@seams/wallet-server 0.7.3 → 0.9.0

package/dist/esm/router/cloudflare/d1/authorization/d1AuthorizationStore.js

@@ -5,12 +5,15 @@ import { buildCapabilityOperationEnvelope, computeCapabilityOperationFingerprint
 import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { buildActiveWalletSessionQuota, buildAuthorizedOperation, buildExactWalletSessionQuotaProjectionV1, computeAuthorizedOperationResultDigest, exactWalletSessionCapabilitySubjectsResolveAuthority, parseAuthorizedOperationReplayResponse, parseHostedWalletSessionCredentialId, parseSessionOrigin, parseWalletSessionAuthorizationV2, walletSessionAuthorizationV2RecordsEqual } from "../../../../authorization/domain.js";
 import { ECDSA_INSTALLATION_SNAPSHOT_COLUMNS } from "../../../../core/ecdsaMaterialReadSnapshot.js";
-import { d1ChangedRows, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
+import { D1_BATCH_CAS_GUARD_SQL, d1ChangedRows, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
 import { EcdsaMaterialRead } from "../../../../core/d1EcdsaSignerRead.js";
-import { D1WalletStore } from "../../../../core/d1WalletStore.js";
+import { D1WalletStore, ED25519_SIGNER_ACTIVATION_ID_PATH } from "../../../../core/d1WalletStore.js";
 import { normalizeWalletAuthMethodV2 } from "../../../../core/d1WalletAuthMethodStore.js";
-import { D1EcdsaAdmissionPolicyRead, ECDSA_CREDENTIAL_POLICY_PROJECTION } from "../signingAdmission/d1RouterAbNormalSigningAdmissionStore.js";
+import { D1EcdsaAdmissionPolicyRead, D1Ed25519AdmissionPolicyRead, ECDSA_CREDENTIAL_POLICY_PROJECTION, ED25519_CREDENTIAL_POLICY_PROJECTION } from "../signingAdmission/d1RouterAbNormalSigningAdmissionStore.js";
 import { parseInstalledEcdsaCustodySnapshotV1 } from "../deviceLinking/d1LinkedDeviceAuthorityInstallService.js";
+import { D1RegistrationSessionTransaction } from "../registration/d1RegistrationSessionTransaction.js";
+import { ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistrationPartitionedStateStore.js";
+import { Ed25519SignerRead } from "../../../../core/d1Ed25519SignerRead.js";
 import { prepareAuthorizedOperationAdmissionRead, prepareAuthorizedOperationCommittedRead, prepareAuthorizedOperationInsert, prepareAuthorizedOperationRead } from "./authorizedOperationStatements.js";
 import { prepareD1WalletSessionAuthorityProjectionStatements } from "./walletSessionAuthorityProjection.js";
 import { parseD1WalletAuthorityRow } from "../wallet/d1WalletAuthorityStore.js";
@@ -319,11 +322,12 @@ var CloudflareD1AuthorizationStore = class {
            AND quota.expires_at_ms >= ?
            AND ${ACTIVE_V2_HOSTED_PARENT_PROVENANCE_SQL}`).bind(this.namespace, this.walletSignerScope.orgId, this.walletSignerScope.projectId, this.walletSignerScope.envId, exchange.tenantId, exchange.exchangeCodeId, exchange.authorizationId, exchange.walletSessionId, exchange.quotaId, exchange.principalId, exchange.walletId, exchange.authorityId, exchange.walletAuthMethodId, exchange.codeHash, exchange.nonceDigest, exchange.appOrigin, exchange.walletOrigin, requirePositiveInteger(exchange.issuedAtMs, "exchange.issuedAtMs"), requirePositiveInteger(exchange.expiresAtMs, "exchange.expiresAtMs"), this.namespace, this.walletSignerScope.orgId, this.walletSignerScope.projectId, this.walletSignerScope.envId, exchange.tenantId, exchange.authorizationId, exchange.walletSessionId, exchange.quotaId, exchange.principalId, exchange.walletId, exchange.authorityId, exchange.walletAuthMethodId, exchange.expiresAtMs, exchange.expiresAtMs).run(), "hosted-wallet Seams session exchange code");
 	}
-	async redeemHostedWalletSeamsSessionExchange(input) {
+	async redeemHostedWalletSeamsSessionExchange(input, publishCredentialLocator) {
 		const current = await this.readHostedWalletExchangeV2(input.codeHash);
 		const rejected = classifyHostedWalletExchangeV2(current, input);
 		if (rejected) return rejected;
 		if (!current) throw new Error("hosted-wallet exchange disappeared");
+		await publishCredentialLocator?.();
 		try {
 			const insertCredential = this.database.prepare(`INSERT INTO wallet_session_hosted_credentials_v2 (
             namespace,
@@ -603,6 +607,7 @@ var CloudflareD1AuthorizationStore = class {
 	}
 	async putVerifiedEvidenceSet(evidenceSet) {
 		if (d1ChangedRows(await this.database.prepare(`INSERT OR IGNORE INTO verified_wallet_operation_evidence_sets (
+          org_id, project_id, env_id,
           namespace,
           tenant_id,
           evidence_set_id,
@@ -621,7 +626,7 @@ var CloudflareD1AuthorizationStore = class {
           assurance,
           verified_at_ms,
           expires_at_ms
-        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).bind(this.namespace, evidenceSet.tenantId, evidenceSet.evidenceSetId, evidenceSet.principalId, evidenceSet.walletId, evidenceSet.authorityRef.authorityDigest, evidenceSet.requestOrigin, evidenceSet.audience, evidenceSet.evidenceSetDigest, JSON.stringify(evidenceSet.evidence), evidenceSet.operation.capabilityKind, evidenceSet.operation.operationKind, evidenceSet.laneDigest, evidenceSet.intentDigest, evidenceSet.displayDigest, evidenceSet.assurance, requirePositiveInteger(evidenceSet.verifiedAtMs, "evidenceSet.verifiedAtMs"), requirePositiveInteger(evidenceSet.expiresAtMs, "evidenceSet.expiresAtMs")).run()) > 1) throw new Error("verified wallet operation evidence set changed more than one row");
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).bind(this.walletSignerScope.orgId, this.walletSignerScope.projectId, this.walletSignerScope.envId, this.namespace, evidenceSet.tenantId, evidenceSet.evidenceSetId, evidenceSet.principalId, evidenceSet.walletId, evidenceSet.authorityRef.authorityDigest, evidenceSet.requestOrigin, evidenceSet.audience, evidenceSet.evidenceSetDigest, JSON.stringify(evidenceSet.evidence), evidenceSet.operation.capabilityKind, evidenceSet.operation.operationKind, evidenceSet.laneDigest, evidenceSet.intentDigest, evidenceSet.displayDigest, evidenceSet.assurance, requirePositiveInteger(evidenceSet.verifiedAtMs, "evidenceSet.verifiedAtMs"), requirePositiveInteger(evidenceSet.expiresAtMs, "evidenceSet.expiresAtMs")).run()) > 1) throw new Error("verified wallet operation evidence set changed more than one row");
 	}
 	async consumeVerifiedOwnerProof(proof, consumedAtMs, consumptionScopeId) {
 		const consumedAt = requirePositiveInteger(consumedAtMs, "owner proof consumedAtMs");
@@ -659,28 +664,40 @@ var CloudflareD1AuthorizationStore = class {
 	async commitDirectWalletSessionAuthorizationV2(input) {
 		return await this.commitDirectWalletSessionAuthorizationV2WithMode({
 			persisted: input.persisted,
-			mode: { kind: "strict" }
+			mode: { kind: "strict" },
+			purpose: { kind: "ordinary" }
 		});
 	}
+	async readWalletSessionIssuanceGeneration(walletId) {
+		const row = await this.prepareWalletSessionIssuanceGenerationRead(walletId).first();
+		if (!row) throw new Error("Wallet session issuance requires an open execution generation");
+		return requirePositiveInteger(row.generation, "Wallet Session ownership generation");
+	}
+	prepareWalletSessionIssuanceGenerationRead(walletId) {
+		return this.database.prepare(`SELECT generation, state FROM wallet_execution_generations
+       WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
+         AND wallet_id = ? AND state IN ('registering', 'active')`).bind(this.namespace, this.walletSignerScope.orgId, this.walletSignerScope.projectId, this.walletSignerScope.envId, walletId);
+	}
 	/** The service validates the committed winner against its caller-specific replay contract. */
 	async commitDirectReplayableWalletSessionAuthorizationV2(input) {
 		return await this.commitDirectWalletSessionAuthorizationV2WithMode({
 			persisted: input.persisted,
-			mode: { kind: "replayable" }
+			mode: { kind: "replayable" },
+			purpose: input.purpose
 		});
 	}
-	async commitDirectWalletSessionAuthorizationV2WithMode(input) {
+	async commitRegistrationWalletSessionAuthorizationV2(commitWallet, input) {
+		if (input.purpose.kind !== "registration") throw new Error("A wallet registration transaction requires a registration session");
+		const transaction = new D1RegistrationSessionTransaction(this.database, commitWallet);
+		return this.commitDirectWalletSessionAuthorizationV2WithMode({
+			persisted: input.persisted,
+			purpose: input.purpose,
+			mode: { kind: "replayable" }
+		}, transaction.execute.bind(transaction));
+	}
+	async commitDirectWalletSessionAuthorizationV2WithMode(input, executeBatch) {
 		const { persisted, mode } = input;
 		requireExactPersistedActiveWalletSessionAuthorizationV2(persisted);
-		const statements = this.prepareDirectWalletSessionAuthorizationV2Statements(persisted);
-		const results = await this.database.batch(statements);
-		if (results.length !== 6) throw new Error("Direct V2 Wallet Session transaction returned incomplete results");
-		const quotaResult = results[4];
-		const sessionResult = results[5];
-		if (!quotaResult || !sessionResult) throw new Error("Direct V2 Wallet Session transaction returned incomplete results");
-		const quotaChanges = d1ChangedRows(quotaResult);
-		const sessionChanges = d1ChangedRows(sessionResult);
-		if (quotaChanges !== sessionChanges) throw new Error("Direct V2 Wallet Session transaction persisted an incomplete identity");
 		const lookup = {
 			tenantId: persisted.session.tenantId,
 			principalId: persisted.session.principalId,
@@ -689,13 +706,44 @@ var CloudflareD1AuthorizationStore = class {
 			walletAuthMethodId: persisted.session.walletAuthMethodId,
 			mintId: persisted.session.mintId
 		};
-		const committed = await this.readWalletSessionAuthorizationV2ByMint(lookup);
-		if (!committed) throw new Error("Direct V2 Wallet Session authorization commit was not readable");
+		const completionStatements = this.prepareRegistrationSessionCompletion(input.purpose, lookup);
+		const statements = [
+			...this.prepareDirectWalletSessionAuthorizationV2Statements(persisted),
+			this.prepareWalletSessionAuthorizationV2ByMintRead(lookup),
+			this.prepareWalletSessionIssuanceGenerationRead(persisted.session.walletId),
+			...completionStatements
+		];
+		const results = executeBatch ? await executeBatch(statements) : await this.database.batch(statements);
+		if (results.length !== 8 + completionStatements.length) throw new Error("Direct V2 Wallet Session transaction returned incomplete results");
+		const quotaResult = results[4];
+		const sessionResult = results[5];
+		const committedResult = results[6];
+		if (!quotaResult || !sessionResult || !committedResult?.success) throw new Error("Direct V2 Wallet Session transaction returned incomplete results");
+		const quotaChanges = d1ChangedRows(quotaResult);
+		const sessionChanges = d1ChangedRows(sessionResult);
+		if (quotaChanges !== sessionChanges) throw new Error("Direct V2 Wallet Session transaction persisted an incomplete identity");
+		const committed = parseWalletSessionAuthorizationV2MintRow(committedResult.results?.[0] ?? null, lookup);
+		const generationResult = results[7];
+		const generation = generationResult?.results?.[0];
+		let registration = null;
+		if (input.purpose.kind === "registration") {
+			if (!generationResult?.success || generation?.state !== "registering" && generation?.state !== "active") throw new Error("Registration session commit requires an open execution generation");
+			registration = {
+				ceremonyId: input.purpose.ceremonyId,
+				walletId: lookup.walletId,
+				state: generation.state
+			};
+		}
+		if (!committed) {
+			if (!generationResult?.success || !generation) throw new Error("Wallet session issuance requires an open execution generation");
+			throw new Error("Direct V2 Wallet Session authorization commit was not readable");
+		}
 		if (sessionChanges === 0) switch (mode.kind) {
 			case "strict": break;
 			case "replayable": return {
 				kind: "already_committed",
-				committed
+				committed,
+				registration
 			};
 			default: return assertNeverDirectV2CommitMode(mode);
 		}
@@ -703,10 +751,33 @@ var CloudflareD1AuthorizationStore = class {
 		if (committed.primaryOperationCredentialDigestB64u !== persisted.primaryOperationCredentialDigestB64u) throw new Error("Direct V2 Wallet Session commit returned a different credential digest");
 		if (sessionChanges === 0) return {
 			kind: "already_committed",
-			committed
+			committed,
+			registration
 		};
 		if (sessionChanges !== 1) throw new Error("Direct V2 Wallet Session transaction changed more than one session");
-		return { kind: "inserted" };
+		if (!generationResult?.success || !generation) throw new Error("Wallet session issuance requires an open execution generation");
+		return {
+			kind: "inserted",
+			registration,
+			ownershipGeneration: requirePositiveInteger(generation.generation, "Wallet Session ownership generation")
+		};
+	}
+	prepareRegistrationSessionCompletion(purpose, session) {
+		switch (purpose.kind) {
+			case "ordinary": return [];
+			case "registration": return [this.database.prepare(`UPDATE wallet_execution_generations SET registration_completion = 'established'
+             WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+               AND wallet_id = ?5 AND origin = 'registration' AND origin_id = ?6
+               AND state IN ('registering', 'active')
+               AND registration_completion IN ('pending', 'established')
+               AND EXISTS (
+                 SELECT 1 FROM wallet_session_authorizations_v2
+                 WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4
+                   AND wallet_id = ?5 AND tenant_id = ?7 AND principal_id = ?8
+                   AND authority_id = ?9 AND wallet_auth_method_id = ?10 AND mint_id = ?11
+               )`).bind(this.namespace, this.walletSignerScope.orgId, this.walletSignerScope.projectId, this.walletSignerScope.envId, session.walletId, purpose.ceremonyId, session.tenantId, String(session.principalId), session.authorityId, session.walletAuthMethodId, session.mintId), this.database.prepare(D1_BATCH_CAS_GUARD_SQL)];
+			default: return assertNeverDirectWalletSessionCommitPurpose(purpose);
+		}
 	}
 	/**
 	* Builds the one batch used by direct issuance. Every predecessor mutation
@@ -767,8 +838,7 @@ var CloudflareD1AuthorizationStore = class {
           expires_at_ms
         )
         SELECT ?, ?, ?, ?, ?, ?, 'active', ?
-         WHERE ${availabilitySql}
-           AND ${ACTIVE_V2_AUTHORITY_METHOD_EXISTS_SQL}`).bind(this.namespace, quota.tenantId, String(quota.quotaId), String(quota.walletSessionId), String(quota.principalId), requirePositiveInteger(quota.remainingUses, "Direct V2 quota.remainingUses"), requirePositiveInteger(quota.expiresAtMs, "Direct V2 quota.expiresAtMs"), ...availabilityBindings, ...activeV2AuthorityMethodBindings(this.walletSignerScope, session));
+         WHERE ${availabilitySql}`).bind(this.namespace, quota.tenantId, String(quota.quotaId), String(quota.walletSessionId), String(quota.principalId), requirePositiveInteger(quota.remainingUses, "Direct V2 quota.remainingUses"), requirePositiveInteger(quota.expiresAtMs, "Direct V2 quota.expiresAtMs"), ...availabilityBindings);
 		const sessionStatement = this.database.prepare(`INSERT OR IGNORE INTO wallet_session_authorizations_v2 (
           namespace,
           org_id,
@@ -794,7 +864,6 @@ var CloudflareD1AuthorizationStore = class {
         )
         SELECT ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, ?, ?
          WHERE ${sessionIdentityAvailabilitySql}
-           AND ${ACTIVE_V2_AUTHORITY_METHOD_EXISTS_SQL}
            AND EXISTS (
              SELECT 1
                FROM authorization_wallet_session_quotas AS quota
@@ -806,7 +875,7 @@ var CloudflareD1AuthorizationStore = class {
                 AND quota.remaining_uses = ?
                 AND quota.lifecycle_kind = 'active'
                 AND quota.expires_at_ms = ?
-           )`).bind(this.namespace, this.walletSignerScope.orgId, this.walletSignerScope.projectId, this.walletSignerScope.envId, session.tenantId, String(session.authorizationId), String(session.mintId), String(session.walletSessionId), String(session.quotaId), String(session.principalId), String(session.walletId), String(session.authorityId), String(session.walletAuthMethodId), String(session.authorityDigestB64u), session.authorityRevocationEpoch, capabilitySubjectsJson, requirePositiveInteger(session.createdAtMs, "Direct V2 session.createdAtMs"), requirePositiveInteger(session.expiresAtMs, "Direct V2 session.expiresAtMs"), recordJson, String(primaryOperationCredentialDigestB64u), ...sessionIdentityAvailabilityBindings, ...activeV2AuthorityMethodBindings(this.walletSignerScope, session), this.namespace, quota.tenantId, String(quota.quotaId), String(quota.walletSessionId), String(quota.principalId), requirePositiveInteger(quota.remainingUses, "Direct V2 quota.remainingUses"), requirePositiveInteger(quota.expiresAtMs, "Direct V2 quota.expiresAtMs"));
+           )`).bind(this.namespace, this.walletSignerScope.orgId, this.walletSignerScope.projectId, this.walletSignerScope.envId, session.tenantId, String(session.authorizationId), String(session.mintId), String(session.walletSessionId), String(session.quotaId), String(session.principalId), String(session.walletId), String(session.authorityId), String(session.walletAuthMethodId), String(session.authorityDigestB64u), session.authorityRevocationEpoch, capabilitySubjectsJson, requirePositiveInteger(session.createdAtMs, "Direct V2 session.createdAtMs"), requirePositiveInteger(session.expiresAtMs, "Direct V2 session.expiresAtMs"), recordJson, String(primaryOperationCredentialDigestB64u), ...sessionIdentityAvailabilityBindings, this.namespace, quota.tenantId, String(quota.quotaId), String(quota.walletSessionId), String(quota.principalId), requirePositiveInteger(quota.remainingUses, "Direct V2 quota.remainingUses"), requirePositiveInteger(quota.expiresAtMs, "Direct V2 quota.expiresAtMs"));
 		const [deleteHostedExchanges, retireHostedCredentials] = this.prepareRetireHostedChildrenForParentSelection({
 			tenantId: session.tenantId,
 			nowMs: session.createdAtMs,
@@ -815,12 +884,14 @@ var CloudflareD1AuthorizationStore = class {
           AND predecessor.authority_id = ?
           AND predecessor.wallet_auth_method_id = ?
           AND predecessor.mint_id != ?
-          AND predecessor.retired_at_ms IS NULL`,
+          AND predecessor.retired_at_ms IS NULL
+          AND ${availabilitySql}`,
 			parentSelectionBindings: [
 				session.walletId,
 				session.authorityId,
 				session.walletAuthMethodId,
-				session.mintId
+				session.mintId,
+				...availabilityBindings
 			]
 		});
 		return [
@@ -863,7 +934,10 @@ var CloudflareD1AuthorizationStore = class {
 		});
 	}
 	async readWalletSessionAuthorizationV2ByMint(input) {
-		const row = await this.database.prepare(`SELECT
+		return parseWalletSessionAuthorizationV2MintRow(await this.prepareWalletSessionAuthorizationV2ByMintRead(input).first(), input);
+	}
+	prepareWalletSessionAuthorizationV2ByMintRead(input) {
+		return this.database.prepare(`SELECT
            record_json,
            capability_subjects_json,
            tenant_id,
@@ -892,46 +966,7 @@ var CloudflareD1AuthorizationStore = class {
           AND authority_id = ?
           AND wallet_auth_method_id = ?
           AND mint_id = ?
-        LIMIT 1`).bind(this.namespace, this.walletSignerScope.orgId, this.walletSignerScope.projectId, this.walletSignerScope.envId, input.tenantId, String(input.principalId), String(input.walletId), String(input.authorityId), String(input.walletAuthMethodId), String(input.mintId)).first();
-		if (!row) return null;
-		const session = parsePersistedWalletSessionAuthorizationV2(parseD1JsonColumn(row.record_json));
-		if (!walletSessionAuthorizationV2RowMatches({
-			session_tenant_id: row.tenant_id,
-			session_authorization_id: row.authorization_id,
-			session_mint_id: row.mint_id,
-			session_wallet_session_id: row.wallet_session_id,
-			session_quota_id: row.quota_id,
-			session_principal_id: row.principal_id,
-			session_wallet_id: row.wallet_id,
-			session_authority_id: row.authority_id,
-			session_wallet_auth_method_id: row.wallet_auth_method_id,
-			session_authority_digest_b64u: row.authority_digest_b64u,
-			session_authority_revocation_epoch: row.authority_revocation_epoch,
-			session_issued_at_ms: row.issued_at_ms,
-			session_expires_at_ms: row.expires_at_ms
-		}, session)) throw new Error("Stored V2 Wallet Session mint columns disagree with record");
-		if (!walletSessionAuthorizationV2RecordsEqual(parseWalletSessionAuthorizationV2WithSubjects({
-			session_tenant_id: row.tenant_id,
-			session_authorization_id: row.authorization_id,
-			session_mint_id: row.mint_id,
-			session_wallet_session_id: row.wallet_session_id,
-			session_quota_id: row.quota_id,
-			session_principal_id: row.principal_id,
-			session_wallet_id: row.wallet_id,
-			session_authority_id: row.authority_id,
-			session_wallet_auth_method_id: row.wallet_auth_method_id,
-			session_authority_digest_b64u: row.authority_digest_b64u,
-			session_authority_revocation_epoch: row.authority_revocation_epoch,
-			session_issued_at_ms: row.issued_at_ms,
-			session_expires_at_ms: row.expires_at_ms
-		}, parseD1JsonColumn(row.capability_subjects_json)), session)) throw new Error("Stored V2 Wallet Session mint subjects disagree with record");
-		if (session.tenantId !== input.tenantId || session.principalId !== input.principalId || session.walletId !== input.walletId || session.authorityId !== input.authorityId || session.walletAuthMethodId !== input.walletAuthMethodId || session.mintId !== input.mintId) throw new Error("Stored V2 Wallet Session mint identity does not match the request");
-		return {
-			kind: "committed",
-			session,
-			primaryOperationCredentialDigestB64u: parseDigestB64u(row.operation_credential_hash),
-			retiredAtMs: row.retired_at_ms === null || row.retired_at_ms === void 0 ? null : requirePositiveInteger(row.retired_at_ms, "V2 session.retiredAtMs")
-		};
+        LIMIT 1`).bind(this.namespace, this.walletSignerScope.orgId, this.walletSignerScope.projectId, this.walletSignerScope.envId, input.tenantId, String(input.principalId), String(input.walletId), String(input.authorityId), String(input.walletAuthMethodId), String(input.mintId));
 	}
 	async readLiveWalletSessionAuthorizationProjectionV2(input) {
 		const row = await this.readJoinedWalletSessionAuthorizationV2Row({
@@ -999,7 +1034,7 @@ var CloudflareD1AuthorizationStore = class {
 			tenantId: input.tenantId,
 			lookupValue: input.tokenHash
 		});
-		if (!row) return null;
+		if (!row || row.session_retired_at_ms !== null) return null;
 		return parseWalletSessionAdmissionRow(row, input);
 	}
 	async readEcdsaWalletSessionAdmissionSnapshotByOperationCredential(input) {
@@ -1012,7 +1047,7 @@ var CloudflareD1AuthorizationStore = class {
 			tenantId: input.tenantId,
 			lookupValue: input.tokenHash
 		});
-		if (!row) return null;
+		if (!row || row.session_retired_at_ms !== null) return null;
 		const snapshot = await parseWalletSessionAdmissionRow(row, input);
 		const session = snapshot.kind === "active" ? snapshot.authorization.session : snapshot.session;
 		return {
@@ -1027,6 +1062,30 @@ var CloudflareD1AuthorizationStore = class {
 			policyRead: D1EcdsaAdmissionPolicyRead.fromRows(this.database, this.namespace, session.walletId, input.materialActivation.activation_id, parseD1JsonColumn(row.ecdsa_policy_records_json))
 		};
 	}
+	/**
+	* The session with the Ed25519 signer and the policy rows its admission
+	* needs, in one statement. The signer and the policy are those of the
+	* session's own wallet, whatever wallet the request names.
+	*/
+	async readEd25519WalletSessionAdmissionSnapshotByOperationCredential(input) {
+		const row = await this.readJoinedWalletSessionAuthorizationV2Row({
+			projection: {
+				kind: "ed25519_material",
+				materialActivation: input.materialActivation
+			},
+			lookupColumn: "operation_credential_hash",
+			tenantId: input.tenantId,
+			lookupValue: input.tokenHash
+		});
+		if (!row || row.session_retired_at_ms !== null) return null;
+		const snapshot = await parseWalletSessionAdmissionRow(row, input);
+		const session = snapshot.kind === "active" ? snapshot.authorization.session : snapshot.session;
+		return {
+			snapshot,
+			signerRead: Ed25519SignerRead.fromRows(session.walletId, input.materialActivation, parseD1JsonColumn(row.ed25519_material_records_json), parseD1JsonColumn(row.ed25519_capability_partition_json)),
+			policyRead: D1Ed25519AdmissionPolicyRead.fromRows(this.database, this.namespace, session.walletId, session.authorityId, parseD1JsonColumn(row.ed25519_policy_records_json))
+		};
+	}
 	async readWalletSessionExactOperationContextByCredential(input) {
 		const row = await this.readJoinedWalletSessionAuthorizationV2Row({
 			projection: { kind: "session" },
@@ -1035,6 +1094,7 @@ var CloudflareD1AuthorizationStore = class {
 			lookupValue: input.tokenHash
 		});
 		if (!row) return null;
+		if (row.session_retired_at_ms !== null && row.session_retired_at_ms !== void 0 || integerColumn(row.session_expires_at_ms, "session.expiresAtMs") <= input.nowMs) return null;
 		const session = parseLiveWalletSessionAuthorizationV2Row(row, {
 			operationCredentialHash: input.tokenHash,
 			tenantId: input.tenantId,
@@ -1050,6 +1110,7 @@ var CloudflareD1AuthorizationStore = class {
 			authMethod,
 			retiredAtMs: null,
 			ownerWalletScope: {
+				ownershipGeneration: requirePositiveInteger(row.execution_generation, "session.ownershipGeneration"),
 				orgId: requireString(row.session_org_id, "session.ownerWalletScope.orgId"),
 				projectId: requireString(row.session_project_id, "session.ownerWalletScope.projectId"),
 				projectEnvironmentId: requireString(row.session_env_id, "session.ownerWalletScope.projectEnvironmentId"),
@@ -1239,6 +1300,37 @@ var CloudflareD1AuthorizationStore = class {
            END AS ecdsa_source_signers_json,
            ${ECDSA_CREDENTIAL_POLICY_PROJECTION}`;
 			materialBindings = [input.projection.materialActivation.activation_id, input.projection.materialActivation.activation_id];
+		} else if (input.projection.kind === "ed25519_material") {
+			const signerScope = [
+				this.walletSignerScope.namespace,
+				this.walletSignerScope.orgId,
+				this.walletSignerScope.projectId,
+				this.walletSignerScope.envId
+			];
+			materialProjection = `
+           (SELECT json_group_array(json_object('record_json', signer.record_json))
+              FROM wallet_signers AS signer
+             WHERE signer.namespace = ? AND signer.org_id = ?
+               AND signer.project_id = ? AND signer.env_id = ?
+               AND signer.wallet_id = session.wallet_id
+               AND signer.signer_family = 'ed25519'
+               AND CASE WHEN json_valid(signer.record_json) THEN
+                 json_extract(signer.record_json, '${ED25519_SIGNER_ACTIVATION_ID_PATH}') = ?
+                 ELSE 0 END
+           ) AS ed25519_material_records_json,
+           (SELECT record_json FROM router_ab_yao_versioned_json_records
+             WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
+               AND record_key = ?
+           ) AS ed25519_capability_partition_json,
+           ${ED25519_CREDENTIAL_POLICY_PROJECTION}`;
+			materialBindings = [
+				...signerScope,
+				input.projection.materialActivation.activation_id,
+				...signerScope,
+				`router-ab-yao:${ROUTER_AB_ED25519_YAO_SHARED_STATE_RECORD_KEY_V1}`,
+				...signerScope,
+				input.projection.materialActivation.activation_id
+			];
 		} else if (input.projection.kind === "session_status") {
 			materialProjection = `
         (SELECT json_group_array(json_object('record_json', signer.record_json))
@@ -1257,6 +1349,13 @@ var CloudflareD1AuthorizationStore = class {
 		}
 		return await this.database.prepare(`SELECT ${materialProjection}
            authority.*,
+           (SELECT execution.generation FROM wallet_execution_generations AS execution
+             WHERE execution.namespace = session.namespace
+               AND execution.org_id = session.org_id
+               AND execution.project_id = session.project_id
+               AND execution.env_id = session.env_id
+               AND execution.wallet_id = session.wallet_id
+               AND execution.state = 'active') AS execution_generation,
            session.namespace AS session_namespace,
            session.record_json AS session_record_json,
            session.capability_subjects_json AS session_capability_subjects_json,
@@ -1354,8 +1453,9 @@ var CloudflareD1AuthorizationStore = class {
 		const row = await prepareAuthorizedOperationCommittedRead(this.database, this.namespace, operation).first();
 		if (!row || row.authorized_operation_id !== operation.authorizedOperationId || row.authorization_source_kind !== operation.authorization.kind) throw new Error("Pinned owner operation is not claimed");
 		if (operation.authorization.kind === "verified_step_up") {
-			if (row.evidence_set_digest !== operation.authorization.evidenceSetDigest) throw new Error("Verified step-up operation is not claimed");
+			if (row.evidence_set_digest !== operation.authorization.evidenceSetDigest || row.pinned_owner_wallet_id !== walletId || row.step_up_org_id !== this.walletSignerScope.orgId || row.step_up_project_id !== this.walletSignerScope.projectId || row.step_up_env_id !== this.walletSignerScope.envId) throw new Error("Verified step-up operation is not claimed");
 			return {
+				ownershipGeneration: requirePositiveInteger(row.ownership_generation, "operation.ownershipGeneration"),
 				orgId: this.walletSignerScope.orgId,
 				projectId: this.walletSignerScope.projectId,
 				projectEnvironmentId: this.walletSignerScope.envId
@@ -1367,9 +1467,10 @@ var CloudflareD1AuthorizationStore = class {
 	pinnedWalletSessionOwnerScope(row, walletId) {
 		if (row.pinned_owner_wallet_id !== walletId) throw new Error("Pinned owner Wallet Session scope is unavailable");
 		return {
-			orgId: requireString(row.linked_scope_org_id, "operation.ownerScope.orgId"),
-			projectId: requireString(row.linked_scope_project_id, "operation.ownerScope.projectId"),
-			projectEnvironmentId: requireString(row.linked_scope_env_id, "operation.ownerScope.projectEnvironmentId")
+			ownershipGeneration: requirePositiveInteger(row.ownership_generation, "operation.ownershipGeneration"),
+			orgId: requireString(row.owner_scope_org_id, "operation.ownerScope.orgId"),
+			projectId: requireString(row.owner_scope_project_id, "operation.ownerScope.projectId"),
+			projectEnvironmentId: requireString(row.owner_scope_env_id, "operation.ownerScope.projectEnvironmentId")
 		};
 	}
 	async readAuthorizedOperationForAdmission(input) {
@@ -1469,39 +1570,32 @@ var CloudflareD1AuthorizationStore = class {
 			materialSnapshot: input.material.readSnapshot
 		});
 		if (!existing) return { kind: "authorized_operation_missing" };
-		const result = this.answerExistingAuthorizedOperation(existing, operation, input.material);
-		if (result.kind === "operation_in_progress") return {
-			kind: result.kind,
-			operation: result.operation,
-			ownerScope: this.pinnedWalletSessionOwnerScope(result.row, input.material.walletId)
-		};
-		if (result.kind === "replayed") return {
-			kind: result.kind,
-			operation: result.operation
-		};
-		switch (result.kind) {
-			case "authorization_grant_rejected":
-			case "verified_step_up_rejected":
-			case "wallet_session_quota_exhausted":
-			case "material_mismatch": return result;
-			default: throw new Error("Unexpected ECDSA operation resolution");
-		}
+		return this.pinExistingWalletSessionOperation(this.answerExistingAuthorizedOperation(existing, operation, input.material), input.material.walletId);
 	}
-	async admitEcdsaWalletSessionOperation(input) {
-		const result = await this.admitAuthorizedOperationRecord({
-			operation: input.operation,
-			material: input.material,
-			materialSnapshot: input.material.readSnapshot
+	/**
+	* The stored operation answers for itself: its own grant must still be
+	* active, as when a finalize request admitted it again.
+	*/
+	async resolveEd25519WalletSessionOperation(input) {
+		const existing = await this.readAuthorizedOperationForAdmission({
+			tenantId: input.tenantId,
+			operationFingerprintDigest: input.operationFingerprintDigest,
+			nowMs: input.nowMs,
+			materialSnapshot: null
 		});
+		if (!existing) return { kind: "authorized_operation_missing" };
+		if (existing.operation.authorization.kind !== "authorization_grant") return { kind: "authorization_grant_rejected" };
+		return this.pinExistingWalletSessionOperation(this.answerExistingAuthorizedOperation(existing, existing.operation, void 0), input.walletId);
+	}
+	pinExistingWalletSessionOperation(result, walletId) {
 		switch (result.kind) {
-			case "claimed":
 			case "operation_in_progress": return {
 				kind: result.kind,
 				operation: result.operation,
-				ownerScope: this.pinnedWalletSessionOwnerScope(result.row, input.material.walletId)
+				ownerScope: this.pinnedWalletSessionOwnerScope(result.row, walletId)
 			};
 			case "replayed": return {
-				kind: "replayed",
+				kind: result.kind,
 				operation: result.operation
 			};
 			case "authorization_grant_rejected":
@@ -1510,10 +1604,33 @@ var CloudflareD1AuthorizationStore = class {
 			case "material_mismatch": return result;
 			default: {
 				const unexpected = result;
-				throw new Error(`Unexpected ECDSA admission: ${unexpected}`);
+				throw new Error(`Unexpected Wallet Session resolution: ${unexpected}`);
 			}
 		}
 	}
+	async admitEcdsaWalletSessionOperation(input) {
+		return this.pinWalletSessionAdmission(await this.admitAuthorizedOperationRecord({
+			operation: input.operation,
+			material: input.material,
+			materialSnapshot: input.material.readSnapshot
+		}), input.material.walletId);
+	}
+	async admitEd25519WalletSessionOperation(input) {
+		return this.pinWalletSessionAdmission(await this.admitAuthorizedOperationRecord({
+			operation: input.operation,
+			material: void 0,
+			materialSnapshot: null
+		}), input.walletId);
+	}
+	/** A live operation's owner scope comes from the row its own admission read back. */
+	pinWalletSessionAdmission(result, walletId) {
+		if (result.kind !== "claimed") return this.pinExistingWalletSessionOperation(result, walletId);
+		return {
+			kind: "claimed",
+			operation: result.operation,
+			ownerScope: this.pinnedWalletSessionOwnerScope(result.row, walletId)
+		};
+	}
 	async admitAuthorizedOperationRecord(input) {
 		const operation = await buildAuthorizedOperation(input.operation);
 		if (!authorizedOperationMaterialScopeMatches(operation, input.material, input.materialSnapshot)) return { kind: "material_mismatch" };
@@ -1555,6 +1672,7 @@ var CloudflareD1AuthorizationStore = class {
 		}
 		if (!committedRow) {
 			if (!claimed && input.material) return { kind: "material_mismatch" };
+			if (!claimed && operation.authorization.kind === "verified_step_up") return { kind: "verified_step_up_rejected" };
 			throw new Error("authorized operation admission could not be read back");
 		}
 		const admitted = await parseAuthorizedOperationAdmissionRecord(committedRow);
@@ -1646,11 +1764,11 @@ function classifyAuthorizedOperationAdmissionError(error) {
 function authorizedOperationReplayMismatch(input) {
 	if (requireString(input.existing.authorization_source_kind, "operation.authorization.kind") !== input.incoming.authorization.kind) return authorizationSourceRejected(input.incoming.authorization);
 	if (input.incoming.authorization.kind === "authorization_grant") {
-		if (input.existing.linked_scope_org_id !== input.scope.orgId || input.existing.linked_scope_project_id !== input.scope.projectId || input.existing.linked_scope_env_id !== input.scope.envId) return { kind: "authorization_grant_rejected" };
+		if (input.existing.owner_scope_org_id !== input.scope.orgId || input.existing.owner_scope_project_id !== input.scope.projectId || input.existing.owner_scope_env_id !== input.scope.envId) return { kind: "authorization_grant_rejected" };
 		const expectedGrantKind = input.incoming.authorization.authorizationGrantRef.kind;
 		if (input.existing.authorization_grant_kind !== expectedGrantKind) return { kind: "authorization_grant_rejected" };
 		if (input.existing.authorization_id !== input.incoming.authorization.authorizationGrantRef.authorizationId) return { kind: "authorization_grant_rejected" };
-	} else if (input.existing.evidence_set_digest !== input.incoming.authorization.evidenceSetDigest) return { kind: "verified_step_up_rejected" };
+	} else if (input.existing.evidence_set_digest !== input.incoming.authorization.evidenceSetDigest || input.existing.step_up_org_id !== input.scope.orgId || input.existing.step_up_project_id !== input.scope.projectId || input.existing.step_up_env_id !== input.scope.envId) return { kind: "verified_step_up_rejected" };
 	const existingQuotaKind = requireString(input.existing.quota_kind, "operation.quota.kind");
 	if (existingQuotaKind !== input.incoming.quota.kind) return authorizationSourceRejected(input.incoming.authorization);
 	if (existingQuotaKind === "consume_reusable_wallet_session" && input.existing.quota_id !== input.incoming.quota.quotaId) return { kind: "authorization_grant_rejected" };
@@ -1827,7 +1945,13 @@ function directV2IdentityAvailabilityBindings(namespace, scope, session) {
 }
 function directV2SessionIdentityAvailabilitySql() {
 	return `
-      NOT EXISTS (
+      ${ACTIVE_V2_AUTHORITY_METHOD_EXISTS_SQL}
+      AND EXISTS (
+        SELECT 1 FROM wallet_execution_generations
+         WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
+           AND wallet_id = ? AND state IN ('registering', 'active')
+      )
+      AND NOT EXISTS (
         SELECT 1
           FROM wallet_session_authorizations_v2 AS existing
          WHERE existing.namespace = ?
@@ -1845,6 +1969,12 @@ function directV2SessionIdentityAvailabilitySql() {
 }
 function directV2SessionIdentityAvailabilityBindings(namespace, scope, session) {
 	return [
+		...activeV2AuthorityMethodBindings(scope, session),
+		namespace,
+		scope.orgId,
+		scope.projectId,
+		scope.envId,
+		String(session.walletId),
 		namespace,
 		scope.orgId,
 		scope.projectId,
@@ -1856,6 +1986,34 @@ function directV2SessionIdentityAvailabilityBindings(namespace, scope, session)
 		String(session.quotaId)
 	];
 }
+function parseWalletSessionAuthorizationV2MintRow(row, input) {
+	if (!row) return null;
+	const session = parsePersistedWalletSessionAuthorizationV2(parseD1JsonColumn(row.record_json));
+	const sessionColumns = {
+		session_tenant_id: row.tenant_id,
+		session_authorization_id: row.authorization_id,
+		session_mint_id: row.mint_id,
+		session_wallet_session_id: row.wallet_session_id,
+		session_quota_id: row.quota_id,
+		session_principal_id: row.principal_id,
+		session_wallet_id: row.wallet_id,
+		session_authority_id: row.authority_id,
+		session_wallet_auth_method_id: row.wallet_auth_method_id,
+		session_authority_digest_b64u: row.authority_digest_b64u,
+		session_authority_revocation_epoch: row.authority_revocation_epoch,
+		session_issued_at_ms: row.issued_at_ms,
+		session_expires_at_ms: row.expires_at_ms
+	};
+	if (!walletSessionAuthorizationV2RowMatches(sessionColumns, session)) throw new Error("Stored V2 Wallet Session mint columns disagree with record");
+	if (!walletSessionAuthorizationV2RecordsEqual(parseWalletSessionAuthorizationV2WithSubjects(sessionColumns, parseD1JsonColumn(row.capability_subjects_json)), session)) throw new Error("Stored V2 Wallet Session mint subjects disagree with record");
+	if (session.tenantId !== input.tenantId || session.principalId !== input.principalId || session.walletId !== input.walletId || session.authorityId !== input.authorityId || session.walletAuthMethodId !== input.walletAuthMethodId || session.mintId !== input.mintId) throw new Error("Stored V2 Wallet Session mint identity does not match the request");
+	return {
+		kind: "committed",
+		session,
+		primaryOperationCredentialDigestB64u: parseDigestB64u(row.operation_credential_hash),
+		retiredAtMs: row.retired_at_ms === null || row.retired_at_ms === void 0 ? null : requirePositiveInteger(row.retired_at_ms, "V2 session.retiredAtMs")
+	};
+}
 function walletSessionAuthorizationV2RowMatches(row, session) {
 	return row.session_tenant_id === String(session.tenantId) && row.session_authorization_id === String(session.authorizationId) && row.session_mint_id === String(session.mintId) && row.session_wallet_session_id === String(session.walletSessionId) && row.session_quota_id === String(session.quotaId) && row.session_principal_id === String(session.principalId) && row.session_wallet_id === String(session.walletId) && row.session_authority_id === String(session.authorityId) && row.session_wallet_auth_method_id === String(session.walletAuthMethodId) && row.session_authority_digest_b64u === String(session.authorityDigestB64u) && integerColumn(row.session_authority_revocation_epoch, "session.authorityRevocationEpoch") === session.authorityRevocationEpoch && integerColumn(row.session_issued_at_ms, "session.createdAtMs") === session.createdAtMs && integerColumn(row.session_expires_at_ms, "session.expiresAtMs") === session.expiresAtMs;
 }
@@ -1943,6 +2101,9 @@ function parseExactWalletSessionQuotaProjectionRow(row, session) {
 function assertNeverDirectV2CommitMode(value) {
 	throw new Error(`Unsupported direct V2 Wallet Session commit mode: ${String(value)}`);
 }
+function assertNeverDirectWalletSessionCommitPurpose(value) {
+	throw new Error(`Unsupported Wallet Session commit purpose: ${String(value)}`);
+}
 async function parseWalletSessionAdmissionRow(row, input) {
 	const session = parseLiveWalletSessionAuthorizationV2Row(row, {
 		operationCredentialHash: input.tokenHash,