@seams/wallet-server 0.5.0

package/dist/esm/core/RegistrationCeremonyStore.js

@@ -0,0 +1,2101 @@
+import { parseChallengeSubjectId, parseEmailOtpChallengeId, parseOrgId, parseProviderSubject, parseRootShareEpoch, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../shared-ts/src/utils/domainIds.js";
+import { parseDeviceId } from "../shared-ts/src/authorization/capabilityKinds.js";
+import { parseDigestB64u } from "../shared-ts/src/utils/canonicalPrimitives.js";
+import { parseWalletAddAuthMethodRegistrationOptions } from "../shared-ts/src/utils/addAuthMethodRegistration.js";
+import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, normalizeAddAuthMethodInput, normalizeAddAuthMethodIntentCaller, normalizeAddSignerSelection, normalizeRegistrationAuthMethodInput, normalizeRegistrationSignerPlan, registrationSignerBranchKeyFromString, registrationSignerPlanFromSelection, registrationSignerSetSelectionFromPlan } from "../shared-ts/src/utils/registrationIntent.js";
+import { parseWebAuthnAuthenticatorDeviceInfo } from "../shared-ts/src/utils/webauthnDeviceInfo.js";
+import { parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { derivationClientSharePublicKey33B64uFromString, ecdsaClientRootPublicKey33B64uFromString } from "../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
+import { parseWalletAuthAuthorityRef } from "../shared-ts/src/utils/walletAuthAuthority.js";
+import { parseRouterAbEcdsaDerivationNormalSigningStateV1, parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaRegistrationActivationReceiptV1, parseRouterAbEcdsaRegistrationRequestFactsV1, parseRouterAbEcdsaRegistrationRequestV1, parseRouterAbEcdsaStrictForwardedRegistrationResponseV1, parseRouterAbEcdsaVerifiedClientActivationFactsV1 } from "../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { thresholdEcdsaChainTargetFromValue, thresholdEcdsaChainTargetKey } from "./thresholdEcdsaChainTarget.js";
+import "./defaultConfigsServer.js";
+import { parseWalletEd25519SignerRecord } from "./d1WalletStore.js";
+import { registrationPreparationIdFromString } from "./types.js";
+import { parsePasskeyCustodyEnvelopeRecord } from "../shared-ts/src/passkey-custody/custodyEnvelope.js";
+import "../shared-ts/src/passkey-custody/index.js";
+import { parseEcdsaDerivationPublicIdentity } from "./ThresholdService/validation.js";
+import { parseStoredRouterAbEcdsaPendingActivationV1 } from "../router/domains/ecdsa/routerAbEcdsaStrictRegistration.js";
+//#region src/core/RegistrationCeremonyStore.ts
+function buildStoredWalletRegistrationPreparedContext(input) {
+	const signingRootId = String(input.signingRootId || "").trim();
+	const signingRootVersion = String(input.signingRootVersion || "").trim();
+	if (!signingRootId || !signingRootVersion) throw new Error("registration prepared context requires signing-root scope");
+	return {
+		kind: "wallet_registration_prepared_context_v1",
+		signingRootId,
+		signingRootVersion,
+		runtimePolicy: input.runtimePolicyScope ? {
+			kind: "runtime_policy_scope",
+			scope: {
+				orgId: input.runtimePolicyScope.orgId,
+				projectId: input.runtimePolicyScope.projectId,
+				envId: input.runtimePolicyScope.envId,
+				signingRootVersion: input.runtimePolicyScope.signingRootVersion
+			}
+		} : { kind: "signing_root_only" },
+		ecdsa: input.ecdsaChainTargets && input.ecdsaChainTargets.length > 0 ? {
+			kind: "evm_family_ecdsa_requested",
+			chainTargets: input.ecdsaChainTargets.map((target) => ({ ...target }))
+		} : { kind: "evm_family_ecdsa_absent" }
+	};
+}
+function storedWalletRegistrationPreparedContextsMatch(left, right) {
+	if (left.kind !== right.kind || left.signingRootId !== right.signingRootId || left.signingRootVersion !== right.signingRootVersion || left.runtimePolicy.kind !== right.runtimePolicy.kind || left.ecdsa.kind !== right.ecdsa.kind) return false;
+	if (left.runtimePolicy.kind === "runtime_policy_scope" && right.runtimePolicy.kind === "runtime_policy_scope" && (left.runtimePolicy.scope.orgId !== right.runtimePolicy.scope.orgId || left.runtimePolicy.scope.projectId !== right.runtimePolicy.scope.projectId || left.runtimePolicy.scope.envId !== right.runtimePolicy.scope.envId || left.runtimePolicy.scope.signingRootVersion !== right.runtimePolicy.scope.signingRootVersion)) return false;
+	if (left.ecdsa.kind === "evm_family_ecdsa_requested" && right.ecdsa.kind === "evm_family_ecdsa_requested") {
+		const leftTargets = left.ecdsa.chainTargets;
+		const rightTargets = right.ecdsa.chainTargets;
+		if (leftTargets.length !== rightTargets.length) return false;
+		return leftTargets.every((target, index) => thresholdEcdsaChainTargetKey(target) === thresholdEcdsaChainTargetKey(rightTargets[index]));
+	}
+	return true;
+}
+function storedRegistrationAuthoritiesMatch(left, right) {
+	if (left.kind !== right.kind) return false;
+	switch (left.kind) {
+		case "passkey": return right.kind === "passkey" && left.walletId === right.walletId && left.rpId === right.rpId && left.credentialIdB64u === right.credentialIdB64u && left.credentialPublicKeyB64u === right.credentialPublicKeyB64u && left.registrationIntentDigestB64u === right.registrationIntentDigestB64u;
+		case "email_otp": return right.kind === "email_otp" && left.proofKind === right.proofKind && left.walletId === right.walletId && left.providerSubject === right.providerSubject && left.emailHashHex === right.emailHashHex && left.registrationAuthorityId === right.registrationAuthorityId && left.finalWalletId === right.finalWalletId && left.orgId === right.orgId && left.registrationIntentDigestB64u === right.registrationIntentDigestB64u;
+		default: return left;
+	}
+}
+function buildStoredWalletRegistrationEvmFamilyEcdsaFinalizedBranch(input) {
+	const { activationOwner: _activationOwner, ...activated } = input.activated;
+	return {
+		...activated,
+		kind: "evm_family_ecdsa_finalized",
+		finalizedAtMs: input.finalizedAtMs
+	};
+}
+function buildStoredWalletRegistrationEvmFamilyEcdsaPreparedBranch(input) {
+	return {
+		kind: "evm_family_ecdsa_prepared",
+		branchKey: input.branchKey,
+		derivationKind: input.ecdsa.kind,
+		chainTargets: input.ecdsa.chainTargets,
+		prepare: input.ecdsa.prepare,
+		strictRegistration: input.ecdsa.strictRegistration,
+		strictRegistrationBindingJson: input.ecdsa.strictRegistrationBindingJson
+	};
+}
+function buildStoredWalletRegistrationNearEd25519YaoAuthorizedBranch(input) {
+	return {
+		kind: "near_ed25519_yao_authorized",
+		branchKey: input.branchKey,
+		admissionRequest: input.admissionRequest,
+		admissionReceipt: input.admissionReceipt
+	};
+}
+function findStoredWalletRegistrationNearEd25519YaoBranch(state) {
+	for (const branch of state.branches) if (branch.kind === "near_ed25519_yao_authorized") return branch;
+	return null;
+}
+function findStoredWalletRegistrationEvmFamilyEcdsaBranch(state) {
+	for (const branch of state.branches) if (branch.kind === "evm_family_ecdsa_prepared" || branch.kind === "evm_family_ecdsa_response_claimed" || branch.kind === "evm_family_ecdsa_pending_activation" || branch.kind === "evm_family_ecdsa_activation_claimed" || branch.kind === "evm_family_ecdsa_activated" || branch.kind === "evm_family_ecdsa_finalized") return branch;
+	return null;
+}
+function replaceStoredWalletRegistrationSignerBranch(input) {
+	return {
+		kind: "signer_set_registration",
+		branches: input.state.branches.map((branch) => branch.branchKey === input.replacement.branchKey ? input.replacement : branch)
+	};
+}
+/**
+* The verified authority, or `null` while the ceremony is still awaiting its
+* proof. Legs downstream of respond (activation, finalization, persistence)
+* require a verified authority and treat `null` as an invalid state rather
+* than a missing field.
+*/
+function verifiedRegistrationCeremonyAuthority(ceremony) {
+	return ceremony.authorityState.kind === "verified" ? ceremony.authorityState.authority : null;
+}
+function registrationCeremonyAuthorityRpId(authorityState) {
+	switch (authorityState.kind) {
+		case "awaiting_proof": return authorityState.authMethod.kind === "passkey" ? String(authorityState.authMethod.rpId) : null;
+		case "verified": return authorityState.authority.kind === "passkey" ? String(authorityState.authority.rpId) : null;
+		default: return authorityState;
+	}
+}
+function parseTerminalRegistrationCeremonyCancellationResult(value) {
+	const parsed = parseJsonValue(value);
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+	const record = parsed;
+	switch (record.kind) {
+		case "cancelled": return record.ceremonyDeleted === true ? {
+			kind: "cancelled",
+			ceremonyDeleted: true
+		} : null;
+		case "not_found": return record.ceremonyDeleted === false ? {
+			kind: "not_found",
+			ceremonyDeleted: false
+		} : null;
+		default: return null;
+	}
+}
+var MemoryRegistrationCeremonyStore = class {
+	constructor() {
+		this.addAuthMethodIntents = /* @__PURE__ */ new Map();
+		this.addSignerIntents = /* @__PURE__ */ new Map();
+		this.ceremonies = /* @__PURE__ */ new Map();
+		this.addSignerFinalizeReplays = /* @__PURE__ */ new Map();
+		this.addSignerFinalizeReplayClaims = /* @__PURE__ */ new Map();
+		this.addAuthMethodCeremonies = /* @__PURE__ */ new Map();
+		this.addSignerCeremonies = /* @__PURE__ */ new Map();
+	}
+	async putAddAuthMethodIntent(intent) {
+		this.pruneExpired();
+		this.addAuthMethodIntents.set(intent.grant, intent);
+	}
+	async getAddAuthMethodIntent(grant) {
+		this.pruneExpired();
+		const intent = this.addAuthMethodIntents.get(String(grant || "").trim()) || null;
+		if (!intent || intent.expiresAtMs <= Date.now()) return null;
+		return intent;
+	}
+	async takeAddAuthMethodIntent(grant) {
+		this.pruneExpired();
+		const key = String(grant || "").trim();
+		const intent = this.addAuthMethodIntents.get(key) || null;
+		if (!intent) return null;
+		this.addAuthMethodIntents.delete(key);
+		if (intent.expiresAtMs <= Date.now()) return null;
+		return {
+			...intent,
+			kind: "add_auth_method_intent_consumed",
+			consumedAtMs: Date.now()
+		};
+	}
+	async putAddSignerIntent(intent) {
+		this.pruneExpired();
+		this.addSignerIntents.set(intent.grant, intent);
+	}
+	async getAddSignerIntent(grant) {
+		this.pruneExpired();
+		const intent = this.addSignerIntents.get(String(grant || "").trim()) || null;
+		if (!intent || intent.expiresAtMs <= Date.now()) return null;
+		return intent;
+	}
+	async takeAddSignerIntent(grant) {
+		this.pruneExpired();
+		const key = String(grant || "").trim();
+		const intent = this.addSignerIntents.get(key) || null;
+		if (!intent) return null;
+		this.addSignerIntents.delete(key);
+		if (intent.expiresAtMs <= Date.now()) return null;
+		return {
+			...intent,
+			kind: "add_signer_intent_consumed",
+			consumedAtMs: Date.now()
+		};
+	}
+	async putCeremony(ceremony) {
+		this.pruneExpired();
+		this.ceremonies.set(ceremony.registrationCeremonyId, ceremony);
+	}
+	async getCeremony(registrationCeremonyId) {
+		this.pruneExpired();
+		const ceremony = this.ceremonies.get(String(registrationCeremonyId || "").trim()) || null;
+		if (!ceremony || ceremony.expiresAtMs <= Date.now()) return null;
+		return ceremony;
+	}
+	async updateCeremony(ceremony) {
+		this.pruneExpired();
+		if (ceremony.expiresAtMs <= Date.now()) return;
+		this.ceremonies.set(ceremony.registrationCeremonyId, ceremony);
+	}
+	async takeCeremony(registrationCeremonyId) {
+		this.pruneExpired();
+		const key = String(registrationCeremonyId || "").trim();
+		const ceremony = this.ceremonies.get(key) || null;
+		this.ceremonies.delete(key);
+		if (!ceremony || ceremony.expiresAtMs <= Date.now()) return null;
+		return ceremony;
+	}
+	async cancelTerminalCeremony(input) {
+		this.pruneExpired();
+		const registrationCeremonyId = trimString(input.registrationCeremonyId);
+		const ceremony = this.ceremonies.get(registrationCeremonyId);
+		if (!ceremony) return {
+			kind: "not_found",
+			ceremonyDeleted: false
+		};
+		if (ceremony.intent.walletId !== input.walletId) throw new Error("Terminal registration cancellation walletId mismatch");
+		this.ceremonies.delete(registrationCeremonyId);
+		return {
+			kind: "cancelled",
+			ceremonyDeleted: true
+		};
+	}
+	async putAddSignerFinalizeReplay(replay) {
+		this.pruneExpired();
+		this.addSignerFinalizeReplays.set(addSignerFinalizeReplayKey(replay), replay);
+		this.addSignerFinalizeReplayClaims.set(replay.addSignerCeremonyId, replay);
+	}
+	async getAddSignerFinalizeReplay(input) {
+		this.pruneExpired();
+		const replay = this.addSignerFinalizeReplays.get(addSignerFinalizeReplayKey(input)) || null;
+		if (!replay || replay.expiresAtMs <= Date.now()) return null;
+		return replay;
+	}
+	async getAddSignerFinalizeReplayForCeremony(addSignerCeremonyId) {
+		this.pruneExpired();
+		const replay = this.addSignerFinalizeReplayClaims.get(trimString(addSignerCeremonyId)) || null;
+		if (!replay || replay.expiresAtMs <= Date.now()) return null;
+		return replay;
+	}
+	async putAddAuthMethodCeremony(ceremony) {
+		this.pruneExpired();
+		this.addAuthMethodCeremonies.set(ceremony.addAuthMethodCeremonyId, ceremony);
+	}
+	async getAddAuthMethodCeremony(addAuthMethodCeremonyId) {
+		this.pruneExpired();
+		const ceremony = this.addAuthMethodCeremonies.get(String(addAuthMethodCeremonyId || "").trim()) || null;
+		if (!ceremony || ceremony.expiresAtMs <= Date.now()) return null;
+		return ceremony;
+	}
+	async updateAddAuthMethodCeremony(ceremony) {
+		this.pruneExpired();
+		if (ceremony.expiresAtMs <= Date.now()) return;
+		this.addAuthMethodCeremonies.set(ceremony.addAuthMethodCeremonyId, ceremony);
+	}
+	async takeAddAuthMethodCeremony(addAuthMethodCeremonyId) {
+		this.pruneExpired();
+		const key = String(addAuthMethodCeremonyId || "").trim();
+		const ceremony = this.addAuthMethodCeremonies.get(key) || null;
+		this.addAuthMethodCeremonies.delete(key);
+		if (!ceremony || ceremony.expiresAtMs <= Date.now()) return null;
+		return ceremony;
+	}
+	async putAddSignerCeremony(ceremony) {
+		this.pruneExpired();
+		this.addSignerCeremonies.set(ceremony.addSignerCeremonyId, ceremony);
+	}
+	async getAddSignerCeremony(addSignerCeremonyId) {
+		this.pruneExpired();
+		const ceremony = this.addSignerCeremonies.get(String(addSignerCeremonyId || "").trim()) || null;
+		if (!ceremony || ceremony.expiresAtMs <= Date.now()) return null;
+		return ceremony;
+	}
+	async updateAddSignerCeremony(ceremony) {
+		this.pruneExpired();
+		if (ceremony.expiresAtMs <= Date.now()) return;
+		this.addSignerCeremonies.set(ceremony.addSignerCeremonyId, ceremony);
+	}
+	async takeAddSignerCeremony(addSignerCeremonyId) {
+		this.pruneExpired();
+		const key = String(addSignerCeremonyId || "").trim();
+		const ceremony = this.addSignerCeremonies.get(key) || null;
+		this.addSignerCeremonies.delete(key);
+		if (!ceremony || ceremony.expiresAtMs <= Date.now()) return null;
+		return ceremony;
+	}
+	pruneExpired() {
+		const now = Date.now();
+		for (const [key, intent] of this.addAuthMethodIntents) if (intent.expiresAtMs <= now) this.addAuthMethodIntents.delete(key);
+		for (const [key, intent] of this.addSignerIntents) if (intent.expiresAtMs <= now) this.addSignerIntents.delete(key);
+		for (const [key, ceremony] of this.ceremonies) if (ceremony.expiresAtMs <= now) this.ceremonies.delete(key);
+		for (const [key, replay] of this.addSignerFinalizeReplays) if (replay.expiresAtMs <= now) this.addSignerFinalizeReplays.delete(key);
+		for (const [key, replay] of this.addSignerFinalizeReplayClaims) if (replay.expiresAtMs <= now) this.addSignerFinalizeReplayClaims.delete(key);
+		for (const [key, ceremony] of this.addAuthMethodCeremonies) if (ceremony.expiresAtMs <= now) this.addAuthMethodCeremonies.delete(key);
+		for (const [key, ceremony] of this.addSignerCeremonies) if (ceremony.expiresAtMs <= now) this.addSignerCeremonies.delete(key);
+	}
+};
+function assertNever(value) {
+	throw new Error(`Unexpected registration ceremony store branch: ${String(value)}`);
+}
+function trimString(value) {
+	return typeof value === "string" ? value.trim() : "";
+}
+function addSignerFinalizeReplayKey(input) {
+	return `${trimString(input.addSignerCeremonyId)}:${trimString(input.idempotencyKey)}`;
+}
+function parseJsonValue(value) {
+	if (typeof value !== "string") return value;
+	try {
+		return JSON.parse(value);
+	} catch {
+		return null;
+	}
+}
+function parseStoredWalletAddSignerFinalizeParticipantIds(value) {
+	if (!Array.isArray(value) || value.length !== 2) return null;
+	const first = value[0];
+	const second = value[1];
+	if (typeof first !== "number" || !Number.isSafeInteger(first) || first <= 0 || typeof second !== "number" || !Number.isSafeInteger(second) || second <= 0) return null;
+	return [first, second];
+}
+function parseStoredWalletAddSignerFinalizeEd25519Result(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	const record = value;
+	const signerSlot = Number(record.signerSlot);
+	const nearAccountId = trimString(record.nearAccountId);
+	const nearEd25519SigningKeyId = trimString(record.nearEd25519SigningKeyId);
+	const publicKey = trimString(record.publicKey);
+	const relayerKeyId = trimString(record.relayerKeyId);
+	const keyVersion = trimString(record.keyVersion);
+	const participantIds = parseStoredWalletAddSignerFinalizeParticipantIds(record.participantIds);
+	if (record.recoveryExportCapable !== true || !Number.isSafeInteger(signerSlot) || signerSlot <= 0 || !nearAccountId || !nearEd25519SigningKeyId || !publicKey.startsWith("ed25519:") || !relayerKeyId || !keyVersion || !participantIds) return null;
+	return {
+		signerSlot,
+		nearAccountId,
+		nearEd25519SigningKeyId,
+		publicKey,
+		relayerKeyId,
+		keyVersion,
+		recoveryExportCapable: true,
+		participantIds
+	};
+}
+function parseStoredWalletAddSignerFinalizeEcdsaWalletKey(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	const record = value;
+	if (record.keyScope !== "evm-family") return null;
+	const chainTarget = thresholdEcdsaChainTargetFromValue(record.chainTarget);
+	const walletId = trimString(record.walletId);
+	const evmFamilySigningKeySlotId = trimString(record.evmFamilySigningKeySlotId);
+	const keyHandle = trimString(record.keyHandle);
+	const ecdsaThresholdKeyId = trimString(record.ecdsaThresholdKeyId);
+	const signingRootId = trimString(record.signingRootId);
+	const signingRootVersion = trimString(record.signingRootVersion);
+	const thresholdEcdsaPublicKeyB64u = trimString(record.thresholdEcdsaPublicKeyB64u);
+	const thresholdOwnerAddress = trimString(record.thresholdOwnerAddress);
+	const relayerKeyId = trimString(record.relayerKeyId);
+	const relayerVerifyingShareB64u = trimString(record.relayerVerifyingShareB64u);
+	const contextBinding32B64u = trimString(record.contextBinding32B64u);
+	const derivationClientSharePublicKey33B64u = trimString(record.derivationClientSharePublicKey33B64u);
+	const clientShareRetryCounter = Number(record.clientShareRetryCounter);
+	const relayerShareRetryCounter = Number(record.relayerShareRetryCounter);
+	const participantIds = parseStoredWalletAddSignerFinalizeParticipantIds(record.participantIds);
+	let publicCapability;
+	let parsedDerivationClientSharePublicKey33B64u;
+	try {
+		publicCapability = parseRouterAbEcdsaDerivationPublicCapabilityV1(record.publicCapability);
+		parsedDerivationClientSharePublicKey33B64u = derivationClientSharePublicKey33B64uFromString(derivationClientSharePublicKey33B64u);
+	} catch {
+		return null;
+	}
+	if (!chainTarget || !walletId || !evmFamilySigningKeySlotId || !keyHandle || !ecdsaThresholdKeyId || !signingRootId || !signingRootVersion || !thresholdEcdsaPublicKeyB64u || !thresholdOwnerAddress || !relayerKeyId || !relayerVerifyingShareB64u || !contextBinding32B64u || !derivationClientSharePublicKey33B64u || !Number.isSafeInteger(clientShareRetryCounter) || clientShareRetryCounter < 0 || !Number.isSafeInteger(relayerShareRetryCounter) || relayerShareRetryCounter < 0 || !participantIds || participantIds[0] !== 1 || participantIds[1] !== 2) return null;
+	return {
+		keyScope: "evm-family",
+		chainTarget,
+		walletId,
+		evmFamilySigningKeySlotId,
+		keyHandle,
+		ecdsaThresholdKeyId,
+		signingRootId,
+		signingRootVersion,
+		thresholdEcdsaPublicKeyB64u,
+		thresholdOwnerAddress,
+		relayerKeyId,
+		relayerVerifyingShareB64u,
+		contextBinding32B64u,
+		derivationClientSharePublicKey33B64u: parsedDerivationClientSharePublicKey33B64u,
+		clientShareRetryCounter,
+		relayerShareRetryCounter,
+		participantIds: [1, 2],
+		publicCapability
+	};
+}
+function parseStoredWalletAddSignerFinalizeEcdsaResult(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	const record = value;
+	if (!Array.isArray(record.walletKeys) || record.walletKeys.length === 0) return null;
+	const walletKeys = [];
+	for (const rawWalletKey of record.walletKeys) {
+		const walletKey = parseStoredWalletAddSignerFinalizeEcdsaWalletKey(rawWalletKey);
+		if (!walletKey) return null;
+		walletKeys.push(walletKey);
+	}
+	return { walletKeys };
+}
+function parseStoredWalletAddSignerFinalizeSuccess(value) {
+	const parsed = parseJsonValue(value);
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+	const record = parsed;
+	if (record.ok !== true) return null;
+	const walletId = parseWalletId(record.walletId);
+	if (!walletId.ok) return null;
+	if (record.kind === "near_ed25519") {
+		if (!trimString(record.rpId) || !trimString(record.credentialIdB64u)) return null;
+		const ed25519 = parseStoredWalletAddSignerFinalizeEd25519Result(record.ed25519);
+		return ed25519 ? {
+			ok: true,
+			kind: "near_ed25519",
+			walletId: walletId.value,
+			rpId: trimString(record.rpId),
+			credentialIdB64u: trimString(record.credentialIdB64u),
+			ed25519
+		} : null;
+	}
+	if (record.kind !== "evm_family_ecdsa") return null;
+	const ecdsa = parseStoredWalletAddSignerFinalizeEcdsaResult(record.ecdsa);
+	if (!ecdsa) return null;
+	const rpId = trimString(record.rpId);
+	return rpId ? {
+		ok: true,
+		kind: "evm_family_ecdsa",
+		walletId: walletId.value,
+		rpId,
+		ecdsa
+	} : {
+		ok: true,
+		kind: "evm_family_ecdsa",
+		walletId: walletId.value,
+		ecdsa
+	};
+}
+function parseStoredWalletAddSignerFinalizeReplay(value) {
+	const parsed = parseJsonValue(value);
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+	const record = parsed;
+	if (record.kind !== "wallet_add_signer_finalize_replay_v1") return null;
+	const addSignerCeremonyId = trimString(record.addSignerCeremonyId);
+	const idempotencyKey = trimString(record.idempotencyKey);
+	const createdAtMs = Number(record.createdAtMs);
+	const expiresAtMs = Number(record.expiresAtMs);
+	const request = parseStoredWalletAddSignerFinalizeRequest(record.request);
+	const response = parseStoredWalletAddSignerFinalizeSuccess(record.response);
+	if (!addSignerCeremonyId || !idempotencyKey || !request || request.addSignerCeremonyId !== addSignerCeremonyId || request.idempotencyKey !== idempotencyKey || !response || request.kind !== response.kind || !Number.isSafeInteger(createdAtMs) || createdAtMs <= 0 || !Number.isSafeInteger(expiresAtMs) || expiresAtMs <= 0) return null;
+	return {
+		kind: "wallet_add_signer_finalize_replay_v1",
+		addSignerCeremonyId,
+		idempotencyKey,
+		request,
+		response,
+		createdAtMs,
+		expiresAtMs
+	};
+}
+function parseStoredWalletAddSignerFinalizeRequest(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	const record = value;
+	const addSignerCeremonyId = trimString(record.addSignerCeremonyId);
+	const idempotencyKey = trimString(record.idempotencyKey);
+	if (!addSignerCeremonyId || !idempotencyKey) return null;
+	if (record.kind === "near_ed25519") {
+		if (record.custodyKeySet === null || typeof record.custodyKeySet !== "object" || Array.isArray(record.custodyKeySet) || record.activationReference === null || typeof record.activationReference !== "object" || Array.isArray(record.activationReference)) return null;
+		const custodyKeySet = record.custodyKeySet;
+		const activationReference = record.activationReference;
+		const lifecycleId = trimString(activationReference.lifecycleId);
+		const sessionId = parseStoredBytes32(activationReference.sessionId);
+		if (custodyKeySet.kind !== "near_ed25519_v1" || !lifecycleId || !sessionId) return null;
+		let keyManifestDigestB64u;
+		try {
+			keyManifestDigestB64u = parseDigestB64u(custodyKeySet.keyManifestDigestB64u);
+		} catch {
+			return null;
+		}
+		const registeredPublicKeyB64u = trimString(custodyKeySet.registeredPublicKeyB64u);
+		if (!registeredPublicKeyB64u) return null;
+		return {
+			kind: "near_ed25519",
+			addSignerCeremonyId,
+			idempotencyKey,
+			custodyKeySet: {
+				kind: "near_ed25519_v1",
+				keyManifestDigestB64u,
+				registeredPublicKeyB64u
+			},
+			activationReference: {
+				lifecycleId,
+				sessionId
+			}
+		};
+	}
+	if (record.kind !== "evm_family_ecdsa" || !Array.isArray(record.expectedKeyHandles) || record.expectedKeyHandles.length !== 1) return null;
+	const expectedKeyHandle = trimString(record.expectedKeyHandles[0]);
+	if (record.custodyKeySet === null || typeof record.custodyKeySet !== "object" || Array.isArray(record.custodyKeySet)) return null;
+	const custodyKeySet = record.custodyKeySet;
+	if (!expectedKeyHandle || custodyKeySet.kind !== "evm_family_ecdsa_v1") return null;
+	let keyManifestDigestB64u;
+	let clientRootPublicKey33B64u;
+	try {
+		keyManifestDigestB64u = parseDigestB64u(custodyKeySet.keyManifestDigestB64u);
+		clientRootPublicKey33B64u = ecdsaClientRootPublicKey33B64uFromString(trimString(custodyKeySet.clientRootPublicKey33B64u));
+	} catch {
+		return null;
+	}
+	return {
+		kind: "evm_family_ecdsa",
+		addSignerCeremonyId,
+		idempotencyKey,
+		custodyKeySet: {
+			kind: "evm_family_ecdsa_v1",
+			keyManifestDigestB64u,
+			clientRootPublicKey33B64u
+		},
+		expectedKeyHandles: [expectedKeyHandle]
+	};
+}
+function parseStoredBytes32(value) {
+	if (!Array.isArray(value) || value.length !== 32) return null;
+	const bytes = [];
+	for (const byte of value) {
+		if (typeof byte !== "number" || !Number.isInteger(byte) || byte < 0 || byte > 255) return null;
+		bytes.push(byte);
+	}
+	return bytes;
+}
+function parseStoredRegistrationSignerPlan(value) {
+	const parsed = normalizeRegistrationSignerPlan(value);
+	if (parsed.ok) return parsed.value;
+	const decoded = parseJsonValue(value);
+	if (decoded === null || typeof decoded !== "object" || Array.isArray(decoded)) return null;
+	const record = decoded;
+	if (record.kind !== "signer_set" || !Array.isArray(record.branches)) return null;
+	const branches = [];
+	const signers = [];
+	for (const rawBranch of record.branches) {
+		const branch = parseStoredRegistrationSignerPlanBranch(rawBranch);
+		if (!branch) return null;
+		branches.push(branch.branch);
+		signers.push(branch.signer);
+	}
+	const recomputed = registrationSignerPlanFromSelection({
+		kind: "signer_set",
+		signers
+	});
+	if (!recomputed.ok) return null;
+	if (!storedRegistrationSignerPlansMatch({
+		kind: "signer_set",
+		branches
+	}, recomputed.value)) return null;
+	return recomputed.value;
+}
+function parseStoredWalletRegistrationPreparedContext(value) {
+	const decoded = parseJsonValue(value);
+	if (decoded === null || typeof decoded !== "object" || Array.isArray(decoded)) return null;
+	const record = decoded;
+	if (record.kind !== "wallet_registration_prepared_context_v1" || record.runtimePolicy === null || typeof record.runtimePolicy !== "object" || Array.isArray(record.runtimePolicy) || record.ecdsa === null || typeof record.ecdsa !== "object" || Array.isArray(record.ecdsa)) return null;
+	const signingRootId = trimString(record.signingRootId);
+	const signingRootVersion = trimString(record.signingRootVersion);
+	if (!signingRootId || !signingRootVersion) return null;
+	const runtimePolicy = parseStoredWalletRegistrationRuntimePolicyContext(record.runtimePolicy);
+	const ecdsa = parseStoredWalletRegistrationEcdsaPreparedContext(record.ecdsa);
+	if (!runtimePolicy || !ecdsa) return null;
+	return {
+		kind: "wallet_registration_prepared_context_v1",
+		signingRootId,
+		signingRootVersion,
+		runtimePolicy,
+		ecdsa
+	};
+}
+function parseStoredWalletRegistrationRuntimePolicyContext(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	const record = value;
+	switch (record.kind) {
+		case "runtime_policy_scope": {
+			const scope = parseStoredRuntimePolicyScope(record.scope);
+			return scope ? {
+				kind: "runtime_policy_scope",
+				scope
+			} : null;
+		}
+		case "signing_root_only": return record.scope !== void 0 ? null : { kind: "signing_root_only" };
+		default: return null;
+	}
+}
+function parseStoredRuntimePolicyScope(value) {
+	const scope = parseStoredAddAuthMethodRuntimePolicyScope(value);
+	if (!scope?.signingRootVersion) return null;
+	return {
+		orgId: scope.orgId,
+		projectId: scope.projectId,
+		envId: scope.envId,
+		signingRootVersion: scope.signingRootVersion
+	};
+}
+function parseStoredWalletRegistrationEcdsaPreparedContext(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	const record = value;
+	switch (record.kind) {
+		case "evm_family_ecdsa_requested": {
+			if (!Array.isArray(record.chainTargets) || record.chainTargets.length === 0) return null;
+			const chainTargets = [];
+			for (const rawTarget of record.chainTargets) {
+				const chainTarget = thresholdEcdsaChainTargetFromValue(rawTarget);
+				if (!chainTarget) return null;
+				chainTargets.push(chainTarget);
+			}
+			return {
+				kind: "evm_family_ecdsa_requested",
+				chainTargets
+			};
+		}
+		case "evm_family_ecdsa_absent": return record.chainTargets !== void 0 ? null : { kind: "evm_family_ecdsa_absent" };
+		default: return null;
+	}
+}
+function parseStoredRegistrationSignerPlanBranch(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	const record = value;
+	let signerCandidate;
+	switch (record.kind) {
+		case "near_ed25519":
+			signerCandidate = {
+				kind: "near_ed25519",
+				accountProvisioning: record.accountProvisioning,
+				signerSlot: Number(record.signerSlot),
+				participantIds: Array.isArray(record.participantIds) ? [...record.participantIds] : [],
+				derivationVersion: Number(record.derivationVersion)
+			};
+			break;
+		case "evm_family_ecdsa":
+			signerCandidate = {
+				kind: "evm_family_ecdsa",
+				participantIds: Array.isArray(record.participantIds) ? [...record.participantIds] : [],
+				chainTargets: Array.isArray(record.chainTargets) ? [...record.chainTargets] : []
+			};
+			break;
+		default: return null;
+	}
+	let singleBranchPlan;
+	try {
+		singleBranchPlan = normalizeRegistrationSignerPlan({
+			kind: "signer_set",
+			signers: [signerCandidate]
+		});
+	} catch {
+		return null;
+	}
+	if (!singleBranchPlan.ok || singleBranchPlan.value.branches.length !== 1) return null;
+	const branch = singleBranchPlan.value.branches[0];
+	if (!branch || trimString(record.branchKey) !== branch.branchKey) return null;
+	switch (branch.kind) {
+		case "near_ed25519":
+			if (trimString(record.keyPurpose) !== branch.keyPurpose || trimString(record.keyVersion) !== branch.keyVersion || record.chainTargets !== void 0) return null;
+			return {
+				branch,
+				signer: {
+					kind: "near_ed25519",
+					accountProvisioning: branch.accountProvisioning,
+					signerSlot: branch.signerSlot,
+					participantIds: [...branch.participantIds],
+					derivationVersion: branch.derivationVersion
+				}
+			};
+		case "evm_family_ecdsa":
+			if (record.accountProvisioning !== void 0 || record.signerSlot !== void 0 || record.keyPurpose !== void 0 || record.keyVersion !== void 0 || record.derivationVersion !== void 0) return null;
+			return {
+				branch,
+				signer: {
+					kind: "evm_family_ecdsa",
+					participantIds: [...branch.participantIds],
+					chainTargets: [...branch.chainTargets]
+				}
+			};
+		default: return assertNever(branch);
+	}
+}
+function storedRegistrationSignerPlansMatch(left, right) {
+	if (left.kind !== right.kind || left.branches.length !== right.branches.length) return false;
+	for (let index = 0; index < left.branches.length; index += 1) {
+		const rightBranch = right.branches[index];
+		if (!rightBranch || !storedRegistrationSignerPlanBranchesMatch(left.branches[index], rightBranch)) return false;
+	}
+	return true;
+}
+function storedRegistrationSignerPlanBranchesMatch(left, right) {
+	if (left.kind !== right.kind || left.branchKey !== right.branchKey || !storedRegistrationNumberArraysMatch(left.participantIds, right.participantIds)) return false;
+	switch (left.kind) {
+		case "near_ed25519": return right.kind === "near_ed25519" && sameStoredRegistrationNearAccountProvisioning(left.accountProvisioning, right.accountProvisioning) && left.signerSlot === right.signerSlot && left.keyPurpose === right.keyPurpose && left.keyVersion === right.keyVersion && left.derivationVersion === right.derivationVersion;
+		case "evm_family_ecdsa": return right.kind === "evm_family_ecdsa" && left.chainTargets.length === right.chainTargets.length;
+		default: return assertNeverStoredRegistrationSignerPlanBranch(left);
+	}
+}
+function storedRegistrationNumberArraysMatch(left, right) {
+	if (left.length !== right.length) return false;
+	for (let index = 0; index < left.length; index += 1) if (left[index] !== right[index]) return false;
+	return true;
+}
+function sameStoredRegistrationNearAccountProvisioning(left, right) {
+	if (left.kind !== right.kind) return false;
+	switch (left.kind) {
+		case "implicit_account": return right.kind === "implicit_account" && left.accountIdSource === right.accountIdSource;
+		case "sponsored_named_account": return right.kind === "sponsored_named_account" && left.requestedAccountId === right.requestedAccountId && left.sponsor === right.sponsor;
+		default: return assertNeverStoredRegistrationNearAccountProvisioning(left);
+	}
+}
+function assertNeverStoredRegistrationSignerPlanBranch(branch) {
+	throw new Error(`Unexpected stored registration signer plan branch: ${String(branch)}`);
+}
+function assertNeverStoredRegistrationNearAccountProvisioning(provisioning) {
+	throw new Error(`Unexpected stored registration account provisioning: ${String(provisioning)}`);
+}
+function parseStoredAddSignerIntent(value) {
+	const decoded = parseJsonValue(value);
+	if (decoded === null || typeof decoded !== "object" || Array.isArray(decoded)) return null;
+	const record = decoded;
+	if (record.kind !== "add_signer_intent_allocated") return null;
+	const grant = trimString(record.grant);
+	const digestB64u = trimString(record.digestB64u);
+	const orgId = trimString(record.orgId);
+	const expiresAtMs = Number(record.expiresAtMs);
+	if (!grant || !digestB64u || !orgId || !Number.isSafeInteger(expiresAtMs)) return null;
+	if (record.intent === null || typeof record.intent !== "object" || Array.isArray(record.intent)) return null;
+	const intent = record.intent;
+	if (intent.version !== "add_signer_intent_v1") return null;
+	const walletId = parseWalletId(intent.walletId);
+	const signerSelection = normalizeAddSignerSelection(intent.signerSelection, { normalizeEcdsaChainTarget: thresholdEcdsaChainTargetFromValue });
+	const nonceB64u = trimString(intent.nonceB64u);
+	if (!walletId.ok || !signerSelection.ok || !nonceB64u) return null;
+	const runtimePolicyScope = Object.prototype.hasOwnProperty.call(intent, "runtimePolicyScope") ? parseStoredAddAuthMethodRuntimePolicyScope(intent.runtimePolicyScope) : void 0;
+	if (Object.prototype.hasOwnProperty.call(intent, "runtimePolicyScope") && !runtimePolicyScope) return null;
+	const parsedIntent = runtimePolicyScope ? {
+		version: "add_signer_intent_v1",
+		walletId: walletId.value,
+		signerSelection: signerSelection.value,
+		runtimePolicyScope,
+		nonceB64u
+	} : {
+		version: "add_signer_intent_v1",
+		walletId: walletId.value,
+		signerSelection: signerSelection.value,
+		nonceB64u
+	};
+	return {
+		kind: "add_signer_intent_allocated",
+		grant: addSignerIntentGrantFromString(grant),
+		intent: parsedIntent,
+		digestB64u,
+		orgId,
+		expiresAtMs,
+		...trimString(record.signingRootId) ? { signingRootId: trimString(record.signingRootId) } : {},
+		...trimString(record.signingRootVersion) ? { signingRootVersion: trimString(record.signingRootVersion) } : {},
+		...trimString(record.expectedOrigin) ? { expectedOrigin: trimString(record.expectedOrigin) } : {}
+	};
+}
+function parseStoredAddAuthMethodIntent(value) {
+	const decoded = parseJsonValue(value);
+	if (decoded === null || typeof decoded !== "object" || Array.isArray(decoded)) return null;
+	const record = decoded;
+	if (record.kind !== "add_auth_method_intent_allocated") return null;
+	const grant = trimString(record.grant);
+	const digestB64u = trimString(record.digestB64u);
+	const orgId = trimString(record.orgId);
+	const expiresAtMs = Number(record.expiresAtMs);
+	if (!grant || !digestB64u || !orgId || !Number.isSafeInteger(expiresAtMs)) return null;
+	if (record.intent === null || typeof record.intent !== "object" || Array.isArray(record.intent)) return null;
+	const intent = record.intent;
+	const walletId = parseWalletId(intent.walletId);
+	const authMethod = normalizeAddAuthMethodInput(intent.authMethod);
+	const targetWalletAuthMethodId = parseWalletAuthMethodId(intent.targetWalletAuthMethodId);
+	const caller = normalizeAddAuthMethodIntentCaller(intent);
+	const nonceB64u = trimString(intent.nonceB64u);
+	if (intent.version !== "add_auth_method_intent_v1" || !walletId.ok || !authMethod || !targetWalletAuthMethodId.ok || !caller || !nonceB64u) return null;
+	const runtimePolicyScope = Object.prototype.hasOwnProperty.call(intent, "runtimePolicyScope") ? parseStoredAddAuthMethodRuntimePolicyScope(intent.runtimePolicyScope) : void 0;
+	if (Object.prototype.hasOwnProperty.call(intent, "runtimePolicyScope") && !runtimePolicyScope) return null;
+	const parsedIntent = caller.caller === "same_device_addition" ? {
+		version: "add_auth_method_intent_v1",
+		walletId: walletId.value,
+		authMethod,
+		targetWalletAuthMethodId: targetWalletAuthMethodId.value,
+		...runtimePolicyScope ? { runtimePolicyScope } : {},
+		nonceB64u,
+		caller: "same_device_addition",
+		source: caller.source
+	} : {
+		version: "add_auth_method_intent_v1",
+		walletId: walletId.value,
+		authMethod,
+		targetWalletAuthMethodId: targetWalletAuthMethodId.value,
+		...runtimePolicyScope ? { runtimePolicyScope } : {},
+		nonceB64u,
+		caller: "linked_device_ceremony"
+	};
+	return {
+		kind: "add_auth_method_intent_allocated",
+		grant: addAuthMethodIntentGrantFromString(grant),
+		intent: parsedIntent,
+		digestB64u,
+		orgId,
+		expiresAtMs,
+		...trimString(record.signingRootId) ? { signingRootId: trimString(record.signingRootId) } : {},
+		...trimString(record.signingRootVersion) ? { signingRootVersion: trimString(record.signingRootVersion) } : {},
+		...trimString(record.expectedOrigin) ? { expectedOrigin: trimString(record.expectedOrigin) } : {}
+	};
+}
+function parseStoredAddAuthMethodRuntimePolicyScope(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	const record = value;
+	const orgId = trimString(record.orgId);
+	const projectId = trimString(record.projectId);
+	const envId = trimString(record.envId);
+	const signingRootVersion = trimString(record.signingRootVersion);
+	if (!orgId || !projectId || !envId) return null;
+	if (record.signingRootVersion !== void 0 && !signingRootVersion) return null;
+	return signingRootVersion ? {
+		orgId,
+		projectId,
+		envId,
+		signingRootVersion
+	} : {
+		orgId,
+		projectId,
+		envId
+	};
+}
+function parseStoredRegistrationAuthority(value) {
+	const decoded = parseJsonValue(value);
+	if (decoded === null || typeof decoded !== "object" || Array.isArray(decoded)) return null;
+	const record = decoded;
+	const walletId = parseWalletId(record.walletId);
+	const registrationIntentDigestB64u = trimString(record.registrationIntentDigestB64u);
+	if (!walletId.ok || !registrationIntentDigestB64u) return null;
+	switch (record.kind) {
+		case "passkey": {
+			if (record.emailHashHex !== void 0 || record.challengeId !== void 0) return null;
+			const rpId = parseWebAuthnRpId(record.rpId);
+			const credentialIdB64u = parseWebAuthnCredentialIdB64u(record.credentialIdB64u);
+			const credentialPublicKeyB64u = trimString(record.credentialPublicKeyB64u);
+			const counter = Number(record.counter);
+			const device = parseWebAuthnAuthenticatorDeviceInfo(record.device);
+			if (!rpId.ok || !credentialIdB64u.ok || !credentialPublicKeyB64u || !Number.isSafeInteger(counter) || counter < 0 || !device) return null;
+			return {
+				kind: "passkey",
+				walletId: walletId.value,
+				rpId: rpId.value,
+				credentialIdB64u: credentialIdB64u.value,
+				credentialPublicKeyB64u,
+				counter,
+				device,
+				registrationIntentDigestB64u
+			};
+		}
+		case "email_otp": {
+			if (record.rpId !== void 0 || record.credentialIdB64u !== void 0 || record.credentialPublicKeyB64u !== void 0 || record.counter !== void 0) return null;
+			const emailHashHex = trimString(record.emailHashHex);
+			const proofKind = trimString(record.proofKind);
+			const providerSubject = parseProviderSubject(record.providerSubject);
+			const email = trimString(record.email).toLowerCase();
+			const finalWalletId = parseWalletId(record.finalWalletId);
+			const orgId = parseOrgId(record.orgId);
+			const ownerProofBindingDigest = trimString(record.ownerProofBindingDigest);
+			if (!providerSubject.ok || !email || !emailHashHex || !finalWalletId.ok || !orgId.ok || !ownerProofBindingDigest) return null;
+			if (proofKind === "otp_challenge") {
+				const parsedChallengeId = parseEmailOtpChallengeId(record.challengeId);
+				const registrationAuthorityId = parseEmailOtpChallengeId(record.registrationAuthorityId);
+				const challengeSubjectId = parseChallengeSubjectId(record.challengeSubjectId);
+				const originalWalletId = parseWalletId(record.originalWalletId);
+				const challengePurpose = record.challengePurpose === "registration" || record.challengePurpose === "registration_reroll" ? record.challengePurpose : null;
+				if (!challengeSubjectId.ok || !parsedChallengeId.ok || !registrationAuthorityId.ok || parsedChallengeId.value !== registrationAuthorityId.value || !originalWalletId.ok || !challengePurpose) return null;
+				return {
+					kind: "email_otp",
+					proofKind: "otp_challenge",
+					walletId: walletId.value,
+					providerSubject: providerSubject.value,
+					challengeSubjectId: challengeSubjectId.value,
+					email,
+					emailHashHex,
+					challengeId: parsedChallengeId.value,
+					registrationAuthorityId: registrationAuthorityId.value,
+					originalWalletId: originalWalletId.value,
+					finalWalletId: finalWalletId.value,
+					orgId: orgId.value,
+					ownerProofBindingDigest,
+					challengePurpose,
+					registrationIntentDigestB64u
+				};
+			}
+			if (proofKind === "google_sso_registration") {
+				const registrationAttemptId = trimString(record.googleEmailOtpRegistrationAttemptId);
+				const registrationOfferId = trimString(record.googleEmailOtpRegistrationOfferId);
+				const registrationCandidateId = trimString(record.googleEmailOtpRegistrationCandidateId);
+				const registrationAuthorityId = trimString(record.registrationAuthorityId);
+				if (!registrationAttemptId || !registrationOfferId || !registrationCandidateId || !registrationAuthorityId || registrationAuthorityId !== registrationAttemptId || record.challengeId !== void 0 || record.challengeSubjectId !== void 0 || record.originalWalletId !== void 0 || record.challengePurpose !== void 0) return null;
+				return {
+					kind: "email_otp",
+					proofKind: "google_sso_registration",
+					walletId: walletId.value,
+					providerSubject: providerSubject.value,
+					email,
+					emailHashHex,
+					googleEmailOtpRegistrationAttemptId: registrationAttemptId,
+					googleEmailOtpRegistrationOfferId: registrationOfferId,
+					googleEmailOtpRegistrationCandidateId: registrationCandidateId,
+					registrationAuthorityId,
+					finalWalletId: finalWalletId.value,
+					orgId: orgId.value,
+					ownerProofBindingDigest,
+					registrationIntentDigestB64u
+				};
+			}
+			return null;
+		}
+	}
+	return null;
+}
+function parseStoredRegistrationIntent(value) {
+	const decoded = parseJsonValue(value);
+	if (decoded === null || typeof decoded !== "object" || Array.isArray(decoded)) return null;
+	const record = decoded;
+	if (record.version !== "registration_intent_v1") return null;
+	const walletId = parseWalletId(record.walletId);
+	const authMethod = normalizeRegistrationAuthMethodInput(record.authMethod);
+	const signerPlan = parseStoredRegistrationSignerPlan(record.signerSelection);
+	const foundingWalletAuthMethodId = parseWalletAuthMethodId(record.foundingWalletAuthMethodId);
+	const nonceB64u = trimString(record.nonceB64u);
+	if (!walletId.ok || !authMethod || !signerPlan || !foundingWalletAuthMethodId.ok || !nonceB64u) return null;
+	const signerSelection = registrationSignerSetSelectionFromPlan(signerPlan, { normalizeEcdsaChainTarget: thresholdEcdsaChainTargetFromValue });
+	if (!signerSelection.ok) return null;
+	const runtimePolicyScope = Object.prototype.hasOwnProperty.call(record, "runtimePolicyScope") ? parseStoredAddAuthMethodRuntimePolicyScope(record.runtimePolicyScope) : void 0;
+	if (Object.prototype.hasOwnProperty.call(record, "runtimePolicyScope") && !runtimePolicyScope) return null;
+	return runtimePolicyScope ? {
+		version: "registration_intent_v1",
+		walletId: walletId.value,
+		authMethod,
+		signerSelection: signerSelection.value,
+		foundingWalletAuthMethodId: foundingWalletAuthMethodId.value,
+		runtimePolicyScope,
+		nonceB64u
+	} : {
+		version: "registration_intent_v1",
+		walletId: walletId.value,
+		authMethod,
+		signerSelection: signerSelection.value,
+		foundingWalletAuthMethodId: foundingWalletAuthMethodId.value,
+		nonceB64u
+	};
+}
+function parseStoredRegistrationSignerBranchKey(value) {
+	const branchKey = trimString(value);
+	if (!branchKey) return null;
+	try {
+		return registrationSignerBranchKeyFromString(branchKey);
+	} catch {
+		return null;
+	}
+}
+function parseStoredRegistrationEcdsaChainTargets(value) {
+	if (!Array.isArray(value) || value.length === 0) return null;
+	const chainTargets = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const rawTarget of value) {
+		const chainTarget = thresholdEcdsaChainTargetFromValue(rawTarget);
+		if (!chainTarget) return null;
+		const key = thresholdEcdsaChainTargetKey(chainTarget);
+		if (seen.has(key)) return null;
+		seen.add(key);
+		chainTargets.push(chainTarget);
+	}
+	const first = chainTargets[0];
+	return first ? [first, ...chainTargets.slice(1)] : null;
+}
+function parseStoredRegistrationEcdsaParticipantPair(value) {
+	if (!Array.isArray(value) || value.length !== 2 || value[0] !== 1 || value[1] !== 2) return null;
+	return [1, 2];
+}
+function parseStoredWalletRegistrationEcdsaPrepare(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	const record = value;
+	if (record.formatVersion !== "ecdsa-derivation-role-local") return null;
+	const walletId = trimString(record.walletId);
+	const evmFamilySigningKeySlotId = trimString(record.evmFamilySigningKeySlotId);
+	const ecdsaThresholdKeyId = trimString(record.ecdsaThresholdKeyId);
+	const signingRootId = trimString(record.signingRootId);
+	const signingRootVersion = trimString(record.signingRootVersion);
+	const relayerKeyId = trimString(record.relayerKeyId);
+	const registrationPreparationId = trimString(record.registrationPreparationId);
+	const requestId = trimString(record.requestId);
+	const thresholdSessionId = trimString(record.thresholdSessionId);
+	const ttlMs = Number(record.ttlMs);
+	const remainingUses = Number(record.remainingUses);
+	const participantIds = parseStoredRegistrationEcdsaParticipantPair(record.participantIds);
+	const runtimePolicyScope = parseStoredRuntimePolicyScope(record.runtimePolicyScope);
+	if (!walletId || !evmFamilySigningKeySlotId || !ecdsaThresholdKeyId || !signingRootId || !signingRootVersion || record.keyScope !== "evm-family" || !relayerKeyId || !registrationPreparationId || !requestId || !thresholdSessionId || !Number.isSafeInteger(ttlMs) || !Number.isSafeInteger(remainingUses) || !participantIds || !runtimePolicyScope) return null;
+	try {
+		return {
+			formatVersion: "ecdsa-derivation-role-local",
+			walletId,
+			evmFamilySigningKeySlotId,
+			ecdsaThresholdKeyId,
+			signingRootId,
+			signingRootVersion,
+			keyScope: "evm-family",
+			relayerKeyId,
+			registrationPreparationId: registrationPreparationIdFromString(registrationPreparationId),
+			requestId,
+			thresholdSessionId,
+			ttlMs,
+			remainingUses,
+			participantIds,
+			runtimePolicyScope
+		};
+	} catch {
+		return null;
+	}
+}
+function parseStoredEcdsaDerivationPublicIdentity(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	const record = value;
+	const derivationClientSharePublicKey33B64u = trimString(record.derivationClientSharePublicKey33B64u);
+	const relayerPublicKey33B64u = trimString(record.relayerPublicKey33B64u);
+	const groupPublicKey33B64u = trimString(record.groupPublicKey33B64u);
+	const ethereumAddress = trimString(record.ethereumAddress);
+	if (!derivationClientSharePublicKey33B64u || !relayerPublicKey33B64u || !groupPublicKey33B64u || !ethereumAddress) return null;
+	return parseEcdsaDerivationPublicIdentity({
+		derivationClientSharePublicKey33B64u,
+		relayerPublicKey33B64u,
+		groupPublicKey33B64u,
+		ethereumAddress
+	});
+}
+function parseStoredEcdsaDerivationServerBootstrapResponse(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	const record = value;
+	if (record.formatVersion !== "ecdsa-derivation-role-local") return null;
+	const publicIdentity = parseStoredEcdsaDerivationPublicIdentity(record.publicIdentity);
+	const walletId = trimString(record.walletId);
+	const evmFamilySigningKeySlotId = trimString(record.evmFamilySigningKeySlotId);
+	const ecdsaThresholdKeyId = trimString(record.ecdsaThresholdKeyId);
+	const relayerKeyId = trimString(record.relayerKeyId);
+	const applicationBindingDigestB64u = trimString(record.applicationBindingDigestB64u);
+	const contextBinding32B64u = trimString(record.contextBinding32B64u);
+	const clientShareRetryCounter = Number(record.clientShareRetryCounter);
+	const relayerShareRetryCounter = Number(record.relayerShareRetryCounter);
+	const publicTranscriptDigest32B64u = trimString(record.publicTranscriptDigest32B64u);
+	const keyHandle = trimString(record.keyHandle);
+	const signingRootId = trimString(record.signingRootId);
+	const signingRootVersion = trimString(record.signingRootVersion);
+	const thresholdEcdsaPublicKeyB64u = trimString(record.thresholdEcdsaPublicKeyB64u);
+	const ethereumAddress = trimString(record.ethereumAddress);
+	const relayerVerifyingShareB64u = trimString(record.relayerVerifyingShareB64u);
+	const participantIds = parseStoredRegistrationEcdsaParticipantPair(record.participantIds);
+	const thresholdSessionId = trimString(record.thresholdSessionId);
+	const activationEpoch = parseRootShareEpoch(record.activationEpoch);
+	const expiresAtMs = Number(record.expiresAtMs);
+	const expiresAt = trimString(record.expiresAt);
+	const remainingUses = Number(record.remainingUses);
+	let routerAbEcdsaDerivationNormalSigning;
+	try {
+		routerAbEcdsaDerivationNormalSigning = parseRouterAbEcdsaDerivationNormalSigningStateV1(record.routerAbEcdsaDerivationNormalSigning);
+	} catch {
+		return null;
+	}
+	if (!walletId || !evmFamilySigningKeySlotId || !ecdsaThresholdKeyId || !relayerKeyId || !applicationBindingDigestB64u || !contextBinding32B64u || !publicIdentity || !Number.isSafeInteger(clientShareRetryCounter) || clientShareRetryCounter < 0 || !Number.isSafeInteger(relayerShareRetryCounter) || relayerShareRetryCounter < 0 || !publicTranscriptDigest32B64u || !keyHandle || !signingRootId || !signingRootVersion || !thresholdEcdsaPublicKeyB64u || !ethereumAddress || !relayerVerifyingShareB64u || !participantIds || !thresholdSessionId || !activationEpoch.ok || !Number.isSafeInteger(expiresAtMs) || !expiresAt || !Number.isSafeInteger(remainingUses) || remainingUses < 0 || !routerAbEcdsaDerivationNormalSigning) return null;
+	return {
+		formatVersion: "ecdsa-derivation-role-local",
+		walletId,
+		evmFamilySigningKeySlotId,
+		ecdsaThresholdKeyId,
+		relayerKeyId,
+		applicationBindingDigestB64u,
+		contextBinding32B64u,
+		publicIdentity,
+		clientShareRetryCounter,
+		relayerShareRetryCounter,
+		publicTranscriptDigest32B64u,
+		keyHandle,
+		signingRootId,
+		signingRootVersion,
+		thresholdEcdsaPublicKeyB64u,
+		ethereumAddress,
+		relayerVerifyingShareB64u,
+		participantIds: [1, 2],
+		thresholdSessionId,
+		activationEpoch: activationEpoch.value,
+		expiresAtMs,
+		expiresAt,
+		remainingUses,
+		routerAbEcdsaDerivationNormalSigning
+	};
+}
+function parseStoredWalletRegistrationEcdsaBranchBase(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	const record = value;
+	const branchKey = parseStoredRegistrationSignerBranchKey(record.branchKey);
+	const chainTargets = parseStoredRegistrationEcdsaChainTargets(record.chainTargets);
+	const prepare = parseStoredWalletRegistrationEcdsaPrepare(record.prepare);
+	const strictRegistrationBindingJson = trimString(record.strictRegistrationBindingJson);
+	if (!branchKey || record.derivationKind !== "evm_family_ecdsa_keygen" || !chainTargets || !prepare || !strictRegistrationBindingJson) return null;
+	let strictRegistration;
+	try {
+		strictRegistration = parseRouterAbEcdsaRegistrationRequestFactsV1(record.strictRegistration);
+	} catch {
+		return null;
+	}
+	return strictRegistration.registration_purpose === "wallet_registration" ? {
+		branchKey,
+		derivationKind: "evm_family_ecdsa_keygen",
+		chainTargets,
+		prepare,
+		strictRegistration,
+		strictRegistrationBindingJson
+	} : null;
+}
+function parseStoredWalletRegistrationSignerBranch(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	const record = value;
+	switch (record.kind) {
+		case "near_ed25519_yao_authorized": {
+			const branchKey = parseStoredRegistrationSignerBranchKey(record.branchKey);
+			const admissionRequest = parseRouterAbEd25519YaoRegistrationAdmissionRequestV1(record.admissionRequest);
+			const admissionReceipt = parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1(record.admissionReceipt);
+			return branchKey && admissionRequest.ok && admissionReceipt.ok ? {
+				kind: "near_ed25519_yao_authorized",
+				branchKey,
+				admissionRequest: admissionRequest.value,
+				admissionReceipt: admissionReceipt.value
+			} : null;
+		}
+		case "evm_family_ecdsa_prepared": {
+			const base = parseStoredWalletRegistrationEcdsaBranchBase(record);
+			return base ? {
+				kind: "evm_family_ecdsa_prepared",
+				branchKey: base.branchKey,
+				derivationKind: base.derivationKind,
+				chainTargets: base.chainTargets,
+				prepare: base.prepare,
+				strictRegistration: base.strictRegistration,
+				strictRegistrationBindingJson: base.strictRegistrationBindingJson
+			} : null;
+		}
+		case "evm_family_ecdsa_response_claimed": {
+			const base = parseStoredWalletRegistrationEcdsaBranchBase(record);
+			if (!base) return null;
+			try {
+				const registrationRequest = parseRouterAbEcdsaRegistrationRequestV1(record.registrationRequest);
+				return registrationRequest.registration_purpose === "wallet_registration" ? {
+					kind: "evm_family_ecdsa_response_claimed",
+					branchKey: base.branchKey,
+					derivationKind: base.derivationKind,
+					chainTargets: base.chainTargets,
+					prepare: base.prepare,
+					strictRegistration: base.strictRegistration,
+					strictRegistrationBindingJson: base.strictRegistrationBindingJson,
+					registrationRequest
+				} : null;
+			} catch {
+				return null;
+			}
+		}
+		case "evm_family_ecdsa_pending_activation": {
+			const base = parseStoredWalletRegistrationEcdsaBranchBase(record);
+			if (!base) return null;
+			try {
+				const registrationRequest = parseRouterAbEcdsaRegistrationRequestV1(record.registrationRequest);
+				const pendingActivation = parseStoredRouterAbEcdsaPendingActivationV1(record.pendingActivation);
+				const publicResponse = parseRouterAbEcdsaStrictForwardedRegistrationResponseV1(record.publicResponse);
+				return registrationRequest.registration_purpose === "wallet_registration" ? {
+					kind: "evm_family_ecdsa_pending_activation",
+					branchKey: base.branchKey,
+					derivationKind: base.derivationKind,
+					chainTargets: base.chainTargets,
+					prepare: base.prepare,
+					strictRegistration: base.strictRegistration,
+					strictRegistrationBindingJson: base.strictRegistrationBindingJson,
+					registrationRequest,
+					pendingActivation,
+					publicResponse
+				} : null;
+			} catch {
+				return null;
+			}
+		}
+		case "evm_family_ecdsa_activation_claimed": {
+			const base = parseStoredWalletRegistrationEcdsaBranchBase(record);
+			const activationRequestDigestB64u = parseStoredRegistrationDigest(record.activationRequestDigestB64u);
+			const activationOwner = trimString(record.activationOwner);
+			if (!base || !activationRequestDigestB64u || !activationOwner) return null;
+			try {
+				const registrationRequest = parseRouterAbEcdsaRegistrationRequestV1(record.registrationRequest);
+				const pendingActivation = parseStoredRouterAbEcdsaPendingActivationV1(record.pendingActivation);
+				const publicResponse = parseRouterAbEcdsaStrictForwardedRegistrationResponseV1(record.publicResponse);
+				const publicFacts = parseRouterAbEcdsaVerifiedClientActivationFactsV1(record.publicFacts);
+				return registrationRequest.registration_purpose === "wallet_registration" ? {
+					kind: "evm_family_ecdsa_activation_claimed",
+					branchKey: base.branchKey,
+					derivationKind: base.derivationKind,
+					chainTargets: base.chainTargets,
+					prepare: base.prepare,
+					strictRegistration: base.strictRegistration,
+					strictRegistrationBindingJson: base.strictRegistrationBindingJson,
+					registrationRequest,
+					pendingActivation,
+					publicResponse,
+					publicFacts,
+					activationRequestDigestB64u,
+					activationOwner
+				} : null;
+			} catch {
+				return null;
+			}
+		}
+		case "evm_family_ecdsa_activated":
+		case "evm_family_ecdsa_finalized": {
+			const base = parseStoredWalletRegistrationEcdsaBranchBase(record);
+			const bootstrap = parseStoredEcdsaDerivationServerBootstrapResponse(record.bootstrap);
+			if (!base || !bootstrap) return null;
+			try {
+				const registrationRequest = parseRouterAbEcdsaRegistrationRequestV1(record.registrationRequest);
+				const publicFacts = parseRouterAbEcdsaVerifiedClientActivationFactsV1(record.publicFacts);
+				const activation = parseRouterAbEcdsaRegistrationActivationReceiptV1(record.activation);
+				const publicCapability = parseRouterAbEcdsaDerivationPublicCapabilityV1(record.publicCapability);
+				if (registrationRequest.registration_purpose !== "wallet_registration") return null;
+				if (record.kind === "evm_family_ecdsa_activated") {
+					const activationOwner = trimString(record.activationOwner);
+					return activationOwner ? {
+						kind: "evm_family_ecdsa_activated",
+						branchKey: base.branchKey,
+						derivationKind: base.derivationKind,
+						chainTargets: base.chainTargets,
+						prepare: base.prepare,
+						strictRegistration: base.strictRegistration,
+						strictRegistrationBindingJson: base.strictRegistrationBindingJson,
+						registrationRequest,
+						publicFacts,
+						activation,
+						publicCapability,
+						bootstrap,
+						activationOwner
+					} : null;
+				}
+				const finalizedAtMs = Number(record.finalizedAtMs);
+				return Number.isSafeInteger(finalizedAtMs) && finalizedAtMs > 0 ? {
+					kind: "evm_family_ecdsa_finalized",
+					branchKey: base.branchKey,
+					derivationKind: base.derivationKind,
+					chainTargets: base.chainTargets,
+					prepare: base.prepare,
+					strictRegistration: base.strictRegistration,
+					strictRegistrationBindingJson: base.strictRegistrationBindingJson,
+					registrationRequest,
+					publicFacts,
+					activation,
+					publicCapability,
+					bootstrap,
+					finalizedAtMs
+				} : null;
+			} catch {
+				return null;
+			}
+		}
+		default: return null;
+	}
+}
+function parseStoredWalletRegistrationSignerState(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	const record = value;
+	if (record.kind === "signer_set_registration") {
+		if (!Array.isArray(record.branches)) return null;
+		const branches = [];
+		for (const rawBranch of record.branches) {
+			const branch = parseStoredWalletRegistrationSignerBranch(rawBranch);
+			if (!branch) return null;
+			branches.push(branch);
+		}
+		return {
+			kind: "signer_set_registration",
+			branches
+		};
+	}
+	if (record.kind !== "registration_failed") return null;
+	const failedAtMs = Number(record.failedAtMs);
+	if (!Number.isSafeInteger(failedAtMs) || failedAtMs <= 0 || record.failure === null || typeof record.failure !== "object" || Array.isArray(record.failure)) return null;
+	const failure = record.failure;
+	const code = trimString(failure.code);
+	const message = trimString(failure.message);
+	return code && message ? {
+		kind: "registration_failed",
+		failedAtMs,
+		failure: {
+			code,
+			message
+		}
+	} : null;
+}
+function parseStoredRegistrationDigest(value) {
+	try {
+		return parseDigestB64u(value);
+	} catch {
+		return null;
+	}
+}
+function parseStoredWalletRegistrationCeremony(value) {
+	const decoded = parseJsonValue(value);
+	if (decoded === null || typeof decoded !== "object" || Array.isArray(decoded)) return null;
+	const record = decoded;
+	const registrationCeremonyId = trimString(record.registrationCeremonyId);
+	const foundingWalletAuthorityId = parseWalletAuthorityId(record.foundingWalletAuthorityId);
+	const foundingDeviceId = parseDeviceId(record.foundingDeviceId);
+	const foundingWalletAuthMethodId = parseWalletAuthMethodId(record.foundingWalletAuthMethodId);
+	const intent = parseStoredRegistrationIntent(record.intent);
+	const digestB64u = trimString(record.digestB64u);
+	const signerPlan = parseStoredRegistrationSignerPlan(record.signerPlan);
+	const preparedContext = parseStoredWalletRegistrationPreparedContext(record.preparedContext);
+	const orgId = trimString(record.orgId);
+	const signingRootId = trimString(record.signingRootId);
+	const signingRootVersion = trimString(record.signingRootVersion);
+	const expectedOrigin = trimString(record.expectedOrigin);
+	const expiresAtMs = Number(record.expiresAtMs);
+	const authorityState = parseStoredWalletRegistrationCeremonyAuthorityState(record.authorityState);
+	const signerState = parseStoredWalletRegistrationSignerState(record.signerState);
+	const intentSignerPlan = intent ? parseStoredRegistrationSignerPlan(intent.signerSelection) : null;
+	if (!registrationCeremonyId || !authorityState || !foundingWalletAuthorityId.ok || !foundingDeviceId.ok || !foundingWalletAuthMethodId.ok || !intent || !digestB64u || !orgId || !Number.isSafeInteger(expiresAtMs) || !signerPlan || !preparedContext || !intentSignerPlan || !storedRegistrationSignerPlansMatch(signerPlan, intentSignerPlan) || signingRootId && preparedContext.signingRootId !== signingRootId || signingRootVersion && preparedContext.signingRootVersion !== signingRootVersion || !signerState) return null;
+	return {
+		registrationCeremonyId,
+		foundingWalletAuthorityId: foundingWalletAuthorityId.value,
+		foundingDeviceId: foundingDeviceId.value,
+		foundingWalletAuthMethodId: foundingWalletAuthMethodId.value,
+		intent,
+		digestB64u,
+		signerPlan,
+		preparedContext,
+		orgId,
+		...signingRootId ? { signingRootId } : {},
+		...signingRootVersion ? { signingRootVersion } : {},
+		...expectedOrigin ? { expectedOrigin } : {},
+		expiresAtMs,
+		authorityState,
+		signerState
+	};
+}
+function parseStoredWalletRegistrationCeremonyAuthorityState(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	const record = value;
+	switch (record.kind) {
+		case "awaiting_proof": {
+			const authMethod = parseStoredRegistrationCeremonyAuthMethod(record.authMethod);
+			return authMethod ? {
+				kind: "awaiting_proof",
+				authMethod
+			} : null;
+		}
+		case "verified": {
+			const authority = parseStoredRegistrationAuthority(record.authority);
+			return authority ? {
+				kind: "verified",
+				authority
+			} : null;
+		}
+		default: return null;
+	}
+}
+function parseStoredRegistrationCeremonyAuthMethod(value) {
+	return normalizeRegistrationAuthMethodInput(parseJsonValue(value));
+}
+function parseStoredWalletAddSignerAuth(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	const record = value;
+	if (record.kind !== "webauthn_assertion") return null;
+	const rpId = parseWebAuthnRpId(record.rpId);
+	const credentialIdB64u = parseWebAuthnCredentialIdB64u(record.credentialIdB64u);
+	return rpId.ok && credentialIdB64u.ok ? {
+		kind: "webauthn_assertion",
+		rpId: rpId.value,
+		credentialIdB64u: credentialIdB64u.value
+	} : null;
+}
+function parseStoredWalletAddSignerEcdsaStateBase(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	const record = value;
+	const chainTargets = parseStoredRegistrationEcdsaChainTargets(record.chainTargets);
+	const prepare = parseStoredWalletRegistrationEcdsaPrepare(record.prepare);
+	if (record.derivationKind !== "evm_family_ecdsa_keygen" || !chainTargets || !prepare) return null;
+	let strictRegistration;
+	try {
+		strictRegistration = parseRouterAbEcdsaRegistrationRequestFactsV1(record.strictRegistration);
+	} catch {
+		return null;
+	}
+	return strictRegistration.registration_purpose === "wallet_add_signer" ? {
+		derivationKind: "evm_family_ecdsa_keygen",
+		chainTargets,
+		prepare,
+		strictRegistration
+	} : null;
+}
+function parseStoredWalletAddSignerNearActivation(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	const record = value;
+	if (record.finalizeRequest === null || typeof record.finalizeRequest !== "object" || Array.isArray(record.finalizeRequest) || record.activation === null || typeof record.activation !== "object" || Array.isArray(record.activation)) return null;
+	const finalizeRequest = parseStoredWalletAddSignerFinalizeRequest(record.finalizeRequest);
+	const activation = record.activation;
+	const admissionRequest = parseRouterAbEd25519YaoRegistrationAdmissionRequestV1(activation.admissionRequest);
+	const admissionReceipt = parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1(activation.admissionReceipt);
+	const result = parseRouterAbEd25519YaoRegistrationActivationResultV1(activation.result);
+	if (!finalizeRequest || finalizeRequest.kind !== "near_ed25519" || !admissionRequest.ok || !admissionReceipt.ok || !result.ok) return null;
+	const { lifecycleId, sessionId } = finalizeRequest.activationReference;
+	if (lifecycleId !== admissionRequest.value.scope.lifecycle_id || !storedWalletAddSignerByteArraysEqual(sessionId, admissionReceipt.value.binding.session_id) || !storedWalletAddSignerByteArraysEqual(sessionId, result.value.binding.session_id)) return null;
+	return {
+		finalizeRequest,
+		activation: {
+			admissionRequest: admissionRequest.value,
+			admissionReceipt: admissionReceipt.value,
+			result: result.value
+		}
+	};
+}
+function parseStoredWalletAddSignerSignerState(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	const record = value;
+	switch (record.kind) {
+		case "near_ed25519_yao_add_signer_authorized": {
+			const admissionRequest = parseRouterAbEd25519YaoRegistrationAdmissionRequestV1(record.admissionRequest);
+			return admissionRequest.ok ? {
+				kind: "near_ed25519_yao_add_signer_authorized",
+				admissionRequest: admissionRequest.value
+			} : null;
+		}
+		case "near_ed25519_yao_add_signer_activated": {
+			const activation = parseStoredWalletAddSignerNearActivation(record);
+			return activation ? {
+				kind: "near_ed25519_yao_add_signer_activated",
+				finalizeRequest: activation.finalizeRequest,
+				activation: activation.activation
+			} : null;
+		}
+		case "near_ed25519_yao_add_signer_finalizing": {
+			const activation = parseStoredWalletAddSignerNearActivation(record);
+			const response = parseStoredWalletAddSignerFinalizeSuccess(record.response);
+			if (!activation || !response || response.kind !== "near_ed25519") return null;
+			const signer = parseWalletEd25519SignerRecord(record.signer);
+			const finalizingAtMs = Number(record.finalizingAtMs);
+			return signer && Number.isSafeInteger(finalizingAtMs) && finalizingAtMs > 0 ? {
+				kind: "near_ed25519_yao_add_signer_finalizing",
+				finalizeRequest: activation.finalizeRequest,
+				activation: activation.activation,
+				response,
+				signer,
+				finalizingAtMs
+			} : null;
+		}
+		case "ecdsa_add_signer_prepared": {
+			const base = parseStoredWalletAddSignerEcdsaStateBase(record);
+			return base ? {
+				kind: "ecdsa_add_signer_prepared",
+				derivationKind: base.derivationKind,
+				chainTargets: base.chainTargets,
+				prepare: base.prepare,
+				strictRegistration: base.strictRegistration
+			} : null;
+		}
+		case "ecdsa_add_signer_pending_activation": {
+			const base = parseStoredWalletAddSignerEcdsaStateBase(record);
+			if (!base) return null;
+			try {
+				const registrationRequest = parseRouterAbEcdsaRegistrationRequestV1(record.registrationRequest);
+				const pendingActivation = parseStoredRouterAbEcdsaPendingActivationV1(record.pendingActivation);
+				const publicResponse = parseRouterAbEcdsaStrictForwardedRegistrationResponseV1(record.publicResponse);
+				return registrationRequest.registration_purpose === "wallet_add_signer" ? {
+					kind: "ecdsa_add_signer_pending_activation",
+					derivationKind: base.derivationKind,
+					chainTargets: base.chainTargets,
+					prepare: base.prepare,
+					strictRegistration: base.strictRegistration,
+					registrationRequest,
+					pendingActivation,
+					publicResponse
+				} : null;
+			} catch {
+				return null;
+			}
+		}
+		case "ecdsa_add_signer_activation_claimed": {
+			const base = parseStoredWalletAddSignerEcdsaStateBase(record);
+			const activationRequestDigestB64u = parseStoredRegistrationDigest(record.activationRequestDigestB64u);
+			if (!base || !activationRequestDigestB64u) return null;
+			try {
+				const registrationRequest = parseRouterAbEcdsaRegistrationRequestV1(record.registrationRequest);
+				const pendingActivation = parseStoredRouterAbEcdsaPendingActivationV1(record.pendingActivation);
+				const publicResponse = parseRouterAbEcdsaStrictForwardedRegistrationResponseV1(record.publicResponse);
+				const publicFacts = parseRouterAbEcdsaVerifiedClientActivationFactsV1(record.publicFacts);
+				return registrationRequest.registration_purpose === "wallet_add_signer" ? {
+					kind: "ecdsa_add_signer_activation_claimed",
+					derivationKind: base.derivationKind,
+					chainTargets: base.chainTargets,
+					prepare: base.prepare,
+					strictRegistration: base.strictRegistration,
+					registrationRequest,
+					pendingActivation,
+					publicResponse,
+					publicFacts,
+					activationRequestDigestB64u
+				} : null;
+			} catch {
+				return null;
+			}
+		}
+		case "ecdsa_add_signer_activated": {
+			const base = parseStoredWalletAddSignerEcdsaStateBase(record);
+			const activationRequestDigestB64u = parseStoredRegistrationDigest(record.activationRequestDigestB64u);
+			const bootstrap = parseStoredEcdsaDerivationServerBootstrapResponse(record.bootstrap);
+			if (!base || !activationRequestDigestB64u || !bootstrap) return null;
+			try {
+				const registrationRequest = parseRouterAbEcdsaRegistrationRequestV1(record.registrationRequest);
+				const publicFacts = parseRouterAbEcdsaVerifiedClientActivationFactsV1(record.publicFacts);
+				const activation = parseRouterAbEcdsaRegistrationActivationReceiptV1(record.activation);
+				const publicCapability = parseRouterAbEcdsaDerivationPublicCapabilityV1(record.publicCapability);
+				return registrationRequest.registration_purpose === "wallet_add_signer" ? {
+					kind: "ecdsa_add_signer_activated",
+					derivationKind: base.derivationKind,
+					chainTargets: base.chainTargets,
+					prepare: base.prepare,
+					strictRegistration: base.strictRegistration,
+					registrationRequest,
+					publicFacts,
+					activationRequestDigestB64u,
+					activation,
+					publicCapability,
+					bootstrap
+				} : null;
+			} catch {
+				return null;
+			}
+		}
+		default: return null;
+	}
+}
+function storedWalletAddSignerByteArraysEqual(left, right) {
+	return left.length === right.length && left.every((byte, index) => byte === right[index]);
+}
+function parseStoredWalletAddSignerCeremony(value) {
+	const decoded = parseJsonValue(value);
+	if (decoded === null || typeof decoded !== "object" || Array.isArray(decoded)) return null;
+	const record = decoded;
+	const addSignerCeremonyId = trimString(record.addSignerCeremonyId);
+	const digestB64u = trimString(record.digestB64u);
+	const orgId = trimString(record.orgId);
+	const signingRootId = trimString(record.signingRootId);
+	const signingRootVersion = trimString(record.signingRootVersion);
+	const expiresAtMs = Number(record.expiresAtMs);
+	const intentRecord = parseStoredAddSignerIntent({
+		kind: "add_signer_intent_allocated",
+		grant: "ignored",
+		intent: record.intent,
+		digestB64u,
+		orgId,
+		expiresAtMs
+	});
+	const auth = parseStoredWalletAddSignerAuth(record.auth);
+	const signerState = parseStoredWalletAddSignerSignerState(record.signerState);
+	if (!addSignerCeremonyId || !digestB64u || !orgId || !signingRootId || !signingRootVersion || !Number.isSafeInteger(expiresAtMs) || !intentRecord || !auth || !signerState) return null;
+	if ((signerState.kind === "near_ed25519_yao_add_signer_activated" || signerState.kind === "near_ed25519_yao_add_signer_finalizing") && signerState.finalizeRequest.addSignerCeremonyId !== addSignerCeremonyId) return null;
+	return {
+		addSignerCeremonyId,
+		intent: intentRecord.intent,
+		digestB64u,
+		orgId,
+		signingRootId,
+		signingRootVersion,
+		expiresAtMs,
+		auth,
+		signerState
+	};
+}
+function parseStoredWalletAddAuthMethodCeremonyAuth(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	const record = value;
+	if (record.kind === "email_otp") {
+		const providerUserId = trimString(record.providerUserId);
+		const enrollmentId = trimString(record.enrollmentId);
+		const enrollmentSealKeyVersion = trimString(record.enrollmentSealKeyVersion);
+		const authorityRef = parseWalletAuthAuthorityRef(record.authorityRef);
+		if (!providerUserId || !enrollmentId || !enrollmentSealKeyVersion || !authorityRef) return null;
+		return {
+			kind: "email_otp",
+			providerUserId,
+			enrollmentId,
+			enrollmentSealKeyVersion,
+			authorityRef
+		};
+	}
+	if (record.kind === "wallet_session") {
+		const walletSessionId = trimString(record.walletSessionId);
+		const authorizationId = trimString(record.authorizationId);
+		const rpId = trimString(record.rpId);
+		const credentialIdB64u = trimString(record.credentialIdB64u);
+		if (!walletSessionId || !authorizationId || !rpId || !credentialIdB64u) return null;
+		return {
+			kind: "wallet_session",
+			walletSessionId,
+			authorizationId,
+			rpId,
+			credentialIdB64u
+		};
+	}
+	if (record.kind !== "webauthn_assertion") return null;
+	const rpId = trimString(record.rpId);
+	const credentialIdB64u = trimString(record.credentialIdB64u);
+	if (!rpId || !credentialIdB64u) return null;
+	return {
+		kind: "webauthn_assertion",
+		rpId,
+		credentialIdB64u
+	};
+}
+function addAuthMethodCustodyFactorMatches(auth, custodyEnvelope) {
+	switch (auth.kind) {
+		case "webauthn_assertion":
+		case "wallet_session": return custodyEnvelope.factor.kind === "passkey" && custodyEnvelope.factor.rpId === auth.rpId && custodyEnvelope.factor.credentialIdB64u === auth.credentialIdB64u;
+		case "email_otp": return custodyEnvelope.factor.kind === "email_otp" && custodyEnvelope.factor.enrollmentId === auth.enrollmentId && custodyEnvelope.factor.enrollmentSealKeyVersion === auth.enrollmentSealKeyVersion;
+		default: return assertNever(auth);
+	}
+}
+/**
+* Nullable wrapper over the canonical parser. Reading these options a second,
+* looser way here is what would let a stored ceremony and a live one disagree.
+*/
+function parseStoredWalletAddAuthMethodRegistrationOptions(value) {
+	try {
+		return parseWalletAddAuthMethodRegistrationOptions(value);
+	} catch {
+		return null;
+	}
+}
+function parseStoredWalletAddAuthMethodCeremony(value) {
+	const decoded = parseJsonValue(value);
+	if (decoded === null || typeof decoded !== "object" || Array.isArray(decoded)) return null;
+	const record = decoded;
+	const addAuthMethodCeremonyId = trimString(record.addAuthMethodCeremonyId);
+	const digestB64u = trimString(record.digestB64u);
+	const orgId = trimString(record.orgId);
+	const expiresAtMs = Number(record.expiresAtMs);
+	const sourceWalletAuthMethodId = parseWalletAuthMethodId(record.sourceWalletAuthMethodId);
+	const sourceWalletAuthorityId = parseWalletAuthorityId(record.sourceWalletAuthorityId);
+	const targetWalletAuthMethodId = parseWalletAuthMethodId(record.targetWalletAuthMethodId);
+	let sourceAuthorityDigestB64u;
+	try {
+		sourceAuthorityDigestB64u = parseDigestB64u(record.sourceAuthorityDigestB64u);
+	} catch {
+		return null;
+	}
+	const sourceAuthorityRevocationEpoch = Number(record.sourceAuthorityRevocationEpoch);
+	if (!addAuthMethodCeremonyId || !digestB64u || !orgId || !Number.isSafeInteger(expiresAtMs) || !sourceWalletAuthMethodId.ok || !sourceWalletAuthorityId.ok || !Number.isSafeInteger(sourceAuthorityRevocationEpoch) || sourceAuthorityRevocationEpoch < 0 || !targetWalletAuthMethodId.ok) return null;
+	const auth = parseStoredWalletAddAuthMethodCeremonyAuth(record.auth);
+	const intentRecord = parseStoredAddAuthMethodIntent({
+		kind: "add_auth_method_intent_allocated",
+		grant: "ignored",
+		intent: record.intent,
+		digestB64u,
+		orgId,
+		expiresAtMs
+	});
+	if (!auth || !intentRecord) return null;
+	let custodyEnvelope;
+	try {
+		custodyEnvelope = parsePasskeyCustodyEnvelopeRecord(record.custodyEnvelope);
+	} catch {
+		return null;
+	}
+	if (custodyEnvelope.walletId !== intentRecord.intent.walletId || !addAuthMethodCustodyFactorMatches(auth, custodyEnvelope) || custodyEnvelope.lifecycle.state !== "active") return null;
+	const kind = record.kind;
+	if (kind === "email_otp") {
+		const authority = parseStoredRegistrationAuthority(record.authority);
+		if (!authority || authority.kind !== "email_otp") return null;
+		return {
+			kind: "email_otp",
+			custodyEnvelope,
+			addAuthMethodCeremonyId,
+			intent: intentRecord.intent,
+			digestB64u,
+			orgId,
+			sourceWalletAuthMethodId: sourceWalletAuthMethodId.value,
+			sourceWalletAuthorityId: sourceWalletAuthorityId.value,
+			sourceAuthorityDigestB64u,
+			sourceAuthorityRevocationEpoch,
+			targetWalletAuthMethodId: targetWalletAuthMethodId.value,
+			expiresAtMs: Math.floor(expiresAtMs),
+			auth,
+			authority,
+			...trimString(record.expectedOrigin) ? { expectedOrigin: trimString(record.expectedOrigin) } : {}
+		};
+	}
+	if (kind !== "passkey" || record.passkeyRegistration === null || typeof record.passkeyRegistration !== "object" || Array.isArray(record.passkeyRegistration)) return null;
+	const passkeyRegistration = record.passkeyRegistration;
+	const rpId = parseWebAuthnRpId(passkeyRegistration.rpId);
+	const challengeB64u = trimString(passkeyRegistration.challengeB64u);
+	const options = parseStoredWalletAddAuthMethodRegistrationOptions(passkeyRegistration.options);
+	if (!rpId.ok || !challengeB64u || !options || options.rpId !== rpId.value || options.challengeB64u !== challengeB64u || intentRecord.intent.authMethod.kind !== "passkey" || intentRecord.intent.authMethod.rpId !== rpId.value) return null;
+	return {
+		kind: "passkey",
+		addAuthMethodCeremonyId,
+		intent: intentRecord.intent,
+		digestB64u,
+		orgId,
+		sourceWalletAuthMethodId: sourceWalletAuthMethodId.value,
+		sourceWalletAuthorityId: sourceWalletAuthorityId.value,
+		sourceAuthorityDigestB64u,
+		sourceAuthorityRevocationEpoch,
+		targetWalletAuthMethodId: targetWalletAuthMethodId.value,
+		expiresAtMs: Math.floor(expiresAtMs),
+		auth,
+		passkeyRegistration: {
+			rpId: rpId.value,
+			challengeB64u,
+			options
+		},
+		custodyEnvelope,
+		...trimString(record.expectedOrigin) ? { expectedOrigin: trimString(record.expectedOrigin) } : {}
+	};
+}
+function isDurableObjectNamespaceLike(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	return "idFromName" in value && typeof value.idFromName === "function" && "get" in value && typeof value.get === "function";
+}
+function resolveDoNamespaceFromConfig(config) {
+	const direct = config.namespace;
+	if (isDurableObjectNamespaceLike(direct)) return direct;
+	const durableObjectNamespace = config.durableObjectNamespace;
+	if (isDurableObjectNamespaceLike(durableObjectNamespace)) return durableObjectNamespace;
+	const envStyle = config.THRESHOLD_DO_NAMESPACE;
+	if (isDurableObjectNamespaceLike(envStyle)) return envStyle;
+	return null;
+}
+function resolveDoStub(input) {
+	const id = input.namespace.idFromName(input.objectName);
+	return input.namespace.get(id);
+}
+async function callDo(stub, request) {
+	const response = await stub.fetch("https://threshold-store.invalid/", {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify(request)
+	});
+	const text = await response.text();
+	if (!response.ok) throw new Error(`Registration ceremony DO store HTTP ${response.status}: ${text}`);
+	let json;
+	try {
+		json = text ? JSON.parse(text) : null;
+	} catch {
+		throw new Error(`Registration ceremony DO store returned non-JSON response: ${text.slice(0, 200)}`);
+	}
+	if (json === null || typeof json !== "object" || Array.isArray(json)) throw new Error("Registration ceremony DO store returned invalid JSON shape");
+	const responseKeys = Reflect.ownKeys(json);
+	if (Reflect.get(json, "ok") === true && responseKeys.length === 2 && responseKeys.includes("ok") && responseKeys.includes("value")) return {
+		ok: true,
+		value: Reflect.get(json, "value")
+	};
+	if (Reflect.get(json, "ok") !== false || responseKeys.length !== 3 || !responseKeys.includes("ok") || !responseKeys.includes("code") || !responseKeys.includes("message")) throw new Error("Registration ceremony DO store returned invalid JSON shape");
+	const code = trimString(Reflect.get(json, "code"));
+	const message = trimString(Reflect.get(json, "message"));
+	return {
+		ok: false,
+		code: code || "internal",
+		message: message || "Registration ceremony DO store error"
+	};
+}
+var CloudflareDurableObjectRegistrationCeremonyStore = class {
+	constructor(input) {
+		this.stub = resolveDoStub({
+			namespace: input.namespace,
+			objectName: input.objectName
+		});
+		this.prefix = input.prefix;
+	}
+	key(scope, id) {
+		return `${this.prefix}${scope}:${id}`;
+	}
+	async putAddSignerIntent(intent) {
+		const parsed = parseStoredAddSignerIntent(intent);
+		if (!parsed) throw new Error("Invalid add-signer intent record");
+		const ttlMs = Math.max(1, parsed.expiresAtMs - Date.now());
+		const response = await callDo(this.stub, {
+			op: "set",
+			key: this.key("add-signer-intent", parsed.grant),
+			value: parsed,
+			ttlMs
+		});
+		if (!response.ok) throw new Error(response.message);
+	}
+	async getAddSignerIntent(grant) {
+		const key = trimString(grant);
+		if (!key) return null;
+		const response = await callDo(this.stub, {
+			op: "get",
+			key: this.key("add-signer-intent", key)
+		});
+		if (!response.ok) return null;
+		const intent = parseStoredAddSignerIntent(response.value);
+		if (!intent || intent.expiresAtMs <= Date.now()) return null;
+		return intent;
+	}
+	async takeAddSignerIntent(grant) {
+		const key = trimString(grant);
+		if (!key) return null;
+		const response = await callDo(this.stub, {
+			op: "getdel",
+			key: this.key("add-signer-intent", key)
+		});
+		if (!response.ok) return null;
+		const intent = parseStoredAddSignerIntent(response.value);
+		if (!intent || intent.expiresAtMs <= Date.now()) return null;
+		return {
+			...intent,
+			kind: "add_signer_intent_consumed",
+			consumedAtMs: Date.now()
+		};
+	}
+	async putAddAuthMethodIntent(intent) {
+		const parsed = parseStoredAddAuthMethodIntent(intent);
+		if (!parsed) throw new Error("Invalid add-auth-method intent record");
+		const ttlMs = Math.max(1, parsed.expiresAtMs - Date.now());
+		const response = await callDo(this.stub, {
+			op: "set",
+			key: this.key("add-auth-method-intent", parsed.grant),
+			value: parsed,
+			ttlMs
+		});
+		if (!response.ok) throw new Error(response.message);
+	}
+	async getAddAuthMethodIntent(grant) {
+		const key = trimString(grant);
+		if (!key) return null;
+		const response = await callDo(this.stub, {
+			op: "get",
+			key: this.key("add-auth-method-intent", key)
+		});
+		if (!response.ok) return null;
+		const intent = parseStoredAddAuthMethodIntent(response.value);
+		if (!intent || intent.expiresAtMs <= Date.now()) return null;
+		return intent;
+	}
+	async takeAddAuthMethodIntent(grant) {
+		const key = trimString(grant);
+		if (!key) return null;
+		const response = await callDo(this.stub, {
+			op: "getdel",
+			key: this.key("add-auth-method-intent", key)
+		});
+		if (!response.ok) return null;
+		const intent = parseStoredAddAuthMethodIntent(response.value);
+		if (!intent || intent.expiresAtMs <= Date.now()) return null;
+		return {
+			...intent,
+			kind: "add_auth_method_intent_consumed",
+			consumedAtMs: Date.now()
+		};
+	}
+	async putCeremony(ceremony) {
+		const parsed = parseStoredWalletRegistrationCeremony(ceremony);
+		if (!parsed) throw new Error("Invalid registration ceremony record");
+		const ttlMs = Math.max(1, parsed.expiresAtMs - Date.now());
+		const response = await callDo(this.stub, {
+			op: "set",
+			key: this.key("ceremony", parsed.registrationCeremonyId),
+			value: parsed,
+			ttlMs
+		});
+		if (!response.ok) throw new Error(response.message);
+	}
+	async getCeremony(registrationCeremonyId) {
+		const key = trimString(registrationCeremonyId);
+		if (!key) return null;
+		const response = await callDo(this.stub, {
+			op: "get",
+			key: this.key("ceremony", key)
+		});
+		if (!response.ok) return null;
+		const ceremony = parseStoredWalletRegistrationCeremony(response.value);
+		if (!ceremony || ceremony.expiresAtMs <= Date.now()) return null;
+		return ceremony;
+	}
+	async updateCeremony(ceremony) {
+		const parsed = parseStoredWalletRegistrationCeremony(ceremony);
+		if (!parsed) throw new Error("Invalid registration ceremony record");
+		if (parsed.expiresAtMs <= Date.now()) return;
+		const ttlMs = Math.max(1, parsed.expiresAtMs - Date.now());
+		const response = await callDo(this.stub, {
+			op: "set",
+			key: this.key("ceremony", parsed.registrationCeremonyId),
+			value: parsed,
+			ttlMs
+		});
+		if (!response.ok) throw new Error(response.message);
+	}
+	async takeCeremony(registrationCeremonyId) {
+		const key = trimString(registrationCeremonyId);
+		if (!key) return null;
+		const response = await callDo(this.stub, {
+			op: "getdel",
+			key: this.key("ceremony", key)
+		});
+		if (!response.ok) return null;
+		const ceremony = parseStoredWalletRegistrationCeremony(response.value);
+		if (!ceremony || ceremony.expiresAtMs <= Date.now()) return null;
+		return ceremony;
+	}
+	async cancelTerminalCeremony(input) {
+		const registrationCeremonyId = trimString(input.registrationCeremonyId);
+		const walletId = trimString(input.walletId);
+		if (!registrationCeremonyId || !walletId) throw new Error("Terminal registration cancellation requires ceremony and wallet IDs");
+		const response = await callDo(this.stub, {
+			op: "registrationCancelTerminal",
+			ceremonyKey: this.key("ceremony", registrationCeremonyId),
+			registrationCeremonyId,
+			walletId
+		});
+		if (!response.ok) throw new Error(response.message);
+		const result = parseTerminalRegistrationCeremonyCancellationResult(response.value);
+		if (!result) throw new Error("Terminal registration cancellation returned an invalid result");
+		return result;
+	}
+	async putAddSignerFinalizeReplay(replay) {
+		const parsed = parseStoredWalletAddSignerFinalizeReplay(replay);
+		if (!parsed) throw new Error("Invalid wallet add-signer finalize replay record");
+		const ttlMs = Math.max(1, parsed.expiresAtMs - Date.now());
+		const response = await callDo(this.stub, {
+			op: "set",
+			key: this.key("add-signer-finalize-replay", addSignerFinalizeReplayKey(parsed)),
+			value: parsed,
+			ttlMs
+		});
+		if (!response.ok) throw new Error(response.message);
+		const claimResponse = await callDo(this.stub, {
+			op: "set",
+			key: this.key("add-signer-finalize-claim", parsed.addSignerCeremonyId),
+			value: parsed,
+			ttlMs
+		});
+		if (!claimResponse.ok) throw new Error(claimResponse.message);
+	}
+	async getAddSignerFinalizeReplay(input) {
+		if (!trimString(input.addSignerCeremonyId) || !trimString(input.idempotencyKey)) return null;
+		const response = await callDo(this.stub, {
+			op: "get",
+			key: this.key("add-signer-finalize-replay", addSignerFinalizeReplayKey(input))
+		});
+		if (!response.ok) return null;
+		const replay = parseStoredWalletAddSignerFinalizeReplay(response.value);
+		if (!replay || replay.expiresAtMs <= Date.now()) return null;
+		return replay;
+	}
+	async getAddSignerFinalizeReplayForCeremony(addSignerCeremonyId) {
+		const ceremonyId = trimString(addSignerCeremonyId);
+		if (!ceremonyId) return null;
+		const response = await callDo(this.stub, {
+			op: "get",
+			key: this.key("add-signer-finalize-claim", ceremonyId)
+		});
+		if (!response.ok) return null;
+		const replay = parseStoredWalletAddSignerFinalizeReplay(response.value);
+		if (!replay || replay.expiresAtMs <= Date.now()) return null;
+		return replay;
+	}
+	async putAddAuthMethodCeremony(ceremony) {
+		const parsed = parseStoredWalletAddAuthMethodCeremony(ceremony);
+		if (!parsed) throw new Error("Invalid add-auth-method ceremony record");
+		const ttlMs = Math.max(1, parsed.expiresAtMs - Date.now());
+		const response = await callDo(this.stub, {
+			op: "set",
+			key: this.key("add-auth-method", parsed.addAuthMethodCeremonyId),
+			value: parsed,
+			ttlMs
+		});
+		if (!response.ok) throw new Error(response.message);
+	}
+	async getAddAuthMethodCeremony(addAuthMethodCeremonyId) {
+		const key = trimString(addAuthMethodCeremonyId);
+		if (!key) return null;
+		const response = await callDo(this.stub, {
+			op: "get",
+			key: this.key("add-auth-method", key)
+		});
+		if (!response.ok) return null;
+		const ceremony = parseStoredWalletAddAuthMethodCeremony(response.value);
+		if (!ceremony || ceremony.expiresAtMs <= Date.now()) return null;
+		return ceremony;
+	}
+	async updateAddAuthMethodCeremony(ceremony) {
+		const parsed = parseStoredWalletAddAuthMethodCeremony(ceremony);
+		if (!parsed) throw new Error("Invalid add-auth-method ceremony record");
+		if (parsed.expiresAtMs <= Date.now()) return;
+		const ttlMs = Math.max(1, parsed.expiresAtMs - Date.now());
+		const response = await callDo(this.stub, {
+			op: "set",
+			key: this.key("add-auth-method", parsed.addAuthMethodCeremonyId),
+			value: parsed,
+			ttlMs
+		});
+		if (!response.ok) throw new Error(response.message);
+	}
+	async takeAddAuthMethodCeremony(addAuthMethodCeremonyId) {
+		const key = trimString(addAuthMethodCeremonyId);
+		if (!key) return null;
+		const response = await callDo(this.stub, {
+			op: "getdel",
+			key: this.key("add-auth-method", key)
+		});
+		if (!response.ok) return null;
+		const ceremony = parseStoredWalletAddAuthMethodCeremony(response.value);
+		if (!ceremony || ceremony.expiresAtMs <= Date.now()) return null;
+		return ceremony;
+	}
+	async putAddSignerCeremony(ceremony) {
+		const parsed = parseStoredWalletAddSignerCeremony(ceremony);
+		if (!parsed) throw new Error("Invalid add-signer ceremony record");
+		const ttlMs = Math.max(1, parsed.expiresAtMs - Date.now());
+		const response = await callDo(this.stub, {
+			op: "set",
+			key: this.key("add-signer", parsed.addSignerCeremonyId),
+			value: parsed,
+			ttlMs
+		});
+		if (!response.ok) throw new Error(response.message);
+	}
+	async getAddSignerCeremony(addSignerCeremonyId) {
+		const key = trimString(addSignerCeremonyId);
+		if (!key) return null;
+		const response = await callDo(this.stub, {
+			op: "get",
+			key: this.key("add-signer", key)
+		});
+		if (!response.ok) return null;
+		const ceremony = parseStoredWalletAddSignerCeremony(response.value);
+		if (!ceremony || ceremony.expiresAtMs <= Date.now()) return null;
+		return ceremony;
+	}
+	async updateAddSignerCeremony(ceremony) {
+		const parsed = parseStoredWalletAddSignerCeremony(ceremony);
+		if (!parsed) throw new Error("Invalid add-signer ceremony record");
+		if (parsed.expiresAtMs <= Date.now()) return;
+		const ttlMs = Math.max(1, parsed.expiresAtMs - Date.now());
+		const response = await callDo(this.stub, {
+			op: "set",
+			key: this.key("add-signer", parsed.addSignerCeremonyId),
+			value: parsed,
+			ttlMs
+		});
+		if (!response.ok) throw new Error(response.message);
+	}
+	async takeAddSignerCeremony(addSignerCeremonyId) {
+		const key = trimString(addSignerCeremonyId);
+		if (!key) return null;
+		const response = await callDo(this.stub, {
+			op: "getdel",
+			key: this.key("add-signer", key)
+		});
+		if (!response.ok) return null;
+		const ceremony = parseStoredWalletAddSignerCeremony(response.value);
+		if (!ceremony || ceremony.expiresAtMs <= Date.now()) return null;
+		return ceremony;
+	}
+};
+function resolveRegistrationDoPrefix(config) {
+	const base = trimString(config.WALLET_REGISTRATION_PREFIX) || trimString(config.walletRegistrationPrefix) || trimString(config.keyPrefix) || trimString(config.THRESHOLD_PREFIX);
+	if (!base) return "wallet-registration:";
+	return base.endsWith(":") ? `${base}wallet-registration:` : `${base}:wallet-registration:`;
+}
+function createRegistrationCeremonyStore(input = {}) {
+	const config = input.config || {};
+	const kind = typeof config.kind === "string" ? config.kind.trim() : "";
+	if (kind === "cloudflare-do") {
+		const namespace = resolveDoNamespaceFromConfig(config);
+		if (!namespace) throw new Error("cloudflare-do registration ceremony store selected but no Durable Object namespace was provided (expected config.namespace)");
+		const objectName = trimString(config.objectName) || trimString(config.name) || "threshold-store";
+		input.logger?.info("[wallet-registration] Using Cloudflare Durable Object store for registration ceremonies");
+		return new CloudflareDurableObjectRegistrationCeremonyStore({
+			namespace,
+			objectName,
+			prefix: resolveRegistrationDoPrefix(config)
+		});
+	}
+	if (kind && kind !== "memory" && kind !== "in-memory") throw new Error(`[wallet-registration] Unknown registration ceremony store kind: ${kind}`);
+	input.logger?.warn?.("[wallet-registration] Using in-memory registration ceremony store; configure Cloudflare Durable Object storage for durable registration ceremonies");
+	return new MemoryRegistrationCeremonyStore();
+}
+//#endregion
+export { MemoryRegistrationCeremonyStore, buildStoredWalletRegistrationEvmFamilyEcdsaFinalizedBranch, buildStoredWalletRegistrationEvmFamilyEcdsaPreparedBranch, buildStoredWalletRegistrationNearEd25519YaoAuthorizedBranch, buildStoredWalletRegistrationPreparedContext, createRegistrationCeremonyStore, findStoredWalletRegistrationEvmFamilyEcdsaBranch, findStoredWalletRegistrationNearEd25519YaoBranch, parseStoredRegistrationSignerPlan, parseStoredWalletRegistrationPreparedContext, parseTerminalRegistrationCeremonyCancellationResult, registrationCeremonyAuthorityRpId, replaceStoredWalletRegistrationSignerBranch, storedRegistrationAuthoritiesMatch, storedRegistrationSignerPlansMatch, storedWalletRegistrationPreparedContextsMatch, verifiedRegistrationCeremonyAuthority };
+
+//# sourceMappingURL=RegistrationCeremonyStore.js.map