@seams/wallet-server 0.5.0

package/dist/esm/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.js

@@ -0,0 +1,2084 @@
+import { parseChallengeSubjectId, parseEmailOtpChallengeId, parseOrgId, parseProviderSubject, parseRootShareEpoch, parseWalletAuthMethodId, parseWalletAuthorityId, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
+import { parseDeviceId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
+import { parseWalletAddAuthMethodRegistrationOptions } from "../../../../shared-ts/src/utils/addAuthMethodRegistration.js";
+import { parseWalletAuthorityV1 } from "../../../../shared-ts/src/authorization/walletAuthority.js";
+import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../../shared-ts/src/utils/near.js";
+import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, createServerAllocatedWalletId, nearEd25519SigningKeyIdFromString, normalizeAddAuthMethodInput, normalizeAddAuthMethodIntentCaller, normalizeAddSignerSelection, normalizeRegistrationAuthMethodInput, normalizeRegistrationSignerPlan, parseWalletAuthMethodRecordV2, registrationSignerBranchKeyFromString, registrationSignerSetSelectionFromPlan, walletIdFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { parseWebAuthnAuthenticatorDeviceInfo, unknownWebAuthnAuthenticatorDeviceInfo } from "../../../../shared-ts/src/utils/webauthnDeviceInfo.js";
+import { parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
+import { deriveEvmFamilySigningKeySlotId, parseEvmFamilySigningKeySlotId } from "../../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
+import { derivationClientSharePublicKey33B64uFromString, ecdsaClientRootPublicKey33B64uFromString } from "../../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
+import { normalizeOptionalTrimmedString } from "../../../../shared-ts/src/utils/normalize.js";
+import "../../../../shared-ts/src/utils/validation.js";
+import { parseWalletAuthAuthority, parseWalletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { parseRouterAbEcdsaDerivationNormalSigningStateV1, parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaRegistrationActivationReceiptV1, parseRouterAbEcdsaRegistrationRequestFactsV1, parseRouterAbEcdsaRegistrationRequestV1, parseRouterAbEcdsaStrictForwardedRegistrationResponseV1, parseRouterAbEcdsaVerifiedClientActivationFactsV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { secureRandomBase64Url } from "../../../../shared-ts/src/utils/secureRandomId.js";
+import { parseRouterAbEd25519NormalSigningState } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
+import { thresholdEcdsaChainTargetFromValue, thresholdEcdsaChainTargetKey } from "../../../../core/thresholdEcdsaChainTarget.js";
+import { buildWalletEcdsaSignerRecord, parseWalletEd25519SignerRecord } from "../../../../core/d1WalletStore.js";
+import { registrationPreparationIdFromString } from "../../../../core/types.js";
+import "../../../../shared-ts/src/signing-lanes/index.js";
+import { parsePasskeyCustodyEnvelopeRecord } from "../../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
+import "../../../../shared-ts/src/passkey-custody/index.js";
+import { parseEcdsaDerivationPublicIdentity, parseThresholdEd25519AuthorityScope, thresholdEd25519AuthorityScopeFromWalletAuthAuthority, thresholdEd25519AuthorityScopesMatch } from "../../../../core/ThresholdService/validation.js";
+import { toRecordValue } from "../auth/d1RouterApiAuthBoundary.js";
+import { parseStoredRouterAbEcdsaPendingActivationV1 } from "../../../domains/ecdsa/routerAbEcdsaStrictRegistration.js";
+import { parseStoredRegistrationSignerPlan, parseStoredWalletRegistrationPreparedContext, storedRegistrationSignerPlansMatch } from "../../../../core/RegistrationCeremonyStore.js";
+//#region src/router/cloudflare/d1/registration/d1RegistrationCeremonyRecords.ts
+function requireEvmFamilySigningKeySlotId(value) {
+	const parsed = parseEvmFamilySigningKeySlotId(value);
+	if (!parsed.ok) throw new Error(parsed.error.message);
+	return parsed.value;
+}
+function createD1ServerAllocatedWalletId() {
+	return createServerAllocatedWalletId();
+}
+function inferRuntimePolicyScopeFromSigningRoot(input) {
+	const signingRootId = normalizeOptionalTrimmedString(input.signingRootId);
+	const signingRootVersion = normalizeOptionalTrimmedString(input.signingRootVersion);
+	if (!signingRootId || !signingRootVersion) return void 0;
+	const [projectId, envId] = signingRootId.split(":");
+	if (!projectId || !envId) return void 0;
+	return {
+		orgId: normalizeOptionalTrimmedString(input.orgId) || "",
+		projectId,
+		envId,
+		signingRootVersion
+	};
+}
+function buildRegistrationIntent(input) {
+	const nonceB64u = secureRandomBase64Url(32);
+	const foundingWalletAuthMethodId = input.foundingWalletAuthMethodId;
+	if (input.runtimePolicyScope) return {
+		version: "registration_intent_v1",
+		walletId: input.walletId,
+		authMethod: input.authMethod,
+		signerSelection: input.signerSelection,
+		foundingWalletAuthMethodId,
+		runtimePolicyScope: input.runtimePolicyScope,
+		nonceB64u
+	};
+	return {
+		version: "registration_intent_v1",
+		walletId: input.walletId,
+		authMethod: input.authMethod,
+		signerSelection: input.signerSelection,
+		foundingWalletAuthMethodId,
+		nonceB64u
+	};
+}
+function buildAddSignerIntent(input) {
+	const nonceB64u = secureRandomBase64Url(32);
+	if (input.runtimePolicyScope) return {
+		version: "add_signer_intent_v1",
+		walletId: input.walletId,
+		signerSelection: input.signerSelection,
+		runtimePolicyScope: input.runtimePolicyScope,
+		nonceB64u
+	};
+	return {
+		version: "add_signer_intent_v1",
+		walletId: input.walletId,
+		signerSelection: input.signerSelection,
+		nonceB64u
+	};
+}
+/**
+* Mints the intent, including the target method id the source proof will sign.
+*
+* The id is allocated here rather than in `start` so a fresh proof can name the
+* method it authorizes creating. The caller branch is carried through
+* unchanged: it decides what the source has to present, and it is part of the
+* digest so a proof taken over one branch cannot start the other.
+*/
+function buildAddAuthMethodIntent(input) {
+	const nonceB64u = secureRandomBase64Url(32);
+	const common = {
+		version: "add_auth_method_intent_v1",
+		walletId: input.walletId,
+		authMethod: input.authMethod,
+		targetWalletAuthMethodId: input.targetWalletAuthMethodId,
+		...input.runtimePolicyScope ? { runtimePolicyScope: input.runtimePolicyScope } : {},
+		nonceB64u
+	};
+	switch (input.caller.caller) {
+		case "same_device_addition": return {
+			...common,
+			caller: "same_device_addition",
+			source: input.caller.source
+		};
+		case "linked_device_ceremony": return {
+			...common,
+			caller: "linked_device_ceremony"
+		};
+		default: return unreachableAddAuthMethodIntentCaller(input.caller);
+	}
+}
+function unreachableAddAuthMethodIntentCaller(value) {
+	throw new Error(`Unhandled add-auth-method intent caller: ${String(value)}`);
+}
+function addAuthMethodInputMatches(left, right) {
+	if (left.kind !== right.kind) return false;
+	switch (left.kind) {
+		case "passkey": return right.kind === "passkey" && left.rpId === right.rpId;
+		case "email_otp": return right.kind === "email_otp" && left.email.toLowerCase() === right.email.toLowerCase();
+	}
+	return unreachableAddAuthMethodInput(left);
+}
+function addSignerSelectionMatches(left, right) {
+	if (left.mode !== right.mode) return false;
+	switch (left.mode) {
+		case "ecdsa": return right.mode === "ecdsa" && positiveIntegerArraysEqual(left.ecdsa.participantIds, right.ecdsa.participantIds) && thresholdEcdsaChainTargetsEqual(left.ecdsa.chainTargets, right.ecdsa.chainTargets);
+		case "ed25519": return right.mode === "ed25519" && addSignerEd25519SelectionsMatch(left, right);
+	}
+	return unreachableAddSignerSelection(left);
+}
+function parseWalletIdForIntent(raw) {
+	const value = normalizeOptionalTrimmedString(raw);
+	if (!value) return null;
+	try {
+		return walletIdFromString(value);
+	} catch {
+		return null;
+	}
+}
+function parseD1RegistrationIntent(raw) {
+	const record = toRecordValue(raw);
+	if (!record || record.version !== "registration_intent_v1") return null;
+	const walletId = parseWalletIdForIntent(record.walletId);
+	const authMethod = normalizeRegistrationAuthMethodInput(record.authMethod);
+	const signerPlan = normalizeRegistrationSignerPlan(record.signerSelection);
+	const signerSelection = signerPlan.ok ? registrationSignerSetSelectionFromPlan(signerPlan.value, { normalizeEcdsaChainTarget: thresholdEcdsaChainTargetFromValue }) : signerPlan;
+	const nonceB64u = normalizeOptionalTrimmedString(record.nonceB64u);
+	const runtimePolicyScope = parseD1RuntimePolicyScope(record.runtimePolicyScope);
+	const foundingWalletAuthMethodId = parseWalletAuthMethodId(record.foundingWalletAuthMethodId);
+	if (!walletId || !authMethod || !signerSelection.ok || !nonceB64u) return null;
+	if (!foundingWalletAuthMethodId.ok) return null;
+	if (record.runtimePolicyScope !== void 0 && !runtimePolicyScope) return null;
+	if (runtimePolicyScope) return {
+		version: "registration_intent_v1",
+		walletId,
+		authMethod,
+		signerSelection: signerSelection.value,
+		foundingWalletAuthMethodId: foundingWalletAuthMethodId.value,
+		runtimePolicyScope,
+		nonceB64u
+	};
+	return {
+		version: "registration_intent_v1",
+		walletId,
+		authMethod,
+		signerSelection: signerSelection.value,
+		foundingWalletAuthMethodId: foundingWalletAuthMethodId.value,
+		nonceB64u
+	};
+}
+function parseD1StoredWalletRegistrationCeremony(raw) {
+	const record = toRecordValue(raw);
+	if (!record) return null;
+	const registrationCeremonyId = normalizeOptionalTrimmedString(record.registrationCeremonyId);
+	const intent = parseD1RegistrationIntent(record.intent);
+	const digestB64u = normalizeOptionalTrimmedString(record.digestB64u);
+	const orgId = normalizeOptionalTrimmedString(record.orgId);
+	const expiresAtMs = safeInteger(record.expiresAtMs);
+	const foundingWalletAuthorityId = parseWalletAuthorityId(record.foundingWalletAuthorityId);
+	const foundingDeviceId = parseDeviceId(record.foundingDeviceId);
+	const foundingWalletAuthMethodId = parseWalletAuthMethodId(record.foundingWalletAuthMethodId);
+	const authorityState = parseD1WalletRegistrationCeremonyAuthorityState(record.authorityState);
+	const signerPlan = parseStoredRegistrationSignerPlan(record.signerPlan);
+	const preparedContext = parseStoredWalletRegistrationPreparedContext(record.preparedContext);
+	const intentSignerPlan = intent ? parseStoredRegistrationSignerPlan(intent.signerSelection) : null;
+	const signerState = parseD1StoredWalletRegistrationSignerState(record.signerState);
+	const signingRootId = normalizeOptionalTrimmedString(record.signingRootId);
+	const signingRootVersion = normalizeOptionalTrimmedString(record.signingRootVersion);
+	if (!registrationCeremonyId || !intent || !digestB64u || !orgId || !signingRootId || !signingRootVersion || !foundingWalletAuthorityId.ok || !foundingDeviceId.ok || !foundingWalletAuthMethodId.ok || expiresAtMs === null || !authorityState || !signerPlan || !preparedContext || !intentSignerPlan || !storedRegistrationSignerPlansMatch(signerPlan, intentSignerPlan) || signingRootId && preparedContext.signingRootId !== signingRootId || signingRootVersion && preparedContext.signingRootVersion !== signingRootVersion || !signerState) return null;
+	const ceremony = {
+		registrationCeremonyId,
+		foundingWalletAuthorityId: foundingWalletAuthorityId.value,
+		foundingDeviceId: foundingDeviceId.value,
+		foundingWalletAuthMethodId: foundingWalletAuthMethodId.value,
+		intent,
+		digestB64u,
+		signerPlan,
+		preparedContext,
+		orgId,
+		expiresAtMs,
+		authorityState,
+		signerState
+	};
+	const expectedOrigin = normalizeOptionalTrimmedString(record.expectedOrigin);
+	if (signingRootId) ceremony.signingRootId = signingRootId;
+	if (signingRootVersion) ceremony.signingRootVersion = signingRootVersion;
+	if (expectedOrigin) ceremony.expectedOrigin = expectedOrigin;
+	return ceremony;
+}
+/**
+* Refactor 94C. Setup creates the ceremony before the WebAuthn proof exists,
+* so the stored authority is a two-arm state rather than a required record.
+*/
+function parseD1WalletRegistrationCeremonyAuthorityState(raw) {
+	const record = toRecordValue(raw);
+	if (!record) return null;
+	switch (record.kind) {
+		case "awaiting_proof": {
+			const authMethod = normalizeRegistrationAuthMethodInput(record.authMethod);
+			return authMethod ? {
+				kind: "awaiting_proof",
+				authMethod
+			} : null;
+		}
+		case "verified": {
+			const authority = parseD1RegistrationAuthority(record.authority);
+			return authority ? {
+				kind: "verified",
+				authority
+			} : null;
+		}
+		default: return null;
+	}
+}
+function parseD1StoredWalletAddAuthMethodFinalizeReplay(raw) {
+	const record = toRecordValue(raw);
+	if (!record || record.kind !== "wallet_add_auth_method_finalize_replay_v1") return null;
+	const addAuthMethodCeremonyId = normalizeOptionalTrimmedString(record.addAuthMethodCeremonyId);
+	const requestDigestB64u = normalizeOptionalTrimmedString(record.requestDigestB64u);
+	const createdAtMs = safeInteger(record.createdAtMs);
+	const expiresAtMs = safeInteger(record.expiresAtMs);
+	const response = parseD1WalletAddAuthMethodFinalizeReplayResponse(record.response);
+	if (!addAuthMethodCeremonyId || !requestDigestB64u || createdAtMs == null || expiresAtMs == null || expiresAtMs <= createdAtMs || !response) return null;
+	return {
+		kind: "wallet_add_auth_method_finalize_replay_v1",
+		addAuthMethodCeremonyId,
+		requestDigestB64u,
+		response,
+		createdAtMs,
+		expiresAtMs
+	};
+}
+function parseD1WalletAddAuthMethodFinalizeReplayResponse(raw) {
+	const record = toRecordValue(raw);
+	if (!record || record.ok !== true) return null;
+	const walletId = parseWalletIdForIntent(record.walletId);
+	const authority = parseWalletAuthAuthority(record.authority);
+	if (!walletId || !authority || authority.walletId !== walletId) return null;
+	const authMethod = toRecordValue(record.authMethod);
+	if (!authMethod || authMethod.status !== "active") return null;
+	if (authMethod.kind === "email_otp") return {
+		ok: true,
+		walletId,
+		authority,
+		authMethod: {
+			kind: "email_otp",
+			status: "active"
+		}
+	};
+	const parsedRpId = parseWebAuthnRpId(record.rpId);
+	const rpId = parsedRpId.ok ? parsedRpId.value : null;
+	const credentialIdB64u = normalizeOptionalTrimmedString(authMethod.credentialIdB64u);
+	const credentialPublicKeyB64u = normalizeOptionalTrimmedString(authMethod.credentialPublicKeyB64u);
+	const counter = Number(authMethod.counter);
+	if (authMethod.kind !== "passkey" || !rpId || !credentialIdB64u || !credentialPublicKeyB64u || !Number.isSafeInteger(counter) || counter < 0) return null;
+	return {
+		ok: true,
+		walletId,
+		authority,
+		rpId,
+		authMethod: {
+			kind: "passkey",
+			status: "active",
+			credentialIdB64u,
+			credentialPublicKeyB64u,
+			counter,
+			device: parseWebAuthnAuthenticatorDeviceInfo(authMethod.device) ?? unknownWebAuthnAuthenticatorDeviceInfo()
+		}
+	};
+}
+function parseD1StoredWalletAddSignerFinalizeReplay(raw) {
+	const record = toRecordValue(raw);
+	if (!record || record.kind !== "wallet_add_signer_finalize_replay_v1") return null;
+	const addSignerCeremonyId = normalizeOptionalTrimmedString(record.addSignerCeremonyId);
+	const idempotencyKey = normalizeOptionalTrimmedString(record.idempotencyKey);
+	const response = parseD1WalletAddSignerFinalizeSuccessResponse(record.response);
+	const request = parseD1WalletAddSignerFinalizeRequest(record.request);
+	const createdAtMs = safeInteger(record.createdAtMs);
+	const expiresAtMs = safeInteger(record.expiresAtMs);
+	if (!addSignerCeremonyId || !idempotencyKey || !response || !request || request.addSignerCeremonyId !== addSignerCeremonyId || request.idempotencyKey !== idempotencyKey || request.kind !== response.kind || createdAtMs === null || createdAtMs <= 0 || expiresAtMs === null || expiresAtMs <= 0) return null;
+	return {
+		kind: "wallet_add_signer_finalize_replay_v1",
+		addSignerCeremonyId,
+		idempotencyKey,
+		request,
+		response,
+		createdAtMs,
+		expiresAtMs
+	};
+}
+function parseD1WalletAddSignerFinalizeSuccessResponse(raw) {
+	const record = toRecordValue(raw);
+	if (!record || record.ok !== true) return null;
+	const walletId = parseWalletIdForIntent(record.walletId);
+	if (!walletId) return null;
+	if (record.kind === "near_ed25519") {
+		const rpId = normalizeOptionalTrimmedString(record.rpId);
+		const credentialIdB64u = normalizeOptionalTrimmedString(record.credentialIdB64u);
+		const ed25519 = parseD1WalletEd25519YaoSignerPublicResult(record.ed25519);
+		if (!rpId || !credentialIdB64u || !ed25519) return null;
+		return {
+			ok: true,
+			kind: "near_ed25519",
+			walletId,
+			rpId,
+			credentialIdB64u,
+			ed25519
+		};
+	}
+	if (record.kind !== "evm_family_ecdsa") return null;
+	const ecdsa = parseD1WalletRegistrationFinalizeEcdsa(record.ecdsa);
+	if (!ecdsa) return null;
+	const rpId = normalizeOptionalTrimmedString(record.rpId);
+	return rpId ? {
+		ok: true,
+		kind: "evm_family_ecdsa",
+		walletId,
+		rpId,
+		ecdsa
+	} : {
+		ok: true,
+		kind: "evm_family_ecdsa",
+		walletId,
+		ecdsa
+	};
+}
+function parseD1WalletAddSignerFinalizeTerminalResponse(raw) {
+	const record = toRecordValue(raw);
+	if (!record) return null;
+	if (record.ok === true) return parseD1WalletAddSignerFinalizeSuccessResponse(record);
+	const code = normalizeOptionalTrimmedString(record.code);
+	const message = normalizeOptionalTrimmedString(record.message);
+	return record.ok === false && code && message ? {
+		ok: false,
+		code,
+		message
+	} : null;
+}
+function parseD1WalletRegistrationFinalizeReplayResponse(raw) {
+	const record = toRecordValue(raw);
+	if (!record || record.ok !== true) return null;
+	const walletId = parseWalletIdForIntent(record.walletId);
+	const authMethod = parseD1WalletRegistrationFinalizeAuthMethod(record.authMethod);
+	const authority = parseWalletAuthAuthority(record.authority);
+	const foundingAuthority = parseWalletAuthorityV1(record.foundingAuthority);
+	const foundingAuthMethod = parseWalletAuthMethodRecordV2(record.foundingAuthMethod);
+	if (!walletId || !authMethod || !authority || authority.walletId !== walletId || !foundingAuthority.ok || foundingAuthority.value.state !== "active" || foundingAuthority.value.walletId !== walletId || !foundingAuthMethod || foundingAuthMethod.status !== "active" || foundingAuthMethod.walletId !== walletId || foundingAuthMethod.walletAuthorityId !== foundingAuthority.value.authorityId || foundingAuthMethod.walletAuthMethodId !== authority.bindingId) return null;
+	const rpId = normalizeOptionalTrimmedString(record.rpId);
+	if (authMethod.kind === "passkey" && !rpId) return null;
+	if (authMethod.kind === "email_otp" && rpId) return null;
+	let custodyKeyManifestDigestB64u;
+	try {
+		custodyKeyManifestDigestB64u = parseDigestB64u(record.custodyKeyManifestDigestB64u);
+	} catch {
+		return null;
+	}
+	const ecdsa = parseD1WalletRegistrationFinalizeEcdsa(record.ecdsa);
+	if (record.kind === "evm_family_ecdsa") {
+		if (!ecdsa) return null;
+		if (authMethod.kind === "passkey") {
+			if (!rpId) return null;
+			return {
+				ok: true,
+				kind: "evm_family_ecdsa",
+				walletId,
+				rpId,
+				authority,
+				foundingAuthority: foundingAuthority.value,
+				foundingAuthMethod,
+				authMethod,
+				custodyKeyManifestDigestB64u,
+				ecdsa
+			};
+		}
+		return {
+			ok: true,
+			kind: "evm_family_ecdsa",
+			walletId,
+			authority,
+			foundingAuthority: foundingAuthority.value,
+			foundingAuthMethod,
+			authMethod,
+			custodyKeyManifestDigestB64u,
+			ecdsa
+		};
+	}
+	if (record.kind !== "near_ed25519") return null;
+	if (record.ecdsa !== void 0) return null;
+	const ed25519 = parseD1WalletRegistrationFinalizeEd25519(record.ed25519);
+	const authorityScope = parseThresholdEd25519AuthorityScope(record.authorityScope);
+	const accountProvisioning = parseD1RegistrationNearAccountProvisioning(record.accountProvisioning);
+	const resolvedAccount = parseD1ResolvedRegistrationNearAccount(record.resolvedAccount);
+	if (!ed25519 || !authorityScope || !thresholdEd25519AuthorityScopesMatch(authorityScope, thresholdEd25519AuthorityScopeFromWalletAuthAuthority(authority)) || !accountProvisioning || !resolvedAccount || ed25519.nearAccountId !== resolvedAccount.nearAccountId || ed25519.nearEd25519SigningKeyId !== resolvedAccount.nearEd25519SigningKeyId || !registrationNearProvisioningMatchesResolution(accountProvisioning, resolvedAccount)) return null;
+	if (ecdsa) return null;
+	if (authMethod.kind === "passkey") {
+		if (!rpId) return null;
+		return {
+			ok: true,
+			kind: "near_ed25519",
+			walletId,
+			rpId,
+			authority,
+			foundingAuthority: foundingAuthority.value,
+			foundingAuthMethod,
+			authMethod,
+			authorityScope,
+			accountProvisioning,
+			resolvedAccount,
+			custodyKeyManifestDigestB64u,
+			ed25519
+		};
+	}
+	return {
+		ok: true,
+		kind: "near_ed25519",
+		walletId,
+		authority,
+		foundingAuthority: foundingAuthority.value,
+		foundingAuthMethod,
+		authMethod,
+		authorityScope,
+		accountProvisioning,
+		resolvedAccount,
+		custodyKeyManifestDigestB64u,
+		ed25519
+	};
+}
+function hasExactKeys(record, expected) {
+	const actual = Object.keys(record);
+	return actual.length === expected.length && expected.every((key) => actual.includes(key));
+}
+function hasStrictRegistrationAuthorityRecord(raw) {
+	const record = toRecordValue(raw);
+	if (!record) return false;
+	if (record.kind === "passkey") {
+		const device = toRecordValue(record.device);
+		return hasExactKeys(record, [
+			"kind",
+			"walletId",
+			"rpId",
+			"credentialIdB64u",
+			"credentialPublicKeyB64u",
+			"counter",
+			"device",
+			"registrationIntentDigestB64u"
+		]) && device !== null && hasStrictWebAuthnDeviceInfo(device);
+	}
+	if (record.kind !== "email_otp") return false;
+	if (record.proofKind === "otp_challenge") return hasExactKeys(record, [
+		"kind",
+		"proofKind",
+		"walletId",
+		"providerSubject",
+		"challengeSubjectId",
+		"email",
+		"emailHashHex",
+		"challengeId",
+		"registrationAuthorityId",
+		"originalWalletId",
+		"finalWalletId",
+		"orgId",
+		"ownerProofBindingDigest",
+		"challengePurpose",
+		"registrationIntentDigestB64u"
+	]);
+	if (record.proofKind === "google_sso_registration") return hasExactKeys(record, [
+		"kind",
+		"proofKind",
+		"walletId",
+		"providerSubject",
+		"email",
+		"emailHashHex",
+		"googleEmailOtpRegistrationAttemptId",
+		"googleEmailOtpRegistrationOfferId",
+		"googleEmailOtpRegistrationCandidateId",
+		"registrationAuthorityId",
+		"finalWalletId",
+		"orgId",
+		"ownerProofBindingDigest",
+		"registrationIntentDigestB64u"
+	]);
+	return false;
+}
+function hasStrictWebAuthnDeviceInfo(record) {
+	const keys = Object.keys(record);
+	const allowed = [
+		"label",
+		"browser",
+		"os",
+		"synced",
+		"transports",
+		"provider",
+		"providerLabel"
+	];
+	if (!keys.every((key) => allowed.includes(key))) return false;
+	if (!keys.includes("label") || !keys.includes("browser") || !keys.includes("os") || !keys.includes("synced") || !keys.includes("transports")) return false;
+	return parseWebAuthnAuthenticatorDeviceInfo(record) !== null;
+}
+function hasStrictStoredRegistrationSignerPlan(raw) {
+	const record = toRecordValue(raw);
+	if (!record || !hasExactKeys(record, ["kind", "branches"]) || record.kind !== "signer_set") return false;
+	if (!Array.isArray(record.branches) || record.branches.length === 0) return false;
+	for (const rawBranch of record.branches) {
+		const branch = toRecordValue(rawBranch);
+		if (!branch) return false;
+		if (branch.kind === "near_ed25519" && !hasExactKeys(branch, [
+			"kind",
+			"branchKey",
+			"accountProvisioning",
+			"signerSlot",
+			"participantIds",
+			"keyPurpose",
+			"keyVersion",
+			"derivationVersion"
+		])) return false;
+		if (branch.kind === "evm_family_ecdsa" && !hasExactKeys(branch, [
+			"kind",
+			"branchKey",
+			"participantIds",
+			"chainTargets"
+		])) return false;
+		if (branch.kind !== "near_ed25519" && branch.kind !== "evm_family_ecdsa") return false;
+	}
+	return true;
+}
+function hasStrictThresholdEcdsaChainTarget(raw) {
+	const record = toRecordValue(raw);
+	if (!record) return false;
+	if (record.kind === "evm") return (hasExactKeys(record, [
+		"kind",
+		"namespace",
+		"chainId"
+	]) || hasExactKeys(record, [
+		"kind",
+		"namespace",
+		"chainId",
+		"networkSlug"
+	])) && record.namespace === "eip155";
+	if (record.kind === "tempo") return hasExactKeys(record, ["kind", "chainId"]) || hasExactKeys(record, [
+		"kind",
+		"chainId",
+		"networkSlug"
+	]);
+	return false;
+}
+function hasStrictStoredWalletRegistrationPreparedContext(raw) {
+	const record = toRecordValue(raw);
+	if (!record || !hasExactKeys(record, [
+		"kind",
+		"signingRootId",
+		"signingRootVersion",
+		"runtimePolicy",
+		"ecdsa"
+	]) || record.kind !== "wallet_registration_prepared_context_v1") return false;
+	const runtimePolicy = toRecordValue(record.runtimePolicy);
+	const ecdsa = toRecordValue(record.ecdsa);
+	if (!runtimePolicy || !ecdsa) return false;
+	if (runtimePolicy.kind === "runtime_policy_scope") {
+		const scope = toRecordValue(runtimePolicy.scope);
+		if (!hasExactKeys(runtimePolicy, ["kind", "scope"]) || !scope || !hasExactKeys(scope, [
+			"orgId",
+			"projectId",
+			"envId",
+			"signingRootVersion"
+		])) return false;
+	} else if (runtimePolicy.kind === "signing_root_only") {
+		if (!hasExactKeys(runtimePolicy, ["kind"])) return false;
+	} else return false;
+	if (ecdsa.kind === "evm_family_ecdsa_requested") return hasExactKeys(ecdsa, ["kind", "chainTargets"]) && Array.isArray(ecdsa.chainTargets) && ecdsa.chainTargets.length > 0 && ecdsa.chainTargets.every(hasStrictThresholdEcdsaChainTarget);
+	return ecdsa.kind === "evm_family_ecdsa_absent" && hasExactKeys(ecdsa, ["kind"]);
+}
+function registrationNearProvisioningMatchesResolution(provisioning, resolved) {
+	switch (provisioning.kind) {
+		case "implicit_account": return resolved.kind === "implicit_account";
+		case "sponsored_named_account": return resolved.kind === "sponsored_named_account" && resolved.nearAccountId === provisioning.requestedAccountId;
+	}
+}
+function parseD1WalletRegistrationFinalizeAuthMethod(raw) {
+	const record = toRecordValue(raw);
+	const kind = normalizeOptionalTrimmedString(record?.kind);
+	if (kind === "passkey") {
+		const credentialIdB64u = normalizeOptionalTrimmedString(record?.credentialIdB64u);
+		const credentialPublicKeyB64u = normalizeOptionalTrimmedString(record?.credentialPublicKeyB64u);
+		if (!credentialIdB64u || !credentialPublicKeyB64u) return null;
+		return {
+			kind: "passkey",
+			credentialIdB64u,
+			credentialPublicKeyB64u
+		};
+	}
+	if (kind === "email_otp") {
+		const registrationAuthorityId = normalizeOptionalTrimmedString(record?.registrationAuthorityId);
+		return registrationAuthorityId ? {
+			kind: "email_otp",
+			registrationAuthorityId
+		} : null;
+	}
+	return null;
+}
+function parseD1WalletRegistrationFinalizeEd25519(raw) {
+	const publicResult = parseD1WalletEd25519YaoSignerPublicResult(raw);
+	const record = toRecordValue(raw);
+	if (!record || !publicResult) return null;
+	const runtimePolicyScope = parseD1RuntimePolicyScope(record.runtimePolicyScope);
+	const thresholdSessionId = normalizeOptionalTrimmedString(record.thresholdSessionId);
+	const routerAbNormalSigning = parseRouterAbEd25519NormalSigningState(record.routerAbNormalSigning);
+	if (!runtimePolicyScope || !thresholdSessionId || !routerAbNormalSigning || routerAbNormalSigning.signingWorkerId !== publicResult.relayerKeyId) return null;
+	return {
+		...publicResult,
+		thresholdSessionId,
+		runtimePolicyScope,
+		routerAbNormalSigning
+	};
+}
+function parseD1WalletEd25519YaoSignerPublicResult(raw) {
+	const record = toRecordValue(raw);
+	if (!record || record.recoveryExportCapable !== true) return null;
+	const signerSlot = safeInteger(record.signerSlot);
+	const nearAccountId = normalizeOptionalTrimmedString(record.nearAccountId);
+	const nearEd25519SigningKeyId = normalizeOptionalTrimmedString(record.nearEd25519SigningKeyId);
+	const publicKey = normalizeOptionalTrimmedString(record.publicKey);
+	const relayerKeyId = normalizeOptionalTrimmedString(record.relayerKeyId);
+	const keyVersion = normalizeOptionalTrimmedString(record.keyVersion);
+	const participantIds = parseD1PositiveIntegerArray(record.participantIds);
+	if (signerSlot === null || signerSlot <= 0 || !nearAccountId || !nearEd25519SigningKeyId || !publicKey?.startsWith("ed25519:") || !relayerKeyId || !keyVersion || !participantIds || participantIds.length !== 2) return null;
+	const firstParticipantId = participantIds[0];
+	const secondParticipantId = participantIds[1];
+	if (firstParticipantId === void 0 || secondParticipantId === void 0) return null;
+	return {
+		signerSlot,
+		nearAccountId,
+		nearEd25519SigningKeyId,
+		publicKey,
+		relayerKeyId,
+		keyVersion,
+		recoveryExportCapable: true,
+		participantIds: [firstParticipantId, secondParticipantId]
+	};
+}
+function parseD1RegistrationNearAccountProvisioning(raw) {
+	const record = toRecordValue(raw);
+	if (!record) return null;
+	if (record.kind === "implicit_account" && record.accountIdSource === "ed25519_public_key") return {
+		kind: "implicit_account",
+		accountIdSource: "ed25519_public_key"
+	};
+	if (record.kind === "sponsored_named_account" && record.sponsor === "relayer") {
+		const requestedAccountId = parseNamedNearAccountId(record.requestedAccountId);
+		if (!requestedAccountId.ok) return null;
+		return {
+			kind: "sponsored_named_account",
+			requestedAccountId: requestedAccountId.value,
+			sponsor: "relayer"
+		};
+	}
+	return null;
+}
+function parseD1ResolvedRegistrationNearAccount(raw) {
+	const record = toRecordValue(raw);
+	if (!record) return null;
+	const nearEd25519SigningKeyId = normalizeOptionalTrimmedString(record.nearEd25519SigningKeyId);
+	if (!nearEd25519SigningKeyId) return null;
+	const signingKeyId = nearEd25519SigningKeyIdFromString(nearEd25519SigningKeyId);
+	if (record.kind === "implicit_account") {
+		const nearAccountId = parseImplicitNearAccountId(record.nearAccountId);
+		return nearAccountId.ok ? {
+			kind: "implicit_account",
+			nearAccountId: nearAccountId.value,
+			nearEd25519SigningKeyId: signingKeyId
+		} : null;
+	}
+	if (record.kind === "sponsored_named_account") {
+		const nearAccountId = parseNamedNearAccountId(record.nearAccountId);
+		const transactionHash = normalizeOptionalTrimmedString(record.transactionHash);
+		return nearAccountId.ok && transactionHash ? {
+			kind: "sponsored_named_account",
+			nearAccountId: nearAccountId.value,
+			nearEd25519SigningKeyId: signingKeyId,
+			transactionHash
+		} : null;
+	}
+	return null;
+}
+function parseD1WalletRegistrationFinalizeEcdsa(raw) {
+	const record = toRecordValue(raw);
+	if (!record || !Array.isArray(record.walletKeys) || record.walletKeys.length === 0) return null;
+	const walletKeys = [];
+	for (const walletKey of record.walletKeys) {
+		const parsed = parseD1WalletRegistrationEcdsaWalletKey(walletKey);
+		if (!parsed) return null;
+		walletKeys.push(parsed);
+	}
+	return { walletKeys };
+}
+function parseD1WalletRegistrationEcdsaWalletKey(raw) {
+	const record = toRecordValue(raw);
+	if (!record || record.keyScope !== "evm-family") return null;
+	const chainTarget = thresholdEcdsaChainTargetFromValue(record.chainTarget);
+	const walletId = normalizeOptionalTrimmedString(record.walletId);
+	const evmFamilySigningKeySlotId = normalizeOptionalTrimmedString(record.evmFamilySigningKeySlotId);
+	const keyHandle = normalizeOptionalTrimmedString(record.keyHandle);
+	const ecdsaThresholdKeyId = normalizeOptionalTrimmedString(record.ecdsaThresholdKeyId);
+	const signingRootId = normalizeOptionalTrimmedString(record.signingRootId);
+	const signingRootVersion = normalizeOptionalTrimmedString(record.signingRootVersion);
+	const thresholdEcdsaPublicKeyB64u = normalizeOptionalTrimmedString(record.thresholdEcdsaPublicKeyB64u);
+	const thresholdOwnerAddress = normalizeOptionalTrimmedString(record.thresholdOwnerAddress);
+	const relayerKeyId = normalizeOptionalTrimmedString(record.relayerKeyId);
+	const relayerVerifyingShareB64u = normalizeOptionalTrimmedString(record.relayerVerifyingShareB64u);
+	const contextBinding32B64u = normalizeOptionalTrimmedString(record.contextBinding32B64u);
+	const rawDerivationClientSharePublicKey33B64u = normalizeOptionalTrimmedString(record.derivationClientSharePublicKey33B64u);
+	const clientShareRetryCounter = safeInteger(record.clientShareRetryCounter);
+	const relayerShareRetryCounter = safeInteger(record.relayerShareRetryCounter);
+	const participantIds = parseD1PositiveIntegerArray(record.participantIds);
+	let publicCapability;
+	try {
+		publicCapability = parseRouterAbEcdsaDerivationPublicCapabilityV1(record.publicCapability);
+	} catch {
+		return null;
+	}
+	if (!chainTarget || !walletId || !evmFamilySigningKeySlotId || !keyHandle || !ecdsaThresholdKeyId || !signingRootId || !signingRootVersion || !thresholdEcdsaPublicKeyB64u || !thresholdOwnerAddress || !relayerKeyId || !relayerVerifyingShareB64u || !contextBinding32B64u || !rawDerivationClientSharePublicKey33B64u || clientShareRetryCounter === null || clientShareRetryCounter < 0 || relayerShareRetryCounter === null || relayerShareRetryCounter < 0 || !participantIds || participantIds.length !== 2 || participantIds[0] !== 1 || participantIds[1] !== 2) return null;
+	let derivationClientSharePublicKey33B64u;
+	try {
+		derivationClientSharePublicKey33B64u = derivationClientSharePublicKey33B64uFromString(rawDerivationClientSharePublicKey33B64u);
+	} catch {
+		return null;
+	}
+	return {
+		keyScope: "evm-family",
+		chainTarget,
+		walletId,
+		evmFamilySigningKeySlotId,
+		keyHandle,
+		ecdsaThresholdKeyId,
+		signingRootId,
+		signingRootVersion,
+		thresholdEcdsaPublicKeyB64u,
+		thresholdOwnerAddress,
+		relayerKeyId,
+		relayerVerifyingShareB64u,
+		contextBinding32B64u,
+		derivationClientSharePublicKey33B64u,
+		clientShareRetryCounter,
+		relayerShareRetryCounter,
+		participantIds: [1, 2],
+		publicCapability
+	};
+}
+function parseD1StoredWalletRegistrationSignerState(raw) {
+	const record = toRecordValue(raw);
+	if (!record) return null;
+	if (normalizeOptionalTrimmedString(record.kind) === "signer_set_registration") return parseD1StoredSignerSetRegistrationState(record);
+	return null;
+}
+function parseD1StoredSignerSetRegistrationState(record) {
+	if (!Array.isArray(record.branches)) return null;
+	const branches = [];
+	for (const rawBranch of record.branches) {
+		const branch = parseD1StoredSignerSetRegistrationBranch(rawBranch);
+		if (!branch) return null;
+		branches.push(branch);
+	}
+	return {
+		kind: "signer_set_registration",
+		branches
+	};
+}
+function parseD1StoredSignerSetRegistrationBranch(raw) {
+	const record = toRecordValue(raw);
+	if (!record) return null;
+	switch (normalizeOptionalTrimmedString(record.kind)) {
+		case "near_ed25519_yao_authorized": return parseD1StoredNearEd25519YaoAuthorizedBranch(record);
+		case "evm_family_ecdsa_prepared": return parseD1StoredEvmFamilyEcdsaPreparedBranch(record);
+		case "evm_family_ecdsa_response_claimed": return parseD1StoredEvmFamilyEcdsaResponseClaimedBranch(record);
+		case "evm_family_ecdsa_pending_activation": return parseD1StoredEvmFamilyEcdsaPendingActivationBranch(record);
+		case "evm_family_ecdsa_activation_claimed": return parseD1StoredEvmFamilyEcdsaActivationClaimedBranch(record);
+		case "evm_family_ecdsa_activated": return parseD1StoredEvmFamilyEcdsaActivatedBranch(record);
+		case "evm_family_ecdsa_finalized": return parseD1StoredEvmFamilyEcdsaFinalizedBranch(record);
+		default: return null;
+	}
+}
+function parseD1StoredNearEd25519YaoAuthorizedBranch(record) {
+	if (!hasExactKeys(record, [
+		"kind",
+		"branchKey",
+		"admissionRequest",
+		"admissionReceipt"
+	])) return null;
+	const branchKey = parseD1RegistrationSignerBranchKey(record.branchKey);
+	const admissionRequest = parseRouterAbEd25519YaoRegistrationAdmissionRequestV1(record.admissionRequest);
+	const admissionReceipt = parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1(record.admissionReceipt);
+	if (!branchKey || !admissionRequest.ok || !admissionReceipt.ok) return null;
+	return {
+		kind: "near_ed25519_yao_authorized",
+		branchKey,
+		admissionRequest: admissionRequest.value,
+		admissionReceipt: admissionReceipt.value
+	};
+}
+function parseD1WalletRegistrationCommittedInstallationProjection(raw) {
+	const record = toRecordValue(raw);
+	if (!record || !hasExactKeys(record, [
+		"kind",
+		"registrationCeremonyId",
+		"walletId",
+		"orgId",
+		"registrationAuthority",
+		"signerPlan",
+		"preparedContext",
+		"nearEd25519"
+	]) || record.kind !== "wallet_registration_committed_installation_projection_v1") return null;
+	const registrationCeremonyId = normalizeOptionalTrimmedString(record.registrationCeremonyId);
+	const walletId = parseWalletIdForIntent(record.walletId);
+	const orgId = parseOrgId(record.orgId);
+	if (!hasStrictRegistrationAuthorityRecord(record.registrationAuthority) || !hasStrictStoredRegistrationSignerPlan(record.signerPlan) || !hasStrictStoredWalletRegistrationPreparedContext(record.preparedContext)) return null;
+	const registrationAuthority = parseD1RegistrationAuthority(record.registrationAuthority);
+	const signerPlan = parseStoredRegistrationSignerPlan(record.signerPlan);
+	const preparedContext = parseStoredWalletRegistrationPreparedContext(record.preparedContext);
+	const nearEd25519Record = toRecordValue(record.nearEd25519);
+	if (!nearEd25519Record || !hasExactKeys(nearEd25519Record, [
+		"kind",
+		"branchKey",
+		"admissionRequest",
+		"admissionReceipt"
+	])) return null;
+	const nearEd25519 = nearEd25519Record ? parseD1StoredNearEd25519YaoAuthorizedBranch(nearEd25519Record) : null;
+	const planNearEd25519 = signerPlan ? signerPlan.branches.find((branch) => branch.kind === "near_ed25519") : void 0;
+	const planEvmFamilyEcdsa = signerPlan ? signerPlan.branches.find((branch) => branch.kind === "evm_family_ecdsa") : void 0;
+	if (!registrationCeremonyId || !walletId || !orgId.ok || !registrationAuthority || !signerPlan || !preparedContext || !nearEd25519 || !planNearEd25519 || !planEvmFamilyEcdsa || signerPlan.branches.length !== 2 || registrationAuthority.walletId !== walletId || nearEd25519.branchKey !== planNearEd25519.branchKey || nearEd25519.admissionRequest.application_binding.wallet_id !== walletId || nearEd25519.admissionRequest.application_binding.signing_root_id !== preparedContext.signingRootId || nearEd25519.admissionRequest.scope.lifecycle_id !== registrationCeremonyId || nearEd25519.admissionRequest.scope.root_share_epoch !== preparedContext.signingRootVersion || nearEd25519.admissionRequest.scope.account_id !== String(walletId) || nearEd25519.admissionRequest.scope.signer_set_id !== String(planNearEd25519.branchKey) || nearEd25519.admissionRequest.application_binding.key_creation_signer_slot !== planNearEd25519.signerSlot || nearEd25519.admissionRequest.participant_ids.length !== planNearEd25519.participantIds.length || nearEd25519.admissionRequest.participant_ids.some((participantId, index) => participantId !== planNearEd25519.participantIds[index]) || preparedContext.ecdsa.kind !== "evm_family_ecdsa_requested" || !thresholdEcdsaChainTargetsEqual(planEvmFamilyEcdsa.chainTargets, preparedContext.ecdsa.chainTargets) || preparedContext.runtimePolicy.kind === "runtime_policy_scope" && preparedContext.runtimePolicy.scope.signingRootVersion !== preparedContext.signingRootVersion || registrationAuthority.kind === "email_otp" && (registrationAuthority.finalWalletId !== walletId || registrationAuthority.orgId !== orgId.value) || preparedContext.runtimePolicy.kind !== "runtime_policy_scope" || preparedContext.runtimePolicy.scope.orgId !== orgId.value) return null;
+	return {
+		kind: "wallet_registration_committed_installation_projection_v1",
+		registrationCeremonyId,
+		walletId,
+		orgId: orgId.value,
+		registrationAuthority,
+		signerPlan,
+		preparedContext,
+		nearEd25519
+	};
+}
+function parseD1StoredEvmFamilyEcdsaPreparedBranch(record) {
+	const branchKey = parseD1RegistrationSignerBranchKey(record.branchKey);
+	const prepared = parseD1StoredEcdsaRegistrationBranchBase(record);
+	if (!branchKey || !prepared) return null;
+	return {
+		kind: "evm_family_ecdsa_prepared",
+		branchKey,
+		derivationKind: prepared.derivationKind,
+		chainTargets: prepared.chainTargets,
+		prepare: prepared.prepare,
+		strictRegistration: prepared.strictRegistration,
+		strictRegistrationBindingJson: prepared.strictRegistrationBindingJson
+	};
+}
+function parseD1StoredEvmFamilyEcdsaResponseClaimedBranch(record) {
+	const branchKey = parseD1RegistrationSignerBranchKey(record.branchKey);
+	const prepared = parseD1StoredEcdsaRegistrationBranchBase(record);
+	if (!branchKey || !prepared) return null;
+	try {
+		return {
+			kind: "evm_family_ecdsa_response_claimed",
+			branchKey,
+			derivationKind: prepared.derivationKind,
+			chainTargets: prepared.chainTargets,
+			prepare: prepared.prepare,
+			strictRegistration: prepared.strictRegistration,
+			strictRegistrationBindingJson: prepared.strictRegistrationBindingJson,
+			registrationRequest: parseRouterAbEcdsaRegistrationRequestV1(record.registrationRequest)
+		};
+	} catch {
+		return null;
+	}
+}
+function parseD1StoredEvmFamilyEcdsaPendingActivationBranch(record) {
+	const branchKey = parseD1RegistrationSignerBranchKey(record.branchKey);
+	const prepared = parseD1StoredEcdsaRegistrationBranchBase(record);
+	if (!branchKey || !prepared) return null;
+	try {
+		return {
+			kind: "evm_family_ecdsa_pending_activation",
+			branchKey,
+			derivationKind: prepared.derivationKind,
+			chainTargets: prepared.chainTargets,
+			prepare: prepared.prepare,
+			strictRegistration: prepared.strictRegistration,
+			strictRegistrationBindingJson: prepared.strictRegistrationBindingJson,
+			registrationRequest: parseRouterAbEcdsaRegistrationRequestV1(record.registrationRequest),
+			pendingActivation: parseStoredRouterAbEcdsaPendingActivationV1(record.pendingActivation),
+			publicResponse: parseRouterAbEcdsaStrictForwardedRegistrationResponseV1(record.publicResponse)
+		};
+	} catch {
+		return null;
+	}
+}
+function parseD1StoredEvmFamilyEcdsaActivationClaimedBranch(record) {
+	const branchKey = parseD1RegistrationSignerBranchKey(record.branchKey);
+	const prepared = parseD1StoredEcdsaRegistrationBranchBase(record);
+	if (!branchKey || !prepared) return null;
+	try {
+		return {
+			kind: "evm_family_ecdsa_activation_claimed",
+			branchKey,
+			derivationKind: prepared.derivationKind,
+			chainTargets: prepared.chainTargets,
+			prepare: prepared.prepare,
+			strictRegistration: prepared.strictRegistration,
+			strictRegistrationBindingJson: prepared.strictRegistrationBindingJson,
+			registrationRequest: parseRouterAbEcdsaRegistrationRequestV1(record.registrationRequest),
+			pendingActivation: parseStoredRouterAbEcdsaPendingActivationV1(record.pendingActivation),
+			publicResponse: parseRouterAbEcdsaStrictForwardedRegistrationResponseV1(record.publicResponse),
+			publicFacts: parseRouterAbEcdsaVerifiedClientActivationFactsV1(record.publicFacts),
+			activationRequestDigestB64u: parseDigestB64u(record.activationRequestDigestB64u),
+			activationOwner: typeof record.activationOwner === "string" ? record.activationOwner : ""
+		};
+	} catch {
+		return null;
+	}
+}
+function parseD1StoredEvmFamilyEcdsaActivatedBranch(record) {
+	const branchKey = parseD1RegistrationSignerBranchKey(record.branchKey);
+	const prepared = parseD1StoredEcdsaRegistrationBranchBase(record);
+	const bootstrap = parseD1EcdsaDerivationServerBootstrapResponse(record.bootstrap);
+	if (!branchKey || !prepared || !bootstrap) return null;
+	try {
+		return {
+			kind: "evm_family_ecdsa_activated",
+			branchKey,
+			derivationKind: prepared.derivationKind,
+			chainTargets: prepared.chainTargets,
+			prepare: prepared.prepare,
+			strictRegistration: prepared.strictRegistration,
+			strictRegistrationBindingJson: prepared.strictRegistrationBindingJson,
+			registrationRequest: parseRouterAbEcdsaRegistrationRequestV1(record.registrationRequest),
+			publicFacts: parseRouterAbEcdsaVerifiedClientActivationFactsV1(record.publicFacts),
+			activation: parseRouterAbEcdsaRegistrationActivationReceiptV1(record.activation),
+			publicCapability: parseRouterAbEcdsaDerivationPublicCapabilityV1(record.publicCapability),
+			bootstrap,
+			activationOwner: typeof record.activationOwner === "string" ? record.activationOwner : ""
+		};
+	} catch {
+		return null;
+	}
+}
+function parseD1StoredEvmFamilyEcdsaFinalizedBranch(record) {
+	const branchKey = parseD1RegistrationSignerBranchKey(record.branchKey);
+	const prepared = parseD1StoredEcdsaRegistrationBranchBase(record);
+	const bootstrap = parseD1EcdsaDerivationServerBootstrapResponse(record.bootstrap);
+	const finalizedAtMs = safeInteger(record.finalizedAtMs);
+	if (!branchKey || !prepared || !bootstrap || finalizedAtMs === null) return null;
+	try {
+		return {
+			kind: "evm_family_ecdsa_finalized",
+			branchKey,
+			derivationKind: prepared.derivationKind,
+			chainTargets: prepared.chainTargets,
+			prepare: prepared.prepare,
+			strictRegistration: prepared.strictRegistration,
+			strictRegistrationBindingJson: prepared.strictRegistrationBindingJson,
+			registrationRequest: parseRouterAbEcdsaRegistrationRequestV1(record.registrationRequest),
+			publicFacts: parseRouterAbEcdsaVerifiedClientActivationFactsV1(record.publicFacts),
+			activation: parseRouterAbEcdsaRegistrationActivationReceiptV1(record.activation),
+			publicCapability: parseRouterAbEcdsaDerivationPublicCapabilityV1(record.publicCapability),
+			bootstrap,
+			finalizedAtMs
+		};
+	} catch {
+		return null;
+	}
+}
+function parseD1RegistrationSignerBranchKey(raw) {
+	const value = normalizeOptionalTrimmedString(raw);
+	if (!value) return null;
+	try {
+		return registrationSignerBranchKeyFromString(value);
+	} catch {
+		return null;
+	}
+}
+function parseD1StoredEcdsaRegistrationBase(record) {
+	const derivationKind = normalizeOptionalTrimmedString(record.derivationKind);
+	const chainTargets = parseD1ThresholdEcdsaChainTargets(record.chainTargets);
+	const prepare = parseD1WalletRegistrationEcdsaPrepare(record.prepare);
+	if (derivationKind !== "evm_family_ecdsa_keygen" || !chainTargets || !prepare) return null;
+	try {
+		return {
+			derivationKind,
+			chainTargets,
+			prepare,
+			strictRegistration: parseRouterAbEcdsaRegistrationRequestFactsV1(record.strictRegistration)
+		};
+	} catch {
+		return null;
+	}
+}
+/**
+* Registration branch rows additionally persist the strict-registration
+* binding JSON: branch convergence compares it byte-for-byte, so a branch row
+* without one is unusable. Add-signer rows never carry the field — their
+* replay check matches the request against the stored facts instead — so the
+* shared base above must not demand it: doing so made every stored ECDSA
+* add-signer ceremony unreadable, surfacing as `not_found` mid-ceremony.
+*/
+function parseD1StoredEcdsaRegistrationBranchBase(record) {
+	const prepared = parseD1StoredEcdsaRegistrationBase(record);
+	const strictRegistrationBindingJson = normalizeOptionalTrimmedString(record.strictRegistrationBindingJson);
+	if (!prepared || !strictRegistrationBindingJson) return null;
+	return {
+		...prepared,
+		strictRegistrationBindingJson
+	};
+}
+function parseD1StoredAddSignerIntent(raw) {
+	const record = toRecordValue(raw);
+	if (!record || record.kind !== "add_signer_intent_allocated") return null;
+	const grant = addSignerIntentGrantFromString(normalizeOptionalTrimmedString(record.grant) || "");
+	const intent = parseD1AddSignerIntent(record.intent);
+	const digestB64u = normalizeOptionalTrimmedString(record.digestB64u);
+	const orgId = normalizeOptionalTrimmedString(record.orgId);
+	const expiresAtMs = safeInteger(record.expiresAtMs);
+	if (!grant || !intent || !digestB64u || !orgId || expiresAtMs === null) return null;
+	return {
+		kind: "add_signer_intent_allocated",
+		grant,
+		intent,
+		digestB64u,
+		orgId,
+		expiresAtMs,
+		...intentScopeMetadata(record)
+	};
+}
+function parseD1AddSignerIntent(raw) {
+	const record = toRecordValue(raw);
+	if (!record || record.version !== "add_signer_intent_v1") return null;
+	const walletId = parseWalletIdForIntent(record.walletId);
+	const signerSelection = normalizeAddSignerSelection(record.signerSelection, { normalizeEcdsaChainTarget: thresholdEcdsaChainTargetFromValue });
+	const nonceB64u = normalizeOptionalTrimmedString(record.nonceB64u);
+	const runtimePolicyScope = parseD1RuntimePolicyScope(record.runtimePolicyScope);
+	if (!walletId || !signerSelection.ok || !nonceB64u) return null;
+	if (record.runtimePolicyScope !== void 0 && !runtimePolicyScope) return null;
+	if (runtimePolicyScope) return {
+		version: "add_signer_intent_v1",
+		walletId,
+		signerSelection: signerSelection.value,
+		runtimePolicyScope,
+		nonceB64u
+	};
+	return {
+		version: "add_signer_intent_v1",
+		walletId,
+		signerSelection: signerSelection.value,
+		nonceB64u
+	};
+}
+function parseD1StoredWalletAddSignerCeremony(raw) {
+	const record = toRecordValue(raw);
+	if (!record) return null;
+	const addSignerCeremonyId = normalizeOptionalTrimmedString(record.addSignerCeremonyId);
+	const intent = parseD1AddSignerIntent(record.intent);
+	const digestB64u = normalizeOptionalTrimmedString(record.digestB64u);
+	const orgId = normalizeOptionalTrimmedString(record.orgId);
+	const signingRootId = normalizeOptionalTrimmedString(record.signingRootId);
+	const signingRootVersion = normalizeOptionalTrimmedString(record.signingRootVersion);
+	const expiresAtMs = safeInteger(record.expiresAtMs);
+	const auth = parseD1StoredAddSignerAuth(record.auth);
+	const signerState = parseD1StoredWalletAddSignerSignerState(record.signerState);
+	if (!addSignerCeremonyId || !intent || !digestB64u || !orgId || !signingRootId || !signingRootVersion || expiresAtMs === null || !auth || !signerState) return null;
+	if ((signerState.kind === "near_ed25519_yao_add_signer_activated" || signerState.kind === "near_ed25519_yao_add_signer_finalizing") && signerState.finalizeRequest.addSignerCeremonyId !== addSignerCeremonyId) return null;
+	return {
+		addSignerCeremonyId,
+		intent,
+		digestB64u,
+		orgId,
+		signingRootId,
+		signingRootVersion,
+		expiresAtMs,
+		auth,
+		signerState
+	};
+}
+function parseD1StoredAddSignerAuth(raw) {
+	const record = toRecordValue(raw);
+	if (normalizeOptionalTrimmedString(record?.kind) === "webauthn_assertion") {
+		const rpId = normalizeOptionalTrimmedString(record?.rpId);
+		const credentialIdB64u = normalizeOptionalTrimmedString(record?.credentialIdB64u);
+		return rpId && credentialIdB64u ? {
+			kind: "webauthn_assertion",
+			rpId,
+			credentialIdB64u
+		} : null;
+	}
+	return null;
+}
+function parseD1StoredWalletAddSignerSignerState(raw) {
+	const record = toRecordValue(raw);
+	if (!record) return null;
+	const kind = normalizeOptionalTrimmedString(record.kind);
+	if (kind === "near_ed25519_yao_add_signer_authorized") {
+		const admissionRequest = parseRouterAbEd25519YaoRegistrationAdmissionRequestV1(record.admissionRequest);
+		return admissionRequest.ok ? {
+			kind: "near_ed25519_yao_add_signer_authorized",
+			admissionRequest: admissionRequest.value
+		} : null;
+	}
+	if (kind === "near_ed25519_yao_add_signer_activated" || kind === "near_ed25519_yao_add_signer_finalizing") {
+		const activation = parseD1StoredEd25519YaoAddSignerActivation(record);
+		if (!activation) return null;
+		if (kind === "near_ed25519_yao_add_signer_activated") return {
+			kind: "near_ed25519_yao_add_signer_activated",
+			...activation
+		};
+		const response = parseD1WalletAddSignerFinalizeSuccessResponse(record.response);
+		const signer = parseWalletEd25519SignerRecord(record.signer);
+		const finalizingAtMs = safeInteger(record.finalizingAtMs);
+		if (!response || response.kind !== "near_ed25519" || !signer || finalizingAtMs === null || finalizingAtMs <= 0) return null;
+		return {
+			kind: "near_ed25519_yao_add_signer_finalizing",
+			...activation,
+			response,
+			signer,
+			finalizingAtMs
+		};
+	}
+	if (kind === "ecdsa_add_signer_prepared") return parseD1StoredEcdsaAddSignerPrepared(record);
+	if (kind === "ecdsa_add_signer_pending_activation") return parseD1StoredEcdsaAddSignerPendingActivation(record);
+	if (kind === "ecdsa_add_signer_activation_claimed") return parseD1StoredEcdsaAddSignerActivationClaimed(record);
+	if (kind === "ecdsa_add_signer_activated") return parseD1StoredEcdsaAddSignerActivated(record);
+	return null;
+}
+function parseD1StoredEd25519YaoAddSignerActivation(record) {
+	const activation = toRecordValue(record.activation);
+	const finalizeRequest = parseD1WalletAddSignerFinalizeRequest(record.finalizeRequest);
+	const admissionRequest = parseRouterAbEd25519YaoRegistrationAdmissionRequestV1(activation?.admissionRequest);
+	const admissionReceipt = parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1(activation?.admissionReceipt);
+	const result = parseRouterAbEd25519YaoRegistrationActivationResultV1(activation?.result);
+	if (!finalizeRequest || finalizeRequest.kind !== "near_ed25519" || !admissionRequest.ok || !admissionReceipt.ok || !result.ok) return null;
+	const lifecycleId = finalizeRequest.activationReference.lifecycleId;
+	const sessionId = finalizeRequest.activationReference.sessionId;
+	if (!sessionId || lifecycleId !== admissionRequest.value.scope.lifecycle_id || !d1ByteArraysEqual(sessionId, admissionReceipt.value.binding.session_id) || !d1ByteArraysEqual(sessionId, result.value.binding.session_id)) return null;
+	return {
+		finalizeRequest,
+		activation: {
+			admissionRequest: admissionRequest.value,
+			admissionReceipt: admissionReceipt.value,
+			result: result.value
+		}
+	};
+}
+function parseD1WalletAddSignerFinalizeRequest(raw) {
+	const record = toRecordValue(raw);
+	const addSignerCeremonyId = normalizeOptionalTrimmedString(record?.addSignerCeremonyId);
+	const idempotencyKey = normalizeOptionalTrimmedString(record?.idempotencyKey);
+	if (!record || !addSignerCeremonyId || !idempotencyKey) return null;
+	if (record.kind === "near_ed25519") {
+		const custodyKeySet = toRecordValue(record.custodyKeySet);
+		const activationReference = toRecordValue(record.activationReference);
+		const lifecycleId = normalizeOptionalTrimmedString(activationReference?.lifecycleId);
+		const sessionId = parseD1Bytes32(activationReference?.sessionId);
+		if (custodyKeySet?.kind !== "near_ed25519_v1" || !lifecycleId || !sessionId) return null;
+		let keyManifestDigestB64u;
+		try {
+			keyManifestDigestB64u = parseDigestB64u(custodyKeySet.keyManifestDigestB64u);
+		} catch {
+			return null;
+		}
+		const registeredPublicKeyB64u = normalizeOptionalTrimmedString(custodyKeySet.registeredPublicKeyB64u);
+		if (!registeredPublicKeyB64u) return null;
+		return {
+			kind: "near_ed25519",
+			addSignerCeremonyId,
+			idempotencyKey,
+			custodyKeySet: {
+				kind: "near_ed25519_v1",
+				keyManifestDigestB64u,
+				registeredPublicKeyB64u
+			},
+			activationReference: {
+				lifecycleId,
+				sessionId
+			}
+		};
+	}
+	if (record.kind !== "evm_family_ecdsa" || !Array.isArray(record.expectedKeyHandles) || record.expectedKeyHandles.length !== 1) return null;
+	const expectedKeyHandle = normalizeOptionalTrimmedString(record.expectedKeyHandles[0]);
+	const custodyKeySet = toRecordValue(record.custodyKeySet);
+	if (!expectedKeyHandle || custodyKeySet?.kind !== "evm_family_ecdsa_v1") return null;
+	let keyManifestDigestB64u;
+	let clientRootPublicKey33B64u;
+	try {
+		keyManifestDigestB64u = parseDigestB64u(custodyKeySet.keyManifestDigestB64u);
+		clientRootPublicKey33B64u = ecdsaClientRootPublicKey33B64uFromString(String(custodyKeySet.clientRootPublicKey33B64u ?? ""));
+	} catch {
+		return null;
+	}
+	return {
+		kind: "evm_family_ecdsa",
+		addSignerCeremonyId,
+		idempotencyKey,
+		custodyKeySet: {
+			kind: "evm_family_ecdsa_v1",
+			keyManifestDigestB64u,
+			clientRootPublicKey33B64u
+		},
+		expectedKeyHandles: [expectedKeyHandle]
+	};
+}
+function parseD1Bytes32(raw) {
+	if (!Array.isArray(raw) || raw.length !== 32) return null;
+	const bytes = [];
+	for (const byte of raw) {
+		if (!Number.isInteger(byte) || Number(byte) < 0 || Number(byte) > 255) return null;
+		bytes.push(Number(byte));
+	}
+	return bytes;
+}
+function d1ByteArraysEqual(left, right) {
+	return left.length === right.length && left.every((byte, index) => byte === right[index]);
+}
+function parseD1StoredEcdsaAddSignerPrepared(record) {
+	const prepared = parseD1StoredEcdsaRegistrationBase(record);
+	if (!prepared) return null;
+	return {
+		kind: "ecdsa_add_signer_prepared",
+		derivationKind: prepared.derivationKind,
+		chainTargets: prepared.chainTargets,
+		prepare: prepared.prepare,
+		strictRegistration: prepared.strictRegistration
+	};
+}
+function parseD1StoredEcdsaAddSignerPendingActivation(record) {
+	const prepared = parseD1StoredEcdsaRegistrationBase(record);
+	if (!prepared) return null;
+	try {
+		return {
+			kind: "ecdsa_add_signer_pending_activation",
+			derivationKind: prepared.derivationKind,
+			chainTargets: prepared.chainTargets,
+			prepare: prepared.prepare,
+			strictRegistration: prepared.strictRegistration,
+			registrationRequest: parseRouterAbEcdsaRegistrationRequestV1(record.registrationRequest),
+			pendingActivation: parseStoredRouterAbEcdsaPendingActivationV1(record.pendingActivation),
+			publicResponse: parseRouterAbEcdsaStrictForwardedRegistrationResponseV1(record.publicResponse)
+		};
+	} catch {
+		return null;
+	}
+}
+function parseD1StoredEcdsaAddSignerActivationClaimed(record) {
+	const prepared = parseD1StoredEcdsaRegistrationBase(record);
+	if (!prepared) return null;
+	try {
+		return {
+			kind: "ecdsa_add_signer_activation_claimed",
+			derivationKind: prepared.derivationKind,
+			chainTargets: prepared.chainTargets,
+			prepare: prepared.prepare,
+			strictRegistration: prepared.strictRegistration,
+			registrationRequest: parseRouterAbEcdsaRegistrationRequestV1(record.registrationRequest),
+			pendingActivation: parseStoredRouterAbEcdsaPendingActivationV1(record.pendingActivation),
+			publicResponse: parseRouterAbEcdsaStrictForwardedRegistrationResponseV1(record.publicResponse),
+			publicFacts: parseRouterAbEcdsaVerifiedClientActivationFactsV1(record.publicFacts),
+			activationRequestDigestB64u: parseDigestB64u(record.activationRequestDigestB64u)
+		};
+	} catch {
+		return null;
+	}
+}
+function parseD1StoredEcdsaAddSignerActivated(record) {
+	const prepared = parseD1StoredEcdsaRegistrationBase(record);
+	const bootstrap = parseD1EcdsaDerivationServerBootstrapResponse(record.bootstrap);
+	if (!prepared || !bootstrap) return null;
+	try {
+		return {
+			kind: "ecdsa_add_signer_activated",
+			derivationKind: prepared.derivationKind,
+			chainTargets: prepared.chainTargets,
+			prepare: prepared.prepare,
+			strictRegistration: prepared.strictRegistration,
+			registrationRequest: parseRouterAbEcdsaRegistrationRequestV1(record.registrationRequest),
+			publicFacts: parseRouterAbEcdsaVerifiedClientActivationFactsV1(record.publicFacts),
+			activationRequestDigestB64u: parseDigestB64u(record.activationRequestDigestB64u),
+			activation: parseRouterAbEcdsaRegistrationActivationReceiptV1(record.activation),
+			publicCapability: parseRouterAbEcdsaDerivationPublicCapabilityV1(record.publicCapability),
+			bootstrap
+		};
+	} catch {
+		return null;
+	}
+}
+function parseD1ThresholdEcdsaChainTargets(raw) {
+	if (!Array.isArray(raw) || raw.length === 0) return null;
+	const targets = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const rawTarget of raw) {
+		const target = thresholdEcdsaChainTargetFromValue(rawTarget);
+		if (!target) return null;
+		const targetKey = thresholdEcdsaChainTargetKey(target);
+		if (seen.has(targetKey)) return null;
+		seen.add(targetKey);
+		targets.push(target);
+	}
+	const firstTarget = targets[0];
+	return firstTarget ? [firstTarget, ...targets.slice(1)] : null;
+}
+function parseD1EcdsaParticipantPair(raw) {
+	if (!Array.isArray(raw) || raw.length !== 2 || raw[0] !== 1 || raw[1] !== 2) return null;
+	return [1, 2];
+}
+function parseD1WalletRegistrationEcdsaPrepare(raw) {
+	const record = toRecordValue(raw);
+	if (!record || record.formatVersion !== "ecdsa-derivation-role-local") return null;
+	if ("authorizationSessionId" in record || "walletSessionId" in record || "quotaId" in record || "jwt" in record) return null;
+	if (record.keyScope !== "evm-family") return null;
+	const registrationPreparationId = normalizeOptionalTrimmedString(record.registrationPreparationId);
+	const walletId = normalizeOptionalTrimmedString(record.walletId);
+	const evmFamilySigningKeySlotId = normalizeOptionalTrimmedString(record.evmFamilySigningKeySlotId);
+	const ecdsaThresholdKeyId = normalizeOptionalTrimmedString(record.ecdsaThresholdKeyId);
+	const signingRootId = normalizeOptionalTrimmedString(record.signingRootId);
+	const signingRootVersion = normalizeOptionalTrimmedString(record.signingRootVersion);
+	const relayerKeyId = normalizeOptionalTrimmedString(record.relayerKeyId);
+	const requestId = normalizeOptionalTrimmedString(record.requestId);
+	const thresholdSessionId = normalizeOptionalTrimmedString(record.thresholdSessionId);
+	const ttlMs = safeInteger(record.ttlMs);
+	const remainingUses = safeInteger(record.remainingUses);
+	const participantIds = parseD1EcdsaParticipantPair(record.participantIds);
+	const runtimePolicyScope = parseD1RuntimePolicyScope(record.runtimePolicyScope);
+	if (!registrationPreparationId || !walletId || !evmFamilySigningKeySlotId || !ecdsaThresholdKeyId || !signingRootId || !signingRootVersion || !relayerKeyId || !requestId || !thresholdSessionId || ttlMs === null || remainingUses === null || !participantIds || !runtimePolicyScope) return null;
+	return {
+		formatVersion: "ecdsa-derivation-role-local",
+		walletId,
+		evmFamilySigningKeySlotId,
+		ecdsaThresholdKeyId,
+		signingRootId,
+		signingRootVersion,
+		keyScope: "evm-family",
+		relayerKeyId,
+		registrationPreparationId: registrationPreparationIdFromString(registrationPreparationId),
+		requestId,
+		thresholdSessionId,
+		ttlMs,
+		remainingUses,
+		participantIds,
+		runtimePolicyScope
+	};
+}
+function parseD1EcdsaDerivationServerBootstrapResponse(raw) {
+	const record = toRecordValue(raw);
+	if (!record || record.formatVersion !== "ecdsa-derivation-role-local") return null;
+	const walletId = normalizeOptionalTrimmedString(record.walletId);
+	const evmFamilySigningKeySlotId = normalizeOptionalTrimmedString(record.evmFamilySigningKeySlotId);
+	const ecdsaThresholdKeyId = normalizeOptionalTrimmedString(record.ecdsaThresholdKeyId);
+	const relayerKeyId = normalizeOptionalTrimmedString(record.relayerKeyId);
+	const applicationBindingDigestB64u = normalizeOptionalTrimmedString(record.applicationBindingDigestB64u);
+	const contextBinding32B64u = normalizeOptionalTrimmedString(record.contextBinding32B64u);
+	const publicIdentity = parseD1EcdsaDerivationPublicIdentity(record.publicIdentity);
+	const clientShareRetryCounter = safeInteger(record.clientShareRetryCounter);
+	const relayerShareRetryCounter = safeInteger(record.relayerShareRetryCounter);
+	const publicTranscriptDigest32B64u = normalizeOptionalTrimmedString(record.publicTranscriptDigest32B64u);
+	const keyHandle = normalizeOptionalTrimmedString(record.keyHandle);
+	const signingRootId = normalizeOptionalTrimmedString(record.signingRootId);
+	const signingRootVersion = normalizeOptionalTrimmedString(record.signingRootVersion);
+	const thresholdEcdsaPublicKeyB64u = normalizeOptionalTrimmedString(record.thresholdEcdsaPublicKeyB64u);
+	const ethereumAddress = normalizeOptionalTrimmedString(record.ethereumAddress);
+	const relayerVerifyingShareB64u = normalizeOptionalTrimmedString(record.relayerVerifyingShareB64u);
+	const participantIds = parseD1EcdsaParticipantPair(record.participantIds);
+	const thresholdSessionId = normalizeOptionalTrimmedString(record.thresholdSessionId);
+	const activationEpochResult = parseRootShareEpoch(record.activationEpoch);
+	const activationEpoch = activationEpochResult.ok ? activationEpochResult.value : null;
+	const expiresAtMs = safeInteger(record.expiresAtMs);
+	const expiresAt = normalizeOptionalTrimmedString(record.expiresAt);
+	const remainingUses = safeInteger(record.remainingUses);
+	const routerAbEcdsaDerivationNormalSigning = parseRouterAbEcdsaDerivationNormalSigningStateV1(record.routerAbEcdsaDerivationNormalSigning);
+	if (!walletId || !evmFamilySigningKeySlotId || !ecdsaThresholdKeyId || !relayerKeyId || !applicationBindingDigestB64u || !contextBinding32B64u || !publicIdentity || clientShareRetryCounter === null || relayerShareRetryCounter === null || !publicTranscriptDigest32B64u || !keyHandle || !signingRootId || !signingRootVersion || !thresholdEcdsaPublicKeyB64u || !ethereumAddress || !relayerVerifyingShareB64u || !participantIds || !thresholdSessionId || !activationEpoch || expiresAtMs === null || !expiresAt || remainingUses === null || !routerAbEcdsaDerivationNormalSigning) return null;
+	return {
+		formatVersion: "ecdsa-derivation-role-local",
+		walletId,
+		evmFamilySigningKeySlotId,
+		ecdsaThresholdKeyId,
+		relayerKeyId,
+		applicationBindingDigestB64u,
+		contextBinding32B64u,
+		publicIdentity,
+		clientShareRetryCounter,
+		relayerShareRetryCounter,
+		publicTranscriptDigest32B64u,
+		keyHandle,
+		signingRootId,
+		signingRootVersion,
+		thresholdEcdsaPublicKeyB64u,
+		ethereumAddress,
+		relayerVerifyingShareB64u,
+		participantIds: [...participantIds],
+		thresholdSessionId,
+		activationEpoch,
+		expiresAtMs,
+		expiresAt,
+		remainingUses,
+		routerAbEcdsaDerivationNormalSigning
+	};
+}
+function parseD1EcdsaDerivationPublicIdentity(raw) {
+	const record = toRecordValue(raw);
+	if (!record || !hasExactKeys(record, [
+		"derivationClientSharePublicKey33B64u",
+		"relayerPublicKey33B64u",
+		"groupPublicKey33B64u",
+		"ethereumAddress"
+	])) return null;
+	return parseEcdsaDerivationPublicIdentity({
+		derivationClientSharePublicKey33B64u: normalizeOptionalTrimmedString(record.derivationClientSharePublicKey33B64u),
+		relayerPublicKey33B64u: normalizeOptionalTrimmedString(record.relayerPublicKey33B64u),
+		groupPublicKey33B64u: normalizeOptionalTrimmedString(record.groupPublicKey33B64u),
+		ethereumAddress: normalizeOptionalTrimmedString(record.ethereumAddress)
+	});
+}
+function runtimePolicyScopeMatches(left, right) {
+	if (!left && !right) return true;
+	if (!left || !right) return false;
+	return left.orgId === right.orgId && left.projectId === right.projectId && left.envId === right.envId && left.signingRootVersion === right.signingRootVersion;
+}
+function positiveIntegerArraysEqual(left, right) {
+	if (left.length !== right.length) return false;
+	for (let index = 0; index < left.length; index += 1) if (left[index] !== right[index]) return false;
+	return true;
+}
+function thresholdEcdsaChainTargetsEqual(left, right) {
+	const leftTargets = normalizeThresholdEcdsaChainTargets(left);
+	const rightTargets = normalizeThresholdEcdsaChainTargets(right);
+	if (!leftTargets || !rightTargets || leftTargets.length !== rightTargets.length) return false;
+	for (let index = 0; index < leftTargets.length; index += 1) if (thresholdEcdsaChainTargetKey(leftTargets[index]) !== thresholdEcdsaChainTargetKey(rightTargets[index])) return false;
+	return true;
+}
+function isMatchingD1EcdsaClientBootstrap(input) {
+	const expected = input.expected;
+	const actual = input.actual;
+	return actual.formatVersion === expected.formatVersion && actual.walletId === expected.walletId && actual.evmFamilySigningKeySlotId === expected.evmFamilySigningKeySlotId && actual.ecdsaThresholdKeyId === expected.ecdsaThresholdKeyId && actual.signingRootId === expected.signingRootId && actual.signingRootVersion === expected.signingRootVersion && actual.keyScope === expected.keyScope && actual.relayerKeyId === expected.relayerKeyId && actual.registrationPreparationId === expected.registrationPreparationId && actual.requestId === expected.requestId && actual.thresholdSessionId === expected.thresholdSessionId && actual.ttlMs === expected.ttlMs && actual.remainingUses === expected.remainingUses && positiveIntegerArraysEqual(actual.participantIds, expected.participantIds) && runtimePolicyScopeMatches(actual.runtimePolicyScope, expected.runtimePolicyScope);
+}
+function toD1EcdsaDerivationClientBootstrapRequest(clientBootstrap) {
+	return {
+		formatVersion: clientBootstrap.formatVersion,
+		walletId: clientBootstrap.walletId,
+		evmFamilySigningKeySlotId: requireEvmFamilySigningKeySlotId(clientBootstrap.evmFamilySigningKeySlotId),
+		ecdsaThresholdKeyId: clientBootstrap.ecdsaThresholdKeyId,
+		signingRootId: clientBootstrap.signingRootId,
+		signingRootVersion: clientBootstrap.signingRootVersion,
+		keyScope: clientBootstrap.keyScope,
+		relayerKeyId: clientBootstrap.relayerKeyId,
+		registrationPreparationId: clientBootstrap.registrationPreparationId,
+		derivationClientSharePublicKey33B64u: clientBootstrap.derivationClientSharePublicKey33B64u,
+		clientShareRetryCounter: clientBootstrap.clientShareRetryCounter,
+		contextBinding32B64u: clientBootstrap.contextBinding32B64u,
+		requestId: clientBootstrap.requestId,
+		sessionId: clientBootstrap.thresholdSessionId,
+		ttlMs: clientBootstrap.ttlMs,
+		remainingUses: clientBootstrap.remainingUses,
+		participantIds: [...clientBootstrap.participantIds],
+		runtimePolicyScope: clientBootstrap.runtimePolicyScope
+	};
+}
+function buildD1EcdsaWalletKeysFromBootstrap(input) {
+	if (input.bootstraps.length === 0) return {
+		ok: false,
+		code: "incomplete_ecdsa_wallet_key",
+		message: `${input.errorContext} has no ECDSA chain targets`
+	};
+	const walletKeys = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const targetBootstrap of input.bootstraps) {
+		const targetKey = thresholdEcdsaChainTargetKey(targetBootstrap.chainTarget);
+		if (seen.has(targetKey)) return {
+			ok: false,
+			code: "incomplete_ecdsa_wallet_key",
+			message: `${input.errorContext} returned duplicate ECDSA wallet key material for ${targetKey}`
+		};
+		seen.add(targetKey);
+		const walletKey = buildD1EcdsaWalletKeyFromBootstrap({
+			bootstrap: targetBootstrap.bootstrap,
+			chainTarget: targetBootstrap.chainTarget,
+			publicCapability: input.publicCapability,
+			errorContext: input.errorContext
+		});
+		if (!walletKey.ok) return walletKey;
+		walletKeys.push(walletKey.walletKey);
+	}
+	const sharedMaterial = requireSharedD1EvmFamilyWalletKeyMaterial({
+		walletKeys,
+		errorContext: input.errorContext
+	});
+	if (!sharedMaterial.ok) return sharedMaterial;
+	return {
+		ok: true,
+		walletKeys
+	};
+}
+function requireSharedD1EvmFamilyWalletKeyMaterial(input) {
+	const first = input.walletKeys[0];
+	if (!first) return { ok: true };
+	for (const walletKey of input.walletKeys.slice(1)) {
+		const mismatch = firstD1EvmFamilyWalletKeyMaterialMismatch(first, walletKey);
+		if (!mismatch) continue;
+		return {
+			ok: false,
+			code: "incomplete_ecdsa_wallet_key",
+			message: `${input.errorContext} returned partitioned EVM-family wallet key material: ${mismatch}`
+		};
+	}
+	return { ok: true };
+}
+function firstD1EvmFamilyWalletKeyMaterialMismatch(left, right) {
+	if (left.keyScope !== "evm-family" || right.keyScope !== "evm-family") return "keyScope";
+	if (left.walletId !== right.walletId) return "walletId";
+	if (left.evmFamilySigningKeySlotId !== right.evmFamilySigningKeySlotId) return "evmFamilySigningKeySlotId";
+	if (left.keyHandle !== right.keyHandle) return "keyHandle";
+	if (left.ecdsaThresholdKeyId !== right.ecdsaThresholdKeyId) return "ecdsaThresholdKeyId";
+	if (left.signingRootId !== right.signingRootId) return "signingRootId";
+	if (left.signingRootVersion !== right.signingRootVersion) return "signingRootVersion";
+	if (left.thresholdEcdsaPublicKeyB64u !== right.thresholdEcdsaPublicKeyB64u) return "thresholdEcdsaPublicKeyB64u";
+	if (normalizeD1EvmFamilyOwnerAddress(left.thresholdOwnerAddress) !== normalizeD1EvmFamilyOwnerAddress(right.thresholdOwnerAddress)) return "thresholdOwnerAddress";
+	if (left.relayerKeyId !== right.relayerKeyId) return "relayerKeyId";
+	if (left.relayerVerifyingShareB64u !== right.relayerVerifyingShareB64u) return "relayerVerifyingShareB64u";
+	if (left.contextBinding32B64u !== right.contextBinding32B64u) return "contextBinding32B64u";
+	if (left.derivationClientSharePublicKey33B64u !== right.derivationClientSharePublicKey33B64u) return "derivationClientSharePublicKey33B64u";
+	if (left.clientShareRetryCounter !== right.clientShareRetryCounter) return "clientShareRetryCounter";
+	if (left.relayerShareRetryCounter !== right.relayerShareRetryCounter) return "relayerShareRetryCounter";
+	if (d1EvmFamilyParticipantKey(left.participantIds) !== d1EvmFamilyParticipantKey(right.participantIds)) return "participantIds";
+	return null;
+}
+function normalizeD1EvmFamilyOwnerAddress(value) {
+	return value.trim().toLowerCase();
+}
+function d1EvmFamilyParticipantKey(participantIds) {
+	return participantIds.join(",");
+}
+function buildD1EcdsaWalletKeyFromBootstrap(input) {
+	const bootstrap = input.bootstrap;
+	const complete = requireD1EcdsaWalletKeyBootstrapFields({
+		walletId: normalizeOptionalTrimmedString(bootstrap.walletId),
+		evmFamilySigningKeySlotId: normalizeOptionalTrimmedString(bootstrap.evmFamilySigningKeySlotId),
+		keyHandle: normalizeOptionalTrimmedString(bootstrap.keyHandle),
+		ecdsaThresholdKeyId: normalizeOptionalTrimmedString(bootstrap.ecdsaThresholdKeyId),
+		signingRootId: normalizeOptionalTrimmedString(bootstrap.signingRootId),
+		signingRootVersion: normalizeOptionalTrimmedString(bootstrap.signingRootVersion),
+		thresholdEcdsaPublicKeyB64u: normalizeOptionalTrimmedString(bootstrap.thresholdEcdsaPublicKeyB64u),
+		thresholdOwnerAddress: normalizeOptionalTrimmedString(bootstrap.ethereumAddress),
+		relayerKeyId: normalizeOptionalTrimmedString(bootstrap.relayerKeyId),
+		relayerVerifyingShareB64u: normalizeOptionalTrimmedString(bootstrap.relayerVerifyingShareB64u),
+		contextBinding32B64u: normalizeOptionalTrimmedString(bootstrap.contextBinding32B64u),
+		derivationClientSharePublicKey33B64u: normalizeOptionalTrimmedString(bootstrap.publicIdentity?.derivationClientSharePublicKey33B64u),
+		clientShareRetryCounter: safeInteger(bootstrap.clientShareRetryCounter) ?? void 0,
+		relayerShareRetryCounter: safeInteger(bootstrap.relayerShareRetryCounter) ?? void 0
+	});
+	if (!complete.ok) return {
+		ok: false,
+		code: "incomplete_ecdsa_wallet_key",
+		message: `${input.errorContext} returned incomplete ECDSA wallet key material: ${complete.missingField}`
+	};
+	const participantIds = parseD1PositiveIntegerArray(bootstrap.participantIds);
+	if (!participantIds || participantIds.length !== 2 || participantIds[0] !== 1 || participantIds[1] !== 2) return {
+		ok: false,
+		code: "incomplete_ecdsa_wallet_key",
+		message: `${input.errorContext} returned incomplete ECDSA wallet key material: participantIds`
+	};
+	return {
+		ok: true,
+		walletKey: d1EcdsaWalletKeyForChainTarget({
+			required: complete.value,
+			participantIds,
+			chainTarget: input.chainTarget,
+			publicCapability: input.publicCapability
+		})
+	};
+}
+function requireD1EcdsaWalletKeyBootstrapFields(fields) {
+	if (!fields.walletId) return {
+		ok: false,
+		missingField: "walletId"
+	};
+	if (!fields.evmFamilySigningKeySlotId) return {
+		ok: false,
+		missingField: "evmFamilySigningKeySlotId"
+	};
+	if (!fields.keyHandle) return {
+		ok: false,
+		missingField: "keyHandle"
+	};
+	if (!fields.ecdsaThresholdKeyId) return {
+		ok: false,
+		missingField: "ecdsaThresholdKeyId"
+	};
+	if (!fields.signingRootId) return {
+		ok: false,
+		missingField: "signingRootId"
+	};
+	if (!fields.signingRootVersion) return {
+		ok: false,
+		missingField: "signingRootVersion"
+	};
+	if (!fields.thresholdEcdsaPublicKeyB64u) return {
+		ok: false,
+		missingField: "thresholdEcdsaPublicKeyB64u"
+	};
+	if (!fields.thresholdOwnerAddress) return {
+		ok: false,
+		missingField: "thresholdOwnerAddress"
+	};
+	if (!fields.relayerKeyId) return {
+		ok: false,
+		missingField: "relayerKeyId"
+	};
+	if (!fields.relayerVerifyingShareB64u) return {
+		ok: false,
+		missingField: "relayerVerifyingShareB64u"
+	};
+	if (!fields.contextBinding32B64u) return {
+		ok: false,
+		missingField: "contextBinding32B64u"
+	};
+	if (!fields.derivationClientSharePublicKey33B64u) return {
+		ok: false,
+		missingField: "derivationClientSharePublicKey33B64u"
+	};
+	if (fields.clientShareRetryCounter === void 0 || fields.clientShareRetryCounter < 0) return {
+		ok: false,
+		missingField: "clientShareRetryCounter"
+	};
+	if (fields.relayerShareRetryCounter === void 0 || fields.relayerShareRetryCounter < 0) return {
+		ok: false,
+		missingField: "relayerShareRetryCounter"
+	};
+	let derivationClientSharePublicKey33B64u;
+	try {
+		derivationClientSharePublicKey33B64u = derivationClientSharePublicKey33B64uFromString(fields.derivationClientSharePublicKey33B64u);
+	} catch {
+		return {
+			ok: false,
+			missingField: "derivationClientSharePublicKey33B64u"
+		};
+	}
+	return {
+		ok: true,
+		value: {
+			walletId: fields.walletId,
+			evmFamilySigningKeySlotId: fields.evmFamilySigningKeySlotId,
+			keyHandle: fields.keyHandle,
+			ecdsaThresholdKeyId: fields.ecdsaThresholdKeyId,
+			signingRootId: fields.signingRootId,
+			signingRootVersion: fields.signingRootVersion,
+			thresholdEcdsaPublicKeyB64u: fields.thresholdEcdsaPublicKeyB64u,
+			thresholdOwnerAddress: fields.thresholdOwnerAddress,
+			relayerKeyId: fields.relayerKeyId,
+			relayerVerifyingShareB64u: fields.relayerVerifyingShareB64u,
+			contextBinding32B64u: fields.contextBinding32B64u,
+			derivationClientSharePublicKey33B64u,
+			clientShareRetryCounter: fields.clientShareRetryCounter,
+			relayerShareRetryCounter: fields.relayerShareRetryCounter
+		}
+	};
+}
+function d1EcdsaWalletKeyForChainTarget(input) {
+	return {
+		keyScope: "evm-family",
+		chainTarget: input.chainTarget,
+		walletId: input.required.walletId,
+		evmFamilySigningKeySlotId: input.required.evmFamilySigningKeySlotId,
+		keyHandle: input.required.keyHandle,
+		ecdsaThresholdKeyId: input.required.ecdsaThresholdKeyId,
+		signingRootId: input.required.signingRootId,
+		signingRootVersion: input.required.signingRootVersion,
+		thresholdEcdsaPublicKeyB64u: input.required.thresholdEcdsaPublicKeyB64u,
+		thresholdOwnerAddress: input.required.thresholdOwnerAddress,
+		relayerKeyId: input.required.relayerKeyId,
+		relayerVerifyingShareB64u: input.required.relayerVerifyingShareB64u,
+		contextBinding32B64u: input.required.contextBinding32B64u,
+		derivationClientSharePublicKey33B64u: input.required.derivationClientSharePublicKey33B64u,
+		clientShareRetryCounter: input.required.clientShareRetryCounter,
+		relayerShareRetryCounter: input.required.relayerShareRetryCounter,
+		participantIds: [1, 2],
+		publicCapability: input.publicCapability
+	};
+}
+function buildD1WalletRecord(input) {
+	return {
+		version: "wallet_v1",
+		walletId: input.walletId,
+		createdAtMs: input.now,
+		updatedAtMs: input.now
+	};
+}
+function buildD1WalletEcdsaSignerRecords(input) {
+	const records = [];
+	for (const walletKey of input.walletKeys) records.push(buildWalletEcdsaSignerRecord({
+		walletId: input.walletId,
+		walletKey,
+		activationReceipt: input.activationReceipt,
+		runtimePolicyScope: input.runtimePolicyScope,
+		custodyKeyManifestDigestB64u: input.custodyKeyManifestDigestB64u,
+		custodyClientRootPublicKey33B64u: input.custodyClientRootPublicKey33B64u,
+		createdAtMs: input.now,
+		updatedAtMs: input.now
+	}));
+	return records;
+}
+function parseD1PositiveIntegerArray(raw) {
+	if (!Array.isArray(raw) || raw.length === 0) return null;
+	const values = [];
+	for (const item of raw) {
+		const value = safeInteger(item);
+		if (value === null || value <= 0) return null;
+		values.push(value);
+	}
+	return values;
+}
+function parseD1StoredAddAuthMethodIntent(raw) {
+	const record = toRecordValue(raw);
+	if (!record || record.kind !== "add_auth_method_intent_allocated") return null;
+	const grant = addAuthMethodIntentGrantFromString(normalizeOptionalTrimmedString(record.grant) || "");
+	const intent = parseD1AddAuthMethodIntent(record.intent);
+	const digestB64u = normalizeOptionalTrimmedString(record.digestB64u);
+	const orgId = normalizeOptionalTrimmedString(record.orgId);
+	const expiresAtMs = safeInteger(record.expiresAtMs);
+	if (!grant || !intent || !digestB64u || !orgId || expiresAtMs === null) return null;
+	return {
+		kind: "add_auth_method_intent_allocated",
+		grant,
+		intent,
+		digestB64u,
+		orgId,
+		expiresAtMs,
+		...intentScopeMetadata(record)
+	};
+}
+/**
+* Nullable wrapper over the canonical parser, so a row that was written by one
+* reading of these options cannot be read back by a looser one.
+*/
+function parseD1WalletAddAuthMethodRegistrationOptions(raw) {
+	try {
+		return parseWalletAddAuthMethodRegistrationOptions(raw);
+	} catch {
+		return null;
+	}
+}
+function d1AddAuthMethodCustodyFactorMatches(auth, custodyEnvelope) {
+	switch (auth.kind) {
+		case "webauthn_assertion":
+		case "wallet_session": return custodyEnvelope.factor.kind === "passkey" && custodyEnvelope.factor.rpId === auth.rpId && custodyEnvelope.factor.credentialIdB64u === auth.credentialIdB64u;
+		case "email_otp": return custodyEnvelope.factor.kind === "email_otp" && custodyEnvelope.factor.enrollmentId === auth.enrollmentId && custodyEnvelope.factor.enrollmentSealKeyVersion === auth.enrollmentSealKeyVersion;
+		default: return unreachableAddAuthMethodInput(auth);
+	}
+}
+function parseD1StoredWalletAddAuthMethodCeremony(raw) {
+	const record = toRecordValue(raw);
+	if (!record) return null;
+	const addAuthMethodCeremonyId = normalizeOptionalTrimmedString(record.addAuthMethodCeremonyId);
+	const intent = parseD1AddAuthMethodIntent(record.intent);
+	const digestB64u = normalizeOptionalTrimmedString(record.digestB64u);
+	const orgId = normalizeOptionalTrimmedString(record.orgId);
+	const expiresAtMs = safeInteger(record.expiresAtMs);
+	const auth = parseD1StoredAddAuthMethodAuth(record.auth);
+	const sourceWalletAuthMethodId = parseWalletAuthMethodId(record.sourceWalletAuthMethodId);
+	const sourceWalletAuthorityId = parseWalletAuthorityId(record.sourceWalletAuthorityId);
+	const targetWalletAuthMethodId = parseWalletAuthMethodId(record.targetWalletAuthMethodId);
+	let sourceAuthorityDigestB64u;
+	try {
+		sourceAuthorityDigestB64u = parseDigestB64u(record.sourceAuthorityDigestB64u);
+	} catch {
+		return null;
+	}
+	const sourceAuthorityRevocationEpoch = safeInteger(record.sourceAuthorityRevocationEpoch);
+	if (!addAuthMethodCeremonyId || !intent || !digestB64u || !orgId || !sourceWalletAuthMethodId.ok || !sourceWalletAuthorityId.ok || sourceAuthorityRevocationEpoch === null || sourceAuthorityRevocationEpoch < 0 || !targetWalletAuthMethodId.ok || expiresAtMs === null || !auth) return null;
+	let custodyEnvelope;
+	try {
+		custodyEnvelope = parsePasskeyCustodyEnvelopeRecord(record.custodyEnvelope);
+	} catch {
+		return null;
+	}
+	if (custodyEnvelope.walletId !== intent.walletId || !d1AddAuthMethodCustodyFactorMatches(auth, custodyEnvelope) || custodyEnvelope.lifecycle.state !== "active") return null;
+	if (record.kind === "email_otp") {
+		const authority = parseD1RegistrationAuthority(record.authority);
+		if (!authority || authority.kind !== "email_otp") return null;
+		return {
+			kind: "email_otp",
+			custodyEnvelope,
+			addAuthMethodCeremonyId,
+			intent,
+			digestB64u,
+			orgId,
+			sourceWalletAuthMethodId: sourceWalletAuthMethodId.value,
+			sourceWalletAuthorityId: sourceWalletAuthorityId.value,
+			sourceAuthorityDigestB64u,
+			sourceAuthorityRevocationEpoch,
+			targetWalletAuthMethodId: targetWalletAuthMethodId.value,
+			...normalizeOptionalTrimmedString(record.expectedOrigin) ? { expectedOrigin: normalizeOptionalTrimmedString(record.expectedOrigin) } : {},
+			expiresAtMs,
+			auth,
+			authority
+		};
+	}
+	if (record.kind !== "passkey") return null;
+	const passkeyRegistration = toRecordValue(record.passkeyRegistration);
+	const rpId = parseWebAuthnRpId(passkeyRegistration?.rpId);
+	const challengeB64u = normalizeOptionalTrimmedString(passkeyRegistration?.challengeB64u);
+	const options = parseD1WalletAddAuthMethodRegistrationOptions(passkeyRegistration?.options);
+	if (!rpId.ok || !challengeB64u || !options || options.rpId !== rpId.value || options.challengeB64u !== challengeB64u || intent.authMethod.kind !== "passkey" || intent.authMethod.rpId !== rpId.value) return null;
+	return {
+		kind: "passkey",
+		addAuthMethodCeremonyId,
+		intent,
+		digestB64u,
+		orgId,
+		sourceWalletAuthMethodId: sourceWalletAuthMethodId.value,
+		sourceWalletAuthorityId: sourceWalletAuthorityId.value,
+		sourceAuthorityDigestB64u,
+		sourceAuthorityRevocationEpoch,
+		targetWalletAuthMethodId: targetWalletAuthMethodId.value,
+		...normalizeOptionalTrimmedString(record.expectedOrigin) ? { expectedOrigin: normalizeOptionalTrimmedString(record.expectedOrigin) } : {},
+		expiresAtMs,
+		auth,
+		passkeyRegistration: {
+			rpId: rpId.value,
+			challengeB64u,
+			options
+		},
+		custodyEnvelope
+	};
+}
+function parseD1AddAuthMethodIntent(raw) {
+	const record = toRecordValue(raw);
+	if (!record || record.version !== "add_auth_method_intent_v1") return null;
+	const walletId = parseWalletIdForIntent(record.walletId);
+	const authMethod = normalizeAddAuthMethodInput(record.authMethod);
+	const nonceB64u = normalizeOptionalTrimmedString(record.nonceB64u);
+	const runtimePolicyScope = parseD1RuntimePolicyScope(record.runtimePolicyScope);
+	const targetWalletAuthMethodId = parseWalletAuthMethodId(record.targetWalletAuthMethodId);
+	const caller = normalizeAddAuthMethodIntentCaller(record);
+	if (!walletId || !authMethod || !nonceB64u || !targetWalletAuthMethodId.ok || !caller) return null;
+	if (record.runtimePolicyScope !== void 0 && !runtimePolicyScope) return null;
+	return buildStoredAddAuthMethodIntentRecord({
+		walletId,
+		authMethod,
+		targetWalletAuthMethodId: targetWalletAuthMethodId.value,
+		caller,
+		runtimePolicyScope,
+		nonceB64u
+	});
+}
+/**
+* Rebuilds a persisted intent without re-minting its nonce or target id.
+* `buildAddAuthMethodIntent` allocates both, so a parser cannot reuse it.
+*/
+function buildStoredAddAuthMethodIntentRecord(input) {
+	const common = {
+		version: "add_auth_method_intent_v1",
+		walletId: input.walletId,
+		authMethod: input.authMethod,
+		targetWalletAuthMethodId: input.targetWalletAuthMethodId,
+		...input.runtimePolicyScope ? { runtimePolicyScope: input.runtimePolicyScope } : {},
+		nonceB64u: input.nonceB64u
+	};
+	switch (input.caller.caller) {
+		case "same_device_addition": return {
+			...common,
+			caller: "same_device_addition",
+			source: input.caller.source
+		};
+		case "linked_device_ceremony": return {
+			...common,
+			caller: "linked_device_ceremony"
+		};
+		default: return unreachableAddAuthMethodIntentCaller(input.caller);
+	}
+}
+function parseD1RuntimePolicyScope(raw) {
+	if (raw === void 0 || raw === null) return void 0;
+	const record = toRecordValue(raw);
+	if (!record) return void 0;
+	const orgId = normalizeOptionalTrimmedString(record.orgId);
+	const projectId = normalizeOptionalTrimmedString(record.projectId);
+	const envId = normalizeOptionalTrimmedString(record.envId);
+	const signingRootVersion = normalizeOptionalTrimmedString(record.signingRootVersion);
+	if (!orgId || !projectId || !envId || !signingRootVersion) return void 0;
+	return {
+		orgId,
+		projectId,
+		envId,
+		signingRootVersion
+	};
+}
+function parseD1StoredAddAuthMethodAuth(raw) {
+	const record = toRecordValue(raw);
+	const kind = normalizeOptionalTrimmedString(record?.kind);
+	if (kind === "email_otp") {
+		const providerUserId = normalizeOptionalTrimmedString(record?.providerUserId);
+		const enrollmentId = normalizeOptionalTrimmedString(record?.enrollmentId);
+		const enrollmentSealKeyVersion = normalizeOptionalTrimmedString(record?.enrollmentSealKeyVersion);
+		const authorityRef = parseWalletAuthAuthorityRef(record?.authorityRef);
+		return providerUserId && enrollmentId && enrollmentSealKeyVersion && authorityRef ? {
+			kind: "email_otp",
+			providerUserId,
+			enrollmentId,
+			enrollmentSealKeyVersion,
+			authorityRef
+		} : null;
+	}
+	if (kind === "webauthn_assertion") {
+		const rpId = normalizeOptionalTrimmedString(record?.rpId);
+		const credentialIdB64u = normalizeOptionalTrimmedString(record?.credentialIdB64u);
+		return rpId && credentialIdB64u ? {
+			kind: "webauthn_assertion",
+			rpId,
+			credentialIdB64u
+		} : null;
+	}
+	if (kind === "wallet_session") {
+		const walletSessionId = normalizeOptionalTrimmedString(record?.walletSessionId);
+		const authorizationId = normalizeOptionalTrimmedString(record?.authorizationId);
+		const rpId = normalizeOptionalTrimmedString(record?.rpId);
+		const credentialIdB64u = normalizeOptionalTrimmedString(record?.credentialIdB64u);
+		return walletSessionId && authorizationId && rpId && credentialIdB64u ? {
+			kind: "wallet_session",
+			walletSessionId,
+			authorizationId,
+			rpId,
+			credentialIdB64u
+		} : null;
+	}
+	return null;
+}
+function parseD1RegistrationAuthority(raw) {
+	const record = toRecordValue(raw);
+	if (!record) return null;
+	const kind = normalizeOptionalTrimmedString(record?.kind);
+	if (kind === "passkey") return parseD1PasskeyRegistrationAuthority(record);
+	if (kind === "email_otp") return parseD1EmailOtpRegistrationAuthority(record);
+	return null;
+}
+function parseD1PasskeyRegistrationAuthority(record) {
+	const walletId = parseWalletIdForIntent(record.walletId);
+	const rpId = parseWebAuthnRpId(record.rpId);
+	const credentialIdB64u = normalizeOptionalTrimmedString(record.credentialIdB64u);
+	const credentialPublicKeyB64u = normalizeOptionalTrimmedString(record.credentialPublicKeyB64u);
+	const counter = safeInteger(record.counter);
+	const registrationIntentDigestB64u = normalizeOptionalTrimmedString(record.registrationIntentDigestB64u);
+	if (!walletId || !rpId.ok || !credentialIdB64u || !credentialPublicKeyB64u || counter === null || !registrationIntentDigestB64u) return null;
+	const device = parseWebAuthnAuthenticatorDeviceInfo(record.device) ?? unknownWebAuthnAuthenticatorDeviceInfo();
+	return {
+		kind: "passkey",
+		walletId,
+		rpId: rpId.value,
+		credentialIdB64u,
+		credentialPublicKeyB64u,
+		counter,
+		device,
+		registrationIntentDigestB64u
+	};
+}
+function parseD1EmailOtpRegistrationAuthority(record) {
+	if (record.proofKind === "google_sso_registration") return parseD1GoogleSsoEmailOtpRegistrationAuthority(record);
+	if (record.proofKind !== "otp_challenge") return null;
+	const walletId = parseWalletIdForIntent(record.walletId);
+	const providerSubject = parseProviderSubject(record.providerSubject);
+	const challengeSubjectId = parseChallengeSubjectId(record.challengeSubjectId);
+	const email = normalizeOptionalTrimmedString(record.email);
+	const emailHashHex = normalizeOptionalTrimmedString(record.emailHashHex);
+	const challengeId = parseEmailOtpChallengeId(record.challengeId);
+	const registrationAuthorityId = parseEmailOtpChallengeId(record.registrationAuthorityId);
+	const originalWalletId = parseWalletIdForIntent(record.originalWalletId);
+	const finalWalletId = parseWalletIdForIntent(record.finalWalletId);
+	const orgId = parseOrgId(record.orgId);
+	const ownerProofBindingDigest = normalizeOptionalTrimmedString(record.ownerProofBindingDigest);
+	const challengePurpose = normalizeOptionalTrimmedString(record.challengePurpose);
+	const registrationIntentDigestB64u = normalizeOptionalTrimmedString(record.registrationIntentDigestB64u);
+	if (!walletId || !providerSubject.ok || !challengeSubjectId.ok || !email || !emailHashHex || !challengeId.ok || !registrationAuthorityId.ok || !originalWalletId || !finalWalletId || !orgId.ok || !ownerProofBindingDigest || challengePurpose !== "registration" && challengePurpose !== "registration_reroll" || !registrationIntentDigestB64u) return null;
+	return {
+		kind: "email_otp",
+		proofKind: "otp_challenge",
+		walletId,
+		providerSubject: providerSubject.value,
+		challengeSubjectId: challengeSubjectId.value,
+		email,
+		emailHashHex,
+		challengeId: challengeId.value,
+		registrationAuthorityId: registrationAuthorityId.value,
+		originalWalletId,
+		finalWalletId,
+		orgId: orgId.value,
+		ownerProofBindingDigest,
+		challengePurpose,
+		registrationIntentDigestB64u
+	};
+}
+function parseD1GoogleSsoEmailOtpRegistrationAuthority(record) {
+	const walletId = parseWalletIdForIntent(record.walletId);
+	const providerSubject = parseProviderSubject(record.providerSubject);
+	const email = normalizeOptionalTrimmedString(record.email);
+	const emailHashHex = normalizeOptionalTrimmedString(record.emailHashHex);
+	const googleEmailOtpRegistrationAttemptId = normalizeOptionalTrimmedString(record.googleEmailOtpRegistrationAttemptId);
+	const googleEmailOtpRegistrationOfferId = normalizeOptionalTrimmedString(record.googleEmailOtpRegistrationOfferId);
+	const googleEmailOtpRegistrationCandidateId = normalizeOptionalTrimmedString(record.googleEmailOtpRegistrationCandidateId);
+	const registrationAuthorityId = normalizeOptionalTrimmedString(record.registrationAuthorityId);
+	const finalWalletId = parseWalletIdForIntent(record.finalWalletId);
+	const orgId = parseOrgId(record.orgId);
+	const ownerProofBindingDigest = normalizeOptionalTrimmedString(record.ownerProofBindingDigest);
+	const registrationIntentDigestB64u = normalizeOptionalTrimmedString(record.registrationIntentDigestB64u);
+	if (!walletId || !providerSubject.ok || !email || !emailHashHex || !googleEmailOtpRegistrationAttemptId || !googleEmailOtpRegistrationOfferId || !googleEmailOtpRegistrationCandidateId || !registrationAuthorityId || !finalWalletId || !orgId.ok || !ownerProofBindingDigest || !registrationIntentDigestB64u) return null;
+	return {
+		kind: "email_otp",
+		proofKind: "google_sso_registration",
+		walletId,
+		providerSubject: providerSubject.value,
+		email,
+		emailHashHex,
+		googleEmailOtpRegistrationAttemptId,
+		googleEmailOtpRegistrationOfferId,
+		googleEmailOtpRegistrationCandidateId,
+		registrationAuthorityId,
+		finalWalletId,
+		orgId: orgId.value,
+		ownerProofBindingDigest,
+		registrationIntentDigestB64u
+	};
+}
+function normalizeThresholdEcdsaChainTargets(input) {
+	const targets = [];
+	for (const raw of input) {
+		const target = thresholdEcdsaChainTargetFromValue(raw);
+		if (!target) return null;
+		targets.push(target);
+	}
+	return targets;
+}
+function intentScopeMetadata(input) {
+	const signingRootId = normalizeOptionalTrimmedString(input.signingRootId);
+	const signingRootVersion = normalizeOptionalTrimmedString(input.signingRootVersion);
+	const expectedOrigin = normalizeOptionalTrimmedString(input.expectedOrigin);
+	return {
+		...signingRootId ? { signingRootId } : {},
+		...signingRootVersion ? { signingRootVersion } : {},
+		...expectedOrigin ? { expectedOrigin } : {}
+	};
+}
+function safeInteger(raw) {
+	const value = Number(raw);
+	return Number.isSafeInteger(value) ? value : null;
+}
+function addSignerEd25519SelectionsMatch(left, right) {
+	const leftEd25519 = left.ed25519;
+	const rightEd25519 = right.ed25519;
+	return leftEd25519.mode === rightEd25519.mode && leftEd25519.signerSlot === rightEd25519.signerSlot && leftEd25519.keyPurpose === rightEd25519.keyPurpose && leftEd25519.keyVersion === rightEd25519.keyVersion && leftEd25519.derivationVersion === rightEd25519.derivationVersion && positiveIntegerArraysEqual(leftEd25519.participantIds, rightEd25519.participantIds);
+}
+function unreachableAddAuthMethodInput(value) {
+	throw new Error(`Unhandled add-auth-method input kind: ${String(value)}`);
+}
+function unreachableAddSignerSelection(value) {
+	throw new Error(`Unhandled add-signer selection mode: ${String(value)}`);
+}
+//#endregion
+export { addAuthMethodInputMatches, addSignerSelectionMatches, buildAddAuthMethodIntent, buildAddSignerIntent, buildD1EcdsaWalletKeysFromBootstrap, buildD1WalletEcdsaSignerRecords, buildD1WalletRecord, buildRegistrationIntent, createD1ServerAllocatedWalletId, deriveEvmFamilySigningKeySlotId, inferRuntimePolicyScopeFromSigningRoot, intentScopeMetadata, isMatchingD1EcdsaClientBootstrap, normalizeThresholdEcdsaChainTargets, parseD1AddAuthMethodIntent, parseD1AddSignerIntent, parseD1EcdsaDerivationServerBootstrapResponse, parseD1PositiveIntegerArray, parseD1RegistrationAuthority, parseD1RegistrationIntent, parseD1RuntimePolicyScope, parseD1StoredAddAuthMethodIntent, parseD1StoredAddSignerAuth, parseD1StoredAddSignerIntent, parseD1StoredNearEd25519YaoAuthorizedBranch, parseD1StoredWalletAddAuthMethodCeremony, parseD1StoredWalletAddAuthMethodFinalizeReplay, parseD1StoredWalletAddSignerCeremony, parseD1StoredWalletAddSignerFinalizeReplay, parseD1StoredWalletRegistrationCeremony, parseD1WalletAddSignerFinalizeRequest, parseD1WalletAddSignerFinalizeTerminalResponse, parseD1WalletRegistrationCommittedInstallationProjection, parseD1WalletRegistrationFinalizeReplayResponse, parseWalletIdForIntent, positiveIntegerArraysEqual, runtimePolicyScopeMatches, thresholdEcdsaChainTargetsEqual, toD1EcdsaDerivationClientBootstrapRequest };
+
+//# sourceMappingURL=d1RegistrationCeremonyRecords.js.map