@seams/wallet-server 0.6.1 → 0.7.1

package/dist/esm/router/cloudflare/d1/registration/d1WalletRegistrationService.js

@@ -1,33 +1,37 @@
 import { mpcMaterialActivationRefsEqual, parseThresholdEd25519SessionId, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletKeyId, parseWebAuthnCredentialIdB64u } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseDeviceId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { alphabetizeStringify, bytesToUnprefixedHex, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import "../../../../shared-ts/src/utils/encoders.js";
+import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
+import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
+import "../../../../shared-ts/src/utils/validation.js";
+import { buildFullOwnerPermissionsV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
 import { parseEd25519PublicKeyB64u, parseSecp256k1CompressedPublicKeyB64u } from "../../../../shared-ts/src/passkey-custody/primitives.js";
 import { buildExactAdministeredSignerManifestV1 } from "../../../../shared-ts/src/device-linking/delegatedActivationPlan.js";
-import { buildFullOwnerPermissionsV1 } from "../../../../shared-ts/src/authorization/delegatedAuthority.js";
-import { buildActiveWalletAuthorityV1, buildWalletSignerActivationSetV1, computeWalletAuthorityDigestB64u, computeWalletSignerActivationSetDigestB64u, extendEcdsaWalletAuthorityWithEd25519, isActiveEcdsaWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
-import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
-import { buildWalletAuthMethodRecordV2, findRegistrationSignerPlanEvmFamilyEcdsaBranch, findRegistrationSignerPlanNearEd25519Branch, nearEd25519SigningKeyIdFromString, registrationEd25519AuthorityScopeFromAuthority, registrationIntentGrantFromString, registrationNearEd25519BranchKey, registrationSignerPlanFromSelection, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { deriveRouterAbEd25519YaoRuntimePolicyBindingV1, sameRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { deriveRouterAbEd25519YaoRuntimePolicyBindingV1 } from "../../../../shared-ts/src/utils/routerAbEd25519YaoDigests.js";
+import { sameRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { ecdsaClientRootPublicKey33B64uFromString } from "../../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
-import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
-import "../../../../shared-ts/src/utils/validation.js";
 import { deriveSigningRootId, signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, walletAuthAuthoritiesMatch } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1, buildRouterAbEcdsaDerivationActiveStateIdV1, buildRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1, sameRouterAbEcdsaVerifiedClientActivationFactsV1, sameRouterAbPublicDigest32V1Wire } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { buildWalletAuthMethodRecordV2 } from "../../../../shared-ts/src/utils/walletAuthMethodRecord.js";
+import { buildActiveWalletAuthorityV1, buildWalletSignerActivationSetV1, computeWalletAuthorityDigestB64u, computeWalletSignerActivationSetDigestB64u, extendEcdsaWalletAuthorityWithEd25519, isActiveEcdsaWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
 import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
 import { ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 import { normalizeThresholdEd25519ParticipantIds } from "../../../../shared-ts/src/threshold/participants.js";
+import { parseEcdsaDerivationPublicIdentity, thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
+import { nearEd25519SigningKeyIdFromString, registrationEd25519AuthorityScopeFromAuthority, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { registrationPreparationIdFromString } from "../../../../core/types.js";
 import { buildTenantRootIdentityFromAuthenticatedDeploymentV1 } from "../../../../shared-ts/src/tenant-root/tenantRootIdentity.js";
 import { walletCustodyCeremonyCommitPayloadFromWire } from "../../../../shared-ts/src/passkey-custody/ceremonyCommitPayload.js";
 import "../../../../shared-ts/src/passkey-custody/index.js";
 import { computeWalletRegistrationSetupDigestB64u, parseWalletRegistrationSetupClaims, verifySignedWalletRegistrationSetup, verifyWalletRegistrationSetupClaims } from "../../../domains/walletRegistration/walletRegistrationSetupPayload.js";
+import { findRegistrationSignerPlanEvmFamilyEcdsaBranch, findRegistrationSignerPlanNearEd25519Branch, registrationNearEd25519BranchKey, registrationSignerPlanFromSelection } from "../../../../shared-ts/src/utils/registrationSignerPlan.js";
+import { registrationIntentGrantFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { DEFAULT_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
-import { parseEcdsaDerivationPublicIdentity, thresholdEd25519AuthorityScopeFromWalletAuthAuthority } from "../../../../core/ThresholdService/validation.js";
 import { walletAuthAuthorityFromRegistrationAuthority, walletRegistrationFinalizeAuthMethodFromAuthority } from "../wallet/d1WalletAuthMethodBoundary.js";
 import { buildRouterAbEd25519YaoRegistrationCapabilityRecordV1 } from "../../../domains/ed25519Yao/recovery/routerAbEd25519YaoRecovery.js";
 import { buildRouterAbEd25519YaoProductAdmissionRequestV1, createRouterAbEd25519YaoMaterialActivationRefV1, projectRouterAbEd25519YaoExactWalletSession } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoProductRegistration.js";
@@ -42,6 +46,7 @@ import { listThresholdEcdsaKeyIdentityTargetsForUser } from "../../../../core/au
 import { buildWalletRegistrationSetupSignature, normalizeWalletRegistrationSetupRequest, resolveWalletRegistrationSetupWalletId, storedRespondEd25519DeferredWork, walletRegistrationRespondResult, walletRegistrationSetupError, walletRegistrationSetupExpiresAtMs, walletRegistrationSetupIds, walletRegistrationSetupIntentDigest } from "./d1WalletRegistrationSetup.js";
 import { commitRegistrationCustody } from "../../../domains/passkeyCustody/registrationCustodyOutcome.js";
 import { buildD1EvmFamilyEcdsaRegistrationPrepare } from "./d1EvmFamilyEcdsaRegistrationBranch.js";
+import { routerAbEd25519YaoLifecycleDecisionLookupV1, routerAbEd25519YaoLifecycleDecisionV1 } from "../../../domains/ed25519Yao/capabilityLifecycle/routerAbEd25519YaoLifecycleDecision.js";
 import { projectWalletRegistrationSessionCommitReceiptV2, registrationReplayAuthMethodFields, replayedRegistrationCommit, unissuedRegistrationCommit } from "./walletRegistrationSessionCommitReceipt.js";
 import { assertDirectWalletSessionOwnerProof, buildRegistrationOwnerProof, issueDirectRegistrationEstablishedEcdsaSession, issueDirectRegistrationEstablishedEd25519Session, projectCurrentNearRegistrationSession, replayDirectRegistrationEstablishedEcdsaSession, replayDirectRegistrationEstablishedEd25519Session, walletSessionPrincipalId } from "./walletRegistrationEstablishedSessionIssuer.js";
 //#region src/router/cloudflare/d1/registration/d1WalletRegistrationService.ts
@@ -111,13 +116,13 @@ function linkedEd25519ProjectionMatchesDescriptor(input) {
 	const descriptorPublicKeyBytes = descriptor.registeredPublicKey;
 	return projection.applicationBinding.wallet_id === descriptor.applicationBinding.wallet_id && projection.applicationBinding.near_ed25519_signing_key_id === descriptor.applicationBinding.near_ed25519_signing_key_id && projection.applicationBinding.signing_root_id === descriptor.applicationBinding.signing_root_id && projection.applicationBinding.key_creation_signer_slot === descriptor.applicationBinding.key_creation_signer_slot && sameEd25519ParticipantIds(projection.participantIds, descriptor.participantIds) && targetBinding.operation === "registration" && targetLifecycle.work_kind === "registration_prepare" && targetLifecycle.primitive_request_kind === "registration" && targetLifecycle.account_id === descriptor.lifecycle.accountId && targetLifecycle.root_share_epoch === descriptor.lifecycle.rootShareEpoch && targetLifecycle.signer_set_id === descriptor.lifecycle.signerSetId && targetLifecycle.selected_server_id === descriptor.lifecycle.signingWorkerId && sameRouterAbMpcMaterialActivationRef(targetBinding.material_activation, linkedEd25519ProjectionMaterialActivationWire(projection)) && sameRouterAbMpcMaterialActivationRef(projection.activationReceipt.material_activation, linkedEd25519ProjectionMaterialActivationWire(projection)) && ed25519NearPublicKeyFromBytes(registeredPublicKeyBytes) === ed25519NearPublicKeyFromBytes(descriptorPublicKeyBytes) && descriptor.nearAccountId === implicitNearAccountIdFromEd25519PublicKeyBytes(registeredPublicKeyBytes);
 }
-function linkedEcdsaProjectionMatchesSigner(input) {
-	const receipt = input.projection.activationReceipt;
+function linkedEcdsaProjectionMatchesSigner(projection, signer) {
+	const receipt = projection.activationReceipt;
 	const source = receipt.binding.source;
 	const sourceScope = receipt.sourceDerivation.sourceNormalSigning.scope;
-	const capability = input.signer.walletKey.publicCapability;
-	const activation = input.signer.activationReceipt.ecdsa_activation;
-	return input.signer.walletId === input.projection.walletId && input.projection.signer.walletId === input.signer.walletId && input.projection.signer.thresholdPublicKey33B64u === source.thresholdPublicKey33B64u && input.signer.walletKey.ecdsaThresholdKeyId === sourceScope.ecdsa_threshold_key_id && input.signer.walletKey.signingRootId === sourceScope.signing_root_id && input.signer.walletKey.signingRootVersion === sourceScope.signing_root_version && input.signer.walletKey.thresholdEcdsaPublicKeyB64u === source.thresholdPublicKey33B64u && String(input.signer.walletKey.derivationClientSharePublicKey33B64u) === source.clientPublicKey33B64u && String(input.signer.walletKey.relayerVerifyingShareB64u) === source.relayerPublicKey33B64u && sameRouterAbMpcMaterialActivationRef(capability.material_activation, routerAbMpcMaterialActivationRefToWire(source.activation)) && capability.client_id === String(input.projection.walletId) && capability.context.application_binding_digest_b64u === sourceScope.context.application_binding_digest_b64u && capability.public_identity.context_binding_b64u === sourceScope.public_identity.context_binding_b64u && capability.public_identity.derivation_client_share_public_key33_b64u === source.clientPublicKey33B64u && capability.public_identity.server_public_key33_b64u === source.relayerPublicKey33B64u && capability.public_identity.threshold_public_key33_b64u === source.thresholdPublicKey33B64u && capability.public_identity.ethereum_address20_b64u === source.thresholdEthereumAddress20B64u && capability.public_identity.client_share_retry_counter === sourceScope.public_identity.client_share_retry_counter && capability.public_identity.server_share_retry_counter === sourceScope.public_identity.server_share_retry_counter && capability.signer_set.selected_server.server_id === sourceScope.signing_worker.server_id && capability.activation_epoch === sourceScope.activation_epoch && sameRouterAbMpcMaterialActivationRef(activation.material_activation, routerAbMpcMaterialActivationRefToWire(source.activation)) && activation.context.application_binding_digest_b64u === sourceScope.context.application_binding_digest_b64u && activation.public_identity.context_binding_b64u === sourceScope.public_identity.context_binding_b64u && activation.public_identity.derivation_client_share_public_key33_b64u === source.clientPublicKey33B64u && activation.public_identity.server_public_key33_b64u === source.relayerPublicKey33B64u && activation.public_identity.threshold_public_key33_b64u === source.thresholdPublicKey33B64u && activation.public_identity.ethereum_address20_b64u === source.thresholdEthereumAddress20B64u && activation.signing_worker.server_id === sourceScope.signing_worker.server_id && activation.activation_epoch === sourceScope.activation_epoch;
+	const capability = signer.walletKey.publicCapability;
+	const activation = signer.activationReceipt.ecdsa_activation;
+	return signer.walletId === projection.walletId && projection.signer.walletId === signer.walletId && projection.signer.thresholdPublicKey33B64u === source.thresholdPublicKey33B64u && signer.walletKey.ecdsaThresholdKeyId === sourceScope.ecdsa_threshold_key_id && signer.walletKey.signingRootId === sourceScope.signing_root_id && signer.walletKey.signingRootVersion === sourceScope.signing_root_version && signer.walletKey.thresholdEcdsaPublicKeyB64u === source.thresholdPublicKey33B64u && String(signer.walletKey.derivationClientSharePublicKey33B64u) === source.clientPublicKey33B64u && String(signer.walletKey.relayerVerifyingShareB64u) === source.relayerPublicKey33B64u && sameRouterAbMpcMaterialActivationRef(capability.material_activation, routerAbMpcMaterialActivationRefToWire(source.activation)) && capability.client_id === String(projection.walletId) && capability.context.application_binding_digest_b64u === sourceScope.context.application_binding_digest_b64u && capability.public_identity.context_binding_b64u === sourceScope.public_identity.context_binding_b64u && capability.public_identity.derivation_client_share_public_key33_b64u === source.clientPublicKey33B64u && capability.public_identity.server_public_key33_b64u === source.relayerPublicKey33B64u && capability.public_identity.threshold_public_key33_b64u === source.thresholdPublicKey33B64u && capability.public_identity.ethereum_address20_b64u === source.thresholdEthereumAddress20B64u && capability.public_identity.client_share_retry_counter === sourceScope.public_identity.client_share_retry_counter && capability.public_identity.server_share_retry_counter === sourceScope.public_identity.server_share_retry_counter && capability.signer_set.selected_server.server_id === sourceScope.signing_worker.server_id && capability.activation_epoch === sourceScope.activation_epoch && sameRouterAbMpcMaterialActivationRef(activation.material_activation, routerAbMpcMaterialActivationRefToWire(source.activation)) && activation.context.application_binding_digest_b64u === sourceScope.context.application_binding_digest_b64u && activation.public_identity.context_binding_b64u === sourceScope.public_identity.context_binding_b64u && activation.public_identity.derivation_client_share_public_key33_b64u === source.clientPublicKey33B64u && activation.public_identity.server_public_key33_b64u === source.relayerPublicKey33B64u && activation.public_identity.threshold_public_key33_b64u === source.thresholdPublicKey33B64u && activation.public_identity.ethereum_address20_b64u === source.thresholdEthereumAddress20B64u && activation.signing_worker.server_id === sourceScope.signing_worker.server_id && activation.activation_epoch === sourceScope.activation_epoch;
 }
 function sameLinkedEcdsaResolvedSignerIdentity(left, right) {
 	return left.walletId === right.walletId && left.walletKey.keyHandle === right.walletKey.keyHandle && left.walletKey.relayerKeyId === right.walletKey.relayerKeyId && left.walletKey.participantIds[0] === right.walletKey.participantIds[0] && left.walletKey.participantIds[1] === right.walletKey.participantIds[1] && sameRouterAbEcdsaDerivationPublicCapabilityV1(left.walletKey.publicCapability, right.walletKey.publicCapability) && sameWalletRuntimePolicyScope(left.runtimePolicyScope, right.runtimePolicyScope);
@@ -720,8 +725,7 @@ function sponsoredNamedRegistrationAccountId(provisioning) {
 /**
 * A mixed plan finalizes in two calls: `evm_family_ecdsa` first, which returns
 * the wallet ECDSA-ready and leaves the ceremony open, then `near_ed25519`
-* once the Yao ceremony settles (Refactor 94 Phase 4+5). Single-signer plans
-* still finalize in one call.
+* once the Yao ceremony settles. Single-signer plans still finalize in one call.
 *
 * The requested kind must name only branches the plan admitted, and must be
 * legal for the progress those branches have made — a `near_ed25519` call on a
@@ -865,7 +869,6 @@ function postRegistrationRequestId(input) {
 	return input.request.refresh_nonce;
 }
 function pendingEcdsaSessionActivationRecord(input) {
-	postRegistrationProofResponse(input.proof);
 	return {
 		version: "wallet_ecdsa_pending_session_activation_v1",
 		walletId: input.walletId,
@@ -907,9 +910,9 @@ const ROUTER_SERVER_TIMING_MERGE_LIMIT = 32;
 /** Metric names the Gateway is willing to re-emit in its own header. */
 const ROUTER_SERVER_TIMING_NAME_PATTERN = /^[A-Za-z0-9_-]+$/;
 /**
-* Folds the Router's own `Server-Timing` header into the Gateway's span list
-* (Refactor 94B Phase 0), so the Router and role-worker breakdown reaches the
-* browser on the same header as the Gateway's own boundaries.
+* Folds the Router's own `Server-Timing` header into the Gateway's span list,
+* so the Router and role-worker breakdown reaches the browser on the same
+* header as the Gateway's own boundaries.
 *
 * Entries without a finite non-negative `dur` are dropped, which also discards
 * Cloudflare's descriptive metrics, and names are restricted to a token
@@ -960,11 +963,7 @@ var CloudflareD1WalletRegistrationService = class {
 		this.walletCustodyCommitStore = input.walletCustodyCommitStore;
 		this.walletAuthMethods = input.walletAuthMethods;
 		this.getLinkedDeviceEd25519AuthorityReader = input.getLinkedDeviceEd25519AuthorityReader;
-	}
-	async getWalletRegistrationRuntimePolicyScope(registrationCeremonyId) {
-		const ceremony = await this.getRegistrationCeremonyIntentStore().getCeremony(registrationCeremonyId);
-		if (!ceremony) return void 0;
-		return registrationPreparedContextRuntimePolicyScope(ceremony.preparedContext);
+		this.yaoLifecycleDecisions = input.yaoLifecycleDecisions;
 	}
 	async resolveEd25519MaterialActivation(input) {
 		try {
@@ -1097,19 +1096,22 @@ var CloudflareD1WalletRegistrationService = class {
 				})
 			};
 			const linkedDeviceReader = this.getLinkedDeviceEd25519AuthorityReader();
-			const projection = linkedDeviceReader?.readInstalledEcdsaAuthorityByMaterialActivationV1 ? await linkedDeviceReader.readInstalledEcdsaAuthorityByMaterialActivationV1({
+			const custodyChain = linkedDeviceReader ? await linkedDeviceReader.readInstalledEcdsaAuthorityChainByMaterialActivationV1({
 				walletId,
 				materialActivation: routerAbMpcMaterialActivationRefFromWire(input.materialActivation)
-			}) : null;
+			}) : [];
+			const projection = custodyChain[0];
 			if (!projection) return {
 				ok: false,
 				code: "not_found",
 				message: "ECDSA material activation is not active for this wallet"
 			};
-			const matchingSourceSigners = (await store.listEcdsaSignersForWallet({ walletId })).filter((candidate) => linkedEcdsaProjectionMatchesSigner({
-				projection,
-				signer: candidate
-			}));
+			const walletSigners = await store.listEcdsaSignersForWallet({ walletId });
+			let matchingSourceSigners = [];
+			for (const custodySource of custodyChain) {
+				matchingSourceSigners = walletSigners.filter(linkedEcdsaProjectionMatchesSigner.bind(null, custodySource));
+				if (matchingSourceSigners.length > 0) break;
+			}
 			const canonicalSigner = matchingSourceSigners[0];
 			if (!canonicalSigner) return {
 				ok: false,
@@ -1159,7 +1161,9 @@ var CloudflareD1WalletRegistrationService = class {
 			};
 			return {
 				ok: true,
-				...tenantRoot
+				identity: tenantRoot.identity,
+				identityDigestB64u: tenantRoot.identityDigestB64u,
+				custodyLineageB64u: tenantRoot.custodyLineageB64u
 			};
 		} catch (error) {
 			return {
@@ -1651,8 +1655,8 @@ var CloudflareD1WalletRegistrationService = class {
 		}
 	}
 	/**
-	* Refactor 94C. `/wallets/register/setup` — grant, intent, and start in one
-	* request, with one D1 write.
+	* `/wallets/register/setup` — grant, intent, and start in one request, with
+	* one D1 write.
 	*
 	* Setup runs before the client's WebAuthn create, because it issues the
 	* challenge that create signs. So the ECDSA prepare and the Ed25519
@@ -1989,7 +1993,7 @@ var CloudflareD1WalletRegistrationService = class {
 					ed25519: storedRespondEd25519DeferredWork(ceremony.signerState)
 				});
 			}
-			if (ecdsaBranch.kind !== "evm_family_ecdsa_prepared") return {
+			if (ecdsaBranch.kind !== "evm_family_ecdsa_prepared" && ecdsaBranch.kind !== "evm_family_ecdsa_response_claimed") return {
 				ok: false,
 				code: "invalid_state",
 				message: "ECDSA registration branch is not respondable"
@@ -2022,17 +2026,51 @@ var CloudflareD1WalletRegistrationService = class {
 				code: "scope_mismatch",
 				message: "registration authority walletId does not match the ceremony"
 			};
-			const tenantRootIdentity = registrationTenantRootIdentity(ceremony.preparedContext);
-			if (!tenantRootIdentity) return {
+			let activeSnapshot = snapshot;
+			if (ecdsaBranch.kind === "evm_family_ecdsa_prepared") {
+				const tenantRootIdentity = registrationTenantRootIdentity(ceremony.preparedContext);
+				if (!tenantRootIdentity) return {
+					ok: false,
+					code: "invalid_state",
+					message: "ECDSA registration has no authoritative tenant-root identity"
+				};
+				const resolved = await this.tenantRootCustodyLineage.resolveActiveLineageForRuntimeScope(tenantRootIdentity);
+				if (!resolved) return {
+					ok: false,
+					code: "invalid_state",
+					message: "ECDSA registration tenant root is not active"
+				};
+				const claimed = await store.claimEcdsaRespond({
+					registrationCeremonyId: ceremony.registrationCeremonyId,
+					strictRegistrationBindingJson,
+					registrationRequest: strictRegistration,
+					projectEnvironmentId: resolved.projectEnvironmentId,
+					tenantRootIdentityDigestB64u: resolved.identityDigestB64u,
+					tenantRootCustodyLineageB64u: resolved.custodyLineageB64u
+				});
+				if (!claimed) return {
+					ok: false,
+					code: "conflict",
+					message: "ECDSA registration owner claim changed; retry the ceremony"
+				};
+				activeSnapshot = claimed;
+			}
+			const claimedSignerState = activeSnapshot.ceremony.signerState;
+			if (claimedSignerState.kind !== "signer_set_registration") return {
 				ok: false,
 				code: "invalid_state",
-				message: "ECDSA registration has no authoritative tenant-root identity"
+				message: "ECDSA response owner is missing"
 			};
-			const tenantRoot = await this.tenantRootCustodyLineage.resolveActiveLineageForRuntimeScope(tenantRootIdentity);
-			if (!tenantRoot) return {
+			const claimedBranch = findStoredWalletRegistrationEvmFamilyEcdsaBranch(claimedSignerState);
+			if (claimedBranch?.kind !== "evm_family_ecdsa_response_claimed" || !sameRouterAbEcdsaRegistrationRequest(claimedBranch.registrationRequest, strictRegistration)) return {
 				ok: false,
 				code: "invalid_state",
-				message: "ECDSA registration tenant root is not active"
+				message: "ECDSA response claim is invalid"
+			};
+			const tenantRoot = {
+				projectEnvironmentId: claimedBranch.projectEnvironmentId,
+				identityDigestB64u: claimedBranch.tenantRootIdentityDigestB64u,
+				custodyLineageB64u: claimedBranch.tenantRootCustodyLineageB64u
 			};
 			const routerStartedAtMs = Date.now();
 			const nearEd25519Branch = registrationSignerBranchesFromPlan(ceremony.signerPlan).nearEd25519;
@@ -2071,7 +2109,7 @@ var CloudflareD1WalletRegistrationService = class {
 				message: ed25519Admission.message
 			};
 			let nextSignerState = replaceStoredWalletRegistrationSignerBranch({
-				state: ceremony.signerState,
+				state: claimedSignerState,
 				replacement: {
 					kind: "evm_family_ecdsa_pending_activation",
 					branchKey: ecdsaBranch.branchKey,
@@ -2090,7 +2128,7 @@ var CloudflareD1WalletRegistrationService = class {
 				branches: [ed25519Admission.branch, ...nextSignerState.branches]
 			};
 			const next = {
-				...ceremony,
+				...activeSnapshot.ceremony,
 				authorityState: {
 					kind: "verified",
 					authority
@@ -2100,7 +2138,7 @@ var CloudflareD1WalletRegistrationService = class {
 			const commitStartedAtMs = Date.now();
 			try {
 				await store.commitEcdsaClaim({
-					expected: snapshot,
+					expected: activeSnapshot,
 					next
 				});
 			} catch (error) {
@@ -2158,11 +2196,6 @@ var CloudflareD1WalletRegistrationService = class {
 			expiresAtMs: ceremony.expiresAtMs
 		};
 	}
-	async registrationOwnerProof(input) {
-		const context = await this.readRegistrationOwnerProofContext(input.registrationCeremonyId);
-		if (!context) throw new Error("Registration owner proof context is unavailable");
-		return await this.registrationOwnerProofWithContext(context, input);
-	}
 	/** For callers that must read the context before finalize tombstones it. */
 	async registrationOwnerProofWithContext(context, input) {
 		return await buildRegistrationOwnerProof({
@@ -2677,7 +2710,8 @@ var CloudflareD1WalletRegistrationService = class {
 					wallet,
 					walletSigners: [],
 					authority,
-					now
+					now,
+					decisionStatements: []
 				});
 				break;
 			case "email_otp": {
@@ -2700,7 +2734,8 @@ var CloudflareD1WalletRegistrationService = class {
 					walletSigners: [],
 					authority,
 					emailOtp: this.emailOtpRegistrationEnrollmentFinalizer.prepareRegistrationCommitPlan(enrollment.persistence),
-					now
+					now,
+					decisionStatements: []
 				});
 				const completedIdentity = await this.emailOtpRegistrationEnrollmentFinalizer.completeRegistrationIdentity({
 					authority,
@@ -2916,8 +2951,8 @@ var CloudflareD1WalletRegistrationService = class {
 		};
 	}
 	/**
-	* Refactor 94C. `/wallets/register/activate` — activation and finalization
-	* as one irreversible step behind one Gateway operation row.
+	* `/wallets/register/activate` — activation and finalization as one
+	* irreversible step behind one Gateway operation row.
 	*
 	* Previously activation and finalization were separate requests with
 	* separate idempotency: activation claimed and CAS'd the ceremony branch,
@@ -3604,6 +3639,7 @@ var CloudflareD1WalletRegistrationService = class {
 			let ed25519MaterialActivation = null;
 			let ed25519RegisteredPublicKeyB64u = null;
 			let ed25519CapabilityInstallation = null;
+			let yaoDecision = null;
 			if (finalizeNearEd25519) {
 				const yaoRuntime = this.getEd25519YaoProductRegistration();
 				if (!yaoRuntime) return {
@@ -3713,6 +3749,13 @@ var CloudflareD1WalletRegistrationService = class {
 					code: activeYaoCapability.code,
 					message: activeYaoCapability.message
 				};
+				yaoDecision = await routerAbEd25519YaoLifecycleDecisionV1({
+					kind: "registration_finalized",
+					lifecycleId: activationReference.lifecycle_id,
+					walletId: ceremony.intent.walletId,
+					consumerBinding: requestFingerprint,
+					capability: activeYaoCapability.record
+				});
 				const activatedEd25519PublicResult = {
 					signerSlot: finalizeNearEd25519.signerSlot,
 					nearAccountId,
@@ -3749,185 +3792,198 @@ var CloudflareD1WalletRegistrationService = class {
 					now
 				});
 			}
-			const wallet = buildD1WalletRecord({
-				walletId: ceremony.intent.walletId,
-				now
-			});
-			if (activatedEcdsaBranch && !custodyClientRootPublicKey33B64u) return {
+			const yaoDecisionFound = yaoDecision ? routerAbEd25519YaoLifecycleDecisionLookupV1(yaoDecision, await this.yaoLifecycleDecisions.read(yaoDecision.lifecycleId)) : null;
+			if (yaoDecisionFound?.kind === "decided_otherwise") return {
 				ok: false,
 				code: "invalid_state",
-				message: "ECDSA registration is missing its custody client root public key"
+				message: "Ed25519 Yao registration lifecycle was finalized by another request"
 			};
-			const walletSigners = [];
-			if (activatedEcdsaBranch) {
-				const custodyClientRootPublicKey = custodyClientRootPublicKey33B64u;
-				if (!custodyClientRootPublicKey) return {
-					ok: false,
-					code: "invalid_state",
-					message: "ECDSA registration is missing its custody client root public key"
-				};
-				walletSigners.push(...buildD1WalletEcdsaSignerRecords({
+			let foundingAuthorityRecords = null;
+			if (yaoDecisionFound?.kind !== "decided") {
+				const wallet = buildD1WalletRecord({
 					walletId: ceremony.intent.walletId,
-					walletKeys: ecdsaWalletKeys,
-					activationReceipt: activatedEcdsaBranch.activation,
-					runtimePolicyScope: activatedEcdsaBranch.prepare.runtimePolicyScope,
-					custodyKeyManifestDigestB64u,
-					custodyClientRootPublicKey33B64u: custodyClientRootPublicKey,
 					now
-				}));
-			}
-			if (ed25519SignerRecord) walletSigners.push(ed25519SignerRecord);
-			const foundingAuthorityAlreadyCommitted = finalizeNearEd25519 !== null && ecdsaAlreadyFinalized;
-			const foundingAuthorityNeedsEd25519Extension = foundingAuthorityAlreadyCommitted && requestedEvmFamilyEcdsa !== null;
-			const foundingCommitComplete = finalizeEvmFamilyEcdsa !== null || finalizeNearEd25519 !== null && requestedEvmFamilyEcdsa === null || foundingAuthorityNeedsEd25519Extension;
-			let foundingAuthorityRecords = null;
-			if (foundingAuthorityNeedsEd25519Extension) {
-				if (!ed25519SignerRecord || !ed25519MaterialActivation || !ed25519RegisteredPublicKeyB64u) return {
-					ok: false,
-					code: "invalid_state",
-					message: "Deferred Ed25519 finalize is missing its founding signer facts"
-				};
-				const persistedFoundingRecords = await this.walletAuthMethods.readActiveRegistrationIdentity(ceremonyAuthority);
-				if (!persistedFoundingRecords) return {
-					ok: false,
-					code: "invalid_state",
-					message: "Deferred Ed25519 finalize is missing its founding authority"
-				};
-				if (!isActiveEcdsaWalletAuthorityV1(persistedFoundingRecords.authority)) return {
+				});
+				if (activatedEcdsaBranch && !custodyClientRootPublicKey33B64u) return {
 					ok: false,
 					code: "invalid_state",
-					message: "Deferred Ed25519 finalize requires an ECDSA-only founding authority"
+					message: "ECDSA registration is missing its custody client root public key"
 				};
-				foundingAuthorityRecords = {
-					authority: await extendFoundingAuthorityWithEd25519({
-						authority: persistedFoundingRecords.authority,
-						ed25519: {
-							signer: ed25519SignerRecord,
-							registeredPublicKeyB64u: ed25519RegisteredPublicKeyB64u,
-							materialActivation: ed25519MaterialActivation
-						},
+				const walletSigners = [];
+				if (activatedEcdsaBranch) {
+					const custodyClientRootPublicKey = custodyClientRootPublicKey33B64u;
+					if (!custodyClientRootPublicKey) return {
+						ok: false,
+						code: "invalid_state",
+						message: "ECDSA registration is missing its custody client root public key"
+					};
+					walletSigners.push(...buildD1WalletEcdsaSignerRecords({
+						walletId: ceremony.intent.walletId,
+						walletKeys: ecdsaWalletKeys,
+						activationReceipt: activatedEcdsaBranch.activation,
+						runtimePolicyScope: activatedEcdsaBranch.prepare.runtimePolicyScope,
+						custodyKeyManifestDigestB64u,
+						custodyClientRootPublicKey33B64u: custodyClientRootPublicKey,
 						now
-					}),
-					authMethod: persistedFoundingRecords.authMethod
-				};
-			} else if (foundingCommitComplete && !foundingAuthorityAlreadyCommitted) {
-				const ecdsaWalletKey = ecdsaWalletKeys[0];
-				if (ed25519SignerRecord && ed25519MaterialActivation && ed25519RegisteredPublicKeyB64u) if (!ecdsaWalletKey || !ecdsaMaterialActivation) {
-					if (requestedEvmFamilyEcdsa !== null) return {
+					}));
+				}
+				if (ed25519SignerRecord) walletSigners.push(ed25519SignerRecord);
+				const foundingAuthorityAlreadyCommitted = finalizeNearEd25519 !== null && ecdsaAlreadyFinalized;
+				const foundingAuthorityNeedsEd25519Extension = foundingAuthorityAlreadyCommitted && requestedEvmFamilyEcdsa !== null;
+				const foundingCommitComplete = finalizeEvmFamilyEcdsa !== null || finalizeNearEd25519 !== null && requestedEvmFamilyEcdsa === null || foundingAuthorityNeedsEd25519Extension;
+				if (foundingAuthorityNeedsEd25519Extension) {
+					if (!ed25519SignerRecord || !ed25519MaterialActivation || !ed25519RegisteredPublicKeyB64u) return {
+						ok: false,
+						code: "invalid_state",
+						message: "Deferred Ed25519 finalize is missing its founding signer facts"
+					};
+					const persistedFoundingRecords = await this.walletAuthMethods.readActiveRegistrationIdentity(ceremonyAuthority);
+					if (!persistedFoundingRecords) return {
 						ok: false,
 						code: "invalid_state",
-						message: "Complete registration is missing ECDSA founding facts"
+						message: "Deferred Ed25519 finalize is missing its founding authority"
 					};
-					foundingAuthorityRecords = await buildFoundingAuthorityRecords({
+					if (!isActiveEcdsaWalletAuthorityV1(persistedFoundingRecords.authority)) return {
+						ok: false,
+						code: "invalid_state",
+						message: "Deferred Ed25519 finalize requires an ECDSA-only founding authority"
+					};
+					foundingAuthorityRecords = {
+						authority: await extendFoundingAuthorityWithEd25519({
+							authority: persistedFoundingRecords.authority,
+							ed25519: {
+								signer: ed25519SignerRecord,
+								registeredPublicKeyB64u: ed25519RegisteredPublicKeyB64u,
+								materialActivation: ed25519MaterialActivation
+							},
+							now
+						}),
+						authMethod: persistedFoundingRecords.authMethod
+					};
+				} else if (foundingCommitComplete && !foundingAuthorityAlreadyCommitted) {
+					const ecdsaWalletKey = ecdsaWalletKeys[0];
+					if (ed25519SignerRecord && ed25519MaterialActivation && ed25519RegisteredPublicKeyB64u) if (!ecdsaWalletKey || !ecdsaMaterialActivation) {
+						if (requestedEvmFamilyEcdsa !== null) return {
+							ok: false,
+							code: "invalid_state",
+							message: "Complete registration is missing ECDSA founding facts"
+						};
+						foundingAuthorityRecords = await buildFoundingAuthorityRecords({
+							authority: ceremonyAuthority,
+							walletId: ceremony.intent.walletId,
+							prepared,
+							signerFacts: {
+								kind: "ed25519",
+								keyFamilies: ["ed25519"],
+								ed25519: {
+									signer: ed25519SignerRecord,
+									registeredPublicKeyB64u: ed25519RegisteredPublicKeyB64u,
+									materialActivation: ed25519MaterialActivation
+								}
+							},
+							now
+						});
+					} else foundingAuthorityRecords = await buildFoundingAuthorityRecords({
 						authority: ceremonyAuthority,
 						walletId: ceremony.intent.walletId,
 						prepared,
 						signerFacts: {
-							kind: "ed25519",
-							keyFamilies: ["ed25519"],
+							kind: "both",
+							keyFamilies: ["ed25519", "ecdsa_secp256k1"],
 							ed25519: {
 								signer: ed25519SignerRecord,
 								registeredPublicKeyB64u: ed25519RegisteredPublicKeyB64u,
 								materialActivation: ed25519MaterialActivation
+							},
+							ecdsa: {
+								walletKey: requireSingleFoundingEcdsaWalletKey(ecdsaWalletKeys),
+								materialActivation: ecdsaMaterialActivation
 							}
 						},
 						now
 					});
-				} else foundingAuthorityRecords = await buildFoundingAuthorityRecords({
-					authority: ceremonyAuthority,
-					walletId: ceremony.intent.walletId,
-					prepared,
-					signerFacts: {
-						kind: "both",
-						keyFamilies: ["ed25519", "ecdsa_secp256k1"],
-						ed25519: {
-							signer: ed25519SignerRecord,
-							registeredPublicKeyB64u: ed25519RegisteredPublicKeyB64u,
-							materialActivation: ed25519MaterialActivation
+					else if (ecdsaWalletKey && ecdsaMaterialActivation) foundingAuthorityRecords = await buildFoundingAuthorityRecords({
+						authority: ceremonyAuthority,
+						walletId: ceremony.intent.walletId,
+						prepared,
+						signerFacts: {
+							kind: "ecdsa_secp256k1",
+							keyFamilies: ["ecdsa_secp256k1"],
+							ecdsa: {
+								walletKey: requireSingleFoundingEcdsaWalletKey(ecdsaWalletKeys),
+								materialActivation: ecdsaMaterialActivation
+							}
 						},
-						ecdsa: {
-							walletKey: requireSingleFoundingEcdsaWalletKey(ecdsaWalletKeys),
-							materialActivation: ecdsaMaterialActivation
-						}
-					},
-					now
-				});
-				else if (ecdsaWalletKey && ecdsaMaterialActivation) foundingAuthorityRecords = await buildFoundingAuthorityRecords({
-					authority: ceremonyAuthority,
-					walletId: ceremony.intent.walletId,
-					prepared,
-					signerFacts: {
-						kind: "ecdsa_secp256k1",
-						keyFamilies: ["ecdsa_secp256k1"],
-						ecdsa: {
-							walletKey: requireSingleFoundingEcdsaWalletKey(ecdsaWalletKeys),
-							materialActivation: ecdsaMaterialActivation
+						now
+					});
+					else return {
+						ok: false,
+						code: "invalid_state",
+						message: "Complete registration is missing founding signer facts"
+					};
+				}
+				const decisionStatements = yaoDecision ? this.yaoLifecycleDecisions.prepareDecideStatements(yaoDecision, now) : [];
+				const persistenceTiming = startD1RegistrationRouteTiming("relayPersistenceMs");
+				try {
+					switch (ceremonyAuthority.kind) {
+						case "passkey":
+							if (emailOtpEnrollment.persistence) return {
+								ok: false,
+								code: "invalid_state",
+								message: "Passkey registration cannot persist Email OTP enrollment state"
+							};
+							if (foundingAuthorityRecords) await this.walletRegistrationCommitStore.commit({
+								kind: "passkey_wallet_registration_commit_v1",
+								wallet,
+								walletSigners,
+								authority: ceremonyAuthority,
+								foundingAuthority: foundingAuthorityRecords.authority,
+								foundingAuthMethod: foundingAuthorityRecords.authMethod,
+								now,
+								decisionStatements
+							});
+							else await this.walletRegistrationCommitStore.commit({
+								kind: "passkey_wallet_registration_commit_v1",
+								wallet,
+								walletSigners,
+								authority: ceremonyAuthority,
+								now,
+								decisionStatements
+							});
+							break;
+						case "email_otp": {
+							if (!emailOtpEnrollment.persistence) return {
+								ok: false,
+								code: "invalid_state",
+								message: "Email OTP registration is missing enrollment persistence state"
+							};
+							const emailOtp = this.emailOtpRegistrationEnrollmentFinalizer.prepareRegistrationCommitPlan(emailOtpEnrollment.persistence);
+							if (foundingAuthorityRecords) await this.walletRegistrationCommitStore.commit({
+								kind: "email_otp_wallet_registration_commit_v1",
+								wallet,
+								walletSigners,
+								authority: ceremonyAuthority,
+								emailOtp,
+								foundingAuthority: foundingAuthorityRecords.authority,
+								foundingAuthMethod: foundingAuthorityRecords.authMethod,
+								now,
+								decisionStatements
+							});
+							else await this.walletRegistrationCommitStore.commit({
+								kind: "email_otp_wallet_registration_commit_v1",
+								wallet,
+								walletSigners,
+								authority: ceremonyAuthority,
+								emailOtp,
+								now,
+								decisionStatements
+							});
+							break;
 						}
-					},
-					now
-				});
-				else return {
-					ok: false,
-					code: "invalid_state",
-					message: "Complete registration is missing founding signer facts"
-				};
-			}
-			const persistenceTiming = startD1RegistrationRouteTiming("relayPersistenceMs");
-			try {
-				switch (ceremonyAuthority.kind) {
-					case "passkey":
-						if (emailOtpEnrollment.persistence) return {
-							ok: false,
-							code: "invalid_state",
-							message: "Passkey registration cannot persist Email OTP enrollment state"
-						};
-						if (foundingAuthorityRecords) await this.walletRegistrationCommitStore.commit({
-							kind: "passkey_wallet_registration_commit_v1",
-							wallet,
-							walletSigners,
-							authority: ceremonyAuthority,
-							foundingAuthority: foundingAuthorityRecords.authority,
-							foundingAuthMethod: foundingAuthorityRecords.authMethod,
-							now
-						});
-						else await this.walletRegistrationCommitStore.commit({
-							kind: "passkey_wallet_registration_commit_v1",
-							wallet,
-							walletSigners,
-							authority: ceremonyAuthority,
-							now
-						});
-						break;
-					case "email_otp": {
-						if (!emailOtpEnrollment.persistence) return {
-							ok: false,
-							code: "invalid_state",
-							message: "Email OTP registration is missing enrollment persistence state"
-						};
-						const emailOtp = this.emailOtpRegistrationEnrollmentFinalizer.prepareRegistrationCommitPlan(emailOtpEnrollment.persistence);
-						if (foundingAuthorityRecords) await this.walletRegistrationCommitStore.commit({
-							kind: "email_otp_wallet_registration_commit_v1",
-							wallet,
-							walletSigners,
-							authority: ceremonyAuthority,
-							emailOtp,
-							foundingAuthority: foundingAuthorityRecords.authority,
-							foundingAuthMethod: foundingAuthorityRecords.authMethod,
-							now
-						});
-						else await this.walletRegistrationCommitStore.commit({
-							kind: "email_otp_wallet_registration_commit_v1",
-							wallet,
-							walletSigners,
-							authority: ceremonyAuthority,
-							emailOtp,
-							now
-						});
-						break;
 					}
+				} finally {
+					finishD1RegistrationRouteTiming(finalizeTiming, persistenceTiming);
 				}
-			} finally {
-				finishD1RegistrationRouteTiming(finalizeTiming, persistenceTiming);
 			}
 			const completedRegistrationIdentity = await this.emailOtpRegistrationEnrollmentFinalizer.completeRegistrationIdentity({
 				authority: ceremonyAuthority,
@@ -4082,6 +4138,6 @@ function sameRegistrationContinuationSubject(expected, actual) {
 	}
 }
 //#endregion
-export { CloudflareD1WalletRegistrationService, buildActivatedEcdsaFamilyBootstrap, ecdsaStrictRegistrationAuthority, exactEcdsaParticipantPair, hasEcdsaKeyHandleSetMismatch, mergeRouterServerTiming };
+export { CloudflareD1WalletRegistrationService, buildActivatedEcdsaFamilyBootstrap, ecdsaStrictRegistrationAuthority, exactEcdsaParticipantPair };
 
 //# sourceMappingURL=d1WalletRegistrationService.js.map