@seams/wallet-server 0.6.2 → 0.7.1

package/dist/esm/core/RegistrationCeremonyStore.js

@@ -1,21 +1,5 @@
-import { parseChallengeSubjectId, parseEmailOtpChallengeId, parseOrgId, parseProviderSubject, parseRootShareEpoch, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../shared-ts/src/utils/domainIds.js";
-import { parseDeviceId } from "../shared-ts/src/authorization/capabilityKinds.js";
-import { parseDigestB64u } from "../shared-ts/src/utils/canonicalPrimitives.js";
-import { parseWalletAddAuthMethodRegistrationOptions } from "../shared-ts/src/utils/addAuthMethodRegistration.js";
-import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, normalizeAddAuthMethodInput, normalizeAddAuthMethodIntentCaller, normalizeAddSignerSelection, normalizeRegistrationAuthMethodInput, normalizeRegistrationSignerPlan, registrationSignerBranchKeyFromString, registrationSignerPlanFromSelection, registrationSignerSetSelectionFromPlan } from "../shared-ts/src/utils/registrationIntent.js";
-import { parseWebAuthnAuthenticatorDeviceInfo } from "../shared-ts/src/utils/webauthnDeviceInfo.js";
-import { parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1, parseRouterAbEd25519YaoRegistrationActivationResultV1, parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../shared-ts/src/utils/routerAbEd25519Yao.js";
-import { derivationClientSharePublicKey33B64uFromString, ecdsaClientRootPublicKey33B64uFromString } from "../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
-import { parseWalletAuthAuthorityRef } from "../shared-ts/src/utils/walletAuthAuthority.js";
-import { parseRouterAbEcdsaDerivationNormalSigningStateV1, parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaRegistrationActivationReceiptV1, parseRouterAbEcdsaRegistrationRequestFactsV1, parseRouterAbEcdsaRegistrationRequestV1, parseRouterAbEcdsaStrictForwardedRegistrationResponseV1, parseRouterAbEcdsaVerifiedClientActivationFactsV1 } from "../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { thresholdEcdsaChainTargetFromValue, thresholdEcdsaChainTargetKey } from "./thresholdEcdsaChainTarget.js";
-import "./defaultConfigsServer.js";
-import { parseWalletEd25519SignerRecord } from "./d1WalletStore.js";
-import { registrationPreparationIdFromString } from "./types.js";
-import { parsePasskeyCustodyEnvelopeRecord } from "../shared-ts/src/passkey-custody/custodyEnvelope.js";
-import "../shared-ts/src/passkey-custody/index.js";
-import { parseEcdsaDerivationPublicIdentity } from "./ThresholdService/validation.js";
-import { parseStoredRouterAbEcdsaPendingActivationV1 } from "../router/domains/ecdsa/routerAbEcdsaStrictRegistration.js";
+import { thresholdEcdsaChainTargetFromValue } from "./thresholdEcdsaChainTarget.js";
+import { normalizeRegistrationSignerPlan, registrationSignerPlanFromSelection } from "../shared-ts/src/utils/registrationSignerPlan.js";
 //#region src/core/RegistrationCeremonyStore.ts
 function buildStoredWalletRegistrationPreparedContext(input) {
 	const signingRootId = String(input.signingRootId || "").trim();
@@ -40,17 +24,6 @@ function buildStoredWalletRegistrationPreparedContext(input) {
 		} : { kind: "evm_family_ecdsa_absent" }
 	};
 }
-function storedWalletRegistrationPreparedContextsMatch(left, right) {
-	if (left.kind !== right.kind || left.signingRootId !== right.signingRootId || left.signingRootVersion !== right.signingRootVersion || left.runtimePolicy.kind !== right.runtimePolicy.kind || left.ecdsa.kind !== right.ecdsa.kind) return false;
-	if (left.runtimePolicy.kind === "runtime_policy_scope" && right.runtimePolicy.kind === "runtime_policy_scope" && (left.runtimePolicy.scope.orgId !== right.runtimePolicy.scope.orgId || left.runtimePolicy.scope.projectId !== right.runtimePolicy.scope.projectId || left.runtimePolicy.scope.envId !== right.runtimePolicy.scope.envId || left.runtimePolicy.scope.signingRootVersion !== right.runtimePolicy.scope.signingRootVersion)) return false;
-	if (left.ecdsa.kind === "evm_family_ecdsa_requested" && right.ecdsa.kind === "evm_family_ecdsa_requested") {
-		const leftTargets = left.ecdsa.chainTargets;
-		const rightTargets = right.ecdsa.chainTargets;
-		if (leftTargets.length !== rightTargets.length) return false;
-		return leftTargets.every((target, index) => thresholdEcdsaChainTargetKey(target) === thresholdEcdsaChainTargetKey(rightTargets[index]));
-	}
-	return true;
-}
 function storedRegistrationAuthoritiesMatch(left, right) {
 	if (left.kind !== right.kind) return false;
 	switch (left.kind) {
@@ -108,206 +81,12 @@ function replaceStoredWalletRegistrationSignerBranch(input) {
 function verifiedRegistrationCeremonyAuthority(ceremony) {
 	return ceremony.authorityState.kind === "verified" ? ceremony.authorityState.authority : null;
 }
-function registrationCeremonyAuthorityRpId(authorityState) {
-	switch (authorityState.kind) {
-		case "awaiting_proof": return authorityState.authMethod.kind === "passkey" ? String(authorityState.authMethod.rpId) : null;
-		case "verified": return authorityState.authority.kind === "passkey" ? String(authorityState.authority.rpId) : null;
-		default: return authorityState;
-	}
-}
-function parseTerminalRegistrationCeremonyCancellationResult(value) {
-	const parsed = parseJsonValue(value);
-	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return null;
-	const record = parsed;
-	switch (record.kind) {
-		case "cancelled": return record.ceremonyDeleted === true ? {
-			kind: "cancelled",
-			ceremonyDeleted: true
-		} : null;
-		case "not_found": return record.ceremonyDeleted === false ? {
-			kind: "not_found",
-			ceremonyDeleted: false
-		} : null;
-		default: return null;
-	}
-}
-var MemoryRegistrationCeremonyStore = class {
-	constructor() {
-		this.addAuthMethodIntents = /* @__PURE__ */ new Map();
-		this.addSignerIntents = /* @__PURE__ */ new Map();
-		this.ceremonies = /* @__PURE__ */ new Map();
-		this.addSignerFinalizeReplays = /* @__PURE__ */ new Map();
-		this.addSignerFinalizeReplayClaims = /* @__PURE__ */ new Map();
-		this.addAuthMethodCeremonies = /* @__PURE__ */ new Map();
-		this.addSignerCeremonies = /* @__PURE__ */ new Map();
-	}
-	async putAddAuthMethodIntent(intent) {
-		this.pruneExpired();
-		this.addAuthMethodIntents.set(intent.grant, intent);
-	}
-	async getAddAuthMethodIntent(grant) {
-		this.pruneExpired();
-		const intent = this.addAuthMethodIntents.get(String(grant || "").trim()) || null;
-		if (!intent || intent.expiresAtMs <= Date.now()) return null;
-		return intent;
-	}
-	async takeAddAuthMethodIntent(grant) {
-		this.pruneExpired();
-		const key = String(grant || "").trim();
-		const intent = this.addAuthMethodIntents.get(key) || null;
-		if (!intent) return null;
-		this.addAuthMethodIntents.delete(key);
-		if (intent.expiresAtMs <= Date.now()) return null;
-		return {
-			...intent,
-			kind: "add_auth_method_intent_consumed",
-			consumedAtMs: Date.now()
-		};
-	}
-	async putAddSignerIntent(intent) {
-		this.pruneExpired();
-		this.addSignerIntents.set(intent.grant, intent);
-	}
-	async getAddSignerIntent(grant) {
-		this.pruneExpired();
-		const intent = this.addSignerIntents.get(String(grant || "").trim()) || null;
-		if (!intent || intent.expiresAtMs <= Date.now()) return null;
-		return intent;
-	}
-	async takeAddSignerIntent(grant) {
-		this.pruneExpired();
-		const key = String(grant || "").trim();
-		const intent = this.addSignerIntents.get(key) || null;
-		if (!intent) return null;
-		this.addSignerIntents.delete(key);
-		if (intent.expiresAtMs <= Date.now()) return null;
-		return {
-			...intent,
-			kind: "add_signer_intent_consumed",
-			consumedAtMs: Date.now()
-		};
-	}
-	async putCeremony(ceremony) {
-		this.pruneExpired();
-		this.ceremonies.set(ceremony.registrationCeremonyId, ceremony);
-	}
-	async getCeremony(registrationCeremonyId) {
-		this.pruneExpired();
-		const ceremony = this.ceremonies.get(String(registrationCeremonyId || "").trim()) || null;
-		if (!ceremony || ceremony.expiresAtMs <= Date.now()) return null;
-		return ceremony;
-	}
-	async updateCeremony(ceremony) {
-		this.pruneExpired();
-		if (ceremony.expiresAtMs <= Date.now()) return;
-		this.ceremonies.set(ceremony.registrationCeremonyId, ceremony);
-	}
-	async takeCeremony(registrationCeremonyId) {
-		this.pruneExpired();
-		const key = String(registrationCeremonyId || "").trim();
-		const ceremony = this.ceremonies.get(key) || null;
-		this.ceremonies.delete(key);
-		if (!ceremony || ceremony.expiresAtMs <= Date.now()) return null;
-		return ceremony;
-	}
-	async cancelTerminalCeremony(input) {
-		this.pruneExpired();
-		const registrationCeremonyId = trimString(input.registrationCeremonyId);
-		const ceremony = this.ceremonies.get(registrationCeremonyId);
-		if (!ceremony) return {
-			kind: "not_found",
-			ceremonyDeleted: false
-		};
-		if (ceremony.intent.walletId !== input.walletId) throw new Error("Terminal registration cancellation walletId mismatch");
-		this.ceremonies.delete(registrationCeremonyId);
-		return {
-			kind: "cancelled",
-			ceremonyDeleted: true
-		};
-	}
-	async putAddSignerFinalizeReplay(replay) {
-		this.pruneExpired();
-		this.addSignerFinalizeReplays.set(addSignerFinalizeReplayKey(replay), replay);
-		this.addSignerFinalizeReplayClaims.set(replay.addSignerCeremonyId, replay);
-	}
-	async getAddSignerFinalizeReplay(input) {
-		this.pruneExpired();
-		const replay = this.addSignerFinalizeReplays.get(addSignerFinalizeReplayKey(input)) || null;
-		if (!replay || replay.expiresAtMs <= Date.now()) return null;
-		return replay;
-	}
-	async getAddSignerFinalizeReplayForCeremony(addSignerCeremonyId) {
-		this.pruneExpired();
-		const replay = this.addSignerFinalizeReplayClaims.get(trimString(addSignerCeremonyId)) || null;
-		if (!replay || replay.expiresAtMs <= Date.now()) return null;
-		return replay;
-	}
-	async putAddAuthMethodCeremony(ceremony) {
-		this.pruneExpired();
-		this.addAuthMethodCeremonies.set(ceremony.addAuthMethodCeremonyId, ceremony);
-	}
-	async getAddAuthMethodCeremony(addAuthMethodCeremonyId) {
-		this.pruneExpired();
-		const ceremony = this.addAuthMethodCeremonies.get(String(addAuthMethodCeremonyId || "").trim()) || null;
-		if (!ceremony || ceremony.expiresAtMs <= Date.now()) return null;
-		return ceremony;
-	}
-	async updateAddAuthMethodCeremony(ceremony) {
-		this.pruneExpired();
-		if (ceremony.expiresAtMs <= Date.now()) return;
-		this.addAuthMethodCeremonies.set(ceremony.addAuthMethodCeremonyId, ceremony);
-	}
-	async takeAddAuthMethodCeremony(addAuthMethodCeremonyId) {
-		this.pruneExpired();
-		const key = String(addAuthMethodCeremonyId || "").trim();
-		const ceremony = this.addAuthMethodCeremonies.get(key) || null;
-		this.addAuthMethodCeremonies.delete(key);
-		if (!ceremony || ceremony.expiresAtMs <= Date.now()) return null;
-		return ceremony;
-	}
-	async putAddSignerCeremony(ceremony) {
-		this.pruneExpired();
-		this.addSignerCeremonies.set(ceremony.addSignerCeremonyId, ceremony);
-	}
-	async getAddSignerCeremony(addSignerCeremonyId) {
-		this.pruneExpired();
-		const ceremony = this.addSignerCeremonies.get(String(addSignerCeremonyId || "").trim()) || null;
-		if (!ceremony || ceremony.expiresAtMs <= Date.now()) return null;
-		return ceremony;
-	}
-	async updateAddSignerCeremony(ceremony) {
-		this.pruneExpired();
-		if (ceremony.expiresAtMs <= Date.now()) return;
-		this.addSignerCeremonies.set(ceremony.addSignerCeremonyId, ceremony);
-	}
-	async takeAddSignerCeremony(addSignerCeremonyId) {
-		this.pruneExpired();
-		const key = String(addSignerCeremonyId || "").trim();
-		const ceremony = this.addSignerCeremonies.get(key) || null;
-		this.addSignerCeremonies.delete(key);
-		if (!ceremony || ceremony.expiresAtMs <= Date.now()) return null;
-		return ceremony;
-	}
-	pruneExpired() {
-		const now = Date.now();
-		for (const [key, intent] of this.addAuthMethodIntents) if (intent.expiresAtMs <= now) this.addAuthMethodIntents.delete(key);
-		for (const [key, intent] of this.addSignerIntents) if (intent.expiresAtMs <= now) this.addSignerIntents.delete(key);
-		for (const [key, ceremony] of this.ceremonies) if (ceremony.expiresAtMs <= now) this.ceremonies.delete(key);
-		for (const [key, replay] of this.addSignerFinalizeReplays) if (replay.expiresAtMs <= now) this.addSignerFinalizeReplays.delete(key);
-		for (const [key, replay] of this.addSignerFinalizeReplayClaims) if (replay.expiresAtMs <= now) this.addSignerFinalizeReplayClaims.delete(key);
-		for (const [key, ceremony] of this.addAuthMethodCeremonies) if (ceremony.expiresAtMs <= now) this.addAuthMethodCeremonies.delete(key);
-		for (const [key, ceremony] of this.addSignerCeremonies) if (ceremony.expiresAtMs <= now) this.addSignerCeremonies.delete(key);
-	}
-};
 function assertNever(value) {
 	throw new Error(`Unexpected registration ceremony store branch: ${String(value)}`);
 }
 function trimString(value) {
 	return typeof value === "string" ? value.trim() : "";
 }
-function addSignerFinalizeReplayKey(input) {
-	return `${trimString(input.addSignerCeremonyId)}:${trimString(input.idempotencyKey)}`;
-}
 function parseJsonValue(value) {
 	if (typeof value !== "string") return value;
 	try {
@@ -316,225 +95,6 @@ function parseJsonValue(value) {
 		return null;
 	}
 }
-function parseStoredWalletAddSignerFinalizeParticipantIds(value) {
-	if (!Array.isArray(value) || value.length !== 2) return null;
-	const first = value[0];
-	const second = value[1];
-	if (typeof first !== "number" || !Number.isSafeInteger(first) || first <= 0 || typeof second !== "number" || !Number.isSafeInteger(second) || second <= 0) return null;
-	return [first, second];
-}
-function parseStoredWalletAddSignerFinalizeEd25519Result(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const record = value;
-	const signerSlot = Number(record.signerSlot);
-	const nearAccountId = trimString(record.nearAccountId);
-	const nearEd25519SigningKeyId = trimString(record.nearEd25519SigningKeyId);
-	const publicKey = trimString(record.publicKey);
-	const relayerKeyId = trimString(record.relayerKeyId);
-	const keyVersion = trimString(record.keyVersion);
-	const participantIds = parseStoredWalletAddSignerFinalizeParticipantIds(record.participantIds);
-	if (record.recoveryExportCapable !== true || !Number.isSafeInteger(signerSlot) || signerSlot <= 0 || !nearAccountId || !nearEd25519SigningKeyId || !publicKey.startsWith("ed25519:") || !relayerKeyId || !keyVersion || !participantIds) return null;
-	return {
-		signerSlot,
-		nearAccountId,
-		nearEd25519SigningKeyId,
-		publicKey,
-		relayerKeyId,
-		keyVersion,
-		recoveryExportCapable: true,
-		participantIds
-	};
-}
-function parseStoredWalletAddSignerFinalizeEcdsaWalletKey(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const record = value;
-	if (record.keyScope !== "evm-family") return null;
-	const chainTarget = thresholdEcdsaChainTargetFromValue(record.chainTarget);
-	const walletId = trimString(record.walletId);
-	const evmFamilySigningKeySlotId = trimString(record.evmFamilySigningKeySlotId);
-	const keyHandle = trimString(record.keyHandle);
-	const ecdsaThresholdKeyId = trimString(record.ecdsaThresholdKeyId);
-	const signingRootId = trimString(record.signingRootId);
-	const signingRootVersion = trimString(record.signingRootVersion);
-	const thresholdEcdsaPublicKeyB64u = trimString(record.thresholdEcdsaPublicKeyB64u);
-	const thresholdOwnerAddress = trimString(record.thresholdOwnerAddress);
-	const relayerKeyId = trimString(record.relayerKeyId);
-	const relayerVerifyingShareB64u = trimString(record.relayerVerifyingShareB64u);
-	const contextBinding32B64u = trimString(record.contextBinding32B64u);
-	const derivationClientSharePublicKey33B64u = trimString(record.derivationClientSharePublicKey33B64u);
-	const clientShareRetryCounter = Number(record.clientShareRetryCounter);
-	const relayerShareRetryCounter = Number(record.relayerShareRetryCounter);
-	const participantIds = parseStoredWalletAddSignerFinalizeParticipantIds(record.participantIds);
-	let publicCapability;
-	let parsedDerivationClientSharePublicKey33B64u;
-	try {
-		publicCapability = parseRouterAbEcdsaDerivationPublicCapabilityV1(record.publicCapability);
-		parsedDerivationClientSharePublicKey33B64u = derivationClientSharePublicKey33B64uFromString(derivationClientSharePublicKey33B64u);
-	} catch {
-		return null;
-	}
-	if (!chainTarget || !walletId || !evmFamilySigningKeySlotId || !keyHandle || !ecdsaThresholdKeyId || !signingRootId || !signingRootVersion || !thresholdEcdsaPublicKeyB64u || !thresholdOwnerAddress || !relayerKeyId || !relayerVerifyingShareB64u || !contextBinding32B64u || !derivationClientSharePublicKey33B64u || !Number.isSafeInteger(clientShareRetryCounter) || clientShareRetryCounter < 0 || !Number.isSafeInteger(relayerShareRetryCounter) || relayerShareRetryCounter < 0 || !participantIds || participantIds[0] !== 1 || participantIds[1] !== 2) return null;
-	return {
-		keyScope: "evm-family",
-		chainTarget,
-		walletId,
-		evmFamilySigningKeySlotId,
-		keyHandle,
-		ecdsaThresholdKeyId,
-		signingRootId,
-		signingRootVersion,
-		thresholdEcdsaPublicKeyB64u,
-		thresholdOwnerAddress,
-		relayerKeyId,
-		relayerVerifyingShareB64u,
-		contextBinding32B64u,
-		derivationClientSharePublicKey33B64u: parsedDerivationClientSharePublicKey33B64u,
-		clientShareRetryCounter,
-		relayerShareRetryCounter,
-		participantIds: [1, 2],
-		publicCapability
-	};
-}
-function parseStoredWalletAddSignerFinalizeEcdsaResult(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const record = value;
-	if (!Array.isArray(record.walletKeys) || record.walletKeys.length === 0) return null;
-	const walletKeys = [];
-	for (const rawWalletKey of record.walletKeys) {
-		const walletKey = parseStoredWalletAddSignerFinalizeEcdsaWalletKey(rawWalletKey);
-		if (!walletKey) return null;
-		walletKeys.push(walletKey);
-	}
-	return { walletKeys };
-}
-function parseStoredWalletAddSignerFinalizeSuccess(value) {
-	const parsed = parseJsonValue(value);
-	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return null;
-	const record = parsed;
-	if (record.ok !== true) return null;
-	const walletId = parseWalletId(record.walletId);
-	if (!walletId.ok) return null;
-	if (record.kind === "near_ed25519") {
-		if (!trimString(record.rpId) || !trimString(record.credentialIdB64u)) return null;
-		const ed25519 = parseStoredWalletAddSignerFinalizeEd25519Result(record.ed25519);
-		return ed25519 ? {
-			ok: true,
-			kind: "near_ed25519",
-			walletId: walletId.value,
-			rpId: trimString(record.rpId),
-			credentialIdB64u: trimString(record.credentialIdB64u),
-			ed25519
-		} : null;
-	}
-	if (record.kind !== "evm_family_ecdsa") return null;
-	const ecdsa = parseStoredWalletAddSignerFinalizeEcdsaResult(record.ecdsa);
-	if (!ecdsa) return null;
-	const rpId = trimString(record.rpId);
-	return rpId ? {
-		ok: true,
-		kind: "evm_family_ecdsa",
-		walletId: walletId.value,
-		rpId,
-		ecdsa
-	} : {
-		ok: true,
-		kind: "evm_family_ecdsa",
-		walletId: walletId.value,
-		ecdsa
-	};
-}
-function parseStoredWalletAddSignerFinalizeReplay(value) {
-	const parsed = parseJsonValue(value);
-	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return null;
-	const record = parsed;
-	if (record.kind !== "wallet_add_signer_finalize_replay_v1") return null;
-	const addSignerCeremonyId = trimString(record.addSignerCeremonyId);
-	const idempotencyKey = trimString(record.idempotencyKey);
-	const createdAtMs = Number(record.createdAtMs);
-	const expiresAtMs = Number(record.expiresAtMs);
-	const request = parseStoredWalletAddSignerFinalizeRequest(record.request);
-	const response = parseStoredWalletAddSignerFinalizeSuccess(record.response);
-	if (!addSignerCeremonyId || !idempotencyKey || !request || request.addSignerCeremonyId !== addSignerCeremonyId || request.idempotencyKey !== idempotencyKey || !response || request.kind !== response.kind || !Number.isSafeInteger(createdAtMs) || createdAtMs <= 0 || !Number.isSafeInteger(expiresAtMs) || expiresAtMs <= 0) return null;
-	return {
-		kind: "wallet_add_signer_finalize_replay_v1",
-		addSignerCeremonyId,
-		idempotencyKey,
-		request,
-		response,
-		createdAtMs,
-		expiresAtMs
-	};
-}
-function parseStoredWalletAddSignerFinalizeRequest(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const record = value;
-	const addSignerCeremonyId = trimString(record.addSignerCeremonyId);
-	const idempotencyKey = trimString(record.idempotencyKey);
-	if (!addSignerCeremonyId || !idempotencyKey) return null;
-	if (record.kind === "near_ed25519") {
-		if (record.custodyKeySet === null || typeof record.custodyKeySet !== "object" || Array.isArray(record.custodyKeySet) || record.activationReference === null || typeof record.activationReference !== "object" || Array.isArray(record.activationReference)) return null;
-		const custodyKeySet = record.custodyKeySet;
-		const activationReference = record.activationReference;
-		const lifecycleId = trimString(activationReference.lifecycleId);
-		const sessionId = parseStoredBytes32(activationReference.sessionId);
-		if (custodyKeySet.kind !== "near_ed25519_v1" || !lifecycleId || !sessionId) return null;
-		let keyManifestDigestB64u;
-		try {
-			keyManifestDigestB64u = parseDigestB64u(custodyKeySet.keyManifestDigestB64u);
-		} catch {
-			return null;
-		}
-		const registeredPublicKeyB64u = trimString(custodyKeySet.registeredPublicKeyB64u);
-		if (!registeredPublicKeyB64u) return null;
-		return {
-			kind: "near_ed25519",
-			addSignerCeremonyId,
-			idempotencyKey,
-			custodyKeySet: {
-				kind: "near_ed25519_v1",
-				keyManifestDigestB64u,
-				registeredPublicKeyB64u
-			},
-			activationReference: {
-				lifecycleId,
-				sessionId
-			}
-		};
-	}
-	if (record.kind !== "evm_family_ecdsa" || !Array.isArray(record.expectedKeyHandles) || record.expectedKeyHandles.length !== 1) return null;
-	const expectedKeyHandle = trimString(record.expectedKeyHandles[0]);
-	if (record.custodyKeySet === null || typeof record.custodyKeySet !== "object" || Array.isArray(record.custodyKeySet)) return null;
-	const custodyKeySet = record.custodyKeySet;
-	if (!expectedKeyHandle || custodyKeySet.kind !== "evm_family_ecdsa_v1") return null;
-	let keyManifestDigestB64u;
-	let clientRootPublicKey33B64u;
-	try {
-		keyManifestDigestB64u = parseDigestB64u(custodyKeySet.keyManifestDigestB64u);
-		clientRootPublicKey33B64u = ecdsaClientRootPublicKey33B64uFromString(trimString(custodyKeySet.clientRootPublicKey33B64u));
-	} catch {
-		return null;
-	}
-	return {
-		kind: "evm_family_ecdsa",
-		addSignerCeremonyId,
-		idempotencyKey,
-		custodyKeySet: {
-			kind: "evm_family_ecdsa_v1",
-			keyManifestDigestB64u,
-			clientRootPublicKey33B64u
-		},
-		expectedKeyHandles: [expectedKeyHandle]
-	};
-}
-function parseStoredBytes32(value) {
-	if (!Array.isArray(value) || value.length !== 32) return null;
-	const bytes = [];
-	for (const byte of value) {
-		if (typeof byte !== "number" || !Number.isInteger(byte) || byte < 0 || byte > 255) return null;
-		bytes.push(byte);
-	}
-	return bytes;
-}
 function parseStoredRegistrationSignerPlan(value) {
 	const parsed = normalizeRegistrationSignerPlan(value);
 	if (parsed.ok) return parsed.value;
@@ -722,99 +282,6 @@ function assertNeverStoredRegistrationSignerPlanBranch(branch) {
 function assertNeverStoredRegistrationNearAccountProvisioning(provisioning) {
 	throw new Error(`Unexpected stored registration account provisioning: ${String(provisioning)}`);
 }
-function parseStoredAddSignerIntent(value) {
-	const decoded = parseJsonValue(value);
-	if (decoded === null || typeof decoded !== "object" || Array.isArray(decoded)) return null;
-	const record = decoded;
-	if (record.kind !== "add_signer_intent_allocated") return null;
-	const grant = trimString(record.grant);
-	const digestB64u = trimString(record.digestB64u);
-	const orgId = trimString(record.orgId);
-	const expiresAtMs = Number(record.expiresAtMs);
-	if (!grant || !digestB64u || !orgId || !Number.isSafeInteger(expiresAtMs)) return null;
-	if (record.intent === null || typeof record.intent !== "object" || Array.isArray(record.intent)) return null;
-	const intent = record.intent;
-	if (intent.version !== "add_signer_intent_v1") return null;
-	const walletId = parseWalletId(intent.walletId);
-	const signerSelection = normalizeAddSignerSelection(intent.signerSelection, { normalizeEcdsaChainTarget: thresholdEcdsaChainTargetFromValue });
-	const nonceB64u = trimString(intent.nonceB64u);
-	if (!walletId.ok || !signerSelection.ok || !nonceB64u) return null;
-	const runtimePolicyScope = Object.prototype.hasOwnProperty.call(intent, "runtimePolicyScope") ? parseStoredAddAuthMethodRuntimePolicyScope(intent.runtimePolicyScope) : void 0;
-	if (Object.prototype.hasOwnProperty.call(intent, "runtimePolicyScope") && !runtimePolicyScope) return null;
-	const parsedIntent = runtimePolicyScope ? {
-		version: "add_signer_intent_v1",
-		walletId: walletId.value,
-		signerSelection: signerSelection.value,
-		runtimePolicyScope,
-		nonceB64u
-	} : {
-		version: "add_signer_intent_v1",
-		walletId: walletId.value,
-		signerSelection: signerSelection.value,
-		nonceB64u
-	};
-	return {
-		kind: "add_signer_intent_allocated",
-		grant: addSignerIntentGrantFromString(grant),
-		intent: parsedIntent,
-		digestB64u,
-		orgId,
-		expiresAtMs,
-		...trimString(record.signingRootId) ? { signingRootId: trimString(record.signingRootId) } : {},
-		...trimString(record.signingRootVersion) ? { signingRootVersion: trimString(record.signingRootVersion) } : {},
-		...trimString(record.expectedOrigin) ? { expectedOrigin: trimString(record.expectedOrigin) } : {}
-	};
-}
-function parseStoredAddAuthMethodIntent(value) {
-	const decoded = parseJsonValue(value);
-	if (decoded === null || typeof decoded !== "object" || Array.isArray(decoded)) return null;
-	const record = decoded;
-	if (record.kind !== "add_auth_method_intent_allocated") return null;
-	const grant = trimString(record.grant);
-	const digestB64u = trimString(record.digestB64u);
-	const orgId = trimString(record.orgId);
-	const expiresAtMs = Number(record.expiresAtMs);
-	if (!grant || !digestB64u || !orgId || !Number.isSafeInteger(expiresAtMs)) return null;
-	if (record.intent === null || typeof record.intent !== "object" || Array.isArray(record.intent)) return null;
-	const intent = record.intent;
-	const walletId = parseWalletId(intent.walletId);
-	const authMethod = normalizeAddAuthMethodInput(intent.authMethod);
-	const targetWalletAuthMethodId = parseWalletAuthMethodId(intent.targetWalletAuthMethodId);
-	const caller = normalizeAddAuthMethodIntentCaller(intent);
-	const nonceB64u = trimString(intent.nonceB64u);
-	if (intent.version !== "add_auth_method_intent_v1" || !walletId.ok || !authMethod || !targetWalletAuthMethodId.ok || !caller || !nonceB64u) return null;
-	const runtimePolicyScope = Object.prototype.hasOwnProperty.call(intent, "runtimePolicyScope") ? parseStoredAddAuthMethodRuntimePolicyScope(intent.runtimePolicyScope) : void 0;
-	if (Object.prototype.hasOwnProperty.call(intent, "runtimePolicyScope") && !runtimePolicyScope) return null;
-	const parsedIntent = caller.caller === "same_device_addition" ? {
-		version: "add_auth_method_intent_v1",
-		walletId: walletId.value,
-		authMethod,
-		targetWalletAuthMethodId: targetWalletAuthMethodId.value,
-		...runtimePolicyScope ? { runtimePolicyScope } : {},
-		nonceB64u,
-		caller: "same_device_addition",
-		source: caller.source
-	} : {
-		version: "add_auth_method_intent_v1",
-		walletId: walletId.value,
-		authMethod,
-		targetWalletAuthMethodId: targetWalletAuthMethodId.value,
-		...runtimePolicyScope ? { runtimePolicyScope } : {},
-		nonceB64u,
-		caller: "linked_device_ceremony"
-	};
-	return {
-		kind: "add_auth_method_intent_allocated",
-		grant: addAuthMethodIntentGrantFromString(grant),
-		intent: parsedIntent,
-		digestB64u,
-		orgId,
-		expiresAtMs,
-		...trimString(record.signingRootId) ? { signingRootId: trimString(record.signingRootId) } : {},
-		...trimString(record.signingRootVersion) ? { signingRootVersion: trimString(record.signingRootVersion) } : {},
-		...trimString(record.expectedOrigin) ? { expectedOrigin: trimString(record.expectedOrigin) } : {}
-	};
-}
 function parseStoredAddAuthMethodRuntimePolicyScope(value) {
 	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
 	const record = value;
@@ -835,1264 +302,7 @@ function parseStoredAddAuthMethodRuntimePolicyScope(value) {
 		envId
 	};
 }
-function parseStoredRegistrationAuthority(value) {
-	const decoded = parseJsonValue(value);
-	if (decoded === null || typeof decoded !== "object" || Array.isArray(decoded)) return null;
-	const record = decoded;
-	const walletId = parseWalletId(record.walletId);
-	const registrationIntentDigestB64u = trimString(record.registrationIntentDigestB64u);
-	if (!walletId.ok || !registrationIntentDigestB64u) return null;
-	switch (record.kind) {
-		case "passkey": {
-			if (record.emailHashHex !== void 0 || record.challengeId !== void 0) return null;
-			const rpId = parseWebAuthnRpId(record.rpId);
-			const credentialIdB64u = parseWebAuthnCredentialIdB64u(record.credentialIdB64u);
-			const credentialPublicKeyB64u = trimString(record.credentialPublicKeyB64u);
-			const counter = Number(record.counter);
-			const device = parseWebAuthnAuthenticatorDeviceInfo(record.device);
-			if (!rpId.ok || !credentialIdB64u.ok || !credentialPublicKeyB64u || !Number.isSafeInteger(counter) || counter < 0 || !device) return null;
-			return {
-				kind: "passkey",
-				walletId: walletId.value,
-				rpId: rpId.value,
-				credentialIdB64u: credentialIdB64u.value,
-				credentialPublicKeyB64u,
-				counter,
-				device,
-				registrationIntentDigestB64u
-			};
-		}
-		case "email_otp": {
-			if (record.rpId !== void 0 || record.credentialIdB64u !== void 0 || record.credentialPublicKeyB64u !== void 0 || record.counter !== void 0) return null;
-			const emailHashHex = trimString(record.emailHashHex);
-			const proofKind = trimString(record.proofKind);
-			const providerSubject = parseProviderSubject(record.providerSubject);
-			const email = trimString(record.email).toLowerCase();
-			const finalWalletId = parseWalletId(record.finalWalletId);
-			const orgId = parseOrgId(record.orgId);
-			const ownerProofBindingDigest = trimString(record.ownerProofBindingDigest);
-			if (!providerSubject.ok || !email || !emailHashHex || !finalWalletId.ok || !orgId.ok || !ownerProofBindingDigest) return null;
-			if (proofKind === "otp_challenge") {
-				const parsedChallengeId = parseEmailOtpChallengeId(record.challengeId);
-				const registrationAuthorityId = parseEmailOtpChallengeId(record.registrationAuthorityId);
-				const challengeSubjectId = parseChallengeSubjectId(record.challengeSubjectId);
-				const originalWalletId = parseWalletId(record.originalWalletId);
-				const challengePurpose = record.challengePurpose === "registration" || record.challengePurpose === "registration_reroll" ? record.challengePurpose : null;
-				if (!challengeSubjectId.ok || !parsedChallengeId.ok || !registrationAuthorityId.ok || parsedChallengeId.value !== registrationAuthorityId.value || !originalWalletId.ok || !challengePurpose) return null;
-				return {
-					kind: "email_otp",
-					proofKind: "otp_challenge",
-					walletId: walletId.value,
-					providerSubject: providerSubject.value,
-					challengeSubjectId: challengeSubjectId.value,
-					email,
-					emailHashHex,
-					challengeId: parsedChallengeId.value,
-					registrationAuthorityId: registrationAuthorityId.value,
-					originalWalletId: originalWalletId.value,
-					finalWalletId: finalWalletId.value,
-					orgId: orgId.value,
-					ownerProofBindingDigest,
-					challengePurpose,
-					registrationIntentDigestB64u
-				};
-			}
-			if (proofKind === "google_sso_registration") {
-				const registrationAttemptId = trimString(record.googleEmailOtpRegistrationAttemptId);
-				const registrationOfferId = trimString(record.googleEmailOtpRegistrationOfferId);
-				const registrationCandidateId = trimString(record.googleEmailOtpRegistrationCandidateId);
-				const registrationAuthorityId = trimString(record.registrationAuthorityId);
-				if (!registrationAttemptId || !registrationOfferId || !registrationCandidateId || !registrationAuthorityId || registrationAuthorityId !== registrationAttemptId || record.challengeId !== void 0 || record.challengeSubjectId !== void 0 || record.originalWalletId !== void 0 || record.challengePurpose !== void 0) return null;
-				return {
-					kind: "email_otp",
-					proofKind: "google_sso_registration",
-					walletId: walletId.value,
-					providerSubject: providerSubject.value,
-					email,
-					emailHashHex,
-					googleEmailOtpRegistrationAttemptId: registrationAttemptId,
-					googleEmailOtpRegistrationOfferId: registrationOfferId,
-					googleEmailOtpRegistrationCandidateId: registrationCandidateId,
-					registrationAuthorityId,
-					finalWalletId: finalWalletId.value,
-					orgId: orgId.value,
-					ownerProofBindingDigest,
-					registrationIntentDigestB64u
-				};
-			}
-			return null;
-		}
-	}
-	return null;
-}
-function parseStoredRegistrationIntent(value) {
-	const decoded = parseJsonValue(value);
-	if (decoded === null || typeof decoded !== "object" || Array.isArray(decoded)) return null;
-	const record = decoded;
-	if (record.version !== "registration_intent_v1") return null;
-	const walletId = parseWalletId(record.walletId);
-	const authMethod = normalizeRegistrationAuthMethodInput(record.authMethod);
-	const signerPlan = parseStoredRegistrationSignerPlan(record.signerSelection);
-	const foundingWalletAuthMethodId = parseWalletAuthMethodId(record.foundingWalletAuthMethodId);
-	const nonceB64u = trimString(record.nonceB64u);
-	if (!walletId.ok || !authMethod || !signerPlan || !foundingWalletAuthMethodId.ok || !nonceB64u) return null;
-	const signerSelection = registrationSignerSetSelectionFromPlan(signerPlan, { normalizeEcdsaChainTarget: thresholdEcdsaChainTargetFromValue });
-	if (!signerSelection.ok) return null;
-	const runtimePolicyScope = Object.prototype.hasOwnProperty.call(record, "runtimePolicyScope") ? parseStoredAddAuthMethodRuntimePolicyScope(record.runtimePolicyScope) : void 0;
-	if (Object.prototype.hasOwnProperty.call(record, "runtimePolicyScope") && !runtimePolicyScope) return null;
-	return runtimePolicyScope ? {
-		version: "registration_intent_v1",
-		walletId: walletId.value,
-		authMethod,
-		signerSelection: signerSelection.value,
-		foundingWalletAuthMethodId: foundingWalletAuthMethodId.value,
-		runtimePolicyScope,
-		nonceB64u
-	} : {
-		version: "registration_intent_v1",
-		walletId: walletId.value,
-		authMethod,
-		signerSelection: signerSelection.value,
-		foundingWalletAuthMethodId: foundingWalletAuthMethodId.value,
-		nonceB64u
-	};
-}
-function parseStoredRegistrationSignerBranchKey(value) {
-	const branchKey = trimString(value);
-	if (!branchKey) return null;
-	try {
-		return registrationSignerBranchKeyFromString(branchKey);
-	} catch {
-		return null;
-	}
-}
-function parseStoredRegistrationEcdsaChainTargets(value) {
-	if (!Array.isArray(value) || value.length === 0) return null;
-	const chainTargets = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const rawTarget of value) {
-		const chainTarget = thresholdEcdsaChainTargetFromValue(rawTarget);
-		if (!chainTarget) return null;
-		const key = thresholdEcdsaChainTargetKey(chainTarget);
-		if (seen.has(key)) return null;
-		seen.add(key);
-		chainTargets.push(chainTarget);
-	}
-	const first = chainTargets[0];
-	return first ? [first, ...chainTargets.slice(1)] : null;
-}
-function parseStoredRegistrationEcdsaParticipantPair(value) {
-	if (!Array.isArray(value) || value.length !== 2 || value[0] !== 1 || value[1] !== 2) return null;
-	return [1, 2];
-}
-function parseStoredWalletRegistrationEcdsaPrepare(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const record = value;
-	if (record.formatVersion !== "ecdsa-derivation-role-local") return null;
-	const walletId = trimString(record.walletId);
-	const evmFamilySigningKeySlotId = trimString(record.evmFamilySigningKeySlotId);
-	const ecdsaThresholdKeyId = trimString(record.ecdsaThresholdKeyId);
-	const signingRootId = trimString(record.signingRootId);
-	const signingRootVersion = trimString(record.signingRootVersion);
-	const relayerKeyId = trimString(record.relayerKeyId);
-	const registrationPreparationId = trimString(record.registrationPreparationId);
-	const requestId = trimString(record.requestId);
-	const thresholdSessionId = trimString(record.thresholdSessionId);
-	const ttlMs = Number(record.ttlMs);
-	const remainingUses = Number(record.remainingUses);
-	const participantIds = parseStoredRegistrationEcdsaParticipantPair(record.participantIds);
-	const runtimePolicyScope = parseStoredRuntimePolicyScope(record.runtimePolicyScope);
-	if (!walletId || !evmFamilySigningKeySlotId || !ecdsaThresholdKeyId || !signingRootId || !signingRootVersion || record.keyScope !== "evm-family" || !relayerKeyId || !registrationPreparationId || !requestId || !thresholdSessionId || !Number.isSafeInteger(ttlMs) || !Number.isSafeInteger(remainingUses) || !participantIds || !runtimePolicyScope) return null;
-	try {
-		return {
-			formatVersion: "ecdsa-derivation-role-local",
-			walletId,
-			evmFamilySigningKeySlotId,
-			ecdsaThresholdKeyId,
-			signingRootId,
-			signingRootVersion,
-			keyScope: "evm-family",
-			relayerKeyId,
-			registrationPreparationId: registrationPreparationIdFromString(registrationPreparationId),
-			requestId,
-			thresholdSessionId,
-			ttlMs,
-			remainingUses,
-			participantIds,
-			runtimePolicyScope
-		};
-	} catch {
-		return null;
-	}
-}
-function parseStoredEcdsaDerivationPublicIdentity(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const record = value;
-	const derivationClientSharePublicKey33B64u = trimString(record.derivationClientSharePublicKey33B64u);
-	const relayerPublicKey33B64u = trimString(record.relayerPublicKey33B64u);
-	const groupPublicKey33B64u = trimString(record.groupPublicKey33B64u);
-	const ethereumAddress = trimString(record.ethereumAddress);
-	if (!derivationClientSharePublicKey33B64u || !relayerPublicKey33B64u || !groupPublicKey33B64u || !ethereumAddress) return null;
-	return parseEcdsaDerivationPublicIdentity({
-		derivationClientSharePublicKey33B64u,
-		relayerPublicKey33B64u,
-		groupPublicKey33B64u,
-		ethereumAddress
-	});
-}
-function parseStoredEcdsaDerivationServerBootstrapResponse(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const record = value;
-	if (record.formatVersion !== "ecdsa-derivation-role-local") return null;
-	const publicIdentity = parseStoredEcdsaDerivationPublicIdentity(record.publicIdentity);
-	const walletId = trimString(record.walletId);
-	const evmFamilySigningKeySlotId = trimString(record.evmFamilySigningKeySlotId);
-	const ecdsaThresholdKeyId = trimString(record.ecdsaThresholdKeyId);
-	const relayerKeyId = trimString(record.relayerKeyId);
-	const applicationBindingDigestB64u = trimString(record.applicationBindingDigestB64u);
-	const contextBinding32B64u = trimString(record.contextBinding32B64u);
-	const clientShareRetryCounter = Number(record.clientShareRetryCounter);
-	const relayerShareRetryCounter = Number(record.relayerShareRetryCounter);
-	const publicTranscriptDigest32B64u = trimString(record.publicTranscriptDigest32B64u);
-	const keyHandle = trimString(record.keyHandle);
-	const signingRootId = trimString(record.signingRootId);
-	const signingRootVersion = trimString(record.signingRootVersion);
-	const thresholdEcdsaPublicKeyB64u = trimString(record.thresholdEcdsaPublicKeyB64u);
-	const ethereumAddress = trimString(record.ethereumAddress);
-	const relayerVerifyingShareB64u = trimString(record.relayerVerifyingShareB64u);
-	const participantIds = parseStoredRegistrationEcdsaParticipantPair(record.participantIds);
-	const thresholdSessionId = trimString(record.thresholdSessionId);
-	const activationEpoch = parseRootShareEpoch(record.activationEpoch);
-	const expiresAtMs = Number(record.expiresAtMs);
-	const expiresAt = trimString(record.expiresAt);
-	const remainingUses = Number(record.remainingUses);
-	let routerAbEcdsaDerivationNormalSigning;
-	try {
-		routerAbEcdsaDerivationNormalSigning = parseRouterAbEcdsaDerivationNormalSigningStateV1(record.routerAbEcdsaDerivationNormalSigning);
-	} catch {
-		return null;
-	}
-	if (!walletId || !evmFamilySigningKeySlotId || !ecdsaThresholdKeyId || !relayerKeyId || !applicationBindingDigestB64u || !contextBinding32B64u || !publicIdentity || !Number.isSafeInteger(clientShareRetryCounter) || clientShareRetryCounter < 0 || !Number.isSafeInteger(relayerShareRetryCounter) || relayerShareRetryCounter < 0 || !publicTranscriptDigest32B64u || !keyHandle || !signingRootId || !signingRootVersion || !thresholdEcdsaPublicKeyB64u || !ethereumAddress || !relayerVerifyingShareB64u || !participantIds || !thresholdSessionId || !activationEpoch.ok || !Number.isSafeInteger(expiresAtMs) || !expiresAt || !Number.isSafeInteger(remainingUses) || remainingUses < 0 || !routerAbEcdsaDerivationNormalSigning) return null;
-	return {
-		formatVersion: "ecdsa-derivation-role-local",
-		walletId,
-		evmFamilySigningKeySlotId,
-		ecdsaThresholdKeyId,
-		relayerKeyId,
-		applicationBindingDigestB64u,
-		contextBinding32B64u,
-		publicIdentity,
-		clientShareRetryCounter,
-		relayerShareRetryCounter,
-		publicTranscriptDigest32B64u,
-		keyHandle,
-		signingRootId,
-		signingRootVersion,
-		thresholdEcdsaPublicKeyB64u,
-		ethereumAddress,
-		relayerVerifyingShareB64u,
-		participantIds: [1, 2],
-		thresholdSessionId,
-		activationEpoch: activationEpoch.value,
-		expiresAtMs,
-		expiresAt,
-		remainingUses,
-		routerAbEcdsaDerivationNormalSigning
-	};
-}
-function parseStoredWalletRegistrationEcdsaBranchBase(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const record = value;
-	const branchKey = parseStoredRegistrationSignerBranchKey(record.branchKey);
-	const chainTargets = parseStoredRegistrationEcdsaChainTargets(record.chainTargets);
-	const prepare = parseStoredWalletRegistrationEcdsaPrepare(record.prepare);
-	const strictRegistrationBindingJson = trimString(record.strictRegistrationBindingJson);
-	if (!branchKey || record.derivationKind !== "evm_family_ecdsa_keygen" || !chainTargets || !prepare || !strictRegistrationBindingJson) return null;
-	let strictRegistration;
-	try {
-		strictRegistration = parseRouterAbEcdsaRegistrationRequestFactsV1(record.strictRegistration);
-	} catch {
-		return null;
-	}
-	return strictRegistration.registration_purpose === "wallet_registration" ? {
-		branchKey,
-		derivationKind: "evm_family_ecdsa_keygen",
-		chainTargets,
-		prepare,
-		strictRegistration,
-		strictRegistrationBindingJson
-	} : null;
-}
-function parseStoredWalletRegistrationSignerBranch(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const record = value;
-	switch (record.kind) {
-		case "near_ed25519_yao_authorized": {
-			const branchKey = parseStoredRegistrationSignerBranchKey(record.branchKey);
-			const admissionRequest = parseRouterAbEd25519YaoRegistrationAdmissionRequestV1(record.admissionRequest);
-			return branchKey && admissionRequest.ok ? {
-				kind: "near_ed25519_yao_authorized",
-				branchKey,
-				admissionRequest: admissionRequest.value
-			} : null;
-		}
-		case "evm_family_ecdsa_prepared": {
-			const base = parseStoredWalletRegistrationEcdsaBranchBase(record);
-			return base ? {
-				kind: "evm_family_ecdsa_prepared",
-				branchKey: base.branchKey,
-				derivationKind: base.derivationKind,
-				chainTargets: base.chainTargets,
-				prepare: base.prepare,
-				strictRegistration: base.strictRegistration,
-				strictRegistrationBindingJson: base.strictRegistrationBindingJson
-			} : null;
-		}
-		case "evm_family_ecdsa_response_claimed": {
-			const base = parseStoredWalletRegistrationEcdsaBranchBase(record);
-			if (!base) return null;
-			try {
-				const registrationRequest = parseRouterAbEcdsaRegistrationRequestV1(record.registrationRequest);
-				return registrationRequest.registration_purpose === "wallet_registration" ? {
-					kind: "evm_family_ecdsa_response_claimed",
-					branchKey: base.branchKey,
-					derivationKind: base.derivationKind,
-					chainTargets: base.chainTargets,
-					prepare: base.prepare,
-					strictRegistration: base.strictRegistration,
-					strictRegistrationBindingJson: base.strictRegistrationBindingJson,
-					registrationRequest
-				} : null;
-			} catch {
-				return null;
-			}
-		}
-		case "evm_family_ecdsa_pending_activation": {
-			const base = parseStoredWalletRegistrationEcdsaBranchBase(record);
-			if (!base) return null;
-			try {
-				const registrationRequest = parseRouterAbEcdsaRegistrationRequestV1(record.registrationRequest);
-				const pendingActivation = parseStoredRouterAbEcdsaPendingActivationV1(record.pendingActivation);
-				const publicResponse = parseRouterAbEcdsaStrictForwardedRegistrationResponseV1(record.publicResponse);
-				return registrationRequest.registration_purpose === "wallet_registration" ? {
-					kind: "evm_family_ecdsa_pending_activation",
-					branchKey: base.branchKey,
-					derivationKind: base.derivationKind,
-					chainTargets: base.chainTargets,
-					prepare: base.prepare,
-					strictRegistration: base.strictRegistration,
-					strictRegistrationBindingJson: base.strictRegistrationBindingJson,
-					registrationRequest,
-					pendingActivation,
-					publicResponse
-				} : null;
-			} catch {
-				return null;
-			}
-		}
-		case "evm_family_ecdsa_activation_claimed": {
-			const base = parseStoredWalletRegistrationEcdsaBranchBase(record);
-			const activationRequestDigestB64u = parseStoredRegistrationDigest(record.activationRequestDigestB64u);
-			const activationOwner = trimString(record.activationOwner);
-			if (!base || !activationRequestDigestB64u || !activationOwner) return null;
-			try {
-				const registrationRequest = parseRouterAbEcdsaRegistrationRequestV1(record.registrationRequest);
-				const pendingActivation = parseStoredRouterAbEcdsaPendingActivationV1(record.pendingActivation);
-				const publicResponse = parseRouterAbEcdsaStrictForwardedRegistrationResponseV1(record.publicResponse);
-				const publicFacts = parseRouterAbEcdsaVerifiedClientActivationFactsV1(record.publicFacts);
-				return registrationRequest.registration_purpose === "wallet_registration" ? {
-					kind: "evm_family_ecdsa_activation_claimed",
-					branchKey: base.branchKey,
-					derivationKind: base.derivationKind,
-					chainTargets: base.chainTargets,
-					prepare: base.prepare,
-					strictRegistration: base.strictRegistration,
-					strictRegistrationBindingJson: base.strictRegistrationBindingJson,
-					registrationRequest,
-					pendingActivation,
-					publicResponse,
-					publicFacts,
-					activationRequestDigestB64u,
-					activationOwner
-				} : null;
-			} catch {
-				return null;
-			}
-		}
-		case "evm_family_ecdsa_activated":
-		case "evm_family_ecdsa_finalized": {
-			const base = parseStoredWalletRegistrationEcdsaBranchBase(record);
-			const bootstrap = parseStoredEcdsaDerivationServerBootstrapResponse(record.bootstrap);
-			if (!base || !bootstrap) return null;
-			try {
-				const registrationRequest = parseRouterAbEcdsaRegistrationRequestV1(record.registrationRequest);
-				const publicFacts = parseRouterAbEcdsaVerifiedClientActivationFactsV1(record.publicFacts);
-				const activation = parseRouterAbEcdsaRegistrationActivationReceiptV1(record.activation);
-				const publicCapability = parseRouterAbEcdsaDerivationPublicCapabilityV1(record.publicCapability);
-				if (registrationRequest.registration_purpose !== "wallet_registration") return null;
-				if (record.kind === "evm_family_ecdsa_activated") {
-					const activationOwner = trimString(record.activationOwner);
-					return activationOwner ? {
-						kind: "evm_family_ecdsa_activated",
-						branchKey: base.branchKey,
-						derivationKind: base.derivationKind,
-						chainTargets: base.chainTargets,
-						prepare: base.prepare,
-						strictRegistration: base.strictRegistration,
-						strictRegistrationBindingJson: base.strictRegistrationBindingJson,
-						registrationRequest,
-						publicFacts,
-						activation,
-						publicCapability,
-						bootstrap,
-						activationOwner
-					} : null;
-				}
-				const finalizedAtMs = Number(record.finalizedAtMs);
-				return Number.isSafeInteger(finalizedAtMs) && finalizedAtMs > 0 ? {
-					kind: "evm_family_ecdsa_finalized",
-					branchKey: base.branchKey,
-					derivationKind: base.derivationKind,
-					chainTargets: base.chainTargets,
-					prepare: base.prepare,
-					strictRegistration: base.strictRegistration,
-					strictRegistrationBindingJson: base.strictRegistrationBindingJson,
-					registrationRequest,
-					publicFacts,
-					activation,
-					publicCapability,
-					bootstrap,
-					finalizedAtMs
-				} : null;
-			} catch {
-				return null;
-			}
-		}
-		default: return null;
-	}
-}
-function parseStoredWalletRegistrationSignerState(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const record = value;
-	if (record.kind === "signer_set_registration") {
-		if (!Array.isArray(record.branches)) return null;
-		const branches = [];
-		for (const rawBranch of record.branches) {
-			const branch = parseStoredWalletRegistrationSignerBranch(rawBranch);
-			if (!branch) return null;
-			branches.push(branch);
-		}
-		return {
-			kind: "signer_set_registration",
-			branches
-		};
-	}
-	if (record.kind !== "registration_failed") return null;
-	const failedAtMs = Number(record.failedAtMs);
-	if (!Number.isSafeInteger(failedAtMs) || failedAtMs <= 0 || record.failure === null || typeof record.failure !== "object" || Array.isArray(record.failure)) return null;
-	const failure = record.failure;
-	const code = trimString(failure.code);
-	const message = trimString(failure.message);
-	return code && message ? {
-		kind: "registration_failed",
-		failedAtMs,
-		failure: {
-			code,
-			message
-		}
-	} : null;
-}
-function parseStoredRegistrationDigest(value) {
-	try {
-		return parseDigestB64u(value);
-	} catch {
-		return null;
-	}
-}
-function parseStoredWalletRegistrationCeremony(value) {
-	const decoded = parseJsonValue(value);
-	if (decoded === null || typeof decoded !== "object" || Array.isArray(decoded)) return null;
-	const record = decoded;
-	const registrationCeremonyId = trimString(record.registrationCeremonyId);
-	const foundingWalletAuthorityId = parseWalletAuthorityId(record.foundingWalletAuthorityId);
-	const foundingDeviceId = parseDeviceId(record.foundingDeviceId);
-	const foundingWalletAuthMethodId = parseWalletAuthMethodId(record.foundingWalletAuthMethodId);
-	const intent = parseStoredRegistrationIntent(record.intent);
-	const digestB64u = trimString(record.digestB64u);
-	const signerPlan = parseStoredRegistrationSignerPlan(record.signerPlan);
-	const preparedContext = parseStoredWalletRegistrationPreparedContext(record.preparedContext);
-	const orgId = trimString(record.orgId);
-	const signingRootId = trimString(record.signingRootId);
-	const signingRootVersion = trimString(record.signingRootVersion);
-	const expectedOrigin = trimString(record.expectedOrigin);
-	const expiresAtMs = Number(record.expiresAtMs);
-	const authorityState = parseStoredWalletRegistrationCeremonyAuthorityState(record.authorityState);
-	const signerState = parseStoredWalletRegistrationSignerState(record.signerState);
-	const intentSignerPlan = intent ? parseStoredRegistrationSignerPlan(intent.signerSelection) : null;
-	if (!registrationCeremonyId || !authorityState || !foundingWalletAuthorityId.ok || !foundingDeviceId.ok || !foundingWalletAuthMethodId.ok || !intent || !digestB64u || !orgId || !Number.isSafeInteger(expiresAtMs) || !signerPlan || !preparedContext || !intentSignerPlan || !storedRegistrationSignerPlansMatch(signerPlan, intentSignerPlan) || signingRootId && preparedContext.signingRootId !== signingRootId || signingRootVersion && preparedContext.signingRootVersion !== signingRootVersion || !signerState) return null;
-	return {
-		registrationCeremonyId,
-		foundingWalletAuthorityId: foundingWalletAuthorityId.value,
-		foundingDeviceId: foundingDeviceId.value,
-		foundingWalletAuthMethodId: foundingWalletAuthMethodId.value,
-		intent,
-		digestB64u,
-		signerPlan,
-		preparedContext,
-		orgId,
-		...signingRootId ? { signingRootId } : {},
-		...signingRootVersion ? { signingRootVersion } : {},
-		...expectedOrigin ? { expectedOrigin } : {},
-		expiresAtMs,
-		authorityState,
-		signerState
-	};
-}
-function parseStoredWalletRegistrationCeremonyAuthorityState(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const record = value;
-	switch (record.kind) {
-		case "awaiting_proof": {
-			const authMethod = parseStoredRegistrationCeremonyAuthMethod(record.authMethod);
-			return authMethod ? {
-				kind: "awaiting_proof",
-				authMethod
-			} : null;
-		}
-		case "verified": {
-			const authority = parseStoredRegistrationAuthority(record.authority);
-			return authority ? {
-				kind: "verified",
-				authority
-			} : null;
-		}
-		default: return null;
-	}
-}
-function parseStoredRegistrationCeremonyAuthMethod(value) {
-	return normalizeRegistrationAuthMethodInput(parseJsonValue(value));
-}
-function parseStoredWalletAddSignerAuth(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const record = value;
-	if (record.kind !== "webauthn_assertion") return null;
-	const rpId = parseWebAuthnRpId(record.rpId);
-	const credentialIdB64u = parseWebAuthnCredentialIdB64u(record.credentialIdB64u);
-	return rpId.ok && credentialIdB64u.ok ? {
-		kind: "webauthn_assertion",
-		rpId: rpId.value,
-		credentialIdB64u: credentialIdB64u.value
-	} : null;
-}
-function parseStoredWalletAddSignerEcdsaStateBase(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const record = value;
-	const chainTargets = parseStoredRegistrationEcdsaChainTargets(record.chainTargets);
-	const prepare = parseStoredWalletRegistrationEcdsaPrepare(record.prepare);
-	if (record.derivationKind !== "evm_family_ecdsa_keygen" || !chainTargets || !prepare) return null;
-	let strictRegistration;
-	try {
-		strictRegistration = parseRouterAbEcdsaRegistrationRequestFactsV1(record.strictRegistration);
-	} catch {
-		return null;
-	}
-	return strictRegistration.registration_purpose === "wallet_add_signer" ? {
-		derivationKind: "evm_family_ecdsa_keygen",
-		chainTargets,
-		prepare,
-		strictRegistration
-	} : null;
-}
-function parseStoredWalletAddSignerNearActivation(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const record = value;
-	if (record.finalizeRequest === null || typeof record.finalizeRequest !== "object" || Array.isArray(record.finalizeRequest) || record.activation === null || typeof record.activation !== "object" || Array.isArray(record.activation)) return null;
-	const finalizeRequest = parseStoredWalletAddSignerFinalizeRequest(record.finalizeRequest);
-	const activation = record.activation;
-	const admissionRequest = parseRouterAbEd25519YaoRegistrationAdmissionRequestV1(activation.admissionRequest);
-	const admissionReceipt = parseRouterAbEd25519YaoRegistrationActivationAdmissionReceiptV1(activation.admissionReceipt);
-	const result = parseRouterAbEd25519YaoRegistrationActivationResultV1(activation.result);
-	if (!finalizeRequest || finalizeRequest.kind !== "near_ed25519" || !admissionRequest.ok || !admissionReceipt.ok || !result.ok) return null;
-	const { lifecycleId, sessionId } = finalizeRequest.activationReference;
-	if (lifecycleId !== admissionRequest.value.scope.lifecycle_id || !storedWalletAddSignerByteArraysEqual(sessionId, admissionReceipt.value.binding.session_id) || !storedWalletAddSignerByteArraysEqual(sessionId, result.value.binding.session_id)) return null;
-	return {
-		finalizeRequest,
-		activation: {
-			admissionRequest: admissionRequest.value,
-			admissionReceipt: admissionReceipt.value,
-			result: result.value
-		}
-	};
-}
-function parseStoredWalletAddSignerSignerState(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const record = value;
-	switch (record.kind) {
-		case "near_ed25519_yao_add_signer_authorized": {
-			const admissionRequest = parseRouterAbEd25519YaoRegistrationAdmissionRequestV1(record.admissionRequest);
-			return admissionRequest.ok ? {
-				kind: "near_ed25519_yao_add_signer_authorized",
-				admissionRequest: admissionRequest.value
-			} : null;
-		}
-		case "near_ed25519_yao_add_signer_activated": {
-			const activation = parseStoredWalletAddSignerNearActivation(record);
-			return activation ? {
-				kind: "near_ed25519_yao_add_signer_activated",
-				finalizeRequest: activation.finalizeRequest,
-				activation: activation.activation
-			} : null;
-		}
-		case "near_ed25519_yao_add_signer_finalizing": {
-			const activation = parseStoredWalletAddSignerNearActivation(record);
-			const response = parseStoredWalletAddSignerFinalizeSuccess(record.response);
-			if (!activation || !response || response.kind !== "near_ed25519") return null;
-			const signer = parseWalletEd25519SignerRecord(record.signer);
-			const finalizingAtMs = Number(record.finalizingAtMs);
-			return signer && Number.isSafeInteger(finalizingAtMs) && finalizingAtMs > 0 ? {
-				kind: "near_ed25519_yao_add_signer_finalizing",
-				finalizeRequest: activation.finalizeRequest,
-				activation: activation.activation,
-				response,
-				signer,
-				finalizingAtMs
-			} : null;
-		}
-		case "ecdsa_add_signer_prepared": {
-			const base = parseStoredWalletAddSignerEcdsaStateBase(record);
-			return base ? {
-				kind: "ecdsa_add_signer_prepared",
-				derivationKind: base.derivationKind,
-				chainTargets: base.chainTargets,
-				prepare: base.prepare,
-				strictRegistration: base.strictRegistration
-			} : null;
-		}
-		case "ecdsa_add_signer_pending_activation": {
-			const base = parseStoredWalletAddSignerEcdsaStateBase(record);
-			if (!base) return null;
-			try {
-				const registrationRequest = parseRouterAbEcdsaRegistrationRequestV1(record.registrationRequest);
-				const pendingActivation = parseStoredRouterAbEcdsaPendingActivationV1(record.pendingActivation);
-				const publicResponse = parseRouterAbEcdsaStrictForwardedRegistrationResponseV1(record.publicResponse);
-				return registrationRequest.registration_purpose === "wallet_add_signer" ? {
-					kind: "ecdsa_add_signer_pending_activation",
-					derivationKind: base.derivationKind,
-					chainTargets: base.chainTargets,
-					prepare: base.prepare,
-					strictRegistration: base.strictRegistration,
-					registrationRequest,
-					pendingActivation,
-					publicResponse
-				} : null;
-			} catch {
-				return null;
-			}
-		}
-		case "ecdsa_add_signer_activation_claimed": {
-			const base = parseStoredWalletAddSignerEcdsaStateBase(record);
-			const activationRequestDigestB64u = parseStoredRegistrationDigest(record.activationRequestDigestB64u);
-			if (!base || !activationRequestDigestB64u) return null;
-			try {
-				const registrationRequest = parseRouterAbEcdsaRegistrationRequestV1(record.registrationRequest);
-				const pendingActivation = parseStoredRouterAbEcdsaPendingActivationV1(record.pendingActivation);
-				const publicResponse = parseRouterAbEcdsaStrictForwardedRegistrationResponseV1(record.publicResponse);
-				const publicFacts = parseRouterAbEcdsaVerifiedClientActivationFactsV1(record.publicFacts);
-				return registrationRequest.registration_purpose === "wallet_add_signer" ? {
-					kind: "ecdsa_add_signer_activation_claimed",
-					derivationKind: base.derivationKind,
-					chainTargets: base.chainTargets,
-					prepare: base.prepare,
-					strictRegistration: base.strictRegistration,
-					registrationRequest,
-					pendingActivation,
-					publicResponse,
-					publicFacts,
-					activationRequestDigestB64u
-				} : null;
-			} catch {
-				return null;
-			}
-		}
-		case "ecdsa_add_signer_activated": {
-			const base = parseStoredWalletAddSignerEcdsaStateBase(record);
-			const activationRequestDigestB64u = parseStoredRegistrationDigest(record.activationRequestDigestB64u);
-			const bootstrap = parseStoredEcdsaDerivationServerBootstrapResponse(record.bootstrap);
-			if (!base || !activationRequestDigestB64u || !bootstrap) return null;
-			try {
-				const registrationRequest = parseRouterAbEcdsaRegistrationRequestV1(record.registrationRequest);
-				const publicFacts = parseRouterAbEcdsaVerifiedClientActivationFactsV1(record.publicFacts);
-				const activation = parseRouterAbEcdsaRegistrationActivationReceiptV1(record.activation);
-				const publicCapability = parseRouterAbEcdsaDerivationPublicCapabilityV1(record.publicCapability);
-				return registrationRequest.registration_purpose === "wallet_add_signer" ? {
-					kind: "ecdsa_add_signer_activated",
-					derivationKind: base.derivationKind,
-					chainTargets: base.chainTargets,
-					prepare: base.prepare,
-					strictRegistration: base.strictRegistration,
-					registrationRequest,
-					publicFacts,
-					activationRequestDigestB64u,
-					activation,
-					publicCapability,
-					bootstrap
-				} : null;
-			} catch {
-				return null;
-			}
-		}
-		default: return null;
-	}
-}
-function storedWalletAddSignerByteArraysEqual(left, right) {
-	return left.length === right.length && left.every((byte, index) => byte === right[index]);
-}
-function parseStoredWalletAddSignerCeremony(value) {
-	const decoded = parseJsonValue(value);
-	if (decoded === null || typeof decoded !== "object" || Array.isArray(decoded)) return null;
-	const record = decoded;
-	const addSignerCeremonyId = trimString(record.addSignerCeremonyId);
-	const digestB64u = trimString(record.digestB64u);
-	const orgId = trimString(record.orgId);
-	const signingRootId = trimString(record.signingRootId);
-	const signingRootVersion = trimString(record.signingRootVersion);
-	const expiresAtMs = Number(record.expiresAtMs);
-	const intentRecord = parseStoredAddSignerIntent({
-		kind: "add_signer_intent_allocated",
-		grant: "ignored",
-		intent: record.intent,
-		digestB64u,
-		orgId,
-		expiresAtMs
-	});
-	const auth = parseStoredWalletAddSignerAuth(record.auth);
-	const signerState = parseStoredWalletAddSignerSignerState(record.signerState);
-	if (!addSignerCeremonyId || !digestB64u || !orgId || !signingRootId || !signingRootVersion || !Number.isSafeInteger(expiresAtMs) || !intentRecord || !auth || !signerState) return null;
-	if ((signerState.kind === "near_ed25519_yao_add_signer_activated" || signerState.kind === "near_ed25519_yao_add_signer_finalizing") && signerState.finalizeRequest.addSignerCeremonyId !== addSignerCeremonyId) return null;
-	return {
-		addSignerCeremonyId,
-		intent: intentRecord.intent,
-		digestB64u,
-		orgId,
-		signingRootId,
-		signingRootVersion,
-		expiresAtMs,
-		auth,
-		signerState
-	};
-}
-function parseStoredWalletAddAuthMethodCeremonyAuth(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const record = value;
-	if (record.kind === "email_otp") {
-		const providerUserId = trimString(record.providerUserId);
-		const enrollmentId = trimString(record.enrollmentId);
-		const enrollmentSealKeyVersion = trimString(record.enrollmentSealKeyVersion);
-		const authorityRef = parseWalletAuthAuthorityRef(record.authorityRef);
-		if (!providerUserId || !enrollmentId || !enrollmentSealKeyVersion || !authorityRef) return null;
-		return {
-			kind: "email_otp",
-			providerUserId,
-			enrollmentId,
-			enrollmentSealKeyVersion,
-			authorityRef
-		};
-	}
-	if (record.kind === "wallet_session") {
-		const walletSessionId = trimString(record.walletSessionId);
-		const authorizationId = trimString(record.authorizationId);
-		const rpId = trimString(record.rpId);
-		const credentialIdB64u = trimString(record.credentialIdB64u);
-		if (!walletSessionId || !authorizationId || !rpId || !credentialIdB64u) return null;
-		return {
-			kind: "wallet_session",
-			walletSessionId,
-			authorizationId,
-			rpId,
-			credentialIdB64u
-		};
-	}
-	if (record.kind !== "webauthn_assertion") return null;
-	const rpId = trimString(record.rpId);
-	const credentialIdB64u = trimString(record.credentialIdB64u);
-	if (!rpId || !credentialIdB64u) return null;
-	return {
-		kind: "webauthn_assertion",
-		rpId,
-		credentialIdB64u
-	};
-}
-function addAuthMethodCustodyFactorMatches(auth, custodyEnvelope) {
-	switch (auth.kind) {
-		case "webauthn_assertion":
-		case "wallet_session": return custodyEnvelope.factor.kind === "passkey" && custodyEnvelope.factor.rpId === auth.rpId && custodyEnvelope.factor.credentialIdB64u === auth.credentialIdB64u;
-		case "email_otp": return custodyEnvelope.factor.kind === "email_otp" && custodyEnvelope.factor.enrollmentId === auth.enrollmentId && custodyEnvelope.factor.enrollmentSealKeyVersion === auth.enrollmentSealKeyVersion;
-		default: return assertNever(auth);
-	}
-}
-/**
-* Nullable wrapper over the canonical parser. Reading these options a second,
-* looser way here is what would let a stored ceremony and a live one disagree.
-*/
-function parseStoredWalletAddAuthMethodRegistrationOptions(value) {
-	try {
-		return parseWalletAddAuthMethodRegistrationOptions(value);
-	} catch {
-		return null;
-	}
-}
-function parseStoredWalletAddAuthMethodCeremony(value) {
-	const decoded = parseJsonValue(value);
-	if (decoded === null || typeof decoded !== "object" || Array.isArray(decoded)) return null;
-	const record = decoded;
-	const addAuthMethodCeremonyId = trimString(record.addAuthMethodCeremonyId);
-	const digestB64u = trimString(record.digestB64u);
-	const orgId = trimString(record.orgId);
-	const expiresAtMs = Number(record.expiresAtMs);
-	const sourceWalletAuthMethodId = parseWalletAuthMethodId(record.sourceWalletAuthMethodId);
-	const sourceWalletAuthorityId = parseWalletAuthorityId(record.sourceWalletAuthorityId);
-	const targetWalletAuthMethodId = parseWalletAuthMethodId(record.targetWalletAuthMethodId);
-	let sourceAuthorityDigestB64u;
-	try {
-		sourceAuthorityDigestB64u = parseDigestB64u(record.sourceAuthorityDigestB64u);
-	} catch {
-		return null;
-	}
-	const sourceAuthorityRevocationEpoch = Number(record.sourceAuthorityRevocationEpoch);
-	if (!addAuthMethodCeremonyId || !digestB64u || !orgId || !Number.isSafeInteger(expiresAtMs) || !sourceWalletAuthMethodId.ok || !sourceWalletAuthorityId.ok || !Number.isSafeInteger(sourceAuthorityRevocationEpoch) || sourceAuthorityRevocationEpoch < 0 || !targetWalletAuthMethodId.ok) return null;
-	const auth = parseStoredWalletAddAuthMethodCeremonyAuth(record.auth);
-	const intentRecord = parseStoredAddAuthMethodIntent({
-		kind: "add_auth_method_intent_allocated",
-		grant: "ignored",
-		intent: record.intent,
-		digestB64u,
-		orgId,
-		expiresAtMs
-	});
-	if (!auth || !intentRecord) return null;
-	let custodyEnvelope;
-	try {
-		custodyEnvelope = parsePasskeyCustodyEnvelopeRecord(record.custodyEnvelope);
-	} catch {
-		return null;
-	}
-	if (custodyEnvelope.walletId !== intentRecord.intent.walletId || !addAuthMethodCustodyFactorMatches(auth, custodyEnvelope) || custodyEnvelope.lifecycle.state !== "active") return null;
-	const kind = record.kind;
-	if (kind === "email_otp") {
-		const authority = parseStoredRegistrationAuthority(record.authority);
-		if (!authority || authority.kind !== "email_otp") return null;
-		return {
-			kind: "email_otp",
-			custodyEnvelope,
-			addAuthMethodCeremonyId,
-			intent: intentRecord.intent,
-			digestB64u,
-			orgId,
-			sourceWalletAuthMethodId: sourceWalletAuthMethodId.value,
-			sourceWalletAuthorityId: sourceWalletAuthorityId.value,
-			sourceAuthorityDigestB64u,
-			sourceAuthorityRevocationEpoch,
-			targetWalletAuthMethodId: targetWalletAuthMethodId.value,
-			expiresAtMs: Math.floor(expiresAtMs),
-			auth,
-			authority,
-			...trimString(record.expectedOrigin) ? { expectedOrigin: trimString(record.expectedOrigin) } : {}
-		};
-	}
-	if (kind !== "passkey" || record.passkeyRegistration === null || typeof record.passkeyRegistration !== "object" || Array.isArray(record.passkeyRegistration)) return null;
-	const passkeyRegistration = record.passkeyRegistration;
-	const rpId = parseWebAuthnRpId(passkeyRegistration.rpId);
-	const challengeB64u = trimString(passkeyRegistration.challengeB64u);
-	const options = parseStoredWalletAddAuthMethodRegistrationOptions(passkeyRegistration.options);
-	if (!rpId.ok || !challengeB64u || !options || options.rpId !== rpId.value || options.challengeB64u !== challengeB64u || intentRecord.intent.authMethod.kind !== "passkey" || intentRecord.intent.authMethod.rpId !== rpId.value) return null;
-	return {
-		kind: "passkey",
-		addAuthMethodCeremonyId,
-		intent: intentRecord.intent,
-		digestB64u,
-		orgId,
-		sourceWalletAuthMethodId: sourceWalletAuthMethodId.value,
-		sourceWalletAuthorityId: sourceWalletAuthorityId.value,
-		sourceAuthorityDigestB64u,
-		sourceAuthorityRevocationEpoch,
-		targetWalletAuthMethodId: targetWalletAuthMethodId.value,
-		expiresAtMs: Math.floor(expiresAtMs),
-		auth,
-		passkeyRegistration: {
-			rpId: rpId.value,
-			challengeB64u,
-			options
-		},
-		custodyEnvelope,
-		...trimString(record.expectedOrigin) ? { expectedOrigin: trimString(record.expectedOrigin) } : {}
-	};
-}
-function isDurableObjectNamespaceLike(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
-	return "idFromName" in value && typeof value.idFromName === "function" && "get" in value && typeof value.get === "function";
-}
-function resolveDoNamespaceFromConfig(config) {
-	const direct = config.namespace;
-	if (isDurableObjectNamespaceLike(direct)) return direct;
-	const durableObjectNamespace = config.durableObjectNamespace;
-	if (isDurableObjectNamespaceLike(durableObjectNamespace)) return durableObjectNamespace;
-	const envStyle = config.THRESHOLD_DO_NAMESPACE;
-	if (isDurableObjectNamespaceLike(envStyle)) return envStyle;
-	return null;
-}
-function resolveDoStub(input) {
-	const id = input.namespace.idFromName(input.objectName);
-	return input.namespace.get(id);
-}
-async function callDo(stub, request) {
-	const response = await stub.fetch("https://threshold-store.invalid/", {
-		method: "POST",
-		headers: { "content-type": "application/json" },
-		body: JSON.stringify(request)
-	});
-	const text = await response.text();
-	if (!response.ok) throw new Error(`Registration ceremony DO store HTTP ${response.status}: ${text}`);
-	let json;
-	try {
-		json = text ? JSON.parse(text) : null;
-	} catch {
-		throw new Error(`Registration ceremony DO store returned non-JSON response: ${text.slice(0, 200)}`);
-	}
-	if (json === null || typeof json !== "object" || Array.isArray(json)) throw new Error("Registration ceremony DO store returned invalid JSON shape");
-	const responseKeys = Reflect.ownKeys(json);
-	if (Reflect.get(json, "ok") === true && responseKeys.length === 2 && responseKeys.includes("ok") && responseKeys.includes("value")) return {
-		ok: true,
-		value: Reflect.get(json, "value")
-	};
-	if (Reflect.get(json, "ok") !== false || responseKeys.length !== 3 || !responseKeys.includes("ok") || !responseKeys.includes("code") || !responseKeys.includes("message")) throw new Error("Registration ceremony DO store returned invalid JSON shape");
-	const code = trimString(Reflect.get(json, "code"));
-	const message = trimString(Reflect.get(json, "message"));
-	return {
-		ok: false,
-		code: code || "internal",
-		message: message || "Registration ceremony DO store error"
-	};
-}
-var CloudflareDurableObjectRegistrationCeremonyStore = class {
-	constructor(input) {
-		this.stub = resolveDoStub({
-			namespace: input.namespace,
-			objectName: input.objectName
-		});
-		this.prefix = input.prefix;
-	}
-	key(scope, id) {
-		return `${this.prefix}${scope}:${id}`;
-	}
-	async putAddSignerIntent(intent) {
-		const parsed = parseStoredAddSignerIntent(intent);
-		if (!parsed) throw new Error("Invalid add-signer intent record");
-		const ttlMs = Math.max(1, parsed.expiresAtMs - Date.now());
-		const response = await callDo(this.stub, {
-			op: "set",
-			key: this.key("add-signer-intent", parsed.grant),
-			value: parsed,
-			ttlMs
-		});
-		if (!response.ok) throw new Error(response.message);
-	}
-	async getAddSignerIntent(grant) {
-		const key = trimString(grant);
-		if (!key) return null;
-		const response = await callDo(this.stub, {
-			op: "get",
-			key: this.key("add-signer-intent", key)
-		});
-		if (!response.ok) return null;
-		const intent = parseStoredAddSignerIntent(response.value);
-		if (!intent || intent.expiresAtMs <= Date.now()) return null;
-		return intent;
-	}
-	async takeAddSignerIntent(grant) {
-		const key = trimString(grant);
-		if (!key) return null;
-		const response = await callDo(this.stub, {
-			op: "getdel",
-			key: this.key("add-signer-intent", key)
-		});
-		if (!response.ok) return null;
-		const intent = parseStoredAddSignerIntent(response.value);
-		if (!intent || intent.expiresAtMs <= Date.now()) return null;
-		return {
-			...intent,
-			kind: "add_signer_intent_consumed",
-			consumedAtMs: Date.now()
-		};
-	}
-	async putAddAuthMethodIntent(intent) {
-		const parsed = parseStoredAddAuthMethodIntent(intent);
-		if (!parsed) throw new Error("Invalid add-auth-method intent record");
-		const ttlMs = Math.max(1, parsed.expiresAtMs - Date.now());
-		const response = await callDo(this.stub, {
-			op: "set",
-			key: this.key("add-auth-method-intent", parsed.grant),
-			value: parsed,
-			ttlMs
-		});
-		if (!response.ok) throw new Error(response.message);
-	}
-	async getAddAuthMethodIntent(grant) {
-		const key = trimString(grant);
-		if (!key) return null;
-		const response = await callDo(this.stub, {
-			op: "get",
-			key: this.key("add-auth-method-intent", key)
-		});
-		if (!response.ok) return null;
-		const intent = parseStoredAddAuthMethodIntent(response.value);
-		if (!intent || intent.expiresAtMs <= Date.now()) return null;
-		return intent;
-	}
-	async takeAddAuthMethodIntent(grant) {
-		const key = trimString(grant);
-		if (!key) return null;
-		const response = await callDo(this.stub, {
-			op: "getdel",
-			key: this.key("add-auth-method-intent", key)
-		});
-		if (!response.ok) return null;
-		const intent = parseStoredAddAuthMethodIntent(response.value);
-		if (!intent || intent.expiresAtMs <= Date.now()) return null;
-		return {
-			...intent,
-			kind: "add_auth_method_intent_consumed",
-			consumedAtMs: Date.now()
-		};
-	}
-	async putCeremony(ceremony) {
-		const parsed = parseStoredWalletRegistrationCeremony(ceremony);
-		if (!parsed) throw new Error("Invalid registration ceremony record");
-		const ttlMs = Math.max(1, parsed.expiresAtMs - Date.now());
-		const response = await callDo(this.stub, {
-			op: "set",
-			key: this.key("ceremony", parsed.registrationCeremonyId),
-			value: parsed,
-			ttlMs
-		});
-		if (!response.ok) throw new Error(response.message);
-	}
-	async getCeremony(registrationCeremonyId) {
-		const key = trimString(registrationCeremonyId);
-		if (!key) return null;
-		const response = await callDo(this.stub, {
-			op: "get",
-			key: this.key("ceremony", key)
-		});
-		if (!response.ok) return null;
-		const ceremony = parseStoredWalletRegistrationCeremony(response.value);
-		if (!ceremony || ceremony.expiresAtMs <= Date.now()) return null;
-		return ceremony;
-	}
-	async updateCeremony(ceremony) {
-		const parsed = parseStoredWalletRegistrationCeremony(ceremony);
-		if (!parsed) throw new Error("Invalid registration ceremony record");
-		if (parsed.expiresAtMs <= Date.now()) return;
-		const ttlMs = Math.max(1, parsed.expiresAtMs - Date.now());
-		const response = await callDo(this.stub, {
-			op: "set",
-			key: this.key("ceremony", parsed.registrationCeremonyId),
-			value: parsed,
-			ttlMs
-		});
-		if (!response.ok) throw new Error(response.message);
-	}
-	async takeCeremony(registrationCeremonyId) {
-		const key = trimString(registrationCeremonyId);
-		if (!key) return null;
-		const response = await callDo(this.stub, {
-			op: "getdel",
-			key: this.key("ceremony", key)
-		});
-		if (!response.ok) return null;
-		const ceremony = parseStoredWalletRegistrationCeremony(response.value);
-		if (!ceremony || ceremony.expiresAtMs <= Date.now()) return null;
-		return ceremony;
-	}
-	async cancelTerminalCeremony(input) {
-		const registrationCeremonyId = trimString(input.registrationCeremonyId);
-		const walletId = trimString(input.walletId);
-		if (!registrationCeremonyId || !walletId) throw new Error("Terminal registration cancellation requires ceremony and wallet IDs");
-		const response = await callDo(this.stub, {
-			op: "registrationCancelTerminal",
-			ceremonyKey: this.key("ceremony", registrationCeremonyId),
-			registrationCeremonyId,
-			walletId
-		});
-		if (!response.ok) throw new Error(response.message);
-		const result = parseTerminalRegistrationCeremonyCancellationResult(response.value);
-		if (!result) throw new Error("Terminal registration cancellation returned an invalid result");
-		return result;
-	}
-	async putAddSignerFinalizeReplay(replay) {
-		const parsed = parseStoredWalletAddSignerFinalizeReplay(replay);
-		if (!parsed) throw new Error("Invalid wallet add-signer finalize replay record");
-		const ttlMs = Math.max(1, parsed.expiresAtMs - Date.now());
-		const response = await callDo(this.stub, {
-			op: "set",
-			key: this.key("add-signer-finalize-replay", addSignerFinalizeReplayKey(parsed)),
-			value: parsed,
-			ttlMs
-		});
-		if (!response.ok) throw new Error(response.message);
-		const claimResponse = await callDo(this.stub, {
-			op: "set",
-			key: this.key("add-signer-finalize-claim", parsed.addSignerCeremonyId),
-			value: parsed,
-			ttlMs
-		});
-		if (!claimResponse.ok) throw new Error(claimResponse.message);
-	}
-	async getAddSignerFinalizeReplay(input) {
-		if (!trimString(input.addSignerCeremonyId) || !trimString(input.idempotencyKey)) return null;
-		const response = await callDo(this.stub, {
-			op: "get",
-			key: this.key("add-signer-finalize-replay", addSignerFinalizeReplayKey(input))
-		});
-		if (!response.ok) return null;
-		const replay = parseStoredWalletAddSignerFinalizeReplay(response.value);
-		if (!replay || replay.expiresAtMs <= Date.now()) return null;
-		return replay;
-	}
-	async getAddSignerFinalizeReplayForCeremony(addSignerCeremonyId) {
-		const ceremonyId = trimString(addSignerCeremonyId);
-		if (!ceremonyId) return null;
-		const response = await callDo(this.stub, {
-			op: "get",
-			key: this.key("add-signer-finalize-claim", ceremonyId)
-		});
-		if (!response.ok) return null;
-		const replay = parseStoredWalletAddSignerFinalizeReplay(response.value);
-		if (!replay || replay.expiresAtMs <= Date.now()) return null;
-		return replay;
-	}
-	async putAddAuthMethodCeremony(ceremony) {
-		const parsed = parseStoredWalletAddAuthMethodCeremony(ceremony);
-		if (!parsed) throw new Error("Invalid add-auth-method ceremony record");
-		const ttlMs = Math.max(1, parsed.expiresAtMs - Date.now());
-		const response = await callDo(this.stub, {
-			op: "set",
-			key: this.key("add-auth-method", parsed.addAuthMethodCeremonyId),
-			value: parsed,
-			ttlMs
-		});
-		if (!response.ok) throw new Error(response.message);
-	}
-	async getAddAuthMethodCeremony(addAuthMethodCeremonyId) {
-		const key = trimString(addAuthMethodCeremonyId);
-		if (!key) return null;
-		const response = await callDo(this.stub, {
-			op: "get",
-			key: this.key("add-auth-method", key)
-		});
-		if (!response.ok) return null;
-		const ceremony = parseStoredWalletAddAuthMethodCeremony(response.value);
-		if (!ceremony || ceremony.expiresAtMs <= Date.now()) return null;
-		return ceremony;
-	}
-	async updateAddAuthMethodCeremony(ceremony) {
-		const parsed = parseStoredWalletAddAuthMethodCeremony(ceremony);
-		if (!parsed) throw new Error("Invalid add-auth-method ceremony record");
-		if (parsed.expiresAtMs <= Date.now()) return;
-		const ttlMs = Math.max(1, parsed.expiresAtMs - Date.now());
-		const response = await callDo(this.stub, {
-			op: "set",
-			key: this.key("add-auth-method", parsed.addAuthMethodCeremonyId),
-			value: parsed,
-			ttlMs
-		});
-		if (!response.ok) throw new Error(response.message);
-	}
-	async takeAddAuthMethodCeremony(addAuthMethodCeremonyId) {
-		const key = trimString(addAuthMethodCeremonyId);
-		if (!key) return null;
-		const response = await callDo(this.stub, {
-			op: "getdel",
-			key: this.key("add-auth-method", key)
-		});
-		if (!response.ok) return null;
-		const ceremony = parseStoredWalletAddAuthMethodCeremony(response.value);
-		if (!ceremony || ceremony.expiresAtMs <= Date.now()) return null;
-		return ceremony;
-	}
-	async putAddSignerCeremony(ceremony) {
-		const parsed = parseStoredWalletAddSignerCeremony(ceremony);
-		if (!parsed) throw new Error("Invalid add-signer ceremony record");
-		const ttlMs = Math.max(1, parsed.expiresAtMs - Date.now());
-		const response = await callDo(this.stub, {
-			op: "set",
-			key: this.key("add-signer", parsed.addSignerCeremonyId),
-			value: parsed,
-			ttlMs
-		});
-		if (!response.ok) throw new Error(response.message);
-	}
-	async getAddSignerCeremony(addSignerCeremonyId) {
-		const key = trimString(addSignerCeremonyId);
-		if (!key) return null;
-		const response = await callDo(this.stub, {
-			op: "get",
-			key: this.key("add-signer", key)
-		});
-		if (!response.ok) return null;
-		const ceremony = parseStoredWalletAddSignerCeremony(response.value);
-		if (!ceremony || ceremony.expiresAtMs <= Date.now()) return null;
-		return ceremony;
-	}
-	async updateAddSignerCeremony(ceremony) {
-		const parsed = parseStoredWalletAddSignerCeremony(ceremony);
-		if (!parsed) throw new Error("Invalid add-signer ceremony record");
-		if (parsed.expiresAtMs <= Date.now()) return;
-		const ttlMs = Math.max(1, parsed.expiresAtMs - Date.now());
-		const response = await callDo(this.stub, {
-			op: "set",
-			key: this.key("add-signer", parsed.addSignerCeremonyId),
-			value: parsed,
-			ttlMs
-		});
-		if (!response.ok) throw new Error(response.message);
-	}
-	async takeAddSignerCeremony(addSignerCeremonyId) {
-		const key = trimString(addSignerCeremonyId);
-		if (!key) return null;
-		const response = await callDo(this.stub, {
-			op: "getdel",
-			key: this.key("add-signer", key)
-		});
-		if (!response.ok) return null;
-		const ceremony = parseStoredWalletAddSignerCeremony(response.value);
-		if (!ceremony || ceremony.expiresAtMs <= Date.now()) return null;
-		return ceremony;
-	}
-};
-function resolveRegistrationDoPrefix(config) {
-	const base = trimString(config.WALLET_REGISTRATION_PREFIX) || trimString(config.walletRegistrationPrefix) || trimString(config.keyPrefix) || trimString(config.THRESHOLD_PREFIX);
-	if (!base) return "wallet-registration:";
-	return base.endsWith(":") ? `${base}wallet-registration:` : `${base}:wallet-registration:`;
-}
-function createRegistrationCeremonyStore(input = {}) {
-	const config = input.config || {};
-	const kind = typeof config.kind === "string" ? config.kind.trim() : "";
-	if (kind === "cloudflare-do") {
-		const namespace = resolveDoNamespaceFromConfig(config);
-		if (!namespace) throw new Error("cloudflare-do registration ceremony store selected but no Durable Object namespace was provided (expected config.namespace)");
-		const objectName = trimString(config.objectName) || trimString(config.name) || "threshold-store";
-		input.logger?.info("[wallet-registration] Using Cloudflare Durable Object store for registration ceremonies");
-		return new CloudflareDurableObjectRegistrationCeremonyStore({
-			namespace,
-			objectName,
-			prefix: resolveRegistrationDoPrefix(config)
-		});
-	}
-	if (kind && kind !== "memory" && kind !== "in-memory") throw new Error(`[wallet-registration] Unknown registration ceremony store kind: ${kind}`);
-	input.logger?.warn?.("[wallet-registration] Using in-memory registration ceremony store; configure Cloudflare Durable Object storage for durable registration ceremonies");
-	return new MemoryRegistrationCeremonyStore();
-}
 //#endregion
-export { MemoryRegistrationCeremonyStore, buildStoredWalletRegistrationEvmFamilyEcdsaFinalizedBranch, buildStoredWalletRegistrationEvmFamilyEcdsaPreparedBranch, buildStoredWalletRegistrationNearEd25519YaoAuthorizedBranch, buildStoredWalletRegistrationPreparedContext, createRegistrationCeremonyStore, findStoredWalletRegistrationEvmFamilyEcdsaBranch, findStoredWalletRegistrationNearEd25519YaoBranch, parseStoredRegistrationSignerPlan, parseStoredWalletRegistrationPreparedContext, parseTerminalRegistrationCeremonyCancellationResult, registrationCeremonyAuthorityRpId, replaceStoredWalletRegistrationSignerBranch, storedRegistrationAuthoritiesMatch, storedRegistrationSignerPlansMatch, storedWalletRegistrationPreparedContextsMatch, verifiedRegistrationCeremonyAuthority };
+export { buildStoredWalletRegistrationEvmFamilyEcdsaFinalizedBranch, buildStoredWalletRegistrationEvmFamilyEcdsaPreparedBranch, buildStoredWalletRegistrationNearEd25519YaoAuthorizedBranch, buildStoredWalletRegistrationPreparedContext, findStoredWalletRegistrationEvmFamilyEcdsaBranch, findStoredWalletRegistrationNearEd25519YaoBranch, parseStoredRegistrationSignerPlan, parseStoredWalletRegistrationPreparedContext, replaceStoredWalletRegistrationSignerBranch, storedRegistrationAuthoritiesMatch, storedRegistrationSignerPlansMatch, verifiedRegistrationCeremonyAuthority };
 
 //# sourceMappingURL=RegistrationCeremonyStore.js.map