@seams/wallet-server 0.5.0

package/dist/esm/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.js

@@ -0,0 +1,1609 @@
+import { parseThresholdEd25519SessionId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, parseRouterAbEd25519YaoRecoveryActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRecoveryActivationExecuteRequestV1, parseRouterAbEd25519YaoRecoveryActivationReceiptV1, parseRouterAbEd25519YaoRecoveryActivationRequestV1, parseRouterAbEd25519YaoRecoveryActivationResultV1, parseRouterAbEd25519YaoRecoveryAdmissionRequestV1, parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1, sameRouterAbEd25519YaoActivationBindingV1, sameRouterAbEd25519YaoActivationPublicReceiptV1, sameRouterAbEd25519YaoRecoveryAdmissionRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { normalizeRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
+import { ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
+import { defineRoute } from "../../../framework/routeDefinitions.js";
+import { ROUTER_AB_TRACE_ID_HEADER_V1, createRouterAbTraceContextV1, parseRouterAbTraceContextV1 } from "../../../../shared-ts/src/utils/routerAbTraceContext.js";
+import { json, readJson } from "../../../framework/http.js";
+import { createRouterApiModule } from "../../../framework/modules.js";
+//#region src/router/domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.ts
+function requireThresholdEd25519SessionId(value, label) {
+	const parsed = parseThresholdEd25519SessionId(value);
+	if (!parsed.ok) throw new Error(`${label} is invalid`);
+	return parsed.value;
+}
+function resolveTraceContext(request) {
+	const parsed = parseRouterAbTraceContextV1(request.headers.get(ROUTER_AB_TRACE_ID_HEADER_V1));
+	if (parsed.ok) return parsed;
+	if (parsed.reason === "missing") return {
+		ok: true,
+		value: createRouterAbTraceContextV1()
+	};
+	return {
+		ok: false,
+		message: parsed.message
+	};
+}
+function recoveryAuthorizationBinding(authorization) {
+	if (authorization.kind === "wallet_recovery") return authorization;
+	const session = authorization.kind === "wallet_session_v2" ? authorization.context.authorization.session : authorization.context.status.session;
+	return {
+		kind: "wallet_session_v2",
+		tenantId: session.tenantId,
+		principalId: session.principalId,
+		walletId: session.walletId,
+		authorityId: session.authorityId,
+		walletAuthMethodId: session.walletAuthMethodId,
+		mintId: session.mintId,
+		authorizationId: session.authorizationId,
+		walletSessionId: session.walletSessionId,
+		quotaId: session.quotaId
+	};
+}
+function warmBootstrapWalletSessionContext(authorization) {
+	switch (authorization.kind) {
+		case "wallet_session_v2": return {
+			session: authorization.context.authorization.session,
+			quota: authorization.context.authorization.quota,
+			authority: authorization.context.authority,
+			authMethod: authorization.context.authMethod
+		};
+		case "wallet_session_v2_exhausted_candidate": return {
+			session: authorization.context.status.session,
+			quota: authorization.context.status.quota,
+			authority: authorization.context.authority,
+			authMethod: authorization.context.authMethod
+		};
+	}
+}
+function recoveryAuthorityProjection(authorization) {
+	return authorization.kind === "wallet_recovery" ? { kind: "replace_continuity_authority_projections" } : { kind: "replace_active_authority_projection" };
+}
+var EphemeralRouterAbEd25519YaoCapabilityPersistenceV1 = class {
+	replaceActiveCapability() {
+		return {
+			ok: true,
+			disposition: "applied"
+		};
+	}
+};
+var InMemoryRouterAbEd25519YaoRecoveryStateV1 = class {
+	constructor() {
+		this.capabilities = /* @__PURE__ */ new Map();
+		this.identityCapabilities = /* @__PURE__ */ new Map();
+		this.recoveries = /* @__PURE__ */ new Map();
+		this.recoverySessions = /* @__PURE__ */ new Map();
+	}
+};
+const ROUTER_AB_ED25519_YAO_RECOVERY_ROUTES = Object.freeze([
+	defineRoute({
+		id: "router_ab_ed25519_yao_warm_recovery_bootstrap",
+		surface: "relay",
+		method: "POST",
+		path: ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1,
+		auth: {
+			plane: "public",
+			proof: "threshold_protocol_state",
+			rationale: "Warm recovery bootstrap requires an exact owner or delegated-export Ed25519 Wallet Session."
+		},
+		metering: { kind: "none" },
+		requiredServices: [],
+		summary: "Resolve the active capability for an authenticated warm Ed25519 Yao recovery"
+	}),
+	defineRoute({
+		id: "router_ab_ed25519_yao_recovery_admit",
+		surface: "relay",
+		method: "POST",
+		path: ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1,
+		auth: {
+			plane: "public",
+			proof: "intent_grant",
+			rationale: "Recovery admission requires the explicit recovery authorization adapter."
+		},
+		metering: { kind: "none" },
+		requiredServices: [],
+		summary: "Admit an Ed25519 Yao same-root recovery"
+	}),
+	defineRoute({
+		id: "router_ab_ed25519_yao_recovery_execute",
+		surface: "relay",
+		method: "POST",
+		path: ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1,
+		auth: {
+			plane: "public",
+			proof: "threshold_protocol_state",
+			rationale: "Recovery execution requires the explicit recovery authorization adapter."
+		},
+		metering: { kind: "none" },
+		requiredServices: [],
+		summary: "Execute and stage an admitted Ed25519 Yao recovery"
+	}),
+	defineRoute({
+		id: "router_ab_ed25519_yao_recovery_activate",
+		surface: "relay",
+		method: "POST",
+		path: ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1,
+		auth: {
+			plane: "public",
+			proof: "threshold_protocol_state",
+			rationale: "Recovery activation requires the explicit recovery authorization adapter."
+		},
+		metering: { kind: "none" },
+		requiredServices: [],
+		summary: "Promote a verified Ed25519 Yao recovery candidate"
+	})
+]);
+function canonicalFingerprint(value) {
+	return JSON.stringify(value);
+}
+function bytesToHex(bytes) {
+	let encoded = "";
+	for (const byte of bytes) encoded += byte.toString(16).padStart(2, "0");
+	return encoded;
+}
+function equalBytes(left, right) {
+	if (left.length !== right.length) return false;
+	for (let index = 0; index < left.length; index += 1) if (left[index] !== right[index]) return false;
+	return true;
+}
+function sameRecoveryAuthorizationBindingV1(left, right) {
+	if (left.kind !== right.kind) return false;
+	switch (left.kind) {
+		case "wallet_recovery": return right.kind === "wallet_recovery" && left.walletId === right.walletId;
+		case "wallet_session_v2": return right.kind === "wallet_session_v2" && left.tenantId === right.tenantId && left.principalId === right.principalId && left.walletId === right.walletId && left.authorityId === right.authorityId && left.walletAuthMethodId === right.walletAuthMethodId && left.mintId === right.mintId && left.authorizationId === right.authorizationId && left.walletSessionId === right.walletSessionId && left.quotaId === right.quotaId;
+		default: return assertNever(left);
+	}
+}
+function sameRecoveryActivationRequestV1(left, right) {
+	return sameRouterAbEd25519YaoActivationBindingV1(left.binding, right.binding) && sameRouterAbEd25519YaoActivationPublicReceiptV1(left.public_receipt, right.public_receipt);
+}
+function exactRuntimePolicyScope(left, right) {
+	return left.orgId === right.orgId && left.projectId === right.projectId && left.envId === right.envId && left.signingRootVersion === right.signingRootVersion;
+}
+function sameEd25519PublicKeyBytes(left, right) {
+	return left.length === 32 && right.length === 32 && left.every((byte, index) => byte === right[index]);
+}
+/**
+* A linked device shares the wallet's one identity-scoped capability but holds
+* its own lane material, so the descriptor it may bootstrap against must name
+* the linked activation and threshold session from the installed authority
+* projection rather than the founding values the shared descriptor carries.
+* This is the warm-bootstrap counterpart of the wallet-session issuance
+* override in the registration service; without it, no linked authority can
+* satisfy the exact-session predicates below.
+*/
+async function resolveWarmBootstrapCapabilityForAuthority(input) {
+	const authority = input.context.authority;
+	if (authority.provenance.kind !== "device_link") return input.capability;
+	const activation = authority.signerActivations.ed25519;
+	const reader = input.linkedAuthorities;
+	if (!activation || !reader) return null;
+	const projection = await reader.readInstalledEd25519AuthorityByMaterialActivationV1({
+		walletId: authority.walletId,
+		materialActivation: activation.materialActivation
+	});
+	if (!projection) return null;
+	const authorityActivationWire = routerAbMpcMaterialActivationRefToWire(activation.materialActivation);
+	const projectionMaterialWire = routerAbMpcMaterialActivationRefToWire(projection.materialActivation);
+	const descriptor = input.capability;
+	const targetBinding = projection.targetBinding;
+	const targetLifecycle = targetBinding.lifecycle;
+	const targetSessionId = parseThresholdEd25519SessionId(targetLifecycle.session_id);
+	if (!targetSessionId.ok || projection.walletId !== String(authority.walletId) || projection.authorityId !== String(authority.authorityId) || projection.walletAuthMethodId !== String(input.context.authMethod.walletAuthMethodId) || projection.linkSessionId !== String(authority.provenance.linkSessionId) || !sameRouterAbMpcMaterialActivationRef(projectionMaterialWire, authorityActivationWire) || projection.applicationBinding.wallet_id !== descriptor.applicationBinding.wallet_id || projection.applicationBinding.near_ed25519_signing_key_id !== descriptor.applicationBinding.near_ed25519_signing_key_id || projection.applicationBinding.signing_root_id !== descriptor.applicationBinding.signing_root_id || projection.applicationBinding.key_creation_signer_slot !== descriptor.applicationBinding.key_creation_signer_slot || projection.participantIds[0] !== descriptor.participantIds[0] || projection.participantIds[1] !== descriptor.participantIds[1] || targetBinding.operation !== "registration" || targetLifecycle.work_kind !== "registration_prepare" || targetLifecycle.primitive_request_kind !== "registration" || targetLifecycle.account_id !== descriptor.lifecycle.accountId || targetLifecycle.root_share_epoch !== descriptor.lifecycle.rootShareEpoch || targetLifecycle.signer_set_id !== descriptor.lifecycle.signerSetId || targetLifecycle.selected_server_id !== descriptor.lifecycle.signingWorkerId || !sameRouterAbMpcMaterialActivationRef(targetBinding.material_activation, projectionMaterialWire) || !sameRouterAbMpcMaterialActivationRef(projection.activationReceipt.material_activation, projectionMaterialWire) || !sameEd25519PublicKeyBytes(projection.activationReceipt.registered_public_key, descriptor.registeredPublicKey)) return null;
+	return {
+		...descriptor,
+		materialActivation: projectionMaterialWire,
+		lifecycle: {
+			...descriptor.lifecycle,
+			thresholdSessionId: targetSessionId.value
+		}
+	};
+}
+function warmBootstrapCapabilityMatchesStableIdentity(input) {
+	const session = input.context.session;
+	const quota = input.context.quota;
+	const activation = input.context.authority.signerActivations.ed25519;
+	const ed25519Subject = session.capabilitySubjects.find((subject) => subject.kind === "sign" && subject.keyFamily === "ed25519");
+	if (!activation || !ed25519Subject) return false;
+	return warmBootstrapCapabilityMatchesRuntimeScope({
+		request: input.request,
+		runtimePolicyScope: input.capability.runtimePolicyScope,
+		capability: input.capability
+	}) && String(session.walletId) === input.request.walletId && String(input.context.authority.walletId) === input.request.walletId && String(input.context.authMethod.walletId) === input.request.walletId && quota.walletSessionId === session.walletSessionId && quota.quotaId === session.quotaId && quota.tenantId === session.tenantId && quota.principalId === session.principalId && quota.expiresAtMs === session.expiresAtMs && sameRouterAbMpcMaterialActivationRef(routerAbMpcMaterialActivationRefToWire(activation.materialActivation), input.capability.materialActivation) && sameRouterAbMpcMaterialActivationRef(routerAbMpcMaterialActivationRefToWire(ed25519Subject.materialActivation), input.capability.materialActivation);
+}
+function warmBootstrapCapabilityMatchesRuntimeScope(input) {
+	const request = input.request;
+	const capability = input.capability;
+	return capability.applicationBinding.wallet_id === request.walletId && capability.nearAccountId === request.nearAccountId && capability.applicationBinding.near_ed25519_signing_key_id === request.nearEd25519SigningKeyId && capability.applicationBinding.key_creation_signer_slot === request.signerSlot && capability.lifecycle.accountId === request.walletId && capability.lifecycle.thresholdSessionId === request.thresholdSessionId && capability.lifecycle.signingWorkerId === request.signingWorkerId && capability.lifecycle.rootShareEpoch === input.runtimePolicyScope.signingRootVersion && capability.participantIds[0] === request.participantIds[0] && capability.participantIds[1] === request.participantIds[1] && exactRuntimePolicyScope(capability.runtimePolicyScope, input.runtimePolicyScope);
+}
+async function buildWarmRecoveryBootstrapResponse(input) {
+	if (input.authorization.kind === "wallet_recovery") return null;
+	const context = warmBootstrapWalletSessionContext(input.authorization);
+	const capability = await resolveWarmBootstrapCapabilityForAuthority({
+		context,
+		capability: input.capability,
+		linkedAuthorities: input.linkedAuthorities ?? null
+	});
+	if (!capability) return null;
+	if (!warmBootstrapCapabilityMatchesStableIdentity({
+		request: input.request,
+		context,
+		capability
+	})) return null;
+	const session = context.session;
+	return {
+		kind: "router_ab_ed25519_yao_v2_session_bootstrap_v1",
+		walletId: String(session.walletId),
+		nearAccountId: capability.nearAccountId,
+		nearEd25519SigningKeyId: capability.applicationBinding.near_ed25519_signing_key_id,
+		signerSlot: capability.applicationBinding.key_creation_signer_slot,
+		thresholdSessionId: capability.lifecycle.thresholdSessionId,
+		walletSessionId: session.walletSessionId,
+		quotaId: context.quota.quotaId,
+		signingWorkerId: capability.lifecycle.signingWorkerId,
+		thresholdExpiresAtMs: session.expiresAtMs,
+		participantIds: capability.participantIds,
+		runtimePolicyScope: capability.runtimePolicyScope,
+		routerAbNormalSigning: {
+			kind: ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND,
+			signingWorkerId: capability.lifecycle.signingWorkerId
+		},
+		capability
+	};
+}
+function parseCapabilityBinding(value) {
+	if (value.length !== 32 || value.some((byte) => !Number.isInteger(byte) || byte < 0 || byte > 255) || value.every((byte) => byte === 0)) return null;
+	return Object.freeze([...value]);
+}
+function identityKey(identity) {
+	const binding = identity.activationBinding;
+	return canonicalFingerprint({
+		stableKeyContextBinding: binding.stable_key_context_binding,
+		rootShareEpoch: binding.lifecycle.root_share_epoch,
+		accountId: binding.lifecycle.account_id,
+		signerSetId: binding.lifecycle.signer_set_id,
+		signingWorkerId: binding.lifecycle.selected_server_id
+	});
+}
+function capabilityInstallResult(disposition, identity) {
+	return {
+		ok: true,
+		disposition,
+		activeCapabilityBinding: identity.capabilityBinding,
+		registeredPublicKey: identity.registeredPublicKey,
+		stateEpoch: identity.stateEpoch
+	};
+}
+function recoveryFailure(input) {
+	return {
+		ok: false,
+		status: input.status,
+		code: input.code,
+		message: input.message
+	};
+}
+function recoveryAuthorizationMismatchFailure() {
+	return recoveryFailure({
+		status: 409,
+		code: "continuity_mismatch",
+		message: "recovery authorization does not match the admitted authorization"
+	});
+}
+function invalidBackendResponse(message) {
+	return recoveryFailure({
+		status: 502,
+		code: "invalid_backend_response",
+		message
+	});
+}
+function backendFailure(result, phase) {
+	if (result.code === "ceremony_expired") return recoveryFailure({
+		status: 409,
+		code: "ceremony_expired",
+		message: result.message
+	});
+	return recoveryFailure({
+		status: result.status,
+		code: phase,
+		message: `${result.code}: ${result.message}`
+	});
+}
+function uncertainFailure(error, phase) {
+	return recoveryFailure({
+		status: 503,
+		code: phase,
+		message: error instanceof Error ? error.message : String(error)
+	});
+}
+function assertNever(value) {
+	throw new Error(`Unhandled Ed25519 Yao recovery state: ${String(value)}`);
+}
+function routeFailureResponse(failure) {
+	return json({
+		ok: false,
+		code: failure.code,
+		message: failure.message
+	}, { status: failure.status });
+}
+function invalidInstallation(message) {
+	return {
+		ok: false,
+		result: {
+			ok: false,
+			code: "invalid_installation",
+			message
+		}
+	};
+}
+function registrationResultMatchesAdmission(request, result) {
+	const scope = request.scope;
+	const lifecycle = result.binding.lifecycle;
+	return scope.lifecycle_id === lifecycle.lifecycle_id && scope.root_share_epoch === lifecycle.root_share_epoch && scope.account_id === lifecycle.account_id && scope.threshold_session_id === lifecycle.session_id && scope.signer_set_id === lifecycle.signer_set_id && scope.signing_worker_id === lifecycle.selected_server_id && sameRouterAbMpcMaterialActivationRef(scope.material_activation, result.binding.material_activation);
+}
+function recoveryResultMatchesAdmission(request, result) {
+	const scope = request.scope;
+	const lifecycle = result.binding.lifecycle;
+	return scope.lifecycle_id === lifecycle.lifecycle_id && scope.root_share_epoch === lifecycle.root_share_epoch && scope.account_id === lifecycle.account_id && scope.threshold_session_id === lifecycle.session_id && scope.signer_set_id === lifecycle.signer_set_id && scope.signing_worker_id === lifecycle.selected_server_id && sameRouterAbMpcMaterialActivationRef(scope.material_activation, result.binding.material_activation) && equalBytes(request.registered_public_key, result.public_receipt.registered_public_key) && result.public_receipt.state_epoch > 1;
+}
+function buildCapabilityIdentity(input) {
+	if (input.kind !== "router_ab_ed25519_yao_registration_finalize_capability_v1") return invalidInstallation("registration finalize capability kind is invalid");
+	const capabilityBinding = parseCapabilityBinding(input.activeCapabilityBinding);
+	if (!capabilityBinding) return invalidInstallation("registration finalize capability binding is invalid");
+	const nearAccountId = String(input.nearAccountId || "").trim();
+	if (!nearAccountId) return invalidInstallation("registration finalize NEAR account ID is invalid");
+	const parsedRequest = parseRouterAbEd25519YaoRegistrationAdmissionRequestV1(input.registrationAdmissionRequest);
+	if (!parsedRequest.ok) return invalidInstallation(parsedRequest.message);
+	const parsedReceipt = parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1(input.registrationAdmissionReceipt);
+	if (!parsedReceipt.ok) return invalidInstallation(parsedReceipt.message);
+	const parsedResult = parseRouterAbEd25519YaoRegistrationActivationResultV1(input.registrationResult);
+	if (!parsedResult.ok) return invalidInstallation(parsedResult.message);
+	if (!registrationResultMatchesAdmission(parsedRequest.value, parsedResult.value) || !sameRouterAbEd25519YaoActivationBindingV1(parsedReceipt.value.binding, parsedResult.value.binding)) return invalidInstallation("registration result does not match its admitted lifecycle");
+	let runtimePolicyScope;
+	try {
+		runtimePolicyScope = normalizeRuntimePolicyScope(input.runtimePolicyScope);
+	} catch {
+		return invalidInstallation("registration runtime policy scope is invalid");
+	}
+	const signingRootScope = signingRootScopeFromRuntimePolicyScope(runtimePolicyScope);
+	if (signingRootScope.signingRootId !== parsedRequest.value.application_binding.signing_root_id || signingRootScope.signingRootVersion !== parsedRequest.value.scope.root_share_epoch) return invalidInstallation("registration runtime policy signing root does not match scope");
+	if (parsedResult.value.public_receipt.state_epoch !== 1 || !equalBytes(parsedResult.value.public_receipt.joined_signing_worker_commitment, parsedResult.value.public_receipt.signing_worker_verifying_share)) return invalidInstallation("registration result does not establish a valid epoch-one identity");
+	const originFingerprint = canonicalFingerprint({
+		capabilityBinding,
+		nearAccountId,
+		registrationAdmissionRequest: parsedRequest.value,
+		registrationAdmissionReceipt: parsedReceipt.value,
+		registrationResult: parsedResult.value,
+		runtimePolicyScope
+	});
+	const persisted = {
+		version: "wallet_ed25519_yao_registration_capability_v1",
+		activeCapabilityBinding: capabilityBinding,
+		nearAccountId,
+		admissionRequest: parsedRequest.value,
+		admissionReceipt: parsedReceipt.value,
+		activationResult: parsedResult.value,
+		runtimePolicyScope
+	};
+	return {
+		ok: true,
+		identity: {
+			capabilityBinding,
+			nearAccountId,
+			applicationBinding: parsedRequest.value.application_binding,
+			runtimePolicyScope,
+			participantIds: parsedRequest.value.participant_ids,
+			activationBinding: parsedResult.value.binding,
+			registeredPublicKey: parsedResult.value.public_receipt.registered_public_key,
+			stateEpoch: parsedResult.value.public_receipt.state_epoch,
+			originFingerprint,
+			persisted
+		}
+	};
+}
+function buildPersistedCapabilityIdentity(input) {
+	switch (input.version) {
+		case "wallet_ed25519_yao_registration_capability_v1": return buildCapabilityIdentity({
+			kind: "router_ab_ed25519_yao_registration_finalize_capability_v1",
+			activeCapabilityBinding: input.activeCapabilityBinding,
+			nearAccountId: input.nearAccountId,
+			registrationAdmissionRequest: input.admissionRequest,
+			registrationAdmissionReceipt: input.admissionReceipt,
+			registrationResult: input.activationResult,
+			runtimePolicyScope: input.runtimePolicyScope
+		});
+		case "wallet_ed25519_yao_recovery_capability_v1": {
+			const capabilityBinding = parseCapabilityBinding(input.activeCapabilityBinding);
+			const nearAccountId = String(input.nearAccountId || "").trim();
+			const parsedRequest = parseRouterAbEd25519YaoRecoveryAdmissionRequestV1(input.admissionRequest);
+			const parsedResult = parseRouterAbEd25519YaoRecoveryActivationResultV1(input.activationResult);
+			if (!capabilityBinding || !nearAccountId || !parsedRequest.ok || !parsedResult.ok) return invalidInstallation("persisted recovery capability is invalid");
+			if (!equalBytes(capabilityBinding, parsedRequest.value.replacement_capability_binding) || !recoveryResultMatchesAdmission(parsedRequest.value, parsedResult.value) || !equalBytes(parsedResult.value.public_receipt.joined_signing_worker_commitment, parsedResult.value.public_receipt.signing_worker_verifying_share)) return invalidInstallation("persisted recovery capability continuity is invalid");
+			let runtimePolicyScope;
+			try {
+				runtimePolicyScope = normalizeRuntimePolicyScope(input.runtimePolicyScope);
+			} catch {
+				return invalidInstallation("persisted recovery runtime policy scope is invalid");
+			}
+			const signingRootScope = signingRootScopeFromRuntimePolicyScope(runtimePolicyScope);
+			if (signingRootScope.signingRootId !== parsedRequest.value.application_binding.signing_root_id || signingRootScope.signingRootVersion !== parsedRequest.value.scope.root_share_epoch) return invalidInstallation("persisted recovery signing root does not match its scope");
+			const persisted = {
+				version: "wallet_ed25519_yao_recovery_capability_v1",
+				activeCapabilityBinding: capabilityBinding,
+				nearAccountId,
+				admissionRequest: parsedRequest.value,
+				activationResult: parsedResult.value,
+				runtimePolicyScope
+			};
+			return {
+				ok: true,
+				identity: {
+					capabilityBinding,
+					nearAccountId,
+					applicationBinding: parsedRequest.value.application_binding,
+					runtimePolicyScope,
+					participantIds: parsedRequest.value.participant_ids,
+					activationBinding: parsedResult.value.binding,
+					registeredPublicKey: parsedResult.value.public_receipt.registered_public_key,
+					stateEpoch: parsedResult.value.public_receipt.state_epoch,
+					originFingerprint: canonicalFingerprint(persisted),
+					persisted
+				}
+			};
+		}
+		default: return assertNever(input);
+	}
+}
+function buildRouterAbEd25519YaoRegistrationCapabilityRecordV1(input) {
+	const built = buildCapabilityIdentity(input);
+	if (!built.ok) return built.result;
+	return {
+		ok: true,
+		record: built.identity.persisted
+	};
+}
+function recoveryRequestMatchesActiveCapabilityIdentity(request, identity) {
+	const scope = request.scope;
+	const activeLifecycle = identity.activationBinding.lifecycle;
+	return equalBytes(request.active_capability_binding, identity.capabilityBinding) && equalBytes(request.registered_public_key, identity.registeredPublicKey) && request.application_binding.wallet_id === identity.applicationBinding.wallet_id && request.application_binding.near_ed25519_signing_key_id === identity.applicationBinding.near_ed25519_signing_key_id && request.application_binding.signing_root_id === identity.applicationBinding.signing_root_id && request.application_binding.key_creation_signer_slot === identity.applicationBinding.key_creation_signer_slot && request.participant_ids[0] === identity.participantIds[0] && request.participant_ids[1] === identity.participantIds[1] && sameRouterAbMpcMaterialActivationRef(request.active_material_activation, identity.activationBinding.material_activation) && scope.root_share_epoch === activeLifecycle.root_share_epoch && scope.account_id === activeLifecycle.account_id && scope.signer_set_id === activeLifecycle.signer_set_id && scope.signing_worker_id === activeLifecycle.selected_server_id;
+}
+function recoveryAdmissionReceiptMatches(request, identity, receipt) {
+	const scope = request.scope;
+	const lifecycle = receipt.binding.lifecycle;
+	return scope.lifecycle_id === lifecycle.lifecycle_id && scope.root_share_epoch === lifecycle.root_share_epoch && scope.account_id === lifecycle.account_id && scope.threshold_session_id === lifecycle.session_id && scope.signer_set_id === lifecycle.signer_set_id && scope.signing_worker_id === lifecycle.selected_server_id && sameRouterAbMpcMaterialActivationRef(scope.material_activation, receipt.binding.material_activation) && equalBytes(receipt.binding.stable_key_context_binding, identity.activationBinding.stable_key_context_binding);
+}
+function expectedRecoveryEpoch(identity) {
+	if (identity.stateEpoch >= Number.MAX_SAFE_INTEGER) return null;
+	return identity.stateEpoch + 1;
+}
+function recoveryResultMatches(request, identity, result) {
+	if (!sameRouterAbEd25519YaoActivationBindingV1(request.binding, result.binding)) return "binding_mismatch";
+	if (!equalBytes(result.binding.stable_key_context_binding, identity.activationBinding.stable_key_context_binding)) return "binding_mismatch";
+	if (!equalBytes(result.public_receipt.registered_public_key, identity.registeredPublicKey)) return "public_key_mismatch";
+	const expectedEpoch = expectedRecoveryEpoch(identity);
+	if (expectedEpoch === null || result.public_receipt.state_epoch !== expectedEpoch) return "stale_epoch";
+	if (!equalBytes(result.public_receipt.joined_signing_worker_commitment, result.public_receipt.signing_worker_verifying_share)) return "public_key_mismatch";
+	return "match";
+}
+function executionContinuityFailure(mismatch) {
+	switch (mismatch) {
+		case "binding_mismatch": return invalidBackendResponse("recovery result binding does not match execution");
+		case "public_key_mismatch": return recoveryFailure({
+			status: 409,
+			code: "continuity_mismatch",
+			message: "recovery result does not preserve the registered Ed25519 public key"
+		});
+		case "stale_epoch": return recoveryFailure({
+			status: 409,
+			code: "stale_epoch",
+			message: "recovery result does not use the exact next activation epoch"
+		});
+	}
+}
+function activationMatchesStagedResult(request, result) {
+	return sameRecoveryActivationRequestV1(request, result);
+}
+function activationReceiptMatches(request, context, receipt) {
+	return sameRouterAbEd25519YaoActivationBindingV1(receipt.binding, request.binding) && sameRouterAbEd25519YaoActivationPublicReceiptV1(receipt.public_receipt, request.public_receipt) && equalBytes(receipt.active_capability_binding, context.admissionRequest.replacement_capability_binding) && equalBytes(receipt.retired_capability_binding, context.admissionRequest.active_capability_binding);
+}
+function admittedReceiptForState(state) {
+	switch (state.kind) {
+		case "admitting":
+		case "admission_failed": return null;
+		case "admitted":
+		case "executing":
+		case "execution_failed":
+		case "staged":
+		case "activating":
+		case "activation_failed":
+		case "promoted": return state.admissionReceipt;
+		default: return assertNever(state);
+	}
+}
+function admissionReplayResult(state) {
+	switch (state.kind) {
+		case "admitting": return recoveryFailure({
+			status: 409,
+			code: "admission_in_progress",
+			message: "recovery admission is already in progress"
+		});
+		case "admission_failed": return state.failure;
+		case "admitted":
+		case "executing":
+		case "execution_failed":
+		case "staged":
+		case "activating":
+		case "activation_failed":
+		case "promoted": return {
+			ok: true,
+			status: 200,
+			value: state.admissionReceipt
+		};
+		default: return assertNever(state);
+	}
+}
+function executionReplayResult(state, fingerprint) {
+	if (state.executeFingerprint !== fingerprint) return recoveryFailure({
+		status: 409,
+		code: "binding_mismatch",
+		message: "recovery execution retry does not match the committed payload"
+	});
+	switch (state.kind) {
+		case "executing": return recoveryFailure({
+			status: 409,
+			code: "execution_in_progress",
+			message: "recovery execution is already in progress"
+		});
+		case "execution_failed": return state.failure;
+		case "staged":
+		case "activating":
+		case "activation_failed":
+		case "promoted": return {
+			ok: true,
+			status: 200,
+			value: state.result
+		};
+		default: return assertNever(state);
+	}
+}
+function activationReplayResult(state, fingerprint) {
+	if (state.activationFingerprint !== fingerprint) return recoveryFailure({
+		status: 409,
+		code: "binding_mismatch",
+		message: "recovery activation retry does not match the staged candidate"
+	});
+	switch (state.kind) {
+		case "activating": return recoveryFailure({
+			status: 409,
+			code: "activation_in_progress",
+			message: "recovery activation is already in progress"
+		});
+		case "activation_failed": return state.failure;
+		case "promoted": return {
+			ok: true,
+			status: 200,
+			value: state.activationReceipt
+		};
+		default: return assertNever(state);
+	}
+}
+var InMemoryRouterAbEd25519YaoRecoveryService = class {
+	constructor(backend, state = new InMemoryRouterAbEd25519YaoRecoveryStateV1(), capabilityPersistence = new EphemeralRouterAbEd25519YaoCapabilityPersistenceV1()) {
+		this.backend = backend;
+		this.capabilityPersistence = capabilityPersistence;
+		this.capabilities = state.capabilities;
+		this.identityCapabilities = state.identityCapabilities;
+		this.recoveries = state.recoveries;
+		this.recoverySessions = state.recoverySessions;
+	}
+	installRegistrationFinalizeCapability(input) {
+		const built = buildCapabilityIdentity(input);
+		if (!built.ok) return built.result;
+		return this.installCapabilityIdentity(built.identity);
+	}
+	installPersistedActiveCapability(input) {
+		const built = buildPersistedCapabilityIdentity(input);
+		if (!built.ok) return built.result;
+		return this.installPersistedCapabilityIdentity(built.identity);
+	}
+	installPersistedCapabilityIdentity(identity) {
+		const existing = this.capabilities.get(bytesToHex(identity.capabilityBinding));
+		if (existing && (existing.kind === "active" || existing.kind === "suspended") && existing.identity.originFingerprint === identity.originFingerprint) return capabilityInstallResult("exact_retry", existing.identity);
+		return this.installCapabilityIdentity(identity);
+	}
+	installCapabilityIdentity(identity) {
+		const capabilityKey = bytesToHex(identity.capabilityBinding);
+		const existing = this.capabilities.get(capabilityKey);
+		if (existing) switch (existing.kind) {
+			case "active":
+				if (existing.identity.originFingerprint === identity.originFingerprint) return capabilityInstallResult("exact_retry", existing.identity);
+				return {
+					ok: false,
+					code: "capability_conflict",
+					message: "active capability binding belongs to a different registration result"
+				};
+			case "suspended": return {
+				ok: false,
+				code: "capability_conflict",
+				message: "registration finalize cannot replace a suspended capability"
+			};
+			case "retired": return {
+				ok: false,
+				code: "capability_retired",
+				message: "registration finalize cannot reinstall a retired capability"
+			};
+			default: return assertNever(existing);
+		}
+		const stableIdentityKey = identityKey(identity);
+		const installedCapabilityKey = this.identityCapabilities.get(stableIdentityKey);
+		if (installedCapabilityKey && installedCapabilityKey !== capabilityKey) return {
+			ok: false,
+			code: "capability_conflict",
+			message: "stable Ed25519 identity already has an installed capability"
+		};
+		this.capabilities.set(capabilityKey, {
+			kind: "active",
+			identity
+		});
+		this.identityCapabilities.set(stableIdentityKey, capabilityKey);
+		return capabilityInstallResult("installed", identity);
+	}
+	resolveActiveCapability(input) {
+		const walletId = String(input.walletId || "").trim();
+		const nearEd25519SigningKeyId = String(input.nearEd25519SigningKeyId || "").trim();
+		const signingWorkerId = String(input.signingWorkerId || "").trim();
+		const firstParticipantId = input.participantIds?.[0];
+		const secondParticipantId = input.participantIds?.[1];
+		if (input.kind !== "router_ab_ed25519_yao_active_capability_lookup_v1" || !walletId || !nearEd25519SigningKeyId || !signingWorkerId || !Number.isSafeInteger(input.signerSlot) || input.signerSlot < 1 || !Array.isArray(input.participantIds) || input.participantIds.length !== 2 || !Number.isSafeInteger(firstParticipantId) || !Number.isSafeInteger(secondParticipantId) || Number(firstParticipantId) < 1 || Number(secondParticipantId) < 1 || firstParticipantId === secondParticipantId) return {
+			ok: false,
+			code: "invalid_lookup",
+			message: "active Ed25519 Yao capability lookup is invalid"
+		};
+		let matched = null;
+		for (const state of this.capabilities.values()) {
+			if (state.kind !== "active") continue;
+			const identity = state.identity;
+			if (identity.applicationBinding.wallet_id !== walletId || identity.applicationBinding.near_ed25519_signing_key_id !== nearEd25519SigningKeyId || identity.applicationBinding.key_creation_signer_slot !== input.signerSlot || identity.activationBinding.lifecycle.selected_server_id !== signingWorkerId || identity.participantIds[0] !== firstParticipantId || identity.participantIds[1] !== secondParticipantId) continue;
+			if (matched) return {
+				ok: false,
+				code: "capability_conflict",
+				message: "multiple active Ed25519 Yao capabilities match the wallet identity"
+			};
+			matched = identity;
+		}
+		if (!matched) return {
+			ok: false,
+			code: "unknown_capability",
+			message: "active Ed25519 Yao capability was not found"
+		};
+		const lifecycle = matched.activationBinding.lifecycle;
+		return {
+			ok: true,
+			capability: {
+				kind: "router_ab_ed25519_yao_active_capability_v1",
+				materialActivation: matched.activationBinding.material_activation,
+				activeCapabilityBinding: [...matched.capabilityBinding],
+				registeredPublicKey: [...matched.registeredPublicKey],
+				nearAccountId: matched.nearAccountId,
+				applicationBinding: {
+					wallet_id: matched.applicationBinding.wallet_id,
+					near_ed25519_signing_key_id: matched.applicationBinding.near_ed25519_signing_key_id,
+					signing_root_id: matched.applicationBinding.signing_root_id,
+					key_creation_signer_slot: matched.applicationBinding.key_creation_signer_slot
+				},
+				runtimePolicyScope: {
+					orgId: matched.runtimePolicyScope.orgId,
+					projectId: matched.runtimePolicyScope.projectId,
+					envId: matched.runtimePolicyScope.envId,
+					signingRootVersion: matched.runtimePolicyScope.signingRootVersion
+				},
+				participantIds: [matched.participantIds[0], matched.participantIds[1]],
+				lifecycle: {
+					lifecycleId: lifecycle.lifecycle_id,
+					rootShareEpoch: lifecycle.root_share_epoch,
+					accountId: lifecycle.account_id,
+					thresholdSessionId: requireThresholdEd25519SessionId(lifecycle.session_id, "active capability threshold session identity"),
+					signerSetId: lifecycle.signer_set_id,
+					signingWorkerId: lifecycle.selected_server_id
+				},
+				stateEpoch: matched.stateEpoch,
+				registrationContinuity: matched.persisted.version === "wallet_ed25519_yao_registration_capability_v1" ? {
+					kind: "registration",
+					admissionRequest: matched.persisted.admissionRequest,
+					admissionReceipt: matched.persisted.admissionReceipt,
+					activationTranscript: [...matched.persisted.activationResult.public_receipt.transcript]
+				} : {
+					kind: "recovery",
+					activationTranscript: [...matched.persisted.activationResult.public_receipt.transcript]
+				}
+			}
+		};
+	}
+	async admitRecovery(request, authorization, traceContext) {
+		const preparation = this.prepareAdmitRecovery(request, authorization);
+		switch (preparation.kind) {
+			case "completed": return {
+				ok: true,
+				status: 200,
+				value: preparation.value
+			};
+			case "failed": return preparation.failure;
+			case "claimed": {
+				let outcome;
+				try {
+					outcome = {
+						kind: "backend_response",
+						result: await this.backend.admitRecovery(request, traceContext)
+					};
+				} catch (error) {
+					return this.failUncertainAdmission(preparation.claim, error);
+				}
+				return this.commitAdmitRecovery({
+					request,
+					claim: preparation.claim,
+					outcome
+				});
+			}
+		}
+	}
+	prepareAdmitRecovery(request, authorization) {
+		const parsed = parseRouterAbEd25519YaoRecoveryAdmissionRequestV1(request);
+		if (!parsed.ok) return {
+			kind: "failed",
+			failure: recoveryFailure({
+				status: 400,
+				code: "invalid_request",
+				message: parsed.message
+			})
+		};
+		const admittedRequest = parsed.value;
+		if (String(authorization.walletId) !== admittedRequest.scope.account_id) return {
+			kind: "failed",
+			failure: recoveryAuthorizationMismatchFailure()
+		};
+		const recoveryKey = canonicalFingerprint(admittedRequest);
+		const existingRecovery = this.recoveries.get(recoveryKey);
+		if (existingRecovery) {
+			if (!sameRecoveryAuthorizationBindingV1(existingRecovery.context.authorization, authorization)) return {
+				kind: "failed",
+				failure: recoveryAuthorizationMismatchFailure()
+			};
+			const replay = admissionReplayResult(existingRecovery);
+			return replay.ok ? {
+				kind: "completed",
+				value: replay.value
+			} : {
+				kind: "failed",
+				failure: replay
+			};
+		}
+		const activeCapabilityKey = bytesToHex(admittedRequest.active_capability_binding);
+		const activeCapability = this.capabilities.get(activeCapabilityKey);
+		if (!activeCapability) return {
+			kind: "failed",
+			failure: recoveryFailure({
+				status: 404,
+				code: "unknown_capability",
+				message: "recovery active capability was not found"
+			})
+		};
+		switch (activeCapability.kind) {
+			case "suspended": return {
+				kind: "failed",
+				failure: recoveryFailure({
+					status: 409,
+					code: "capability_suspended",
+					message: "recovery active capability is already suspended"
+				})
+			};
+			case "retired": return {
+				kind: "failed",
+				failure: recoveryFailure({
+					status: 409,
+					code: "capability_retired",
+					message: "recovery active capability is retired"
+				})
+			};
+			case "active": break;
+			default: return assertNever(activeCapability);
+		}
+		if (!recoveryRequestMatchesActiveCapabilityIdentity(admittedRequest, activeCapability.identity)) return {
+			kind: "failed",
+			failure: recoveryFailure({
+				status: 409,
+				code: "continuity_mismatch",
+				message: "recovery request does not match the active capability identity"
+			})
+		};
+		const replacementCapabilityKey = bytesToHex(admittedRequest.replacement_capability_binding);
+		const replacementCapability = this.capabilities.get(replacementCapabilityKey);
+		if (replacementCapability) return {
+			kind: "failed",
+			failure: recoveryFailure({
+				status: 409,
+				code: replacementCapability.kind === "retired" ? "capability_retired" : "capability_conflict",
+				message: "recovery replacement capability binding has already been used"
+			})
+		};
+		const context = {
+			recoveryKey,
+			admissionRequest: admittedRequest,
+			activeCapability: activeCapability.identity,
+			authorization
+		};
+		this.capabilities.set(activeCapabilityKey, {
+			kind: "suspended",
+			identity: activeCapability.identity,
+			recoveryKey
+		});
+		this.recoveries.set(recoveryKey, {
+			kind: "admitting",
+			context
+		});
+		return {
+			kind: "claimed",
+			claim: {
+				kind: "router_ab_ed25519_yao_recovery_admission_claim_v1",
+				lifecycleId: admittedRequest.scope.lifecycle_id,
+				recoveryKey
+			}
+		};
+	}
+	commitAdmitRecovery(input) {
+		const recoveryKey = canonicalFingerprint(input.request);
+		const current = this.recoveries.get(input.claim.recoveryKey);
+		if (current?.kind !== "admitting" || input.claim.recoveryKey !== recoveryKey || input.claim.lifecycleId !== input.request.scope.lifecycle_id || current.context.recoveryKey !== recoveryKey || !sameRouterAbEd25519YaoRecoveryAdmissionRequestV1(current.context.admissionRequest, input.request)) return recoveryFailure({
+			status: 409,
+			code: "admission_in_progress",
+			message: "recovery admission claim is no longer current"
+		});
+		const backendResult = input.outcome.result;
+		if (!backendResult.ok) {
+			const failure = backendFailure(backendResult, "admission_failed");
+			this.storeAdmissionFailure(current.context, failure);
+			return failure;
+		}
+		const parsedReceipt = parseRouterAbEd25519YaoRecoveryActivationAdmissionReceiptV1(backendResult.body);
+		if (!parsedReceipt.ok) {
+			const failure = invalidBackendResponse(parsedReceipt.message);
+			this.storeAdmissionFailure(current.context, failure);
+			return failure;
+		}
+		if (!recoveryAdmissionReceiptMatches(input.request, current.context.activeCapability, parsedReceipt.value)) {
+			const failure = invalidBackendResponse("recovery admission receipt does not preserve the active binding");
+			this.storeAdmissionFailure(current.context, failure);
+			return failure;
+		}
+		const sessionKey = bytesToHex(parsedReceipt.value.binding.session_id);
+		if (this.recoverySessions.has(sessionKey)) {
+			const failure = invalidBackendResponse("recovery backend reused a session identifier");
+			this.storeAdmissionFailure(current.context, failure);
+			return failure;
+		}
+		this.recoverySessions.set(sessionKey, input.claim.recoveryKey);
+		this.recoveries.set(input.claim.recoveryKey, {
+			kind: "admitted",
+			context: current.context,
+			admissionReceipt: parsedReceipt.value
+		});
+		return {
+			ok: true,
+			status: 200,
+			value: parsedReceipt.value
+		};
+	}
+	async executeRecovery(request, authorization, traceContext) {
+		const preparation = this.prepareExecuteRecovery(request, authorization);
+		switch (preparation.kind) {
+			case "completed": return {
+				ok: true,
+				status: 200,
+				value: preparation.value
+			};
+			case "failed": return preparation.failure;
+			case "claimed": {
+				let outcome;
+				try {
+					outcome = {
+						kind: "backend_response",
+						result: await this.backend.executeRecovery(request, preparation.claim.admissionRequest, traceContext)
+					};
+				} catch (error) {
+					return this.failUncertainExecution(preparation.claim, error);
+				}
+				return this.commitExecuteRecovery({
+					request,
+					claim: preparation.claim,
+					outcome
+				});
+			}
+		}
+	}
+	prepareExecuteRecovery(request, authorization) {
+		const parsed = parseRouterAbEd25519YaoRecoveryActivationExecuteRequestV1(request);
+		if (!parsed.ok) return {
+			kind: "failed",
+			failure: recoveryFailure({
+				status: 400,
+				code: "invalid_request",
+				message: parsed.message
+			})
+		};
+		const executionRequest = parsed.value;
+		const sessionId = bytesToHex(executionRequest.binding.session_id);
+		const recoveryKey = this.recoverySessions.get(sessionId);
+		const state = recoveryKey ? this.recoveries.get(recoveryKey) : null;
+		if (!state) return {
+			kind: "failed",
+			failure: recoveryFailure({
+				status: 404,
+				code: "unknown_recovery",
+				message: "recovery admission was not found"
+			})
+		};
+		if (!sameRecoveryAuthorizationBindingV1(state.context.authorization, authorization)) return {
+			kind: "failed",
+			failure: recoveryAuthorizationMismatchFailure()
+		};
+		const admissionReceipt = admittedReceiptForState(state);
+		if (!admissionReceipt || !sameRouterAbEd25519YaoActivationBindingV1(executionRequest.binding, admissionReceipt.binding)) return {
+			kind: "failed",
+			failure: recoveryFailure({
+				status: 409,
+				code: "binding_mismatch",
+				message: "recovery execution does not match the admitted binding"
+			})
+		};
+		const executeFingerprint = canonicalFingerprint(executionRequest);
+		switch (state.kind) {
+			case "admitted": {
+				const executing = {
+					kind: "executing",
+					context: state.context,
+					admissionReceipt: state.admissionReceipt,
+					executeFingerprint
+				};
+				this.recoveries.set(state.context.recoveryKey, executing);
+				return {
+					kind: "claimed",
+					claim: {
+						kind: "router_ab_ed25519_yao_recovery_execute_claim_v1",
+						lifecycleId: executionRequest.binding.lifecycle.lifecycle_id,
+						recoveryKey: state.context.recoveryKey,
+						sessionId,
+						executeFingerprint,
+						admissionRequest: state.context.admissionRequest
+					}
+				};
+			}
+			case "executing":
+			case "execution_failed":
+			case "staged":
+			case "activating":
+			case "activation_failed":
+			case "promoted": {
+				const replay = executionReplayResult(state, executeFingerprint);
+				return replay.ok ? {
+					kind: "completed",
+					value: replay.value
+				} : {
+					kind: "failed",
+					failure: replay
+				};
+			}
+			case "admitting":
+			case "admission_failed": return {
+				kind: "failed",
+				failure: recoveryFailure({
+					status: 404,
+					code: "unknown_recovery",
+					message: "recovery admission has no executable session"
+				})
+			};
+			default: return assertNever(state);
+		}
+	}
+	commitExecuteRecovery(input) {
+		const state = this.recoveries.get(input.claim.recoveryKey);
+		if (state?.kind !== "executing" || input.claim.lifecycleId !== input.request.binding.lifecycle.lifecycle_id || input.claim.sessionId !== bytesToHex(input.request.binding.session_id) || input.claim.executeFingerprint !== canonicalFingerprint(input.request) || state.executeFingerprint !== input.claim.executeFingerprint || this.recoverySessions.get(input.claim.sessionId) !== input.claim.recoveryKey || !sameRouterAbEd25519YaoActivationBindingV1(input.request.binding, state.admissionReceipt.binding)) return recoveryFailure({
+			status: 409,
+			code: "execution_in_progress",
+			message: "recovery execution claim is no longer current"
+		});
+		const backendResult = input.outcome.result;
+		if (!backendResult.ok) {
+			const failure = backendFailure(backendResult, "execution_failed");
+			this.storeExecutionFailure(state, failure);
+			return failure;
+		}
+		const parsedResult = parseRouterAbEd25519YaoRecoveryActivationResultV1(backendResult.body);
+		if (!parsedResult.ok) {
+			const failure = invalidBackendResponse(parsedResult.message);
+			this.storeExecutionFailure(state, failure);
+			return failure;
+		}
+		const continuity = recoveryResultMatches(input.request, state.context.activeCapability, parsedResult.value);
+		if (continuity !== "match") {
+			const failure = executionContinuityFailure(continuity);
+			this.storeExecutionFailure(state, failure);
+			return failure;
+		}
+		this.recoveries.set(state.context.recoveryKey, {
+			kind: "staged",
+			context: state.context,
+			admissionReceipt: state.admissionReceipt,
+			executeFingerprint: input.claim.executeFingerprint,
+			result: parsedResult.value
+		});
+		return {
+			ok: true,
+			status: 200,
+			value: parsedResult.value
+		};
+	}
+	async activateRecovery(request, authorization, traceContext) {
+		const preparation = this.prepareActivateRecovery(request, authorization);
+		switch (preparation.kind) {
+			case "completed": return {
+				ok: true,
+				status: 200,
+				value: preparation.value
+			};
+			case "failed": return preparation.failure;
+			case "claimed": {
+				let outcome;
+				try {
+					outcome = {
+						kind: "backend_response",
+						result: await this.backend.activateRecovery(request, traceContext)
+					};
+				} catch (error) {
+					return this.activationUncertainFailure(error);
+				}
+				const committed = await this.commitActivateRecovery({
+					request,
+					claim: preparation.claim,
+					outcome
+				});
+				return committed.kind === "completed" ? committed.value : committed.failure;
+			}
+		}
+	}
+	prepareActivateRecovery(request, authorization) {
+		const parsed = parseRouterAbEd25519YaoRecoveryActivationRequestV1(request);
+		if (!parsed.ok) return {
+			kind: "failed",
+			failure: recoveryFailure({
+				status: 400,
+				code: "invalid_request",
+				message: parsed.message
+			})
+		};
+		const activationRequest = parsed.value;
+		const state = this.stateForSession(activationRequest.binding.session_id);
+		if (!state) return {
+			kind: "failed",
+			failure: recoveryFailure({
+				status: 404,
+				code: "unknown_recovery",
+				message: "recovery admission was not found"
+			})
+		};
+		if (!sameRecoveryAuthorizationBindingV1(state.context.authorization, authorization)) return {
+			kind: "failed",
+			failure: recoveryAuthorizationMismatchFailure()
+		};
+		const admissionReceipt = admittedReceiptForState(state);
+		if (!admissionReceipt || !sameRouterAbEd25519YaoActivationBindingV1(activationRequest.binding, admissionReceipt.binding)) return {
+			kind: "failed",
+			failure: recoveryFailure({
+				status: 409,
+				code: "binding_mismatch",
+				message: "recovery activation does not match the admitted binding"
+			})
+		};
+		const activationFingerprint = canonicalFingerprint(activationRequest);
+		switch (state.kind) {
+			case "staged": {
+				if (!activationMatchesStagedResult(activationRequest, state.result)) return {
+					kind: "failed",
+					failure: recoveryFailure({
+						status: 409,
+						code: "binding_mismatch",
+						message: "recovery activation does not match the staged candidate"
+					})
+				};
+				const activating = {
+					kind: "activating",
+					context: state.context,
+					admissionReceipt: state.admissionReceipt,
+					executeFingerprint: state.executeFingerprint,
+					result: state.result,
+					activationFingerprint
+				};
+				this.recoveries.set(state.context.recoveryKey, activating);
+				return {
+					kind: "claimed",
+					claim: this.activationClaim(activating, recoveryAuthorityProjection(state.context.authorization), "initial")
+				};
+			}
+			case "activating":
+				if (state.activationFingerprint !== activationFingerprint) return {
+					kind: "failed",
+					failure: recoveryFailure({
+						status: 409,
+						code: "binding_mismatch",
+						message: "recovery activation retry does not match the staged candidate"
+					})
+				};
+				return {
+					kind: "claimed",
+					claim: this.activationClaim(state, recoveryAuthorityProjection(state.context.authorization), "reconciliation")
+				};
+			case "activation_failed": {
+				const replay = activationReplayResult(state, activationFingerprint);
+				return replay.ok ? {
+					kind: "completed",
+					value: replay.value
+				} : {
+					kind: "failed",
+					failure: replay
+				};
+			}
+			case "promoted": {
+				const replay = activationReplayResult(state, activationFingerprint);
+				return replay.ok ? {
+					kind: "completed",
+					value: replay.value
+				} : {
+					kind: "failed",
+					failure: replay
+				};
+			}
+			case "admitted":
+			case "executing":
+			case "execution_failed": return {
+				kind: "failed",
+				failure: recoveryFailure({
+					status: 409,
+					code: "recovery_not_staged",
+					message: "recovery has no verified staged candidate"
+				})
+			};
+			case "admitting":
+			case "admission_failed": return {
+				kind: "failed",
+				failure: recoveryFailure({
+					status: 404,
+					code: "unknown_recovery",
+					message: "recovery admission has no activation session"
+				})
+			};
+			default: return assertNever(state);
+		}
+	}
+	async commitActivateRecovery(input) {
+		const state = this.recoveries.get(input.claim.recoveryKey);
+		if (state?.kind !== "activating" || input.claim.lifecycleId !== input.request.binding.lifecycle.lifecycle_id || input.claim.sessionId !== bytesToHex(input.request.binding.session_id) || input.claim.activationFingerprint !== canonicalFingerprint(input.request) || state.activationFingerprint !== input.claim.activationFingerprint || !sameRouterAbEd25519YaoActivationBindingV1(input.request.binding, state.admissionReceipt.binding)) return {
+			kind: "completed",
+			value: recoveryFailure({
+				status: 409,
+				code: "activation_in_progress",
+				message: "recovery activation claim is no longer current"
+			})
+		};
+		const backendResult = input.outcome.result;
+		if (!backendResult.ok) {
+			const failure = backendFailure(backendResult, "activation_failed");
+			this.storeActivationFailure(state, failure);
+			return {
+				kind: "completed",
+				value: failure
+			};
+		}
+		const parsedConfirmation = parseRouterAbEd25519YaoRecoveryActivationRequestV1(backendResult.body);
+		if (!parsedConfirmation.ok) {
+			const failure = invalidBackendResponse(parsedConfirmation.message);
+			this.storeActivationFailure(state, failure);
+			return {
+				kind: "completed",
+				value: failure
+			};
+		}
+		if (!sameRecoveryActivationRequestV1(parsedConfirmation.value, input.request)) {
+			const failure = invalidBackendResponse("recovery activation confirmation does not match the staged transition");
+			this.storeActivationFailure(state, failure);
+			return {
+				kind: "completed",
+				value: failure
+			};
+		}
+		const activationReceipt = parseRouterAbEd25519YaoRecoveryActivationReceiptV1({
+			binding: input.request.binding,
+			public_receipt: input.request.public_receipt,
+			active_capability_binding: state.context.admissionRequest.replacement_capability_binding,
+			retired_capability_binding: state.context.admissionRequest.active_capability_binding
+		});
+		if (!activationReceipt.ok) {
+			const failure = invalidBackendResponse(activationReceipt.message);
+			this.storeActivationFailure(state, failure);
+			return {
+				kind: "completed",
+				value: failure
+			};
+		}
+		if (!activationReceiptMatches(input.request, state.context, activationReceipt.value)) {
+			const failure = invalidBackendResponse("recovery activation receipt does not match the staged transition");
+			this.storeActivationFailure(state, failure);
+			return {
+				kind: "completed",
+				value: failure
+			};
+		}
+		const promoted = this.promoteCapability(state);
+		if (!promoted.ok) {
+			this.storeActivationFailure(state, promoted.failure);
+			return {
+				kind: "completed",
+				value: promoted.failure
+			};
+		}
+		const persisted = await this.capabilityPersistence.replaceActiveCapability({
+			operation: {
+				kind: "router_ab_ed25519_yao_capability_replacement_operation_v1",
+				operationId: input.claim.lifecycleId,
+				operationFingerprint: canonicalFingerprint({
+					activationFingerprint: input.claim.activationFingerprint,
+					authorityProjection: input.claim.authorityProjection
+				}),
+				authorityProjection: input.claim.authorityProjection
+			},
+			previous: promoted.previousIdentity.persisted,
+			next: promoted.identity.persisted
+		});
+		if (!persisted.ok) {
+			this.rollbackCapabilityPromotion(promoted.previousIdentity, promoted.identity, state.context.recoveryKey);
+			const failure = recoveryFailure({
+				status: 503,
+				code: "activation_failed",
+				message: `${persisted.code}: ${persisted.message}`
+			});
+			if (persisted.disposition === "uncertain") return {
+				kind: "uncertain",
+				failure
+			};
+			this.storeActivationFailure(state, failure);
+			return {
+				kind: "completed",
+				value: failure
+			};
+		}
+		this.recoveries.set(state.context.recoveryKey, {
+			kind: "promoted",
+			context: state.context,
+			admissionReceipt: state.admissionReceipt,
+			executeFingerprint: state.executeFingerprint,
+			result: state.result,
+			activationFingerprint: input.claim.activationFingerprint,
+			activationReceipt: activationReceipt.value
+		});
+		return {
+			kind: "completed",
+			value: {
+				ok: true,
+				status: 200,
+				value: activationReceipt.value
+			}
+		};
+	}
+	activationClaim(state, authorityProjection, disposition) {
+		return {
+			kind: "router_ab_ed25519_yao_recovery_activation_claim_v1",
+			lifecycleId: state.context.admissionRequest.scope.lifecycle_id,
+			recoveryKey: state.context.recoveryKey,
+			sessionId: bytesToHex(state.admissionReceipt.binding.session_id),
+			activationFingerprint: state.activationFingerprint,
+			authorityProjection,
+			disposition
+		};
+	}
+	activationUncertainFailure(error) {
+		return uncertainFailure(error, "activation_failed");
+	}
+	promoteCapability(state) {
+		const activeCapabilityKey = bytesToHex(state.context.admissionRequest.active_capability_binding);
+		const activeCapability = this.capabilities.get(activeCapabilityKey);
+		if (!activeCapability || activeCapability.kind !== "suspended" || activeCapability.recoveryKey !== state.context.recoveryKey) return {
+			ok: false,
+			failure: recoveryFailure({
+				status: 409,
+				code: "capability_conflict",
+				message: "suspended recovery capability no longer matches the staged transition"
+			})
+		};
+		const replacementCapabilityBinding = parseCapabilityBinding(state.context.admissionRequest.replacement_capability_binding);
+		if (!replacementCapabilityBinding) return {
+			ok: false,
+			failure: recoveryFailure({
+				status: 409,
+				code: "capability_conflict",
+				message: "replacement capability binding is invalid"
+			})
+		};
+		const replacementCapabilityKey = bytesToHex(replacementCapabilityBinding);
+		if (this.capabilities.has(replacementCapabilityKey)) return {
+			ok: false,
+			failure: recoveryFailure({
+				status: 409,
+				code: "capability_conflict",
+				message: "replacement capability binding was consumed before promotion"
+			})
+		};
+		const stableIdentityKey = identityKey(activeCapability.identity);
+		if (this.identityCapabilities.get(stableIdentityKey) !== activeCapabilityKey) return {
+			ok: false,
+			failure: recoveryFailure({
+				status: 409,
+				code: "capability_conflict",
+				message: "stable identity capability ownership changed before promotion"
+			})
+		};
+		const builtSuccessor = buildPersistedCapabilityIdentity({
+			version: "wallet_ed25519_yao_recovery_capability_v1",
+			activeCapabilityBinding: replacementCapabilityBinding,
+			nearAccountId: activeCapability.identity.nearAccountId,
+			admissionRequest: state.context.admissionRequest,
+			activationResult: state.result,
+			runtimePolicyScope: activeCapability.identity.runtimePolicyScope
+		});
+		if (!builtSuccessor.ok) return {
+			ok: false,
+			failure: recoveryFailure({
+				status: 409,
+				code: "capability_conflict",
+				message: `promoted capability is invalid: ${builtSuccessor.result.message}`
+			})
+		};
+		const successor = builtSuccessor.identity;
+		this.capabilities.set(activeCapabilityKey, {
+			kind: "retired",
+			identity: activeCapability.identity,
+			recoveryKey: state.context.recoveryKey,
+			replacementCapabilityBinding
+		});
+		this.capabilities.set(replacementCapabilityKey, {
+			kind: "active",
+			identity: successor
+		});
+		this.identityCapabilities.set(stableIdentityKey, replacementCapabilityKey);
+		return {
+			ok: true,
+			identity: successor,
+			previousIdentity: activeCapability.identity
+		};
+	}
+	rollbackCapabilityPromotion(previousIdentity, promotedIdentity, recoveryKey) {
+		const previousKey = bytesToHex(previousIdentity.capabilityBinding);
+		const promotedKey = bytesToHex(promotedIdentity.capabilityBinding);
+		this.capabilities.delete(promotedKey);
+		this.capabilities.set(previousKey, {
+			kind: "suspended",
+			identity: previousIdentity,
+			recoveryKey
+		});
+		this.identityCapabilities.set(identityKey(previousIdentity), previousKey);
+	}
+	stateForSession(session) {
+		const recoveryKey = this.recoverySessions.get(bytesToHex(session));
+		if (!recoveryKey) return null;
+		return this.recoveries.get(recoveryKey) ?? null;
+	}
+	failUncertainAdmission(claim, error) {
+		const current = this.recoveries.get(claim.recoveryKey);
+		if (current?.kind !== "admitting") return recoveryFailure({
+			status: 409,
+			code: "admission_in_progress",
+			message: "recovery admission claim is no longer current"
+		});
+		const failure = uncertainFailure(error, "admission_failed");
+		this.storeAdmissionFailure(current.context, failure);
+		return failure;
+	}
+	failUncertainExecution(claim, error) {
+		const current = this.recoveries.get(claim.recoveryKey);
+		if (current?.kind !== "executing" || current.executeFingerprint !== claim.executeFingerprint) return recoveryFailure({
+			status: 409,
+			code: "execution_in_progress",
+			message: "recovery execution claim is no longer current"
+		});
+		const failure = uncertainFailure(error, "execution_failed");
+		this.storeExecutionFailure(current, failure);
+		return failure;
+	}
+	storeAdmissionFailure(context, failure) {
+		this.recoveries.set(context.recoveryKey, {
+			kind: "admission_failed",
+			context,
+			failure
+		});
+	}
+	storeExecutionFailure(state, failure) {
+		this.recoveries.set(state.context.recoveryKey, {
+			kind: "execution_failed",
+			context: state.context,
+			admissionReceipt: state.admissionReceipt,
+			executeFingerprint: state.executeFingerprint,
+			failure
+		});
+	}
+	storeActivationFailure(state, failure) {
+		this.recoveries.set(state.context.recoveryKey, {
+			kind: "activation_failed",
+			context: state.context,
+			admissionReceipt: state.admissionReceipt,
+			executeFingerprint: state.executeFingerprint,
+			result: state.result,
+			activationFingerprint: state.activationFingerprint,
+			failure
+		});
+	}
+};
+var RouterAbEd25519YaoRecoveryRouteExtension = class {
+	constructor(service, capabilities, authorization, linkedAuthorities = null) {
+		this.service = service;
+		this.capabilities = capabilities;
+		this.authorization = authorization;
+		this.linkedAuthorities = linkedAuthorities;
+		this.kind = "fetch_route_extension";
+		this.id = "router_ab_ed25519_yao_recovery";
+		this.routes = ROUTER_AB_ED25519_YAO_RECOVERY_ROUTES;
+	}
+	async handleFetchRoute(input) {
+		if (input.method !== "POST") return json({
+			ok: false,
+			code: "method_not_allowed",
+			message: "Method not allowed"
+		}, { status: 405 });
+		const rawBody = await readJson(input.request);
+		switch (input.pathname) {
+			case ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1: return await this.handleWarmBootstrap(input.request, rawBody);
+			case ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1: return await this.handleAdmission(input.request, rawBody);
+			case ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1: return await this.handleExecution(input.request, rawBody);
+			case ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1: return await this.handleActivation(input.request, rawBody);
+			default: return json({
+				ok: false,
+				code: "not_found",
+				message: "Not found"
+			}, { status: 404 });
+		}
+	}
+	async handleWarmBootstrap(request, rawBody) {
+		const traceContext = resolveTraceContext(request);
+		if (!traceContext.ok) return json({
+			ok: false,
+			code: "invalid_trace_id",
+			message: traceContext.message
+		}, { status: 400 });
+		const parsed = parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1(rawBody);
+		if (!parsed.ok) return json({
+			ok: false,
+			code: parsed.code,
+			message: parsed.message
+		}, { status: 400 });
+		const authorization = await this.authorization.authorize({
+			kind: "bootstrap",
+			request,
+			body: parsed.value
+		});
+		if (!authorization.ok) return routeFailureResponse(authorization);
+		if (authorization.authorization.kind === "wallet_recovery") return json({
+			ok: false,
+			code: "wallet_session_claims_invalid",
+			message: "warm recovery requires a Wallet Session"
+		}, { status: 401 });
+		const activeCapability = await this.capabilities.resolveActiveCapability({
+			kind: "router_ab_ed25519_yao_active_capability_lookup_v1",
+			walletId: parsed.value.walletId,
+			nearEd25519SigningKeyId: parsed.value.nearEd25519SigningKeyId,
+			signerSlot: parsed.value.signerSlot,
+			signingWorkerId: parsed.value.signingWorkerId,
+			participantIds: parsed.value.participantIds
+		});
+		if (!activeCapability.ok) return json({
+			ok: false,
+			code: activeCapability.code,
+			message: activeCapability.message
+		}, { status: activeCapability.code === "unknown_capability" ? 404 : 409 });
+		const response = await buildWarmRecoveryBootstrapResponse({
+			request: parsed.value,
+			authorization: authorization.authorization,
+			capability: activeCapability.capability,
+			linkedAuthorities: this.linkedAuthorities?.() ?? null
+		});
+		if (!response) return json({
+			ok: false,
+			code: "continuity_mismatch",
+			message: "active Ed25519 Yao capability does not match the Wallet Session lifecycle"
+		}, { status: 409 });
+		return json(response, { status: 200 });
+	}
+	async handleAdmission(request, rawBody) {
+		const traceContext = resolveTraceContext(request);
+		if (!traceContext.ok) return json({
+			ok: false,
+			code: "invalid_trace_id",
+			message: traceContext.message
+		}, { status: 400 });
+		const parsed = parseRouterAbEd25519YaoRecoveryAdmissionRequestV1(rawBody);
+		if (!parsed.ok) return json({
+			ok: false,
+			code: parsed.code,
+			message: parsed.message
+		}, { status: 400 });
+		const authorization = await this.authorization.authorize({
+			kind: "admit",
+			request,
+			body: parsed.value
+		});
+		if (!authorization.ok) return routeFailureResponse(authorization);
+		const result = await this.service.admitRecovery(parsed.value, recoveryAuthorizationBinding(authorization.authorization), traceContext.value);
+		if (!result.ok) return routeFailureResponse(result);
+		return json(result.value, { status: result.status });
+	}
+	async handleExecution(request, rawBody) {
+		const traceContext = resolveTraceContext(request);
+		if (!traceContext.ok) return json({
+			ok: false,
+			code: "invalid_trace_id",
+			message: traceContext.message
+		}, { status: 400 });
+		const parsed = parseRouterAbEd25519YaoRecoveryActivationExecuteRequestV1(rawBody);
+		if (!parsed.ok) return json({
+			ok: false,
+			code: parsed.code,
+			message: parsed.message
+		}, { status: 400 });
+		const authorization = await this.authorization.authorize({
+			kind: "execute",
+			request,
+			body: parsed.value
+		});
+		if (!authorization.ok) return routeFailureResponse(authorization);
+		const result = await this.service.executeRecovery(parsed.value, recoveryAuthorizationBinding(authorization.authorization), traceContext.value);
+		if (!result.ok) return routeFailureResponse(result);
+		return json(result.value, { status: result.status });
+	}
+	async handleActivation(request, rawBody) {
+		const traceContext = resolveTraceContext(request);
+		if (!traceContext.ok) return json({
+			ok: false,
+			code: "invalid_trace_id",
+			message: traceContext.message
+		}, { status: 400 });
+		const parsed = parseRouterAbEd25519YaoRecoveryActivationRequestV1(rawBody);
+		if (!parsed.ok) return json({
+			ok: false,
+			code: parsed.code,
+			message: parsed.message
+		}, { status: 400 });
+		const authorization = await this.authorization.authorize({
+			kind: "activate",
+			request,
+			body: parsed.value
+		});
+		if (!authorization.ok) return routeFailureResponse(authorization);
+		const result = await this.service.activateRecovery(parsed.value, recoveryAuthorizationBinding(authorization.authorization), traceContext.value);
+		if (!result.ok) return routeFailureResponse(result);
+		return json(result.value, { status: result.status });
+	}
+};
+function createRouterAbEd25519YaoRecoveryModule(input) {
+	return createRouterApiModule({
+		id: "router_ab_ed25519_yao_recovery",
+		routeExtensions: [new RouterAbEd25519YaoRecoveryRouteExtension(input.service, input.capabilities ?? input.service, input.authorization, input.linkedAuthorities ?? null)]
+	});
+}
+//#endregion
+export { InMemoryRouterAbEd25519YaoRecoveryService, InMemoryRouterAbEd25519YaoRecoveryStateV1, buildRouterAbEd25519YaoRegistrationCapabilityRecordV1, buildWarmRecoveryBootstrapResponse, createRouterAbEd25519YaoRecoveryModule, recoveryAuthorityProjection, recoveryAuthorizationBinding, warmBootstrapCapabilityMatchesStableIdentity };
+
+//# sourceMappingURL=routerAbEd25519YaoRecovery.js.map