../../core/d1EcdsaSignerRead.js";
 import { D1WalletStore } from "../../../../core/d1WalletStore.js";
 import { normalizeWalletAuthMethodV2 } from "../../../../core/d1WalletAuthMethodStore.js";
+import { D1EcdsaAdmissionPolicyRead, ECDSA_CREDENTIAL_POLICY_PROJECTION } from "../signingAdmission/d1RouterAbNormalSigningAdmissionStore.js";
+import { parseInstalledEcdsaCustodySnapshotV1 } from "../deviceLinking/d1LinkedDeviceAuthorityInstallService.js";
 import { prepareAuthorizedOperationAdmissionRead, prepareAuthorizedOperationCommittedRead, prepareAuthorizedOperationInsert, prepareAuthorizedOperationRead } from "./authorizedOperationStatements.js";
 import { prepareD1WalletSessionAuthorityProjectionStatements } from "./walletSessionAuthorityProjection.js";
 import { parseD1WalletAuthorityRow } from "../wallet/d1WalletAuthorityStore.js";
@@ -315,11 +319,12 @@ var CloudflareD1AuthorizationStore = class {
            AND quota.expires_at_ms >= ?
            AND ${ACTIVE_V2_HOSTED_PARENT_PROVENANCE_SQL}`).bind(this.namespace, this.walletSignerScope.orgId, this.walletSignerScope.projectId, this.walletSignerScope.envId, exchange.tenantId, exchange.exchangeCodeId, exchange.authorizationId, exchange.walletSessionId, exchange.quotaId, exchange.principalId, exchange.walletId, exchange.authorityId, exchange.walletAuthMethodId, exchange.codeHash, exchange.nonceDigest, exchange.appOrigin, exchange.walletOrigin, requirePositiveInteger(exchange.issuedAtMs, "exchange.issuedAtMs"), requirePositiveInteger(exchange.expiresAtMs, "exchange.expiresAtMs"), this.namespace, this.walletSignerScope.orgId, this.walletSignerScope.projectId, this.walletSignerScope.envId, exchange.tenantId, exchange.authorizationId, exchange.walletSessionId, exchange.quotaId, exchange.principalId, exchange.walletId, exchange.authorityId, exchange.walletAuthMethodId, exchange.expiresAtMs, exchange.expiresAtMs).run(), "hosted-wallet Seams session exchange code");
 	}
-	async redeemHostedWalletSeamsSessionExchange(input) {
+	async redeemHostedWalletSeamsSessionExchange(input, publishCredentialLocator) {
 		const current = await this.readHostedWalletExchangeV2(input.codeHash);
 		const rejected = classifyHostedWalletExchangeV2(current, input);
 		if (rejected) return rejected;
 		if (!current) throw new Error("hosted-wallet exchange disappeared");
+		await publishCredentialLocator?.();
 		try {
 			const insertCredential = this.database.prepare(`INSERT INTO wallet_session_hosted_credentials_v2 (
             namespace,
@@ -931,6 +936,7 @@ var CloudflareD1AuthorizationStore = class {
 	}
 	async readLiveWalletSessionAuthorizationProjectionV2(input) {
 		const row = await this.readJoinedWalletSessionAuthorizationV2Row({
+			projection: { kind: "session" },
 			lookupColumn: "authorization_id",
 			tenantId: input.expected.tenantId,
 			lookupValue: input.expected.authorizationId
@@ -989,31 +995,48 @@ var CloudflareD1AuthorizationStore = class {
 	*/
 	async readWalletSessionAdmissionSnapshotByOperationCredential(input) {
 		const row = await this.readJoinedWalletSessionAuthorizationV2Row({
+			projection: { kind: "session" },
 			lookupColumn: "operation_credential_hash",
 			tenantId: input.tenantId,
 			lookupValue: input.tokenHash
 		});
 		if (!row) return null;
-		const session = parseLiveWalletSessionAuthorizationV2Row(row, {
-			operationCredentialHash: input.tokenHash,
+		return parseWalletSessionAdmissionRow(row, input);
+	}
+	async readEcdsaWalletSessionAdmissionSnapshotByOperationCredential(input) {
+		const row = await this.readJoinedWalletSessionAuthorizationV2Row({
+			projection: {
+				kind: "ecdsa_material",
+				materialActivation: input.materialActivation
+			},
+			lookupColumn: "operation_credential_hash",
 			tenantId: input.tenantId,
-			nowMs: input.nowMs
+			lookupValue: input.tokenHash
 		});
+		if (!row) return null;
+		const snapshot = await parseWalletSessionAdmissionRow(row, input);
+		const session = snapshot.kind === "active" ? snapshot.authorization.session : snapshot.session;
 		return {
-			authorization: {
-				session,
-				quota: parseWalletSessionAuthorizationV2QuotaRow(row, session)
-			},
-			...await joinedAuthorityAndMethod(row)
+			snapshot,
+			materialRead: EcdsaMaterialRead.fromRows(this.walletSignerScope, session.walletId, input.materialActivation, parseD1JsonColumn(row.ecdsa_material_records_json), await parseInstalledEcdsaCustodySnapshotV1({
+				scope: this.walletSignerScope,
+				walletId: session.walletId,
+				materialActivation: routerAbMpcMaterialActivationRefFromWire(input.materialActivation),
+				installations: parseD1JsonColumn(row.ecdsa_installations_json),
+				signers: parseD1JsonColumn(row.ecdsa_source_signers_json)
+			})),
+			policyRead: D1EcdsaAdmissionPolicyRead.fromRows(this.database, this.namespace, session.walletId, input.materialActivation.activation_id, parseD1JsonColumn(row.ecdsa_policy_records_json))
 		};
 	}
 	async readWalletSessionExactOperationContextByCredential(input) {
 		const row = await this.readJoinedWalletSessionAuthorizationV2Row({
+			projection: { kind: "session" },
 			lookupColumn: "operation_credential_hash",
 			tenantId: input.tenantId,
 			lookupValue: input.tokenHash
 		});
 		if (!row) return null;
+		if (row.session_retired_at_ms !== null && row.session_retired_at_ms !== void 0 || integerColumn(row.session_expires_at_ms, "session.expiresAtMs") <= input.nowMs) return null;
 		const session = parseLiveWalletSessionAuthorizationV2Row(row, {
 			operationCredentialHash: input.tokenHash,
 			tenantId: input.tenantId,
@@ -1058,6 +1081,7 @@ var CloudflareD1AuthorizationStore = class {
 		});
 		const nowMs = requirePositiveInteger(input.nowMs, "exact Wallet Session status time");
 		const row = await this.readJoinedWalletSessionAuthorizationV2Row({
+			projection: { kind: "session_status" },
 			lookupColumn: "operation_credential_hash",
 			tenantId: input.tenantId,
 			lookupValue: input.tokenHash
@@ -1120,7 +1144,7 @@ var CloudflareD1AuthorizationStore = class {
 			session,
 			quota
 		});
-		if (!await this.exactWalletSessionCapabilitySubjectsResolveMaterial(session)) return judged({
+		if (!await this.exactWalletSessionCapabilitySubjectsResolveMaterial(session, parseD1JsonColumn(row.status_ecdsa_material_records_json))) return judged({
 			kind: "capability_unavailable",
 			session,
 			quota
@@ -1131,15 +1155,20 @@ var CloudflareD1AuthorizationStore = class {
 			quota
 		});
 	}
-	async exactWalletSessionCapabilitySubjectsResolveMaterial(session) {
+	async exactWalletSessionCapabilitySubjectsResolveMaterial(session, ecdsaMaterialRows) {
 		const materials = [];
 		for (const subject of session.capabilitySubjects) switch (subject.kind) {
 			case "sign":
 			case "export_keys":
-				if (!materials.some((material) => material.keyFamily === subject.keyFamily && mpcMaterialActivationRefsEqual(material.materialActivation, subject.materialActivation))) materials.push({
-					keyFamily: subject.keyFamily,
+				if (!materials.some((material) => material.keyFamily === subject.keyFamily && mpcMaterialActivationRefsEqual(material.materialActivation, subject.materialActivation))) if (subject.keyFamily === "ed25519") materials.push({
+					keyFamily: "ed25519",
 					materialActivation: subject.materialActivation
 				});
+				else materials.push({
+					keyFamily: "ecdsa_secp256k1",
+					materialActivation: subject.materialActivation,
+					materialRead: EcdsaMaterialRead.fromRows(this.walletSignerScope, session.walletId, routerAbMpcMaterialActivationRefToWire(subject.materialActivation), ecdsaMaterialRows, null)
+				});
 				break;
 			case "link_devices":
 			case "revoke_devices": break;
@@ -1152,10 +1181,7 @@ var CloudflareD1AuthorizationStore = class {
 		const signer = subject.keyFamily === "ed25519" ? await this.walletStore.getEd25519SignerByMaterialActivation({
 			walletId,
 			materialActivation
-		}) : await this.walletStore.getEcdsaSignerByMaterialActivation({
-			walletId,
-			materialActivation
-		});
+		}) : subject.materialRead.resolve(this.walletSignerScope, walletId, materialActivation)?.signer;
 		if (!signer) return await this.readLinkedAuthorityMaterial(walletId, subject) !== null;
 		if (signer.walletId !== walletId) throw new Error("Stored wallet signer material identity does not match the session");
 		return true;
@@ -1176,8 +1202,64 @@ var CloudflareD1AuthorizationStore = class {
 		return projection;
 	}
 	async readJoinedWalletSessionAuthorizationV2Row(input) {
-		return await this.database.prepare(`SELECT
+		const installationProjection = ECDSA_INSTALLATION_SNAPSHOT_COLUMNS.map(installationJsonColumn).join(", ");
+		let materialProjection = "";
+		let materialBindings = [];
+		if (input.projection.kind === "ecdsa_material") {
+			materialProjection = `
+           (SELECT json_group_array(json_object('record_json', signer.record_json))
+              FROM wallet_signers AS signer
+             WHERE signer.namespace = session.namespace
+               AND signer.org_id = session.org_id
+               AND signer.project_id = session.project_id
+               AND signer.env_id = session.env_id
+               AND signer.wallet_id = session.wallet_id
+               AND signer.signer_family = 'ecdsa'
+               AND CASE WHEN json_valid(signer.record_json) THEN
+                 json_extract(signer.record_json,
+                   '$.walletKey.publicCapability.material_activation.activation_id') = ?
+                 ELSE 1 END
+           ) AS ecdsa_material_records_json,
+           CASE WHEN authority.provenance_kind = 'device_link' THEN
+             (SELECT json_group_array(json_object(${installationProjection}))
+                FROM linked_device_authority_installations AS installation
+               WHERE installation.namespace = session.namespace
+                 AND installation.org_id = session.org_id
+                 AND installation.project_id = session.project_id
+                 AND installation.env_id = session.env_id
+                 AND installation.wallet_id = session.wallet_id)
+           END AS ecdsa_installations_json,
+           CASE WHEN authority.provenance_kind = 'device_link' THEN
+             (SELECT json_group_array(json_object('record_json', source_signer.record_json))
+                FROM wallet_signers AS source_signer
+               WHERE source_signer.namespace = session.namespace
+                 AND source_signer.org_id = session.org_id
+                 AND source_signer.project_id = session.project_id
+                 AND source_signer.env_id = session.env_id
+                 AND source_signer.wallet_id = session.wallet_id
+                 AND source_signer.signer_family = 'ecdsa')
+           END AS ecdsa_source_signers_json,
+           ${ECDSA_CREDENTIAL_POLICY_PROJECTION}`;
+			materialBindings = [input.projection.materialActivation.activation_id, input.projection.materialActivation.activation_id];
+		} else if (input.projection.kind === "session_status") {
+			materialProjection = `
+        (SELECT json_group_array(json_object('record_json', signer.record_json))
+           FROM wallet_signers AS signer
+          WHERE signer.namespace = ? AND signer.org_id = ?
+            AND signer.project_id = ? AND signer.env_id = ?
+            AND signer.wallet_id = session.wallet_id
+            AND signer.signer_family = 'ecdsa'
+        ) AS status_ecdsa_material_records_json,`;
+			materialBindings = [
+				this.walletSignerScope.namespace,
+				this.walletSignerScope.orgId,
+				this.walletSignerScope.projectId,
+				this.walletSignerScope.envId
+			];
+		}
+		return await this.database.prepare(`SELECT ${materialProjection}
            authority.*,
+           session.namespace AS session_namespace,
            session.record_json AS session_record_json,
            session.capability_subjects_json AS session_capability_subjects_json,
            session.tenant_id AS session_tenant_id,
@@ -1240,12 +1322,13 @@ var CloudflareD1AuthorizationStore = class {
           AND session.env_id = ?
           AND session.tenant_id = ?
           AND session.${input.lookupColumn} = ?
-        LIMIT 1`).bind(this.walletSignerScope.orgId, this.walletSignerScope.projectId, this.walletSignerScope.envId, this.walletSignerScope.orgId, this.walletSignerScope.projectId, this.walletSignerScope.envId, this.namespace, this.walletSignerScope.orgId, this.walletSignerScope.projectId, this.walletSignerScope.envId, input.tenantId, input.lookupValue).first();
+        LIMIT 1`).bind(...materialBindings, this.walletSignerScope.orgId, this.walletSignerScope.projectId, this.walletSignerScope.envId, this.walletSignerScope.orgId, this.walletSignerScope.projectId, this.walletSignerScope.envId, this.namespace, this.walletSignerScope.orgId, this.walletSignerScope.projectId, this.walletSignerScope.envId, input.tenantId, input.lookupValue).first();
 	}
 	async readWalletSessionAuthorizationV2(input, lookupColumn) {
 		const lookup = "expected" in input ? input.expected : "identity" in input ? input.identity : null;
 		const operationCredentialHash = "operationCredentialHash" in input ? input.operationCredentialHash : null;
 		const row = await this.readJoinedWalletSessionAuthorizationV2Row({
+			projection: { kind: "session" },
 			lookupColumn,
 			tenantId: "operationCredentialHash" in input ? input.tenantId : lookup?.tenantId,
 			lookupValue: lookupColumn === "mint_id" ? String("expected" in input ? input.expected.mintId : lookup?.authorizationId) : lookupColumn === "authorization_id" ? String(lookup?.authorizationId) : operationCredentialHash
@@ -1273,7 +1356,7 @@ var CloudflareD1AuthorizationStore = class {
 		const row = await prepareAuthorizedOperationCommittedRead(this.database, this.namespace, operation).first();
 		if (!row || row.authorized_operation_id !== operation.authorizedOperationId || row.authorization_source_kind !== operation.authorization.kind) throw new Error("Pinned owner operation is not claimed");
 		if (operation.authorization.kind === "verified_step_up") {
-			if (row.evidence_set_digest !== operation.authorization.evidenceSetDigest) throw new Error("Verified step-up operation is not claimed");
+			if (row.evidence_set_digest !== operation.authorization.evidenceSetDigest || row.pinned_owner_wallet_id !== walletId) throw new Error("Verified step-up operation is not claimed");
 			return {
 				orgId: this.walletSignerScope.orgId,
 				projectId: this.walletSignerScope.projectId,
@@ -1286,9 +1369,9 @@ var CloudflareD1AuthorizationStore = class {
 	pinnedWalletSessionOwnerScope(row, walletId) {
 		if (row.pinned_owner_wallet_id !== walletId) throw new Error("Pinned owner Wallet Session scope is unavailable");
 		return {
-			orgId: requireString(row.linked_scope_org_id, "operation.ownerScope.orgId"),
-			projectId: requireString(row.linked_scope_project_id, "operation.ownerScope.projectId"),
-			projectEnvironmentId: requireString(row.linked_scope_env_id, "operation.ownerScope.projectEnvironmentId")
+			orgId: requireString(row.owner_scope_org_id, "operation.ownerScope.orgId"),
+			projectId: requireString(row.owner_scope_project_id, "operation.ownerScope.projectId"),
+			projectEnvironmentId: requireString(row.owner_scope_env_id, "operation.ownerScope.projectEnvironmentId")
 		};
 	}
 	async readAuthorizedOperationForAdmission(input) {
@@ -1296,20 +1379,16 @@ var CloudflareD1AuthorizationStore = class {
 			database: this.database,
 			namespace: this.namespace,
 			walletSignerScope: this.walletSignerScope,
+			materialSnapshot: input.materialSnapshot,
 			tenantId: input.tenantId,
 			operationFingerprintDigest: input.operationFingerprintDigest,
 			nowMs: requirePositiveInteger(input.nowMs, "operation replay time")
 		}).first();
-		if (!row) return null;
-		if (row.authorization_source_active !== 0 && row.authorization_source_active !== 1) throw new Error("Authorized operation source status must be a SQL boolean");
-		return {
-			row,
-			operation: await parseAuthorizedOperationRow(row),
-			sourceActive: row.authorization_source_active === 1
-		};
+		return row ? parseAuthorizedOperationAdmissionRecord(row) : null;
 	}
 	/** How an operation already admitted for this fingerprint answers another admission. */
 	answerExistingAuthorizedOperation(existing, operation, material) {
+		if (!existing.materialActive) return { kind: "material_mismatch" };
 		const replayMismatch = authorizedOperationReplayMismatch({
 			existing: existing.row,
 			incoming: operation,
@@ -1343,7 +1422,8 @@ var CloudflareD1AuthorizationStore = class {
 		const existing = await this.readAuthorizedOperationForAdmission({
 			tenantId: operation.tenantId,
 			operationFingerprintDigest: operation.operationFingerprintDigest,
-			nowMs: operation.claimedAtMs
+			nowMs: operation.claimedAtMs,
+			materialSnapshot: null
 		});
 		if (existing) {
 			const result = this.answerExistingAuthorizedOperation(existing, operation, void 0);
@@ -1360,7 +1440,9 @@ var CloudflareD1AuthorizationStore = class {
 				namespace: this.namespace,
 				walletSignerScope: this.walletSignerScope,
 				operation,
-				material: null
+				material: null,
+				materialSnapshot: null,
+				existingOperation: "reject"
 			})]
 		};
 	}
@@ -1368,17 +1450,50 @@ var CloudflareD1AuthorizationStore = class {
 		return classifyAuthorizedOperationAdmissionError(error);
 	}
 	async admitAuthorizedOperation(input) {
-		const result = await this.admitAuthorizedOperationRecord(input);
+		const result = await this.admitAuthorizedOperationRecord({
+			operation: input.operation,
+			material: input.material,
+			materialSnapshot: null
+		});
 		if (result.kind === "claimed" || result.kind === "replayed" || result.kind === "operation_in_progress") return {
 			kind: result.kind,
 			operation: result.operation
 		};
 		return result;
 	}
+	async resolveEcdsaWalletSessionOperation(input) {
+		const operation = await buildAuthorizedOperation(input.operation);
+		if (!authorizedOperationMaterialScopeMatches(operation, input.material, input.material.readSnapshot)) return { kind: "material_mismatch" };
+		const existing = await this.readAuthorizedOperationForAdmission({
+			tenantId: operation.tenantId,
+			operationFingerprintDigest: operation.operationFingerprintDigest,
+			nowMs: operation.claimedAtMs,
+			materialSnapshot: input.material.readSnapshot
+		});
+		if (!existing) return { kind: "authorized_operation_missing" };
+		const result = this.answerExistingAuthorizedOperation(existing, operation, input.material);
+		if (result.kind === "operation_in_progress") return {
+			kind: result.kind,
+			operation: result.operation,
+			ownerScope: this.pinnedWalletSessionOwnerScope(result.row, input.material.walletId)
+		};
+		if (result.kind === "replayed") return {
+			kind: result.kind,
+			operation: result.operation
+		};
+		switch (result.kind) {
+			case "authorization_grant_rejected":
+			case "verified_step_up_rejected":
+			case "wallet_session_quota_exhausted":
+			case "material_mismatch": return result;
+			default: throw new Error("Unexpected ECDSA operation resolution");
+		}
+	}
 	async admitEcdsaWalletSessionOperation(input) {
 		const result = await this.admitAuthorizedOperationRecord({
 			operation: input.operation,
-			material: input.material
+			material: input.material,
+			materialSnapshot: input.material.readSnapshot
 		});
 		switch (result.kind) {
 			case "claimed":
@@ -1403,42 +1518,52 @@ var CloudflareD1AuthorizationStore = class {
 	}
 	async admitAuthorizedOperationRecord(input) {
 		const operation = await buildAuthorizedOperation(input.operation);
-		if (operation.operation.operation.capabilityKind === CAPABILITY_KINDS.evmEcdsaMpcSigning && !input.material) return { kind: "material_mismatch" };
-		if (input.material && input.material.kind === "ecdsa_material_activation" && (operation.operation.operation.capabilityKind !== CAPABILITY_KINDS.evmEcdsaMpcSigning || input.material.runtimePolicyScope.orgId !== operation.tenantId || input.material.materialActivation.capability !== operation.operation.capabilityId || input.material.materialActivation.material_owner !== input.material.walletId)) return { kind: "material_mismatch" };
-		const existing = await this.readAuthorizedOperationForAdmission({
-			tenantId: operation.tenantId,
-			operationFingerprintDigest: operation.operationFingerprintDigest,
-			nowMs: operation.claimedAtMs
-		});
-		if (existing) return this.answerExistingAuthorizedOperation(existing, operation, input.material);
+		if (!authorizedOperationMaterialScopeMatches(operation, input.material, input.materialSnapshot)) return { kind: "material_mismatch" };
 		let committedRow;
+		let claimed;
 		try {
 			const statement = prepareAuthorizedOperationInsert({
 				database: this.database,
 				namespace: this.namespace,
 				walletSignerScope: this.walletSignerScope,
 				operation,
-				material: input.material ?? null
+				material: input.material ?? null,
+				materialSnapshot: input.materialSnapshot,
+				existingOperation: "preserve"
 			});
-			const [result, readback] = await this.database.batch([statement, prepareAuthorizedOperationCommittedRead(this.database, this.namespace, operation)]);
+			const [result, readback] = await this.database.batch([statement, prepareAuthorizedOperationAdmissionRead({
+				database: this.database,
+				namespace: this.namespace,
+				walletSignerScope: this.walletSignerScope,
+				tenantId: operation.tenantId,
+				operationFingerprintDigest: operation.operationFingerprintDigest,
+				nowMs: operation.claimedAtMs,
+				materialSnapshot: input.materialSnapshot
+			})]);
 			if (!result?.success || !readback?.success) throw new Error("authorized operation admission batch returned incomplete results");
-			if (input.material && d1ChangedRows(result) === 0) return { kind: "material_mismatch" };
+			claimed = d1ChangedRows(result) !== 0;
 			committedRow = readback.results?.[0] ?? null;
 		} catch (error) {
 			const raced = await this.readAuthorizedOperationForAdmission({
 				tenantId: operation.tenantId,
 				operationFingerprintDigest: operation.operationFingerprintDigest,
-				nowMs: operation.claimedAtMs
+				nowMs: operation.claimedAtMs,
+				materialSnapshot: input.materialSnapshot
 			});
 			if (raced) return this.answerExistingAuthorizedOperation(raced, operation, input.material);
 			const triggerFailure = classifyAuthorizedOperationAdmissionError(error);
 			if (triggerFailure) return triggerFailure;
 			throw error;
 		}
-		if (!committedRow) throw new Error("authorized operation admission could not be read back");
+		if (!committedRow) {
+			if (!claimed && input.material) return { kind: "material_mismatch" };
+			throw new Error("authorized operation admission could not be read back");
+		}
+		const admitted = await parseAuthorizedOperationAdmissionRecord(committedRow);
+		if (!claimed) return this.answerExistingAuthorizedOperation(admitted, operation, input.material);
 		return {
 			kind: "claimed",
-			operation: await parseAuthorizedOperationRow(committedRow),
+			operation: admitted.operation,
 			row: committedRow
 		};
 	}
@@ -1498,6 +1623,21 @@ var CloudflareD1AuthorizationStore = class {
           LIMIT 1`).bind(this.namespace, this.walletSignerScope.orgId, this.walletSignerScope.projectId, this.walletSignerScope.envId, codeHash).first();
 	}
 };
+async function parseAuthorizedOperationAdmissionRecord(row) {
+	if (row.authorization_source_active !== 0 && row.authorization_source_active !== 1) throw new Error("Authorized operation source status must be a SQL boolean");
+	return {
+		row,
+		operation: await parseAuthorizedOperationRow(row),
+		sourceActive: row.authorization_source_active === 1,
+		materialActive: row.material_snapshot_active === 1
+	};
+}
+function authorizedOperationMaterialScopeMatches(operation, material, snapshot) {
+	if (snapshot && snapshot.walletId !== material?.walletId) return false;
+	const requiresMaterial = operation.operation.operation.capabilityKind === CAPABILITY_KINDS.evmEcdsaMpcSigning;
+	if (!material) return !requiresMaterial;
+	return requiresMaterial && material.runtimePolicyScope.orgId === operation.tenantId && material.materialActivation.capability === operation.operation.capabilityId && material.materialActivation.material_owner === material.walletId;
+}
 function classifyAuthorizedOperationAdmissionError(error) {
 	const message = error instanceof Error ? error.message : String(error);
 	if (message.includes("authorization_wallet_session_quota_rejected")) return { kind: "wallet_session_quota_exhausted" };
@@ -1508,7 +1648,7 @@ function classifyAuthorizedOperationAdmissionError(error) {
 function authorizedOperationReplayMismatch(input) {
 	if (requireString(input.existing.authorization_source_kind, "operation.authorization.kind") !== input.incoming.authorization.kind) return authorizationSourceRejected(input.incoming.authorization);
 	if (input.incoming.authorization.kind === "authorization_grant") {
-		if (input.existing.linked_scope_org_id !== input.scope.orgId || input.existing.linked_scope_project_id !== input.scope.projectId || input.existing.linked_scope_env_id !== input.scope.envId) return { kind: "authorization_grant_rejected" };
+		if (input.existing.owner_scope_org_id !== input.scope.orgId || input.existing.owner_scope_project_id !== input.scope.projectId || input.existing.owner_scope_env_id !== input.scope.envId) return { kind: "authorization_grant_rejected" };
 		const expectedGrantKind = input.incoming.authorization.authorizationGrantRef.kind;
 		if (input.existing.authorization_grant_kind !== expectedGrantKind) return { kind: "authorization_grant_rejected" };
 		if (input.existing.authorization_id !== input.incoming.authorization.authorizationGrantRef.authorizationId) return { kind: "authorization_grant_rejected" };
@@ -1805,6 +1945,33 @@ function parseExactWalletSessionQuotaProjectionRow(row, session) {
 function assertNeverDirectV2CommitMode(value) {
 	throw new Error(`Unsupported direct V2 Wallet Session commit mode: ${String(value)}`);
 }
+async function parseWalletSessionAdmissionRow(row, input) {
+	const session = parseLiveWalletSessionAuthorizationV2Row(row, {
+		operationCredentialHash: input.tokenHash,
+		tenantId: input.tenantId,
+		nowMs: input.nowMs
+	});
+	const { authority, authMethod } = await joinedAuthorityAndMethod(row);
+	if (row.quota_lifecycle_kind === "exhausted") return {
+		kind: "exhausted",
+		session,
+		quota: parseExactWalletSessionQuotaProjectionRow(row, session),
+		authority,
+		authMethod
+	};
+	return {
+		kind: "active",
+		authorization: {
+			session,
+			quota: parseWalletSessionAuthorizationV2QuotaRow(row, session)
+		},
+		authority,
+		authMethod
+	};
+}
+function installationJsonColumn(column) {
+	return `'${column}', installation.${column}`;
+}
 //#endregion
 export { CloudflareD1AuthorizationStore };