@seams/wallet-server 0.6.2 → 0.7.3

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.js

@@ -1,36 +1,36 @@
 import { parseChallengeSubjectId, parseEmailOtpChallengeId, parseOrgId, parseProviderSubject, parseRootShareEpoch, parseWalletAuthMethodId, parseWalletAuthorityId, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { parseWalletAddAuthMethodRegistrationOptions } from "../../../../shared-ts/src/utils/addAuthMethodRegistration.js";
-import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
+import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
-import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, createServerAllocatedWalletId, nearEd25519SigningKeyIdFromString, normalizeAddAuthMethodInput, normalizeAddAuthMethodIntentCaller, normalizeAddSignerSelection, normalizeRegistrationAuthMethodInput, normalizeRegistrationSignerPlan, parseWalletAuthMethodRecordV2, registrationSignerBranchKeyFromString, registrationSignerSetSelectionFromPlan, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
-import { parseWebAuthnAuthenticatorDeviceInfo, unknownWebAuthnAuthenticatorDeviceInfo } from "../../../../shared-ts/src/utils/webauthnDeviceInfo.js";
+import "../../../../shared-ts/src/utils/validation.js";
+import { parseWalletAddAuthMethodRegistrationOptions } from "../../../../shared-ts/src/utils/addAuthMethodRegistration.js";
 import { parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
-import { deriveEvmFamilySigningKeySlotId, parseEvmFamilySigningKeySlotId } from "../../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
+import { deriveEvmFamilySigningKeySlotId } from "../../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
 import { derivationClientSharePublicKey33B64uFromString, ecdsaClientRootPublicKey33B64uFromString } from "../../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
-import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { parseWalletAuthAuthority, parseWalletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseRouterAbEcdsaDerivationNormalSigningStateV1, parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaRegistrationActivationReceiptV1, parseRouterAbEcdsaRegistrationRequestFactsV1, parseRouterAbEcdsaRegistrationRequestV1, parseRouterAbEcdsaStrictForwardedRegistrationResponseV1, parseRouterAbEcdsaVerifiedClientActivationFactsV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { normalizeAddAuthMethodInput, normalizeRegistrationAuthMethodInput } from "../../../../shared-ts/src/utils/registrationAuthMethodInput.js";
+import { parseWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
+import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
+import { parseWebAuthnAuthenticatorDeviceInfo, unknownWebAuthnAuthenticatorDeviceInfo } from "../../../../shared-ts/src/utils/webauthnDeviceInfo.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { parseRouterAbEd25519NormalSigningState } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
-import { thresholdEcdsaChainTargetFromValue, thresholdEcdsaChainTargetKey } from "../../../../core/thresholdEcdsaChainTarget.js";
+import { parseEcdsaDerivationPublicIdentity, parseThresholdEd25519AuthorityScope, thresholdEd25519AuthorityScopeFromWalletAuthAuthority, thresholdEd25519AuthorityScopesMatch } from "../../../../core/ThresholdService/validation.js";
+import { thresholdEcdsaChainTargetKey } from "../../../../shared-ts/src/utils/thresholdEcdsaChainTarget.js";
+import { thresholdEcdsaChainTargetFromValue } from "../../../../core/thresholdEcdsaChainTarget.js";
 import { buildWalletEcdsaSignerRecord, parseWalletEd25519SignerRecord } from "../../../../core/d1WalletStore.js";
+import { createServerAllocatedWalletId, nearEd25519SigningKeyIdFromString, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { registrationPreparationIdFromString } from "../../../../core/types.js";
 import "../../../../shared-ts/src/signing-lanes/index.js";
 import { parsePasskeyCustodyEnvelopeRecord } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
-import { parseEcdsaDerivationPublicIdentity, parseThresholdEd25519AuthorityScope, thresholdEd25519AuthorityScopeFromWalletAuthAuthority, thresholdEd25519AuthorityScopesMatch } from "../../../../core/ThresholdService/validation.js";
+import { normalizeAddSignerSelection, normalizeRegistrationSignerPlan, registrationSignerBranchKeyFromString, registrationSignerSetSelectionFromPlan } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
+import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, normalizeAddAuthMethodIntentCaller } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
 import { parseStoredRouterAbEcdsaPendingActivationV1 } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
 import { parseStoredRegistrationSignerPlan, parseStoredWalletRegistrationPreparedContext, storedRegistrationSignerPlansMatch } from "../../../../core/RegistrationCeremonyStore.js";
 //#region src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.ts
-function requireEvmFamilySigningKeySlotId(value) {
-	const parsed = parseEvmFamilySigningKeySlotId(value);
-	if (!parsed.ok) throw new Error(parsed.error.message);
-	return parsed.value;
-}
 function createD1ServerAllocatedWalletId() {
 	return createServerAllocatedWalletId();
 }
@@ -118,22 +118,6 @@ function buildAddAuthMethodIntent(input) {
 function unreachableAddAuthMethodIntentCaller(value) {
 	throw new Error(`Unhandled add-auth-method intent caller: ${String(value)}`);
 }
-function addAuthMethodInputMatches(left, right) {
-	if (left.kind !== right.kind) return false;
-	switch (left.kind) {
-		case "passkey": return right.kind === "passkey" && left.rpId === right.rpId;
-		case "email_otp": return right.kind === "email_otp" && left.email.toLowerCase() === right.email.toLowerCase();
-	}
-	return unreachableAddAuthMethodInput(left);
-}
-function addSignerSelectionMatches(left, right) {
-	if (left.mode !== right.mode) return false;
-	switch (left.mode) {
-		case "ecdsa": return right.mode === "ecdsa" && positiveIntegerArraysEqual(left.ecdsa.participantIds, right.ecdsa.participantIds) && thresholdEcdsaChainTargetsEqual(left.ecdsa.chainTargets, right.ecdsa.chainTargets);
-		case "ed25519": return right.mode === "ed25519" && addSignerEd25519SelectionsMatch(left, right);
-	}
-	return unreachableAddSignerSelection(left);
-}
 function parseWalletIdForIntent(raw) {
 	const value = normalizeOptionalTrimmedString(raw);
 	if (!value) return null;
@@ -214,8 +198,8 @@ function parseD1StoredWalletRegistrationCeremony(raw) {
 	return ceremony;
 }
 /**
-* Refactor 94C. Setup creates the ceremony before the WebAuthn proof exists,
-* so the stored authority is a two-arm state rather than a required record.
+* Setup creates the ceremony before the WebAuthn proof exists, so the stored
+* authority is a two-arm state rather than a required record.
 */
 function parseD1WalletRegistrationCeremonyAuthorityState(raw) {
 	const record = toRecordValue(raw);
@@ -335,19 +319,22 @@ function parseD1WalletAddSignerFinalizeSuccessResponse(raw) {
 	}
 	if (record.kind !== "evm_family_ecdsa") return null;
 	const ecdsa = parseD1WalletRegistrationFinalizeEcdsa(record.ecdsa);
-	if (!ecdsa) return null;
+	const authority = parseWalletAuthorityV1(record.authority);
+	if (!ecdsa || !authority.ok || authority.value.state !== "active") return null;
 	const rpId = normalizeOptionalTrimmedString(record.rpId);
 	return rpId ? {
 		ok: true,
 		kind: "evm_family_ecdsa",
 		walletId,
 		rpId,
-		ecdsa
+		ecdsa,
+		authority: authority.value
 	} : {
 		ok: true,
 		kind: "evm_family_ecdsa",
 		walletId,
-		ecdsa
+		ecdsa,
+		authority: authority.value
 	};
 }
 function parseD1WalletAddSignerFinalizeTerminalResponse(raw) {
@@ -877,7 +864,10 @@ function parseD1StoredEvmFamilyEcdsaPreparedBranch(record) {
 function parseD1StoredEvmFamilyEcdsaResponseClaimedBranch(record) {
 	const branchKey = parseD1RegistrationSignerBranchKey(record.branchKey);
 	const prepared = parseD1StoredEcdsaRegistrationBranchBase(record);
-	if (!branchKey || !prepared) return null;
+	const projectEnvironmentId = normalizeOptionalTrimmedString(record.projectEnvironmentId);
+	const tenantRootIdentityDigestB64u = normalizeOptionalTrimmedString(record.tenantRootIdentityDigestB64u);
+	const tenantRootCustodyLineageB64u = normalizeOptionalTrimmedString(record.tenantRootCustodyLineageB64u);
+	if (!branchKey || !prepared || !projectEnvironmentId || !tenantRootIdentityDigestB64u || !tenantRootCustodyLineageB64u) return null;
 	try {
 		return {
 			kind: "evm_family_ecdsa_response_claimed",
@@ -887,7 +877,10 @@ function parseD1StoredEvmFamilyEcdsaResponseClaimedBranch(record) {
 			prepare: prepared.prepare,
 			strictRegistration: prepared.strictRegistration,
 			strictRegistrationBindingJson: prepared.strictRegistrationBindingJson,
-			registrationRequest: parseRouterAbEcdsaRegistrationRequestV1(record.registrationRequest)
+			registrationRequest: parseRouterAbEcdsaRegistrationRequestV1(record.registrationRequest),
+			projectEnvironmentId,
+			tenantRootIdentityDigestB64u,
+			tenantRootCustodyLineageB64u
 		};
 	} catch {
 		return null;
@@ -1451,33 +1444,6 @@ function thresholdEcdsaChainTargetsEqual(left, right) {
 	for (let index = 0; index < leftTargets.length; index += 1) if (thresholdEcdsaChainTargetKey(leftTargets[index]) !== thresholdEcdsaChainTargetKey(rightTargets[index])) return false;
 	return true;
 }
-function isMatchingD1EcdsaClientBootstrap(input) {
-	const expected = input.expected;
-	const actual = input.actual;
-	return actual.formatVersion === expected.formatVersion && actual.walletId === expected.walletId && actual.evmFamilySigningKeySlotId === expected.evmFamilySigningKeySlotId && actual.ecdsaThresholdKeyId === expected.ecdsaThresholdKeyId && actual.signingRootId === expected.signingRootId && actual.signingRootVersion === expected.signingRootVersion && actual.keyScope === expected.keyScope && actual.relayerKeyId === expected.relayerKeyId && actual.registrationPreparationId === expected.registrationPreparationId && actual.requestId === expected.requestId && actual.thresholdSessionId === expected.thresholdSessionId && actual.ttlMs === expected.ttlMs && actual.remainingUses === expected.remainingUses && positiveIntegerArraysEqual(actual.participantIds, expected.participantIds) && runtimePolicyScopeMatches(actual.runtimePolicyScope, expected.runtimePolicyScope);
-}
-function toD1EcdsaDerivationClientBootstrapRequest(clientBootstrap) {
-	return {
-		formatVersion: clientBootstrap.formatVersion,
-		walletId: clientBootstrap.walletId,
-		evmFamilySigningKeySlotId: requireEvmFamilySigningKeySlotId(clientBootstrap.evmFamilySigningKeySlotId),
-		ecdsaThresholdKeyId: clientBootstrap.ecdsaThresholdKeyId,
-		signingRootId: clientBootstrap.signingRootId,
-		signingRootVersion: clientBootstrap.signingRootVersion,
-		keyScope: clientBootstrap.keyScope,
-		relayerKeyId: clientBootstrap.relayerKeyId,
-		registrationPreparationId: clientBootstrap.registrationPreparationId,
-		derivationClientSharePublicKey33B64u: clientBootstrap.derivationClientSharePublicKey33B64u,
-		clientShareRetryCounter: clientBootstrap.clientShareRetryCounter,
-		contextBinding32B64u: clientBootstrap.contextBinding32B64u,
-		requestId: clientBootstrap.requestId,
-		sessionId: clientBootstrap.thresholdSessionId,
-		ttlMs: clientBootstrap.ttlMs,
-		remainingUses: clientBootstrap.remainingUses,
-		participantIds: [...clientBootstrap.participantIds],
-		runtimePolicyScope: clientBootstrap.runtimePolicyScope
-	};
-}
 function buildD1EcdsaWalletKeysFromBootstrap(input) {
 	if (input.bootstraps.length === 0) return {
 		ok: false,
@@ -2064,18 +2030,10 @@ function safeInteger(raw) {
 	const value = Number(raw);
 	return Number.isSafeInteger(value) ? value : null;
 }
-function addSignerEd25519SelectionsMatch(left, right) {
-	const leftEd25519 = left.ed25519;
-	const rightEd25519 = right.ed25519;
-	return leftEd25519.mode === rightEd25519.mode && leftEd25519.signerSlot === rightEd25519.signerSlot && leftEd25519.keyPurpose === rightEd25519.keyPurpose && leftEd25519.keyVersion === rightEd25519.keyVersion && leftEd25519.derivationVersion === rightEd25519.derivationVersion && positiveIntegerArraysEqual(leftEd25519.participantIds, rightEd25519.participantIds);
-}
 function unreachableAddAuthMethodInput(value) {
 	throw new Error(`Unhandled add-auth-method input kind: ${String(value)}`);
 }
-function unreachableAddSignerSelection(value) {
-	throw new Error(`Unhandled add-signer selection mode: ${String(value)}`);
-}
 //#endregion
-export { addAuthMethodInputMatches, addSignerSelectionMatches, buildAddAuthMethodIntent, buildAddSignerIntent, buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, buildD1WalletRecord, buildRegistrationIntent, createD1ServerAllocatedWalletId, deriveEvmFamilySigningKeySlotId, inferRuntimePolicyScopeFromSigningRoot, intentScopeMetadata, isMatchingD1EcdsaClientBootstrap, normalizeThresholdEcdsaChainTargets, parseD1AddAuthMethodIntent, parseD1AddSignerIntent, parseD1EcdsaDerivationServerBootstrapResponse, parseD1PositiveIntegerArray, parseD1RegistrationAuthority, parseD1RegistrationIntent, parseD1RuntimePolicyScope, parseD1StoredAddAuthMethodIntent, parseD1StoredAddSignerAuth, parseD1StoredAddSignerIntent, parseD1StoredNearEd25519YaoAuthorizedBranch, parseD1StoredWalletAddAuthMethodCeremony, parseD1StoredWalletAddAuthMethodFinalizeReplay, parseD1StoredWalletAddSignerCeremony, parseD1StoredWalletAddSignerFinalizeReplay, parseD1StoredWalletRegistrationCeremony, parseD1WalletAddSignerFinalizeRequest, parseD1WalletAddSignerFinalizeTerminalResponse, parseD1WalletRegistrationCommittedInstallationProjection, parseD1WalletRegistrationFinalizeReplayResponse, parseWalletIdForIntent, positiveIntegerArraysEqual, runtimePolicyScopeMatches, thresholdEcdsaChainTargetsEqual, toD1EcdsaDerivationClientBootstrapRequest };
+export { buildAddAuthMethodIntent, buildAddSignerIntent, buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, buildD1WalletRecord, buildRegistrationIntent, createD1ServerAllocatedWalletId, deriveEvmFamilySigningKeySlotId, inferRuntimePolicyScopeFromSigningRoot, intentScopeMetadata, normalizeThresholdEcdsaChainTargets, parseD1AddSignerIntent, parseD1EcdsaDerivationServerBootstrapResponse, parseD1RuntimePolicyScope, parseD1StoredAddAuthMethodIntent, parseD1StoredAddSignerAuth, parseD1StoredAddSignerIntent, parseD1StoredWalletAddAuthMethodCeremony, parseD1StoredWalletAddAuthMethodFinalizeReplay, parseD1StoredWalletAddSignerCeremony, parseD1StoredWalletAddSignerFinalizeReplay, parseD1StoredWalletRegistrationCeremony, parseD1WalletAddSignerFinalizeTerminalResponse, parseD1WalletRegistrationCommittedInstallationProjection, parseD1WalletRegistrationFinalizeReplayResponse, parseWalletIdForIntent, positiveIntegerArraysEqual, runtimePolicyScopeMatches, thresholdEcdsaChainTargetsEqual };
 
 //# sourceMappingURL=d1RegistrationCeremonyRecords.js.map

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyStore.js

@@ -50,7 +50,10 @@ var CloudflareD1RegistrationCeremonyIntentStore = class {
 			},
 			patch: {
 				kind: "evm_family_ecdsa_response_claimed",
-				registrationRequest: input.registrationRequest
+				registrationRequest: input.registrationRequest,
+				projectEnvironmentId: input.projectEnvironmentId,
+				tenantRootIdentityDigestB64u: input.tenantRootIdentityDigestB64u,
+				tenantRootCustodyLineageB64u: input.tenantRootCustodyLineageB64u
 			}
 		});
 	}

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationIntentService.js

@@ -1,9 +1,12 @@
 import { parseWalletAuthMethodId } from "../../../../shared-ts/src/utils/domainIds.js";
-import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, computeAddAuthMethodIntentDigestB64u, computeAddSignerIntentDigestB64u, normalizeAddAuthMethodInput, normalizeAddSignerSelection } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
+import { normalizeAddAuthMethodInput } from "../../../../shared-ts/src/utils/registrationAuthMethodInput.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
+import { failure } from "../../../../shared-ts/src/utils/failure.js";
 import { thresholdEcdsaChainTargetFromValue } from "../../../../core/thresholdEcdsaChainTarget.js";
+import { normalizeAddSignerSelection } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
+import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, computeAddAuthMethodIntentDigestB64u, computeAddSignerIntentDigestB64u } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { buildAddAuthMethodIntent, buildAddSignerIntent, inferRuntimePolicyScopeFromSigningRoot, intentScopeMetadata, parseWalletIdForIntent } from "./d1RegistrationCeremonyRecords.js";
 //#region src/router/cloudflare/d1/registration/d1RegistrationIntentService.ts
 function errorMessage(error) {
@@ -17,11 +20,7 @@ var CloudflareD1RegistrationIntentService = class {
 		try {
 			const store = this.getRegistrationCeremonyIntentStore();
 			const walletId = parseWalletIdForIntent(input.command.subject.walletId);
-			if (!walletId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "walletId is required"
-			};
+			if (!walletId) return failure("invalid_body", "walletId is required");
 			const signerSelection = normalizeAddSignerSelection(input.command.signerSelection, { normalizeEcdsaChainTarget: thresholdEcdsaChainTargetFromValue });
 			if (!signerSelection.ok) return signerSelection;
 			const runtimePolicyScope = input.runtimePolicyScope || inferRuntimePolicyScopeFromSigningRoot(input);
@@ -50,35 +49,19 @@ var CloudflareD1RegistrationIntentService = class {
 				expiresAtMs
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: errorMessage(error) || "Failed to create add-signer intent"
-			};
+			return failure("internal", errorMessage(error) || "Failed to create add-signer intent");
 		}
 	}
 	async createAddAuthMethodIntent(input) {
 		try {
 			const store = this.getRegistrationCeremonyIntentStore();
 			const walletId = parseWalletIdForIntent(input.command.subject.walletId);
-			if (!walletId) return {
-				ok: false,
-				code: "invalid_body",
-				message: "walletId is required"
-			};
+			if (!walletId) return failure("invalid_body", "walletId is required");
 			const authMethod = normalizeAddAuthMethodInput(input.command.authMethod);
-			if (!authMethod) return {
-				ok: false,
-				code: "invalid_body",
-				message: "authMethod is required"
-			};
+			if (!authMethod) return failure("invalid_body", "authMethod is required");
 			const runtimePolicyScope = input.runtimePolicyScope || inferRuntimePolicyScopeFromSigningRoot(input);
 			const targetWalletAuthMethodId = parseWalletAuthMethodId(`wallet-auth-method:${secureRandomBase64Url(32)}`);
-			if (!targetWalletAuthMethodId.ok) return {
-				ok: false,
-				code: "internal",
-				message: "Failed to allocate a target auth-method id"
-			};
+			if (!targetWalletAuthMethodId.ok) return failure("internal", "Failed to allocate a target auth-method id");
 			const intent = buildAddAuthMethodIntent({
 				walletId,
 				authMethod,
@@ -106,11 +89,7 @@ var CloudflareD1RegistrationIntentService = class {
 				expiresAtMs
 			};
 		} catch (error) {
-			return {
-				ok: false,
-				code: "internal",
-				message: errorMessage(error) || "Failed to create add-auth-method intent"
-			};
+			return failure("internal", errorMessage(error) || "Failed to create add-auth-method intent");
 		}
 	}
 };

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.js

@@ -1,16 +1,16 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
-import { parseWalletAuthMethodRecordV2, sameWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
 import "../../../../shared-ts/src/utils/validation.js";
+import { parseWalletAuthMethodRecordV2, sameWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
+import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { buildWalletSessionCapabilitySubjectsV1 } from "../../../../authorization/domain.js";
 import { parseD1JsonColumn } from "../../../../storage/d1Sql.js";
 import { prepareD1WalletPutSignerStatement, prepareD1WalletPutSubjectStatement } from "../../../../core/d1WalletStore.js";
 import { prepareD1WalletAuthMethodV2PutStatement } from "../../../../core/d1WalletAuthMethodStore.js";
 import { prepareD1WebAuthnCredentialBindingPutStatement } from "../../../../core/WebAuthnCredentialBindingStore.js";
 import { prepareD1WebAuthnAuthenticatorPutStatement } from "../webauthn/d1WebAuthnStore.js";
-import { prepareD1WalletAuthorityPutStatement } from "../wallet/d1WalletAuthorityStore.js";
 import { prepareD1WalletSessionAuthorityProjectionStatements } from "../authorization/walletSessionAuthorityProjection.js";
+import { prepareD1WalletAuthorityExtensionCasGuard, prepareD1WalletAuthorityExtensionStatement, prepareD1WalletAuthorityPutStatement } from "../wallet/d1WalletAuthorityStore.js";
 //#region src/router/cloudflare/d1/registration/d1WalletRegistrationCommitStore.ts
 function requireScopeString(value, field) {
 	const normalized = normalizeOptionalTrimmedString(value);
@@ -119,31 +119,6 @@ function canExtendFoundingAuthorityWithEd25519(existing, next) {
 	const nextEcdsa = next.signerActivations.ecdsa;
 	return existing.signerActivations.keyFamilies.length === 1 && existing.signerActivations.keyFamilies[0] === "ecdsa_secp256k1" && next.signerActivations.keyFamilies.length === 2 && next.signerActivations.keyFamilies[0] === "ed25519" && next.signerActivations.keyFamilies[1] === "ecdsa_secp256k1" && existingEcdsa !== void 0 && nextEcdsa !== void 0 && sameWalletEcdsaSignerActivationV1(existingEcdsa, nextEcdsa) && foundingAuthorityIdentityMatches(existing, next) && next.updatedAtMs >= existing.updatedAtMs;
 }
-function prepareFoundingAuthorityExtensionStatement(input) {
-	return input.database.prepare(`UPDATE wallet_authorities
-          SET signer_activations_json = ?,
-              signer_activation_set_digest_b64u = ?,
-              authority_digest_b64u = ?,
-              record_json = ?,
-              updated_at_ms = ?
-        WHERE namespace = ? AND org_id = ? AND project_id = ? AND env_id = ?
-          AND authority_id = ?
-          AND wallet_id = ?
-          AND lifecycle_state = 'active'
-          AND signer_activation_set_digest_b64u = ?
-          AND authority_digest_b64u = ?
-          AND revocation_epoch = ?
-          AND created_at_ms = ?
-          AND updated_at_ms = ?
-          AND activated_at_ms = ?`).bind(JSON.stringify(input.next.signerActivations), String(input.next.signerActivationSetDigestB64u), String(input.next.authorityDigestB64u), JSON.stringify(input.next), input.next.updatedAtMs, input.scope.namespace, input.scope.orgId, input.scope.projectId, input.scope.envId, String(input.expected.authorityId), String(input.expected.walletId), String(input.expected.signerActivationSetDigestB64u), String(input.expected.authorityDigestB64u), input.expected.revocationEpoch, input.expected.createdAtMs, input.expected.updatedAtMs, input.expected.activatedAtMs);
-}
-function prepareFoundingAuthorityExtensionCasGuard(database) {
-	return database.prepare(`
-    INSERT INTO wallet_authority_cas_guard (guard_id)
-    SELECT 1
-     WHERE changes() = 0
-  `);
-}
 async function prepareFoundingStatements(input) {
 	if (!input.foundingAuthority) return [];
 	const foundingAuthMethod = requireFoundingAuthMethod(input.foundingAuthMethod);
@@ -181,12 +156,12 @@ async function prepareFoundingStatements(input) {
 		scope: input.scope,
 		authority: input.foundingAuthority
 	}));
-	else if (persistedAuthority && foundingAuthorityNeedsExtension) statements.push(prepareFoundingAuthorityExtensionStatement({
+	else if (persistedAuthority && foundingAuthorityNeedsExtension) statements.push(prepareD1WalletAuthorityExtensionStatement({
 		database: input.database,
 		scope: input.scope,
 		expected: persistedAuthority,
 		next: input.foundingAuthority
-	}), prepareFoundingAuthorityExtensionCasGuard(input.database), ...prepareD1WalletSessionAuthorityProjectionStatements({
+	}), prepareD1WalletAuthorityExtensionCasGuard(input.database), ...prepareD1WalletSessionAuthorityProjectionStatements({
 		database: input.database,
 		scope: input.scope,
 		projection: {
@@ -250,6 +225,7 @@ var CloudflareD1WalletRegistrationCommitStore = class {
 			now: input.now
 		}));
 		statements.push(...emailOtpCommitStatements(input));
+		statements.push(...input.decisionStatements);
 		const results = await this.database.batch(statements);
 		assertBatchSucceeded({
 			expectedStatementCount: statements.length,