@seams/wallet-server 0.5.0

package/dist/esm/router/cloudflare/d1/wallet/d1WalletAddSignerService.js

@@ -0,0 +1,1396 @@
+import { parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
+import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import "../../../../shared-ts/src/utils/encoders.js";
+import { addSignerIntentGrantFromString, computeAddSignerIntentDigestB64u, sameAddSignerIntentV1 } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { parseRouterAbEd25519YaoRegistrationAdmissionRequestV1, sameRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { ecdsaClientRootPublicKey33B64uFromString } from "../../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
+import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
+import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
+import { deriveSigningRootId } from "../../../../shared-ts/src/threshold/signingRootScope.js";
+import { buildRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaRegistrationRequestFactsV1, sameRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbEcdsaRegistrationRequestFactsV1, sameRouterAbEcdsaVerifiedClientActivationFactsV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { sameWalletEd25519SignerRecordV1 } from "../../../../core/WalletStore.js";
+import { registrationPreparationIdFromString } from "../../../../core/types.js";
+import { buildTenantRootIdentityFromAuthenticatedDeploymentV1 } from "../../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
+import { buildRouterAbEd25519YaoRegistrationCapabilityRecordV1 } from "../../../domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.js";
+import { buildRouterAbEd25519YaoAddSignerAdmissionRequestV1, createRouterAbEd25519YaoMaterialActivationRefV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js";
+import { parseRouterAbEd25519YaoRegistrationSideEffectRecordV1, runRouterAbEd25519YaoRegistrationSideEffectV1, throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1 } from "../../../domains/ed25519Yao/registration/routerAbEd25519YaoRegistrationSideEffectBoundary.js";
+import { buildYaoEd25519WalletSignerRecord, ed25519NearPublicKeyFromBytes, implicitNearAccountIdFromEd25519PublicKeyBytes } from "../ed25519Yao/d1Ed25519YaoWalletSigner.js";
+import { routerAbEcdsaStrictRegistrationRequestMatchesFacts } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
+import { buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, normalizeThresholdEcdsaChainTargets, parseD1AddSignerIntent, parseD1RuntimePolicyScope, parseD1StoredAddSignerAuth, parseD1StoredAddSignerIntent, parseD1StoredWalletAddSignerCeremony, parseD1WalletAddSignerFinalizeTerminalResponse, parseWalletIdForIntent, positiveIntegerArraysEqual, runtimePolicyScopeMatches, thresholdEcdsaChainTargetsEqual } from "../registration/d1RegistrationCeremonyRecords.js";
+import { buildD1EvmFamilyEcdsaRegistrationPrepare } from "../registration/d1EvmFamilyEcdsaRegistrationBranch.js";
+import { buildActivatedEcdsaFamilyBootstrap, ecdsaStrictRegistrationAuthority, exactEcdsaParticipantPair } from "../registration/d1WalletRegistrationService.js";
+import { computeWalletAddSignerEcdsaActivationRequestDigestB64u } from "../../../../shared-ts/src/utils/walletAddSignerActivation.js";
+//#region src/router/cloudflare/d1/wallet/d1WalletAddSignerService.ts
+function isWalletAddSignerStartWebAuthnCoreSuccess(response) {
+	return response.authorizationKind === "webauthn_assertion";
+}
+const ADD_SIGNER_CEREMONY_TTL_MS = 10 * 6e4;
+const ADD_SIGNER_REPLAY_TTL_MS = 10 * 6e4;
+const WALLET_ADD_SIGNER_START_RESUME_AFTER_MS = 3e4;
+const WALLET_ADD_SIGNER_FINALIZE_RESUME_AFTER_MS = 3e4;
+const WALLET_ADD_SIGNER_ROUTER_POLICY_VERSION = "wallet-add-signer-v1";
+function addSignerRecordValue(value) {
+	return isPlainObject(value) ? value : null;
+}
+function sameWalletAddSignerByteSequenceV1(left, right) {
+	if (left.length !== right.length) return false;
+	for (let index = 0; index < left.length; index += 1) if (left[index] !== right[index]) return false;
+	return true;
+}
+function sameStoredAddSignerIntentV1(left, right) {
+	return left.kind === right.kind && left.grant === right.grant && sameAddSignerIntentV1(left.intent, right.intent) && left.digestB64u === right.digestB64u && left.orgId === right.orgId && left.signingRootId === right.signingRootId && left.signingRootVersion === right.signingRootVersion && left.expectedOrigin === right.expectedOrigin && left.expiresAtMs === right.expiresAtMs;
+}
+function sameEcdsaDerivationPublicIdentityV1(left, right) {
+	return left.derivationClientSharePublicKey33B64u === right.derivationClientSharePublicKey33B64u && left.relayerPublicKey33B64u === right.relayerPublicKey33B64u && left.groupPublicKey33B64u === right.groupPublicKey33B64u && left.ethereumAddress === right.ethereumAddress;
+}
+function sameEcdsaDerivationServerBootstrapV1(left, right) {
+	return left.formatVersion === right.formatVersion && left.walletId === right.walletId && left.evmFamilySigningKeySlotId === right.evmFamilySigningKeySlotId && left.ecdsaThresholdKeyId === right.ecdsaThresholdKeyId && left.relayerKeyId === right.relayerKeyId && left.applicationBindingDigestB64u === right.applicationBindingDigestB64u && left.contextBinding32B64u === right.contextBinding32B64u && sameEcdsaDerivationPublicIdentityV1(left.publicIdentity, right.publicIdentity) && left.clientShareRetryCounter === right.clientShareRetryCounter && left.relayerShareRetryCounter === right.relayerShareRetryCounter && left.publicTranscriptDigest32B64u === right.publicTranscriptDigest32B64u && left.keyHandle === right.keyHandle && left.signingRootId === right.signingRootId && left.signingRootVersion === right.signingRootVersion && left.thresholdEcdsaPublicKeyB64u === right.thresholdEcdsaPublicKeyB64u && left.ethereumAddress === right.ethereumAddress && left.relayerVerifyingShareB64u === right.relayerVerifyingShareB64u && positiveIntegerArraysEqual(left.participantIds, right.participantIds) && left.thresholdSessionId === right.thresholdSessionId && left.activationEpoch === right.activationEpoch && left.expiresAtMs === right.expiresAtMs && left.expiresAt === right.expiresAt && left.remainingUses === right.remainingUses && sameRouterAbEcdsaDerivationNormalSigningStateV1(left.routerAbEcdsaDerivationNormalSigning, right.routerAbEcdsaDerivationNormalSigning);
+}
+function walletAddSignerStartResponseFromCeremony(ceremony) {
+	const base = {
+		ok: true,
+		addSignerCeremonyId: ceremony.addSignerCeremonyId,
+		intent: ceremony.intent
+	};
+	switch (ceremony.signerState.kind) {
+		case "near_ed25519_yao_add_signer_authorized":
+			if (ceremony.auth.kind !== "webauthn_assertion") return null;
+			return {
+				...base,
+				authorizationKind: ceremony.auth.kind,
+				kind: "near_ed25519",
+				ed25519: { admissionRequest: ceremony.signerState.admissionRequest }
+			};
+		case "ecdsa_add_signer_prepared": return {
+			...base,
+			authorizationKind: ceremony.auth.kind,
+			kind: "evm_family_ecdsa",
+			ecdsa: {
+				kind: ceremony.signerState.derivationKind,
+				chainTargets: ceremony.signerState.chainTargets,
+				prepare: ceremony.signerState.prepare,
+				strictRegistration: ceremony.signerState.strictRegistration
+			}
+		};
+		case "ecdsa_add_signer_pending_activation":
+		case "ecdsa_add_signer_activation_claimed":
+		case "ecdsa_add_signer_activated":
+		case "near_ed25519_yao_add_signer_activated":
+		case "near_ed25519_yao_add_signer_finalizing": return null;
+		default: return assertNeverWalletAddSignerState(ceremony.signerState);
+	}
+}
+function hasExactWalletAddSignerResponseKeys(record, expectedKeys) {
+	const ownKeys = Reflect.ownKeys(record);
+	return ownKeys.length === expectedKeys.length && ownKeys.every((key) => typeof key === "string" && expectedKeys.includes(key));
+}
+function parseWalletAddSignerStartResponse(raw, expected) {
+	const response = addSignerRecordValue(raw);
+	if (!response || response.ok !== true) return null;
+	if (!hasExactWalletAddSignerResponseKeys(response, [
+		"ok",
+		"addSignerCeremonyId",
+		"intent",
+		"authorizationKind",
+		"kind",
+		expected.kind === "near_ed25519" ? "ed25519" : "ecdsa"
+	]) || response.addSignerCeremonyId !== expected.addSignerCeremonyId || response.authorizationKind !== expected.authorizationKind || response.kind !== expected.kind) return null;
+	const intent = addSignerRecordValue(response.intent);
+	const expectedIntentKeys = expected.intent.runtimePolicyScope ? [
+		"version",
+		"walletId",
+		"signerSelection",
+		"runtimePolicyScope",
+		"nonceB64u"
+	] : [
+		"version",
+		"walletId",
+		"signerSelection",
+		"nonceB64u"
+	];
+	if (!intent || !hasExactWalletAddSignerResponseKeys(intent, expectedIntentKeys)) return null;
+	const parsedIntent = parseD1AddSignerIntent(response.intent);
+	if (!parsedIntent || !sameAddSignerIntentV1(parsedIntent, expected.intent)) return null;
+	switch (expected.kind) {
+		case "near_ed25519": {
+			const ed25519 = addSignerRecordValue(response.ed25519);
+			if (!ed25519 || !hasExactWalletAddSignerResponseKeys(ed25519, ["admissionRequest"])) return null;
+			const parsedAdmission = parseRouterAbEd25519YaoRegistrationAdmissionRequestV1(ed25519.admissionRequest);
+			if (!parsedAdmission.ok || !sameRouterAbEd25519YaoRegistrationAdmissionRequestV1(parsedAdmission.value, expected.ed25519.admissionRequest)) return null;
+			return expected;
+		}
+		case "evm_family_ecdsa": {
+			const ecdsa = addSignerRecordValue(response.ecdsa);
+			if (!ecdsa || !hasExactWalletAddSignerResponseKeys(ecdsa, [
+				"kind",
+				"chainTargets",
+				"prepare",
+				"strictRegistration"
+			]) || ecdsa.kind !== expected.ecdsa.kind || !Array.isArray(ecdsa.chainTargets) || !thresholdEcdsaChainTargetsEqual(ecdsa.chainTargets, expected.ecdsa.chainTargets)) return null;
+			const prepare = addSignerRecordValue(ecdsa.prepare);
+			const expectedPrepare = expected.ecdsa.prepare;
+			if (!prepare || !hasExactWalletAddSignerResponseKeys(prepare, [
+				"formatVersion",
+				"walletId",
+				"evmFamilySigningKeySlotId",
+				"ecdsaThresholdKeyId",
+				"signingRootId",
+				"signingRootVersion",
+				"keyScope",
+				"relayerKeyId",
+				"registrationPreparationId",
+				"requestId",
+				"thresholdSessionId",
+				"ttlMs",
+				"remainingUses",
+				"participantIds",
+				"runtimePolicyScope"
+			]) || prepare.formatVersion !== expectedPrepare.formatVersion || prepare.walletId !== expectedPrepare.walletId || prepare.evmFamilySigningKeySlotId !== expectedPrepare.evmFamilySigningKeySlotId || prepare.ecdsaThresholdKeyId !== expectedPrepare.ecdsaThresholdKeyId || prepare.signingRootId !== expectedPrepare.signingRootId || prepare.signingRootVersion !== expectedPrepare.signingRootVersion || prepare.keyScope !== expectedPrepare.keyScope || prepare.relayerKeyId !== expectedPrepare.relayerKeyId || prepare.registrationPreparationId !== String(expectedPrepare.registrationPreparationId) || prepare.requestId !== expectedPrepare.requestId || prepare.thresholdSessionId !== expectedPrepare.thresholdSessionId || prepare.ttlMs !== expectedPrepare.ttlMs || prepare.remainingUses !== expectedPrepare.remainingUses || !Array.isArray(prepare.participantIds) || !positiveIntegerArraysEqual(prepare.participantIds, expectedPrepare.participantIds)) return null;
+			const parsedRuntimePolicyScope = parseD1RuntimePolicyScope(prepare.runtimePolicyScope);
+			if (!parsedRuntimePolicyScope || !runtimePolicyScopeMatches(parsedRuntimePolicyScope, expectedPrepare.runtimePolicyScope)) return null;
+			let parsedStrictRegistration;
+			try {
+				parsedStrictRegistration = parseRouterAbEcdsaRegistrationRequestFactsV1(ecdsa.strictRegistration);
+			} catch {
+				return null;
+			}
+			return sameRouterAbEcdsaRegistrationRequestFactsV1(parsedStrictRegistration, expected.ecdsa.strictRegistration) ? expected : null;
+		}
+		default: return assertNeverWalletAddSignerStartResponse(expected);
+	}
+}
+function parseWalletAddSignerStartPrepared(raw) {
+	const record = addSignerRecordValue(raw);
+	if (!record || record.kind !== "d1_wallet_add_signer_start_prepared_v1") return null;
+	const addSignerCeremonyId = normalizeOptionalTrimmedString(record.addSignerCeremonyId);
+	const registrationPreparationId = normalizeOptionalTrimmedString(record.registrationPreparationId);
+	const expiresAtMs = record.expiresAtMs;
+	const storedIntent = parseD1StoredAddSignerIntent(record.storedIntent);
+	const auth = parseD1StoredAddSignerAuth(record.auth);
+	if (!addSignerCeremonyId || !registrationPreparationId || typeof expiresAtMs !== "number" || !Number.isSafeInteger(expiresAtMs) || expiresAtMs <= 0 || !storedIntent || !auth) return null;
+	return {
+		kind: "d1_wallet_add_signer_start_prepared_v1",
+		addSignerCeremonyId,
+		registrationPreparationId,
+		expiresAtMs,
+		storedIntent,
+		auth
+	};
+}
+function parseWalletAddSignerStartTerminal(raw) {
+	const record = addSignerRecordValue(raw);
+	if (!record) return null;
+	if (record.kind === "d1_wallet_add_signer_start_rejected_v1") {
+		const response = addSignerRecordValue(record.response);
+		const code = normalizeOptionalTrimmedString(response?.code);
+		const message = normalizeOptionalTrimmedString(response?.message);
+		return response?.ok === false && code && message ? {
+			kind: "d1_wallet_add_signer_start_rejected_v1",
+			response: {
+				ok: false,
+				code,
+				message
+			}
+		} : null;
+	}
+	if (record.kind !== "d1_wallet_add_signer_start_succeeded_v1") return null;
+	const ceremony = parseD1StoredWalletAddSignerCeremony(record.ceremony);
+	const response = addSignerRecordValue(record.response);
+	if (!ceremony || !response || response.ok !== true) return null;
+	const parsedResponse = walletAddSignerStartResponseFromCeremony(ceremony);
+	if (!parsedResponse || !parseWalletAddSignerStartResponse(response, parsedResponse)) return null;
+	return {
+		kind: "d1_wallet_add_signer_start_succeeded_v1",
+		ceremony,
+		response: parsedResponse
+	};
+}
+function parseD1WalletAddSignerStartSideEffectRecord(raw) {
+	return parseRouterAbEd25519YaoRegistrationSideEffectRecordV1(raw, {
+		operation: "add_signer_start",
+		parsePrepared: parseWalletAddSignerStartPrepared,
+		parseResponse: parseWalletAddSignerStartTerminal
+	});
+}
+async function walletAddSignerStartStableToken(grant, domain) {
+	return base64UrlEncode(await sha256BytesUtf8(`${domain}\u0000${grant}`));
+}
+async function walletAddSignerStartRequestFingerprint(request) {
+	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(request)));
+}
+async function buildD1WalletAddSignerStartPrepared(input) {
+	return {
+		kind: "d1_wallet_add_signer_start_prepared_v1",
+		addSignerCeremonyId: `wasc_${await walletAddSignerStartStableToken(input.storedIntent.grant, "wallet-add-signer-ceremony-v1")}`,
+		registrationPreparationId: `regprep_${await walletAddSignerStartStableToken(input.storedIntent.grant, "wallet-add-signer-preparation-v1")}`,
+		expiresAtMs: Math.min(input.storedIntent.expiresAtMs, Date.now() + ADD_SIGNER_CEREMONY_TTL_MS),
+		storedIntent: input.storedIntent,
+		auth: input.auth
+	};
+}
+async function returnD1WalletAddSignerStartPrepared(prepared) {
+	return prepared;
+}
+async function rejectUnexpectedWalletAddSignerStartPreparation() {
+	throw new Error("persisted add-signer start claim disappeared during reconciliation");
+}
+async function fingerprintD1WalletAddSignerStartPrepared(prepared) {
+	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(prepared)));
+}
+function parseWalletAddSignerFinalizePrepared(raw) {
+	const record = addSignerRecordValue(raw);
+	if (!record) return null;
+	if (record.kind === "d1_wallet_add_signer_finalize_ed25519_prepared_v1") {
+		const finalizingAtMs = record.finalizingAtMs;
+		if (typeof finalizingAtMs !== "number" || !Number.isSafeInteger(finalizingAtMs) || finalizingAtMs <= 0) return null;
+		return {
+			kind: "d1_wallet_add_signer_finalize_ed25519_prepared_v1",
+			finalizingAtMs
+		};
+	}
+	if (record.kind !== "d1_wallet_add_signer_finalize_ecdsa_prepared_v1") return null;
+	const signerWriteAtMs = record.signerWriteAtMs;
+	return typeof signerWriteAtMs === "number" && Number.isSafeInteger(signerWriteAtMs) && signerWriteAtMs > 0 ? {
+		kind: "d1_wallet_add_signer_finalize_ecdsa_prepared_v1",
+		signerWriteAtMs
+	} : null;
+}
+function parseD1WalletAddSignerFinalizeSideEffectRecord(raw) {
+	return parseRouterAbEd25519YaoRegistrationSideEffectRecordV1(raw, {
+		operation: "add_signer_finalize",
+		parsePrepared: parseWalletAddSignerFinalizePrepared,
+		parseResponse: parseD1WalletAddSignerFinalizeTerminalResponse
+	});
+}
+async function fingerprintD1WalletAddSignerFinalizePrepared(prepared) {
+	return base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(prepared)));
+}
+async function returnD1WalletAddSignerFinalizePrepared(prepared) {
+	return prepared;
+}
+async function rejectUnexpectedWalletAddSignerFinalizePreparation() {
+	throw new Error("persisted add-signer finalize claim disappeared during reconciliation");
+}
+function buildD1WalletAddSignerFinalizePrepared(input) {
+	if (input.request.kind === "evm_family_ecdsa") return {
+		kind: "d1_wallet_add_signer_finalize_ecdsa_prepared_v1",
+		signerWriteAtMs: input.nowMs
+	};
+	if (input.ceremony.signerState.kind === "near_ed25519_yao_add_signer_finalizing") return {
+		kind: "d1_wallet_add_signer_finalize_ed25519_prepared_v1",
+		finalizingAtMs: input.ceremony.signerState.finalizingAtMs
+	};
+	return {
+		kind: "d1_wallet_add_signer_finalize_ed25519_prepared_v1",
+		finalizingAtMs: input.nowMs
+	};
+}
+function rejectedWalletAddSignerStartTerminal(code, message) {
+	return {
+		kind: "d1_wallet_add_signer_start_rejected_v1",
+		response: {
+			ok: false,
+			code,
+			message
+		}
+	};
+}
+function rejectedWalletAddSignerStartResult(input) {
+	return rejectedWalletAddSignerStartTerminal(input.code, input.message);
+}
+function successfulWalletAddSignerStartTerminal(ceremony) {
+	const response = walletAddSignerStartResponseFromCeremony(ceremony);
+	if (!response) throw new Error("add-signer ceremony cannot produce a start response");
+	return {
+		kind: "d1_wallet_add_signer_start_succeeded_v1",
+		ceremony,
+		response
+	};
+}
+function assertNeverWalletAddSignerState(value) {
+	throw new Error(`Unhandled add-signer state: ${String(value)}`);
+}
+function assertNeverWalletAddSignerFinalizeRequest(value) {
+	throw new Error(`Unhandled add-signer finalize request: ${String(value)}`);
+}
+function assertNeverWalletAddSignerStartResponse(value) {
+	throw new Error(`Unhandled wallet add-signer start response: ${String(value)}`);
+}
+function assertNeverWalletAddSignerStartRun(value) {
+	throw new Error(`Unhandled wallet add-signer start result: ${String(value)}`);
+}
+function assertNeverWalletAddSignerFinalizeRun(value) {
+	throw new Error(`Unhandled wallet add-signer finalize result: ${String(value)}`);
+}
+function errorMessage(error) {
+	return error instanceof Error ? error.message : String(error || "");
+}
+function resolveEd25519AddSignerParticipantIds(selection) {
+	const participantIds = selection.ed25519.participantIds;
+	const firstParticipantId = participantIds[0];
+	const secondParticipantId = participantIds[1];
+	if (participantIds.length !== 2 || firstParticipantId === void 0 || secondParticipantId === void 0 || !Number.isSafeInteger(firstParticipantId) || !Number.isSafeInteger(secondParticipantId) || firstParticipantId <= 0 || secondParticipantId <= 0 || firstParticipantId === secondParticipantId) return null;
+	return [firstParticipantId, secondParticipantId];
+}
+async function cleanupFinalizedAddSignerCeremony(input) {
+	try {
+		await input.store.takeAddSignerCeremony(input.addSignerCeremonyId);
+	} catch {}
+}
+function sameWalletAddSignerFinalizeRequestV1(left, right) {
+	if (left.addSignerCeremonyId !== right.addSignerCeremonyId || left.idempotencyKey !== right.idempotencyKey || left.kind !== right.kind || left.custodyKeySet.kind !== right.custodyKeySet.kind || left.custodyKeySet.keyManifestDigestB64u !== right.custodyKeySet.keyManifestDigestB64u) return false;
+	switch (left.kind) {
+		case "near_ed25519":
+			if (right.kind !== "near_ed25519") return false;
+			return left.custodyKeySet.registeredPublicKeyB64u === right.custodyKeySet.registeredPublicKeyB64u && left.activationReference.lifecycleId === right.activationReference.lifecycleId && sameWalletAddSignerByteSequenceV1(left.activationReference.sessionId, right.activationReference.sessionId);
+		case "evm_family_ecdsa":
+			if (right.kind !== "evm_family_ecdsa") return false;
+			return left.custodyKeySet.clientRootPublicKey33B64u === right.custodyKeySet.clientRootPublicKey33B64u && left.expectedKeyHandles.length === right.expectedKeyHandles.length && left.expectedKeyHandles.every((keyHandle, index) => keyHandle === right.expectedKeyHandles[index]);
+		default: return assertNeverWalletAddSignerFinalizeRequest(left);
+	}
+}
+function normalizeWalletAddSignerFinalizeRequest(request, idempotencyKey) {
+	if (request.kind === "near_ed25519") return {
+		kind: "near_ed25519",
+		addSignerCeremonyId: request.addSignerCeremonyId,
+		idempotencyKey,
+		custodyKeySet: request.custodyKeySet,
+		activationReference: {
+			lifecycleId: request.ed25519.activationReference.lifecycle_id,
+			sessionId: request.ed25519.activationReference.session_id
+		}
+	};
+	const expectedKeyHandle = normalizeOptionalTrimmedString(request.ecdsa.expectedKeyHandles[0]);
+	if (!expectedKeyHandle) throw new Error("one exact ECDSA key handle is required");
+	return {
+		kind: "evm_family_ecdsa",
+		addSignerCeremonyId: request.addSignerCeremonyId,
+		idempotencyKey,
+		custodyKeySet: request.custodyKeySet,
+		expectedKeyHandles: [expectedKeyHandle]
+	};
+}
+function updateAddSignerCeremonyState(input) {
+	return {
+		addSignerCeremonyId: input.ceremony.addSignerCeremonyId,
+		intent: input.ceremony.intent,
+		digestB64u: input.ceremony.digestB64u,
+		orgId: input.ceremony.orgId,
+		signingRootId: input.signingRootId,
+		signingRootVersion: input.signingRootVersion,
+		expiresAtMs: input.ceremony.expiresAtMs,
+		auth: input.ceremony.auth,
+		signerState: input.signerState
+	};
+}
+function storedEcdsaAddSignerBootstrap(bootstrap) {
+	return {
+		formatVersion: bootstrap.formatVersion,
+		walletId: bootstrap.walletId,
+		evmFamilySigningKeySlotId: bootstrap.evmFamilySigningKeySlotId,
+		ecdsaThresholdKeyId: bootstrap.ecdsaThresholdKeyId,
+		relayerKeyId: bootstrap.relayerKeyId,
+		applicationBindingDigestB64u: bootstrap.applicationBindingDigestB64u,
+		contextBinding32B64u: bootstrap.contextBinding32B64u,
+		publicIdentity: bootstrap.publicIdentity,
+		clientShareRetryCounter: bootstrap.clientShareRetryCounter,
+		relayerShareRetryCounter: bootstrap.relayerShareRetryCounter,
+		publicTranscriptDigest32B64u: bootstrap.publicTranscriptDigest32B64u,
+		keyHandle: bootstrap.keyHandle,
+		signingRootId: bootstrap.signingRootId,
+		signingRootVersion: bootstrap.signingRootVersion,
+		thresholdEcdsaPublicKeyB64u: bootstrap.thresholdEcdsaPublicKeyB64u,
+		ethereumAddress: bootstrap.ethereumAddress,
+		relayerVerifyingShareB64u: bootstrap.relayerVerifyingShareB64u,
+		thresholdSessionId: bootstrap.thresholdSessionId,
+		activationEpoch: bootstrap.activationEpoch,
+		expiresAtMs: bootstrap.expiresAtMs,
+		expiresAt: bootstrap.expiresAt,
+		remainingUses: bootstrap.remainingUses,
+		participantIds: [...exactEcdsaParticipantPair(bootstrap.participantIds)],
+		routerAbEcdsaDerivationNormalSigning: bootstrap.routerAbEcdsaDerivationNormalSigning
+	};
+}
+var CloudflareD1WalletAddSignerService = class {
+	constructor(input) {
+		this.getRegistrationCeremonyIntentStore = input.getRegistrationCeremonyIntentStore;
+		this.getEd25519YaoProductRegistration = input.getEd25519YaoProductRegistration;
+		this.ecdsaStrictRegistration = input.ecdsaStrictRegistration;
+		this.tenantRootCustodyLineage = input.tenantRootCustodyLineage;
+		this.getWalletStore = input.getWalletStore;
+		this.walletAuthMethods = input.walletAuthMethods;
+		this.passkeyCustodyEnvelopes = input.passkeyCustodyEnvelopes;
+		this.startSideEffects = input.startSideEffects;
+		this.finalizeSideEffects = input.finalizeSideEffects;
+	}
+	async getWalletAddSignerRuntimePolicyScope(addSignerCeremonyId) {
+		const ceremony = await this.getRegistrationCeremonyIntentStore().getAddSignerCeremony(addSignerCeremonyId);
+		if (!ceremony) return null;
+		return parseD1RuntimePolicyScope(ceremony.intent.runtimePolicyScope) ?? null;
+	}
+	async startWalletAddSigner(request) {
+		try {
+			const store = this.getRegistrationCeremonyIntentStore();
+			const walletId = parseWalletIdForIntent(request.walletId);
+			if (!walletId) return {
+				ok: false,
+				code: "invalid_body",
+				message: "walletId is required"
+			};
+			const grant = addSignerIntentGrantFromString(normalizeOptionalTrimmedString(request.addSignerIntentGrant) || "");
+			if (!grant) return {
+				ok: false,
+				code: "invalid_grant",
+				message: "add-signer intent grant is required"
+			};
+			if (request.intent.walletId !== walletId) return {
+				ok: false,
+				code: "invalid_body",
+				message: "add-signer walletId mismatch"
+			};
+			const digestB64u = normalizeOptionalTrimmedString(request.addSignerIntentDigestB64u);
+			const requestDigest = await computeAddSignerIntentDigestB64u(request.intent);
+			if (!digestB64u || digestB64u !== requestDigest) return {
+				ok: false,
+				code: "invalid_body",
+				message: "add-signer intent digest mismatch"
+			};
+			const requestFingerprint = await walletAddSignerStartRequestFingerprint(request);
+			const startKey = `add-signer:${await walletAddSignerStartStableToken(grant, "wallet-add-signer-start-claim-v1")}`;
+			const existing = await this.startSideEffects.read(startKey);
+			let prepared = null;
+			if (existing.kind === "missing") {
+				const preview = await store.getAddSignerIntent(grant);
+				if (!preview) return {
+					ok: false,
+					code: "invalid_grant",
+					message: "add-signer intent grant expired"
+				};
+				if (digestB64u !== preview.digestB64u || !sameAddSignerIntentV1(request.intent, preview.intent)) return {
+					ok: false,
+					code: "invalid_body",
+					message: "add-signer intent does not match its grant"
+				};
+				if (preview.intent.signerSelection.mode === "ed25519" && request.auth.kind !== "webauthn_assertion") return {
+					ok: false,
+					code: "unauthorized",
+					message: "Ed25519 Yao add-signer requires a fresh WebAuthn assertion"
+				};
+				const storedAuth = await this.walletAuthMethods.resolveAddSignerExistingAuth({
+					auth: request.auth,
+					walletId,
+					intent: preview.intent,
+					nowMs: Date.now()
+				});
+				if (!storedAuth.ok) return storedAuth;
+				prepared = await buildD1WalletAddSignerStartPrepared({
+					storedIntent: preview,
+					auth: storedAuth.auth
+				});
+			}
+			const run = await runRouterAbEd25519YaoRegistrationSideEffectV1(this.startSideEffects, {
+				kind: "prepared_resumable",
+				operation: "add_signer_start",
+				key: startKey,
+				requestFingerprint,
+				resumeAfterMs: WALLET_ADD_SIGNER_START_RESUME_AFTER_MS,
+				nowMs: Date.now,
+				prepare: prepared ? returnD1WalletAddSignerStartPrepared.bind(null, prepared) : rejectUnexpectedWalletAddSignerStartPreparation,
+				derivePreparedArtifactFingerprint: fingerprintD1WalletAddSignerStartPrepared,
+				execute: this.executeWalletAddSignerStartSideEffect.bind(this, {
+					request,
+					store,
+					walletId
+				})
+			});
+			switch (run.kind) {
+				case "executed":
+				case "exact_replay":
+					if (run.value.kind === "d1_wallet_add_signer_start_rejected_v1") return run.value.response;
+					if (!isWalletAddSignerStartWebAuthnCoreSuccess(run.value.response)) return {
+						ok: false,
+						code: "invalid_state",
+						message: "add-signer authorization branch is invalid"
+					};
+					return await this.attachWalletAddSignerCustodyEnvelope({
+						ceremony: run.value.ceremony,
+						response: run.value.response
+					});
+				case "request_conflict": return {
+					ok: false,
+					code: "idempotency_conflict",
+					message: "add-signer intent grant belongs to a different start request"
+				};
+				case "in_progress": return {
+					ok: false,
+					code: "conflict",
+					message: "add-signer start is already in progress; retry later"
+				};
+				case "uncertain": return {
+					ok: false,
+					code: "internal",
+					message: run.message || "Failed to reconcile wallet add-signer start"
+				};
+				default: return assertNeverWalletAddSignerStartRun(run);
+			}
+		} catch (error) {
+			return {
+				ok: false,
+				code: "internal",
+				message: errorMessage(error) || "Failed to start wallet add-signer ceremony"
+			};
+		}
+	}
+	async attachWalletAddSignerCustodyEnvelope(input) {
+		if (input.ceremony.auth.kind !== "webauthn_assertion") return {
+			ok: false,
+			code: "invalid_state",
+			message: "WebAuthn-authorized add-signer preparation lost its factor identity"
+		};
+		const rpId = parseWebAuthnRpId(input.ceremony.auth.rpId);
+		const credentialId = parseWebAuthnCredentialIdB64u(input.ceremony.auth.credentialIdB64u);
+		if (!rpId.ok || !credentialId.ok) return {
+			ok: false,
+			code: "invalid_state",
+			message: "WebAuthn-authorized add-signer preparation has an invalid factor identity"
+		};
+		const lookup = await this.passkeyCustodyEnvelopes.lookupEnvelopeForFactor({
+			walletId: input.ceremony.intent.walletId,
+			factor: {
+				kind: "passkey",
+				rpId: rpId.value,
+				credentialIdB64u: credentialId.value
+			}
+		});
+		if (lookup.kind !== "active") return {
+			ok: false,
+			code: "custody_unavailable",
+			message: "the verified passkey has no active wallet custody envelope"
+		};
+		switch (input.response.kind) {
+			case "near_ed25519": return {
+				...input.response,
+				ed25519: {
+					...input.response.ed25519,
+					custodyEnvelope: lookup.envelope
+				}
+			};
+			case "evm_family_ecdsa": return {
+				...input.response,
+				ecdsa: {
+					...input.response.ecdsa,
+					custodyEnvelope: lookup.envelope
+				}
+			};
+		}
+	}
+	async executeWalletAddSignerStartSideEffect(input, prepared, attempt) {
+		const terminal = await this.executeWalletAddSignerStart(input, prepared, attempt);
+		if (terminal.kind === "d1_wallet_add_signer_start_rejected_v1") throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1(terminal.response);
+		return terminal;
+	}
+	async executeWalletAddSignerStart(input, prepared, attempt) {
+		const existingCeremony = await input.store.getAddSignerCeremony(prepared.addSignerCeremonyId);
+		if (existingCeremony) {
+			if (existingCeremony.digestB64u !== prepared.storedIntent.digestB64u || !sameAddSignerIntentV1(existingCeremony.intent, prepared.storedIntent.intent)) throw new Error("add-signer ceremony conflicts with its durable claim");
+			return successfulWalletAddSignerStartTerminal(existingCeremony);
+		}
+		if (input.request.addSignerIntentDigestB64u !== prepared.storedIntent.digestB64u) return rejectedWalletAddSignerStartTerminal("invalid_body", "add-signer intent digest mismatch");
+		if (!sameAddSignerIntentV1(input.request.intent, prepared.storedIntent.intent)) return rejectedWalletAddSignerStartTerminal("invalid_body", "add-signer intent does not match its grant");
+		const walletStore = this.getWalletStore();
+		if (!await walletStore.getWallet({ walletId: input.walletId })) return rejectedWalletAddSignerStartTerminal("not_found", "wallet not found");
+		const runtimePolicyScope = parseD1RuntimePolicyScope(prepared.storedIntent.intent.runtimePolicyScope);
+		if (!runtimePolicyScope) return rejectedWalletAddSignerStartTerminal("invalid_body", "add-signer requires a runtime policy scope");
+		const selection = prepared.storedIntent.intent.signerSelection;
+		let yaoRuntime = null;
+		if (selection.mode === "ed25519") {
+			const ed25519Selection = selection.ed25519;
+			if (ed25519Selection.mode !== "create_implicit_near_account") return rejectedWalletAddSignerStartTerminal("invalid_body", "Ed25519 Yao add-signer requires implicit NEAR account creation");
+			if (!resolveEd25519AddSignerParticipantIds(selection)) return rejectedWalletAddSignerStartTerminal("invalid_body", "Ed25519 Yao add-signer requires two distinct positive participants");
+			if (await walletStore.getEd25519SignerBySlot({
+				walletId: input.walletId,
+				signerSlot: ed25519Selection.signerSlot
+			})) return rejectedWalletAddSignerStartTerminal("signer_conflict", "Ed25519 signer slot is already occupied");
+			yaoRuntime = this.getEd25519YaoProductRegistration();
+			if (!yaoRuntime) return rejectedWalletAddSignerStartTerminal("not_configured", "Ed25519 Yao add-signer is not configured on this server");
+		}
+		const consumedIntent = await input.store.takeAddSignerIntent(prepared.storedIntent.grant);
+		if (!consumedIntent && attempt === "fresh") return rejectedWalletAddSignerStartTerminal("invalid_grant", "add-signer intent grant expired");
+		if (consumedIntent && !sameStoredAddSignerIntentV1(consumedIntent, prepared.storedIntent)) throw new Error("consumed add-signer intent conflicts with its durable claim");
+		const storedIntent = consumedIntent || prepared.storedIntent;
+		const signingRootId = storedIntent.signingRootId || deriveSigningRootId(runtimePolicyScope);
+		const signingRootVersion = normalizeOptionalTrimmedString(storedIntent.signingRootVersion) || runtimePolicyScope.signingRootVersion;
+		let ceremony;
+		if (selection.mode === "ed25519" && yaoRuntime) {
+			if (prepared.auth.kind !== "webauthn_assertion") return rejectedWalletAddSignerStartTerminal("unauthorized", "Ed25519 Yao add-signer requires a fresh WebAuthn assertion");
+			const ed25519Intent = {
+				version: "add_signer_intent_v1",
+				walletId: storedIntent.intent.walletId,
+				signerSelection: selection,
+				runtimePolicyScope,
+				nonceB64u: storedIntent.intent.nonceB64u
+			};
+			const admissionRequest = await buildRouterAbEd25519YaoAddSignerAdmissionRequestV1({
+				addSignerCeremonyId: prepared.addSignerCeremonyId,
+				walletId: input.walletId,
+				signingRootId,
+				signingRootVersion,
+				selection,
+				signingWorkerId: yaoRuntime.signingWorkerId,
+				materialActivation: createRouterAbEd25519YaoMaterialActivationRefV1({
+					walletId: input.walletId,
+					signingWorkerId: yaoRuntime.signingWorkerId
+				})
+			});
+			const bound = await yaoRuntime.bindVerifiedIntent({
+				kind: "verified_add_signer_intent",
+				addSignerIntentGrant: storedIntent.grant,
+				intent: ed25519Intent,
+				admissionRequest,
+				expiresAtMs: prepared.expiresAtMs
+			});
+			if (!bound.ok) return rejectedWalletAddSignerStartResult(bound);
+			ceremony = {
+				addSignerCeremonyId: prepared.addSignerCeremonyId,
+				intent: ed25519Intent,
+				digestB64u: storedIntent.digestB64u,
+				orgId: runtimePolicyScope.orgId,
+				signingRootId,
+				signingRootVersion,
+				expiresAtMs: prepared.expiresAtMs,
+				auth: prepared.auth,
+				signerState: {
+					kind: "near_ed25519_yao_add_signer_authorized",
+					admissionRequest
+				}
+			};
+		} else if (selection.mode === "ecdsa") {
+			const chainTargets = normalizeThresholdEcdsaChainTargets(selection.ecdsa.chainTargets);
+			if (!chainTargets) return rejectedWalletAddSignerStartTerminal("invalid_body", "ECDSA add-signer contains an invalid chain target");
+			const ecdsaPrepared = await buildD1EvmFamilyEcdsaRegistrationPrepare({
+				registrationPurpose: "wallet_add_signer",
+				registrationCeremonyId: prepared.addSignerCeremonyId,
+				registrationPreparationId: registrationPreparationIdFromString(prepared.registrationPreparationId),
+				walletId: input.walletId,
+				signingRootId,
+				signingRootVersion,
+				chainTargets,
+				participantIds: [...selection.ecdsa.participantIds],
+				runtimePolicyScope,
+				strictRegistration: this.ecdsaStrictRegistration
+			});
+			if (!ecdsaPrepared.ok) return rejectedWalletAddSignerStartResult(ecdsaPrepared);
+			const ecdsa = ecdsaPrepared.ecdsa;
+			ceremony = {
+				addSignerCeremonyId: prepared.addSignerCeremonyId,
+				intent: storedIntent.intent,
+				digestB64u: storedIntent.digestB64u,
+				orgId: runtimePolicyScope.orgId,
+				signingRootId,
+				signingRootVersion,
+				expiresAtMs: prepared.expiresAtMs,
+				auth: prepared.auth,
+				signerState: {
+					kind: "ecdsa_add_signer_prepared",
+					derivationKind: ecdsa.kind,
+					chainTargets: ecdsa.chainTargets,
+					prepare: ecdsa.prepare,
+					strictRegistration: ecdsa.strictRegistration
+				}
+			};
+		} else throw new Error("add-signer selection cannot be executed");
+		await input.store.putAddSignerCeremony(ceremony);
+		return successfulWalletAddSignerStartTerminal(ceremony);
+	}
+	async respondWalletAddSignerEcdsaDerivation(request) {
+		try {
+			const store = this.getRegistrationCeremonyIntentStore();
+			const ceremony = await store.getAddSignerCeremony(request.addSignerCeremonyId);
+			if (!ceremony) return {
+				ok: false,
+				code: "not_found",
+				message: "add-signer ceremony not found"
+			};
+			if (ceremony.intent.signerSelection.mode !== "ecdsa") return {
+				ok: false,
+				code: "unsupported",
+				message: "Cloudflare D1 add-signer respond currently supports ECDSA signer selection"
+			};
+			if (ceremony.signerState.kind === "ecdsa_add_signer_pending_activation") {
+				if (!routerAbEcdsaStrictRegistrationRequestMatchesFacts({
+					request: request.ecdsa.strictRegistration,
+					facts: ceremony.signerState.strictRegistration
+				})) return {
+					ok: false,
+					code: "scope_mismatch",
+					message: "ECDSA add-signer replay changed the admitted registration request"
+				};
+				return {
+					ok: true,
+					addSignerCeremonyId: ceremony.addSignerCeremonyId,
+					ecdsa: {
+						kind: "router_ab_ecdsa_registration_forwarded_v1",
+						strictResult: ceremony.signerState.publicResponse
+					}
+				};
+			}
+			if (ceremony.signerState.kind !== "ecdsa_add_signer_prepared") return {
+				ok: false,
+				code: "invalid_state",
+				message: "one prepared ECDSA add-signer registration is required"
+			};
+			if (!routerAbEcdsaStrictRegistrationRequestMatchesFacts({
+				request: request.ecdsa.strictRegistration,
+				facts: ceremony.signerState.strictRegistration
+			})) return {
+				ok: false,
+				code: "scope_mismatch",
+				message: "ECDSA add-signer request does not match the admitted ceremony facts"
+			};
+			const runtimePolicyScope = parseD1RuntimePolicyScope(ceremony.intent.runtimePolicyScope);
+			if (!runtimePolicyScope) return {
+				ok: false,
+				code: "invalid_state",
+				message: "ECDSA add-signer has no authoritative tenant-root scope"
+			};
+			const tenantRootIdentity = buildTenantRootIdentityFromAuthenticatedDeploymentV1({
+				orgId: runtimePolicyScope.orgId,
+				projectId: runtimePolicyScope.projectId,
+				envId: runtimePolicyScope.envId,
+				signingRootId: ceremony.signingRootId,
+				signingRootVersion: ceremony.signingRootVersion
+			});
+			if (!tenantRootIdentity.ok) return {
+				ok: false,
+				code: "invalid_state",
+				message: "ECDSA add-signer has a non-canonical tenant-root identity"
+			};
+			const tenantRoot = await this.tenantRootCustodyLineage.resolveActiveLineageForRuntimeScope(tenantRootIdentity.value);
+			if (!tenantRoot) return {
+				ok: false,
+				code: "invalid_state",
+				message: "ECDSA add-signer tenant root is not active"
+			};
+			const registered = await this.ecdsaStrictRegistration.registerWithTenantRoot({
+				request: request.ecdsa.strictRegistration,
+				tenantRoot,
+				requestPolicy: {
+					policyVersion: WALLET_ADD_SIGNER_ROUTER_POLICY_VERSION,
+					requestDigestB64u: request.ecdsa.requestDigestB64u
+				},
+				authority: ecdsaStrictRegistrationAuthority(ceremony.signerState.strictRegistration)
+			});
+			if (!registered.ok) return {
+				ok: false,
+				code: registered.code,
+				message: registered.message
+			};
+			await store.updateAddSignerCeremony({
+				expected: ceremony,
+				next: updateAddSignerCeremonyState({
+					ceremony,
+					signingRootId: ceremony.signingRootId,
+					signingRootVersion: ceremony.signingRootVersion,
+					signerState: {
+						kind: "ecdsa_add_signer_pending_activation",
+						derivationKind: ceremony.signerState.derivationKind,
+						chainTargets: ceremony.signerState.chainTargets,
+						prepare: ceremony.signerState.prepare,
+						strictRegistration: ceremony.signerState.strictRegistration,
+						registrationRequest: request.ecdsa.strictRegistration,
+						pendingActivation: registered.value.pendingActivation,
+						publicResponse: registered.value.publicResponse
+					}
+				})
+			});
+			return {
+				ok: true,
+				addSignerCeremonyId: ceremony.addSignerCeremonyId,
+				ecdsa: {
+					kind: "router_ab_ecdsa_registration_forwarded_v1",
+					strictResult: registered.value.publicResponse
+				}
+			};
+		} catch (error) {
+			return {
+				ok: false,
+				code: "internal",
+				message: errorMessage(error) || "Failed to respond to wallet add-signer ceremony"
+			};
+		}
+	}
+	/**
+	* Idempotent under the canonical activation coordinates. The client computes
+	* the activation request digest from the canonical add-signer command
+	* (`wallet_add_signer_activate_v2`); this method recomputes it, records the
+	* coordinates as a claim before any Router custody work, and replays the
+	* committed receipt to any later activate with the same coordinates — the
+	* replay is also how completion is queried since the standalone
+	* prepare/query routes were removed.
+	*/
+	async activateWalletAddSignerEcdsa(request) {
+		try {
+			const store = this.getRegistrationCeremonyIntentStore();
+			const ceremony = await store.getAddSignerCeremony(request.addSignerCeremonyId);
+			if (!ceremony) return {
+				ok: false,
+				code: "not_found",
+				message: "add-signer ceremony not found"
+			};
+			const requestDigestB64u = base64UrlEncode(Uint8Array.from(request.ecdsa.expectedActivationRequestDigest.bytes));
+			const state = ceremony.signerState;
+			if (state.kind === "ecdsa_add_signer_activated") {
+				if (!sameRouterAbEcdsaVerifiedClientActivationFactsV1(state.publicFacts, request.ecdsa.publicFacts)) return {
+					ok: false,
+					code: "scope_mismatch",
+					message: "ECDSA add-signer activation replay changed the verified client facts"
+				};
+				if (state.activationRequestDigestB64u !== requestDigestB64u) return {
+					ok: false,
+					code: "activation_digest_mismatch",
+					message: "ECDSA add-signer activation replay changed the request digest"
+				};
+				return {
+					ok: true,
+					addSignerCeremonyId: ceremony.addSignerCeremonyId,
+					ecdsa: {
+						kind: "router_ab_ecdsa_registration_activated_v1",
+						activation: state.activation,
+						bootstrap: state.bootstrap
+					}
+				};
+			}
+			if (ceremony.intent.signerSelection.mode !== "ecdsa" || state.kind !== "ecdsa_add_signer_pending_activation" && state.kind !== "ecdsa_add_signer_activation_claimed") return {
+				ok: false,
+				code: "invalid_state",
+				message: "one pending ECDSA add-signer activation is required"
+			};
+			let claimedCeremony;
+			let claimedState;
+			if (state.kind === "ecdsa_add_signer_pending_activation") {
+				const canonicalDigestB64u = await computeWalletAddSignerEcdsaActivationRequestDigestB64u({
+					addSignerCeremonyId: ceremony.addSignerCeremonyId,
+					activationCorrelationId: request.ecdsa.activationCorrelationId,
+					publicFacts: request.ecdsa.publicFacts
+				});
+				if (canonicalDigestB64u !== requestDigestB64u) return {
+					ok: false,
+					code: "activation_digest_mismatch",
+					message: "ECDSA add-signer activation request digest is not the canonical command digest"
+				};
+				claimedState = {
+					kind: "ecdsa_add_signer_activation_claimed",
+					derivationKind: state.derivationKind,
+					chainTargets: state.chainTargets,
+					prepare: state.prepare,
+					strictRegistration: state.strictRegistration,
+					registrationRequest: state.registrationRequest,
+					pendingActivation: state.pendingActivation,
+					publicResponse: state.publicResponse,
+					publicFacts: request.ecdsa.publicFacts,
+					activationRequestDigestB64u: canonicalDigestB64u
+				};
+				claimedCeremony = updateAddSignerCeremonyState({
+					ceremony,
+					signingRootId: ceremony.signingRootId,
+					signingRootVersion: ceremony.signingRootVersion,
+					signerState: claimedState
+				});
+				await store.updateAddSignerCeremony({
+					expected: ceremony,
+					next: claimedCeremony
+				});
+			} else {
+				if (state.activationRequestDigestB64u !== requestDigestB64u) return {
+					ok: false,
+					code: "activation_digest_mismatch",
+					message: "ECDSA add-signer activation claim was prepared for a different digest"
+				};
+				if (!sameRouterAbEcdsaVerifiedClientActivationFactsV1(state.publicFacts, request.ecdsa.publicFacts)) return {
+					ok: false,
+					code: "scope_mismatch",
+					message: "ECDSA add-signer activation claim belongs to different verified client facts"
+				};
+				claimedCeremony = ceremony;
+				claimedState = state;
+			}
+			const activated = await this.ecdsaStrictRegistration.activate({
+				activationCorrelationId: request.ecdsa.activationCorrelationId,
+				activationRequestDigestB64u: claimedState.activationRequestDigestB64u,
+				pendingActivation: claimedState.pendingActivation,
+				clientActivation: claimedState.publicFacts,
+				requestPolicy: {
+					policyVersion: WALLET_ADD_SIGNER_ROUTER_POLICY_VERSION,
+					requestDigestB64u: claimedState.publicFacts.registrationRequestDigestB64u
+				},
+				authority: ecdsaStrictRegistrationAuthority(claimedState.strictRegistration)
+			});
+			if (!activated.ok) {
+				if (!activated.retryable) await store.takeAddSignerCeremony(ceremony.addSignerCeremonyId);
+				return {
+					ok: false,
+					code: activated.code,
+					message: activated.message
+				};
+			}
+			let bootstrap;
+			try {
+				bootstrap = storedEcdsaAddSignerBootstrap(await buildActivatedEcdsaFamilyBootstrap({
+					branch: claimedState,
+					publicFacts: claimedState.publicFacts,
+					activation: activated.value
+				}));
+			} catch (error) {
+				return {
+					ok: false,
+					code: "ecdsa_activation_terminal_failure",
+					message: errorMessage(error) || "ECDSA add-signer activation failed"
+				};
+			}
+			const activatedState = {
+				kind: "ecdsa_add_signer_activated",
+				derivationKind: claimedState.derivationKind,
+				chainTargets: claimedState.chainTargets,
+				prepare: claimedState.prepare,
+				strictRegistration: claimedState.strictRegistration,
+				registrationRequest: claimedState.registrationRequest,
+				publicFacts: claimedState.publicFacts,
+				activationRequestDigestB64u: claimedState.activationRequestDigestB64u,
+				activation: activated.value,
+				publicCapability: buildRouterAbEcdsaDerivationPublicCapabilityV1({
+					registrationFacts: claimedState.strictRegistration,
+					registrationRequest: claimedState.registrationRequest,
+					clientActivation: claimedState.publicFacts,
+					activationReceipt: activated.value
+				}),
+				bootstrap
+			};
+			try {
+				await store.updateAddSignerCeremony({
+					expected: claimedCeremony,
+					next: updateAddSignerCeremonyState({
+						ceremony: claimedCeremony,
+						signingRootId: claimedCeremony.signingRootId,
+						signingRootVersion: claimedCeremony.signingRootVersion,
+						signerState: activatedState
+					})
+				});
+			} catch (error) {
+				const reconciledState = (await store.getAddSignerCeremony(ceremony.addSignerCeremonyId))?.signerState;
+				if (reconciledState?.kind !== "ecdsa_add_signer_activated" || !sameRouterAbEcdsaVerifiedClientActivationFactsV1(reconciledState.publicFacts, activatedState.publicFacts) || !sameRouterAbEcdsaRegistrationActivationReceiptV1(reconciledState.activation, activatedState.activation) || !sameEcdsaDerivationServerBootstrapV1(reconciledState.bootstrap, activatedState.bootstrap)) return {
+					ok: false,
+					code: "ecdsa_activation_terminal_failure",
+					message: errorMessage(error) || "ECDSA add-signer activation failed"
+				};
+			}
+			return {
+				ok: true,
+				addSignerCeremonyId: ceremony.addSignerCeremonyId,
+				ecdsa: {
+					kind: "router_ab_ecdsa_registration_activated_v1",
+					activation: activatedState.activation,
+					bootstrap: activatedState.bootstrap
+				}
+			};
+		} catch (error) {
+			return {
+				ok: false,
+				code: "internal",
+				message: errorMessage(error) || "Failed to activate wallet add-signer ceremony"
+			};
+		}
+	}
+	async finalizeWalletAddSigner(request) {
+		try {
+			const store = this.getRegistrationCeremonyIntentStore();
+			const idempotencyKey = normalizeOptionalTrimmedString(request.idempotencyKey);
+			if (!idempotencyKey) return {
+				ok: false,
+				code: "invalid_body",
+				message: "idempotencyKey is required"
+			};
+			const finalizeRequest = normalizeWalletAddSignerFinalizeRequest(request, idempotencyKey);
+			const claimKey = `add-signer-finalize:${finalizeRequest.addSignerCeremonyId}`;
+			const existing = await this.finalizeSideEffects.read(claimKey);
+			let prepared = null;
+			if (existing.kind === "missing") {
+				const replay = await store.getAddSignerFinalizeReplay({
+					addSignerCeremonyId: finalizeRequest.addSignerCeremonyId,
+					idempotencyKey
+				}) || await store.getAddSignerFinalizeReplayForCeremony(finalizeRequest.addSignerCeremonyId);
+				if (replay) {
+					if (!sameWalletAddSignerFinalizeRequestV1(replay.request, finalizeRequest)) return {
+						ok: false,
+						code: "idempotency_conflict",
+						message: "idempotencyKey is already bound to another add-signer finalize request"
+					};
+					await cleanupFinalizedAddSignerCeremony({
+						store,
+						addSignerCeremonyId: finalizeRequest.addSignerCeremonyId
+					});
+					return replay.response;
+				}
+				const ceremony = await store.getAddSignerCeremony(finalizeRequest.addSignerCeremonyId);
+				if (!ceremony) return {
+					ok: false,
+					code: "not_found",
+					message: "add-signer ceremony not found"
+				};
+				prepared = buildD1WalletAddSignerFinalizePrepared({
+					request: finalizeRequest,
+					ceremony,
+					nowMs: Date.now()
+				});
+			}
+			const requestFingerprint = base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(finalizeRequest)));
+			const run = await runRouterAbEd25519YaoRegistrationSideEffectV1(this.finalizeSideEffects, {
+				kind: "prepared_resumable",
+				operation: "add_signer_finalize",
+				key: claimKey,
+				requestFingerprint,
+				resumeAfterMs: WALLET_ADD_SIGNER_FINALIZE_RESUME_AFTER_MS,
+				nowMs: Date.now,
+				prepare: prepared ? returnD1WalletAddSignerFinalizePrepared.bind(null, prepared) : rejectUnexpectedWalletAddSignerFinalizePreparation,
+				derivePreparedArtifactFingerprint: fingerprintD1WalletAddSignerFinalizePrepared,
+				execute: this.executeWalletAddSignerFinalizeSideEffect.bind(this, {
+					finalizeRequest,
+					store,
+					consumerBinding: requestFingerprint
+				})
+			});
+			switch (run.kind) {
+				case "executed":
+				case "exact_replay":
+					if (run.value.ok) await cleanupFinalizedAddSignerCeremony({
+						store,
+						addSignerCeremonyId: finalizeRequest.addSignerCeremonyId
+					});
+					return run.value;
+				case "request_conflict": return {
+					ok: false,
+					code: "idempotency_conflict",
+					message: "add-signer ceremony belongs to a different finalize request"
+				};
+				case "in_progress": return {
+					ok: false,
+					code: "conflict",
+					message: "add-signer finalize is already in progress; retry later"
+				};
+				case "uncertain": return {
+					ok: false,
+					code: "internal",
+					message: run.message || "Failed to reconcile wallet add-signer finalize"
+				};
+				default: return assertNeverWalletAddSignerFinalizeRun(run);
+			}
+		} catch (error) {
+			return {
+				ok: false,
+				code: "internal",
+				message: errorMessage(error) || "Failed to finalize wallet add-signer ceremony"
+			};
+		}
+	}
+	async executeWalletAddSignerFinalizeSideEffect(input, prepared) {
+		const response = await this.executeWalletAddSignerFinalize(input, prepared);
+		return response.ok ? response : throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1(response);
+	}
+	async executeWalletAddSignerFinalize(input, prepared) {
+		const store = input.store;
+		const finalizeRequest = input.finalizeRequest;
+		const idempotencyKey = finalizeRequest.idempotencyKey;
+		const replay = await store.getAddSignerFinalizeReplay({
+			addSignerCeremonyId: finalizeRequest.addSignerCeremonyId,
+			idempotencyKey
+		}) || await store.getAddSignerFinalizeReplayForCeremony(finalizeRequest.addSignerCeremonyId);
+		if (replay) {
+			if (!sameWalletAddSignerFinalizeRequestV1(replay.request, finalizeRequest)) return {
+				ok: false,
+				code: "idempotency_conflict",
+				message: "idempotencyKey is already bound to another add-signer finalize request"
+			};
+			return replay.response;
+		}
+		let ceremony = await store.getAddSignerCeremony(finalizeRequest.addSignerCeremonyId);
+		if (!ceremony) return {
+			ok: false,
+			code: "not_found",
+			message: "add-signer ceremony not found"
+		};
+		if (finalizeRequest.kind === "near_ed25519") {
+			if (prepared.kind !== "d1_wallet_add_signer_finalize_ed25519_prepared_v1") throw new Error("Ed25519 add-signer finalize claim changed branch");
+			if (ceremony.intent.signerSelection.mode !== "ed25519" || ceremony.auth.kind !== "webauthn_assertion") return {
+				ok: false,
+				code: "invalid_state",
+				message: "authorized WebAuthn Ed25519 Yao add-signer state is required"
+			};
+			const webAuthnAuth = ceremony.auth;
+			const runtimePolicyScope = parseD1RuntimePolicyScope(ceremony.intent.runtimePolicyScope);
+			const participantIds = resolveEd25519AddSignerParticipantIds(ceremony.intent.signerSelection);
+			if (!runtimePolicyScope || !participantIds) return {
+				ok: false,
+				code: "invalid_state",
+				message: "Ed25519 Yao add-signer scope is invalid"
+			};
+			const signingRootId = normalizeOptionalTrimmedString(ceremony.signingRootId);
+			const signingRootVersion = normalizeOptionalTrimmedString(ceremony.signingRootVersion);
+			if (!signingRootId || signingRootId !== deriveSigningRootId(runtimePolicyScope) || !signingRootVersion || signingRootVersion !== runtimePolicyScope.signingRootVersion) return {
+				ok: false,
+				code: "scope_mismatch",
+				message: "Ed25519 Yao add-signer signing-root scope is invalid"
+			};
+			const yaoRuntime = this.getEd25519YaoProductRegistration();
+			if (!yaoRuntime) return {
+				ok: false,
+				code: "not_configured",
+				message: "Ed25519 Yao add-signer is not configured on this server"
+			};
+			const walletStore = this.getWalletStore();
+			if (!await walletStore.getWallet({ walletId: ceremony.intent.walletId })) return {
+				ok: false,
+				code: "not_found",
+				message: "wallet not found"
+			};
+			const selection = ceremony.intent.signerSelection.ed25519;
+			const requestedActivationReference = finalizeRequest.activationReference;
+			const currentState = ceremony.signerState;
+			let activation;
+			if (currentState.kind === "near_ed25519_yao_add_signer_authorized") {
+				if (await walletStore.getEd25519SignerBySlot({
+					walletId: ceremony.intent.walletId,
+					signerSlot: selection.signerSlot
+				})) return {
+					ok: false,
+					code: "signer_conflict",
+					message: "Ed25519 signer slot is already occupied"
+				};
+				const consumed = await yaoRuntime.consumeActivated({
+					reference: requestedActivationReference,
+					consumerBinding: input.consumerBinding
+				});
+				if (!consumed.ok) return consumed;
+				if (!sameRouterAbEd25519YaoRegistrationAdmissionRequestV1(consumed.activation.admissionRequest, currentState.admissionRequest)) return {
+					ok: false,
+					code: "scope_mismatch",
+					message: "activated Ed25519 Yao add-signer result does not match its ceremony"
+				};
+				activation = {
+					finalizeRequest,
+					activation: consumed.activation
+				};
+				const activatedCeremony = updateAddSignerCeremonyState({
+					ceremony,
+					signingRootId,
+					signingRootVersion,
+					signerState: {
+						kind: "near_ed25519_yao_add_signer_activated",
+						finalizeRequest: activation.finalizeRequest,
+						activation: activation.activation
+					}
+				});
+				await store.updateAddSignerCeremony({
+					expected: ceremony,
+					next: activatedCeremony
+				});
+				ceremony = activatedCeremony;
+			} else if (currentState.kind === "near_ed25519_yao_add_signer_activated" || currentState.kind === "near_ed25519_yao_add_signer_finalizing") {
+				activation = currentState;
+				if (!sameWalletAddSignerFinalizeRequestV1(activation.finalizeRequest, finalizeRequest)) return {
+					ok: false,
+					code: "idempotency_conflict",
+					message: "Ed25519 Yao finalize request does not match the stored finalize state"
+				};
+			} else return {
+				ok: false,
+				code: "invalid_state",
+				message: "authorized Ed25519 Yao add-signer state is required"
+			};
+			let response;
+			let signer;
+			let finalizingAtMs;
+			if (currentState.kind === "near_ed25519_yao_add_signer_finalizing") {
+				response = currentState.response;
+				signer = currentState.signer;
+				finalizingAtMs = currentState.finalizingAtMs;
+			} else {
+				const publicKeyBytes = activation.activation.result.public_receipt.registered_public_key;
+				if (activation.finalizeRequest.custodyKeySet.registeredPublicKeyB64u !== base64UrlEncode(Uint8Array.from(publicKeyBytes))) return {
+					ok: false,
+					code: "scope_mismatch",
+					message: "NEAR custody key set changed the activated public key"
+				};
+				const publicKey = ed25519NearPublicKeyFromBytes(publicKeyBytes);
+				const nearAccountId = implicitNearAccountIdFromEd25519PublicKeyBytes(publicKeyBytes);
+				const nearEd25519SigningKeyId = activation.activation.admissionRequest.application_binding.near_ed25519_signing_key_id;
+				const activeYaoCapability = buildRouterAbEd25519YaoRegistrationCapabilityRecordV1({
+					kind: "router_ab_ed25519_yao_registration_finalize_capability_v1",
+					activeCapabilityBinding: activation.activation.result.binding.session_id,
+					nearAccountId,
+					registrationAdmissionRequest: activation.activation.admissionRequest,
+					registrationAdmissionReceipt: activation.activation.admissionReceipt,
+					registrationResult: activation.activation.result,
+					runtimePolicyScope
+				});
+				if (!activeYaoCapability.ok) return throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1(activeYaoCapability);
+				finalizingAtMs = prepared.finalizingAtMs;
+				const ed25519 = {
+					signerSlot: selection.signerSlot,
+					nearAccountId,
+					nearEd25519SigningKeyId,
+					publicKey,
+					relayerKeyId: yaoRuntime.signingWorkerId,
+					keyVersion: selection.keyVersion,
+					recoveryExportCapable: true,
+					participantIds
+				};
+				response = {
+					ok: true,
+					kind: "near_ed25519",
+					walletId: ceremony.intent.walletId,
+					rpId: webAuthnAuth.rpId,
+					credentialIdB64u: webAuthnAuth.credentialIdB64u,
+					ed25519
+				};
+				signer = buildYaoEd25519WalletSignerRecord({
+					walletId: ceremony.intent.walletId,
+					nearAccountId,
+					nearEd25519SigningKeyId,
+					thresholdSessionId: activation.activation.admissionRequest.scope.threshold_session_id,
+					signerSlot: selection.signerSlot,
+					publicKey,
+					signingWorkerId: yaoRuntime.signingWorkerId,
+					keyVersion: selection.keyVersion,
+					participantIds,
+					signingRootId,
+					signingRootVersion,
+					runtimePolicyScope,
+					activeYaoCapability: activeYaoCapability.record,
+					custodyKeyManifestDigestB64u: activation.finalizeRequest.custodyKeySet.keyManifestDigestB64u,
+					now: finalizingAtMs
+				});
+				await store.updateAddSignerCeremony({
+					expected: ceremony,
+					next: updateAddSignerCeremonyState({
+						ceremony,
+						signingRootId,
+						signingRootVersion,
+						signerState: {
+							kind: "near_ed25519_yao_add_signer_finalizing",
+							finalizeRequest: activation.finalizeRequest,
+							activation: activation.activation,
+							response,
+							signer,
+							finalizingAtMs
+						}
+					})
+				});
+			}
+			if (response.walletId !== ceremony.intent.walletId || response.rpId !== webAuthnAuth.rpId || response.credentialIdB64u !== webAuthnAuth.credentialIdB64u || response.ed25519.signerSlot !== selection.signerSlot || signer.walletId !== response.walletId || signer.signerSlot !== response.ed25519.signerSlot || signer.nearAccountId !== response.ed25519.nearAccountId || signer.nearEd25519SigningKeyId !== response.ed25519.nearEd25519SigningKeyId || signer.thresholdSessionId !== activation.activation.admissionRequest.scope.threshold_session_id || signer.publicKey !== response.ed25519.publicKey || signer.signingWorkerId !== response.ed25519.relayerKeyId || signer.keyVersion !== response.ed25519.keyVersion || signer.signingRootId !== signingRootId || signer.signingRootVersion !== signingRootVersion || !positiveIntegerArraysEqual(signer.participantIds, response.ed25519.participantIds) || !runtimePolicyScopeMatches(signer.runtimePolicyScope, runtimePolicyScope)) return {
+				ok: false,
+				code: "scope_mismatch",
+				message: "stored Ed25519 Yao add-signer finalize plan is invalid"
+			};
+			if (!await walletStore.putEd25519SignerIfSlotAvailable(signer)) {
+				const existing = await walletStore.getEd25519SignerBySlot({
+					walletId: ceremony.intent.walletId,
+					signerSlot: selection.signerSlot
+				});
+				if (!existing || !sameWalletEd25519SignerRecordV1(existing, signer)) return {
+					ok: false,
+					code: "signer_conflict",
+					message: "Ed25519 signer slot is already occupied"
+				};
+			}
+			const installed = await yaoRuntime.installPersistedActiveCapability(signer.activeYaoCapability);
+			if (!installed.ok) return throwIfRouterAbEd25519YaoRetryableSideEffectFailureV1(installed);
+			await store.putAddSignerFinalizeReplay({
+				kind: "wallet_add_signer_finalize_replay_v1",
+				addSignerCeremonyId: ceremony.addSignerCeremonyId,
+				idempotencyKey,
+				request: finalizeRequest,
+				response,
+				createdAtMs: finalizingAtMs,
+				expiresAtMs: finalizingAtMs + ADD_SIGNER_REPLAY_TTL_MS
+			});
+			return response;
+		}
+		if (prepared.kind !== "d1_wallet_add_signer_finalize_ecdsa_prepared_v1") throw new Error("ECDSA add-signer finalize claim changed branch");
+		if (ceremony.intent.signerSelection.mode !== "ecdsa" || ceremony.signerState.kind !== "ecdsa_add_signer_activated") return {
+			ok: false,
+			code: "invalid_state",
+			message: "activated ECDSA add-signer registration is required before finalize"
+		};
+		if (finalizeRequest.expectedKeyHandles[0] !== ceremony.signerState.bootstrap.keyHandle) return {
+			ok: false,
+			code: "key_handle_mismatch",
+			message: "ECDSA add-signer finalize expected key handle mismatch"
+		};
+		const bootstraps = [];
+		for (const chainTarget of ceremony.signerState.chainTargets) bootstraps.push({
+			chainTarget,
+			bootstrap: ceremony.signerState.bootstrap
+		});
+		const walletKeyResult = buildD1EcdsaWalletKeysFromBootstrap({
+			bootstraps,
+			publicCapability: ceremony.signerState.publicCapability,
+			errorContext: "ECDSA add-signer finalize"
+		});
+		if (!walletKeyResult.ok) return walletKeyResult;
+		const walletKeys = walletKeyResult.walletKeys;
+		const runtimePolicyScope = parseD1RuntimePolicyScope(ceremony.intent.runtimePolicyScope);
+		if (!runtimePolicyScope) return {
+			ok: false,
+			code: "invalid_state",
+			message: "ECDSA add-signer scope is invalid"
+		};
+		const signerWriteNow = prepared.signerWriteAtMs;
+		const walletStore = this.getWalletStore();
+		if (!await walletStore.getWallet({ walletId: ceremony.intent.walletId })) return {
+			ok: false,
+			code: "not_found",
+			message: "wallet not found"
+		};
+		let custodyClientRootPublicKey33B64u;
+		try {
+			custodyClientRootPublicKey33B64u = ecdsaClientRootPublicKey33B64uFromString(finalizeRequest.custodyKeySet.clientRootPublicKey33B64u);
+		} catch {
+			return {
+				ok: false,
+				code: "invalid_state",
+				message: "ECDSA add-signer custody client root public key is invalid"
+			};
+		}
+		const walletSigners = buildD1WalletEcdsaSignerRecords({
+			walletId: ceremony.intent.walletId,
+			walletKeys,
+			activationReceipt: ceremony.signerState.activation,
+			runtimePolicyScope,
+			custodyKeyManifestDigestB64u: finalizeRequest.custodyKeySet.keyManifestDigestB64u,
+			custodyClientRootPublicKey33B64u,
+			now: signerWriteNow
+		});
+		await walletStore.putSigners(walletSigners);
+		const response = {
+			ok: true,
+			kind: "evm_family_ecdsa",
+			walletId: ceremony.intent.walletId,
+			...ceremony.auth.kind === "webauthn_assertion" ? { rpId: ceremony.auth.rpId } : {},
+			ecdsa: { walletKeys }
+		};
+		await store.putAddSignerFinalizeReplay({
+			kind: "wallet_add_signer_finalize_replay_v1",
+			addSignerCeremonyId: ceremony.addSignerCeremonyId,
+			idempotencyKey,
+			request: finalizeRequest,
+			response,
+			createdAtMs: signerWriteNow,
+			expiresAtMs: signerWriteNow + ADD_SIGNER_REPLAY_TTL_MS
+		});
+		return response;
+	}
+};
+//#endregion
+export { CloudflareD1WalletAddSignerService, parseD1WalletAddSignerFinalizeSideEffectRecord, parseD1WalletAddSignerStartSideEffectRecord };
+
+//# sourceMappingURL=d1WalletAddSignerService.js.map