@seams/wallet-server 0.5.0

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationService.js

@@ -0,0 +1,3887 @@
+import { parseThresholdEd25519SessionId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletKeyId, parseWebAuthnCredentialIdB64u } from "../../../../shared-ts/src/utils/domainIds.js";
+import { parseDeviceId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { alphabetizeStringify, bytesToUnprefixedHex, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import "../../../../shared-ts/src/utils/encoders.js";
+import { parseEd25519PublicKeyB64u, parseSecp256k1CompressedPublicKeyB64u } from "../../../../shared-ts/src/passkey-custody/primitives.js";
+import { buildExactAdministeredSignerManifestV1 } from "../../../../shared-ts/src/device-linking/delegatedActivationPlan.js";
+import { buildFullOwnerPermissionsV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
+import { buildActiveCombinedWalletAuthorityV1, buildActiveWalletAuthorityV1, buildWalletSignerActivationSetV1, computeWalletAuthorityDigestB64u, computeWalletSignerActivationSetDigestB64u, isActiveEcdsaWalletAuthorityV1, isCombinedWalletSignerActivationSetV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
+import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
+import { buildWalletAuthMethodRecordV2, findRegistrationSignerPlanEvmFamilyEcdsaBranch, findRegistrationSignerPlanNearEd25519Branch, nearEd25519SigningKeyIdFromString, registrationEd25519AuthorityScopeFromAuthority, registrationIntentGrantFromString, registrationNearEd25519BranchKey, registrationSignerPlanFromSelection, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { deriveRouterAbEd25519YaoRuntimePolicyBindingV1, sameRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { ecdsaClientRootPublicKey33B64uFromString } from "../../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
+import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
+import "../../../../shared-ts/src/utils/validation.js";
+import { deriveSigningRootId, signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
+import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, walletAuthAuthoritiesMatch } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1, buildRouterAbEcdsaDerivationActiveStateIdV1, buildRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbEcdsaVerifiedClientActivationFactsV1, sameRouterAbPublicDigest32V1Wire } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
+import { ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
+import { normalizeThresholdEd25519ParticipantIds } from "../../../../shared-ts/src/threshold/participants.js";
+import { registrationPreparationIdFromString } from "../../../../core/types.js";
+import { buildTenantRootIdentityFromAuthenticatedDeploymentV1 } from "../../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
+import { walletCustodyCeremonyCommitPayloadFromWire } from "../../../../shared-ts/src/passkey-custody/ceremonyCommitPayload.js";
+import "../../../../shared-ts/src/passkey-custody/index.js";
+import { computeWalletRegistrationSetupDigestB64u, verifySignedWalletRegistrationSetup, verifyWalletRegistrationSetupClaims } from "../../../domains/walletRegistration/walletRegistrationSetupPayload.js";
+import { DEFAULT_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
+import { parseEcdsaDerivationPublicIdentity, thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
+import { walletAuthAuthorityFromRegistrationAuthority, walletRegistrationFinalizeAuthMethodFromAuthority } from "../wallet/d1WalletAuthMethodBoundary.js";
+import { buildRouterAbEd25519YaoRegistrationCapabilityRecordV1 } from "../../../domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.js";
+import { buildRouterAbEd25519YaoProductAdmissionRequestV1, createRouterAbEd25519YaoMaterialActivationRefV1, projectRouterAbEd25519YaoExactWalletSession } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js";
+import { runRouterAbEd25519YaoRegistrationSideEffectV2, throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
+import { buildYaoEd25519WalletSignerRecord, ed25519NearPublicKeyFromBytes, implicitNearAccountIdFromEd25519PublicKeyBytes } from "../ed25519Yao/d1Ed25519YaoWalletSigner.js";
+import { deriveThresholdEcdsaKeyHandle } from "../../../../shared-ts/src/utils/thresholdEcdsaKeyHandle.js";
+import { routerAbEcdsaStrictRegistrationFactsBindingJson, routerAbEcdsaStrictRegistrationRequestBindingJson } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
+import { buildStoredWalletRegistrationEvmFamilyEcdsaFinalizedBranch, buildStoredWalletRegistrationEvmFamilyEcdsaPreparedBranch, buildStoredWalletRegistrationNearEd25519YaoAuthorizedBranch, buildStoredWalletRegistrationPreparedContext, findStoredWalletRegistrationEvmFamilyEcdsaBranch, findStoredWalletRegistrationNearEd25519YaoBranch, replaceStoredWalletRegistrationSignerBranch, storedRegistrationAuthoritiesMatch, verifiedRegistrationCeremonyAuthority } from "../../../../core/RegistrationCeremonyStore.js";
+import { buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, buildD1WalletRecord, buildRegistrationIntent, createD1ServerAllocatedWalletId, inferRuntimePolicyScopeFromSigningRoot, normalizeThresholdEcdsaChainTargets, parseWalletIdForIntent, thresholdEcdsaChainTargetsEqual } from "./d1RegistrationCeremonyRecords.js";
+import { resolveTenantRootIdentityV1 } from "../../../domains/tenantRoot/tenantRootIdentityResolution.js";
+import { listThresholdEcdsaKeyIdentityTargetsForUser } from "../../../../core/authService/thresholdEcdsaKeyInventory.js";
+import { buildWalletRegistrationSetupSignature, normalizeWalletRegistrationSetupRequest, resolveWalletRegistrationSetupWalletId, storedRespondEd25519DeferredWork, walletRegistrationRespondResult, walletRegistrationSetupError, walletRegistrationSetupExpiresAtMs, walletRegistrationSetupIds, walletRegistrationSetupIntentDigest } from "./d1WalletRegistrationSetup.js";
+import { commitRegistrationCustody } from "../../../domains/passkeyCustody/registrationCustodyOutcome.js";
+import { buildD1EvmFamilyEcdsaRegistrationPrepare } from "./d1EvmFamilyEcdsaRegistrationBranch.js";
+import { projectWalletRegistrationSessionCommitReceiptV2, registrationReplayAuthMethodFields, replayedRegistrationCommit, unissuedRegistrationCommit } from "./walletRegistrationSessionCommitReceipt.js";
+import { assertDirectWalletSessionOwnerProof, buildRegistrationOwnerProof, issueDirectRegistrationEstablishedEcdsaSession, issueDirectRegistrationEstablishedEd25519Session, replayDirectRegistrationEstablishedEcdsaSession, replayDirectRegistrationEstablishedEd25519Session, walletSessionPrincipalId } from "./walletRegistrationEstablishedSessionIssuer.js";
+//#region src/router/cloudflare/d1/registration/d1WalletRegistrationService.ts
+function buildWalletRegistrationActivatePendingPasskeyResponse(input) {
+	return {
+		ok: true,
+		kind: "near_ed25519",
+		walletId: input.walletId,
+		authority: input.authority,
+		authMethod: input.authMethod,
+		rpId: input.rpId,
+		nearProvisioning: { status: "near_pending" }
+	};
+}
+function buildWalletRegistrationActivatePendingEmailOtpResponse(input) {
+	return {
+		ok: true,
+		kind: "near_ed25519",
+		walletId: input.walletId,
+		authority: input.authority,
+		authMethod: input.authMethod,
+		nearProvisioning: { status: "near_pending" }
+	};
+}
+function sameEd25519ParticipantIds(left, right) {
+	return left[0] === right[0] && left[1] === right[1];
+}
+function sameEcdsaParticipantIds(left, right) {
+	if (left.length !== right.length) return false;
+	for (let index = 0; index < left.length; index += 1) if (left[index] !== right[index]) return false;
+	return true;
+}
+function sameEcdsaDerivationPublicIdentity(left, right) {
+	return left.derivationClientSharePublicKey33B64u === right.derivationClientSharePublicKey33B64u && left.relayerPublicKey33B64u === right.relayerPublicKey33B64u && left.groupPublicKey33B64u === right.groupPublicKey33B64u && left.ethereumAddress === right.ethereumAddress;
+}
+function sameWalletRuntimePolicyScope(left, right) {
+	return left.orgId === right.orgId && left.projectId === right.projectId && left.envId === right.envId && left.signingRootVersion === right.signingRootVersion;
+}
+function sameRouterAbEcdsaRegistrationEnvelope(left, right) {
+	return left.recipient_role === right.recipient_role && sameRouterAbPublicDigest32V1Wire(left.header_digest, right.header_digest) && sameRouterAbPublicDigest32V1Wire(left.aad_digest, right.aad_digest) && left.ciphertext.bytes.length === right.ciphertext.bytes.length && left.ciphertext.bytes.every((value, index) => value === right.ciphertext.bytes[index]);
+}
+function sameRouterAbEcdsaRegistrationRequest(left, right) {
+	return routerAbEcdsaStrictRegistrationRequestBindingJson(left) === routerAbEcdsaStrictRegistrationRequestBindingJson(right) && left.client_ephemeral_public_key === right.client_ephemeral_public_key && sameRouterAbEcdsaRegistrationEnvelope(left.deriver_a_envelope, right.deriver_a_envelope) && sameRouterAbEcdsaRegistrationEnvelope(left.deriver_b_envelope, right.deriver_b_envelope);
+}
+function sameEcdsaDerivationServerBootstrap(left, right) {
+	return left.formatVersion === right.formatVersion && left.walletId === right.walletId && left.evmFamilySigningKeySlotId === right.evmFamilySigningKeySlotId && left.ecdsaThresholdKeyId === right.ecdsaThresholdKeyId && left.relayerKeyId === right.relayerKeyId && left.applicationBindingDigestB64u === right.applicationBindingDigestB64u && left.contextBinding32B64u === right.contextBinding32B64u && sameEcdsaDerivationPublicIdentity(left.publicIdentity, right.publicIdentity) && left.clientShareRetryCounter === right.clientShareRetryCounter && left.relayerShareRetryCounter === right.relayerShareRetryCounter && left.publicTranscriptDigest32B64u === right.publicTranscriptDigest32B64u && left.keyHandle === right.keyHandle && left.signingRootId === right.signingRootId && left.signingRootVersion === right.signingRootVersion && left.thresholdEcdsaPublicKeyB64u === right.thresholdEcdsaPublicKeyB64u && left.ethereumAddress === right.ethereumAddress && left.relayerVerifyingShareB64u === right.relayerVerifyingShareB64u && sameEcdsaParticipantIds(left.participantIds, right.participantIds) && left.thresholdSessionId === right.thresholdSessionId && left.activationEpoch === right.activationEpoch && left.expiresAtMs === right.expiresAtMs && left.expiresAt === right.expiresAt && left.remainingUses === right.remainingUses && sameRouterAbEcdsaDerivationNormalSigningStateV1(left.routerAbEcdsaDerivationNormalSigning, right.routerAbEcdsaDerivationNormalSigning);
+}
+function linkedEd25519ProjectionMaterialActivationWire(projection) {
+	return routerAbMpcMaterialActivationRefToWire(projection.materialActivation);
+}
+function linkedEd25519ProjectionMatchesSigner(input) {
+	const { projection, signer } = input;
+	const authorityActivation = input.authority.signerActivations.ed25519;
+	if (!authorityActivation) return false;
+	const registeredPublicKeyBytes = projection.activationReceipt.registered_public_key;
+	const registeredPublicKeyB64u = base64UrlEncode(Uint8Array.from(registeredPublicKeyBytes));
+	const expectedWalletKeyId = `wallet-key:ed25519:${input.walletId}:${signer.nearEd25519SigningKeyId}`;
+	const targetBinding = projection.targetBinding;
+	const targetLifecycle = targetBinding.lifecycle;
+	return projection.walletId === input.walletId && projection.authorityId === input.authority.authorityId && projection.walletAuthMethodId === input.authMethodId && input.authority.provenance.kind === "device_link" && projection.linkSessionId === input.authority.provenance.linkSessionId && projection.applicationBinding.wallet_id === input.walletId && projection.applicationBinding.near_ed25519_signing_key_id === signer.nearEd25519SigningKeyId && projection.applicationBinding.key_creation_signer_slot === signer.signerSlot && projection.applicationBinding.signing_root_id === signer.signingRootId && sameEd25519ParticipantIds(projection.participantIds, signer.participantIds) && targetBinding.operation === "registration" && targetLifecycle.work_kind === "registration_prepare" && targetLifecycle.primitive_request_kind === "registration" && targetLifecycle.account_id === input.walletId && targetLifecycle.root_share_epoch === signer.signingRootVersion && targetLifecycle.signer_set_id === String(registrationNearEd25519BranchKey(signer.signerSlot)) && targetLifecycle.selected_server_id === signer.signingWorkerId && sameRouterAbMpcMaterialActivationRef(linkedEd25519ProjectionMaterialActivationWire(projection), routerAbMpcMaterialActivationRefToWire(authorityActivation.materialActivation)) && authorityActivation.signer.walletId === input.walletId && authorityActivation.signer.walletKeyId === expectedWalletKeyId && authorityActivation.signer.registeredPublicKeyB64u === registeredPublicKeyB64u && signer.publicKey === ed25519NearPublicKeyFromBytes(registeredPublicKeyBytes);
+}
+function linkedEd25519ProjectionMatchesDescriptor(input) {
+	const { projection, descriptor } = input;
+	const targetBinding = projection.targetBinding;
+	const targetLifecycle = targetBinding.lifecycle;
+	const registeredPublicKeyBytes = projection.activationReceipt.registered_public_key;
+	const descriptorPublicKeyBytes = descriptor.registeredPublicKey;
+	return projection.applicationBinding.wallet_id === descriptor.applicationBinding.wallet_id && projection.applicationBinding.near_ed25519_signing_key_id === descriptor.applicationBinding.near_ed25519_signing_key_id && projection.applicationBinding.signing_root_id === descriptor.applicationBinding.signing_root_id && projection.applicationBinding.key_creation_signer_slot === descriptor.applicationBinding.key_creation_signer_slot && sameEd25519ParticipantIds(projection.participantIds, descriptor.participantIds) && targetBinding.operation === "registration" && targetLifecycle.work_kind === "registration_prepare" && targetLifecycle.primitive_request_kind === "registration" && targetLifecycle.account_id === descriptor.lifecycle.accountId && targetLifecycle.root_share_epoch === descriptor.lifecycle.rootShareEpoch && targetLifecycle.signer_set_id === descriptor.lifecycle.signerSetId && targetLifecycle.selected_server_id === descriptor.lifecycle.signingWorkerId && sameRouterAbMpcMaterialActivationRef(targetBinding.material_activation, linkedEd25519ProjectionMaterialActivationWire(projection)) && sameRouterAbMpcMaterialActivationRef(projection.activationReceipt.material_activation, linkedEd25519ProjectionMaterialActivationWire(projection)) && ed25519NearPublicKeyFromBytes(registeredPublicKeyBytes) === ed25519NearPublicKeyFromBytes(descriptorPublicKeyBytes) && descriptor.nearAccountId === implicitNearAccountIdFromEd25519PublicKeyBytes(registeredPublicKeyBytes);
+}
+function linkedEcdsaProjectionMatchesSigner(input) {
+	const receipt = input.projection.activationReceipt;
+	const source = receipt.binding.source;
+	const sourceScope = receipt.sourceDerivation.sourceNormalSigning.scope;
+	const capability = input.signer.walletKey.publicCapability;
+	const activation = input.signer.activationReceipt.ecdsa_activation;
+	return input.signer.walletId === input.projection.walletId && input.projection.signer.walletId === input.signer.walletId && input.projection.signer.thresholdPublicKey33B64u === source.thresholdPublicKey33B64u && input.signer.walletKey.ecdsaThresholdKeyId === sourceScope.ecdsa_threshold_key_id && input.signer.walletKey.signingRootId === sourceScope.signing_root_id && input.signer.walletKey.signingRootVersion === sourceScope.signing_root_version && input.signer.walletKey.thresholdEcdsaPublicKeyB64u === source.thresholdPublicKey33B64u && String(input.signer.walletKey.derivationClientSharePublicKey33B64u) === source.clientPublicKey33B64u && String(input.signer.walletKey.relayerVerifyingShareB64u) === source.relayerPublicKey33B64u && sameRouterAbMpcMaterialActivationRef(capability.material_activation, routerAbMpcMaterialActivationRefToWire(source.activation)) && capability.client_id === String(input.projection.walletId) && capability.context.application_binding_digest_b64u === sourceScope.context.application_binding_digest_b64u && capability.public_identity.context_binding_b64u === sourceScope.public_identity.context_binding_b64u && capability.public_identity.derivation_client_share_public_key33_b64u === source.clientPublicKey33B64u && capability.public_identity.server_public_key33_b64u === source.relayerPublicKey33B64u && capability.public_identity.threshold_public_key33_b64u === source.thresholdPublicKey33B64u && capability.public_identity.ethereum_address20_b64u === source.thresholdEthereumAddress20B64u && capability.public_identity.client_share_retry_counter === sourceScope.public_identity.client_share_retry_counter && capability.public_identity.server_share_retry_counter === sourceScope.public_identity.server_share_retry_counter && capability.signer_set.selected_server.server_id === sourceScope.signing_worker.server_id && capability.activation_epoch === sourceScope.activation_epoch && sameRouterAbMpcMaterialActivationRef(activation.material_activation, routerAbMpcMaterialActivationRefToWire(source.activation)) && activation.context.application_binding_digest_b64u === sourceScope.context.application_binding_digest_b64u && activation.public_identity.context_binding_b64u === sourceScope.public_identity.context_binding_b64u && activation.public_identity.derivation_client_share_public_key33_b64u === source.clientPublicKey33B64u && activation.public_identity.server_public_key33_b64u === source.relayerPublicKey33B64u && activation.public_identity.threshold_public_key33_b64u === source.thresholdPublicKey33B64u && activation.public_identity.ethereum_address20_b64u === source.thresholdEthereumAddress20B64u && activation.signing_worker.server_id === sourceScope.signing_worker.server_id && activation.activation_epoch === sourceScope.activation_epoch;
+}
+function sameLinkedEcdsaResolvedSignerIdentity(left, right) {
+	return left.walletId === right.walletId && left.walletKey.keyHandle === right.walletKey.keyHandle && left.walletKey.relayerKeyId === right.walletKey.relayerKeyId && left.walletKey.participantIds[0] === right.walletKey.participantIds[0] && left.walletKey.participantIds[1] === right.walletKey.participantIds[1] && sameRouterAbEcdsaDerivationPublicCapabilityV1(left.walletKey.publicCapability, right.walletKey.publicCapability) && sameWalletRuntimePolicyScope(left.runtimePolicyScope, right.runtimePolicyScope);
+}
+async function ed25519ExportIdentityFromActiveCapability(descriptor) {
+	return {
+		scope: {
+			lifecycle_id: descriptor.lifecycle.lifecycleId,
+			root_share_epoch: descriptor.lifecycle.rootShareEpoch,
+			account_id: descriptor.lifecycle.accountId,
+			threshold_session_id: descriptor.lifecycle.thresholdSessionId,
+			signer_set_id: descriptor.lifecycle.signerSetId,
+			signing_worker_id: descriptor.lifecycle.signingWorkerId,
+			material_activation: descriptor.materialActivation
+		},
+		application_binding: descriptor.applicationBinding,
+		participant_ids: descriptor.participantIds,
+		registered_public_key: descriptor.registeredPublicKey,
+		state_epoch: descriptor.stateEpoch,
+		runtime_policy_binding: await deriveRouterAbEd25519YaoRuntimePolicyBindingV1(descriptor.runtimePolicyScope)
+	};
+}
+async function ed25519ExportIdentityFromPersistedCapability(capability) {
+	const binding = capability.activationResult.binding;
+	return {
+		scope: {
+			lifecycle_id: binding.lifecycle.lifecycle_id,
+			root_share_epoch: binding.lifecycle.root_share_epoch,
+			account_id: binding.lifecycle.account_id,
+			threshold_session_id: binding.lifecycle.session_id,
+			signer_set_id: binding.lifecycle.signer_set_id,
+			signing_worker_id: binding.lifecycle.selected_server_id,
+			material_activation: binding.material_activation
+		},
+		application_binding: capability.admissionRequest.application_binding,
+		participant_ids: capability.admissionRequest.participant_ids,
+		registered_public_key: capability.activationResult.public_receipt.registered_public_key,
+		state_epoch: capability.activationResult.public_receipt.state_epoch,
+		runtime_policy_binding: await deriveRouterAbEd25519YaoRuntimePolicyBindingV1(capability.runtimePolicyScope)
+	};
+}
+async function activeEd25519MaterialFromPersistedSigner(signer) {
+	const capability = signer.activeYaoCapability;
+	return {
+		ok: true,
+		materialActivation: capability.activationResult.binding.material_activation,
+		nearAccountId: capability.nearAccountId,
+		signerSlot: signer.signerSlot,
+		signingWorkerId: signer.signingWorkerId,
+		participantIds: signer.participantIds,
+		runtimePolicyScope: capability.runtimePolicyScope,
+		exportIdentity: await ed25519ExportIdentityFromPersistedCapability(capability)
+	};
+}
+async function ed25519ExportIdentityFromLinkedProjection(projection, descriptor) {
+	const lifecycle = projection.targetBinding.lifecycle;
+	return {
+		scope: {
+			lifecycle_id: lifecycle.lifecycle_id,
+			root_share_epoch: lifecycle.root_share_epoch,
+			account_id: lifecycle.account_id,
+			threshold_session_id: lifecycle.session_id,
+			signer_set_id: lifecycle.signer_set_id,
+			signing_worker_id: lifecycle.selected_server_id,
+			material_activation: projection.targetBinding.material_activation
+		},
+		application_binding: projection.applicationBinding,
+		participant_ids: projection.participantIds,
+		registered_public_key: projection.activationReceipt.registered_public_key,
+		state_epoch: projection.activationReceipt.state_epoch,
+		runtime_policy_binding: await deriveRouterAbEd25519YaoRuntimePolicyBindingV1(descriptor.runtimePolicyScope)
+	};
+}
+async function walletRegistrationFinalizeRequestFingerprint(request) {
+	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(request)));
+}
+function requirePreparedRegistrationId(result, label) {
+	if (!result.ok) throw new Error(`${label} is invalid: ${result.error.message}`);
+	return result.value;
+}
+function allocateWalletRegistrationOperationPrepared() {
+	return {
+		kind: "d1_wallet_registration_operation_prepared_v1",
+		walletAuthorityId: requirePreparedRegistrationId(parseWalletAuthorityId(`wallet-authority:${secureRandomBase64Url(32)}`), "walletAuthorityId"),
+		deviceId: requirePreparedRegistrationId(parseDeviceId(`device:${secureRandomBase64Url(32)}`), "deviceId"),
+		walletAuthMethodId: requirePreparedRegistrationId(parseWalletAuthMethodId(`wallet-auth-method:${secureRandomBase64Url(32)}`), "walletAuthMethodId")
+	};
+}
+function walletRegistrationOperationPreparedFromCeremony(ceremony) {
+	if (String(ceremony.foundingWalletAuthMethodId) !== String(ceremony.intent.foundingWalletAuthMethodId)) throw new Error("registration ceremony and intent name different founding auth methods");
+	return {
+		kind: "d1_wallet_registration_operation_prepared_v1",
+		walletAuthorityId: ceremony.foundingWalletAuthorityId,
+		deviceId: ceremony.foundingDeviceId,
+		walletAuthMethodId: ceremony.foundingWalletAuthMethodId
+	};
+}
+function committedInstallationProjectionFromCeremony(ceremony) {
+	const registrationAuthority = verifiedRegistrationCeremonyAuthority(ceremony);
+	if (ceremony.signerState.kind !== "signer_set_registration" || registrationAuthority === null) return null;
+	const branches = registrationSignerBranchesFromPlan(ceremony.signerPlan);
+	const nearPlan = branches.nearEd25519;
+	const ecdsaBranch = findStoredWalletRegistrationEvmFamilyEcdsaBranch(ceremony.signerState);
+	const nearBranch = findStoredWalletRegistrationNearEd25519YaoBranch(ceremony.signerState);
+	if (nearPlan === null || branches.evmFamilyEcdsa === null || ecdsaBranch?.kind !== "evm_family_ecdsa_finalized" || ecdsaBranch.branchKey !== branches.evmFamilyEcdsa.branchKey || nearBranch === null || nearBranch.branchKey !== nearPlan.branchKey || nearBranch.admissionRequest.scope.lifecycle_id !== ceremony.registrationCeremonyId || nearBranch.admissionRequest.scope.account_id !== String(ceremony.intent.walletId) || nearBranch.admissionRequest.application_binding.wallet_id !== String(ceremony.intent.walletId) || nearBranch.admissionRequest.application_binding.signing_root_id !== ceremony.preparedContext.signingRootId || nearBranch.admissionRequest.application_binding.key_creation_signer_slot !== nearPlan.signerSlot || nearBranch.admissionRequest.participant_ids.length !== nearPlan.participantIds.length || nearBranch.admissionRequest.participant_ids.some((participantId, index) => participantId !== nearPlan.participantIds[index])) return null;
+	return {
+		kind: "wallet_registration_committed_installation_projection_v1",
+		registrationCeremonyId: ceremony.registrationCeremonyId,
+		walletId: ceremony.intent.walletId,
+		orgId: ceremony.orgId,
+		registrationAuthority,
+		signerPlan: ceremony.signerPlan,
+		preparedContext: ceremony.preparedContext,
+		nearEd25519: nearBranch
+	};
+}
+function requireFoundingWalletKeyId(raw, label) {
+	const parsed = parseWalletKeyId(raw);
+	if (!parsed.ok) throw new Error(`${label} is invalid: ${parsed.error.message}`);
+	return parsed.value;
+}
+function requireFoundingEvmAddress(raw) {
+	if (!/^0x[0-9a-fA-F]{40}$/.test(raw)) throw new Error("ECDSA registration returned an invalid owner address");
+	return raw;
+}
+function requireSingleFoundingEcdsaWalletKey(walletKeys) {
+	const first = walletKeys[0];
+	if (!first) throw new Error("ECDSA founding authority is missing wallet-key facts");
+	for (const candidate of walletKeys.slice(1)) if (candidate.walletId !== first.walletId || candidate.evmFamilySigningKeySlotId !== first.evmFamilySigningKeySlotId || candidate.thresholdEcdsaPublicKeyB64u !== first.thresholdEcdsaPublicKeyB64u || candidate.thresholdOwnerAddress !== first.thresholdOwnerAddress) throw new Error("ECDSA founding authority received conflicting wallet-key facts");
+	return first;
+}
+function foundingEd25519SignerIdentity(walletId, facts) {
+	return {
+		kind: "exact_administered_ed25519_signer_v1",
+		keyFamily: "ed25519",
+		walletId,
+		walletKeyId: requireFoundingWalletKeyId(`wallet-key:ed25519:${walletId}:${facts.signer.nearEd25519SigningKeyId}`, "Ed25519 walletKeyId"),
+		registeredPublicKeyB64u: parseEd25519PublicKeyB64u(facts.registeredPublicKeyB64u)
+	};
+}
+function foundingEcdsaSignerIdentity(walletId, facts) {
+	return {
+		kind: "exact_administered_ecdsa_signer_v1",
+		keyFamily: "ecdsa_secp256k1",
+		walletId,
+		walletKeyId: requireFoundingWalletKeyId(`wallet-key:ecdsa:${walletId}:${facts.walletKey.evmFamilySigningKeySlotId}`, "ECDSA walletKeyId"),
+		thresholdPublicKey33B64u: parseSecp256k1CompressedPublicKeyB64u(facts.walletKey.thresholdEcdsaPublicKeyB64u),
+		evmAddress: requireFoundingEvmAddress(facts.walletKey.thresholdOwnerAddress)
+	};
+}
+function foundingSignerManifest(walletId, facts) {
+	switch (facts.kind) {
+		case "ed25519": return buildExactAdministeredSignerManifestV1([foundingEd25519SignerIdentity(walletId, facts.ed25519)]);
+		case "ecdsa_secp256k1": return buildExactAdministeredSignerManifestV1([foundingEcdsaSignerIdentity(walletId, facts.ecdsa)]);
+		case "both": return buildExactAdministeredSignerManifestV1([foundingEd25519SignerIdentity(walletId, facts.ed25519), foundingEcdsaSignerIdentity(walletId, facts.ecdsa)]);
+		default: return assertNeverFoundingSignerFacts(facts);
+	}
+}
+function foundingSignerActivations(walletId, facts) {
+	const manifest = foundingSignerManifest(walletId, facts);
+	switch (facts.kind) {
+		case "ed25519": return buildWalletSignerActivationSetV1({
+			manifest,
+			materialActivations: {
+				keyFamilies: ["ed25519"],
+				ed25519: facts.ed25519.materialActivation
+			}
+		});
+		case "ecdsa_secp256k1": return buildWalletSignerActivationSetV1({
+			manifest,
+			materialActivations: {
+				keyFamilies: ["ecdsa_secp256k1"],
+				ecdsa: facts.ecdsa.materialActivation
+			}
+		});
+		case "both": return buildWalletSignerActivationSetV1({
+			manifest,
+			materialActivations: {
+				keyFamilies: ["ed25519", "ecdsa_secp256k1"],
+				ed25519: facts.ed25519.materialActivation,
+				ecdsa: facts.ecdsa.materialActivation
+			}
+		});
+		default: return assertNeverFoundingSignerFacts(facts);
+	}
+}
+async function buildActiveFoundingAuthority(input) {
+	const signerActivations = foundingSignerActivations(input.walletId, input.signerFacts);
+	const signerActivationSetDigestB64u = await computeWalletSignerActivationSetDigestB64u(signerActivations);
+	const permissions = buildFullOwnerPermissionsV1();
+	const draft = {
+		kind: "wallet_authority_v1",
+		authorityId: input.prepared.walletAuthorityId,
+		walletId: input.walletId,
+		principal: {
+			kind: "owner_device",
+			deviceId: input.prepared.deviceId
+		},
+		provenance: { kind: "wallet_registration" },
+		permissions,
+		signerActivations,
+		signerActivationSetDigestB64u,
+		authorityDigestB64u: signerActivationSetDigestB64u,
+		revocationEpoch: 0,
+		createdAtMs: input.now,
+		updatedAtMs: input.now,
+		state: "active",
+		activatedAtMs: input.now
+	};
+	const authorityDigestB64u = await computeWalletAuthorityDigestB64u(draft);
+	return buildActiveWalletAuthorityV1({
+		kind: "wallet_authority_v1",
+		authorityId: draft.authorityId,
+		walletId: draft.walletId,
+		principal: draft.principal,
+		provenance: draft.provenance,
+		permissions: draft.permissions,
+		signerActivations: draft.signerActivations,
+		signerActivationSetDigestB64u: draft.signerActivationSetDigestB64u,
+		authorityDigestB64u,
+		revocationEpoch: draft.revocationEpoch,
+		createdAtMs: draft.createdAtMs,
+		updatedAtMs: draft.updatedAtMs,
+		state: draft.state,
+		activatedAtMs: draft.activatedAtMs
+	});
+}
+async function extendFoundingAuthorityWithEd25519(input) {
+	const existingEcdsa = input.authority.signerActivations.ecdsa;
+	const signerActivationsCandidate = buildWalletSignerActivationSetV1({
+		manifest: buildExactAdministeredSignerManifestV1([foundingEd25519SignerIdentity(input.authority.walletId, input.ed25519), existingEcdsa.signer]),
+		materialActivations: {
+			keyFamilies: ["ed25519", "ecdsa_secp256k1"],
+			ed25519: input.ed25519.materialActivation,
+			ecdsa: existingEcdsa.materialActivation
+		}
+	});
+	if (!isCombinedWalletSignerActivationSetV1(signerActivationsCandidate)) throw new Error("Deferred Ed25519 activation did not produce a combined signer activation set");
+	const signerActivations = signerActivationsCandidate;
+	const signerActivationSetDigestB64u = await computeWalletSignerActivationSetDigestB64u(signerActivations);
+	const draft = {
+		kind: "wallet_authority_v1",
+		authorityId: input.authority.authorityId,
+		walletId: input.authority.walletId,
+		principal: input.authority.principal,
+		provenance: input.authority.provenance,
+		permissions: input.authority.permissions,
+		signerActivations,
+		signerActivationSetDigestB64u,
+		authorityDigestB64u: input.authority.authorityDigestB64u,
+		revocationEpoch: input.authority.revocationEpoch,
+		createdAtMs: input.authority.createdAtMs,
+		updatedAtMs: Math.max(input.authority.updatedAtMs, input.now),
+		state: "active",
+		activatedAtMs: input.authority.activatedAtMs
+	};
+	return buildActiveCombinedWalletAuthorityV1({
+		kind: draft.kind,
+		authorityId: draft.authorityId,
+		walletId: draft.walletId,
+		principal: draft.principal,
+		provenance: draft.provenance,
+		permissions: draft.permissions,
+		signerActivations: draft.signerActivations,
+		signerActivationSetDigestB64u: draft.signerActivationSetDigestB64u,
+		authorityDigestB64u: await computeWalletAuthorityDigestB64u(draft),
+		revocationEpoch: draft.revocationEpoch,
+		createdAtMs: draft.createdAtMs,
+		updatedAtMs: draft.updatedAtMs,
+		state: draft.state,
+		activatedAtMs: draft.activatedAtMs
+	});
+}
+function buildActiveFoundingAuthMethod(input) {
+	switch (input.authority.kind) {
+		case "passkey": return requireActiveFoundingAuthMethod(buildWalletAuthMethodRecordV2({
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.prepared.walletAuthMethodId,
+			walletId: input.authority.walletId,
+			walletAuthorityId: input.prepared.walletAuthorityId,
+			kind: "passkey",
+			status: "active",
+			rpId: input.authority.rpId,
+			credentialIdB64u: requirePreparedRegistrationId(parseWebAuthnCredentialIdB64u(input.authority.credentialIdB64u), "registration credentialIdB64u"),
+			credentialPublicKeyB64u: input.authority.credentialPublicKeyB64u,
+			counter: input.authority.counter,
+			createdAtMs: input.now,
+			updatedAtMs: input.now,
+			activatedAtMs: input.now
+		}));
+		case "email_otp": return requireActiveFoundingAuthMethod(buildWalletAuthMethodRecordV2({
+			version: "wallet_auth_method_v2",
+			walletAuthMethodId: input.prepared.walletAuthMethodId,
+			walletId: input.authority.walletId,
+			walletAuthorityId: input.prepared.walletAuthorityId,
+			kind: "email_otp",
+			status: "active",
+			emailHashHex: input.authority.emailHashHex,
+			registrationAuthorityId: input.authority.registrationAuthorityId,
+			createdAtMs: input.now,
+			updatedAtMs: input.now,
+			activatedAtMs: input.now
+		}));
+	}
+}
+function requireActiveFoundingAuthMethod(record) {
+	if (record.status !== "active") throw new Error("Founding wallet auth method must be active");
+	return record;
+}
+async function buildFoundingAuthorityRecords(input) {
+	return {
+		authority: await buildActiveFoundingAuthority({
+			walletId: input.walletId,
+			prepared: input.prepared,
+			signerFacts: input.signerFacts,
+			now: input.now
+		}),
+		authMethod: buildActiveFoundingAuthMethod({
+			authority: input.authority,
+			prepared: input.prepared,
+			now: input.now
+		})
+	};
+}
+function assertNeverFoundingSignerFacts(value) {
+	throw new Error(`Unsupported founding signer facts: ${String(value)}`);
+}
+function registrationFinalizeCeremonyFromStored(ceremony) {
+	if (ceremony.signerState.kind !== "signer_set_registration") throw new Error("signer-set registration state is required");
+	return {
+		registrationCeremonyId: ceremony.registrationCeremonyId,
+		intent: { walletId: ceremony.intent.walletId },
+		signerPlan: ceremony.signerPlan,
+		preparedContext: ceremony.preparedContext,
+		orgId: ceremony.orgId,
+		expiresAtMs: ceremony.expiresAtMs,
+		authorityState: ceremony.authorityState,
+		signerState: ceremony.signerState
+	};
+}
+function setupPolicyMatchesPreparedContext(policy, preparedContext) {
+	switch (policy.kind) {
+		case "runtime_policy_scope": return preparedContext.runtimePolicy.kind === "runtime_policy_scope" && preparedContext.runtimePolicy.scope.orgId === policy.scope.orgId && preparedContext.runtimePolicy.scope.projectId === policy.scope.projectId && preparedContext.runtimePolicy.scope.envId === policy.scope.envId && preparedContext.runtimePolicy.scope.signingRootVersion === policy.scope.signingRootVersion;
+		case "signing_root_only": return preparedContext.runtimePolicy.kind === "signing_root_only";
+		default: return assertNeverRegistrationSetupPolicy(policy);
+	}
+}
+function assertNeverRegistrationSetupPolicy(value) {
+	throw new Error(`Unsupported registration setup policy: ${String(value)}`);
+}
+function registrationFinalizeRecoveryFromCommittedInstallation(input) {
+	const walletId = parseWalletIdForIntent(input.setupClaims.walletId);
+	if (!walletId) throw new Error("signed registration setup claims contain an invalid wallet identity");
+	const branches = registrationSignerBranchesFromPlan(input.projection.signerPlan);
+	if (!branches.nearEd25519 || !branches.evmFamilyEcdsa) throw new Error("committed registration installation is not a mixed signer plan");
+	if (input.setupClaims.registrationCeremonyId !== input.projection.registrationCeremonyId || input.setupClaims.walletId !== String(input.projection.walletId) || walletId !== input.projection.walletId || input.setupClaims.orgId !== input.projection.orgId || input.setupClaims.signingRootId !== input.projection.preparedContext.signingRootId || input.setupClaims.signingRootVersion !== input.projection.preparedContext.signingRootVersion || !setupPolicyMatchesPreparedContext(input.setupClaims.policy, input.projection.preparedContext) || input.projection.registrationAuthority.walletId !== input.projection.walletId) throw new Error("committed registration installation does not match signed setup claims");
+	return {
+		kind: "committed_mixed_installation",
+		ceremony: {
+			registrationCeremonyId: input.setupClaims.registrationCeremonyId,
+			intent: { walletId },
+			signerPlan: input.projection.signerPlan,
+			preparedContext: input.projection.preparedContext,
+			orgId: input.projection.orgId,
+			expiresAtMs: input.setupClaims.expiresAtMs,
+			authorityState: {
+				kind: "verified",
+				authority: input.projection.registrationAuthority
+			},
+			signerState: {
+				kind: "signer_set_registration",
+				branches: [input.projection.nearEd25519]
+			}
+		}
+	};
+}
+function isWalletRegistrationNearProvisioningSuccess(value) {
+	return value.ok && value.kind === "near_ed25519" && "registrationEstablishedSession" in value;
+}
+function assertNeverD1RegistrationSessionIssuance(value) {
+	throw new Error(`Unsupported registration Wallet Session issuance: ${String(value)}`);
+}
+function assertNeverD1RegistrationSideEffectRecord(value) {
+	throw new Error(`Unsupported registration side-effect record: ${String(value)}`);
+}
+function registrationEstablishedSessionResultFromIssuance(result) {
+	switch (result.kind) {
+		case "issued": return {
+			kind: "issued",
+			session: result.session
+		};
+		case "already_committed": return {
+			kind: "already_committed",
+			session: result.session,
+			next: result.next
+		};
+		default: return assertNeverD1RegistrationSessionIssuance(result);
+	}
+}
+const D1_WALLET_REGISTRATION_OPERATION_RESUME_AFTER_MS = 3e4;
+const WALLET_REGISTRATION_ROUTER_POLICY_VERSION = "wallet-registration-v1";
+function requireWalletSessionMintId(value) {
+	const parsed = parseWalletSessionMintId(value);
+	if (!parsed.ok) throw new Error(`Wallet Session mint identity is invalid: ${parsed.error.message}`);
+	return parsed.value;
+}
+function assertNeverEd25519WalletSessionIssue(value) {
+	throw new Error(`Unsupported Ed25519 Yao Wallet Session issuance: ${String(value)}`);
+}
+/**
+* A committed mint has no reachable credential, so the caller is told to
+* unlock the exact auth method rather than being handed a second bearer for
+* the same session.
+*/
+function ed25519AlreadyCommittedWalletSessionResponse(committed) {
+	return {
+		ok: false,
+		code: "already_committed",
+		message: "Ed25519 Wallet Session is already committed; unlock the exact auth method",
+		next: committed.next,
+		committed: {
+			kind: "already_committed_wallet_session_v1",
+			walletId: committed.walletId,
+			authorityId: committed.authorityId,
+			walletAuthMethodId: committed.walletAuthMethodId,
+			mintId: committed.mintId,
+			authorizationId: committed.authorizationId,
+			walletSessionId: committed.walletSessionId,
+			quotaId: committed.quotaId
+		}
+	};
+}
+/**
+* The bearer issuer used to re-check the owner proof against the session
+* binding it signed. Direct issuance writes no such binding, so the same claim
+* is asserted here before the exact session is committed.
+*/
+function registrationWalletAuthAuthority(input) {
+	return walletAuthAuthorityFromRegistrationAuthority(input);
+}
+function errorMessage(error) {
+	return error instanceof Error ? error.message : String(error || "");
+}
+function assertNeverSponsoredNamedNearAccountCreationResult(value) {
+	throw new Error(`Unexpected sponsored NEAR account creation result: ${String(value)}`);
+}
+function isRegistrationEcdsaReadyReceipt(receipt) {
+	return receipt.committed.kind === "ecdsa_ready";
+}
+function isRegistrationNearPendingReceipt(receipt) {
+	return receipt.committed.kind === "near_pending";
+}
+function isRegistrationNearReadyReceipt(receipt) {
+	return receipt.committed.kind === "near_ready";
+}
+function assertNeverRegistrationReceiptCommit(value) {
+	throw new Error(`Unsupported registration receipt commit: ${String(value)}`);
+}
+async function cleanupFinalizedRegistrationCeremony(input) {
+	try {
+		await input.store.deleteCeremony(input.registrationCeremonyId);
+	} catch {}
+}
+function createD1RegistrationRouteTimingRecorder(route) {
+	return {
+		route,
+		entries: []
+	};
+}
+function startD1RegistrationRouteTiming(name) {
+	return {
+		name,
+		startedAtMs: Date.now()
+	};
+}
+function finishD1RegistrationRouteTiming(recorder, mark) {
+	recorder.entries.push({
+		name: mark.name,
+		durationMs: Math.max(0, Date.now() - mark.startedAtMs)
+	});
+}
+function d1RegistrationRouteDiagnostics(recorder) {
+	return {
+		kind: "wallet_registration_route_diagnostics_v1",
+		route: recorder.route,
+		entries: recorder.entries.map((entry) => ({
+			name: entry.name,
+			durationMs: entry.durationMs
+		}))
+	};
+}
+function withD1RegistrationRouteDiagnostics(response, recorder) {
+	if (!response.ok) return response;
+	return {
+		...response,
+		registrationDiagnostics: d1RegistrationRouteDiagnostics(recorder)
+	};
+}
+function normalizedKeyHandleSet(keyHandles) {
+	const normalized = /* @__PURE__ */ new Set();
+	for (const keyHandle of keyHandles) {
+		const value = String(keyHandle || "").trim();
+		if (value) normalized.add(value);
+	}
+	return normalized;
+}
+function hasEcdsaKeyHandleSetMismatch(expectedKeyHandles, actualKeyHandles) {
+	if (expectedKeyHandles.length === 0) return false;
+	const expected = normalizedKeyHandleSet(expectedKeyHandles);
+	const actual = normalizedKeyHandleSet(actualKeyHandles);
+	if (expected.size !== actual.size) return true;
+	for (const keyHandle of expected) if (!actual.has(keyHandle)) return true;
+	return false;
+}
+function registrationIntentSignerBranches(intent) {
+	const plan = registrationSignerPlanFromSelection(intent.signerSelection);
+	if (!plan.ok) return plan;
+	return {
+		ok: true,
+		value: registrationSignerBranchesFromPlan(plan.value)
+	};
+}
+function registrationSignerBranchesFromPlan(plan) {
+	return {
+		plan,
+		nearEd25519: findRegistrationSignerPlanNearEd25519Branch(plan),
+		evmFamilyEcdsa: findRegistrationSignerPlanEvmFamilyEcdsaBranch(plan)
+	};
+}
+function resolveRegistrationPreparedContextFromPlan(input) {
+	const branches = registrationSignerBranchesFromPlan(input.signerPlan);
+	const ecdsaChainTargets = branches.evmFamilyEcdsa ? normalizeThresholdEcdsaChainTargets(branches.evmFamilyEcdsa.chainTargets) : null;
+	if (branches.evmFamilyEcdsa && !ecdsaChainTargets) return {
+		ok: false,
+		code: "invalid_body",
+		message: "ECDSA registration contains an invalid chain target"
+	};
+	try {
+		return {
+			ok: true,
+			preparedContext: buildStoredWalletRegistrationPreparedContext({
+				signingRootId: input.signingRootId,
+				signingRootVersion: input.signingRootVersion,
+				runtimePolicyScope: input.runtimePolicyScope || null,
+				ecdsaChainTargets
+			}),
+			ecdsaChainTargets
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			code: "invalid_body",
+			message: errorMessage(error) || "registration prepared context is invalid"
+		};
+	}
+}
+function registrationPreparedContextRuntimePolicyScope(preparedContext) {
+	return preparedContext.runtimePolicy.kind === "runtime_policy_scope" ? preparedContext.runtimePolicy.scope : void 0;
+}
+function registrationTenantRootIdentity(preparedContext) {
+	const scope = registrationPreparedContextRuntimePolicyScope(preparedContext);
+	if (!scope) return null;
+	const identity = buildTenantRootIdentityFromAuthenticatedDeploymentV1({
+		orgId: scope.orgId,
+		projectId: scope.projectId,
+		envId: scope.envId,
+		signingRootId: preparedContext.signingRootId,
+		signingRootVersion: preparedContext.signingRootVersion
+	});
+	return identity.ok ? identity.value : null;
+}
+function registrationPreparedContextEcdsaChainTargets(preparedContext) {
+	return preparedContext.ecdsa.kind === "evm_family_ecdsa_requested" ? preparedContext.ecdsa.chainTargets : null;
+}
+/**
+* A verified authority must name the same wallet the intent does. A ceremony
+* still awaiting its proof has no authority to disagree with, so it matches
+* vacuously — respond performs this check again once the proof binds.
+*/
+function registrationCeremonyWalletsMatch(input) {
+	const authority = verifiedRegistrationCeremonyAuthority(input.ceremony);
+	if (!authority) return true;
+	return authority.walletId === input.ceremony.intent.walletId;
+}
+function resolvedRegistrationNearAccount(input) {
+	const nearEd25519SigningKeyId = nearEd25519SigningKeyIdFromString(input.nearEd25519SigningKeyId);
+	switch (input.accountProvisioning.kind) {
+		case "implicit_account": {
+			const parsed = parseImplicitNearAccountId(input.nearAccountId);
+			if (!parsed.ok) return {
+				ok: false,
+				code: "internal",
+				message: parsed.message
+			};
+			return {
+				ok: true,
+				value: {
+					kind: "implicit_account",
+					nearAccountId: parsed.value,
+					nearEd25519SigningKeyId
+				}
+			};
+		}
+		case "sponsored_named_account": {
+			const parsed = parseNamedNearAccountId(input.nearAccountId);
+			if (!parsed.ok) return {
+				ok: false,
+				code: "internal",
+				message: parsed.message
+			};
+			const transactionHash = normalizeOptionalTrimmedString(input.sponsoredTransactionHash);
+			if (!transactionHash) return {
+				ok: false,
+				code: "internal",
+				message: "Sponsored named registration missing account creation transaction hash"
+			};
+			return {
+				ok: true,
+				value: {
+					kind: "sponsored_named_account",
+					nearAccountId: parsed.value,
+					nearEd25519SigningKeyId,
+					transactionHash
+				}
+			};
+		}
+	}
+}
+function sponsoredNamedRegistrationAccountId(provisioning) {
+	switch (provisioning.kind) {
+		case "implicit_account": return null;
+		case "sponsored_named_account": return String(provisioning.requestedAccountId);
+	}
+}
+/**
+* A mixed plan finalizes in two calls: `evm_family_ecdsa` first, which returns
+* the wallet ECDSA-ready and leaves the ceremony open, then `near_ed25519`
+* once the Yao ceremony settles (Refactor 94 Phase 4+5). Single-signer plans
+* still finalize in one call.
+*
+* The requested kind must name only branches the plan admitted, and must be
+* legal for the progress those branches have made — a `near_ed25519` call on a
+* mixed plan before the ECDSA commit is durable would return a NEAR-ready
+* wallet whose ECDSA signer does not exist.
+*/
+function finalizeSignerWorkSequenceFailure(input) {
+	switch (input.request.kind) {
+		case "near_ed25519":
+			if (!input.hasNearEd25519) return {
+				code: "invalid_body",
+				message: "registration plan has no Ed25519 signer to finalize"
+			};
+			if (input.hasEvmFamilyEcdsa && !input.ecdsaFinalized) return {
+				code: "invalid_state",
+				message: "ECDSA finalize must complete before the Ed25519 finalize"
+			};
+			return null;
+		case "evm_family_ecdsa":
+			if (!input.hasEvmFamilyEcdsa) return {
+				code: "invalid_body",
+				message: "registration plan has no ECDSA signer to finalize"
+			};
+			if (input.ecdsaFinalized) return {
+				code: "invalid_state",
+				message: "ECDSA finalize has already completed for this ceremony"
+			};
+			return null;
+	}
+}
+function finalizePasskeyRpId(authority) {
+	if (authority.kind !== "passkey") throw new Error("passkey finalize auth method requires a passkey registration authority");
+	return authority.rpId;
+}
+function ecdsaStrictRegistrationAuthority(facts) {
+	return {
+		subjectId: facts.client_id,
+		sessionId: facts.lifecycle.session_id,
+		accountId: facts.lifecycle.account_id,
+		expiresAtMs: facts.expires_at_ms
+	};
+}
+function exactEcdsaParticipantPair(participantIds) {
+	if (participantIds.length !== 2 || participantIds[0] !== 1 || participantIds[1] !== 2) throw new Error("ECDSA registration requires participant pair [1, 2]");
+	return [1, 2];
+}
+function ethereumAddressHexFromBase64Url(value) {
+	const bytes = base64UrlDecode(value);
+	if (bytes.length !== 20) throw new Error("ECDSA activation Ethereum address must contain 20 bytes");
+	let hex = "0x";
+	for (const byte of bytes) hex += byte.toString(16).padStart(2, "0");
+	return hex;
+}
+function requireActivatedEcdsaIdentity(input) {
+	const registration = input.branch.strictRegistration;
+	const receipt = input.activation.ecdsa_activation;
+	const identity = receipt.public_identity;
+	if (receipt.context.application_binding_digest_b64u !== registration.context.application_binding_digest_b64u || identity.context_binding_b64u !== input.publicFacts.contextBinding32B64u || identity.derivation_client_share_public_key33_b64u !== input.publicFacts.derivationClientSharePublicKey33B64u || identity.client_share_retry_counter !== input.publicFacts.clientShareRetryCounter || input.activation.lifecycle_id !== registration.lifecycle.lifecycle_id || base64UrlEncode(Uint8Array.from(input.activation.transcript_digest.bytes)) !== input.publicFacts.proofTranscriptDigestB64u || receipt.signing_worker.server_id !== registration.lifecycle.selected_server_id) throw new Error("ECDSA activation receipt does not match the admitted registration identity");
+}
+async function buildActivatedEcdsaFamilyBootstrap(input) {
+	requireActivatedEcdsaIdentity(input);
+	const prepare = input.branch.prepare;
+	const identity = input.activation.ecdsa_activation.public_identity;
+	const expiresAtMs = input.branch.strictRegistration.expires_at_ms;
+	const ethereumAddress = ethereumAddressHexFromBase64Url(identity.ethereum_address20_b64u);
+	const publicIdentity = parseEcdsaDerivationPublicIdentity({
+		derivationClientSharePublicKey33B64u: input.publicFacts.derivationClientSharePublicKey33B64u,
+		relayerPublicKey33B64u: identity.server_public_key33_b64u,
+		groupPublicKey33B64u: identity.threshold_public_key33_b64u,
+		ethereumAddress
+	});
+	if (!publicIdentity) throw new Error("ECDSA activation receipt contains an invalid public identity");
+	const keyHandle = await deriveThresholdEcdsaKeyHandle({
+		ecdsaThresholdKeyId: prepare.ecdsaThresholdKeyId,
+		signingRootId: prepare.signingRootId,
+		signingRootVersion: prepare.signingRootVersion
+	});
+	const routerAbEcdsaDerivationNormalSigning = parseRouterAbEcdsaDerivationNormalSigningStateV1({
+		kind: ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1,
+		scope: {
+			wallet_id: String(prepare.walletId),
+			ecdsa_threshold_key_id: prepare.ecdsaThresholdKeyId,
+			signing_root_id: prepare.signingRootId,
+			signing_root_version: prepare.signingRootVersion,
+			context: { application_binding_digest_b64u: input.branch.strictRegistration.context.application_binding_digest_b64u },
+			public_identity: {
+				context_binding_b64u: input.publicFacts.contextBinding32B64u,
+				derivation_client_share_public_key33_b64u: input.publicFacts.derivationClientSharePublicKey33B64u,
+				server_public_key33_b64u: identity.server_public_key33_b64u,
+				threshold_public_key33_b64u: identity.threshold_public_key33_b64u,
+				ethereum_address20_b64u: base64UrlEncode(Uint8Array.from(ethereumAddress.slice(2).match(/.{2}/g)?.map((byte) => Number.parseInt(byte, 16)) ?? [])),
+				client_share_retry_counter: input.publicFacts.clientShareRetryCounter,
+				server_share_retry_counter: identity.server_share_retry_counter
+			},
+			signing_worker: input.activation.ecdsa_activation.signing_worker,
+			material_activation: input.activation.ecdsa_activation.material_activation,
+			activation_epoch: input.activation.ecdsa_activation.activation_epoch
+		}
+	});
+	if (!routerAbEcdsaDerivationNormalSigning) throw new Error("ECDSA activation produced invalid normal-signing state");
+	return {
+		formatVersion: "ecdsa-derivation-role-local",
+		walletId: String(prepare.walletId),
+		evmFamilySigningKeySlotId: prepare.evmFamilySigningKeySlotId,
+		ecdsaThresholdKeyId: prepare.ecdsaThresholdKeyId,
+		relayerKeyId: prepare.relayerKeyId,
+		applicationBindingDigestB64u: input.branch.strictRegistration.context.application_binding_digest_b64u,
+		contextBinding32B64u: input.publicFacts.contextBinding32B64u,
+		publicIdentity,
+		clientShareRetryCounter: input.publicFacts.clientShareRetryCounter,
+		relayerShareRetryCounter: identity.server_share_retry_counter,
+		publicTranscriptDigest32B64u: input.publicFacts.proofTranscriptDigestB64u,
+		keyHandle,
+		signingRootId: prepare.signingRootId,
+		signingRootVersion: prepare.signingRootVersion,
+		thresholdEcdsaPublicKeyB64u: identity.threshold_public_key33_b64u,
+		ethereumAddress,
+		relayerVerifyingShareB64u: identity.server_public_key33_b64u,
+		participantIds: [...exactEcdsaParticipantPair(prepare.participantIds)],
+		thresholdSessionId: buildRouterAbEcdsaDerivationActiveStateIdV1({
+			ecdsaThresholdKeyId: prepare.ecdsaThresholdKeyId,
+			signingRootId: prepare.signingRootId,
+			signingRootVersion: prepare.signingRootVersion,
+			activationEpoch: input.activation.ecdsa_activation.activation_epoch
+		}),
+		activationEpoch: input.activation.ecdsa_activation.activation_epoch,
+		expiresAtMs,
+		expiresAt: new Date(expiresAtMs).toISOString(),
+		remainingUses: prepare.remainingUses,
+		routerAbEcdsaDerivationNormalSigning
+	};
+}
+function postRegistrationProofResponse(input) {
+	return input.response.response;
+}
+function postRegistrationProofMatchesRequest(input) {
+	const response = postRegistrationProofResponse(input);
+	return response.bundles.signerA.transcriptDigestB64u === response.bundles.signerB.transcriptDigestB64u;
+}
+function postRegistrationRequestId(input) {
+	return input.request.refresh_nonce;
+}
+function pendingEcdsaSessionActivationRecord(input) {
+	postRegistrationProofResponse(input.proof);
+	return {
+		version: "wallet_ecdsa_pending_session_activation_v1",
+		walletId: input.walletId,
+		lifecycleId: input.proof.request.lifecycle.lifecycle_id,
+		requestId: postRegistrationRequestId(input.proof),
+		publicCapability: input.publicCapability,
+		createdAtMs: input.nowMs,
+		expiresAtMs: input.proof.request.expires_at_ms,
+		operation: "refresh",
+		request: input.proof.request,
+		response: input.proof.response
+	};
+}
+function buildPostRegistrationEcdsaNormalSigningState(input) {
+	const capability = input.publicCapability;
+	const state = parseRouterAbEcdsaDerivationNormalSigningStateV1({
+		kind: ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1,
+		scope: {
+			wallet_id: input.walletKey.walletId,
+			ecdsa_threshold_key_id: input.walletKey.ecdsaThresholdKeyId,
+			signing_root_id: input.walletKey.signingRootId,
+			signing_root_version: input.walletKey.signingRootVersion,
+			context: capability.context,
+			public_identity: capability.public_identity,
+			material_activation: capability.material_activation,
+			signing_worker: capability.signer_set.selected_server,
+			activation_epoch: capability.activation_epoch
+		}
+	});
+	if (!state) throw new Error("registered ECDSA normal-signing state is invalid");
+	return state;
+}
+/**
+* Upper bound on Router metrics folded into one Gateway header. The Router is
+* ours, but a merged header grows at every hop, so the fold is bounded rather
+* than trusting the peer to stay terse.
+*/
+const ROUTER_SERVER_TIMING_MERGE_LIMIT = 32;
+/** Metric names the Gateway is willing to re-emit in its own header. */
+const ROUTER_SERVER_TIMING_NAME_PATTERN = /^[A-Za-z0-9_-]+$/;
+/**
+* Folds the Router's own `Server-Timing` header into the Gateway's span list
+* (Refactor 94B Phase 0), so the Router and role-worker breakdown reaches the
+* browser on the same header as the Gateway's own boundaries.
+*
+* Entries without a finite non-negative `dur` are dropped, which also discards
+* Cloudflare's descriptive metrics, and names are restricted to a token
+* charset so a metric name can never forge extra entries downstream.
+*/
+function mergeRouterServerTiming(target, header) {
+	let merged = 0;
+	for (const entry of header.split(",")) {
+		if (merged >= ROUTER_SERVER_TIMING_MERGE_LIMIT) return;
+		const parts = entry.split(";");
+		const name = String(parts[0] || "").trim();
+		if (!ROUTER_SERVER_TIMING_NAME_PATTERN.test(name)) continue;
+		for (const part of parts.slice(1)) {
+			const [key, rawValue] = part.split("=");
+			if (String(key || "").trim() !== "dur") continue;
+			const duration = Number(String(rawValue || "").trim());
+			if (!Number.isFinite(duration) || duration < 0) break;
+			target.push([name, duration]);
+			merged += 1;
+			break;
+		}
+	}
+}
+var CloudflareD1WalletRegistrationService = class {
+	constructor(input) {
+		this.authorizationService = input.authorizationService;
+		this.authorizationTenantId = input.authorizationTenantId;
+		this.createSponsoredNamedNearAccount = input.createSponsoredNamedNearAccount;
+		this.emailOtpRegistrationEnrollmentFinalizer = input.emailOtpRegistrationEnrollmentFinalizer;
+		this.getRegistrationCeremonyIntentStore = input.getRegistrationCeremonyIntentStore;
+		this.getEd25519YaoProductRegistration = input.getEd25519YaoProductRegistration;
+		this.ecdsaStrictRegistration = input.ecdsaStrictRegistration;
+		this.tenantRootCustodyLineage = input.tenantRootCustodyLineage;
+		this.getWalletStore = input.getWalletStore;
+		this.activateSideEffects = input.activateSideEffects;
+		this.nearProvisioningSideEffects = input.nearProvisioningSideEffects;
+		this.walletRegistrationCommitStore = input.walletRegistrationCommitStore;
+		this.walletCustodyCommitStore = input.walletCustodyCommitStore;
+		this.walletAuthMethods = input.walletAuthMethods;
+		this.getLinkedDeviceEd25519AuthorityReader = input.getLinkedDeviceEd25519AuthorityReader;
+	}
+	async getWalletRegistrationRuntimePolicyScope(registrationCeremonyId) {
+		const ceremony = await this.getRegistrationCeremonyIntentStore().getCeremony(registrationCeremonyId);
+		if (!ceremony) return void 0;
+		return registrationPreparedContextRuntimePolicyScope(ceremony.preparedContext);
+	}
+	async resolveEd25519MaterialActivation(input) {
+		try {
+			const walletId = walletIdFromString(input.walletId);
+			const signer = await this.getWalletStore().getEd25519SignerByMaterialActivation({
+				walletId,
+				materialActivation: input.materialActivation
+			});
+			const yaoRuntime = this.getEd25519YaoProductRegistration();
+			if (!yaoRuntime) return {
+				ok: false,
+				code: "internal",
+				message: "Ed25519 Yao capability resolver is not configured"
+			};
+			if (!signer) {
+				const linkedDeviceReader = this.getLinkedDeviceEd25519AuthorityReader();
+				const projection = linkedDeviceReader ? await linkedDeviceReader.readInstalledEd25519AuthorityByMaterialActivationV1({
+					walletId,
+					materialActivation: routerAbMpcMaterialActivationRefFromWire(input.materialActivation)
+				}) : null;
+				if (!projection) return {
+					ok: false,
+					code: "not_found",
+					message: "Ed25519 material activation is not active for this wallet"
+				};
+				const projectionMaterialActivation = linkedEd25519ProjectionMaterialActivationWire(projection);
+				if (projection.walletId !== walletId || !sameRouterAbMpcMaterialActivationRef(projectionMaterialActivation, input.materialActivation)) return {
+					ok: false,
+					code: "not_found",
+					message: "Linked Ed25519 material activation does not match its installation"
+				};
+				const linkedSignerSlot = projection.applicationBinding.key_creation_signer_slot;
+				const linkedSigningWorkerId = projection.targetBinding.lifecycle.selected_server_id;
+				const active = await yaoRuntime.resolveActiveCapability({
+					kind: "router_ab_ed25519_yao_active_capability_lookup_v1",
+					walletId: input.walletId,
+					nearEd25519SigningKeyId: projection.applicationBinding.near_ed25519_signing_key_id,
+					signerSlot: linkedSignerSlot,
+					signingWorkerId: linkedSigningWorkerId,
+					participantIds: projection.participantIds
+				});
+				if (!active.ok) return {
+					ok: false,
+					code: active.code === "unknown_capability" ? "not_found" : "internal",
+					message: active.message
+				};
+				if (!linkedEd25519ProjectionMatchesDescriptor({
+					projection,
+					descriptor: active.capability
+				})) return {
+					ok: false,
+					code: "not_found",
+					message: "Linked Ed25519 installation does not match the active signer identity"
+				};
+				return {
+					ok: true,
+					materialActivation: projectionMaterialActivation,
+					nearAccountId: active.capability.nearAccountId,
+					signerSlot: linkedSignerSlot,
+					signingWorkerId: linkedSigningWorkerId,
+					participantIds: projection.participantIds,
+					runtimePolicyScope: active.capability.runtimePolicyScope,
+					exportIdentity: await ed25519ExportIdentityFromLinkedProjection(projection, active.capability)
+				};
+			}
+			const active = await yaoRuntime.resolveActiveCapability({
+				kind: "router_ab_ed25519_yao_active_capability_lookup_v1",
+				walletId: input.walletId,
+				nearEd25519SigningKeyId: signer.nearEd25519SigningKeyId,
+				signerSlot: signer.signerSlot,
+				signingWorkerId: signer.signingWorkerId,
+				participantIds: signer.participantIds
+			});
+			if (!active.ok) {
+				if (active.code === "unknown_capability") {
+					if (!sameRouterAbMpcMaterialActivationRef(signer.activeYaoCapability.activationResult.binding.material_activation, input.materialActivation)) return {
+						ok: false,
+						code: "not_found",
+						message: "Ed25519 material activation does not match the persisted capability"
+					};
+					return await activeEd25519MaterialFromPersistedSigner(signer);
+				}
+				return {
+					ok: false,
+					code: "internal",
+					message: active.message
+				};
+			}
+			if (!sameRouterAbMpcMaterialActivationRef(active.capability.materialActivation, input.materialActivation)) return {
+				ok: false,
+				code: "not_found",
+				message: "Ed25519 material activation does not match the active capability"
+			};
+			return {
+				ok: true,
+				materialActivation: active.capability.materialActivation,
+				nearAccountId: active.capability.nearAccountId,
+				signerSlot: signer.signerSlot,
+				signingWorkerId: signer.signingWorkerId,
+				participantIds: signer.participantIds,
+				runtimePolicyScope: active.capability.runtimePolicyScope,
+				exportIdentity: await ed25519ExportIdentityFromActiveCapability(active.capability)
+			};
+		} catch (error) {
+			return {
+				ok: false,
+				code: "internal",
+				message: error instanceof Error ? error.message : "Ed25519 material lookup failed"
+			};
+		}
+	}
+	async resolveEcdsaMaterialActivation(input) {
+		try {
+			const walletId = walletIdFromString(input.walletId);
+			const store = this.getWalletStore();
+			const signer = await store.getEcdsaSignerByMaterialActivation({
+				walletId,
+				materialActivation: input.materialActivation
+			});
+			if (signer) return {
+				ok: true,
+				materialActivation: signer.walletKey.publicCapability.material_activation,
+				keyHandle: signer.walletKey.keyHandle,
+				relayerKeyId: signer.walletKey.relayerKeyId,
+				participantIds: signer.walletKey.participantIds,
+				runtimePolicyScope: signer.runtimePolicyScope,
+				routerAbEcdsaDerivationNormalSigning: buildPostRegistrationEcdsaNormalSigningState({
+					walletKey: signer.walletKey,
+					publicCapability: signer.walletKey.publicCapability
+				})
+			};
+			const linkedDeviceReader = this.getLinkedDeviceEd25519AuthorityReader();
+			const projection = linkedDeviceReader?.readInstalledEcdsaAuthorityByMaterialActivationV1 ? await linkedDeviceReader.readInstalledEcdsaAuthorityByMaterialActivationV1({
+				walletId,
+				materialActivation: routerAbMpcMaterialActivationRefFromWire(input.materialActivation)
+			}) : null;
+			if (!projection) return {
+				ok: false,
+				code: "not_found",
+				message: "ECDSA material activation is not active for this wallet"
+			};
+			const matchingSourceSigners = (await store.listEcdsaSignersForWallet({ walletId })).filter((candidate) => linkedEcdsaProjectionMatchesSigner({
+				projection,
+				signer: candidate
+			}));
+			const canonicalSigner = matchingSourceSigners[0];
+			if (!canonicalSigner) return {
+				ok: false,
+				code: "not_found",
+				message: "Linked ECDSA material has no canonical custody source"
+			};
+			if (matchingSourceSigners.some((candidate) => !sameLinkedEcdsaResolvedSignerIdentity(canonicalSigner, candidate))) return {
+				ok: false,
+				code: "internal",
+				message: "Linked ECDSA material has conflicting custody source identities"
+			};
+			return {
+				ok: true,
+				materialActivation: routerAbMpcMaterialActivationRefToWire(projection.materialActivation),
+				keyHandle: canonicalSigner.walletKey.keyHandle,
+				relayerKeyId: canonicalSigner.walletKey.relayerKeyId,
+				participantIds: canonicalSigner.walletKey.participantIds,
+				runtimePolicyScope: canonicalSigner.runtimePolicyScope,
+				routerAbEcdsaDerivationNormalSigning: projection.activationReceipt.normalSigning
+			};
+		} catch (error) {
+			return {
+				ok: false,
+				code: "internal",
+				message: error instanceof Error ? error.message : "ECDSA material lookup failed"
+			};
+		}
+	}
+	async resolveActiveEd25519TenantRoot(input) {
+		const activeMaterial = await this.resolveEd25519MaterialActivation(input);
+		if (!activeMaterial.ok) return activeMaterial;
+		const identity = resolveTenantRootIdentityV1({
+			kind: "ed25519_b5_active_material",
+			activeMaterial
+		});
+		if (!identity.ok) return {
+			ok: false,
+			code: "invalid_state",
+			message: identity.message
+		};
+		try {
+			const tenantRoot = await this.tenantRootCustodyLineage.resolveActiveLineageForRuntimeScope(identity.identity);
+			if (!tenantRoot) return {
+				ok: false,
+				code: "not_found",
+				message: "Ed25519 tenant root is not active"
+			};
+			return {
+				ok: true,
+				...tenantRoot
+			};
+		} catch (error) {
+			return {
+				ok: false,
+				code: "internal",
+				message: error instanceof Error ? error.message : "Ed25519 tenant-root lookup failed"
+			};
+		}
+	}
+	async resolveActiveEcdsaTenantRoot(input) {
+		const activeMaterial = await this.resolveEcdsaMaterialActivation(input);
+		if (!activeMaterial.ok) return activeMaterial;
+		const identity = resolveTenantRootIdentityV1({
+			kind: "ecdsa_b5_active_material",
+			activeMaterial
+		});
+		if (!identity.ok) return {
+			ok: false,
+			code: "invalid_state",
+			message: identity.message
+		};
+		try {
+			const tenantRoot = await this.tenantRootCustodyLineage.resolveActiveLineageForRuntimeScope(identity.identity);
+			if (!tenantRoot) return {
+				ok: false,
+				code: "not_found",
+				message: "ECDSA tenant root is not active"
+			};
+			return {
+				ok: true,
+				...tenantRoot
+			};
+		} catch (error) {
+			return {
+				ok: false,
+				code: "internal",
+				message: error instanceof Error ? error.message : "ECDSA tenant-root lookup failed"
+			};
+		}
+	}
+	async listWalletEcdsaKeyFactsInventory(input) {
+		const store = this.getWalletStore();
+		return await listThresholdEcdsaKeyIdentityTargetsForUser({
+			userId: input.walletId,
+			rpId: input.rpId,
+			keyTargets: input.keyTargets,
+			getEcdsaSignerByKeyHandle: store.getEcdsaSignerByKeyHandle.bind(store)
+		});
+	}
+	async listWalletEcdsaCustodyContinuity(input) {
+		return await this.getWalletStore().listEcdsaSignersForWallet({ walletId: walletIdFromString(input.walletId) });
+	}
+	async recordEcdsaPostRegistrationProof(input) {
+		try {
+			const nowMs = Date.now();
+			if (input.request.expires_at_ms <= nowMs || !postRegistrationProofMatchesRequest(input)) return {
+				ok: false,
+				code: "scope_mismatch",
+				message: "ECDSA post-registration proof does not match its admitted request"
+			};
+			const walletId = walletIdFromString(input.request.lifecycle.account_id);
+			if (input.request.client_id !== walletId || input.request.lifecycle.root_share_epoch === "") return {
+				ok: false,
+				code: "identity_mismatch",
+				message: "ECDSA post-registration proof has an invalid wallet identity"
+			};
+			const store = this.getWalletStore();
+			const signer = await store.getEcdsaSignerByPostRegistrationRequest({
+				walletId,
+				request: input.request
+			});
+			if (!signer) return {
+				ok: false,
+				code: "not_found",
+				message: "ECDSA post-registration public capability is not registered"
+			};
+			if (input.request.previous_activation_epoch !== signer.walletKey.publicCapability.activation_epoch) return {
+				ok: false,
+				code: "scope_mismatch",
+				message: "ECDSA post-registration request uses a stale activation epoch"
+			};
+			await store.putEcdsaPendingSessionActivation(pendingEcdsaSessionActivationRecord({
+				proof: input,
+				walletId,
+				publicCapability: signer.walletKey.publicCapability,
+				nowMs
+			}));
+			return { ok: true };
+		} catch (error) {
+			return {
+				ok: false,
+				code: "internal",
+				message: errorMessage(error) || "Failed to persist ECDSA post-registration proof"
+			};
+		}
+	}
+	async activateEcdsaPostRegistrationSession(input) {
+		try {
+			const nowMs = Date.now();
+			const walletId = walletIdFromString(input.public_capability.client_id);
+			const signer = await this.getWalletStore().getEcdsaSignerByPublicCapability({
+				walletId,
+				publicCapability: input.public_capability
+			});
+			if (!signer) return {
+				ok: false,
+				code: "not_found",
+				message: "ECDSA public capability is not registered for this wallet"
+			};
+			const walletKey = signer.walletKey;
+			const signingRootScope = signingRootScopeFromRuntimePolicyScope(input.session_policy.runtime_policy_scope);
+			if (signingRootScope.signingRootId !== walletKey.signingRootId || signingRootScope.signingRootVersion !== walletKey.signingRootVersion) return {
+				ok: false,
+				code: "scope_mismatch",
+				message: "ECDSA session policy is outside the registered signing-root scope"
+			};
+			const normalSigning = buildPostRegistrationEcdsaNormalSigningState({
+				walletKey,
+				publicCapability: input.public_capability
+			});
+			return {
+				ok: true,
+				walletKey,
+				session: {
+					thresholdSessionId: input.session_policy.threshold_session_id,
+					expiresAtMs: nowMs + input.session_policy.ttl_ms,
+					remainingUses: input.session_policy.remaining_uses
+				},
+				normalSigning,
+				keyManifestDigestB64u: parseDigestB64u(signer.custodyKeyManifestDigestB64u)
+			};
+		} catch (error) {
+			return {
+				ok: false,
+				code: "internal",
+				message: errorMessage(error) || "Failed to activate ECDSA post-registration session"
+			};
+		}
+	}
+	async refreshEd25519YaoWalletSession(request) {
+		try {
+			const policy = request.sessionPolicy;
+			const authorization = request.authorization;
+			const authority = policy.authority;
+			const runtimePolicyScope = policy.runtimePolicyScope;
+			const routerAbNormalSigning = policy.routerAbNormalSigning;
+			const participantIds = normalizeThresholdEd25519ParticipantIds(policy.participantIds);
+			if (!runtimePolicyScope || !routerAbNormalSigning || !participantIds || participantIds.length !== 2 || !walletAuthAuthoritiesMatch(authority, authorization.authority)) return {
+				ok: false,
+				code: "invalid_body",
+				message: "Ed25519 Yao budget refresh policy is invalid"
+			};
+			if (!isPasskeyWalletAuthAuthority(authority)) return {
+				ok: false,
+				code: "invalid_body",
+				message: "Ed25519 Yao passkey budget refresh requires passkey authority"
+			};
+			const firstParticipantId = participantIds[0];
+			const secondParticipantId = participantIds[1];
+			if (firstParticipantId === void 0 || secondParticipantId === void 0) return {
+				ok: false,
+				code: "invalid_body",
+				message: "Ed25519 Yao budget refresh requires exactly two participants"
+			};
+			const exactParticipantIds = [firstParticipantId, secondParticipantId];
+			const yaoRuntime = this.getEd25519YaoProductRegistration();
+			if (!yaoRuntime) return {
+				ok: false,
+				code: "not_configured",
+				message: "Ed25519 Yao Wallet Session refresh is not configured"
+			};
+			if (policy.relayerKeyId !== yaoRuntime.signingWorkerId || routerAbNormalSigning.signingWorkerId !== yaoRuntime.signingWorkerId) return {
+				ok: false,
+				code: "scope_mismatch",
+				message: "Ed25519 Yao budget refresh does not match the active Wallet Session"
+			};
+			const activeAuthority = await this.walletAuthMethods.verifyActivePasskeyAuthority(authorization.authority);
+			if (!activeAuthority.ok) return activeAuthority;
+			const signingRoot = signingRootScopeFromRuntimePolicyScope(runtimePolicyScope);
+			const signingRootVersion = normalizeOptionalTrimmedString(signingRoot.signingRootVersion);
+			if (!signingRootVersion) return {
+				ok: false,
+				code: "invalid_body",
+				message: "Ed25519 Yao budget refresh requires a signing-root version"
+			};
+			const signer = await this.getWalletStore().getEd25519Signer({
+				walletId: authority.walletId,
+				nearAccountId: policy.nearAccountId,
+				nearEd25519SigningKeyId: policy.nearEd25519SigningKeyId
+			});
+			if (!signer || signer.signingWorkerId !== yaoRuntime.signingWorkerId || !sameEd25519ParticipantIds(signer.participantIds, exactParticipantIds) || signer.signingRootId !== signingRoot.signingRootId || signer.signingRootVersion !== signingRootVersion || !sameWalletRuntimePolicyScope(signer.runtimePolicyScope, runtimePolicyScope)) return {
+				ok: false,
+				code: "not_found",
+				message: "Registered Ed25519 Yao signer does not match the refresh policy"
+			};
+			const issuedAtMs = Date.now();
+			const expiresAtMs = issuedAtMs + DEFAULT_WALLET_SESSION_TTL_MS;
+			const remainingUses = Math.min(3, policy.remainingUses);
+			await assertDirectWalletSessionOwnerProof({
+				proof: authorization.proof,
+				tenantId: this.authorizationTenantId,
+				authority,
+				activeAuthority: activeAuthority.authority,
+				walletAuthMethodId: activeAuthority.authMethod.walletAuthMethodId,
+				nowMs: issuedAtMs
+			});
+			const directIssue = await this.authorizationService.issueDirectWalletSessionAuthorizationV2({
+				tenantId: this.authorizationTenantId,
+				principalId: walletSessionPrincipalId(authority),
+				walletId: activeAuthority.authority.walletId,
+				authority: activeAuthority.authority,
+				walletAuthMethodId: activeAuthority.authMethod.walletAuthMethodId,
+				mintId: requireWalletSessionMintId(authorization.verifiedChallengeId),
+				remainingUses,
+				issuedAtMs,
+				expiresAtMs
+			});
+			if (directIssue.kind === "already_committed") return ed25519AlreadyCommittedWalletSessionResponse(directIssue);
+			const sessionInput = {
+				kind: "same_identity_budget_refresh_v1",
+				walletId: authority.walletId,
+				nearAccountId: policy.nearAccountId,
+				nearEd25519SigningKeyId: policy.nearEd25519SigningKeyId,
+				authority,
+				thresholdSessionId: policy.thresholdSessionId,
+				authorizationId: directIssue.session.authorizationId,
+				walletSessionId: directIssue.quota.walletSessionId,
+				quotaId: directIssue.quota.quotaId,
+				expiresAtMs: directIssue.session.expiresAtMs,
+				remainingUses: directIssue.quota.remainingUses,
+				participantIds: exactParticipantIds,
+				runtimePolicyScope,
+				keyManifestDigestB64u: parseDigestB64u(signer.custodyKeyManifestDigestB64u),
+				walletSessionCredential: {
+					kind: "issued_exact_wallet_session",
+					operationCredential: directIssue.operationCredential
+				}
+			};
+			const session = await projectRouterAbEd25519YaoExactWalletSession({
+				signingWorkerId: yaoRuntime.signingWorkerId,
+				sessionInput
+			});
+			if (session.sessionKind !== "issued_exact_wallet_session") throw new Error("Direct Ed25519 budget refresh did not project an issued session");
+			return {
+				ok: true,
+				walletId: session.walletId,
+				nearAccountId: session.nearAccountId,
+				nearEd25519SigningKeyId: session.nearEd25519SigningKeyId,
+				authorityScope: session.authorityScope,
+				thresholdSessionId: session.thresholdSessionId,
+				authorizationId: directIssue.session.authorizationId,
+				walletSessionId: session.walletSessionId,
+				quotaId: session.quotaId,
+				expiresAtMs: session.expiresAtMs,
+				expiresAt: new Date(session.expiresAtMs).toISOString(),
+				participantIds: exactParticipantIds,
+				remainingUses: session.remainingUses,
+				runtimePolicyScope,
+				routerAbNormalSigning,
+				sessionKind: "issued_exact_wallet_session",
+				operationCredential: session.operationCredential
+			};
+		} catch (error) {
+			return {
+				ok: false,
+				code: "internal",
+				message: errorMessage(error) || "Ed25519 Yao Wallet Session refresh failed"
+			};
+		}
+	}
+	async provisionEd25519YaoWalletSession(request) {
+		try {
+			const walletId = normalizeOptionalTrimmedString(request.walletId);
+			const verifiedChallengeId = normalizeOptionalTrimmedString(request.verifiedChallengeId);
+			const signerSlot = Math.floor(Number(request.signerSlot));
+			const remainingUses = Math.floor(Number(request.remainingUses));
+			if (!walletId || !verifiedChallengeId || !Number.isSafeInteger(signerSlot) || signerSlot < 1 || !Number.isSafeInteger(remainingUses) || remainingUses < 1) return {
+				ok: false,
+				code: "invalid_body",
+				message: "Verified Ed25519 Wallet Session request is invalid"
+			};
+			const yaoRuntime = this.getEd25519YaoProductRegistration();
+			if (!yaoRuntime) return {
+				ok: false,
+				code: "not_configured",
+				message: "Verified Ed25519 Wallet Session provisioning is not configured"
+			};
+			const authority = request.authority;
+			if (String(authority.walletId) !== walletId) return {
+				ok: false,
+				code: "scope_mismatch",
+				message: "Verified owner proof does not match the wallet authority"
+			};
+			let activeAuthority;
+			if (isPasskeyWalletAuthAuthority(authority)) {
+				const verified = await this.walletAuthMethods.verifyActivePasskeyAuthority(authority);
+				if (!verified.ok) return verified;
+				activeAuthority = verified;
+			} else if (isEmailOtpWalletAuthAuthority(authority)) {
+				const resolved = await this.walletAuthMethods.resolveActiveEmailOtpAuthorityForUnlock({
+					walletId: walletIdFromString(walletId),
+					walletAuthMethodId: authority.bindingId,
+					providerUserId: authority.factor.providerUserId,
+					emailHashHex: authority.verifier.emailHashHex
+				});
+				if (resolved.kind === "rejected") return {
+					ok: false,
+					code: resolved.code,
+					message: resolved.message
+				};
+				if (!walletAuthAuthoritiesMatch(resolved.walletAuthAuthority, authority)) return {
+					ok: false,
+					code: "unauthorized",
+					message: "Verified Email OTP authority does not match the active auth method"
+				};
+				activeAuthority = resolved;
+			} else return {
+				ok: false,
+				code: "invalid_body",
+				message: "Verified Ed25519 Wallet Session authority is invalid"
+			};
+			const signer = await this.getWalletStore().getEd25519SignerBySlot({
+				walletId: walletIdFromString(walletId),
+				signerSlot
+			});
+			const firstParticipantId = signer?.participantIds[0];
+			const secondParticipantId = signer?.participantIds[1];
+			if (!signer || signer.walletId !== walletId || signer.signerSlot !== signerSlot || signer.signingWorkerId !== yaoRuntime.signingWorkerId || firstParticipantId === void 0 || secondParticipantId === void 0) return {
+				ok: false,
+				code: "not_found",
+				message: "Registered Ed25519 Yao signer is unavailable for wallet unlock"
+			};
+			const participantIds = [firstParticipantId, secondParticipantId];
+			const signingRoot = signingRootScopeFromRuntimePolicyScope(signer.runtimePolicyScope);
+			if (signingRoot.signingRootId !== signer.signingRootId || signingRoot.signingRootVersion !== signer.signingRootVersion) return {
+				ok: false,
+				code: "invalid_state",
+				message: "Registered Ed25519 Yao signer has inconsistent signing-root scope"
+			};
+			const capability = await yaoRuntime.resolveActiveCapability({
+				kind: "router_ab_ed25519_yao_active_capability_lookup_v1",
+				walletId,
+				nearEd25519SigningKeyId: signer.nearEd25519SigningKeyId,
+				signerSlot,
+				signingWorkerId: signer.signingWorkerId,
+				participantIds
+			});
+			if (!capability.ok) return capability;
+			const descriptor = capability.capability;
+			if (descriptor.applicationBinding.wallet_id !== walletId || descriptor.applicationBinding.near_ed25519_signing_key_id !== signer.nearEd25519SigningKeyId || descriptor.applicationBinding.key_creation_signer_slot !== signerSlot || descriptor.applicationBinding.signing_root_id !== signer.signingRootId || descriptor.nearAccountId !== signer.nearAccountId || descriptor.lifecycle.accountId !== walletId || descriptor.lifecycle.signerSetId !== String(registrationNearEd25519BranchKey(signerSlot)) || descriptor.lifecycle.signingWorkerId !== signer.signingWorkerId || descriptor.lifecycle.rootShareEpoch !== signer.signingRootVersion || ed25519NearPublicKeyFromBytes(descriptor.registeredPublicKey) !== signer.publicKey || !sameEd25519ParticipantIds(descriptor.participantIds, participantIds) || !sameWalletRuntimePolicyScope(descriptor.runtimePolicyScope, signer.runtimePolicyScope)) return {
+				ok: false,
+				code: "capability_conflict",
+				message: "Active Ed25519 Yao capability does not match the registered signer"
+			};
+			let thresholdSessionId = descriptor.lifecycle.thresholdSessionId;
+			let issuedCapability = descriptor;
+			if (activeAuthority.authority.provenance.kind === "device_link") {
+				const linkedDeviceReader = this.getLinkedDeviceEd25519AuthorityReader();
+				const projection = linkedDeviceReader ? await linkedDeviceReader.readInstalledEd25519AuthorityByIdentityV1({
+					walletId: walletIdFromString(walletId),
+					authorityId: activeAuthority.authority.authorityId,
+					walletAuthMethodId: activeAuthority.authMethod.walletAuthMethodId
+				}) : null;
+				if (!projection || !linkedEd25519ProjectionMatchesSigner({
+					projection,
+					walletId,
+					authority: activeAuthority.authority,
+					authMethodId: activeAuthority.authMethod.walletAuthMethodId,
+					signer
+				}) || !linkedEd25519ProjectionMatchesDescriptor({
+					projection,
+					descriptor
+				})) return {
+					ok: false,
+					code: "invalid_state",
+					message: "Linked Ed25519 authority installation does not match the active signer"
+				};
+				const targetSessionId = parseThresholdEd25519SessionId(projection.targetBinding.lifecycle.session_id);
+				if (!targetSessionId.ok) return {
+					ok: false,
+					code: "invalid_state",
+					message: "Linked Ed25519 authority installation has an invalid target session"
+				};
+				thresholdSessionId = targetSessionId.value;
+				issuedCapability = {
+					...descriptor,
+					materialActivation: linkedEd25519ProjectionMaterialActivationWire(projection),
+					lifecycle: {
+						...descriptor.lifecycle,
+						thresholdSessionId: targetSessionId.value
+					}
+				};
+			}
+			const issuedAtMs = Date.now();
+			let walletSessionIdentity;
+			switch (request.walletSessionIdentity.kind) {
+				case "new_wallet_session": {
+					const expiresAtMs = issuedAtMs + DEFAULT_WALLET_SESSION_TTL_MS;
+					const issuedRemainingUses = Math.min(3, remainingUses);
+					await assertDirectWalletSessionOwnerProof({
+						proof: request.proof,
+						tenantId: this.authorizationTenantId,
+						authority,
+						activeAuthority: activeAuthority.authority,
+						walletAuthMethodId: activeAuthority.authMethod.walletAuthMethodId,
+						nowMs: issuedAtMs
+					});
+					const directIssue = await this.authorizationService.issueDirectWalletSessionAuthorizationV2({
+						tenantId: this.authorizationTenantId,
+						principalId: walletSessionPrincipalId(authority),
+						walletId: activeAuthority.authority.walletId,
+						authority: activeAuthority.authority,
+						walletAuthMethodId: activeAuthority.authMethod.walletAuthMethodId,
+						mintId: requireWalletSessionMintId(verifiedChallengeId),
+						remainingUses: issuedRemainingUses,
+						issuedAtMs,
+						expiresAtMs
+					});
+					switch (directIssue.kind) {
+						case "issued":
+							walletSessionIdentity = {
+								authorizationId: directIssue.session.authorizationId,
+								walletSessionId: directIssue.quota.walletSessionId,
+								quotaId: directIssue.quota.quotaId,
+								expiresAtMs,
+								remainingUses: issuedRemainingUses,
+								walletSessionCredential: {
+									kind: "issued_exact_wallet_session",
+									operationCredential: directIssue.operationCredential
+								}
+							};
+							break;
+						case "already_committed": return ed25519AlreadyCommittedWalletSessionResponse(directIssue);
+						default: return assertNeverEd25519WalletSessionIssue(directIssue);
+					}
+					break;
+				}
+				case "reuse_wallet_session_v2": {
+					const requestedIdentity = request.walletSessionIdentity;
+					const existing = await this.authorizationService.readWalletSessionAuthorizationV2ByIdentity({
+						tenantId: this.authorizationTenantId,
+						walletId: walletIdFromString(walletId),
+						walletSessionId: requestedIdentity.walletSessionId,
+						authorizationId: requestedIdentity.authorizationId,
+						nowMs: issuedAtMs
+					});
+					if (!existing || existing.session.authorityId !== activeAuthority.authority.authorityId || existing.session.walletAuthMethodId !== activeAuthority.authMethod.walletAuthMethodId || existing.session.authorityDigestB64u !== activeAuthority.authority.authorityDigestB64u || existing.session.authorityRevocationEpoch !== activeAuthority.authority.revocationEpoch || existing.session.quotaId !== requestedIdentity.quotaId || existing.session.expiresAtMs !== requestedIdentity.expiresAtMs || existing.quota.remainingUses !== requestedIdentity.remainingUses || requestedIdentity.expiresAtMs <= issuedAtMs || requestedIdentity.remainingUses < 1) return {
+						ok: false,
+						code: "invalid_state",
+						message: "Linked Ed25519 Wallet Session identity is unavailable"
+					};
+					walletSessionIdentity = {
+						...requestedIdentity,
+						walletSessionCredential: { kind: "already_committed_exact_wallet_session" }
+					};
+					break;
+				}
+			}
+			return {
+				ok: true,
+				session: await projectRouterAbEd25519YaoExactWalletSession({
+					signingWorkerId: yaoRuntime.signingWorkerId,
+					sessionInput: {
+						kind: "verified_wallet_unlock_v1",
+						walletId: walletIdFromString(walletId),
+						nearAccountId: signer.nearAccountId,
+						nearEd25519SigningKeyId: signer.nearEd25519SigningKeyId,
+						authority,
+						thresholdSessionId,
+						authorizationId: walletSessionIdentity.authorizationId,
+						walletSessionId: walletSessionIdentity.walletSessionId,
+						quotaId: walletSessionIdentity.quotaId,
+						participantIds,
+						runtimePolicyScope: signer.runtimePolicyScope,
+						keyManifestDigestB64u: parseDigestB64u(signer.custodyKeyManifestDigestB64u),
+						expiresAtMs: walletSessionIdentity.expiresAtMs,
+						remainingUses: walletSessionIdentity.remainingUses,
+						walletSessionCredential: walletSessionIdentity.walletSessionCredential
+					}
+				}),
+				capability: issuedCapability
+			};
+		} catch (error) {
+			return {
+				ok: false,
+				code: "internal",
+				message: errorMessage(error) || "Verified Ed25519 Wallet Session provisioning failed"
+			};
+		}
+	}
+	/**
+	* Refactor 94C. `/wallets/register/setup` — grant, intent, and start in one
+	* request, with one D1 write.
+	*
+	* Setup runs before the client's WebAuthn create, because it issues the
+	* challenge that create signs. So the ECDSA prepare and the Ed25519
+	* admission — the two Router calls that dominated the measured cold path —
+	* overlap the authenticator prompt instead of being serialized after it.
+	* They are started before either is awaited: they share no state and neither
+	* can invalidate the other.
+	*/
+	async setupWalletRegistration(input) {
+		const timing = createD1RegistrationRouteTimingRecorder("wallets_register_setup");
+		const total = startD1RegistrationRouteTiming("registerSetupTotalMs");
+		try {
+			const normalized = normalizeWalletRegistrationSetupRequest(input.request);
+			if (!normalized.ok) return walletRegistrationSetupError(normalized.code, normalized.message);
+			const wallet = resolveWalletRegistrationSetupWalletId({
+				wallet: input.request?.wallet,
+				parseProvided: parseWalletIdForIntent,
+				createServerAllocated: createD1ServerAllocatedWalletId
+			});
+			if (!wallet.ok) return walletRegistrationSetupError(wallet.code, wallet.message);
+			const runtimePolicyScope = input.runtimePolicyScope || inferRuntimePolicyScopeFromSigningRoot({
+				orgId: input.orgId,
+				signingRootId: input.signingRootId,
+				signingRootVersion: input.signingRootVersion
+			});
+			const signingRootId = normalizeOptionalTrimmedString(input.signingRootId) || (runtimePolicyScope ? deriveSigningRootId(runtimePolicyScope) : "");
+			const signingRootVersion = normalizeOptionalTrimmedString(input.signingRootVersion) || runtimePolicyScope?.signingRootVersion || "default";
+			if (!signingRootId) return walletRegistrationSetupError("invalid_body", "registration requires a signing root");
+			const registrationOperation = allocateWalletRegistrationOperationPrepared();
+			const intent = buildRegistrationIntent({
+				walletId: wallet.walletId,
+				authMethod: normalized.authMethod,
+				signerSelection: normalized.signerSelection,
+				foundingWalletAuthMethodId: registrationOperation.walletAuthMethodId,
+				...runtimePolicyScope ? { runtimePolicyScope } : {}
+			});
+			const digestB64u = await walletRegistrationSetupIntentDigest(intent);
+			const branches = registrationIntentSignerBranches(intent);
+			if (!branches.ok) return walletRegistrationSetupError(branches.code, branches.message);
+			const ecdsaBranch = branches.value.evmFamilyEcdsa;
+			const nearEd25519Branch = branches.value.nearEd25519;
+			if (!ecdsaBranch && !nearEd25519Branch) return walletRegistrationSetupError("invalid_body", "registration signer branch is required");
+			const preparedContext = resolveRegistrationPreparedContextFromPlan({
+				signerPlan: branches.value.plan,
+				runtimePolicyScope,
+				signingRootId,
+				signingRootVersion
+			});
+			if (!preparedContext.ok) return walletRegistrationSetupError(preparedContext.code, preparedContext.message);
+			if (ecdsaBranch && !runtimePolicyScope) return walletRegistrationSetupError("invalid_body", "ECDSA registration requires an exact runtime policy scope");
+			const chainTargets = ecdsaBranch ? registrationPreparedContextEcdsaChainTargets(preparedContext.preparedContext) : null;
+			if (ecdsaBranch && !chainTargets) return walletRegistrationSetupError("invalid_body", "ECDSA chain targets are required");
+			const expiresAtMs = walletRegistrationSetupExpiresAtMs(Date.now());
+			const { registrationCeremonyId, registrationPreparationId } = walletRegistrationSetupIds();
+			const ecdsaPrepared = ecdsaBranch && chainTargets && runtimePolicyScope ? await buildD1EvmFamilyEcdsaRegistrationPrepare({
+				registrationPurpose: "wallet_registration",
+				registrationCeremonyId,
+				registrationPreparationId: registrationPreparationIdFromString(registrationPreparationId),
+				walletId: wallet.walletId,
+				signingRootId,
+				signingRootVersion,
+				chainTargets,
+				participantIds: [...ecdsaBranch.participantIds],
+				strictRegistration: this.ecdsaStrictRegistration,
+				runtimePolicyScope
+			}) : null;
+			if (ecdsaPrepared && !ecdsaPrepared.ok) return walletRegistrationSetupError(ecdsaPrepared.code, ecdsaPrepared.message);
+			const storedBranches = [];
+			if (ecdsaPrepared?.ok && ecdsaBranch) storedBranches.push(buildStoredWalletRegistrationEvmFamilyEcdsaPreparedBranch({
+				branchKey: ecdsaBranch.branchKey,
+				ecdsa: {
+					kind: ecdsaPrepared.ecdsa.kind,
+					chainTargets: ecdsaPrepared.ecdsa.chainTargets,
+					prepare: ecdsaPrepared.ecdsa.prepare,
+					strictRegistration: ecdsaPrepared.ecdsa.strictRegistration,
+					strictRegistrationBindingJson: routerAbEcdsaStrictRegistrationFactsBindingJson(ecdsaPrepared.ecdsa.strictRegistration)
+				}
+			}));
+			const ceremony = {
+				registrationCeremonyId,
+				foundingWalletAuthorityId: registrationOperation.walletAuthorityId,
+				foundingDeviceId: registrationOperation.deviceId,
+				foundingWalletAuthMethodId: registrationOperation.walletAuthMethodId,
+				intent,
+				digestB64u,
+				signerPlan: branches.value.plan,
+				preparedContext: preparedContext.preparedContext,
+				orgId: normalizeOptionalTrimmedString(input.orgId) || "",
+				signingRootId,
+				signingRootVersion,
+				...input.expectedOrigin ? { expectedOrigin: input.expectedOrigin } : {},
+				expiresAtMs,
+				authorityState: {
+					kind: "awaiting_proof",
+					authMethod: normalized.authMethod
+				},
+				signerState: {
+					kind: "signer_set_registration",
+					branches: storedBranches
+				}
+			};
+			const ceremonyWriteTiming = startD1RegistrationRouteTiming("registrationCeremonyInsertMs");
+			try {
+				await this.getRegistrationCeremonyIntentStore().putCeremony(ceremony);
+			} finally {
+				finishD1RegistrationRouteTiming(timing, ceremonyWriteTiming);
+			}
+			const { signedSetup } = await buildWalletRegistrationSetupSignature({
+				signer: input.signer,
+				ceremony,
+				expectedOrigin: input.expectedOrigin
+			});
+			finishD1RegistrationRouteTiming(timing, total);
+			const success = {
+				ok: true,
+				registrationCeremonyId,
+				walletId: String(wallet.walletId),
+				walletAuthMethodId: registrationOperation.walletAuthMethodId,
+				registrationIntentDigestB64u: digestB64u,
+				intent,
+				signedSetup
+			};
+			if (!ecdsaPrepared?.ok || !ecdsaBranch) return {
+				...success,
+				kind: "near_ed25519"
+			};
+			return {
+				...success,
+				kind: nearEd25519Branch ? "near_ed25519_and_evm_family_ecdsa" : "evm_family_ecdsa",
+				ecdsa: {
+					kind: ecdsaPrepared.ecdsa.kind,
+					chainTargets: ecdsaPrepared.ecdsa.chainTargets,
+					prepare: ecdsaPrepared.ecdsa.prepare,
+					strictRegistration: ecdsaPrepared.ecdsa.strictRegistration
+				}
+			};
+		} catch (error) {
+			return walletRegistrationSetupError("internal", errorMessage(error) || "Failed to set up wallet registration");
+		}
+	}
+	async respondWalletRegistration(input, traceContext) {
+		const serverTiming = [];
+		const totalStartedAtMs = Date.now();
+		const mark = (name, startedAtMs) => {
+			serverTiming.push([name, Math.max(0, Date.now() - startedAtMs)]);
+		};
+		try {
+			const store = this.getRegistrationCeremonyIntentStore();
+			const loadStartedAtMs = Date.now();
+			const snapshot = await store.getCeremonySnapshot(input.registrationCeremonyId);
+			mark("respond_d1_load", loadStartedAtMs);
+			if (!snapshot) return {
+				ok: false,
+				code: "not_found",
+				message: "registration ceremony not found"
+			};
+			const ceremony = snapshot.ceremony;
+			if (ceremony.signerState.kind !== "signer_set_registration") return {
+				ok: false,
+				code: "invalid_state",
+				message: "signer-set registration state is required"
+			};
+			const expectedOrigin = normalizeOptionalTrimmedString(ceremony.expectedOrigin) || "";
+			const setupDigestB64u = await computeWalletRegistrationSetupDigestB64u({
+				registrationCeremonyId: ceremony.registrationCeremonyId,
+				intent: ceremony.intent,
+				intentDigestB64u: ceremony.digestB64u,
+				orgId: ceremony.orgId,
+				signingRootId: normalizeOptionalTrimmedString(ceremony.signingRootId) || "",
+				signingRootVersion: normalizeOptionalTrimmedString(ceremony.signingRootVersion) || "",
+				expectedOrigin
+			});
+			const verifiedSetup = await verifySignedWalletRegistrationSetup(input.verifier, input.signedSetup, {
+				registrationCeremonyId: ceremony.registrationCeremonyId,
+				setupDigestB64u,
+				nowMs: Date.now()
+			});
+			if (!verifiedSetup.ok) return {
+				ok: false,
+				code: verifiedSetup.code,
+				message: verifiedSetup.message
+			};
+			const registrationBearerToken = normalizeOptionalTrimmedString(input.signedSetup);
+			if (!registrationBearerToken) return {
+				ok: false,
+				code: "invalid_body",
+				message: "signedSetup is required"
+			};
+			const ecdsaBranch = findStoredWalletRegistrationEvmFamilyEcdsaBranch(ceremony.signerState);
+			const planNearEd25519 = registrationSignerBranchesFromPlan(ceremony.signerPlan).nearEd25519;
+			if (!ecdsaBranch && !planNearEd25519) return {
+				ok: false,
+				code: "invalid_state",
+				message: "a signer branch is required"
+			};
+			const ceremonyIsEd25519Only = !ecdsaBranch && Boolean(planNearEd25519);
+			if (input.planKind === "near_ed25519" !== ceremonyIsEd25519Only) return {
+				ok: false,
+				code: "scope_mismatch",
+				message: "respond signer plan does not match the registration ceremony"
+			};
+			if (!ecdsaBranch && planNearEd25519) return await this.respondEd25519OnlyRegistration({
+				snapshot,
+				ceremony,
+				branch: planNearEd25519,
+				authorityInput: input.authority,
+				registrationBearerToken,
+				expectedOrigin,
+				...input.userAgent ? { userAgent: input.userAgent } : {}
+			});
+			if (!ecdsaBranch) return {
+				ok: false,
+				code: "invalid_state",
+				message: "ECDSA branch is required"
+			};
+			if (!input.ecdsa) return {
+				ok: false,
+				code: "invalid_body",
+				message: "strict Router A/B ECDSA registration request is required"
+			};
+			const strictRegistration = input.ecdsa.strictRegistration;
+			const strictRegistrationBindingJson = routerAbEcdsaStrictRegistrationRequestBindingJson(strictRegistration);
+			if (ecdsaBranch.kind === "evm_family_ecdsa_pending_activation") {
+				if (!sameRouterAbEcdsaRegistrationRequest(ecdsaBranch.registrationRequest, strictRegistration)) return {
+					ok: false,
+					code: "scope_mismatch",
+					message: "ECDSA registration replay changed the exact request"
+				};
+				const replayAuthority = await this.verifyRespondReplayAuthority({
+					ceremony,
+					authorityInput: input.authority,
+					expectedOrigin,
+					...input.userAgent ? { userAgent: input.userAgent } : {}
+				});
+				if (!replayAuthority.ok) return {
+					ok: false,
+					code: replayAuthority.code,
+					message: replayAuthority.message
+				};
+				return walletRegistrationRespondResult({
+					ceremony,
+					strictResult: ecdsaBranch.publicResponse,
+					ed25519: storedRespondEd25519DeferredWork(ceremony.signerState)
+				});
+			}
+			if (ecdsaBranch.kind !== "evm_family_ecdsa_prepared") return {
+				ok: false,
+				code: "invalid_state",
+				message: "ECDSA registration branch is not respondable"
+			};
+			if (ecdsaBranch.strictRegistrationBindingJson !== strictRegistrationBindingJson) return {
+				ok: false,
+				code: "scope_mismatch",
+				message: "ECDSA registration request does not match the admitted ceremony facts"
+			};
+			const authorityStartedAtMs = Date.now();
+			const verifiedAuthority = await this.walletAuthMethods.verifyRegistrationAuthorityForIntent({
+				orgId: ceremony.orgId,
+				authority: input.authority,
+				expectedDigestB64u: ceremony.digestB64u,
+				expectedOrigin,
+				intent: ceremony.intent,
+				verificationOperationId: ceremony.registrationCeremonyId,
+				verificationReceiptExpiresAtMs: ceremony.expiresAtMs,
+				...input.userAgent ? { userAgent: input.userAgent } : {}
+			});
+			mark("respond_authority_verify", authorityStartedAtMs);
+			if (!verifiedAuthority.ok) return {
+				ok: false,
+				code: verifiedAuthority.code,
+				message: verifiedAuthority.message
+			};
+			const authority = verifiedAuthority.authority;
+			if (authority.walletId !== ceremony.intent.walletId) return {
+				ok: false,
+				code: "scope_mismatch",
+				message: "registration authority walletId does not match the ceremony"
+			};
+			const tenantRootIdentity = registrationTenantRootIdentity(ceremony.preparedContext);
+			if (!tenantRootIdentity) return {
+				ok: false,
+				code: "invalid_state",
+				message: "ECDSA registration has no authoritative tenant-root identity"
+			};
+			const tenantRoot = await this.tenantRootCustodyLineage.resolveActiveLineageForRuntimeScope(tenantRootIdentity);
+			if (!tenantRoot) return {
+				ok: false,
+				code: "invalid_state",
+				message: "ECDSA registration tenant root is not active"
+			};
+			const routerStartedAtMs = Date.now();
+			const nearEd25519Branch = registrationSignerBranchesFromPlan(ceremony.signerPlan).nearEd25519;
+			const [strictResult, ed25519Admission] = await Promise.all([this.ecdsaStrictRegistration.registerWithTenantRoot({
+				request: strictRegistration,
+				tenantRoot,
+				requestPolicy: {
+					policyVersion: WALLET_REGISTRATION_ROUTER_POLICY_VERSION,
+					requestDigestB64u: input.ecdsa.requestDigestB64u
+				},
+				authority: ecdsaStrictRegistrationAuthority(ecdsaBranch.strictRegistration),
+				traceContext,
+				onServerTiming: (header) => mergeRouterServerTiming(serverTiming, header),
+				onHeaderPresence: (presence) => serverTiming.push([`ecdsa_role_timing_${presence.serverTiming}`, 1])
+			}), this.admitRespondEd25519Branch({
+				ceremony,
+				branch: nearEd25519Branch,
+				authority,
+				registrationBearerToken
+			})]);
+			mark("respond_router", routerStartedAtMs);
+			if (!strictResult.ok) {
+				if (!strictResult.retryable) await store.cancelTerminalCeremony({
+					registrationCeremonyId: ceremony.registrationCeremonyId,
+					walletId: ceremony.intent.walletId
+				});
+				return {
+					ok: false,
+					code: strictResult.code,
+					message: strictResult.message
+				};
+			}
+			if (!ed25519Admission.ok) return {
+				ok: false,
+				code: ed25519Admission.code,
+				message: ed25519Admission.message
+			};
+			let nextSignerState = replaceStoredWalletRegistrationSignerBranch({
+				state: ceremony.signerState,
+				replacement: {
+					kind: "evm_family_ecdsa_pending_activation",
+					branchKey: ecdsaBranch.branchKey,
+					derivationKind: ecdsaBranch.derivationKind,
+					chainTargets: ecdsaBranch.chainTargets,
+					prepare: ecdsaBranch.prepare,
+					strictRegistration: ecdsaBranch.strictRegistration,
+					strictRegistrationBindingJson: ecdsaBranch.strictRegistrationBindingJson,
+					registrationRequest: strictRegistration,
+					pendingActivation: strictResult.value.pendingActivation,
+					publicResponse: strictResult.value.publicResponse
+				}
+			});
+			if (ed25519Admission.branch) nextSignerState = {
+				kind: "signer_set_registration",
+				branches: [ed25519Admission.branch, ...nextSignerState.branches]
+			};
+			const next = {
+				...ceremony,
+				authorityState: {
+					kind: "verified",
+					authority
+				},
+				signerState: nextSignerState
+			};
+			const commitStartedAtMs = Date.now();
+			try {
+				await store.commitEcdsaClaim({
+					expected: snapshot,
+					next
+				});
+			} catch (error) {
+				const reconciled = await store.getCeremony(input.registrationCeremonyId);
+				const reconciledBranch = reconciled?.signerState.kind === "signer_set_registration" ? findStoredWalletRegistrationEvmFamilyEcdsaBranch(reconciled.signerState) : null;
+				if (!reconciled || reconciledBranch?.kind !== "evm_family_ecdsa_pending_activation" || !sameRouterAbEcdsaRegistrationRequest(reconciledBranch.registrationRequest, strictRegistration)) throw error;
+				mark("respond_d1_commit", commitStartedAtMs);
+				mark("respond_total", totalStartedAtMs);
+				return walletRegistrationRespondResult({
+					ceremony: reconciled,
+					strictResult: reconciledBranch.publicResponse,
+					ed25519: storedRespondEd25519DeferredWork(reconciled.signerState)
+				});
+			}
+			mark("respond_d1_commit", commitStartedAtMs);
+			mark("respond_total", totalStartedAtMs);
+			return walletRegistrationRespondResult({
+				ceremony: next,
+				strictResult: strictResult.value.publicResponse,
+				ed25519: ed25519Admission.deferred
+			});
+		} catch (error) {
+			return {
+				ok: false,
+				code: "internal",
+				message: errorMessage(error) || "Failed to respond to wallet registration ceremony"
+			};
+		}
+	}
+	/**
+	* The Ed25519 commit core, extracted so deferred provisioning reaches it
+	* without going through the standalone finalize wrapper. The operation row
+	* owns idempotency here, so the commit keeps no replay cache of its own.
+	*/
+	async readRegistrationOwnerProofContext(registrationCeremonyId) {
+		const ceremony = await this.getRegistrationCeremonyIntentStore().getCeremony(registrationCeremonyId);
+		if (!ceremony) {
+			const committed = await this.readCommittedRegistrationInstallation(registrationCeremonyId);
+			if (!committed) return null;
+			if (!isRegistrationEcdsaReadyReceipt(committed.receipt)) throw new Error("Committed registration installation has no ECDSA session receipt");
+			const runtimePolicyScope = registrationPreparedContextRuntimePolicyScope(committed.projection.preparedContext);
+			if (!runtimePolicyScope) throw new Error("Committed registration is missing its runtime policy scope");
+			return {
+				expectedOrigin: committed.receipt.expectedOrigin,
+				runtimePolicyScope,
+				expiresAtMs: committed.receipt.expiresAtMs
+			};
+		}
+		const expectedOrigin = normalizeOptionalTrimmedString(ceremony.expectedOrigin);
+		const runtimePolicyScope = registrationPreparedContextRuntimePolicyScope(ceremony.preparedContext);
+		if (!expectedOrigin || !runtimePolicyScope) throw new Error("Registration is missing its session origin or runtime policy scope");
+		return {
+			expectedOrigin,
+			runtimePolicyScope,
+			expiresAtMs: ceremony.expiresAtMs
+		};
+	}
+	async registrationOwnerProof(input) {
+		const context = await this.readRegistrationOwnerProofContext(input.registrationCeremonyId);
+		if (!context) throw new Error("Registration owner proof context is unavailable");
+		return await this.registrationOwnerProofWithContext(context, input);
+	}
+	/** For callers that must read the context before finalize tombstones it. */
+	async registrationOwnerProofWithContext(context, input) {
+		return await buildRegistrationOwnerProof({
+			...input,
+			tenantId: this.authorizationTenantId,
+			expectedOrigin: context.expectedOrigin,
+			expiresAtMs: Math.min(context.expiresAtMs, Date.now() + DEFAULT_WALLET_SESSION_TTL_MS)
+		});
+	}
+	async readCommittedRegistrationInstallation(registrationCeremonyId) {
+		const entries = await this.activateSideEffects.listByKeyPrefix(`registration-activate:${registrationCeremonyId}:`, { limit: 2 });
+		const completed = [];
+		for (const entry of entries) {
+			if (entry.result.kind !== "present") continue;
+			switch (entry.result.value.kind) {
+				case "router_ab_ed25519_yao_registration_side_effect_completion_v2":
+					completed.push({ record: entry.result.value });
+					break;
+				case "router_ab_ed25519_yao_registration_side_effect_claim_v1": throw new Error("registration activation has an unfinished side-effect claim");
+				default: return assertNeverD1RegistrationSideEffectRecord(entry.result.value);
+			}
+		}
+		if (completed.length === 0) return null;
+		if (completed.length !== 1) throw new Error("registration activation has conflicting committed installation receipts");
+		const record = completed[0].record;
+		if (base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(record.prepared))) !== record.preparedArtifactFingerprint) throw new Error("registration activation prepared artifact fingerprint is invalid");
+		const receipt = record.receipt;
+		if (receipt.operation !== "registration_activate" || receipt.registrationCeremonyId !== registrationCeremonyId || receipt.operationFingerprint !== record.requestFingerprint || !isRegistrationEcdsaReadyReceipt(receipt) || receipt.committed.nearProvisioning?.status !== "near_pending" || receipt.committed.installation === void 0) throw new Error("registration activation receipt has no valid mixed installation projection");
+		const projection = receipt.committed.installation;
+		const foundingDeviceId = receipt.foundingAuthority.principal.deviceId;
+		const derivedAuthority = registrationWalletAuthAuthority({
+			authority: projection.registrationAuthority,
+			walletAuthMethodId: receipt.walletAuthMethodId
+		});
+		const nearPlan = projection.signerPlan.branches.find((branch) => branch.kind === "near_ed25519");
+		const ecdsaPlan = projection.signerPlan.branches.find((branch) => branch.kind === "evm_family_ecdsa");
+		if (projection.registrationCeremonyId !== registrationCeremonyId || projection.walletId !== receipt.walletId || projection.registrationAuthority.walletId !== receipt.walletId || projection.orgId !== (projection.preparedContext.runtimePolicy.kind === "runtime_policy_scope" ? projection.preparedContext.runtimePolicy.scope.orgId : "") || !nearPlan || !ecdsaPlan || !thresholdEcdsaChainTargetsEqual(ecdsaPlan.chainTargets, projection.preparedContext.ecdsa.kind === "evm_family_ecdsa_requested" ? projection.preparedContext.ecdsa.chainTargets : []) || !thresholdEcdsaChainTargetsEqual(ecdsaPlan.chainTargets, receipt.committed.ecdsa.walletKeys.map((walletKey) => walletKey.chainTarget)) || receipt.committed.ecdsa.walletKeys.some((walletKey) => walletKey.walletId !== String(receipt.walletId) || walletKey.signingRootId !== projection.preparedContext.signingRootId || walletKey.signingRootVersion !== projection.preparedContext.signingRootVersion || walletKey.participantIds.length !== ecdsaPlan.participantIds.length || walletKey.participantIds.some((participantId, index) => participantId !== ecdsaPlan.participantIds[index])) || projection.nearEd25519.branchKey !== nearPlan.branchKey || projection.nearEd25519.admissionRequest.scope.lifecycle_id !== registrationCeremonyId || projection.nearEd25519.admissionRequest.scope.account_id !== String(receipt.walletId) || projection.nearEd25519.admissionRequest.scope.root_share_epoch !== projection.preparedContext.signingRootVersion || projection.nearEd25519.admissionRequest.scope.signer_set_id !== String(nearPlan.branchKey) || projection.nearEd25519.admissionRequest.application_binding.wallet_id !== String(receipt.walletId) || projection.nearEd25519.admissionRequest.application_binding.signing_root_id !== projection.preparedContext.signingRootId || projection.nearEd25519.admissionRequest.application_binding.key_creation_signer_slot !== nearPlan.signerSlot || projection.nearEd25519.admissionRequest.participant_ids.length !== nearPlan.participantIds.length || projection.nearEd25519.admissionRequest.participant_ids.some((participantId, index) => participantId !== nearPlan.participantIds[index]) || !walletAuthAuthoritiesMatch(derivedAuthority, receipt.authority) || record.prepared.walletAuthorityId !== receipt.foundingAuthority.authorityId || record.prepared.deviceId !== foundingDeviceId || record.prepared.walletAuthMethodId !== receipt.walletAuthMethodId) throw new Error("registration activation receipt installation identity is invalid");
+		return {
+			receipt,
+			projection,
+			prepared: record.prepared
+		};
+	}
+	async prepareNearProvisioningOperation(registrationCeremonyId, allocated) {
+		const ceremony = await this.getRegistrationCeremonyIntentStore().getCeremony(registrationCeremonyId);
+		if (!ceremony) {
+			const committed = await this.readCommittedRegistrationInstallation(registrationCeremonyId);
+			if (!committed) throw new Error("Registration ceremony is unavailable for identity preparation");
+			if (allocated && (allocated.walletAuthorityId !== committed.prepared.walletAuthorityId || allocated.deviceId !== committed.prepared.deviceId || allocated.walletAuthMethodId !== committed.prepared.walletAuthMethodId)) throw new Error("registration operation identity does not match its committed installation");
+			return committed.prepared;
+		}
+		const prepared = allocated ?? walletRegistrationOperationPreparedFromCeremony(ceremony);
+		const authority = verifiedRegistrationCeremonyAuthority(ceremony);
+		if (!authority) return prepared;
+		const persisted = await this.walletAuthMethods.readActiveRegistrationIdentity(authority);
+		if (!persisted) return prepared;
+		return {
+			kind: prepared.kind,
+			walletAuthorityId: persisted.walletAuthorityId,
+			deviceId: prepared.deviceId,
+			walletAuthMethodId: persisted.walletAuthMethodId
+		};
+	}
+	async commitDeferredEd25519Signer(args, prepared) {
+		const ownerProofContext = await this.readRegistrationOwnerProofContext(args.input.registrationCeremonyId);
+		if (!ownerProofContext) throw new Error("Registration owner proof context is unavailable");
+		const ceremony = await this.getRegistrationCeremonyIntentStore().getCeremony(args.input.registrationCeremonyId);
+		let recovery = null;
+		let registrationAuthority;
+		let sessionPredecessor;
+		if (ceremony) {
+			const authority = verifiedRegistrationCeremonyAuthority(ceremony);
+			if (!authority) throw new Error("Registration authority is unavailable before finalize");
+			registrationAuthority = authority;
+			sessionPredecessor = { kind: "ed25519_only" };
+		} else {
+			const committed = await this.readCommittedRegistrationInstallation(args.input.registrationCeremonyId);
+			if (!committed) throw new Error("Committed registration installation is unavailable");
+			recovery = registrationFinalizeRecoveryFromCommittedInstallation({
+				setupClaims: args.setupClaims,
+				projection: committed.projection
+			});
+			const authority = verifiedRegistrationCeremonyAuthority(recovery.ceremony);
+			if (!authority) throw new Error("Committed registration installation has no verified authority");
+			registrationAuthority = authority;
+			const activationReceipt = committed.receipt;
+			if (!isRegistrationEcdsaReadyReceipt(activationReceipt)) throw new Error("Committed mixed registration receipt is not ECDSA-ready");
+			if (activationReceipt.committed.session.tokens.kind !== "evm_family_ecdsa") throw new Error("Committed mixed registration is missing its ECDSA session projection");
+			sessionPredecessor = {
+				kind: "mixed",
+				ecdsa: activationReceipt.committed.session.tokens.ecdsa
+			};
+		}
+		const effectivePrepared = await this.prepareNearProvisioningOperation(args.input.registrationCeremonyId, prepared);
+		const committed = await this.executeWalletRegistrationFinalize({
+			kind: "near_ed25519",
+			registrationCeremonyId: args.input.registrationCeremonyId,
+			idempotencyKey: args.input.idempotencyKey,
+			ed25519: args.input.ed25519,
+			emailOtpEnrollment: args.input.emailOtpEnrollment,
+			walletCustodyCommit: args.input.walletCustodyCommit
+		}, effectivePrepared, recovery);
+		const finalized = committed.ok ? committed : throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1(committed);
+		if (!finalized.ok || finalized.kind !== "near_ed25519") return unissuedRegistrationCommit(finalized);
+		const proof = await buildRegistrationOwnerProof({
+			registrationCeremonyId: args.input.registrationCeremonyId,
+			authMethod: finalized.authMethod,
+			authority: finalized.authority,
+			tenantId: this.authorizationTenantId,
+			expectedOrigin: ownerProofContext.expectedOrigin,
+			expiresAtMs: ownerProofContext.expiresAtMs
+		});
+		const issuedRegistrationSession = await issueDirectRegistrationEstablishedEd25519Session({
+			authorizationService: this.authorizationService,
+			authorizationTenantId: this.authorizationTenantId,
+			walletAuthMethods: this.walletAuthMethods,
+			registrationCeremonyId: args.input.registrationCeremonyId,
+			authority: finalized.authority,
+			registrationAuthority,
+			walletAuthMethodId: effectivePrepared.walletAuthMethodId,
+			expiresAtMs: Date.now() + DEFAULT_WALLET_SESSION_TTL_MS,
+			remainingUses: 3,
+			publicResult: finalized.ed25519,
+			predecessor: sessionPredecessor,
+			keyManifestDigestB64u: finalized.custodyKeyManifestDigestB64u,
+			proof
+		});
+		switch (issuedRegistrationSession.kind) {
+			case "issued": return {
+				kind: "session_issued",
+				response: {
+					...finalized,
+					registrationEstablishedSession: {
+						kind: "issued",
+						session: issuedRegistrationSession.session
+					}
+				},
+				issuedAtMs: issuedRegistrationSession.issuedAtMs,
+				expectedOrigin: ownerProofContext.expectedOrigin
+			};
+			case "already_committed": return {
+				kind: "session_issued",
+				response: {
+					...finalized,
+					registrationEstablishedSession: {
+						kind: "already_committed",
+						session: issuedRegistrationSession.session,
+						next: issuedRegistrationSession.next
+					}
+				},
+				issuedAtMs: issuedRegistrationSession.issuedAtMs,
+				expectedOrigin: ownerProofContext.expectedOrigin
+			};
+			default: return assertNeverD1RegistrationSessionIssuance(issuedRegistrationSession);
+		}
+	}
+	async replayWalletRegistrationActivateCommit(receipt) {
+		if (receipt.operation !== "registration_activate") throw new Error("Registration activation receipt operation is invalid");
+		switch (receipt.committed.kind) {
+			case "error": return replayedRegistrationCommit(receipt.committed.error);
+			case "near_pending": {
+				if (!isRegistrationNearPendingReceipt(receipt)) throw new Error("Registration pending receipt branch is invalid");
+				const authMethod = registrationReplayAuthMethodFields(receipt);
+				if (authMethod.kind === "passkey") return replayedRegistrationCommit({
+					ok: true,
+					kind: "near_ed25519",
+					walletId: receipt.walletId,
+					authority: receipt.authority,
+					authMethod: authMethod.authMethod,
+					rpId: authMethod.rpId,
+					...receipt.registrationDiagnostics ? { registrationDiagnostics: receipt.registrationDiagnostics } : {},
+					nearProvisioning: { status: "near_pending" }
+				});
+				return replayedRegistrationCommit({
+					ok: true,
+					kind: "near_ed25519",
+					walletId: receipt.walletId,
+					authority: receipt.authority,
+					authMethod: authMethod.authMethod,
+					...receipt.registrationDiagnostics ? { registrationDiagnostics: receipt.registrationDiagnostics } : {},
+					nearProvisioning: { status: "near_pending" }
+				});
+			}
+			case "ecdsa_ready": {
+				if (!isRegistrationEcdsaReadyReceipt(receipt)) throw new Error("Registration activation receipt branch is invalid");
+				const registrationEstablishedSession = replayDirectRegistrationEstablishedEcdsaSession(receipt);
+				const authMethod = registrationReplayAuthMethodFields(receipt);
+				const committedFields = {
+					ok: true,
+					kind: "evm_family_ecdsa",
+					walletId: receipt.walletId,
+					authority: receipt.authority,
+					foundingAuthority: receipt.foundingAuthority,
+					foundingAuthMethod: receipt.foundingAuthMethod,
+					...receipt.registrationDiagnostics ? { registrationDiagnostics: receipt.registrationDiagnostics } : {},
+					...receipt.walletCustody ? { walletCustody: receipt.walletCustody } : {},
+					custodyKeyManifestDigestB64u: receipt.custodyKeyManifestDigestB64u,
+					ecdsa: {
+						...receipt.committed.ecdsa,
+						walletKeys: [...receipt.committed.ecdsa.walletKeys]
+					},
+					registrationEstablishedSession,
+					...receipt.committed.nearProvisioning ? { nearProvisioning: receipt.committed.nearProvisioning } : {}
+				};
+				if (authMethod.kind === "passkey") return replayedRegistrationCommit({
+					...committedFields,
+					authMethod: authMethod.authMethod,
+					rpId: authMethod.rpId
+				});
+				return replayedRegistrationCommit({
+					...committedFields,
+					authMethod: authMethod.authMethod
+				});
+			}
+			case "near_ready": throw new Error("Registration activation receipt contains a deferred NEAR result");
+			default: return assertNeverRegistrationReceiptCommit(receipt.committed);
+		}
+	}
+	async replayWalletRegistrationNearProvisioningCommit(receipt) {
+		if (receipt.operation !== "near_provisioning") throw new Error("Registration NEAR provisioning receipt operation is invalid");
+		if (receipt.committed.kind === "error") return replayedRegistrationCommit(receipt.committed.error);
+		if (receipt.committed.kind !== "near_ready") throw new Error("Registration NEAR provisioning receipt branch is invalid");
+		if (!isRegistrationNearReadyReceipt(receipt)) throw new Error("Registration NEAR provisioning receipt branch is invalid");
+		const authMethod = registrationReplayAuthMethodFields(receipt);
+		const registrationEstablishedSession = replayDirectRegistrationEstablishedEd25519Session(receipt);
+		const committedFields = {
+			ok: true,
+			kind: "near_ed25519",
+			walletId: receipt.walletId,
+			authority: receipt.authority,
+			foundingAuthority: receipt.foundingAuthority,
+			foundingAuthMethod: receipt.foundingAuthMethod,
+			...receipt.registrationDiagnostics ? { registrationDiagnostics: receipt.registrationDiagnostics } : {},
+			...receipt.walletCustody ? { walletCustody: receipt.walletCustody } : {},
+			custodyKeyManifestDigestB64u: receipt.custodyKeyManifestDigestB64u,
+			authorityScope: receipt.committed.authorityScope,
+			accountProvisioning: receipt.committed.accountProvisioning,
+			resolvedAccount: receipt.committed.resolvedAccount,
+			ed25519: receipt.committed.ed25519,
+			registrationEstablishedSession
+		};
+		if (authMethod.kind === "passkey") return replayedRegistrationCommit({
+			...committedFields,
+			authMethod: authMethod.authMethod,
+			rpId: authMethod.rpId
+		});
+		return replayedRegistrationCommit({
+			...committedFields,
+			authMethod: authMethod.authMethod
+		});
+	}
+	/**
+	* Deferred NEAR provisioning. Verifies the signed setup, then reuses the
+	* existing deferred Ed25519 commit — the same path lazy-Yao 4+5 built — so
+	* signer installation and the implicit-account projection keep one
+	* implementation across both plans.
+	*
+	* A retryable failure leaves the pending wallet intact: the wallet must not
+	* be destroyed because its signer ceremony needs another attempt.
+	*/
+	async completeWalletRegistrationNearProvisioning(input) {
+		try {
+			const verified = await verifyWalletRegistrationSetupClaims(input.verifier, input.signedSetup, {
+				registrationCeremonyId: input.registrationCeremonyId,
+				nowMs: Date.now()
+			});
+			if (!verified.ok) return {
+				ok: false,
+				code: verified.code,
+				message: verified.message
+			};
+			const requestFingerprint = base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
+				version: "wallet_registration_near_provisioning_digest_v1",
+				registrationCeremonyId: input.registrationCeremonyId,
+				setupDigestB64u: verified.claims.setupDigestB64u,
+				idempotencyKey: input.idempotencyKey,
+				ed25519: input.ed25519,
+				emailOtpEnrollment: input.emailOtpEnrollment
+			})));
+			const run = await runRouterAbEd25519YaoRegistrationSideEffectV2(this.nearProvisioningSideEffects, {
+				kind: "prepared_resumable",
+				operation: "near_provisioning",
+				key: `near-provisioning:${input.registrationCeremonyId}:${input.idempotencyKey}`,
+				requestFingerprint,
+				resumeAfterMs: D1_WALLET_REGISTRATION_OPERATION_RESUME_AFTER_MS,
+				nowMs: Date.now,
+				prepare: async () => await this.prepareNearProvisioningOperation(input.registrationCeremonyId),
+				derivePreparedArtifactFingerprint: async (prepared) => base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(prepared))),
+				execute: this.commitDeferredEd25519Signer.bind(this, {
+					input,
+					setupClaims: verified.claims
+				}),
+				projectReceipt: (execution) => projectWalletRegistrationSessionCommitReceiptV2({
+					operation: "near_provisioning",
+					operationFingerprint: requestFingerprint,
+					registrationCeremonyId: input.registrationCeremonyId,
+					execution
+				}),
+				replay: this.replayWalletRegistrationNearProvisioningCommit.bind(this)
+			});
+			switch (run.kind) {
+				case "executed":
+				case "exact_replay": break;
+				case "request_conflict": return {
+					ok: false,
+					code: "idempotency_conflict",
+					message: "NEAR provisioning idempotency key was reused for a different request"
+				};
+				case "in_progress": return {
+					ok: false,
+					code: "conflict",
+					message: "NEAR provisioning is already in progress; retry later"
+				};
+				case "uncertain": return {
+					ok: false,
+					code: "internal",
+					message: run.message || "Failed to reconcile NEAR provisioning",
+					nearProvisioning: { status: "near_failed_retryable" }
+				};
+				default: return {
+					ok: false,
+					code: "internal",
+					message: "unsupported provisioning outcome"
+				};
+			}
+			const committed = run.value.response;
+			if (!committed.ok) return {
+				ok: false,
+				code: committed.code,
+				message: committed.message,
+				nearProvisioning: { status: "near_failed_retryable" }
+			};
+			if (committed.kind !== "near_ed25519") return {
+				ok: false,
+				code: "internal",
+				message: "NEAR provisioning committed a different signer branch"
+			};
+			if (!isWalletRegistrationNearProvisioningSuccess(committed)) return {
+				ok: false,
+				code: "internal",
+				message: "NEAR provisioning did not establish a Wallet Session",
+				nearProvisioning: { status: "near_failed_retryable" }
+			};
+			await cleanupFinalizedRegistrationCeremony({
+				store: this.getRegistrationCeremonyIntentStore(),
+				registrationCeremonyId: input.registrationCeremonyId
+			});
+			return {
+				...committed,
+				nearProvisioning: { status: "near_ready" }
+			};
+		} catch (error) {
+			return {
+				ok: false,
+				code: "internal",
+				message: errorMessage(error) || "Failed to complete NEAR provisioning",
+				nearProvisioning: { status: "near_failed_retryable" }
+			};
+		}
+	}
+	/**
+	* Persists the Ed25519-only wallet in `near_pending`: wallet, profile, and
+	* authentication state, and no signer record — the signer does not exist
+	* until deferred Yao produces it.
+	*
+	* The terminal response carries no signer, resolved account, or key
+	* identity, because none of those are known yet. Reporting them would be
+	* fabricating readiness.
+	*/
+	async commitEd25519PendingWallet(input) {
+		const now = Date.now();
+		const ceremony = input.ceremony;
+		const authority = input.authority;
+		const wallet = buildD1WalletRecord({
+			walletId: ceremony.intent.walletId,
+			now
+		});
+		const walletAuthAuthority = registrationWalletAuthAuthority({
+			authority,
+			walletAuthMethodId: input.walletAuthMethodId
+		});
+		switch (authority.kind) {
+			case "passkey":
+				await this.walletRegistrationCommitStore.commit({
+					kind: "passkey_wallet_registration_commit_v1",
+					wallet,
+					walletSigners: [],
+					authority,
+					now
+				});
+				break;
+			case "email_otp": {
+				const enrollment = await this.emailOtpRegistrationEnrollmentFinalizer.prepareRegistrationFinalize({
+					authority,
+					request: input.enrollment,
+					walletId: ceremony.intent.walletId,
+					orgId: ceremony.orgId,
+					nowMs: now
+				});
+				if (!enrollment.ok) return enrollment;
+				if (!enrollment.persistence) return {
+					ok: false,
+					code: "invalid_state",
+					message: "Email OTP registration is missing enrollment persistence state"
+				};
+				await this.walletRegistrationCommitStore.commit({
+					kind: "email_otp_wallet_registration_commit_v1",
+					wallet,
+					walletSigners: [],
+					authority,
+					emailOtp: this.emailOtpRegistrationEnrollmentFinalizer.prepareRegistrationCommitPlan(enrollment.persistence),
+					now
+				});
+				const completedIdentity = await this.emailOtpRegistrationEnrollmentFinalizer.completeRegistrationIdentity({
+					authority,
+					walletId: ceremony.intent.walletId
+				});
+				if (!completedIdentity.ok) return completedIdentity;
+				break;
+			}
+		}
+		const authMethod = walletRegistrationFinalizeAuthMethodFromAuthority(authority);
+		if (authMethod.kind === "passkey") {
+			if (!isPasskeyWalletAuthAuthority(walletAuthAuthority)) return {
+				ok: false,
+				code: "internal",
+				message: "Passkey registration returned a different authority"
+			};
+			return buildWalletRegistrationActivatePendingPasskeyResponse({
+				walletId: ceremony.intent.walletId,
+				authority: walletAuthAuthority,
+				authMethod,
+				rpId: finalizePasskeyRpId(authority)
+			});
+		}
+		if (!isEmailOtpWalletAuthAuthority(walletAuthAuthority)) return {
+			ok: false,
+			code: "internal",
+			message: "Email OTP registration returned a different authority"
+		};
+		return buildWalletRegistrationActivatePendingEmailOtpResponse({
+			walletId: ceremony.intent.walletId,
+			authority: walletAuthAuthority,
+			authMethod
+		});
+	}
+	/**
+	* Ed25519-only respond. The wallet's sole signer is Yao, and that is
+	* deliberately not a reason to block: the admission is returned as deferred
+	* work exactly as on a mixed plan, and the wallet lives in `near_pending`
+	* until the computation completes.
+	*/
+	/**
+	* Respond replay stays authority-bound.
+	*
+	* `signedSetup` is client-carried, so possession of it must never recover a
+	* stored respond result. Re-verifying the proof is necessary but not
+	* sufficient: registration *mints* the credential, so a fresh passkey over
+	* the same challenge would verify. The replayed proof must therefore resolve
+	* to the same authority that admitted the stored result.
+	*/
+	async verifyRespondReplayAuthority(input) {
+		const ceremony = input.ceremony;
+		const storedAuthority = verifiedRegistrationCeremonyAuthority(ceremony);
+		if (!storedAuthority) return {
+			ok: false,
+			code: "invalid_state",
+			message: "registration ceremony has no verified authority to replay"
+		};
+		const verified = await this.walletAuthMethods.verifyRegistrationAuthorityForIntent({
+			orgId: ceremony.orgId,
+			authority: input.authorityInput,
+			expectedDigestB64u: ceremony.digestB64u,
+			expectedOrigin: input.expectedOrigin,
+			intent: ceremony.intent,
+			verificationOperationId: ceremony.registrationCeremonyId,
+			verificationReceiptExpiresAtMs: ceremony.expiresAtMs,
+			...input.userAgent ? { userAgent: input.userAgent } : {}
+		});
+		if (!verified.ok) return {
+			ok: false,
+			code: verified.code,
+			message: verified.message
+		};
+		if (!storedRegistrationAuthoritiesMatch(storedAuthority, verified.authority)) return {
+			ok: false,
+			code: "unauthorized",
+			message: "registration respond replay presented a different authority"
+		};
+		return { ok: true };
+	}
+	async respondEd25519OnlyRegistration(input) {
+		const ceremony = input.ceremony;
+		const stored = storedRespondEd25519DeferredWork(ceremony.signerState);
+		if (stored) {
+			const replayAuthority = await this.verifyRespondReplayAuthority({
+				ceremony,
+				authorityInput: input.authorityInput,
+				expectedOrigin: input.expectedOrigin,
+				...input.userAgent ? { userAgent: input.userAgent } : {}
+			});
+			if (!replayAuthority.ok) return {
+				ok: false,
+				code: replayAuthority.code,
+				message: replayAuthority.message
+			};
+			return {
+				ok: true,
+				registrationCeremonyId: ceremony.registrationCeremonyId,
+				kind: "near_ed25519",
+				ed25519: stored
+			};
+		}
+		const verifiedAuthority = await this.walletAuthMethods.verifyRegistrationAuthorityForIntent({
+			orgId: ceremony.orgId,
+			authority: input.authorityInput,
+			expectedDigestB64u: ceremony.digestB64u,
+			expectedOrigin: input.expectedOrigin,
+			intent: ceremony.intent,
+			verificationOperationId: ceremony.registrationCeremonyId,
+			verificationReceiptExpiresAtMs: ceremony.expiresAtMs,
+			...input.userAgent ? { userAgent: input.userAgent } : {}
+		});
+		if (!verifiedAuthority.ok) return {
+			ok: false,
+			code: verifiedAuthority.code,
+			message: verifiedAuthority.message
+		};
+		const authority = verifiedAuthority.authority;
+		if (authority.walletId !== ceremony.intent.walletId) return {
+			ok: false,
+			code: "scope_mismatch",
+			message: "registration authority walletId does not match the ceremony"
+		};
+		const admitted = await this.admitRespondEd25519Branch({
+			ceremony,
+			branch: input.branch,
+			authority,
+			registrationBearerToken: input.registrationBearerToken
+		});
+		if (!admitted.ok) return {
+			ok: false,
+			code: admitted.code,
+			message: admitted.message
+		};
+		if (!admitted.branch || !admitted.deferred) return {
+			ok: false,
+			code: "internal",
+			message: "Ed25519 admission produced no branch"
+		};
+		await this.getRegistrationCeremonyIntentStore().commitEcdsaClaim({
+			expected: input.snapshot,
+			next: {
+				...ceremony,
+				authorityState: {
+					kind: "verified",
+					authority
+				},
+				signerState: {
+					kind: "signer_set_registration",
+					branches: [admitted.branch]
+				}
+			}
+		});
+		return {
+			ok: true,
+			registrationCeremonyId: ceremony.registrationCeremonyId,
+			kind: "near_ed25519",
+			ed25519: admitted.deferred
+		};
+	}
+	/**
+	* Derives the authority-bound Yao admission now that the proof is verified.
+	* Both auth methods take this path — the scope comes from the verified
+	* authority, so Email OTP's `providerUserId` is established rather than
+	* assumed.
+	*/
+	async admitRespondEd25519Branch(input) {
+		if (!input.branch) return {
+			ok: true,
+			branch: null,
+			deferred: null
+		};
+		const yaoRuntime = this.getEd25519YaoProductRegistration();
+		if (!yaoRuntime) return {
+			ok: false,
+			code: "not_configured",
+			message: "Ed25519 Yao product registration is not configured"
+		};
+		const admissionRequest = await buildRouterAbEd25519YaoProductAdmissionRequestV1({
+			registrationCeremonyId: input.ceremony.registrationCeremonyId,
+			walletId: input.ceremony.intent.walletId,
+			signingRootId: normalizeOptionalTrimmedString(input.ceremony.signingRootId) || "",
+			signingRootVersion: normalizeOptionalTrimmedString(input.ceremony.signingRootVersion) || "",
+			authorityScope: registrationEd25519AuthorityScopeFromAuthority(input.authority),
+			branch: input.branch,
+			signingWorkerId: yaoRuntime.signingWorkerId,
+			materialActivation: createRouterAbEd25519YaoMaterialActivationRefV1({
+				walletId: input.ceremony.intent.walletId,
+				signingWorkerId: yaoRuntime.signingWorkerId
+			})
+		});
+		const admitted = await yaoRuntime.bindAndAdmitVerifiedRegistration({
+			kind: "verified_registration_intent",
+			registrationIntentGrant: registrationIntentGrantFromString(input.registrationBearerToken),
+			intent: input.ceremony.intent,
+			admissionRequest,
+			expiresAtMs: input.ceremony.expiresAtMs
+		});
+		if (!admitted.ok) return {
+			ok: false,
+			code: admitted.code,
+			message: admitted.message
+		};
+		return {
+			ok: true,
+			branch: buildStoredWalletRegistrationNearEd25519YaoAuthorizedBranch({
+				branchKey: input.branch.branchKey,
+				admissionRequest,
+				admissionReceipt: admitted.value
+			}),
+			deferred: {
+				status: "deferred",
+				admissionRequest,
+				admissionReceipt: admitted.value
+			}
+		};
+	}
+	/**
+	* Refactor 94C. `/wallets/register/activate` — activation and finalization
+	* as one irreversible step behind one Gateway operation row.
+	*
+	* Previously activation and finalization were separate requests with
+	* separate idempotency: activation claimed and CAS'd the ceremony branch,
+	* then finalize opened its own side-effect journal *and* maintained a second
+	* replay cache. Three records guarding one irreversible commit, each with
+	* its own failure window.
+	*
+	* Here the operation row is the only one. Its claim is the activation claim,
+	* and its completion record holds one credential-free session receipt plus
+	* the request fingerprint. The direct-capability first response carries one
+	* ephemeral primary credential after the receipt CAS; exact retry returns
+	* the committed projection without fabricating a credential or repeating a
+	* custody effect. A conflicting fingerprint is refused
+	* before execution; an ambiguous outcome after the custody call stays
+	* `uncertain` rather than being guessed either way.
+	*/
+	async activateWalletRegistration(input, traceContext) {
+		try {
+			const verifiedSetup = await verifyWalletRegistrationSetupClaims(input.verifier, input.signedSetup, {
+				registrationCeremonyId: input.registrationCeremonyId,
+				nowMs: Date.now()
+			});
+			if (!verifiedSetup.ok) return {
+				ok: false,
+				code: verifiedSetup.code,
+				message: verifiedSetup.message
+			};
+			const claims = verifiedSetup.claims;
+			const idempotencyKey = normalizeOptionalTrimmedString(input.idempotencyKey);
+			if (!idempotencyKey) return {
+				ok: false,
+				code: "invalid_body",
+				message: "registration activate idempotencyKey is required"
+			};
+			const activateDigestB64u = base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
+				version: "wallet_registration_activate_digest_v1",
+				registrationCeremonyId: claims.registrationCeremonyId,
+				setupDigestB64u: claims.setupDigestB64u,
+				idempotencyKey,
+				ecdsa: input.ecdsa,
+				...input.emailOtpEnrollment ? { emailOtpEnrollment: input.emailOtpEnrollment } : {}
+			})));
+			const run = await runRouterAbEd25519YaoRegistrationSideEffectV2(this.activateSideEffects, {
+				kind: "prepared_resumable",
+				operation: "registration_activate",
+				key: `registration-activate:${claims.registrationCeremonyId}:${idempotencyKey}`,
+				requestFingerprint: activateDigestB64u,
+				resumeAfterMs: D1_WALLET_REGISTRATION_OPERATION_RESUME_AFTER_MS,
+				nowMs: Date.now,
+				prepare: async () => await this.prepareNearProvisioningOperation(claims.registrationCeremonyId),
+				derivePreparedArtifactFingerprint: async (prepared) => base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(prepared))),
+				execute: this.executeWalletRegistrationActivation.bind(this, {
+					registrationCeremonyId: claims.registrationCeremonyId,
+					idempotencyKey,
+					input,
+					traceContext
+				}),
+				projectReceipt: (execution) => projectWalletRegistrationSessionCommitReceiptV2({
+					operation: "registration_activate",
+					operationFingerprint: activateDigestB64u,
+					registrationCeremonyId: claims.registrationCeremonyId,
+					execution
+				}),
+				replay: this.replayWalletRegistrationActivateCommit.bind(this)
+			});
+			switch (run.kind) {
+				case "executed":
+				case "exact_replay":
+					if (run.value.response.ok && run.value.response.kind === "evm_family_ecdsa") await cleanupFinalizedRegistrationCeremony({
+						store: this.getRegistrationCeremonyIntentStore(),
+						registrationCeremonyId: claims.registrationCeremonyId
+					});
+					return run.value.response;
+				case "request_conflict": return {
+					ok: false,
+					code: "idempotency_conflict",
+					message: "registration activate idempotency key was reused for a different request"
+				};
+				case "in_progress": return {
+					ok: false,
+					code: "conflict",
+					message: "registration activation is already in progress; retry later"
+				};
+				case "uncertain": return {
+					ok: false,
+					code: "internal",
+					message: run.message || "Failed to reconcile wallet registration activation"
+				};
+				default: return {
+					ok: false,
+					code: "internal",
+					message: "registration activation returned an unsupported outcome"
+				};
+			}
+		} catch (error) {
+			return {
+				ok: false,
+				code: "internal",
+				message: errorMessage(error) || "Failed to activate wallet registration"
+			};
+		}
+	}
+	/**
+	* Router/SigningWorker activation followed by the blocking finalize
+	* persistence, as one unit inside the operation row. The commit is told the
+	* operation row owns idempotency, so it maintains no replay cache of its own.
+	*/
+	async executeWalletRegistrationActivation(context, prepared) {
+		const ceremony = await this.getRegistrationCeremonyIntentStore().getCeremony(context.registrationCeremonyId);
+		if (!ceremony) return unissuedRegistrationCommit({
+			ok: false,
+			code: "not_found",
+			message: "registration ceremony not found"
+		});
+		const ceremonyAuthority = verifiedRegistrationCeremonyAuthority(ceremony);
+		if (!ceremonyAuthority) return unissuedRegistrationCommit({
+			ok: false,
+			code: "invalid_state",
+			message: "registration ceremony has not verified its authority proof"
+		});
+		if (!registrationSignerBranchesFromPlan(ceremony.signerPlan).evmFamilyEcdsa) {
+			const expectedOrigin = normalizeOptionalTrimmedString(ceremony.expectedOrigin);
+			if (!expectedOrigin) return unissuedRegistrationCommit({
+				ok: false,
+				code: "invalid_state",
+				message: "registration ceremony has no expected origin"
+			});
+			const pending = await this.commitEd25519PendingWallet({
+				ceremony,
+				authority: ceremonyAuthority,
+				walletAuthMethodId: prepared.walletAuthMethodId,
+				enrollment: { ...context.input.emailOtpEnrollment ? { emailOtpEnrollment: context.input.emailOtpEnrollment } : {} }
+			});
+			if (!pending.ok) return unissuedRegistrationCommit(pending);
+			return {
+				kind: "near_pending",
+				response: pending,
+				expectedOrigin
+			};
+		}
+		if (!context.input.ecdsa) return unissuedRegistrationCommit({
+			ok: false,
+			code: "invalid_body",
+			message: "browser-verified clientActivation is required for this signer plan"
+		});
+		const ecdsa = context.input.ecdsa;
+		const activated = await this.activateWalletRegistrationEcdsa({
+			registrationCeremonyId: context.registrationCeremonyId,
+			ecdsa: {
+				kind: "router_ab_ecdsa_registration_activation_v1",
+				activationCorrelationId: ecdsa.activationCorrelationId,
+				activationRequestDigestB64u: ecdsa.activationRequestDigestB64u,
+				publicFacts: ecdsa.clientActivation
+			}
+		}, context.traceContext, context.idempotencyKey);
+		if (!activated.ok) return unissuedRegistrationCommit(throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1(activated));
+		const keyHandle = activated.ecdsa.bootstrap?.keyHandle;
+		if (!keyHandle) return unissuedRegistrationCommit({
+			ok: false,
+			code: "internal",
+			message: "ECDSA activation completed without a key handle to commit"
+		});
+		const ownerProofContext = await this.readRegistrationOwnerProofContext(context.registrationCeremonyId);
+		if (!ownerProofContext) throw new Error("Registration owner proof context is unavailable");
+		const commit = await this.executeWalletRegistrationFinalize({
+			kind: "evm_family_ecdsa",
+			registrationCeremonyId: context.registrationCeremonyId,
+			idempotencyKey: context.idempotencyKey,
+			ecdsa: { expectedKeyHandles: [keyHandle] },
+			...context.input.emailOtpEnrollment ? { emailOtpEnrollment: context.input.emailOtpEnrollment } : {},
+			...context.input.walletCustodyCommit !== void 0 ? { walletCustodyCommit: context.input.walletCustodyCommit } : {}
+		}, prepared, null);
+		if (!commit.ok) return unissuedRegistrationCommit(throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1(commit));
+		if (commit.kind !== "evm_family_ecdsa") return unissuedRegistrationCommit({
+			ok: false,
+			code: "internal",
+			message: "registration activation committed a non-ECDSA branch"
+		});
+		let installationProjection = null;
+		if (registrationSignerBranchesFromPlan(ceremony.signerPlan).nearEd25519) {
+			const committedCeremony = await this.getRegistrationCeremonyIntentStore().getCeremony(context.registrationCeremonyId);
+			installationProjection = committedCeremony ? committedInstallationProjectionFromCeremony(committedCeremony) : null;
+			if (!installationProjection) throw new Error("mixed registration did not persist its installation projection");
+		}
+		const runtimePolicyScope = registrationPreparedContextRuntimePolicyScope(ceremony.preparedContext);
+		if (!runtimePolicyScope) throw new Error("ECDSA registration is missing runtime policy scope");
+		const registrationEstablishedSession = await issueDirectRegistrationEstablishedEcdsaSession({
+			authorizationService: this.authorizationService,
+			authorizationTenantId: this.authorizationTenantId,
+			walletAuthMethods: this.walletAuthMethods,
+			registrationCeremonyId: context.registrationCeremonyId,
+			authority: commit.authority,
+			registrationAuthority: ceremonyAuthority,
+			walletAuthMethodId: prepared.walletAuthMethodId,
+			expiresAtMs: activated.ecdsa.bootstrap.expiresAtMs,
+			remainingUses: activated.ecdsa.bootstrap.remainingUses,
+			bootstrap: activated.ecdsa.bootstrap,
+			runtimePolicyScope,
+			keyManifestDigestB64u: commit.custodyKeyManifestDigestB64u,
+			proof: await this.registrationOwnerProofWithContext(ownerProofContext, {
+				registrationCeremonyId: context.registrationCeremonyId,
+				authMethod: commit.authMethod,
+				authority: commit.authority
+			})
+		});
+		const registrationEstablishedSessionResult = registrationEstablishedSessionResultFromIssuance(registrationEstablishedSession);
+		const responseBase = {
+			ok: true,
+			kind: "evm_family_ecdsa",
+			walletId: commit.walletId,
+			authority: commit.authority,
+			foundingAuthority: commit.foundingAuthority,
+			foundingAuthMethod: commit.foundingAuthMethod,
+			...commit.registrationDiagnostics ? { registrationDiagnostics: commit.registrationDiagnostics } : {},
+			...commit.walletCustody ? { walletCustody: commit.walletCustody } : {},
+			custodyKeyManifestDigestB64u: commit.custodyKeyManifestDigestB64u,
+			ecdsa: {
+				...commit.ecdsa,
+				activation: activated.ecdsa.activation,
+				bootstrap: activated.ecdsa.bootstrap
+			},
+			...registrationSignerBranchesFromPlan(ceremony.signerPlan).nearEd25519 ? { nearProvisioning: { status: "near_pending" } } : {},
+			registrationEstablishedSession: registrationEstablishedSessionResult
+		};
+		const issuedContext = {
+			issuedAtMs: registrationEstablishedSession.issuedAtMs,
+			expectedOrigin: ownerProofContext.expectedOrigin
+		};
+		if (commit.authMethod.kind === "passkey") {
+			if (!commit.rpId) throw new Error("Passkey registration activation is missing its RP ID");
+			const response = {
+				...responseBase,
+				authMethod: commit.authMethod,
+				rpId: commit.rpId
+			};
+			if (installationProjection) return {
+				kind: "session_issued_with_installation_projection",
+				response,
+				...issuedContext,
+				installationProjection
+			};
+			return {
+				kind: "session_issued",
+				response,
+				...issuedContext
+			};
+		}
+		const response = {
+			...responseBase,
+			authMethod: commit.authMethod
+		};
+		if (installationProjection) return {
+			kind: "session_issued_with_installation_projection",
+			response,
+			...issuedContext,
+			installationProjection
+		};
+		return {
+			kind: "session_issued",
+			response,
+			...issuedContext
+		};
+	}
+	async activateWalletRegistrationEcdsa(request, traceContext, activationOwner) {
+		const serverTiming = [];
+		const totalStartedAtMs = Date.now();
+		const markServerTiming = (name, startedAtMs) => {
+			serverTiming.push([name, Math.max(0, Date.now() - startedAtMs)]);
+		};
+		const withServerTiming = (response) => {
+			markServerTiming("ecdsa_activate_total", totalStartedAtMs);
+			return {
+				...response,
+				gatewayServerTiming: serverTiming
+			};
+		};
+		try {
+			const store = this.getRegistrationCeremonyIntentStore();
+			const claimStartedAtMs = Date.now();
+			const owner = normalizeOptionalTrimmedString(activationOwner);
+			if (!owner) return {
+				ok: false,
+				code: "internal",
+				message: "ECDSA activation requires an owning operation identity"
+			};
+			let claimed = await store.claimEcdsaActivation({
+				registrationCeremonyId: request.registrationCeremonyId,
+				publicFacts: request.ecdsa.publicFacts,
+				activationRequestDigestB64u: request.ecdsa.activationRequestDigestB64u,
+				activationOwner: owner
+			});
+			markServerTiming("ecdsa_activate_d1_claim", claimStartedAtMs);
+			if (!claimed) {
+				const reconcileStartedAtMs = Date.now();
+				const existing = await store.getCeremonySnapshot(request.registrationCeremonyId);
+				markServerTiming("ecdsa_activate_reconcile", reconcileStartedAtMs);
+				if (!existing) return {
+					ok: false,
+					code: "not_found",
+					message: "registration ceremony not found"
+				};
+				const ceremony = existing.ceremony;
+				if (!registrationCeremonyWalletsMatch({ ceremony }) || ceremony.signerState.kind !== "signer_set_registration") return {
+					ok: false,
+					code: "invalid_state",
+					message: "signer-set registration state is required"
+				};
+				const ecdsaBranch = findStoredWalletRegistrationEvmFamilyEcdsaBranch(ceremony.signerState);
+				if (ecdsaBranch?.kind === "evm_family_ecdsa_activated") {
+					if (!sameRouterAbEcdsaVerifiedClientActivationFactsV1(ecdsaBranch.publicFacts, request.ecdsa.publicFacts)) return {
+						ok: false,
+						code: "scope_mismatch",
+						message: "ECDSA activation replay changed the verified client facts"
+					};
+					if (ecdsaBranch.activationOwner !== owner) return {
+						ok: false,
+						code: "conflict",
+						message: "ECDSA activation belongs to another activate operation"
+					};
+					return withServerTiming({
+						ok: true,
+						registrationCeremonyId: ceremony.registrationCeremonyId,
+						ecdsa: {
+							kind: "router_ab_ecdsa_registration_activated_v1",
+							activation: ecdsaBranch.activation,
+							bootstrap: ecdsaBranch.bootstrap
+						}
+					});
+				}
+				if (ecdsaBranch?.kind !== "evm_family_ecdsa_activation_claimed") return {
+					ok: false,
+					code: "invalid_state",
+					message: "ECDSA registration activation is not claimable"
+				};
+				if (!sameRouterAbEcdsaVerifiedClientActivationFactsV1(ecdsaBranch.publicFacts, request.ecdsa.publicFacts) || ecdsaBranch.activationRequestDigestB64u !== request.ecdsa.activationRequestDigestB64u) return {
+					ok: false,
+					code: "scope_mismatch",
+					message: "ECDSA activation claim belongs to different verified client facts"
+				};
+				if (ecdsaBranch.activationOwner !== owner) return {
+					ok: false,
+					code: "conflict",
+					message: "ECDSA activation claim belongs to another activate operation"
+				};
+				claimed = existing;
+			}
+			const ceremony = claimed.ceremony;
+			if (ceremony.signerState.kind !== "signer_set_registration") throw new Error("Claimed ECDSA activation ceremony has an invalid signer state");
+			const ecdsaBranch = findStoredWalletRegistrationEvmFamilyEcdsaBranch(ceremony.signerState);
+			if (!ecdsaBranch || ecdsaBranch.kind !== "evm_family_ecdsa_activation_claimed") throw new Error("Claimed ECDSA activation branch is invalid");
+			const routerStartedAtMs = Date.now();
+			const activated = await this.ecdsaStrictRegistration.activate({
+				activationCorrelationId: request.ecdsa.activationCorrelationId,
+				activationRequestDigestB64u: ecdsaBranch.activationRequestDigestB64u,
+				pendingActivation: ecdsaBranch.pendingActivation,
+				clientActivation: ecdsaBranch.publicFacts,
+				requestPolicy: {
+					policyVersion: WALLET_REGISTRATION_ROUTER_POLICY_VERSION,
+					requestDigestB64u: ecdsaBranch.publicFacts.registrationRequestDigestB64u
+				},
+				authority: ecdsaStrictRegistrationAuthority(ecdsaBranch.strictRegistration),
+				traceContext,
+				onServerTiming: (header) => mergeRouterServerTiming(serverTiming, header),
+				onHeaderPresence: (presence) => serverTiming.push([`ecdsa_role_timing_${presence.serverTiming}`, 1])
+			});
+			markServerTiming("ecdsa_activate_router", routerStartedAtMs);
+			if (!activated.ok) {
+				if (!activated.retryable) await store.commitEcdsaClaim({
+					expected: claimed,
+					next: {
+						...ceremony,
+						signerState: {
+							kind: "registration_failed",
+							failedAtMs: Date.now(),
+							failure: {
+								code: activated.code,
+								message: activated.message
+							}
+						}
+					}
+				});
+				return {
+					ok: false,
+					code: activated.code,
+					message: activated.message
+				};
+			}
+			try {
+				const bootstrapStartedAtMs = Date.now();
+				const bootstrap = await buildActivatedEcdsaFamilyBootstrap({
+					branch: ecdsaBranch,
+					publicFacts: ecdsaBranch.publicFacts,
+					activation: activated.value
+				});
+				markServerTiming("ecdsa_activate_bootstrap", bootstrapStartedAtMs);
+				const activatedBranch = {
+					kind: "evm_family_ecdsa_activated",
+					activationOwner: ecdsaBranch.activationOwner,
+					branchKey: ecdsaBranch.branchKey,
+					derivationKind: ecdsaBranch.derivationKind,
+					chainTargets: ecdsaBranch.chainTargets,
+					prepare: ecdsaBranch.prepare,
+					strictRegistration: ecdsaBranch.strictRegistration,
+					strictRegistrationBindingJson: ecdsaBranch.strictRegistrationBindingJson,
+					registrationRequest: ecdsaBranch.registrationRequest,
+					publicFacts: ecdsaBranch.publicFacts,
+					activation: activated.value,
+					publicCapability: buildRouterAbEcdsaDerivationPublicCapabilityV1({
+						registrationFacts: ecdsaBranch.strictRegistration,
+						registrationRequest: ecdsaBranch.registrationRequest,
+						clientActivation: ecdsaBranch.publicFacts,
+						activationReceipt: activated.value
+					}),
+					bootstrap: {
+						formatVersion: bootstrap.formatVersion,
+						walletId: bootstrap.walletId,
+						evmFamilySigningKeySlotId: bootstrap.evmFamilySigningKeySlotId,
+						ecdsaThresholdKeyId: bootstrap.ecdsaThresholdKeyId,
+						relayerKeyId: bootstrap.relayerKeyId,
+						applicationBindingDigestB64u: bootstrap.applicationBindingDigestB64u,
+						contextBinding32B64u: bootstrap.contextBinding32B64u,
+						publicIdentity: bootstrap.publicIdentity,
+						clientShareRetryCounter: bootstrap.clientShareRetryCounter,
+						relayerShareRetryCounter: bootstrap.relayerShareRetryCounter,
+						publicTranscriptDigest32B64u: bootstrap.publicTranscriptDigest32B64u,
+						keyHandle: bootstrap.keyHandle,
+						signingRootId: bootstrap.signingRootId,
+						signingRootVersion: bootstrap.signingRootVersion,
+						thresholdEcdsaPublicKeyB64u: bootstrap.thresholdEcdsaPublicKeyB64u,
+						ethereumAddress: bootstrap.ethereumAddress,
+						relayerVerifyingShareB64u: bootstrap.relayerVerifyingShareB64u,
+						thresholdSessionId: bootstrap.thresholdSessionId,
+						activationEpoch: bootstrap.activationEpoch,
+						expiresAtMs: bootstrap.expiresAtMs,
+						expiresAt: bootstrap.expiresAt,
+						remainingUses: bootstrap.remainingUses,
+						participantIds: [...exactEcdsaParticipantPair(bootstrap.participantIds)],
+						routerAbEcdsaDerivationNormalSigning: bootstrap.routerAbEcdsaDerivationNormalSigning
+					}
+				};
+				const commitStartedAtMs = Date.now();
+				try {
+					await store.commitEcdsaClaim({
+						expected: claimed,
+						next: {
+							...ceremony,
+							signerState: replaceStoredWalletRegistrationSignerBranch({
+								state: ceremony.signerState,
+								replacement: activatedBranch
+							})
+						}
+					});
+				} catch (error) {
+					const reconciled = await store.getCeremony(request.registrationCeremonyId);
+					const reconciledBranch = reconciled?.signerState.kind === "signer_set_registration" ? findStoredWalletRegistrationEvmFamilyEcdsaBranch(reconciled.signerState) : null;
+					if (reconciledBranch?.kind !== "evm_family_ecdsa_activated" || reconciledBranch.activationOwner !== activatedBranch.activationOwner || !sameRouterAbEcdsaVerifiedClientActivationFactsV1(reconciledBranch.publicFacts, activatedBranch.publicFacts) || !sameRouterAbEcdsaRegistrationActivationReceiptV1(reconciledBranch.activation, activatedBranch.activation) || !sameEcdsaDerivationServerBootstrap(reconciledBranch.bootstrap, activatedBranch.bootstrap)) throw error;
+				} finally {
+					markServerTiming("ecdsa_activate_d1_commit", commitStartedAtMs);
+				}
+				return withServerTiming({
+					ok: true,
+					registrationCeremonyId: ceremony.registrationCeremonyId,
+					ecdsa: {
+						kind: "router_ab_ecdsa_registration_activated_v1",
+						activation: activated.value,
+						bootstrap: activatedBranch.bootstrap
+					}
+				});
+			} catch (error) {
+				const message = errorMessage(error) || "ECDSA activation could not establish normal signing";
+				await store.commitEcdsaClaim({
+					expected: claimed,
+					next: {
+						...ceremony,
+						signerState: {
+							kind: "registration_failed",
+							failedAtMs: Date.now(),
+							failure: {
+								code: "ecdsa_activation_terminal_failure",
+								message
+							}
+						}
+					}
+				});
+				return {
+					ok: false,
+					code: "ecdsa_activation_terminal_failure",
+					message
+				};
+			}
+		} catch (error) {
+			return {
+				ok: false,
+				code: "internal",
+				message: errorMessage(error) || "Failed to activate ECDSA wallet registration"
+			};
+		}
+	}
+	async executeWalletRegistrationFinalize(request, prepared, recovery) {
+		const finalizeTiming = createD1RegistrationRouteTimingRecorder("wallets_register_finalize");
+		const totalTiming = startD1RegistrationRouteTiming("registerFinalizeTotalMs");
+		try {
+			const store = this.getRegistrationCeremonyIntentStore();
+			if (!normalizeOptionalTrimmedString(request.idempotencyKey)) return {
+				ok: false,
+				code: "invalid_body",
+				message: "registration finalize idempotencyKey is required"
+			};
+			const requestFingerprint = await walletRegistrationFinalizeRequestFingerprint(request);
+			const ceremonyLoadTiming = startD1RegistrationRouteTiming("registrationCeremonyLoadMs");
+			let storedCeremony;
+			try {
+				storedCeremony = await store.getCeremony(request.registrationCeremonyId);
+			} finally {
+				finishD1RegistrationRouteTiming(finalizeTiming, ceremonyLoadTiming);
+			}
+			let ceremony;
+			if (storedCeremony) {
+				if (storedCeremony.signerState.kind !== "signer_set_registration") return {
+					ok: false,
+					code: "invalid_state",
+					message: "signer-set registration state is required"
+				};
+				ceremony = registrationFinalizeCeremonyFromStored(storedCeremony);
+			} else if (recovery) {
+				if (request.kind !== "near_ed25519") return {
+					ok: false,
+					code: "invalid_state",
+					message: "committed mixed registration can only finalize NEAR Ed25519"
+				};
+				ceremony = recovery.ceremony;
+			} else return {
+				ok: false,
+				code: "not_found",
+				message: "registration ceremony not found"
+			};
+			if (!registrationCeremonyWalletsMatch({ ceremony })) return {
+				ok: false,
+				code: "scope_mismatch",
+				message: "registration ceremony walletId mismatch"
+			};
+			const ceremonyAuthority = verifiedRegistrationCeremonyAuthority(ceremony);
+			if (!ceremonyAuthority) return {
+				ok: false,
+				code: "invalid_state",
+				message: "registration ceremony has not verified its authority proof"
+			};
+			const signerBranches = registrationSignerBranchesFromPlan(ceremony.signerPlan);
+			const requestedNearEd25519 = signerBranches.nearEd25519;
+			const requestedEvmFamilyEcdsa = signerBranches.evmFamilyEcdsa;
+			if (!requestedNearEd25519 && !requestedEvmFamilyEcdsa) return {
+				ok: false,
+				code: "invalid_state",
+				message: "registration signer set requires a signer branch"
+			};
+			const storedEcdsaBranch = findStoredWalletRegistrationEvmFamilyEcdsaBranch(ceremony.signerState);
+			const ecdsaAlreadyFinalized = storedCeremony === null && recovery !== null || storedEcdsaBranch?.kind === "evm_family_ecdsa_finalized";
+			const sequenceFailure = finalizeSignerWorkSequenceFailure({
+				request,
+				hasNearEd25519: requestedNearEd25519 !== null,
+				hasEvmFamilyEcdsa: requestedEvmFamilyEcdsa !== null,
+				ecdsaFinalized: ecdsaAlreadyFinalized
+			});
+			if (sequenceFailure) return {
+				ok: false,
+				...sequenceFailure
+			};
+			const finalizeEvmFamilyEcdsa = request.kind === "evm_family_ecdsa" ? requestedEvmFamilyEcdsa : null;
+			const finalizeNearEd25519 = request.kind === "near_ed25519" ? requestedNearEd25519 : null;
+			const ed25519FinalizePending = finalizeEvmFamilyEcdsa !== null && requestedNearEd25519 !== null;
+			const walletCustodyCommitPayload = walletCustodyCeremonyCommitPayloadFromWire(request.walletCustodyCommit);
+			if (!walletCustodyCommitPayload) return {
+				ok: false,
+				code: "invalid_body",
+				message: "registration finalize requires its wallet custody commit"
+			};
+			if (walletCustodyCommitPayload.walletId !== ceremony.intent.walletId) return {
+				ok: false,
+				code: "scope_mismatch",
+				message: "wallet custody commit does not name the registered wallet"
+			};
+			const expectedCustodyKeySet = finalizeEvmFamilyEcdsa ? "evm_family_ecdsa_v1" : "near_ed25519_v1";
+			if (walletCustodyCommitPayload.keySet !== expectedCustodyKeySet) return {
+				ok: false,
+				code: "scope_mismatch",
+				message: "wallet custody commit does not name the finalized key set"
+			};
+			let custodyKeyManifestDigestB64u;
+			try {
+				custodyKeyManifestDigestB64u = parseDigestB64u(walletCustodyCommitPayload.keyManifestDigestB64u);
+			} catch {
+				return {
+					ok: false,
+					code: "invalid_body",
+					message: "wallet custody commit carries an invalid key manifest digest"
+				};
+			}
+			let custodyClientRootPublicKey33B64u = null;
+			if (finalizeEvmFamilyEcdsa) try {
+				custodyClientRootPublicKey33B64u = ecdsaClientRootPublicKey33B64uFromString(walletCustodyCommitPayload.clientRootPublicKey33B64u ?? "");
+			} catch {
+				return {
+					ok: false,
+					code: "invalid_body",
+					message: "ECDSA custody commit carries an invalid client root public key"
+				};
+			}
+			const ecdsaWalletKeys = [];
+			let ecdsaMaterialActivation = null;
+			let activatedEcdsaBranch = null;
+			if (finalizeEvmFamilyEcdsa) {
+				const ecdsaState = storedEcdsaBranch;
+				if (!ecdsaState || ecdsaState.kind !== "evm_family_ecdsa_activated") return {
+					ok: false,
+					code: "invalid_state",
+					message: "ECDSA family activation is required before finalize"
+				};
+				activatedEcdsaBranch = ecdsaState;
+				if (!request.ecdsa) return {
+					ok: false,
+					code: "invalid_body",
+					message: "ECDSA finalize requires the activated family key handle"
+				};
+				const expectedKeyHandles = request.ecdsa.expectedKeyHandles;
+				if (hasEcdsaKeyHandleSetMismatch(expectedKeyHandles, [ecdsaState.bootstrap.keyHandle])) return {
+					ok: false,
+					code: "key_handle_mismatch",
+					message: "ECDSA finalize expected key handle mismatch"
+				};
+				const ecdsaVerifyTiming = startD1RegistrationRouteTiming("registrationEcdsaBootstrapVerifyMs");
+				let walletKeyResult;
+				try {
+					walletKeyResult = buildD1EcdsaWalletKeysFromBootstrap({
+						bootstraps: ecdsaState.chainTargets.map((chainTarget) => ({
+							chainTarget,
+							bootstrap: ecdsaState.bootstrap
+						})),
+						publicCapability: ecdsaState.publicCapability,
+						errorContext: "ECDSA registration finalize"
+					});
+				} finally {
+					finishD1RegistrationRouteTiming(finalizeTiming, ecdsaVerifyTiming);
+				}
+				if (!walletKeyResult.ok) return walletKeyResult;
+				ecdsaWalletKeys.push(...walletKeyResult.walletKeys);
+				ecdsaMaterialActivation = routerAbMpcMaterialActivationRefFromWire(ecdsaState.activation.ecdsa_activation.material_activation);
+			} else if (storedEcdsaBranch?.kind === "evm_family_ecdsa_finalized") {
+				const walletKeyResult = buildD1EcdsaWalletKeysFromBootstrap({
+					bootstraps: storedEcdsaBranch.chainTargets.map((chainTarget) => ({
+						chainTarget,
+						bootstrap: storedEcdsaBranch.bootstrap
+					})),
+					publicCapability: storedEcdsaBranch.publicCapability,
+					errorContext: "ECDSA registration final Ed25519 finalize"
+				});
+				if (!walletKeyResult.ok) return walletKeyResult;
+				ecdsaWalletKeys.push(...walletKeyResult.walletKeys);
+				ecdsaMaterialActivation = routerAbMpcMaterialActivationRefFromWire(storedEcdsaBranch.activation.ecdsa_activation.material_activation);
+			}
+			const now = Date.now();
+			const emailOtpEnrollmentTiming = startD1RegistrationRouteTiming("registrationEmailOtpEnrollmentPlanMs");
+			let emailOtpEnrollment;
+			try {
+				emailOtpEnrollment = await this.emailOtpRegistrationEnrollmentFinalizer.prepareRegistrationFinalize({
+					authority: ceremonyAuthority,
+					request,
+					walletId: ceremony.intent.walletId,
+					orgId: ceremony.orgId,
+					nowMs: now
+				});
+			} finally {
+				finishD1RegistrationRouteTiming(finalizeTiming, emailOtpEnrollmentTiming);
+			}
+			if (!emailOtpEnrollment.ok) return emailOtpEnrollment;
+			const walletAuthAuthority = registrationWalletAuthAuthority({
+				authority: ceremonyAuthority,
+				walletAuthMethodId: prepared.walletAuthMethodId
+			});
+			let ed25519PublicResult = null;
+			let resolvedNearAccount = null;
+			let ed25519SignerRecord = null;
+			let ed25519MaterialActivation = null;
+			let ed25519RegisteredPublicKeyB64u = null;
+			let ed25519CapabilityInstallation = null;
+			if (finalizeNearEd25519) {
+				const yaoRuntime = this.getEd25519YaoProductRegistration();
+				if (!yaoRuntime) return {
+					ok: false,
+					code: "not_configured",
+					message: "Ed25519 Yao product registration is not configured"
+				};
+				const storedYao = findStoredWalletRegistrationNearEd25519YaoBranch(ceremony.signerState);
+				if (!storedYao || !request.ed25519) return {
+					ok: false,
+					code: "invalid_state",
+					message: "authorized Ed25519 Yao registration is required before finalize"
+				};
+				if (ceremony.preparedContext.runtimePolicy.kind !== "runtime_policy_scope") return {
+					ok: false,
+					code: "invalid_state",
+					message: "Ed25519 Yao wallet session requires a runtime policy scope"
+				};
+				const runtimePolicyScope = ceremony.preparedContext.runtimePolicy.scope;
+				const activationReference = request.ed25519.activationReference;
+				if (activationReference.lifecycle_id !== ceremony.registrationCeremonyId) return {
+					ok: false,
+					code: "scope_mismatch",
+					message: "Ed25519 activation reference does not belong to this registration ceremony"
+				};
+				const consumed = await yaoRuntime.consumeActivated({
+					reference: {
+						lifecycleId: activationReference.lifecycle_id,
+						sessionId: activationReference.session_id
+					},
+					consumerBinding: requestFingerprint
+				});
+				if (!consumed.ok) return {
+					ok: false,
+					code: consumed.code,
+					message: consumed.message
+				};
+				if (!sameRouterAbEd25519YaoRegistrationAdmissionRequestV1(consumed.activation.admissionRequest, storedYao.admissionRequest)) return {
+					ok: false,
+					code: "scope_mismatch",
+					message: "activated Ed25519 Yao registration does not match the stored signer branch"
+				};
+				const firstParticipantId = finalizeNearEd25519.participantIds[0];
+				const secondParticipantId = finalizeNearEd25519.participantIds[1];
+				if (finalizeNearEd25519.participantIds.length !== 2 || firstParticipantId === void 0 || secondParticipantId === void 0) return {
+					ok: false,
+					code: "invalid_state",
+					message: "Ed25519 Yao registration requires exactly two participants"
+				};
+				const participantIds = [firstParticipantId, secondParticipantId];
+				const publicKeyBytes = consumed.activation.result.public_receipt.registered_public_key;
+				ed25519RegisteredPublicKeyB64u = base64UrlEncode(Uint8Array.from(publicKeyBytes));
+				if (walletCustodyCommitPayload.registeredPublicKeyB64u !== ed25519RegisteredPublicKeyB64u) return {
+					ok: false,
+					code: "scope_mismatch",
+					message: "NEAR custody commit changed the activated public key"
+				};
+				const publicKey = ed25519NearPublicKeyFromBytes(publicKeyBytes);
+				let nearAccountId = implicitNearAccountIdFromEd25519PublicKeyBytes(publicKeyBytes);
+				let sponsoredTransactionHash;
+				const sponsoredAccountId = sponsoredNamedRegistrationAccountId(finalizeNearEd25519.accountProvisioning);
+				if (sponsoredAccountId) {
+					const created = await this.createSponsoredNamedNearAccount({
+						accountId: sponsoredAccountId,
+						publicKey,
+						idempotencyKey: bytesToUnprefixedHex(Uint8Array.from(consumed.activation.result.binding.session_id))
+					});
+					switch (created.kind) {
+						case "rejected": return {
+							ok: false,
+							code: "account_creation_failed",
+							message: created.message
+						};
+						case "retryable": return {
+							ok: false,
+							code: "account_creation_retryable",
+							message: created.message,
+							retryAfterMs: created.retryAfterMs
+						};
+						case "created":
+							nearAccountId = created.accountId;
+							sponsoredTransactionHash = created.transactionHash;
+							break;
+						default: return assertNeverSponsoredNamedNearAccountCreationResult(created);
+					}
+				}
+				const resolved = resolvedRegistrationNearAccount({
+					accountProvisioning: finalizeNearEd25519.accountProvisioning,
+					nearAccountId,
+					nearEd25519SigningKeyId: consumed.activation.admissionRequest.application_binding.near_ed25519_signing_key_id,
+					...sponsoredTransactionHash ? { sponsoredTransactionHash } : {}
+				});
+				if (!resolved.ok) return resolved;
+				resolvedNearAccount = resolved.value;
+				ed25519CapabilityInstallation = {
+					kind: "router_ab_ed25519_yao_registration_finalize_capability_v1",
+					activeCapabilityBinding: consumed.activation.result.binding.session_id,
+					nearAccountId,
+					registrationAdmissionRequest: consumed.activation.admissionRequest,
+					registrationAdmissionReceipt: consumed.activation.admissionReceipt,
+					registrationResult: consumed.activation.result,
+					runtimePolicyScope
+				};
+				const activeYaoCapability = buildRouterAbEd25519YaoRegistrationCapabilityRecordV1(ed25519CapabilityInstallation);
+				if (!activeYaoCapability.ok) return {
+					ok: false,
+					code: activeYaoCapability.code,
+					message: activeYaoCapability.message
+				};
+				const activatedEd25519PublicResult = {
+					signerSlot: finalizeNearEd25519.signerSlot,
+					nearAccountId,
+					nearEd25519SigningKeyId: consumed.activation.admissionRequest.application_binding.near_ed25519_signing_key_id,
+					publicKey,
+					relayerKeyId: yaoRuntime.signingWorkerId,
+					keyVersion: finalizeNearEd25519.keyVersion,
+					recoveryExportCapable: true,
+					participantIds,
+					thresholdSessionId: consumed.activation.admissionRequest.scope.threshold_session_id,
+					runtimePolicyScope,
+					routerAbNormalSigning: {
+						kind: ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND,
+						signingWorkerId: yaoRuntime.signingWorkerId
+					}
+				};
+				ed25519PublicResult = activatedEd25519PublicResult;
+				ed25519MaterialActivation = routerAbMpcMaterialActivationRefFromWire(consumed.activation.admissionRequest.scope.material_activation);
+				ed25519SignerRecord = buildYaoEd25519WalletSignerRecord({
+					walletId: ceremony.intent.walletId,
+					nearAccountId,
+					nearEd25519SigningKeyId: activatedEd25519PublicResult.nearEd25519SigningKeyId,
+					thresholdSessionId: consumed.activation.admissionRequest.scope.threshold_session_id,
+					signerSlot: finalizeNearEd25519.signerSlot,
+					publicKey,
+					signingWorkerId: yaoRuntime.signingWorkerId,
+					keyVersion: finalizeNearEd25519.keyVersion,
+					participantIds,
+					signingRootId: ceremony.preparedContext.signingRootId,
+					signingRootVersion: ceremony.preparedContext.signingRootVersion,
+					runtimePolicyScope,
+					activeYaoCapability: activeYaoCapability.record,
+					custodyKeyManifestDigestB64u,
+					now
+				});
+			}
+			const wallet = buildD1WalletRecord({
+				walletId: ceremony.intent.walletId,
+				now
+			});
+			if (activatedEcdsaBranch && !custodyClientRootPublicKey33B64u) return {
+				ok: false,
+				code: "invalid_state",
+				message: "ECDSA registration is missing its custody client root public key"
+			};
+			const walletSigners = [];
+			if (activatedEcdsaBranch) {
+				const custodyClientRootPublicKey = custodyClientRootPublicKey33B64u;
+				if (!custodyClientRootPublicKey) return {
+					ok: false,
+					code: "invalid_state",
+					message: "ECDSA registration is missing its custody client root public key"
+				};
+				walletSigners.push(...buildD1WalletEcdsaSignerRecords({
+					walletId: ceremony.intent.walletId,
+					walletKeys: ecdsaWalletKeys,
+					activationReceipt: activatedEcdsaBranch.activation,
+					runtimePolicyScope: activatedEcdsaBranch.prepare.runtimePolicyScope,
+					custodyKeyManifestDigestB64u,
+					custodyClientRootPublicKey33B64u: custodyClientRootPublicKey,
+					now
+				}));
+			}
+			if (ed25519SignerRecord) walletSigners.push(ed25519SignerRecord);
+			const foundingAuthorityAlreadyCommitted = finalizeNearEd25519 !== null && ecdsaAlreadyFinalized;
+			const foundingAuthorityNeedsEd25519Extension = foundingAuthorityAlreadyCommitted && requestedEvmFamilyEcdsa !== null;
+			const foundingCommitComplete = finalizeEvmFamilyEcdsa !== null || finalizeNearEd25519 !== null && requestedEvmFamilyEcdsa === null || foundingAuthorityNeedsEd25519Extension;
+			let foundingAuthorityRecords = null;
+			if (foundingAuthorityNeedsEd25519Extension) {
+				if (!ed25519SignerRecord || !ed25519MaterialActivation || !ed25519RegisteredPublicKeyB64u) return {
+					ok: false,
+					code: "invalid_state",
+					message: "Deferred Ed25519 finalize is missing its founding signer facts"
+				};
+				const persistedFoundingRecords = await this.walletAuthMethods.readActiveRegistrationIdentity(ceremonyAuthority);
+				if (!persistedFoundingRecords) return {
+					ok: false,
+					code: "invalid_state",
+					message: "Deferred Ed25519 finalize is missing its founding authority"
+				};
+				if (!isActiveEcdsaWalletAuthorityV1(persistedFoundingRecords.authority)) return {
+					ok: false,
+					code: "invalid_state",
+					message: "Deferred Ed25519 finalize requires an ECDSA-only founding authority"
+				};
+				foundingAuthorityRecords = {
+					authority: await extendFoundingAuthorityWithEd25519({
+						authority: persistedFoundingRecords.authority,
+						ed25519: {
+							signer: ed25519SignerRecord,
+							registeredPublicKeyB64u: ed25519RegisteredPublicKeyB64u,
+							materialActivation: ed25519MaterialActivation
+						},
+						now
+					}),
+					authMethod: persistedFoundingRecords.authMethod
+				};
+			} else if (foundingCommitComplete && !foundingAuthorityAlreadyCommitted) {
+				const ecdsaWalletKey = ecdsaWalletKeys[0];
+				if (ed25519SignerRecord && ed25519MaterialActivation && ed25519RegisteredPublicKeyB64u) if (!ecdsaWalletKey || !ecdsaMaterialActivation) {
+					if (requestedEvmFamilyEcdsa !== null) return {
+						ok: false,
+						code: "invalid_state",
+						message: "Complete registration is missing ECDSA founding facts"
+					};
+					foundingAuthorityRecords = await buildFoundingAuthorityRecords({
+						authority: ceremonyAuthority,
+						walletId: ceremony.intent.walletId,
+						prepared,
+						signerFacts: {
+							kind: "ed25519",
+							keyFamilies: ["ed25519"],
+							ed25519: {
+								signer: ed25519SignerRecord,
+								registeredPublicKeyB64u: ed25519RegisteredPublicKeyB64u,
+								materialActivation: ed25519MaterialActivation
+							}
+						},
+						now
+					});
+				} else foundingAuthorityRecords = await buildFoundingAuthorityRecords({
+					authority: ceremonyAuthority,
+					walletId: ceremony.intent.walletId,
+					prepared,
+					signerFacts: {
+						kind: "both",
+						keyFamilies: ["ed25519", "ecdsa_secp256k1"],
+						ed25519: {
+							signer: ed25519SignerRecord,
+							registeredPublicKeyB64u: ed25519RegisteredPublicKeyB64u,
+							materialActivation: ed25519MaterialActivation
+						},
+						ecdsa: {
+							walletKey: requireSingleFoundingEcdsaWalletKey(ecdsaWalletKeys),
+							materialActivation: ecdsaMaterialActivation
+						}
+					},
+					now
+				});
+				else if (ecdsaWalletKey && ecdsaMaterialActivation) foundingAuthorityRecords = await buildFoundingAuthorityRecords({
+					authority: ceremonyAuthority,
+					walletId: ceremony.intent.walletId,
+					prepared,
+					signerFacts: {
+						kind: "ecdsa_secp256k1",
+						keyFamilies: ["ecdsa_secp256k1"],
+						ecdsa: {
+							walletKey: requireSingleFoundingEcdsaWalletKey(ecdsaWalletKeys),
+							materialActivation: ecdsaMaterialActivation
+						}
+					},
+					now
+				});
+				else return {
+					ok: false,
+					code: "invalid_state",
+					message: "Complete registration is missing founding signer facts"
+				};
+			}
+			const persistenceTiming = startD1RegistrationRouteTiming("relayPersistenceMs");
+			try {
+				switch (ceremonyAuthority.kind) {
+					case "passkey":
+						if (emailOtpEnrollment.persistence) return {
+							ok: false,
+							code: "invalid_state",
+							message: "Passkey registration cannot persist Email OTP enrollment state"
+						};
+						if (foundingAuthorityRecords) await this.walletRegistrationCommitStore.commit({
+							kind: "passkey_wallet_registration_commit_v1",
+							wallet,
+							walletSigners,
+							authority: ceremonyAuthority,
+							foundingAuthority: foundingAuthorityRecords.authority,
+							foundingAuthMethod: foundingAuthorityRecords.authMethod,
+							now
+						});
+						else await this.walletRegistrationCommitStore.commit({
+							kind: "passkey_wallet_registration_commit_v1",
+							wallet,
+							walletSigners,
+							authority: ceremonyAuthority,
+							now
+						});
+						break;
+					case "email_otp": {
+						if (!emailOtpEnrollment.persistence) return {
+							ok: false,
+							code: "invalid_state",
+							message: "Email OTP registration is missing enrollment persistence state"
+						};
+						const emailOtp = this.emailOtpRegistrationEnrollmentFinalizer.prepareRegistrationCommitPlan(emailOtpEnrollment.persistence);
+						if (foundingAuthorityRecords) await this.walletRegistrationCommitStore.commit({
+							kind: "email_otp_wallet_registration_commit_v1",
+							wallet,
+							walletSigners,
+							authority: ceremonyAuthority,
+							emailOtp,
+							foundingAuthority: foundingAuthorityRecords.authority,
+							foundingAuthMethod: foundingAuthorityRecords.authMethod,
+							now
+						});
+						else await this.walletRegistrationCommitStore.commit({
+							kind: "email_otp_wallet_registration_commit_v1",
+							wallet,
+							walletSigners,
+							authority: ceremonyAuthority,
+							emailOtp,
+							now
+						});
+						break;
+					}
+				}
+			} finally {
+				finishD1RegistrationRouteTiming(finalizeTiming, persistenceTiming);
+			}
+			const completedRegistrationIdentity = await this.emailOtpRegistrationEnrollmentFinalizer.completeRegistrationIdentity({
+				authority: ceremonyAuthority,
+				walletId: ceremony.intent.walletId
+			});
+			if (!completedRegistrationIdentity.ok) return completedRegistrationIdentity;
+			const persistedFoundingRecords = foundingAuthorityRecords ?? await this.walletAuthMethods.readActiveRegistrationIdentity(ceremonyAuthority);
+			if (!persistedFoundingRecords) return {
+				ok: false,
+				code: "invalid_state",
+				message: "Registration founding authority is unavailable after commit"
+			};
+			const foundingAuthority = persistedFoundingRecords.authority;
+			const foundingAuthMethod = persistedFoundingRecords.authMethod;
+			if (ed25519CapabilityInstallation) {
+				const yaoRuntime = this.getEd25519YaoProductRegistration();
+				if (!yaoRuntime) return {
+					ok: false,
+					code: "not_configured",
+					message: "Ed25519 Yao product registration is not configured"
+				};
+				const installed = await yaoRuntime.installRegistrationFinalizeCapability(ed25519CapabilityInstallation);
+				if (!installed.ok) return {
+					ok: false,
+					code: installed.code,
+					message: installed.message
+				};
+			}
+			const walletCustody = await commitRegistrationCustody({
+				payload: walletCustodyCommitPayload,
+				verifiedWalletId: ceremony.intent.walletId,
+				verifiedAuthority: walletAuthAuthority,
+				...emailOtpEnrollment.persistence ? { verifiedEmailOtpEnrollment: {
+					enrollmentId: emailOtpEnrollment.persistence.enrollment.enrollmentId,
+					enrollmentSealKeyVersion: emailOtpEnrollment.persistence.enrollment.enrollmentSealKeyVersion
+				} } : {},
+				nowMs: now,
+				store: this.walletCustodyCommitStore
+			});
+			if (walletCustody.status === "rejected") console.warn("[wallet-registration] custody commit rejected", {
+				registrationCeremonyId: ceremony.registrationCeremonyId,
+				reason: walletCustody.reason
+			});
+			const custodyField = walletCustody.status === "not_requested" ? {} : { walletCustody };
+			const authMethod = walletRegistrationFinalizeAuthMethodFromAuthority(ceremonyAuthority);
+			let response;
+			if (ed25519PublicResult && finalizeNearEd25519 && resolvedNearAccount) {
+				const authorityScope = thresholdEd25519AuthorityScopeFromWalletAuthAuthority(walletAuthAuthority);
+				response = authMethod.kind === "passkey" ? {
+					ok: true,
+					kind: "near_ed25519",
+					walletId: ceremony.intent.walletId,
+					authority: walletAuthAuthority,
+					foundingAuthority,
+					foundingAuthMethod,
+					rpId: finalizePasskeyRpId(ceremonyAuthority),
+					authMethod,
+					...custodyField,
+					custodyKeyManifestDigestB64u,
+					authorityScope,
+					accountProvisioning: finalizeNearEd25519.accountProvisioning,
+					resolvedAccount: resolvedNearAccount,
+					ed25519: ed25519PublicResult
+				} : {
+					ok: true,
+					kind: "near_ed25519",
+					walletId: ceremony.intent.walletId,
+					authority: walletAuthAuthority,
+					foundingAuthority,
+					foundingAuthMethod,
+					authMethod,
+					...custodyField,
+					custodyKeyManifestDigestB64u,
+					authorityScope,
+					accountProvisioning: finalizeNearEd25519.accountProvisioning,
+					resolvedAccount: resolvedNearAccount,
+					ed25519: ed25519PublicResult
+				};
+			} else response = authMethod.kind === "passkey" ? {
+				ok: true,
+				kind: "evm_family_ecdsa",
+				walletId: ceremony.intent.walletId,
+				authority: walletAuthAuthority,
+				foundingAuthority,
+				foundingAuthMethod,
+				rpId: finalizePasskeyRpId(ceremonyAuthority),
+				authMethod,
+				...custodyField,
+				custodyKeyManifestDigestB64u,
+				ecdsa: { walletKeys: ecdsaWalletKeys }
+			} : {
+				ok: true,
+				kind: "evm_family_ecdsa",
+				walletId: ceremony.intent.walletId,
+				authority: walletAuthAuthority,
+				foundingAuthority,
+				foundingAuthMethod,
+				authMethod,
+				...custodyField,
+				custodyKeyManifestDigestB64u,
+				ecdsa: { walletKeys: ecdsaWalletKeys }
+			};
+			if (ed25519FinalizePending) {
+				if (!activatedEcdsaBranch) return {
+					ok: false,
+					code: "internal",
+					message: "ECDSA finalize completed without an activated branch to advance"
+				};
+				if (!storedCeremony) return {
+					ok: false,
+					code: "invalid_state",
+					message: "committed mixed registration cannot finalize ECDSA"
+				};
+				if (storedCeremony.signerState.kind !== "signer_set_registration") return {
+					ok: false,
+					code: "invalid_state",
+					message: "signer-set registration state is required"
+				};
+				await store.updateCeremony({
+					expected: storedCeremony,
+					next: {
+						...storedCeremony,
+						signerState: replaceStoredWalletRegistrationSignerBranch({
+							state: storedCeremony.signerState,
+							replacement: buildStoredWalletRegistrationEvmFamilyEcdsaFinalizedBranch({
+								activated: activatedEcdsaBranch,
+								finalizedAtMs: now
+							})
+						})
+					}
+				});
+				finishD1RegistrationRouteTiming(finalizeTiming, totalTiming);
+				return withD1RegistrationRouteDiagnostics(response, finalizeTiming);
+			}
+			finishD1RegistrationRouteTiming(finalizeTiming, totalTiming);
+			return withD1RegistrationRouteDiagnostics(response, finalizeTiming);
+		} catch (error) {
+			return {
+				ok: false,
+				code: "internal",
+				message: errorMessage(error) || "Failed to finalize wallet registration ceremony"
+			};
+		}
+	}
+};
+//#endregion
+export { CloudflareD1WalletRegistrationService, buildActivatedEcdsaFamilyBootstrap, ecdsaStrictRegistrationAuthority, exactEcdsaParticipantPair, hasEcdsaKeyHandleSetMismatch, mergeRouterServerTiming };
+
+//# sourceMappingURL=d1WalletRegistrationService.js.map