@seams/wallet-server 0.5.0

package/dist/esm/router/domains/walletRegistration/walletRegistrationRoutes.js

@@ -0,0 +1,2199 @@
+import { parseWalletAuthMethodId, parseWalletId, parseWebAuthnRpId } from "../../../shared-ts/src/utils/domainIds.js";
+import { EVM_ECDSA_MPC_OPERATION_KINDS, NEAR_ED25519_MPC_OPERATION_KINDS, parseWalletSessionId } from "../../../shared-ts/src/authorization/capabilityKinds.js";
+import { base64UrlDecode } from "../../../shared-ts/src/utils/base64.js";
+import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { base58Encode } from "../../../shared-ts/src/utils/base58.js";
+import "../../../shared-ts/src/utils/encoders.js";
+import { deriveImplicitNearAccountIdFromEd25519PublicKey, parseImplicitNearAccountId } from "../../../shared-ts/src/utils/near.js";
+import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, computeAddAuthMethodIntentDigestB64u, computeAddSignerIntentDigestB64u, normalizeAddAuthMethodInput, normalizeAddAuthMethodIntentCaller, normalizeEmailOtpRegistrationProof, normalizeRegistrationAuthMethodInput, normalizeRegistrationSignerPlan, registrationSignerSetSelectionFromPlan, walletIdFromString } from "../../../shared-ts/src/utils/registrationIntent.js";
+import { ecdsaClientRootPublicKey33B64uFromString } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
+import { isPlainObject } from "../../../shared-ts/src/utils/validation.js";
+import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
+import { parseRouterAbEcdsaRegistrationActivationRequestV1, parseRouterAbEcdsaRegistrationRequestV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { parseHostedWalletSessionOperationCredentialToken, parsePrimaryWalletSessionOperationCredentialToken, parseSessionOrigin } from "../../../authorization/domain.js";
+import { normalizeCorsOrigin } from "../../../core/SessionService.js";
+import { thresholdEcdsaChainTargetFromValue } from "../../../core/thresholdEcdsaChainTarget.js";
+import { parseRouterAbTraceContextV1 } from "../../../shared-ts/src/utils/routerAbTraceContext.js";
+import { extractBearerCredential, extractRouterApiEnvironmentId } from "../../auth/routerApiKeyAuth.js";
+import { resolvePublishableKeyApiCredentialAuth } from "../../auth/routerApiCredentialAuth.js";
+import { resolveActiveRuntimePolicyScopeForEnvironment, resolveWalletSessionAdministrationAdmission, resolveWalletSessionOperationCredentialAdmission, resolveWalletSessionOperationCredentialAdmissionFromContext } from "../../auth/commonRouterUtils.js";
+import { enforceRoutePolicy } from "../../framework/enforceRoutePolicy.js";
+import { routeError, routeJson } from "../../framework/routeResponses.js";
+import { parsePasskeyCustodyEnvelopeRecord } from "../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
+import "../../../shared-ts/src/passkey-custody/index.js";
+import { verifyWalletRegistrationSetupClaims } from "./walletRegistrationSetupPayload.js";
+import { computeWalletEcdsaKeyFactsInventoryChallengeDigestB64u } from "../../../shared-ts/src/utils/ecdsaKeyFactsInventory.js";
+//#region src/router/domains/walletRegistration/walletRegistrationRoutes.ts
+function parseRegistrationTraceContext(headers) {
+	const parsed = parseRouterAbTraceContextV1(headers["x-seams-trace-id"] ?? headers["X-Seams-Trace-Id"]);
+	if (parsed.ok) return {
+		ok: true,
+		value: parsed.value
+	};
+	if (parsed.reason === "missing") return {
+		ok: true,
+		value: null
+	};
+	return {
+		ok: false,
+		message: parsed.message
+	};
+}
+/** User-Agent of the registering request; feeds authenticator device labels. */
+function registrationUserAgentFromHeaders(headers) {
+	const raw = headers["user-agent"] ?? headers["User-Agent"];
+	const value = Array.isArray(raw) ? raw[0] : raw;
+	const trimmed = String(value || "").trim();
+	return trimmed ? trimmed : void 0;
+}
+function assertNeverWalletEcdsaInventoryAuth(value) {
+	throw new Error(`Unsupported wallet ECDSA inventory auth: ${String(value)}`);
+}
+function isEmailOtpWalletRegistrationActivateSuccessV2(result) {
+	return result.authMethod.kind === "email_otp";
+}
+function isPasskeyWalletRegistrationActivateSuccessV2(result) {
+	return result.authMethod.kind === "passkey";
+}
+function walletRegistrationRoutePolicyServices(input) {
+	const service = input.services.walletRegistration;
+	return {
+		walletRegistration: service,
+		walletAuthMethods: service,
+		thresholdRuntime: service,
+		webAuthn: service,
+		nearFunding: service
+	};
+}
+function parseFundImplicitNearAccountBody(body, walletId) {
+	if (!isPlainObject(body)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "JSON body required"
+	};
+	const nearAccountId = String(body.nearAccountId || "").trim();
+	const nearPublicKeyStr = String(body.nearPublicKeyStr || "").trim();
+	if (!walletId) return {
+		ok: false,
+		code: "invalid_body",
+		message: "walletId is required"
+	};
+	if (!nearAccountId) return {
+		ok: false,
+		code: "invalid_body",
+		message: "nearAccountId is required"
+	};
+	if (!nearPublicKeyStr) return {
+		ok: false,
+		code: "invalid_body",
+		message: "nearPublicKeyStr is required"
+	};
+	const parsedNearAccountId = parseImplicitNearAccountId(nearAccountId);
+	if (!parsedNearAccountId.ok) return {
+		ok: false,
+		code: "invalid_body",
+		message: parsedNearAccountId.message
+	};
+	try {
+		if (deriveImplicitNearAccountIdFromEd25519PublicKey(nearPublicKeyStr) !== parsedNearAccountId.value) return {
+			ok: false,
+			code: "invalid_body",
+			message: "nearAccountId does not match nearPublicKeyStr implicit account ID"
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			code: "invalid_body",
+			message: error && typeof error === "object" && "message" in error ? String(error.message || "Invalid nearPublicKeyStr") : "Invalid nearPublicKeyStr"
+		};
+	}
+	return {
+		ok: true,
+		value: {
+			walletId,
+			nearAccountId: parsedNearAccountId.value,
+			nearPublicKeyStr
+		}
+	};
+}
+function requireWebAuthnExpectedOrigin(input) {
+	const expectedOrigin = normalizeCorsOrigin(input.origin);
+	if (expectedOrigin) return {
+		ok: true,
+		expectedOrigin
+	};
+	return {
+		ok: false,
+		response: routeError(403, "forbidden", "Origin header is required and must be a valid exact origin")
+	};
+}
+function requireWebAuthnRpId(raw) {
+	const parsed = parseWebAuthnRpId(raw);
+	if (parsed.ok) return {
+		ok: true,
+		rpId: parsed.value
+	};
+	return {
+		ok: false,
+		response: routeError(400, "invalid_body", parsed.error.message)
+	};
+}
+const WALLET_REGISTRATION_ED25519_FINALIZE_FIELDS = ["activationReference"];
+const WALLET_REGISTRATION_YAO_ACTIVATION_REFERENCE_FIELDS = [
+	"kind",
+	"lifecycle_id",
+	"session_id"
+];
+const WALLET_REGISTRATION_ECDSA_FINALIZE_FIELDS = ["expectedKeyHandles"];
+function trimRequiredString(raw, field, message) {
+	const value = typeof raw[field] === "string" ? raw[field].trim() : "";
+	if (!value) return {
+		ok: false,
+		code: "invalid_body",
+		message
+	};
+	return {
+		ok: true,
+		value
+	};
+}
+function findUnknownField(raw, allowed) {
+	return Object.keys(raw).find((field) => !allowed.includes(field));
+}
+function parseChainTargets(raw) {
+	if (!Array.isArray(raw) || raw.length === 0) return {
+		ok: false,
+		code: "invalid_body",
+		message: "auth.policy.chainTargets must contain at least one chain target"
+	};
+	const targets = [];
+	for (const value of raw) {
+		const target = thresholdEcdsaChainTargetFromValue(value);
+		if (!target) return {
+			ok: false,
+			code: "invalid_body",
+			message: "auth.policy.chainTargets contains an invalid chain target"
+		};
+		targets.push(target);
+	}
+	return {
+		ok: true,
+		value: targets
+	};
+}
+function parseParticipantIds(raw, field) {
+	if (!Array.isArray(raw) || raw.length === 0) return {
+		ok: false,
+		code: "invalid_body",
+		message: `${field} must contain participant ids`
+	};
+	const participantIds = raw.map((value) => Math.floor(Number(value)));
+	if (participantIds.some((value) => !Number.isFinite(value) || value < 1)) return {
+		ok: false,
+		code: "invalid_body",
+		message: `${field} contains an invalid participant id`
+	};
+	return {
+		ok: true,
+		value: Array.from(new Set(participantIds)).sort((a, b) => a - b)
+	};
+}
+function parseAddSignerSelection(raw) {
+	if (!isPlainObject(raw)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "add-signer signerSelection is required"
+	};
+	if (raw.mode === "ecdsa") {
+		const ecdsa = isPlainObject(raw.ecdsa) ? raw.ecdsa : null;
+		if (!ecdsa) return {
+			ok: false,
+			code: "invalid_body",
+			message: "add-signer ECDSA spec is required"
+		};
+		const chainTargets = parseChainTargets(ecdsa.chainTargets);
+		if (!chainTargets.ok) return {
+			ok: false,
+			code: "invalid_body",
+			message: "add-signer ECDSA chainTargets are invalid"
+		};
+		const participantIds = parseParticipantIds(ecdsa.participantIds, "add-signer ECDSA participantIds");
+		if (!participantIds.ok) return participantIds;
+		return {
+			ok: true,
+			value: {
+				mode: "ecdsa",
+				ecdsa: {
+					chainTargets: chainTargets.value,
+					participantIds: participantIds.value
+				}
+			}
+		};
+	}
+	if (raw.mode === "ed25519") {
+		const ed25519 = isPlainObject(raw.ed25519) ? raw.ed25519 : null;
+		if (!ed25519) return {
+			ok: false,
+			code: "invalid_body",
+			message: "add-signer Ed25519 spec is required"
+		};
+		const mode = typeof ed25519.mode === "string" ? ed25519.mode.trim() : "";
+		const signerSlot = Math.floor(Number(ed25519.signerSlot));
+		const keyPurpose = typeof ed25519.keyPurpose === "string" ? ed25519.keyPurpose.trim() : "";
+		const keyVersion = typeof ed25519.keyVersion === "string" ? ed25519.keyVersion.trim() : "";
+		const derivationVersion = Math.floor(Number(ed25519.derivationVersion));
+		const participantIds = parseParticipantIds(ed25519.participantIds, "add-signer Ed25519 participantIds");
+		if (!participantIds.ok) return participantIds;
+		if (!Number.isFinite(signerSlot) || signerSlot < 1 || !keyPurpose || !keyVersion || !Number.isFinite(derivationVersion) || derivationVersion < 1) return {
+			ok: false,
+			code: "invalid_body",
+			message: "add-signer Ed25519 spec is invalid"
+		};
+		if (mode === "create_implicit_near_account") return {
+			ok: true,
+			value: {
+				mode: "ed25519",
+				ed25519: {
+					mode: "create_implicit_near_account",
+					signerSlot,
+					participantIds: participantIds.value,
+					keyPurpose,
+					keyVersion,
+					derivationVersion
+				}
+			}
+		};
+	}
+	return {
+		ok: false,
+		code: "invalid_body",
+		message: "add-signer signerSelection mode is unsupported"
+	};
+}
+function parseRegistrationSignerSet(raw) {
+	const signerPlan = normalizeRegistrationSignerPlan(raw);
+	if (!signerPlan.ok) return {
+		ok: false,
+		code: "invalid_body",
+		message: signerPlan.message
+	};
+	const signerSelection = registrationSignerSetSelectionFromPlan(signerPlan.value, { normalizeEcdsaChainTarget: thresholdEcdsaChainTargetFromValue });
+	if (!signerSelection.ok) return {
+		ok: false,
+		code: "invalid_body",
+		message: signerSelection.message
+	};
+	return {
+		ok: true,
+		value: {
+			selection: signerSelection.value,
+			plan: signerPlan.value
+		}
+	};
+}
+function parseWalletRegistrationSetupWallet(raw) {
+	if (!isPlainObject(raw)) return {
+		ok: true,
+		value: void 0
+	};
+	if (raw.kind === "server_allocated") return {
+		ok: true,
+		value: { kind: "server_allocated" }
+	};
+	if (raw.kind !== "provided") return {
+		ok: false,
+		code: "invalid_body",
+		message: "wallet.kind is unsupported"
+	};
+	const walletId = parseWalletId(raw.walletId);
+	if (!walletId.ok) return {
+		ok: false,
+		code: "invalid_body",
+		message: "walletId is required"
+	};
+	return {
+		ok: true,
+		value: {
+			kind: "provided",
+			walletId: walletId.value
+		}
+	};
+}
+function parseWalletRegistrationSetupRequest(body) {
+	const signerSelection = parseRegistrationSignerSet(body.signerSelection);
+	if (!signerSelection.ok) return signerSelection;
+	const authMethod = normalizeRegistrationAuthMethodInput(body.authMethod);
+	if (!authMethod) return {
+		ok: false,
+		code: "invalid_body",
+		message: "authMethod is required"
+	};
+	const wallet = parseWalletRegistrationSetupWallet(body.wallet);
+	if (!wallet.ok) return wallet;
+	return {
+		ok: true,
+		value: {
+			...wallet.value ? { wallet: wallet.value } : {},
+			signerSelection: signerSelection.value.selection,
+			authMethod
+		}
+	};
+}
+function parseCreateAddSignerIntentRequest(body, walletId) {
+	const signerSelection = parseAddSignerSelection(body.signerSelection);
+	if (!signerSelection.ok) return signerSelection;
+	return {
+		ok: true,
+		value: {
+			walletId: walletIdFromString(walletId),
+			signerSelection: signerSelection.value
+		}
+	};
+}
+function parseCreateAddAuthMethodIntentRequest(body, walletId) {
+	const authMethod = normalizeAddAuthMethodInput(body.authMethod);
+	if (!authMethod) return {
+		ok: false,
+		code: "invalid_body",
+		message: "authMethod is invalid"
+	};
+	const caller = normalizeAddAuthMethodIntentCaller(body);
+	if (!caller) return {
+		ok: false,
+		code: "invalid_body",
+		message: "add-auth-method caller is invalid"
+	};
+	return {
+		ok: true,
+		value: {
+			walletId: walletIdFromString(walletId),
+			authMethod,
+			caller
+		}
+	};
+}
+function parseInventoryKeyTargets(raw) {
+	if (!Array.isArray(raw) || raw.length === 0) return {
+		ok: false,
+		code: "invalid_body",
+		message: "keyTargets is required"
+	};
+	const targets = [];
+	for (const rawTarget of raw) {
+		if (!isPlainObject(rawTarget)) return {
+			ok: false,
+			code: "invalid_body",
+			message: "keyTargets contains an invalid target"
+		};
+		const keyHandle = typeof rawTarget.keyHandle === "string" ? rawTarget.keyHandle.trim() : "";
+		const chainTarget = thresholdEcdsaChainTargetFromValue(rawTarget.chainTarget);
+		if (!keyHandle || !chainTarget) return {
+			ok: false,
+			code: "invalid_body",
+			message: "keyTargets contains an invalid target"
+		};
+		targets.push({
+			keyHandle,
+			chainTarget
+		});
+	}
+	return {
+		ok: true,
+		value: targets
+	};
+}
+function parseWebAuthnAuthenticationCredential(raw) {
+	if (!isPlainObject(raw)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "auth.credential is required"
+	};
+	const response = isPlainObject(raw.response) ? raw.response : null;
+	if (typeof raw.id !== "string" || typeof raw.rawId !== "string" || typeof raw.type !== "string" || !response || typeof response.clientDataJSON !== "string" || typeof response.authenticatorData !== "string" || typeof response.signature !== "string") return {
+		ok: false,
+		code: "invalid_body",
+		message: "auth.credential is invalid"
+	};
+	return {
+		ok: true,
+		value: {
+			id: raw.id,
+			rawId: raw.rawId,
+			type: raw.type,
+			authenticatorAttachment: typeof raw.authenticatorAttachment === "string" ? raw.authenticatorAttachment : null,
+			response: {
+				clientDataJSON: response.clientDataJSON,
+				authenticatorData: response.authenticatorData,
+				signature: response.signature,
+				userHandle: typeof response.userHandle === "string" ? response.userHandle : null
+			},
+			clientExtensionResults: isPlainObject(raw.clientExtensionResults) ? raw.clientExtensionResults : null
+		}
+	};
+}
+function parseOptionalRuntimePolicyScope(raw) {
+	if (raw === void 0) return {
+		ok: true,
+		value: void 0
+	};
+	try {
+		return {
+			ok: true,
+			value: normalizeRuntimePolicyScope(raw)
+		};
+	} catch {
+		return {
+			ok: false,
+			code: "invalid_body",
+			message: "auth.runtimePolicyScope is invalid"
+		};
+	}
+}
+function parseWalletSessionCredentialReference(raw) {
+	if (Object.keys(raw).length !== 2 || raw.kind !== "opaque_wallet_session_operation_credential_v1" && raw.kind !== "opaque_hosted_wallet_session_operation_credential_v1") return {
+		ok: false,
+		code: "invalid_body",
+		message: "auth operation credential reference is invalid"
+	};
+	const walletSessionId = parseWalletSessionId(raw.walletSessionId);
+	if (!walletSessionId.ok) return {
+		ok: false,
+		code: "invalid_body",
+		message: "auth operation credential walletSessionId is invalid"
+	};
+	return {
+		ok: true,
+		value: {
+			kind: raw.kind,
+			walletSessionId: walletSessionId.value
+		}
+	};
+}
+async function parseWalletEcdsaInventoryBody(body, walletId) {
+	const rpId = trimRequiredString(body, "rpId", "rpId is required");
+	if (!rpId.ok) return rpId;
+	const keyTargets = parseInventoryKeyTargets(body.keyTargets);
+	if (!keyTargets.ok) return keyTargets;
+	const auth = isPlainObject(body.auth) ? body.auth : null;
+	if (!auth) return {
+		ok: false,
+		code: "invalid_body",
+		message: "auth is required"
+	};
+	if (auth.kind === "webauthn_assertion") {
+		const credential = parseWebAuthnAuthenticationCredential(auth.credential);
+		if (!credential.ok) return credential;
+		const expectedChallengeDigestB64u = typeof auth.expectedChallengeDigestB64u === "string" ? auth.expectedChallengeDigestB64u.trim() : "";
+		const serverNonceB64u = typeof auth.serverNonceB64u === "string" ? auth.serverNonceB64u.trim() : "";
+		if (!expectedChallengeDigestB64u || !serverNonceB64u) return {
+			ok: false,
+			code: "invalid_body",
+			message: "auth.expectedChallengeDigestB64u and auth.serverNonceB64u are required"
+		};
+		const runtimePolicyScope = parseOptionalRuntimePolicyScope(auth.runtimePolicyScope);
+		if (!runtimePolicyScope.ok) return runtimePolicyScope;
+		if (expectedChallengeDigestB64u !== await computeWalletEcdsaKeyFactsInventoryChallengeDigestB64u({
+			walletId,
+			rpId: rpId.value,
+			keyTargets: keyTargets.value,
+			...runtimePolicyScope.value ? { runtimePolicyScope: runtimePolicyScope.value } : {},
+			serverNonceB64u
+		})) return {
+			ok: false,
+			code: "invalid_body",
+			message: "auth.expectedChallengeDigestB64u mismatch"
+		};
+		return {
+			ok: true,
+			value: {
+				rpId: rpId.value,
+				auth: {
+					kind: "webauthn_assertion",
+					credential: credential.value,
+					expectedChallengeDigestB64u,
+					serverNonceB64u,
+					...runtimePolicyScope.value ? { runtimePolicyScope: runtimePolicyScope.value } : {}
+				},
+				keyTargets: keyTargets.value
+			}
+		};
+	}
+	if (auth.kind === "opaque_wallet_session_operation_credential_v1" || auth.kind === "opaque_hosted_wallet_session_operation_credential_v1") {
+		const operationCredential = parseWalletSessionCredentialReference(auth);
+		if (!operationCredential.ok) return operationCredential;
+		return {
+			ok: true,
+			value: {
+				rpId: rpId.value,
+				auth: operationCredential.value,
+				keyTargets: keyTargets.value
+			}
+		};
+	}
+	return {
+		ok: false,
+		code: "invalid_body",
+		message: "auth.kind is unsupported"
+	};
+}
+async function resolveRouteExactWalletSessionAdministration(input, walletId) {
+	const token = extractBearerCredential(input.headers);
+	if (!token) return null;
+	let primaryToken;
+	try {
+		primaryToken = parsePrimaryWalletSessionOperationCredentialToken(token);
+	} catch {
+		return null;
+	}
+	try {
+		const resolution = await resolveWalletSessionAdministrationAdmission({
+			authorizationSessions: input.services.authorizationSessions,
+			token: primaryToken,
+			nowMs: Date.now(),
+			operation: {
+				kind: "link_devices",
+				walletId
+			}
+		});
+		if (resolution.kind !== "admitted") return null;
+		return resolution.admission;
+	} catch {
+		return null;
+	}
+}
+const ECDSA_INVENTORY_SESSION_OPERATION = {
+	keyFamily: "ecdsa_secp256k1",
+	operationKind: EVM_ECDSA_MPC_OPERATION_KINDS.signTransaction
+};
+function hostedInventoryRequestOrigin(input) {
+	let requestOrigin;
+	try {
+		requestOrigin = parseSessionOrigin(input.origin);
+	} catch {
+		return null;
+	}
+	for (const candidate of input.hostedWalletOrigins) try {
+		if (parseSessionOrigin(candidate) === requestOrigin) return requestOrigin;
+	} catch {
+		continue;
+	}
+	return null;
+}
+function admittedEcdsaInventorySession(resolution) {
+	if (resolution.kind !== "admitted" || resolution.admission.curve !== "ecdsa") return null;
+	return resolution.admission;
+}
+async function resolveRouteEcdsaInventorySession(input, credentialReference) {
+	const token = extractBearerCredential(input.headers);
+	if (!token) return { kind: "unavailable" };
+	const nowMs = Date.now();
+	if (credentialReference.kind === "opaque_wallet_session_operation_credential_v1") {
+		let primaryToken;
+		try {
+			primaryToken = parsePrimaryWalletSessionOperationCredentialToken(token);
+		} catch {
+			return { kind: "unavailable" };
+		}
+		const resolution = await resolveWalletSessionOperationCredentialAdmission({
+			authorizationSessions: input.services.authorizationSessions,
+			token: primaryToken,
+			nowMs,
+			operation: ECDSA_INVENTORY_SESSION_OPERATION
+		});
+		if (resolution.kind !== "admitted" || resolution.admission.curve !== "ecdsa") return { kind: "unavailable" };
+		if (resolution.admission.context.authorization.session.walletSessionId !== credentialReference.walletSessionId) return { kind: "credential_mismatch" };
+		return {
+			kind: "admitted",
+			admission: resolution.admission
+		};
+	}
+	let hostedToken;
+	try {
+		hostedToken = parseHostedWalletSessionOperationCredentialToken(token);
+	} catch {
+		return { kind: "unavailable" };
+	}
+	const requestOrigin = hostedInventoryRequestOrigin(input);
+	if (!requestOrigin) return { kind: "hosted_origin_rejected" };
+	const context = await input.services.authorizationSessions.readHostedWalletSessionOperationCredentialV2({
+		tenantId: input.services.authorizationSessions.tenantId,
+		token: hostedToken,
+		requestOrigin,
+		nowMs
+	});
+	if (!context) return { kind: "unavailable" };
+	const admission = admittedEcdsaInventorySession(resolveWalletSessionOperationCredentialAdmissionFromContext({
+		context,
+		nowMs,
+		operation: ECDSA_INVENTORY_SESSION_OPERATION
+	}));
+	if (admission) {
+		if (admission.context.authorization.session.walletSessionId !== credentialReference.walletSessionId) return { kind: "credential_mismatch" };
+		return {
+			kind: "admitted",
+			admission
+		};
+	}
+	return { kind: "unavailable" };
+}
+async function resolveRouteNearFundingWalletSession(input) {
+	const token = extractBearerCredential(input.headers);
+	if (!token) return null;
+	const v2 = await resolveWalletSessionOperationCredentialAdmission({
+		authorizationSessions: input.services.authorizationSessions,
+		token,
+		nowMs: Date.now(),
+		operation: {
+			keyFamily: "ed25519",
+			operationKind: NEAR_ED25519_MPC_OPERATION_KINDS.signTransaction
+		}
+	});
+	if (v2.kind === "admitted" && v2.admission.curve === "ed25519") {
+		const signer = v2.admission.admission.signer;
+		const nearAccountId = deriveImplicitNearAccountIdFromEd25519PublicKey(`ed25519:${base58Encode(base64UrlDecode(signer.registeredPublicKeyB64u))}`);
+		return {
+			kind: "owner",
+			walletId: String(v2.admission.context.authorization.session.walletId),
+			nearAccountId
+		};
+	}
+	return null;
+}
+async function parseWalletAddSignerStartBody(body, walletId) {
+	const intent = isPlainObject(body.intent) ? body.intent : null;
+	if (!intent || intent.version !== "add_signer_intent_v1") return {
+		ok: false,
+		code: "invalid_body",
+		message: "add-signer intent is required"
+	};
+	const rawAddSignerIntentGrant = typeof body.addSignerIntentGrant === "string" ? body.addSignerIntentGrant.trim() : "";
+	if (!rawAddSignerIntentGrant) return {
+		ok: false,
+		code: "invalid_body",
+		message: "add-signer intent grant is required"
+	};
+	const addSignerIntentGrant = addSignerIntentGrantFromString(rawAddSignerIntentGrant);
+	if (String(intent.walletId || "").trim() !== walletId) return {
+		ok: false,
+		code: "invalid_body",
+		message: "add-signer walletId mismatch"
+	};
+	const signerSelection = parseAddSignerSelection(intent.signerSelection);
+	if (!signerSelection.ok) return signerSelection;
+	const nonceB64u = typeof intent.nonceB64u === "string" ? intent.nonceB64u.trim() : "";
+	if (!nonceB64u) return {
+		ok: false,
+		code: "invalid_body",
+		message: "add-signer intent is incomplete"
+	};
+	const runtimePolicyScope = parseOptionalRuntimePolicyScope(intent.runtimePolicyScope);
+	if (!runtimePolicyScope.ok) return runtimePolicyScope;
+	const normalizedIntent = {
+		version: "add_signer_intent_v1",
+		walletId: walletIdFromString(walletId),
+		signerSelection: signerSelection.value,
+		...runtimePolicyScope.value ? { runtimePolicyScope: runtimePolicyScope.value } : {},
+		nonceB64u
+	};
+	const expectedDigest = typeof body.addSignerIntentDigestB64u === "string" ? body.addSignerIntentDigestB64u.trim() : "";
+	const computedDigest = await computeAddSignerIntentDigestB64u(normalizedIntent);
+	if (!expectedDigest || expectedDigest !== computedDigest) return {
+		ok: false,
+		code: "invalid_body",
+		message: "add-signer intent digest mismatch"
+	};
+	const auth = isPlainObject(body.auth) ? body.auth : null;
+	if (!auth) return {
+		ok: false,
+		code: "invalid_body",
+		message: "add-signer auth is required"
+	};
+	if (auth.kind === "webauthn_assertion") {
+		const authRpId = parseWebAuthnRpId(auth.rpId);
+		if (!authRpId.ok) return {
+			ok: false,
+			code: "invalid_body",
+			message: authRpId.error.message
+		};
+		const credential = parseWebAuthnAuthenticationCredential(auth.credential);
+		if (!credential.ok) return credential;
+		const expectedChallengeDigestB64u = typeof auth.expectedChallengeDigestB64u === "string" ? auth.expectedChallengeDigestB64u.trim() : "";
+		if (expectedChallengeDigestB64u !== expectedDigest) return {
+			ok: false,
+			code: "invalid_body",
+			message: "auth.expectedChallengeDigestB64u must match add-signer intent digest"
+		};
+		return {
+			ok: true,
+			value: {
+				walletId: walletIdFromString(walletId),
+				addSignerIntentGrant,
+				addSignerIntentDigestB64u: expectedDigest,
+				intent: normalizedIntent,
+				auth: {
+					kind: "webauthn_assertion",
+					rpId: authRpId.value,
+					credential: credential.value,
+					expectedChallengeDigestB64u
+				}
+			}
+		};
+	}
+	return {
+		ok: false,
+		code: "invalid_body",
+		message: "add-signer auth.kind is unsupported"
+	};
+}
+async function parseWalletAddAuthMethodStartBody(body, walletId) {
+	const intent = isPlainObject(body.intent) ? body.intent : null;
+	if (!intent || intent.version !== "add_auth_method_intent_v1") return {
+		ok: false,
+		code: "invalid_body",
+		message: "add-auth-method intent is required"
+	};
+	const rawGrant = typeof body.addAuthMethodIntentGrant === "string" ? body.addAuthMethodIntentGrant.trim() : "";
+	if (!rawGrant) return {
+		ok: false,
+		code: "invalid_body",
+		message: "add-auth-method intent grant is required"
+	};
+	if (String(intent.walletId || "").trim() !== walletId) return {
+		ok: false,
+		code: "invalid_body",
+		message: "add-auth-method walletId mismatch"
+	};
+	const authMethod = normalizeAddAuthMethodInput(intent.authMethod);
+	if (!authMethod) return {
+		ok: false,
+		code: "invalid_body",
+		message: "add-auth-method authMethod is invalid"
+	};
+	const nonceB64u = typeof intent.nonceB64u === "string" ? intent.nonceB64u.trim() : "";
+	if (!nonceB64u) return {
+		ok: false,
+		code: "invalid_body",
+		message: "add-auth-method intent is incomplete"
+	};
+	const runtimePolicyScope = parseOptionalRuntimePolicyScope(intent.runtimePolicyScope);
+	if (!runtimePolicyScope.ok) return runtimePolicyScope;
+	const targetWalletAuthMethodId = parseWalletAuthMethodId(intent.targetWalletAuthMethodId);
+	if (!targetWalletAuthMethodId.ok) return {
+		ok: false,
+		code: "invalid_body",
+		message: "add-auth-method intent target method id is invalid"
+	};
+	const intentCaller = normalizeAddAuthMethodIntentCaller(intent);
+	if (!intentCaller) return {
+		ok: false,
+		code: "invalid_body",
+		message: "add-auth-method caller is invalid"
+	};
+	const intentCommon = {
+		version: "add_auth_method_intent_v1",
+		walletId: walletIdFromString(walletId),
+		authMethod,
+		targetWalletAuthMethodId: targetWalletAuthMethodId.value,
+		...runtimePolicyScope.value ? { runtimePolicyScope: runtimePolicyScope.value } : {},
+		nonceB64u
+	};
+	const normalizedIntent = intentCaller.caller === "same_device_addition" ? {
+		...intentCommon,
+		caller: "same_device_addition",
+		source: intentCaller.source
+	} : {
+		...intentCommon,
+		caller: "linked_device_ceremony"
+	};
+	const expectedDigest = typeof body.addAuthMethodIntentDigestB64u === "string" ? body.addAuthMethodIntentDigestB64u.trim() : "";
+	const computedDigest = await computeAddAuthMethodIntentDigestB64u(normalizedIntent);
+	if (!expectedDigest || expectedDigest !== computedDigest) return {
+		ok: false,
+		code: "invalid_body",
+		message: "add-auth-method intent digest mismatch"
+	};
+	const auth = isPlainObject(body.auth) ? body.auth : null;
+	if (!auth) return {
+		ok: false,
+		code: "invalid_body",
+		message: "add-auth-method auth is required"
+	};
+	let existingAuth;
+	if (auth.kind === "webauthn_assertion") {
+		const authRpId = parseWebAuthnRpId(auth.rpId);
+		if (!authRpId.ok) return {
+			ok: false,
+			code: "invalid_body",
+			message: authRpId.error.message
+		};
+		const credential = parseWebAuthnAuthenticationCredential(auth.credential);
+		if (!credential.ok) return credential;
+		const expectedChallengeDigestB64u = typeof auth.expectedChallengeDigestB64u === "string" ? auth.expectedChallengeDigestB64u.trim() : "";
+		if (expectedChallengeDigestB64u !== expectedDigest) return {
+			ok: false,
+			code: "invalid_body",
+			message: "auth.expectedChallengeDigestB64u must match add-auth-method intent digest"
+		};
+		existingAuth = {
+			kind: "webauthn_assertion",
+			rpId: authRpId.value,
+			credential: credential.value,
+			expectedChallengeDigestB64u
+		};
+	} else if (auth.kind === "email_otp") {
+		const emailChallengeId = typeof auth.challengeId === "string" ? auth.challengeId.trim() : "";
+		const emailOtpCode = typeof auth.otpCode === "string" ? auth.otpCode.trim() : "";
+		const emailExpectedDigest = typeof auth.expectedChallengeDigestB64u === "string" ? auth.expectedChallengeDigestB64u.trim() : "";
+		if (!emailChallengeId || !emailOtpCode) return {
+			ok: false,
+			code: "invalid_body",
+			message: "email_otp auth requires a challenge and a one-time code"
+		};
+		if (emailExpectedDigest !== expectedDigest) return {
+			ok: false,
+			code: "invalid_body",
+			message: "auth.expectedChallengeDigestB64u must match add-auth-method intent digest"
+		};
+		existingAuth = {
+			kind: "email_otp_source_proof",
+			challengeId: emailChallengeId,
+			otpCode: emailOtpCode,
+			expectedChallengeDigestB64u: emailExpectedDigest
+		};
+	} else if (auth.kind === "wallet_session") {
+		if (Object.keys(auth).length !== 1) return {
+			ok: false,
+			code: "invalid_body",
+			message: "wallet_session auth carries no body facts"
+		};
+		existingAuth = { kind: "wallet_session" };
+	} else return {
+		ok: false,
+		code: "invalid_body",
+		message: "add-auth-method auth.kind is unsupported"
+	};
+	let authority;
+	if (normalizedIntent.authMethod.kind === "passkey") {
+		if (Object.prototype.hasOwnProperty.call(body, "webauthnRegistration")) return {
+			ok: false,
+			code: "invalid_body",
+			message: "webauthnRegistration belongs on add-auth-method finalize"
+		};
+		authority = { kind: "passkey" };
+	} else if (Object.prototype.hasOwnProperty.call(body, "emailOtpRegistrationProof")) {
+		const proof = normalizeEmailOtpRegistrationProof(body.emailOtpRegistrationProof);
+		if (!proof) return {
+			ok: false,
+			code: "invalid_body",
+			message: "emailOtpRegistrationProof is invalid"
+		};
+		authority = {
+			kind: "email_otp",
+			emailOtpRegistrationProof: proof
+		};
+	} else return {
+		ok: false,
+		code: "invalid_body",
+		message: "new auth-method authority is required"
+	};
+	if (authority.kind !== normalizedIntent.authMethod.kind) return {
+		ok: false,
+		code: "invalid_body",
+		message: "new auth-method authority kind must match the requested auth-method kind"
+	};
+	return {
+		ok: true,
+		value: {
+			walletId: walletIdFromString(walletId),
+			addAuthMethodIntentGrant: addAuthMethodIntentGrantFromString(rawGrant),
+			addAuthMethodIntentDigestB64u: expectedDigest,
+			intent: normalizedIntent,
+			auth: existingAuth,
+			authority
+		}
+	};
+}
+function parseActivationRequestDigest(value) {
+	if (!isPlainObject(value) || !Array.isArray(value.bytes) || value.bytes.length !== 32) return null;
+	const bytes = [];
+	for (const entry of value.bytes) {
+		if (!Number.isInteger(entry) || Number(entry) < 0 || Number(entry) > 255) return null;
+		bytes.push(Number(entry));
+	}
+	return { bytes };
+}
+function parseYaoSessionId(value) {
+	if (!Array.isArray(value) || value.length !== 32) return {
+		ok: false,
+		code: "invalid_body",
+		message: "ed25519.activationReference.session_id must contain 32 bytes"
+	};
+	const sessionId = [];
+	let nonzero = false;
+	for (const valueByte of value) {
+		if (typeof valueByte !== "number" || !Number.isInteger(valueByte) || valueByte < 0 || valueByte > 255) return {
+			ok: false,
+			code: "invalid_body",
+			message: "ed25519.activationReference.session_id contains an invalid byte"
+		};
+		if (valueByte !== 0) nonzero = true;
+		sessionId.push(valueByte);
+	}
+	if (!nonzero) return {
+		ok: false,
+		code: "invalid_body",
+		message: "ed25519.activationReference.session_id must be nonzero"
+	};
+	return {
+		ok: true,
+		value: sessionId
+	};
+}
+function parseYaoVisibleIdentifier(value, field) {
+	if (typeof value !== "string" || value.length === 0) return {
+		ok: false,
+		code: "invalid_body",
+		message: `${field} is required`
+	};
+	for (let index = 0; index < value.length; index += 1) {
+		const code = value.charCodeAt(index);
+		if (code < 33 || code > 126) return {
+			ok: false,
+			code: "invalid_body",
+			message: `${field} must contain visible ASCII bytes`
+		};
+	}
+	return {
+		ok: true,
+		value
+	};
+}
+function parseWalletRegistrationEd25519YaoActivationReference(raw) {
+	const activationReference = isPlainObject(raw) ? raw : null;
+	if (!activationReference) return {
+		ok: false,
+		code: "invalid_body",
+		message: "ed25519.activationReference is required"
+	};
+	const unknownField = findUnknownField(activationReference, WALLET_REGISTRATION_YAO_ACTIVATION_REFERENCE_FIELDS);
+	if (unknownField) return {
+		ok: false,
+		code: "invalid_body",
+		message: `ed25519.activationReference.${unknownField} is not supported`
+	};
+	if (activationReference.kind !== "router_ab_ed25519_yao_activation_reference_v1") return {
+		ok: false,
+		code: "invalid_body",
+		message: "ed25519.activationReference.kind must be router_ab_ed25519_yao_activation_reference_v1"
+	};
+	const lifecycleId = parseYaoVisibleIdentifier(activationReference.lifecycle_id, "ed25519.activationReference.lifecycle_id");
+	if (!lifecycleId.ok) return lifecycleId;
+	const sessionId = parseYaoSessionId(activationReference.session_id);
+	if (!sessionId.ok) return sessionId;
+	return {
+		ok: true,
+		value: {
+			kind: "router_ab_ed25519_yao_activation_reference_v1",
+			lifecycle_id: lifecycleId.value,
+			session_id: sessionId.value
+		}
+	};
+}
+function parseWalletRegistrationEd25519Finalize(raw) {
+	const ed25519 = isPlainObject(raw) ? raw : null;
+	if (!ed25519) return {
+		ok: false,
+		code: "invalid_body",
+		message: "ed25519 is required"
+	};
+	const unknownField = findUnknownField(ed25519, WALLET_REGISTRATION_ED25519_FINALIZE_FIELDS);
+	if (unknownField) return {
+		ok: false,
+		code: "invalid_body",
+		message: `ed25519.${unknownField} is not supported`
+	};
+	const activationReference = parseWalletRegistrationEd25519YaoActivationReference(ed25519.activationReference);
+	if (!activationReference.ok) return activationReference;
+	return {
+		ok: true,
+		value: { activationReference: activationReference.value }
+	};
+}
+function parseWalletRegistrationEcdsaFinalize(raw) {
+	const ecdsa = isPlainObject(raw) ? raw : null;
+	if (!ecdsa) return {
+		ok: false,
+		code: "invalid_body",
+		message: "ecdsa is required"
+	};
+	const unknownField = findUnknownField(ecdsa, WALLET_REGISTRATION_ECDSA_FINALIZE_FIELDS);
+	if (unknownField) return {
+		ok: false,
+		code: "invalid_body",
+		message: `ecdsa.${unknownField} is not supported`
+	};
+	if (!Array.isArray(ecdsa.expectedKeyHandles) || ecdsa.expectedKeyHandles.length !== 1) return {
+		ok: false,
+		code: "invalid_body",
+		message: "ecdsa.expectedKeyHandles must contain one family key handle"
+	};
+	const expectedKeyHandle = typeof ecdsa.expectedKeyHandles[0] === "string" ? ecdsa.expectedKeyHandles[0].trim() : "";
+	if (!expectedKeyHandle) return {
+		ok: false,
+		code: "invalid_body",
+		message: "ecdsa.expectedKeyHandles contains an invalid family key handle"
+	};
+	return {
+		ok: true,
+		value: { expectedKeyHandles: [expectedKeyHandle] }
+	};
+}
+function parseWalletAddSignerCustodyKeySet(raw, kind) {
+	const custodyKeySet = isPlainObject(raw) ? raw : null;
+	if (!custodyKeySet) return {
+		ok: false,
+		code: "invalid_body",
+		message: "custodyKeySet is required"
+	};
+	const expectedKind = kind === "near_ed25519" ? "near_ed25519_v1" : "evm_family_ecdsa_v1";
+	if (custodyKeySet.kind !== expectedKind) return {
+		ok: false,
+		code: "invalid_body",
+		message: `custodyKeySet.kind must be ${expectedKind}`
+	};
+	let keyManifestDigestB64u;
+	try {
+		keyManifestDigestB64u = parseDigestB64u(custodyKeySet.keyManifestDigestB64u);
+	} catch {
+		return {
+			ok: false,
+			code: "invalid_body",
+			message: "custodyKeySet.keyManifestDigestB64u is invalid"
+		};
+	}
+	if (kind === "near_ed25519") {
+		const registeredPublicKeyB64u = trimRequiredString(custodyKeySet, "registeredPublicKeyB64u", "custodyKeySet.registeredPublicKeyB64u is required");
+		if (!registeredPublicKeyB64u.ok) return registeredPublicKeyB64u;
+		return {
+			ok: true,
+			value: {
+				kind: "near_ed25519_v1",
+				keyManifestDigestB64u,
+				registeredPublicKeyB64u: registeredPublicKeyB64u.value
+			}
+		};
+	}
+	const clientRootPublicKeyRaw = trimRequiredString(custodyKeySet, "clientRootPublicKey33B64u", "custodyKeySet.clientRootPublicKey33B64u is required");
+	if (!clientRootPublicKeyRaw.ok) return clientRootPublicKeyRaw;
+	try {
+		return {
+			ok: true,
+			value: {
+				kind: "evm_family_ecdsa_v1",
+				keyManifestDigestB64u,
+				clientRootPublicKey33B64u: ecdsaClientRootPublicKey33B64uFromString(clientRootPublicKeyRaw.value)
+			}
+		};
+	} catch {
+		return {
+			ok: false,
+			code: "invalid_body",
+			message: "custodyKeySet.clientRootPublicKey33B64u is invalid"
+		};
+	}
+}
+function parseWalletAddSignerEcdsaDerivationRespondRequest(body) {
+	const unknownBodyField = findUnknownField(body, ["addSignerCeremonyId", "ecdsa"]);
+	if (unknownBodyField) return {
+		ok: false,
+		code: "invalid_body",
+		message: `add-signer ECDSA request field ${unknownBodyField} is unsupported`
+	};
+	const addSignerCeremonyId = trimRequiredString(body, "addSignerCeremonyId", "addSignerCeremonyId is required");
+	if (!addSignerCeremonyId.ok) return addSignerCeremonyId;
+	const ecdsa = isPlainObject(body.ecdsa) ? body.ecdsa : null;
+	if (!ecdsa || ecdsa.kind !== "router_ab_ecdsa_registration_v1") return {
+		ok: false,
+		code: "invalid_body",
+		message: "strict Router A/B ECDSA add-signer request is required"
+	};
+	const unknownEcdsaField = findUnknownField(ecdsa, [
+		"kind",
+		"strictRegistration",
+		"requestDigestB64u"
+	]);
+	if (unknownEcdsaField) return {
+		ok: false,
+		code: "invalid_body",
+		message: `add-signer ECDSA field ${unknownEcdsaField} is unsupported`
+	};
+	let strictRegistration;
+	try {
+		strictRegistration = parseRouterAbEcdsaRegistrationRequestV1(ecdsa.strictRegistration);
+	} catch {
+		return {
+			ok: false,
+			code: "invalid_body",
+			message: "strict Router A/B ECDSA add-signer request is invalid"
+		};
+	}
+	const requestDigestB64u = parseRegistrationRequestDigestB64u(ecdsa.requestDigestB64u);
+	if (!requestDigestB64u) return {
+		ok: false,
+		code: "invalid_body",
+		message: "ECDSA add-signer requestDigestB64u must contain 32 base64url bytes"
+	};
+	return {
+		ok: true,
+		value: {
+			addSignerCeremonyId: addSignerCeremonyId.value,
+			ecdsa: {
+				kind: "router_ab_ecdsa_registration_v1",
+				strictRegistration,
+				requestDigestB64u
+			}
+		}
+	};
+}
+function parseWalletAddSignerEcdsaActivationRequest(body) {
+	const unknownBodyField = findUnknownField(body, ["addSignerCeremonyId", "ecdsa"]);
+	if (unknownBodyField) return {
+		ok: false,
+		code: "invalid_body",
+		message: `add-signer ECDSA activation field ${unknownBodyField} is unsupported`
+	};
+	const addSignerCeremonyId = trimRequiredString(body, "addSignerCeremonyId", "addSignerCeremonyId is required");
+	if (!addSignerCeremonyId.ok) return addSignerCeremonyId;
+	const ecdsa = isPlainObject(body.ecdsa) ? body.ecdsa : null;
+	if (!ecdsa || ecdsa.kind !== "router_ab_ecdsa_registration_activation_v1") return {
+		ok: false,
+		code: "invalid_body",
+		message: "strict Router A/B ECDSA add-signer activation is required"
+	};
+	const unknownEcdsaField = findUnknownField(ecdsa, [
+		"kind",
+		"activationCorrelationId",
+		"publicFacts",
+		"expectedActivationRequestDigest"
+	]);
+	if (unknownEcdsaField) return {
+		ok: false,
+		code: "invalid_body",
+		message: `add-signer ECDSA activation field ${unknownEcdsaField} is unsupported`
+	};
+	try {
+		const parsed = parseRouterAbEcdsaRegistrationActivationRequestV1({
+			registrationCeremonyId: addSignerCeremonyId.value,
+			ecdsa: {
+				kind: ecdsa.kind,
+				activationCorrelationId: ecdsa.activationCorrelationId,
+				publicFacts: ecdsa.publicFacts
+			}
+		});
+		const expectedActivationRequestDigest = parseActivationRequestDigest(ecdsa.expectedActivationRequestDigest);
+		if (!expectedActivationRequestDigest) return {
+			ok: false,
+			code: "invalid_body",
+			message: "ECDSA activation request digest is invalid"
+		};
+		return {
+			ok: true,
+			value: {
+				addSignerCeremonyId: addSignerCeremonyId.value,
+				ecdsa: {
+					kind: "router_ab_ecdsa_registration_activation_v1",
+					activationCorrelationId: parsed.ecdsa.activationCorrelationId,
+					publicFacts: parsed.ecdsa.publicFacts,
+					expectedActivationRequestDigest
+				}
+			}
+		};
+	} catch {
+		return {
+			ok: false,
+			code: "invalid_body",
+			message: "strict Router A/B ECDSA add-signer activation facts are invalid"
+		};
+	}
+}
+function parseWalletAddSignerFinalizeRequest(body) {
+	const addSignerCeremonyId = trimRequiredString(body, "addSignerCeremonyId", "addSignerCeremonyId is required");
+	if (!addSignerCeremonyId.ok) return addSignerCeremonyId;
+	const idempotencyKey = trimRequiredString(body, "idempotencyKey", "idempotencyKey is required");
+	if (!idempotencyKey.ok) return idempotencyKey;
+	if (body.kind === "near_ed25519") {
+		if (Object.prototype.hasOwnProperty.call(body, "ecdsa")) return {
+			ok: false,
+			code: "invalid_body",
+			message: "Ed25519 finalize cannot carry ECDSA"
+		};
+		const ed25519 = parseWalletRegistrationEd25519Finalize(body.ed25519);
+		if (!ed25519.ok) return ed25519;
+		const custodyKeySet = parseWalletAddSignerCustodyKeySet(body.custodyKeySet, "near_ed25519");
+		if (!custodyKeySet.ok) return custodyKeySet;
+		return {
+			ok: true,
+			value: {
+				addSignerCeremonyId: addSignerCeremonyId.value,
+				idempotencyKey: idempotencyKey.value,
+				kind: "near_ed25519",
+				ed25519: ed25519.value,
+				custodyKeySet: custodyKeySet.value
+			}
+		};
+	}
+	if (body.kind === "evm_family_ecdsa") {
+		if (Object.prototype.hasOwnProperty.call(body, "ed25519")) return {
+			ok: false,
+			code: "invalid_body",
+			message: "ECDSA finalize cannot carry Ed25519"
+		};
+		const ecdsa = parseWalletRegistrationEcdsaFinalize(body.ecdsa);
+		if (!ecdsa.ok) return ecdsa;
+		const custodyKeySet = parseWalletAddSignerCustodyKeySet(body.custodyKeySet, "evm_family_ecdsa");
+		if (!custodyKeySet.ok) return custodyKeySet;
+		return {
+			ok: true,
+			value: {
+				addSignerCeremonyId: addSignerCeremonyId.value,
+				idempotencyKey: idempotencyKey.value,
+				kind: "evm_family_ecdsa",
+				ecdsa: ecdsa.value,
+				custodyKeySet: custodyKeySet.value
+			}
+		};
+	}
+	return {
+		ok: false,
+		code: "invalid_body",
+		message: "add-signer finalize kind is invalid"
+	};
+}
+/**
+* The caller's statement about the wallet's shared Email OTP enrollment.
+*
+* Required on this branch rather than optional. The two cases carry different
+* material and land on different persistence, and a body that simply omitted
+* the field would read as "reuse whatever is there" — which on a wallet with no
+* enrollment is not a reusable state, and on a wallet with one is a claim the
+* caller never made.
+*/
+function parseWalletAddAuthMethodEmailOtpTarget(raw) {
+	if (!isPlainObject(raw)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "emailOtpTarget is required for an Email OTP add-auth-method finalize"
+	};
+	if (raw.kind === "existing_enrollment") {
+		if (raw.enrollment !== void 0) return {
+			ok: false,
+			code: "invalid_body",
+			message: "emailOtpTarget.enrollment belongs to the new_enrollment branch"
+		};
+		return {
+			ok: true,
+			value: { kind: "existing_enrollment" }
+		};
+	}
+	if (raw.kind !== "new_enrollment") return {
+		ok: false,
+		code: "invalid_body",
+		message: "emailOtpTarget.kind must be existing_enrollment or new_enrollment"
+	};
+	const enrollment = raw.enrollment;
+	if (!isPlainObject(enrollment)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "emailOtpTarget.enrollment is required to create an enrollment"
+	};
+	const material = {
+		enrollmentSealKeyVersion: "",
+		clientUnlockPublicKeyB64u: "",
+		unlockKeyVersion: "",
+		serverSealedFactorCiphertextB64u: ""
+	};
+	for (const field of Object.keys(material)) {
+		const value = enrollment[field];
+		if (typeof value !== "string" || !value.trim()) return {
+			ok: false,
+			code: "invalid_body",
+			message: `emailOtpTarget.enrollment.${field} is required`
+		};
+		material[field] = value.trim();
+	}
+	return {
+		ok: true,
+		value: {
+			kind: "new_enrollment",
+			enrollment: material
+		}
+	};
+}
+function parseWalletAddAuthMethodFinalizeRequest(body) {
+	const addAuthMethodCeremonyId = trimRequiredString(body, "addAuthMethodCeremonyId", "addAuthMethodCeremonyId is required");
+	if (!addAuthMethodCeremonyId.ok) return addAuthMethodCeremonyId;
+	const hasRegistration = Object.prototype.hasOwnProperty.call(body, "webauthnRegistration");
+	const hasEnvelope = Object.prototype.hasOwnProperty.call(body, "custodyEnvelope");
+	if (hasRegistration && !hasEnvelope) return {
+		ok: false,
+		code: "invalid_body",
+		message: "a WebAuthn registration must be finalized with its custody envelope"
+	};
+	if (!hasRegistration && hasEnvelope) {
+		const emailOtpTarget = parseWalletAddAuthMethodEmailOtpTarget(body.emailOtpTarget);
+		if (!emailOtpTarget.ok) return emailOtpTarget;
+		try {
+			return {
+				ok: true,
+				value: {
+					addAuthMethodCeremonyId: addAuthMethodCeremonyId.value,
+					custodyEnvelope: parsePasskeyCustodyEnvelopeRecord(body.custodyEnvelope),
+					emailOtpTarget: emailOtpTarget.value
+				}
+			};
+		} catch {
+			return {
+				ok: false,
+				code: "invalid_body",
+				message: "custodyEnvelope is invalid"
+			};
+		}
+	}
+	if (hasRegistration) try {
+		return {
+			ok: true,
+			value: {
+				addAuthMethodCeremonyId: addAuthMethodCeremonyId.value,
+				webauthnRegistration: body.webauthnRegistration,
+				custodyEnvelope: parsePasskeyCustodyEnvelopeRecord(body.custodyEnvelope)
+			}
+		};
+	} catch {
+		return {
+			ok: false,
+			code: "invalid_body",
+			message: "custodyEnvelope is invalid"
+		};
+	}
+	return {
+		ok: true,
+		value: { addAuthMethodCeremonyId: addAuthMethodCeremonyId.value }
+	};
+}
+async function parseWalletRevokeAuthMethodRequest(body, walletId) {
+	const keys = Object.keys(body).sort();
+	if (keys.length !== 4 || keys[0] !== "requestedAtMs" || keys[1] !== "sourceProof" || keys[2] !== "walletAuthMethodId" || keys[3] !== "walletId") return {
+		ok: false,
+		code: "invalid_body",
+		message: "auth-method revoke body fields are invalid"
+	};
+	const requestedAtMs = Number(body.requestedAtMs);
+	if (!Number.isSafeInteger(requestedAtMs) || requestedAtMs < 0) return {
+		ok: false,
+		code: "invalid_body",
+		message: "requestedAtMs is invalid"
+	};
+	const bodyWalletId = typeof body.walletId === "string" ? body.walletId.trim() : "";
+	if (!bodyWalletId || bodyWalletId !== walletId) return {
+		ok: false,
+		code: "invalid_body",
+		message: "walletId path and body values must agree"
+	};
+	const walletAuthMethodId = parseWalletAuthMethodId(body.walletAuthMethodId);
+	if (!walletAuthMethodId.ok) return {
+		ok: false,
+		code: "invalid_body",
+		message: "walletAuthMethodId is invalid"
+	};
+	const sourceProof = parseWalletRevokeAuthMethodSourceProof(body.sourceProof);
+	if (!sourceProof.ok) return sourceProof;
+	return {
+		ok: true,
+		value: {
+			walletId: walletIdFromString(walletId),
+			walletAuthMethodId: walletAuthMethodId.value,
+			requestedAtMs,
+			sourceProof: sourceProof.value
+		}
+	};
+}
+function parseWalletRevokeAuthMethodSourceProof(raw) {
+	if (!isPlainObject(raw)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "sourceProof is required"
+	};
+	if (raw.kind === "webauthn_assertion") {
+		const rpId = parseWebAuthnRpId(raw.rpId);
+		if (!rpId.ok) return {
+			ok: false,
+			code: "invalid_body",
+			message: rpId.error.message
+		};
+		const credential = parseWebAuthnAuthenticationCredential(raw.credential);
+		if (!credential.ok) return credential;
+		const expectedChallengeDigestB64u = typeof raw.expectedChallengeDigestB64u === "string" ? raw.expectedChallengeDigestB64u.trim() : "";
+		if (!expectedChallengeDigestB64u) return {
+			ok: false,
+			code: "invalid_body",
+			message: "sourceProof.expectedChallengeDigestB64u is required"
+		};
+		if (!hasExactObjectKeys(raw, [
+			"credential",
+			"expectedChallengeDigestB64u",
+			"kind",
+			"rpId"
+		])) return {
+			ok: false,
+			code: "invalid_body",
+			message: "sourceProof fields are invalid"
+		};
+		return {
+			ok: true,
+			value: {
+				kind: "webauthn_assertion",
+				rpId: rpId.value,
+				credential: credential.value,
+				expectedChallengeDigestB64u
+			}
+		};
+	}
+	if (raw.kind === "email_otp") {
+		if (!hasExactObjectKeys(raw, [
+			"challengeId",
+			"kind",
+			"otpCode",
+			"ownerProofBindingDigest"
+		]) || typeof raw.challengeId !== "string" || typeof raw.otpCode !== "string" || typeof raw.ownerProofBindingDigest !== "string" || !raw.challengeId.trim() || !raw.otpCode.trim() || !raw.ownerProofBindingDigest.trim()) return {
+			ok: false,
+			code: "invalid_body",
+			message: "sourceProof fields are invalid"
+		};
+		return {
+			ok: true,
+			value: {
+				kind: "email_otp",
+				challengeId: raw.challengeId.trim(),
+				otpCode: raw.otpCode.trim(),
+				ownerProofBindingDigest: raw.ownerProofBindingDigest.trim()
+			}
+		};
+	}
+	return {
+		ok: false,
+		code: "invalid_body",
+		message: "sourceProof.kind is unsupported"
+	};
+}
+function hasExactObjectKeys(input, expected) {
+	const actual = Object.keys(input).sort();
+	const keys = [...expected].sort();
+	return actual.length === keys.length && actual.every((key, index) => key === keys[index]);
+}
+async function handleRouterApiWalletAddSignerIntent(input) {
+	if (!isPlainObject(input.body)) return routeError(400, "invalid_body", "JSON body required");
+	const walletId = String(input.pathParams?.walletId || "").trim();
+	if (!walletId) return routeError(400, "invalid_body", "walletId path parameter is required");
+	const request = parseCreateAddSignerIntentRequest(input.body, walletId);
+	if (!request.ok) return routeError(400, request.code, request.message);
+	const origin = normalizeCorsOrigin(input.origin);
+	if (!origin) return routeError(403, "forbidden", "Origin header is required and must be a valid exact origin");
+	const publishableKeyAuth = input.services.publishableKeyAuth;
+	if (!publishableKeyAuth) return routeError(500, "route_auth_not_configured", "wallet add-signer intent requires publishable key auth on this server");
+	const resolved = await enforceRoutePolicy({
+		headers: input.headers,
+		logger: input.logger,
+		request: {
+			body: input.body,
+			headers: input.headers
+		},
+		route: input.route,
+		services: walletRegistrationRoutePolicyServices(input),
+		sourceIp: input.sourceIp,
+		resolvers: { apiCredentials: async () => await resolvePublishableKeyApiCredentialAuth({
+			environmentId: extractRouterApiEnvironmentId(input.headers) || void 0,
+			headers: input.headers,
+			missingEnvironmentMessage: "Environment header is required for add-signer intent",
+			missingOriginMessage: "Origin header is required and must be a valid exact origin",
+			missingPublishableKeyMessage: "Missing publishable key",
+			origin,
+			publishableKeyAuth,
+			route: input.route,
+			routeAuthNotConfiguredMessage: "Add-signer intent requires API credential auth policy"
+		}) }
+	});
+	if (!resolved.ok) return routeJson(resolved.status, resolved.body);
+	if (resolved.context.principal.kind !== "api_credentials") return routeError(500, "internal", "wallet add-signer intent requires API credentials");
+	const principal = resolved.context.principal.principal;
+	const runtimePolicyScope = await resolveActiveRuntimePolicyScopeForEnvironment({
+		orgProjectEnv: input.services.orgProjectEnv || null,
+		orgId: principal.orgId,
+		environmentId: principal.environmentId,
+		projectId: principal.projectId,
+		envId: principal.envId
+	});
+	const result = await input.services.walletRegistration.createAddSignerIntent({
+		command: {
+			subject: {
+				kind: "wallet_signer_management",
+				walletId: request.value.walletId
+			},
+			signerSelection: request.value.signerSelection
+		},
+		orgId: principal.orgId,
+		...runtimePolicyScope ? { runtimePolicyScope } : {},
+		...runtimePolicyScope ? {
+			signingRootId: `${runtimePolicyScope.projectId}:${runtimePolicyScope.envId}`,
+			signingRootVersion: runtimePolicyScope.signingRootVersion
+		} : {},
+		expectedOrigin: origin
+	});
+	return routeJson(result.ok ? 200 : 400, result);
+}
+/**
+* Refactor 94C. `POST /wallets/register/setup` — the single admitted entry
+* point that replaces the bootstrap grant, the intent, and start.
+*
+* Authentication is the same API-credential plane the intent route used, so
+* origin and environment binding are unchanged; what is gone is the stored
+* grant that used to sit between the check and its only reader.
+*/
+async function handleRouterApiWalletRegistrationSetup(input) {
+	if (!isPlainObject(input.body)) return routeError(400, "invalid_body", "JSON body required");
+	const origin = normalizeCorsOrigin(input.origin);
+	if (!origin) return routeError(403, "forbidden", "Origin header is required and must be a valid exact origin");
+	const publishableKeyAuth = input.services.publishableKeyAuth;
+	if (!publishableKeyAuth) return routeError(500, "route_auth_not_configured", "wallet registration setup requires publishable key auth on this server");
+	const resolved = await enforceRoutePolicy({
+		headers: input.headers,
+		logger: input.logger,
+		request: {
+			body: input.body,
+			headers: input.headers
+		},
+		route: input.route,
+		services: walletRegistrationRoutePolicyServices(input),
+		sourceIp: input.sourceIp,
+		resolvers: { apiCredentials: async () => await resolvePublishableKeyApiCredentialAuth({
+			environmentId: extractRouterApiEnvironmentId(input.headers) || void 0,
+			headers: input.headers,
+			missingEnvironmentMessage: "Environment header is required for wallet registration setup",
+			missingOriginMessage: "Origin header is required and must be a valid exact origin",
+			missingPublishableKeyMessage: "Missing publishable key",
+			origin,
+			publishableKeyAuth,
+			route: input.route,
+			routeAuthNotConfiguredMessage: "Wallet registration setup requires API credential auth policy"
+		}) }
+	});
+	if (!resolved.ok) return routeJson(resolved.status, resolved.body);
+	if (resolved.context.principal.kind !== "api_credentials") return routeError(500, "internal", "wallet registration setup requires API credentials");
+	const principal = resolved.context.principal.principal;
+	const runtimePolicyScope = await resolveActiveRuntimePolicyScopeForEnvironment({
+		orgProjectEnv: input.services.orgProjectEnv || null,
+		orgId: principal.orgId,
+		environmentId: principal.environmentId,
+		projectId: principal.projectId,
+		envId: principal.envId
+	});
+	const session = input.services.session;
+	if (!session) return routeError(500, "internal", "wallet registration setup requires session signing");
+	const request = parseWalletRegistrationSetupRequest(input.body);
+	if (!request.ok) return routeError(400, request.code, request.message);
+	const result = await input.services.walletRegistration.setupWalletRegistration({
+		request: request.value,
+		orgId: principal.orgId,
+		expectedOrigin: origin,
+		signer: session,
+		...runtimePolicyScope ? { runtimePolicyScope } : {},
+		...runtimePolicyScope ? {
+			signingRootId: `${runtimePolicyScope.projectId}:${runtimePolicyScope.envId}`,
+			signingRootVersion: runtimePolicyScope.signingRootVersion
+		} : {}
+	});
+	return routeJson(result.ok ? 200 : 400, result);
+}
+/**
+* Refactor 94C. `POST /wallets/register/respond` — the authenticated leg.
+*
+* Bearing the proof, so it is a public-plane route authorized by the signed
+* setup payload plus the WebAuthn or Email OTP proof, exactly as the
+* derivation respond leg it replaces was.
+*/
+async function handleRouterApiWalletRegistrationRespond(input) {
+	const traceContext = parseRegistrationTraceContext(input.headers);
+	if (!traceContext.ok) return routeError(400, "invalid_trace_id", traceContext.message);
+	if (!isPlainObject(input.body)) return routeError(400, "invalid_body", "JSON body required");
+	const session = input.services.session;
+	if (!session) return routeError(500, "internal", "wallet registration respond requires session signing");
+	const parsed = parseWalletRegistrationRespondRequest(input.body);
+	if (!parsed.ok) return routeError(400, parsed.code, parsed.message);
+	const result = await input.services.walletRegistration.respondWalletRegistration({
+		...parsed.value,
+		verifier: session,
+		...registrationUserAgentFromHeaders(input.headers) ? { userAgent: registrationUserAgentFromHeaders(input.headers) } : {}
+	}, traceContext.value ?? void 0);
+	return routeJson(result.ok ? 200 : 400, result);
+}
+/**
+* Parses respond's public body. `signedSetup` stays an opaque string here —
+* the service verifies it; parsing its contents at the boundary would invite
+* trusting them before verification.
+*/
+function parseWalletRegistrationRespondRequest(body) {
+	if (!isPlainObject(body)) return {
+		ok: false,
+		code: "invalid_body",
+		message: "JSON body required"
+	};
+	const registrationCeremonyId = String(body.registrationCeremonyId || "").trim();
+	if (!registrationCeremonyId) return {
+		ok: false,
+		code: "invalid_body",
+		message: "registrationCeremonyId is required"
+	};
+	const signedSetup = String(body.signedSetup || "").trim();
+	if (!signedSetup) return {
+		ok: false,
+		code: "invalid_body",
+		message: "signedSetup is required"
+	};
+	const planKind = String(body.kind || "").trim();
+	if (planKind !== "evm_family_ecdsa" && planKind !== "near_ed25519_and_evm_family_ecdsa" && planKind !== "near_ed25519") return {
+		ok: false,
+		code: "invalid_body",
+		message: "kind must name the signer plan"
+	};
+	if (planKind === "near_ed25519" && body.ecdsa !== void 0) return {
+		ok: false,
+		code: "invalid_body",
+		message: "an Ed25519-only respond carries no ECDSA registration"
+	};
+	const hasWebAuthn = Object.prototype.hasOwnProperty.call(body, "webauthn_registration");
+	if (hasWebAuthn === Object.prototype.hasOwnProperty.call(body, "emailOtpRegistrationProof")) return {
+		ok: false,
+		code: "invalid_body",
+		message: "exactly one registration authority proof is required"
+	};
+	let authority;
+	if (hasWebAuthn) authority = {
+		kind: "passkey",
+		webauthnRegistration: body.webauthn_registration
+	};
+	else {
+		const proof = normalizeEmailOtpRegistrationProof(body.emailOtpRegistrationProof);
+		if (!proof) return {
+			ok: false,
+			code: "invalid_body",
+			message: "emailOtpRegistrationProof is invalid"
+		};
+		authority = {
+			kind: "email_otp",
+			emailOtpRegistrationProof: proof
+		};
+	}
+	if (planKind === "near_ed25519") return {
+		ok: true,
+		value: {
+			registrationCeremonyId,
+			signedSetup,
+			authority,
+			planKind
+		}
+	};
+	const ecdsa = isPlainObject(body.ecdsa) ? body.ecdsa : null;
+	if (!ecdsa || ecdsa.kind !== "router_ab_ecdsa_registration_v1") return {
+		ok: false,
+		code: "invalid_body",
+		message: "strict Router A/B ECDSA registration request is required"
+	};
+	let strictRegistration;
+	try {
+		strictRegistration = parseRouterAbEcdsaRegistrationRequestV1(ecdsa.strictRegistration);
+	} catch {
+		return {
+			ok: false,
+			code: "invalid_body",
+			message: "strict Router A/B ECDSA registration request is invalid"
+		};
+	}
+	const requestDigestB64u = parseRegistrationRequestDigestB64u(ecdsa.requestDigestB64u);
+	if (!requestDigestB64u) return {
+		ok: false,
+		code: "invalid_body",
+		message: "ECDSA registration requestDigestB64u must contain 32 base64url bytes"
+	};
+	return {
+		ok: true,
+		value: {
+			registrationCeremonyId,
+			signedSetup,
+			authority,
+			planKind,
+			ecdsa: {
+				kind: "router_ab_ecdsa_registration_v1",
+				strictRegistration,
+				requestDigestB64u
+			}
+		}
+	};
+}
+function parseRegistrationRequestDigestB64u(raw) {
+	const value = typeof raw === "string" ? raw.trim() : "";
+	if (!value || !/^[A-Za-z0-9_-]+$/u.test(value)) return null;
+	try {
+		return base64UrlDecode(value).byteLength === 32 ? value : null;
+	} catch {
+		return null;
+	}
+}
+async function projectActivatedWallet(input) {
+	const walletProjection = input.services.walletProjection || null;
+	if (!walletProjection) return null;
+	const verifier = input.services.session;
+	if (!verifier) return "wallet projection requires setup verification";
+	const verified = await verifyWalletRegistrationSetupClaims(verifier, input.signedSetup, {
+		registrationCeremonyId: input.registrationCeremonyId,
+		nowMs: Date.now()
+	});
+	if (!verified.ok) return verified.message;
+	if (verified.claims.policy.kind !== "runtime_policy_scope") return "wallet projection requires an exact runtime policy scope";
+	if (verified.claims.policy.scope.orgId !== verified.claims.orgId) return "wallet projection scope does not match its organization";
+	try {
+		await walletProjection.recordCreatedWallet({
+			orgId: verified.claims.orgId,
+			runtimePolicyScope: verified.claims.policy.scope,
+			walletId: verified.claims.walletId,
+			occurredAt: (/* @__PURE__ */ new Date()).toISOString()
+		});
+		return null;
+	} catch (error) {
+		return error instanceof Error ? error.message : String(error);
+	}
+}
+/**
+* Refactor 94C. `POST /wallets/register/activate` — activation and
+* finalization behind one Gateway operation row.
+*/
+async function handleRouterApiWalletRegistrationActivate(input) {
+	const traceContext = parseRegistrationTraceContext(input.headers);
+	if (!traceContext.ok) return routeError(400, "invalid_trace_id", traceContext.message);
+	if (!isPlainObject(input.body)) return routeError(400, "invalid_body", "JSON body required");
+	const session = input.services.session;
+	if (!session) return routeError(500, "internal", "wallet registration activate requires setup verification");
+	const body = input.body;
+	const registrationCeremonyId = String(body.registrationCeremonyId || "").trim();
+	if (!registrationCeremonyId) return routeError(400, "invalid_body", "registrationCeremonyId is required");
+	const signedSetup = String(body.signedSetup || "").trim();
+	if (!signedSetup) return routeError(400, "invalid_body", "signedSetup is required");
+	const idempotencyKey = String(body.idempotencyKey || "").trim();
+	if (!idempotencyKey) return routeError(400, "invalid_body", "idempotencyKey is required");
+	const planKind = String(body.kind || "").trim();
+	if (planKind !== "evm_family_ecdsa" && planKind !== "near_ed25519_and_evm_family_ecdsa" && planKind !== "near_ed25519") return routeError(400, "invalid_body", "kind must name the signer plan");
+	const ed25519Only = planKind === "near_ed25519";
+	if (ed25519Only && body.ecdsa !== void 0) return routeError(400, "invalid_body", "an Ed25519-only activate carries no ECDSA activation");
+	const ecdsa = isPlainObject(body.ecdsa) ? body.ecdsa : null;
+	const unknownEcdsaField = ecdsa ? findUnknownField(ecdsa, [
+		"activationCorrelationId",
+		"activationRequestDigestB64u",
+		"clientActivation"
+	]) : null;
+	if (unknownEcdsaField) return routeError(400, "invalid_body", `wallet registration ECDSA activation field ${unknownEcdsaField} is unsupported`);
+	if (!ed25519Only && (!ecdsa || typeof ecdsa.activationCorrelationId !== "string" || typeof ecdsa.activationRequestDigestB64u !== "string" || !isPlainObject(ecdsa.clientActivation))) return routeError(400, "invalid_body", "browser-verified clientActivation is required");
+	let parsedActivation;
+	if (ecdsa) try {
+		const parsed = parseRouterAbEcdsaRegistrationActivationRequestV1({
+			registrationCeremonyId,
+			ecdsa: {
+				kind: "router_ab_ecdsa_registration_activation_v1",
+				activationCorrelationId: ecdsa.activationCorrelationId,
+				publicFacts: ecdsa.clientActivation
+			}
+		});
+		parsedActivation = {
+			activationCorrelationId: parsed.ecdsa.activationCorrelationId,
+			activationRequestDigestB64u: parseDigestB64u(ecdsa.activationRequestDigestB64u),
+			clientActivation: parsed.ecdsa.publicFacts
+		};
+	} catch {
+		return routeError(400, "invalid_body", "ECDSA activation facts are invalid");
+	}
+	const result = await input.services.walletRegistration.activateWalletRegistration({
+		registrationCeremonyId,
+		signedSetup,
+		idempotencyKey,
+		planKind,
+		...parsedActivation ? { ecdsa: parsedActivation } : {},
+		...body.emailOtpEnrollment ? { emailOtpEnrollment: body.emailOtpEnrollment } : {},
+		...body.walletCustodyCommit !== void 0 ? { walletCustodyCommit: body.walletCustodyCommit } : {},
+		verifier: session
+	}, traceContext.value ?? void 0);
+	if (!result.ok) return routeJson(400, result);
+	if (!isEmailOtpWalletRegistrationActivateSuccessV2(result) && !isPasskeyWalletRegistrationActivateSuccessV2(result)) return routeError(500, "internal", "Wallet registration activation returned an invalid authority");
+	const projectionError = await projectActivatedWallet({
+		registrationCeremonyId,
+		services: input.services,
+		signedSetup
+	});
+	if (projectionError) return routeError(500, "internal", `Wallet was created but its Console projection failed: ${projectionError}`);
+	return routeJson(200, result);
+}
+/**
+* Refactor 94C. `POST /wallets/register/near-provisioning` — the non-blocking
+* completion the client calls after activate, once its already-running Yao
+* computation produces an activation.
+*/
+async function handleRouterApiWalletRegistrationNearProvisioning(input) {
+	if (!isPlainObject(input.body)) return routeError(400, "invalid_body", "JSON body required");
+	const session = input.services.session;
+	if (!session) return routeError(500, "internal", "NEAR provisioning requires setup verification");
+	const body = input.body;
+	const registrationCeremonyId = String(body.registrationCeremonyId || "").trim();
+	const signedSetup = String(body.signedSetup || "").trim();
+	const idempotencyKey = String(body.idempotencyKey || "").trim();
+	if (!registrationCeremonyId || !signedSetup || !idempotencyKey) return routeError(400, "invalid_body", "registrationCeremonyId, signedSetup and idempotencyKey are required");
+	const ed25519 = parseWalletRegistrationEd25519Finalize(body.ed25519);
+	if (!ed25519.ok) return routeError(400, ed25519.code, ed25519.message);
+	const result = await input.services.walletRegistration.completeWalletRegistrationNearProvisioning({
+		registrationCeremonyId,
+		signedSetup,
+		idempotencyKey,
+		ed25519: ed25519.value,
+		emailOtpEnrollment: body.emailOtpEnrollment,
+		...body.walletCustodyCommit !== void 0 ? { walletCustodyCommit: body.walletCustodyCommit } : {},
+		verifier: session
+	});
+	if (!result.ok) return routeJson(400, result);
+	return routeJson(200, result);
+}
+async function handleRouterApiWalletAddSignerStart(input) {
+	if (!isPlainObject(input.body)) return routeError(400, "invalid_body", "JSON body required");
+	const walletId = String(input.pathParams?.walletId || "").trim();
+	if (!walletId) return routeError(400, "invalid_body", "walletId is required");
+	const parsedBody = await parseWalletAddSignerStartBody(input.body, walletId);
+	if (!parsedBody.ok) return routeError(400, parsedBody.code, parsedBody.message);
+	if (parsedBody.value.auth.kind === "webauthn_assertion") {
+		const origin = requireWebAuthnExpectedOrigin(input);
+		if (!origin.ok) return origin.response;
+		const parsedRpId = requireWebAuthnRpId(parsedBody.value.auth.rpId);
+		if (!parsedRpId.ok) return parsedRpId.response;
+		const verified = await input.services.walletRegistration.verifyWebAuthnAuthenticationLite({
+			userId: walletId,
+			rpId: parsedRpId.rpId,
+			expectedChallenge: parsedBody.value.auth.expectedChallengeDigestB64u,
+			expected_origin: origin.expectedOrigin,
+			webauthn_authentication: parsedBody.value.auth.credential
+		});
+		if (!verified.success || !verified.verified) return routeError(401, "unauthorized", verified.message || "Invalid add-signer WebAuthn authorization");
+	}
+	const result = await input.services.walletRegistration.startWalletAddSigner(parsedBody.value);
+	return routeJson(result.ok ? 200 : 400, result);
+}
+async function handleRouterApiWalletAddSignerEcdsaDerivationRespond(input) {
+	if (!isPlainObject(input.body)) return routeError(400, "invalid_body", "JSON body required");
+	const request = parseWalletAddSignerEcdsaDerivationRespondRequest(input.body);
+	if (!request.ok) return routeError(400, request.code, request.message);
+	const result = await input.services.walletRegistration.respondWalletAddSignerEcdsaDerivation(request.value);
+	return routeJson(result.ok ? 200 : 400, result);
+}
+async function handleRouterApiWalletAddSignerEcdsaActivation(input) {
+	if (!isPlainObject(input.body)) return routeError(400, "invalid_body", "JSON body required");
+	const request = parseWalletAddSignerEcdsaActivationRequest(input.body);
+	if (!request.ok) return routeError(400, request.code, request.message);
+	const result = await input.services.walletRegistration.activateWalletAddSignerEcdsa(request.value);
+	if (!result.ok) return routeJson(400, result);
+	return routeJson(200, result);
+}
+async function handleRouterApiWalletAddSignerFinalize(input) {
+	if (!isPlainObject(input.body)) return routeError(400, "invalid_body", "JSON body required");
+	const request = parseWalletAddSignerFinalizeRequest(input.body);
+	if (!request.ok) return routeError(400, request.code, request.message);
+	const result = await input.services.walletRegistration.finalizeWalletAddSigner(request.value);
+	return routeJson(result.ok ? 200 : 400, result, { usage: result.ok ? { walletId: result.walletId } : void 0 });
+}
+async function handleRouterApiWalletAddAuthMethodIntent(input) {
+	if (!isPlainObject(input.body)) return routeError(400, "invalid_body", "JSON body required");
+	const walletId = String(input.pathParams?.walletId || "").trim();
+	if (!walletId) return routeError(400, "invalid_body", "walletId path parameter is required");
+	const request = parseCreateAddAuthMethodIntentRequest(input.body, walletId);
+	if (!request.ok) return routeError(400, request.code, request.message);
+	const origin = normalizeCorsOrigin(input.origin);
+	if (!origin) return routeError(403, "forbidden", "Origin header is required and must be a valid exact origin");
+	const publishableKeyAuth = input.services.publishableKeyAuth;
+	if (!publishableKeyAuth) return routeError(500, "route_auth_not_configured", "wallet add-auth-method intent requires publishable key auth on this server");
+	const resolved = await enforceRoutePolicy({
+		headers: input.headers,
+		logger: input.logger,
+		request: {
+			body: input.body,
+			headers: input.headers
+		},
+		route: input.route,
+		services: walletRegistrationRoutePolicyServices(input),
+		sourceIp: input.sourceIp,
+		resolvers: { apiCredentials: async () => await resolvePublishableKeyApiCredentialAuth({
+			environmentId: extractRouterApiEnvironmentId(input.headers) || void 0,
+			headers: input.headers,
+			missingEnvironmentMessage: "Environment header is required for add-auth-method intent",
+			missingOriginMessage: "Origin header is required and must be a valid exact origin",
+			missingPublishableKeyMessage: "Missing publishable key",
+			origin,
+			publishableKeyAuth,
+			route: input.route,
+			routeAuthNotConfiguredMessage: "Add-auth-method intent requires API credential auth policy"
+		}) }
+	});
+	if (!resolved.ok) return routeJson(resolved.status, resolved.body);
+	if (resolved.context.principal.kind !== "api_credentials") return routeError(500, "internal", "wallet add-auth-method intent requires API credentials");
+	const principal = resolved.context.principal.principal;
+	const runtimePolicyScope = await resolveActiveRuntimePolicyScopeForEnvironment({
+		orgProjectEnv: input.services.orgProjectEnv || null,
+		orgId: principal.orgId,
+		environmentId: principal.environmentId,
+		projectId: principal.projectId,
+		envId: principal.envId
+	});
+	const result = await input.services.walletRegistration.createAddAuthMethodIntent({
+		command: {
+			subject: {
+				kind: "wallet_auth_method_management",
+				walletId: request.value.walletId
+			},
+			authMethod: request.value.authMethod,
+			caller: request.value.caller
+		},
+		orgId: principal.orgId,
+		...runtimePolicyScope ? { runtimePolicyScope } : {},
+		...runtimePolicyScope ? {
+			signingRootId: `${runtimePolicyScope.projectId}:${runtimePolicyScope.envId}`,
+			signingRootVersion: runtimePolicyScope.signingRootVersion
+		} : {},
+		expectedOrigin: origin
+	});
+	return routeJson(result.ok ? 200 : 400, result);
+}
+/**
+* Sends the enrollment code for an Email OTP addition.
+*
+* The intent grant is the whole gate. The address is read from the intent the
+* grant names rather than taken from the body: a caller able to name the
+* recipient could send any wallet's enrollment code anywhere, and the grant is
+* the only evidence this addition was authorized at all.
+*/
+async function handleRouterApiWalletAddAuthMethodEmailOtpChallenge(input) {
+	if (!isPlainObject(input.body)) return routeError(400, "invalid_body", "JSON body required");
+	const walletId = parseWalletId(String(input.pathParams?.walletId || "").trim());
+	if (!walletId.ok) return routeError(400, "invalid_body", "walletId is required");
+	const grant = addAuthMethodIntentGrantFromString(String(input.body.addAuthMethodIntentGrant || "").trim());
+	const digestB64u = String(input.body.addAuthMethodIntentDigestB64u || "").trim();
+	if (!grant || !digestB64u) return routeError(400, "invalid_body", "addAuthMethodIntentGrant and addAuthMethodIntentDigestB64u are required");
+	const result = await input.services.walletRegistration.createAddAuthMethodEmailOtpChallenge({
+		walletId: walletId.value,
+		addAuthMethodIntentGrant: grant,
+		addAuthMethodIntentDigestB64u: digestB64u
+	});
+	if (!result.ok) {
+		if (result.code === "unauthorized") return routeError(401, "unauthorized", result.message);
+		if (result.code === "internal") return routeError(500, "internal", result.message);
+		return routeJson(400, {
+			ok: false,
+			code: result.code,
+			message: result.message
+		});
+	}
+	return routeJson(200, result);
+}
+async function handleRouterApiWalletAddAuthMethodStart(input) {
+	if (!isPlainObject(input.body)) return routeError(400, "invalid_body", "JSON body required");
+	const walletId = String(input.pathParams?.walletId || "").trim();
+	if (!walletId) return routeError(400, "invalid_body", "walletId is required");
+	const parsedBody = await parseWalletAddAuthMethodStartBody(input.body, walletId);
+	if (!parsedBody.ok) return routeError(400, parsedBody.code, parsedBody.message);
+	const parsedRequest = parsedBody.value;
+	let request;
+	if (parsedRequest.auth.kind === "webauthn_assertion") {
+		if (parsedRequest.intent.caller !== "same_device_addition") return routeError(401, "unauthorized", "Linked-device add-auth-method start requires the owner Wallet Session handoff");
+		const origin = requireWebAuthnExpectedOrigin(input);
+		if (!origin.ok) return origin.response;
+		const parsedRpId = requireWebAuthnRpId(parsedRequest.auth.rpId);
+		if (!parsedRpId.ok) return parsedRpId.response;
+		const verified = await input.services.walletRegistration.verifyWebAuthnAuthenticationLite({
+			userId: walletId,
+			rpId: parsedRpId.rpId,
+			expectedChallenge: parsedRequest.auth.expectedChallengeDigestB64u,
+			expected_origin: origin.expectedOrigin,
+			webauthn_authentication: parsedRequest.auth.credential
+		});
+		if (!verified.success || !verified.verified) return routeError(401, "unauthorized", verified.message || "Invalid add-auth-method WebAuthn authorization");
+		const auth = parsedRequest.auth;
+		request = {
+			...parsedRequest,
+			auth: {
+				kind: auth.kind,
+				rpId: auth.rpId,
+				credential: auth.credential,
+				expectedChallengeDigestB64u: auth.expectedChallengeDigestB64u
+			}
+		};
+	} else if (parsedRequest.auth.kind === "email_otp_source_proof") {
+		if (parsedRequest.intent.caller !== "same_device_addition") return routeError(401, "unauthorized", "Linked-device add-auth-method start requires the owner Wallet Session handoff");
+		const sourceProof = parsedRequest.auth;
+		const verified = await input.services.walletRegistration.verifyAddAuthMethodEmailOtpSourceProof({
+			walletId: walletIdFromString(walletId),
+			walletAuthMethodId: parsedRequest.intent.source.walletAuthMethodId,
+			challengeId: sourceProof.challengeId,
+			otpCode: sourceProof.otpCode,
+			expectedDigestB64u: sourceProof.expectedChallengeDigestB64u
+		});
+		if (!verified.ok) return routeError(verified.code === "invalid_state" ? 400 : 401, verified.code === "invalid_state" ? "invalid_body" : "unauthorized", verified.message);
+		request = {
+			...parsedRequest,
+			auth: verified.auth
+		};
+	} else if (parsedRequest.auth.kind === "wallet_session") {
+		if (parsedRequest.intent.caller !== "linked_device_ceremony") return routeError(401, "unauthorized", "Same-device add-auth-method requires a fresh source proof, not a Wallet Session");
+		const admission = await resolveRouteExactWalletSessionAdministration(input, parsedRequest.walletId);
+		if (!admission) return routeError(401, "unauthorized", "Add-auth-method requires an active owner Wallet Session");
+		const { authorization, authMethod } = admission.context;
+		const session = authorization.session;
+		if (String(session.walletId) !== walletId) return routeError(401, "unauthorized", "Owner Wallet Session names another wallet");
+		if (authMethod.kind !== "passkey") return routeError(401, "unauthorized", "Add-auth-method requires a passkey-owned owner Wallet Session");
+		request = {
+			...parsedRequest,
+			auth: {
+				kind: "wallet_session",
+				walletSessionId: session.walletSessionId,
+				authorizationId: session.authorizationId,
+				rpId: authMethod.rpId,
+				credentialIdB64u: authMethod.credentialIdB64u
+			}
+		};
+	} else return routeError(400, "invalid_body", "add-auth-method auth.kind is unsupported");
+	const result = await input.services.walletRegistration.startWalletAddAuthMethod({
+		...request,
+		subject: {
+			kind: "wallet_auth_method_management",
+			walletId: walletIdFromString(walletId)
+		}
+	}, { userAgent: registrationUserAgentFromHeaders(input.headers) });
+	return routeJson(result.ok ? 200 : 400, result);
+}
+async function handleRouterApiWalletAddAuthMethodFinalize(input) {
+	if (!isPlainObject(input.body)) return routeError(400, "invalid_body", "JSON body required");
+	const request = parseWalletAddAuthMethodFinalizeRequest(input.body);
+	if (!request.ok) return routeError(400, request.code, request.message);
+	const walletId = String(input.pathParams?.walletId || "").trim();
+	if (!walletId) return routeError(400, "invalid_body", "walletId is required");
+	const result = await input.services.walletRegistration.finalizeWalletAddAuthMethod({
+		...request.value,
+		subject: {
+			kind: "wallet_auth_method_management",
+			walletId: walletIdFromString(walletId)
+		},
+		authorization: { kind: "owner" }
+	});
+	return routeJson(result.ok ? 200 : 400, result, { usage: result.ok ? { walletId: result.walletId } : void 0 });
+}
+async function handleRouterApiWalletRevokeAuthMethod(input) {
+	if (!isPlainObject(input.body)) return routeError(400, "invalid_body", "JSON body required");
+	const walletId = String(input.pathParams?.walletId || "").trim();
+	if (!walletId) return routeError(400, "invalid_body", "walletId is required");
+	const parsedPathWalletAuthMethodId = parseWalletAuthMethodId(String(input.pathParams?.walletAuthMethodId || "").trim());
+	if (!parsedPathWalletAuthMethodId.ok) return routeError(400, "invalid_body", "walletAuthMethodId path parameter is invalid");
+	const parsedBody = await parseWalletRevokeAuthMethodRequest(input.body, walletId);
+	if (!parsedBody.ok) return routeError(400, parsedBody.code, parsedBody.message);
+	if (parsedPathWalletAuthMethodId.value !== parsedBody.value.walletAuthMethodId) return routeError(400, "invalid_body", "walletAuthMethodId path and body values must agree");
+	const origin = requireWebAuthnExpectedOrigin(input);
+	if (!origin.ok) return origin.response;
+	const verified = await input.services.walletRegistration.verifyWalletAuthMethodRevokeProof({
+		walletId: parsedBody.value.walletId,
+		targetWalletAuthMethodId: parsedBody.value.walletAuthMethodId,
+		requestedAtMs: parsedBody.value.requestedAtMs,
+		sourceProof: parsedBody.value.sourceProof,
+		expectedOrigin: origin.expectedOrigin
+	});
+	if (verified.kind === "denied") return routeError(401, "unauthorized", verified.message);
+	const result = await input.services.walletRegistration.revokeWalletAuthMethod({
+		...parsedBody.value,
+		subject: {
+			kind: "wallet_auth_method_management",
+			walletId: walletIdFromString(walletId)
+		},
+		verifiedSource: {
+			walletAuthMethodId: verified.walletAuthMethodId,
+			verifiedAtMs: verified.verifiedAtMs
+		}
+	});
+	return routeJson(result.ok ? 200 : 400, result, { usage: result.ok ? { walletId: result.walletId } : void 0 });
+}
+async function handleRouterApiWalletEcdsaKeyFactsInventory(input) {
+	if (!isPlainObject(input.body)) return routeError(400, "invalid_body", "JSON body required");
+	const walletId = String(input.pathParams?.walletId || "").trim();
+	if (!walletId) return routeError(400, "invalid_body", "walletId is required");
+	const parsedBody = await parseWalletEcdsaInventoryBody(input.body, walletId);
+	if (!parsedBody.ok) return routeError(400, parsedBody.code, parsedBody.message);
+	let inventoryWalletId = walletId;
+	switch (parsedBody.value.auth.kind) {
+		case "webauthn_assertion": {
+			const origin = requireWebAuthnExpectedOrigin(input);
+			if (!origin.ok) return origin.response;
+			const parsedRpId = requireWebAuthnRpId(parsedBody.value.rpId);
+			if (!parsedRpId.ok) return parsedRpId.response;
+			const verified = await input.services.walletRegistration.verifyWebAuthnAuthenticationLite({
+				userId: walletId,
+				rpId: parsedRpId.rpId,
+				expectedChallenge: parsedBody.value.auth.expectedChallengeDigestB64u,
+				expected_origin: origin.expectedOrigin,
+				webauthn_authentication: parsedBody.value.auth.credential
+			});
+			if (!verified.success || !verified.verified) return routeError(401, "unauthorized", verified.message || "Invalid ECDSA key-facts inventory WebAuthn authorization");
+			break;
+		}
+		case "opaque_wallet_session_operation_credential_v1":
+		case "opaque_hosted_wallet_session_operation_credential_v1": {
+			let resolution;
+			try {
+				resolution = await resolveRouteEcdsaInventorySession(input, parsedBody.value.auth);
+			} catch {
+				return routeError(503, "internal", "ECDSA Wallet Session is unavailable");
+			}
+			if (resolution.kind === "hosted_origin_rejected") return routeError(403, "forbidden", "Hosted Wallet Session origin is unavailable");
+			if (resolution.kind === "credential_mismatch") return routeError(403, "forbidden", "Wallet session credential does not match its bearer");
+			if (resolution.kind !== "admitted") return routeError(401, "unauthorized", "ECDSA Wallet Session is unavailable");
+			const admittedWalletId = resolution.admission.context.authorization.session.walletId;
+			if (admittedWalletId !== walletId) return routeError(403, "forbidden", "Wallet session does not match walletId");
+			inventoryWalletId = admittedWalletId;
+			break;
+		}
+		default: return assertNeverWalletEcdsaInventoryAuth(parsedBody.value.auth);
+	}
+	const keyInventory = await input.services.walletRegistration.listWalletEcdsaKeyFactsInventory({
+		walletId: inventoryWalletId,
+		rpId: parsedBody.value.rpId,
+		keyTargets: parsedBody.value.keyTargets
+	});
+	input.logger.info("[wallet][ecdsa-key-facts-inventory][diagnostic]", {
+		walletId: inventoryWalletId,
+		...keyInventory.diagnostics
+	});
+	return routeJson(200, {
+		ok: true,
+		ecdsaKeyIdentityTargets: keyInventory.records,
+		diagnostics: keyInventory.diagnostics
+	});
+}
+async function handleRouterApiWalletNearImplicitAccountFund(input) {
+	const walletId = String(input.pathParams?.walletId || "").trim();
+	const parsedBody = parseFundImplicitNearAccountBody(input.body, walletId);
+	if (!parsedBody.ok) return routeError(400, parsedBody.code, parsedBody.message);
+	const admission = await resolveRouteNearFundingWalletSession(input);
+	if (!admission) return routeError(401, "unauthorized", "Ed25519 Wallet Session is unavailable");
+	if (admission.walletId !== parsedBody.value.walletId) return routeError(403, "forbidden", "Wallet session does not match walletId");
+	if (admission.nearAccountId !== parsedBody.value.nearAccountId) return routeError(403, "forbidden", "Wallet session does not match nearAccountId");
+	const result = await input.services.walletRegistration.fundImplicitNearAccount(parsedBody.value);
+	return routeJson(result.ok ? 200 : 400, result, { usage: result.ok ? { walletId: result.walletId } : void 0 });
+}
+//#endregion
+export { handleRouterApiWalletAddAuthMethodEmailOtpChallenge, handleRouterApiWalletAddAuthMethodFinalize, handleRouterApiWalletAddAuthMethodIntent, handleRouterApiWalletAddAuthMethodStart, handleRouterApiWalletAddSignerEcdsaActivation, handleRouterApiWalletAddSignerEcdsaDerivationRespond, handleRouterApiWalletAddSignerFinalize, handleRouterApiWalletAddSignerIntent, handleRouterApiWalletAddSignerStart, handleRouterApiWalletEcdsaKeyFactsInventory, handleRouterApiWalletNearImplicitAccountFund, handleRouterApiWalletRegistrationActivate, handleRouterApiWalletRegistrationNearProvisioning, handleRouterApiWalletRegistrationRespond, handleRouterApiWalletRegistrationSetup, handleRouterApiWalletRevokeAuthMethod };
+
+//# sourceMappingURL=walletRegistrationRoutes.js.map