@seams/wallet-server 0.6.1 → 0.7.1

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationSetup.js

@@ -1,13 +1,15 @@
-import { computeRegistrationIntentDigestB64u, normalizeRegistrationAuthMethodInput, normalizeRegistrationSignerPlan, registrationSignerSetSelectionFromPlan } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
+import { normalizeRegistrationAuthMethodInput } from "../../../../shared-ts/src/utils/registrationAuthMethodInput.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { thresholdEcdsaChainTargetFromValue } from "../../../../core/thresholdEcdsaChainTarget.js";
 import { computeWalletRegistrationSetupDigestB64u, mintSignedWalletRegistrationSetup } from "../../../domains/walletRegistration/walletRegistrationSetupPayload.js";
+import { normalizeRegistrationSignerPlan, registrationSignerSetSelectionFromPlan } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
+import { computeRegistrationIntentDigestB64u } from "../../../../shared-ts/src/utils/registrationIntent.js";
 //#region src/router/cloudflare/d1/registration/d1WalletRegistrationSetup.ts
 /**
-* Refactor 94C. `/wallets/register/setup` — one request replacing the bootstrap
-* grant, the registration intent, and registration start.
+* `/wallets/register/setup` — one request replacing the bootstrap grant, the
+* registration intent, and registration start.
 *
 * The three legs it replaces made six-plus serialized storage round trips
 * between them, most of it bookkeeping written on every request and read on

package/dist/esm/router/cloudflare/d1/registration/walletRegistrationEstablishedSessionIssuer.js

@@ -1,15 +1,15 @@
 import { mpcMaterialActivationRefsEqual, parseEmailOtpChallengeId, parseThresholdEcdsaSessionId, parseThresholdEd25519SessionId, parseWebAuthnCredentialIdB64u } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseAuthFactorId, parsePrincipalId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import "../../../../shared-ts/src/utils/encoders.js";
 import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
-import { nearEd25519SigningKeyIdFromString, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { isEmailOtpWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseSessionOrigin, parseVerifiedOwnerProofId } from "../../../../authorization/domain.js";
 import { buildVerifiedOwnerProof, buildVerifiedWalletSessionEmailOtpFactorResult, buildVerifiedWalletSessionPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
+import { nearEd25519SigningKeyIdFromString, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { DEFAULT_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
 import { deriveThresholdEcdsaKeyHandle } from "../../../../shared-ts/src/utils/thresholdEcdsaKeyHandle.js";
 import { registrationEstablishedMintId } from "./walletRegistrationSessionCommitReceipt.js";

package/dist/esm/router/cloudflare/d1/registration/walletRegistrationSessionCommitReceipt.js

@@ -1,9 +1,9 @@
 import { parseWalletAuthMethodId, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
-import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { parseWalletAuthAuthority } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
+import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { parseSessionOrigin } from "../../../../authorization/domain.js";
 import { parseWalletCustodyRegistrationOutcome } from "../../../../shared-ts/src/passkey-custody/ceremonyCommitPayload.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
@@ -481,6 +481,6 @@ function containsPersistedRegistrationCredential(value) {
 	return false;
 }
 //#endregion
-export { parseWalletRegistrationSessionCommitReceiptV2, projectRegistrationEstablishedSessionV2, projectWalletRegistrationSessionCommitReceiptV2, registrationEstablishedMintId, registrationReplayAuthMethodFields, replayedRegistrationCommit, unissuedRegistrationCommit };
+export { parseWalletRegistrationSessionCommitReceiptV2, projectWalletRegistrationSessionCommitReceiptV2, registrationEstablishedMintId, registrationReplayAuthMethodFields, replayedRegistrationCommit, unissuedRegistrationCommit };
 
 //# sourceMappingURL=walletRegistrationSessionCommitReceipt.js.map

package/dist/esm/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.js

@@ -1,3 +1,4 @@
+import { requireNonEmptyString } from "../../../../shared-ts/src/utils/validation.js";
 import { isD1DatabaseLike } from "../../../../storage/d1Sql.js";
 import { abusePrincipalKey, runtimePolicyScopeKey } from "../../../domains/signingOperations/routerAbNormalSigningAdmissionCore.js";
 //#region src/router/cloudflare/d1/signingAdmission/d1RouterAbNormalSigningAdmissionStore.ts
@@ -6,16 +7,48 @@ var CloudflareD1RouterAbNormalSigningAdmissionStore = class {
 	constructor(options) {
 		if (!isD1DatabaseLike(options.database)) throw new Error("Router A/B normal-signing admission D1 database is required");
 		this.database = options.database;
-		this.storageNamespace = requireNonEmptyString("storageNamespace", options.storageNamespace);
+		this.storageNamespace = requireNonEmptyString(options.storageNamespace, "storageNamespace");
 		this.now = options.now || Date.now;
 	}
-	async evaluateProjectPolicy(input) {
-		const row = await this.readDecision(input.runtimePolicyScope, "project_policy", runtimePolicyScopeKey(input.runtimePolicyScope));
-		return row === null ? { kind: "allowed" } : parseProjectPolicyDecision(row);
-	}
-	async evaluateAbuse(input) {
-		const row = await this.readDecision(input.runtimePolicyScope, "abuse", abusePrincipalKey(input));
-		return row === null ? { kind: "allowed" } : parseAbuseDecision(row);
+	async evaluatePolicy(input) {
+		const scope = input.runtimePolicyScope;
+		const row = await this.database.prepare(`WITH scope(namespace, org_id, project_id, env_id, signing_root_version,
+                  project_key, abuse_key) AS (VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7))
+       SELECT project.record_key AS project_key, project.decision AS project_decision,
+              project.retry_after_ms AS project_retry_after_ms,
+              abuse.record_key AS abuse_key, abuse.decision AS abuse_decision,
+              abuse.retry_after_ms AS abuse_retry_after_ms
+         FROM scope
+         LEFT JOIN ${ROUTER_AB_NORMAL_SIGNING_ADMISSION_TABLE} AS project
+           ON project.namespace = scope.namespace AND project.org_id = scope.org_id
+          AND project.project_id = scope.project_id AND project.env_id = scope.env_id
+          AND project.signing_root_version = scope.signing_root_version
+          AND project.record_kind = 'project_policy' AND project.record_key = scope.project_key
+         LEFT JOIN ${ROUTER_AB_NORMAL_SIGNING_ADMISSION_TABLE} AS abuse
+           ON abuse.namespace = scope.namespace AND abuse.org_id = scope.org_id
+          AND abuse.project_id = scope.project_id AND abuse.env_id = scope.env_id
+          AND abuse.signing_root_version = scope.signing_root_version
+          AND abuse.record_kind = 'abuse' AND abuse.record_key = scope.abuse_key`).bind(this.storageNamespace, scope.orgId, scope.projectId, scope.envId, scope.signingRootVersion, runtimePolicyScopeKey(scope), abusePrincipalKey(input)).first();
+		if (!row) throw new Error("Router A/B admission policy snapshot is missing");
+		if (row.project_key !== null) {
+			const project = parseProjectPolicyDecision({
+				decision: row.project_decision,
+				retry_after_ms: row.project_retry_after_ms
+			});
+			if (project.kind === "rejected") return {
+				kind: "project_policy_rejected",
+				retryAfterMs: project.retryAfterMs
+			};
+		}
+		if (row.abuse_key === null) return { kind: "allowed" };
+		const abuse = parseAbuseDecision({
+			decision: row.abuse_decision,
+			retry_after_ms: row.abuse_retry_after_ms
+		});
+		return abuse.kind === "rejected" ? {
+			kind: "abuse_rejected",
+			retryAfterMs: abuse.retryAfterMs
+		} : abuse;
 	}
 	async setProjectPolicy(scope, decision) {
 		const normalized = normalizeProjectPolicyDecision(decision);
@@ -31,17 +64,6 @@ var CloudflareD1RouterAbNormalSigningAdmissionStore = class {
 	async clearAbuseDecision(input) {
 		await this.deleteRecord(input.runtimePolicyScope, "abuse", abusePrincipalKey(input));
 	}
-	async readDecision(scope, kind, key) {
-		return await this.database.prepare(`SELECT decision, retry_after_ms
-           FROM ${ROUTER_AB_NORMAL_SIGNING_ADMISSION_TABLE}
-          WHERE namespace = ?1
-            AND org_id = ?2
-            AND project_id = ?3
-            AND env_id = ?4
-            AND signing_root_version = ?5
-            AND record_kind = ?6
-            AND record_key = ?7`).bind(this.storageNamespace, scope.orgId, scope.projectId, scope.envId, scope.signingRootVersion, kind, key).first();
-	}
 	async putDecision(scope, kind, key, decision, retryAfterMs) {
 		await requireSuccessfulD1Write(this.database.prepare(`INSERT INTO ${ROUTER_AB_NORMAL_SIGNING_ADMISSION_TABLE} (
              namespace, org_id, project_id, env_id, signing_root_version,
@@ -93,7 +115,7 @@ function normalizeAbuseDecision(decision) {
 	}
 }
 function parseProjectPolicyDecision(row) {
-	const decision = requireNonEmptyString("decision", row.decision);
+	const decision = requireNonEmptyString(row.decision, "decision");
 	switch (decision) {
 		case "allowed": return { kind: "allowed" };
 		case "rejected": return {
@@ -104,7 +126,7 @@ function parseProjectPolicyDecision(row) {
 	}
 }
 function parseAbuseDecision(row) {
-	const decision = requireNonEmptyString("decision", row.decision);
+	const decision = requireNonEmptyString(row.decision, "decision");
 	switch (decision) {
 		case "allowed": return { kind: "allowed" };
 		case "rate_limited": return {
@@ -124,10 +146,6 @@ async function requireSuccessfulD1Write(statement) {
 function isSuccessfulD1Result(result) {
 	return result.success === true;
 }
-function requireNonEmptyString(label, value) {
-	if (typeof value === "string" && value.trim().length > 0) return value.trim();
-	throw new Error(`${label} must be a non-empty string`);
-}
 function requirePositiveInteger(label, value) {
 	const numeric = typeof value === "bigint" ? Number(value) : value;
 	if (typeof numeric === "number" && Number.isSafeInteger(numeric) && numeric > 0) return numeric;

package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneEffectJournalStore.js

@@ -7,7 +7,6 @@ var CloudflareD1LaneEffectJournalStore = class {
 		const normalized = requireD1LaneStoreOptions(options);
 		this.database = normalized.database;
 		this.scope = normalized.scope;
-		this.now = normalized.now;
 	}
 	async getEffect(input) {
 		const row = await this.database.prepare(`SELECT effect_id, enrollment_id, operation_id, wallet_id, wallet_key_id, lane_id, lane_share_epoch, effect_kind, request_digest_b64u, status, response_digest_b64u, recorded_at_ms, confirmed_at_ms, version, command_digest_b64u FROM ${EFFECT_TABLE} WHERE namespace = ?1 AND org_id = ?2 AND project_id = ?3 AND env_id = ?4 AND effect_id = ?5`).bind(...scopeValues(this.scope), input.effectId).first();

package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneLifecycleStore.js

@@ -2,8 +2,8 @@ import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { sha256Bytes } from "../../../../shared-ts/src/utils/digests.js";
 import { d1ChangedRows } from "../../../../storage/d1Sql.js";
-import { computeLaneParticipantSetBindingDigestV1 } from "../../../../shared-ts/src/signing-lanes/participantDigest.js";
 import { buildLaneProductEpochPendingVisibilityV1, buildLaneProductEpochRevokedV1, parseAggregateLaneActivationReceiptV1, parseAggregateLaneRevocationReceiptV1, parseCompleteSigningLaneRevocationV1, parseLaneEnrollmentManifestV1, parseLaneHolderDeliveryReceiptV1, parseLaneProductEpochRecordV1, parseLaneProtocolCommitReceiptV1, parseLaneRefreshPredecessorRetirementV1, parseLaneServerActivationReceiptV1, parseLaneServerRetirementReceiptV1, parseRevokeSigningLaneV1 } from "../../../../shared-ts/src/signing-lanes/rotationParsers.js";
+import { computeLaneParticipantSetBindingDigestV1 } from "../../../../shared-ts/src/signing-lanes/participantDigest.js";
 import { computeAggregateLaneActivationReceiptDigestV1, computeAggregateLaneRevocationReceiptDigestV1, computeEcdsaServerRetirementReceiptDigestV1, computeEd25519ServerRetirementReceiptDigestV1, computeLaneEnrollmentManifestDigestV1, computeRevokeSigningLaneDigestV1, encodeLaneHolderDeliveryReceiptV1, encodeLaneProtocolCommitReceiptV1, encodeLaneServerActivationReceiptV1 } from "../../../../shared-ts/src/signing-lanes/rotationDigests.js";
 import { activateLaneProductEpochV1, beginLaneProductEpochRevocationV1, completeLaneProductEpochRevocationV1, retireFencedLaneProductEpochV1, transitionLaneEnrollmentLifecycleV1 } from "../../../../shared-ts/src/signing-lanes/rotationLifecycle.js";
 import { LANE_CAS_GUARD_SQL, assertD1Success, digestLaneEnrollmentRevocationCommand, equalLaneRecords, firstBatchResult, parseEnrollmentRow, parseJsonRecord, parseProductEpochRow, parseProtocolRow, parseRequiredString, parseVersion, requireD1LaneStoreOptions, scopeValues } from "./d1LaneRecords.js";

package/dist/esm/router/cloudflare/d1/signingLanes/d1LaneRecords.js

@@ -1,7 +1,8 @@
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import { isD1DatabaseLike, parseD1JsonColumn } from "../../../../storage/d1Sql.js";
-import { parseAggregateLaneActivationReceiptV1, parseAggregateLaneRevocationReceiptV1, parseLaneEnrollmentLifecycleV1, parseLaneEnrollmentManifestV1, parseLaneHolderDeliveryReceiptV1, parseLaneProductEpochRecordV1, parseLaneProtocolCommitReceiptV1, parseLaneProtocolJobV1, parseLaneProtocolLifecycleV1, parseLaneServerActivationReceiptV1, parseLaneServerRetirementReceiptV1 } from "../../../../shared-ts/src/signing-lanes/rotationParsers.js";
+import { parseAggregateLaneActivationReceiptV1, parseAggregateLaneRevocationReceiptV1, parseLaneEnrollmentLifecycleV1, parseLaneEnrollmentManifestV1, parseLaneHolderDeliveryReceiptV1, parseLaneProductEpochRecordV1, parseLaneProtocolCommitReceiptV1, parseLaneProtocolLifecycleV1, parseLaneServerActivationReceiptV1, parseLaneServerRetirementReceiptV1 } from "../../../../shared-ts/src/signing-lanes/rotationParsers.js";
+import { parseLaneProtocolJobV1 } from "../../../../shared-ts/src/signing-lanes/rotationProtocolParsers.js";
 //#region src/router/cloudflare/d1/signingLanes/d1LaneRecords.ts
 function requireD1LaneStoreOptions(input) {
 	if (!isD1DatabaseLike(input.database)) throw new Error("R102 lane D1 database is required");

package/dist/esm/router/cloudflare/d1/versionedJson/d1VersionedJsonRecordStore.js

@@ -1,12 +1,10 @@
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
-import { isD1DatabaseLike } from "../../../../storage/d1Sql.js";
+import { D1_BATCH_CAS_GUARD_SQL, isD1DatabaseLike } from "../../../../storage/d1Sql.js";
 import { containsControlCharacter } from "../../durableObjects/versionedJsonRecordStore.js";
 //#region src/router/cloudflare/d1/versionedJson/d1VersionedJsonRecordStore.ts
 const TABLE_NAME = "router_ab_yao_versioned_json_records";
-const CAS_GUARD_SQL = `INSERT INTO router_ab_yao_versioned_json_cas_guard (guard_id)
-SELECT 1
- WHERE changes() = 0`;
+const CAS_GUARD_SQL = D1_BATCH_CAS_GUARD_SQL;
 var CloudflareD1VersionedJsonRecordStoreError = class extends Error {
 	constructor(code, message) {
 		super(message);
@@ -181,59 +179,6 @@ var CloudflareD1VersionedJsonRecordStore = class {
 		}
 		return statements;
 	}
-	async patchAtomically(input) {
-		const storageKey = this.storageKey(input.key);
-		const expectedVersion = parseVersion(input.expectedVersion);
-		if (expectedVersion === null) throw new Error("Cloudflare D1 atomic JSON patch expectedVersion is invalid");
-		if (!Number.isSafeInteger(input.unexpired.nowMs) || input.unexpired.nowMs <= 0 || !isJsonPath(input.unexpired.jsonPath)) throw new Error("Cloudflare D1 atomic JSON patch expiry predicate is invalid");
-		for (const predicate of input.exactStringPredicates) if (!isJsonPath(predicate.jsonPath) || typeof predicate.value !== "string") throw new Error("Cloudflare D1 atomic JSON patch exact predicate is invalid");
-		if (!isJsonObject(input.patch)) throw new Error("Cloudflare D1 atomic JSON patch value is invalid");
-		const exactSql = input.exactStringPredicates.map((_, index) => `AND json_extract(record_json, ?${9 + index * 2}) = ?${10 + index * 2}`).join("\n");
-		const expiryPathIndex = 9 + input.exactStringPredicates.length * 2;
-		const nowIndex = expiryPathIndex + 1;
-		const bindings = [
-			this.scope.namespace,
-			this.scope.orgId,
-			this.scope.projectId,
-			this.scope.envId,
-			storageKey,
-			JSON.stringify(input.patch),
-			Date.now(),
-			expectedVersion,
-			...input.exactStringPredicates.flatMap((predicate) => [predicate.jsonPath, predicate.value]),
-			input.unexpired.jsonPath,
-			input.unexpired.nowMs
-		];
-		let row;
-		try {
-			row = await this.database.prepare(`UPDATE ${TABLE_NAME}
-              SET version = version + 1,
-                  record_json = json_patch(record_json, json(?6)),
-                  updated_at_ms = ?7
-            WHERE namespace = ?1
-              AND org_id = ?2
-              AND project_id = ?3
-              AND env_id = ?4
-              AND record_key = ?5
-              AND version = ?8
-              ${exactSql}
-              AND json_extract(record_json, ?${expiryPathIndex}) > ?${nowIndex}
-          RETURNING version, record_json`).bind(...bindings).first();
-		} catch (error) {
-			throw requestFailure(error);
-		}
-		if (row === null) return { kind: "version_mismatch" };
-		const parsed = this.parseReadResult({
-			success: true,
-			results: [row]
-		});
-		if (parsed.kind !== "present") throw invalidResponseFailure("Cloudflare D1 atomic JSON patch omitted its stored value");
-		return {
-			kind: "stored",
-			version: parsed.version,
-			value: parsed.value
-		};
-	}
 	prepareBatchMutations(mutations) {
 		if (mutations.length === 0) throw new Error("Cloudflare D1 versioned JSON batch requires at least one mutation");
 		const seenKeys = /* @__PURE__ */ new Set();
@@ -340,9 +285,6 @@ function normalizeRecordKey(value) {
 	if (key.length > 512 || containsControlCharacter(key)) throw new Error("Cloudflare D1 versioned JSON record key is invalid");
 	return key;
 }
-function isJsonPath(value) {
-	return typeof value === "string" && /^\$\.[A-Za-z][A-Za-z0-9.]*$/u.test(value);
-}
 function parseVersion(value) {
 	const text = typeof value === "number" ? String(value) : normalizeOptionalTrimmedString(value);
 	if (!text || !/^\d+$/u.test(text)) return null;

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAddSignerService.js

@@ -1,17 +1,20 @@
-import { parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { mpcMaterialActivationRefsEqual, parseWalletKeyId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
 import "../../../../shared-ts/src/utils/encoders.js";
-import { addSignerIntentGrantFromString, computeAddSignerIntentDigestB64u, sameAddSignerIntentV1 } from "../../../../shared-ts/src/utils/registrationIntent.js";
-import { parseRouterAbEd25519YaoRegistrationAdmissionRequestV1, sameRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
-import { ecdsaClientRootPublicKey33B64uFromString } from "../../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
+import { parseSecp256k1CompressedPublicKeyB64u } from "../../../../shared-ts/src/passkey-custody/primitives.js";
+import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { parseRouterAbEd25519YaoRegistrationAdmissionRequestV1, sameRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { ecdsaClientRootPublicKey33B64uFromString } from "../../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { deriveSigningRootId } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { buildRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaRegistrationRequestFactsV1, sameRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbEcdsaRegistrationRequestFactsV1, sameRouterAbEcdsaVerifiedClientActivationFactsV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { sameWalletEd25519SignerRecordV1 } from "../../../../core/WalletStore.js";
+import { buildWalletEcdsaSignerActivationV1, extendEd25519WalletAuthorityWithEcdsa, isActiveEd25519WalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { registrationPreparationIdFromString } from "../../../../core/types.js";
 import { buildTenantRootIdentityFromAuthenticatedDeploymentV1 } from "../../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
+import { addSignerIntentGrantFromString, computeAddSignerIntentDigestB64u, sameAddSignerIntentV1 } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { WalletAuthorityCommitConflictError } from "./d1WalletAuthorityStore.js";
 import { buildRouterAbEd25519YaoRegistrationCapabilityRecordV1 } from "../../../domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.js";
 import { buildRouterAbEd25519YaoAddSignerAdmissionRequestV1, createRouterAbEd25519YaoMaterialActivationRefV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js";
 import { parseRouterAbEd25519YaoRegistrationSideEffectRecordV1, runRouterAbEd25519YaoRegistrationSideEffectV1, throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
@@ -19,6 +22,7 @@ import { buildYaoEd25519WalletSignerRecord, ed25519NearPublicKeyFromBytes, impli
 import { routerAbEcdsaStrictRegistrationRequestMatchesFacts } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
 import { buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, normalizeThresholdEcdsaChainTargets, parseD1AddSignerIntent, parseD1RuntimePolicyScope, parseD1StoredAddSignerAuth, parseD1StoredAddSignerIntent, parseD1StoredWalletAddSignerCeremony, parseD1WalletAddSignerFinalizeTerminalResponse, parseWalletIdForIntent, positiveIntegerArraysEqual, runtimePolicyScopeMatches, thresholdEcdsaChainTargetsEqual } from "../registration/d1RegistrationCeremonyRecords.js";
 import { buildD1EvmFamilyEcdsaRegistrationPrepare } from "../registration/d1EvmFamilyEcdsaRegistrationBranch.js";
+import { routerAbEd25519YaoLifecycleDecisionLookupV1, routerAbEd25519YaoLifecycleDecisionV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision.js";
 import { buildActivatedEcdsaFamilyBootstrap, ecdsaStrictRegistrationAuthority, exactEcdsaParticipantPair } from "../registration/d1WalletRegistrationService.js";
 import { computeWalletAddSignerEcdsaActivationRequestDigestB64u } from "../../../../shared-ts/src/utils/walletAddSignerActivation.js";
 //#region src/router/cloudflare/d1/wallet/d1WalletAddSignerService.ts
@@ -412,6 +416,9 @@ function storedEcdsaAddSignerBootstrap(bootstrap) {
 		routerAbEcdsaDerivationNormalSigning: bootstrap.routerAbEcdsaDerivationNormalSigning
 	};
 }
+function sameEcdsaSignerActivation(left, right) {
+	return left.signer.walletId === right.signer.walletId && left.signer.walletKeyId === right.signer.walletKeyId && left.signer.thresholdPublicKey33B64u === right.signer.thresholdPublicKey33B64u && left.signer.evmAddress === right.signer.evmAddress && mpcMaterialActivationRefsEqual(left.materialActivation, right.materialActivation);
+}
 var CloudflareD1WalletAddSignerService = class {
 	constructor(input) {
 		this.getRegistrationCeremonyIntentStore = input.getRegistrationCeremonyIntentStore;
@@ -423,6 +430,86 @@ var CloudflareD1WalletAddSignerService = class {
 		this.passkeyCustodyEnvelopes = input.passkeyCustodyEnvelopes;
 		this.startSideEffects = input.startSideEffects;
 		this.finalizeSideEffects = input.finalizeSideEffects;
+		this.yaoLifecycleDecisions = input.yaoLifecycleDecisions;
+	}
+	/**
+	* Commits an added ECDSA signer onto the authority whose passkey authorized
+	* the ceremony: its signer records, the authority extended with the new
+	* activation, and that authority's live Wallet Sessions promoted to it, so the
+	* wallet signs with the new key at once. A retry after the commit finds the
+	* authority already carrying this activation and commits nothing.
+	*/
+	async extendOwnerAuthorityWithAddedEcdsaSigner(input) {
+		const rpId = parseWebAuthnRpId(input.ceremony.auth.rpId);
+		const credentialId = parseWebAuthnCredentialIdB64u(input.ceremony.auth.credentialIdB64u);
+		if (!rpId.ok || !credentialId.ok) return {
+			ok: false,
+			code: "invalid_state",
+			message: "ECDSA add-signer has an invalid factor identity"
+		};
+		const walletId = input.ceremony.intent.walletId;
+		const owner = await this.walletAuthMethods.resolveActivePasskeyAuthorityForVerifiedCredential({
+			walletId,
+			rpId: rpId.value,
+			credentialIdB64u: credentialId.value
+		});
+		if (!owner.ok) return owner;
+		const walletKeyId = parseWalletKeyId(`wallet-key:ecdsa:${walletId}:${input.walletKey.evmFamilySigningKeySlotId}`);
+		if (!walletKeyId.ok || !/^0x[0-9a-fA-F]{40}$/.test(input.walletKey.thresholdOwnerAddress)) return {
+			ok: false,
+			code: "invalid_state",
+			message: "ECDSA add-signer wallet key identity is invalid"
+		};
+		const ecdsa = buildWalletEcdsaSignerActivationV1({
+			signer: {
+				kind: "exact_administered_ecdsa_signer_v1",
+				keyFamily: "ecdsa_secp256k1",
+				walletId,
+				walletKeyId: walletKeyId.value,
+				thresholdPublicKey33B64u: parseSecp256k1CompressedPublicKeyB64u(input.walletKey.thresholdEcdsaPublicKeyB64u),
+				evmAddress: input.walletKey.thresholdOwnerAddress
+			},
+			materialActivation: routerAbMpcMaterialActivationRefFromWire(input.activation.ecdsa_activation.material_activation)
+		});
+		const current = owner.walletAuthority;
+		const currentEcdsa = current.signerActivations.ecdsa;
+		if (currentEcdsa) return sameEcdsaSignerActivation(currentEcdsa, ecdsa) ? {
+			ok: true,
+			authority: current
+		} : {
+			ok: false,
+			code: "signer_conflict",
+			message: "the wallet authority already holds a different ECDSA signer"
+		};
+		if (!isActiveEd25519WalletAuthorityV1(current)) return {
+			ok: false,
+			code: "invalid_state",
+			message: "ECDSA add-signer requires an active NEAR-only wallet authority"
+		};
+		const next = await extendEd25519WalletAuthorityWithEcdsa({
+			authority: current,
+			ecdsa,
+			now: input.now
+		});
+		try {
+			await this.walletAuthMethods.extendActiveWalletAuthority({
+				expected: current,
+				next,
+				walletSigners: input.walletSigners,
+				promotionAtMs: input.now
+			});
+		} catch (error) {
+			if (error instanceof WalletAuthorityCommitConflictError) return {
+				ok: false,
+				code: "conflict",
+				message: "the wallet authority changed while its ECDSA signer was added; retry"
+			};
+			throw error;
+		}
+		return {
+			ok: true,
+			authority: next
+		};
 	}
 	async getWalletAddSignerRuntimePolicyScope(addSignerCeremonyId) {
 		const ceremony = await this.getRegistrationCeremonyIntentStore().getAddSignerCeremony(addSignerCeremonyId);
@@ -1096,6 +1183,44 @@ var CloudflareD1WalletAddSignerService = class {
 		const response = await this.executeWalletAddSignerFinalize(input, prepared);
 		return response.ok ? response : throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1(response);
 	}
+	/**
+	* Makes an added Ed25519 signer visible with its lifecycle's decision, in
+	* one batch. A finalize that finds its own decision has nothing left to
+	* write. Another decision for the lifecycle, or another signer in the slot,
+	* refuses it.
+	*/
+	async decideEd25519YaoSignerVisibility(input) {
+		const decisions = this.yaoLifecycleDecisions;
+		const settled = (stored) => {
+			switch (routerAbEd25519YaoLifecycleDecisionLookupV1(input.decision, stored).kind) {
+				case "undecided": return null;
+				case "decided": return { ok: true };
+				case "decided_otherwise": return {
+					ok: false,
+					code: "invalid_state",
+					message: "Ed25519 Yao add-signer lifecycle was finalized by another request"
+				};
+			}
+		};
+		const before = settled(await decisions.read(input.decision.lifecycleId));
+		if (before) return before;
+		try {
+			await decisions.decide(input.decision, await input.walletStore.prepareEd25519SignerIfSlotAvailableStatements(input.signer), Date.now());
+			return { ok: true };
+		} catch (error) {
+			const after = settled(await decisions.read(input.decision.lifecycleId));
+			if (after) return after;
+			if (await input.walletStore.getEd25519SignerBySlot({
+				walletId: input.signer.walletId,
+				signerSlot: input.signer.signerSlot
+			})) return {
+				ok: false,
+				code: "signer_conflict",
+				message: "Ed25519 signer slot is already occupied"
+			};
+			throw error;
+		}
+	}
 	async executeWalletAddSignerFinalize(input, prepared) {
 		const store = input.store;
 		const finalizeRequest = input.finalizeRequest;
@@ -1291,17 +1416,18 @@ var CloudflareD1WalletAddSignerService = class {
 				code: "scope_mismatch",
 				message: "stored Ed25519 Yao add-signer finalize plan is invalid"
 			};
-			if (!await walletStore.putEd25519SignerIfSlotAvailable(signer)) {
-				const existing = await walletStore.getEd25519SignerBySlot({
+			const visible = await this.decideEd25519YaoSignerVisibility({
+				decision: await routerAbEd25519YaoLifecycleDecisionV1({
+					kind: "add_signer_finalized",
+					lifecycleId: activation.activation.admissionRequest.scope.lifecycle_id,
 					walletId: ceremony.intent.walletId,
-					signerSlot: selection.signerSlot
-				});
-				if (!existing || !sameWalletEd25519SignerRecordV1(existing, signer)) return {
-					ok: false,
-					code: "signer_conflict",
-					message: "Ed25519 signer slot is already occupied"
-				};
-			}
+					consumerBinding: input.consumerBinding,
+					capability: signer.activeYaoCapability
+				}),
+				signer,
+				walletStore
+			});
+			if (!visible.ok) return visible;
 			const installed = await yaoRuntime.installPersistedActiveCapability(signer.activeYaoCapability);
 			if (!installed.ok) return throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1(installed);
 			await store.putAddSignerFinalizeReplay({
@@ -1345,8 +1471,7 @@ var CloudflareD1WalletAddSignerService = class {
 			message: "ECDSA add-signer scope is invalid"
 		};
 		const signerWriteNow = prepared.signerWriteAtMs;
-		const walletStore = this.getWalletStore();
-		if (!await walletStore.getWallet({ walletId: ceremony.intent.walletId })) return {
+		if (!await this.getWalletStore().getWallet({ walletId: ceremony.intent.walletId })) return {
 			ok: false,
 			code: "not_found",
 			message: "wallet not found"
@@ -1370,13 +1495,27 @@ var CloudflareD1WalletAddSignerService = class {
 			custodyClientRootPublicKey33B64u,
 			now: signerWriteNow
 		});
-		await walletStore.putSigners(walletSigners);
+		const primaryWalletKey = walletKeys[0];
+		if (!primaryWalletKey) return {
+			ok: false,
+			code: "invalid_state",
+			message: "ECDSA add-signer produced no wallet key"
+		};
+		const owner = await this.extendOwnerAuthorityWithAddedEcdsaSigner({
+			ceremony,
+			walletKey: primaryWalletKey,
+			activation: ceremony.signerState.activation,
+			walletSigners,
+			now: signerWriteNow
+		});
+		if (!owner.ok) return owner;
 		const response = {
 			ok: true,
 			kind: "evm_family_ecdsa",
 			walletId: ceremony.intent.walletId,
 			...ceremony.auth.kind === "webauthn_assertion" ? { rpId: ceremony.auth.rpId } : {},
-			ecdsa: { walletKeys }
+			ecdsa: { walletKeys },
+			authority: owner.authority
 		};
 		await store.putAddSignerFinalizeReplay({
 			kind: "wallet_add_signer_finalize_replay_v1",