@seams/wallet 0.6.2 → 0.7.3

package/dist/esm/core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestStore.js

@@ -1,45 +1,27 @@
-import { mpcMaterialActivationRefsEqual, parseCapabilityInstanceRef, parseMpcMaterialActivationRef, parseMpcMaterialOwnerRef, parseWalletId } from "../../../shared-ts/src/utils/domainIds.js";
-import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
-import { parseCorrelationId, parseDigestB64u, parseIsoTimestamp } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { alphabetizeStringify, sha256Bytes, sha256BytesUtf8 } from "../../../shared-ts/src/utils/digests.js";
-import { canonicalRouterAbMpcMaterialActivationRefBytes, routerAbMpcMaterialActivationRefFromWire, routerAbMpcMaterialActivationRefToWire } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { parseSdkEcdsaDerivationSigningRootId, parseSdkEcdsaDerivationSigningRootVersion } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
+import { mpcMaterialActivationRefsEqual, parseMpcMaterialActivationRef, parseWalletId } from "../../../shared-ts/src/utils/domainIds.js";
+import { requireRecord } from "../../../shared-ts/src/utils/validation.js";
+import { base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
+import { parseCorrelationId } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
-import { parseCanonicalEcdsaServerActivationRequest, parseEcdsaCapabilityManifestId, parseEcdsaCapabilityManifestRevision, parseEcdsaCiphertextB64u, parseEcdsaCiphertextDigest, parseEcdsaIv12B64u, parseEcdsaMaterialSealingKeyId, parseEcdsaPendingCiphertextDigest, parseEcdsaServerGeneration, parseEvmFamilyEcdsaSignerId } from "../../../shared-ts/src/utils/ecdsaCapabilityActivation.js";
-import { parseWalletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { parseRouterAbEcdsaDerivationPublicCapabilityV1, parseRouterAbEcdsaRegistrationActivationReceiptV1, requireRouterAbEcdsaDerivationNormalSigningStateV1, routerAbEcdsaDerivationNormalSigningScopeCanonicalBytesV1, sameRouterAbEcdsaDerivationNormalSigningStateV1, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { thresholdEcdsaChainTargetFromRequest } from "../../signingEngine/interfaces/ecdsaChainTarget.js";
-import { buildVerifiedEcdsaPublicFacts, toEvmFamilyEcdsaKeyHandle, toParticipantId } from "../../signingEngine/session/identity/evmFamilyEcdsaIdentity.js";
+import { parseEcdsaCiphertextDigest, parseEcdsaMaterialSealingKeyId, parseEcdsaPendingCiphertextDigest } from "../../../shared-ts/src/utils/ecdsaCapabilityActivation.js";
 import { secureRandomId } from "../../../shared-ts/src/utils/secureRandomId.js";
-import { parseEcdsaClientVerifyingPublicKey33B64u, parseEcdsaKeyHandle, parseEcdsaRelayerKeyId, parseEcdsaRoleLocalBindingDigest, parseEcdsaRoleLocalDurableMaterialRef, parseEcdsaRoleLocalPersistedMaterialRef, parseEcdsaThresholdKeyId } from "../../signingEngine/session/keyMaterialBrands.js";
-import { SEAMS_WALLET_INDEXES, SEAMS_WALLET_STORES } from "../schemaNames.js";
+import { routerAbMpcMaterialActivationRefFromWire } from "../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { parseEcdsaClientVerifyingPublicKey33B64u, parseEcdsaRoleLocalPersistedMaterialRef } from "../../signingEngine/session/keyMaterialBrands.js";
+import { sameRouterAbEcdsaDerivationNormalSigningStateV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
+import { SEAMS_WALLET_INDEXES } from "../schemaNames.js";
 import { seamsWalletDB } from "../singletons.js";
-import { SeamsWalletRepositories } from "./repositories.js";
 import { buildEcdsaRoleLocalPublicFacts } from "../../signingEngine/session/persistence/ecdsaRoleLocalRecords.js";
-import { buildActiveEcdsaCapabilityManifest, buildDurableEcdsaMaterialBinding, buildEcdsaActivationBinding, buildEcdsaCapabilityScope, buildEcdsaManifestIdentity, buildEcdsaRoleLocalMaterialBinding, buildEcdsaServerActivationCommit, buildEncryptedEcdsaPendingCandidate, buildExactEcdsaManifestExpectation, buildExactEcdsaServerGenerationExpectation, buildNoCurrentEcdsaManifestExpectation, buildNoCurrentEcdsaServerGenerationExpectation, buildPreparedEcdsaActivationCandidate, buildPreparedEcdsaActivationJournal, buildPreparedEvmFamilySigner, buildReplacedEcdsaCapabilityManifest, buildServerCommittedEcdsaActivationJournal, buildValidatedEncryptedEcdsaReadyMaterial } from "../../signingEngine/session/material/ecdsaCapabilityManifest.js";
+import { buildActiveEcdsaCapabilityManifest, buildDurableEcdsaMaterialBinding, buildEcdsaServerActivationCommit, buildEncryptedEcdsaPendingCandidate, buildServerCommittedEcdsaActivationJournal, buildValidatedEncryptedEcdsaReadyMaterial } from "../../signingEngine/session/material/ecdsaCapabilityManifest.js";
 import { ecdsaClientPresignPoolKey, equalEcdsaClientPresignPoolIdentity, parseEcdsaClientPresignPoolIdentity } from "../../signingEngine/workerManager/ecdsaPresignPoolIdentity.js";
 import "../../signingEngine/workerManager/ecdsaPresignLifecycle.js";
+import { JOURNAL_STORE, MANIFEST_RECORD_VERSION, MANIFEST_STORE, MATERIAL_STORE, POINTER_STORE, PRESIGNATURE_STORE, SEALING_KEY_STORE, assertNever, buildPreparedJournalFromEncryptedCandidate, ciphertextDigestB64u, decryptStateBlob, ecdsaActivationCommitJournalsMatch, ecdsaActiveCapabilityManifestsMatch, ecdsaCapabilityScopesMatch, ecdsaDurableMaterialBindingsMatch, ecdsaRegisteredPublicFactsMatch, ecdsaRoleLocalMaterialBindingsMatch, ecdsaRoleLocalPublicFactsMatch, ecdsaServerActivationCommitsMatch, encryptStateBlob, generateMaterialSealingKey, materialMatchesManifest, normalizeSelector, parseActiveProof, parseCommittedJournal, parseJournalRow, parseManifestRow, parseMaterialLocator, parseMaterialRow, parsePointerRow, parseSealingKeyRow, preparedJournalProjection, runtimePolicyScopesMatch, selectorColumns, selectorFromJournal, selectorFromManifest, selectorFromSigner, selectorKey, selectorsMatch, storedJournalRow, storedMaterialRow, storedPointerRow, storedSealingKeyRow, walletAuthAuthorityRefsMatch } from "./ecdsaCapabilityManifestRecords.js";
+import { activeMaterialMatchesPresignature, decryptPresignatureBytes, deleteCursorRows, encryptPresignatureBytes, materialRefMatchesPoolIdentity, metadataFromPresignatureRow, parseDurableClientPresignatureRecordId, parsePresignatureTimestamp, parseSealedAvailableClientPresignatureRow, rawRecordId, readAvailableClientPresignatureRows, retireClientPresignaturesForActivationInTransaction, supportsStrictIndexedDbDurability } from "./ecdsaClientPresignatures.js";
+import { activeLookupUsesMaterialActivation, ecdsaManifestErrorMessage, isConstraintError, journalConstraintConflict, lookupInTransaction, materialRefOpenFailure, persistenceDigest, readActivationJournalRows, readActiveManifestRows, readPointerRowsForWallet, retryCorrelation } from "./ecdsaCapabilityManifestLookups.js";
 //#region src/core/indexedDB/seamsWalletDB/ecdsaCapabilityManifestStore.ts
-const MANIFEST_RECORD_VERSION = "ecdsa_capability_manifest_v3";
-const POINTER_RECORD_VERSION = "ecdsa_current_capability_manifest_v2";
-const MATERIAL_RECORD_VERSION = "ecdsa_role_local_material_v2";
-const JOURNAL_RECORD_VERSION = "ecdsa_activation_commit_journal_v1";
-const SEALING_KEY_RECORD_VERSION = "ecdsa_material_sealing_key_v1";
-const MANIFEST_STORE = SEAMS_WALLET_STORES.ecdsaCapabilityManifests;
-const POINTER_STORE = SEAMS_WALLET_STORES.ecdsaCurrentCapabilityManifests;
-const MATERIAL_STORE = SEAMS_WALLET_STORES.ecdsaRoleLocalMaterial;
-const JOURNAL_STORE = SEAMS_WALLET_STORES.ecdsaActivationCommitJournals;
-const SEALING_KEY_STORE = SEAMS_WALLET_STORES.ecdsaMaterialSealingKeys;
-const PRESIGNATURE_STORE = SEAMS_WALLET_STORES.ecdsaClientPresignatures;
-const AES_GCM_IV_BYTES = 12;
 const MATERIAL_AAD_VERSION = 1;
-const CLIENT_PRESIGNATURE_AAD_DOMAIN = "seams/ecdsa-client-presignature/v1";
-const MAX_EXPIRED_CLIENT_PRESIGNATURE_DELETIONS_PER_TRANSACTION = 32;
-const MAX_DURABLE_CLIENT_PRESIGNATURE_FUTURE_SKEW_MS = 5 * 6e4;
-function activeManifestMatchesWalletCustodyImport(input) {
-	const manifest = input.manifest;
+function activeManifestMatchesWalletCustodyImport(manifest, input, serverActivation) {
 	const binding = input.activationBinding;
-	return walletAuthAuthorityRefsMatch(manifest.signer.authority, binding.signer.authority) && ecdsaCapabilityScopesMatch(manifest.signer.scope, binding.signer.scope) && manifest.signer.walletId === binding.signer.walletId && manifest.signer.capability === binding.signer.capability && manifest.signer.materialOwner === binding.signer.materialOwner && manifest.signer.signingRootId === binding.signer.signingRootId && manifest.signer.signingRootVersion === binding.signer.signingRootVersion && ecdsaRegisteredPublicFactsMatch(manifest.signer.registeredPublicFacts, input.registeredPublicFacts) && ecdsaServerActivationCommitsMatch(manifest.activation.serverActivation, input.serverActivation) && mpcMaterialActivationRefsEqual(manifest.activation.materialActivation, routerAbMpcMaterialActivationRefFromWire(input.serverActivation.serverActivationReceipt.protocolReceipt.ecdsa_activation.material_activation)) && manifest.durableMaterial.bindingDigest === binding.bindingDigest && manifest.durableMaterial.durableMaterialRef === binding.durableMaterialRef && ecdsaRoleLocalMaterialBindingsMatch(manifest.durableMaterial.roleLocalBinding, binding.roleLocalBinding) && ecdsaRoleLocalPublicFactsMatch(manifest.durableMaterial.roleLocalPublicFacts, input.roleLocalPublicFacts) && sameRouterAbEcdsaDerivationNormalSigningStateV1(manifest.durableMaterial.routerAbEcdsaDerivationNormalSigning, input.routerAbEcdsaDerivationNormalSigning) && runtimePolicyScopesMatch(manifest.durableMaterial.runtimePolicyScope, normalizeRuntimePolicyScope(input.runtimePolicyScope));
+	return walletAuthAuthorityRefsMatch(manifest.signer.authority, binding.signer.authority) && ecdsaCapabilityScopesMatch(manifest.signer.scope, binding.signer.scope) && manifest.signer.walletId === binding.signer.walletId && manifest.signer.capability === binding.signer.capability && manifest.signer.materialOwner === binding.signer.materialOwner && manifest.signer.signingRootId === binding.signer.signingRootId && manifest.signer.signingRootVersion === binding.signer.signingRootVersion && ecdsaRegisteredPublicFactsMatch(manifest.signer.registeredPublicFacts, input.registeredPublicFacts) && ecdsaServerActivationCommitsMatch(manifest.activation.serverActivation, serverActivation) && mpcMaterialActivationRefsEqual(manifest.activation.materialActivation, routerAbMpcMaterialActivationRefFromWire(serverActivation.serverActivationReceipt.protocolReceipt.ecdsa_activation.material_activation)) && manifest.durableMaterial.bindingDigest === binding.bindingDigest && manifest.durableMaterial.durableMaterialRef === binding.durableMaterialRef && ecdsaRoleLocalMaterialBindingsMatch(manifest.durableMaterial.roleLocalBinding, binding.roleLocalBinding) && ecdsaRoleLocalPublicFactsMatch(manifest.durableMaterial.roleLocalPublicFacts, input.roleLocalPublicFacts) && sameRouterAbEcdsaDerivationNormalSigningStateV1(manifest.durableMaterial.routerAbEcdsaDerivationNormalSigning, input.routerAbEcdsaDerivationNormalSigning) && runtimePolicyScopesMatch(manifest.durableMaterial.runtimePolicyScope, normalizeRuntimePolicyScope(input.runtimePolicyScope));
 }
 var FinalizationControlError = class extends Error {
 	constructor(kind, message) {
@@ -48,206 +30,6 @@ var FinalizationControlError = class extends Error {
 		this.kind = kind;
 	}
 };
-function requireRecord(value, label) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
-	return value;
-}
-function requireExactKeys(record, label, expectedKeys) {
-	const actual = Object.keys(record).sort();
-	const expected = [...expectedKeys].sort();
-	if (actual.length !== expected.length || actual.some((field, index) => field !== expected[index])) throw new Error(`${label} has unexpected fields`);
-}
-function requireArray(value, label) {
-	if (!Array.isArray(value)) throw new Error(`${label} must be an array`);
-	return value;
-}
-function unwrapDomainId(result) {
-	if (!result.ok) throw new Error(result.error.message);
-	return result.value;
-}
-function normalizeSelector(selector) {
-	const authority = parseWalletAuthAuthorityRef(selector.authority);
-	if (!authority) throw new Error("ECDSA capability selector authority is invalid");
-	return {
-		capability: unwrapDomainId(parseCapabilityInstanceRef(selector.capability)),
-		authority
-	};
-}
-function selectorFromJournal(journal) {
-	return {
-		capability: journal.candidate.activationBinding.signer.capability,
-		authority: journal.candidate.activationBinding.signer.authority
-	};
-}
-function selectorFromManifest(manifest) {
-	return {
-		capability: manifest.signer.capability,
-		authority: manifest.signer.authority
-	};
-}
-function selectorKey(selector) {
-	return [
-		String(selector.capability),
-		String(selector.authority.walletId),
-		String(selector.authority.authorityDigest)
-	];
-}
-function walletAuthAuthorityRefsMatch(left, right) {
-	return left.kind === right.kind && left.walletId === right.walletId && left.authorityDigest === right.authorityDigest && left.walletAuthMethodId === right.walletAuthMethodId;
-}
-function selectorsMatch(left, right) {
-	const leftKey = selectorKey(left);
-	const rightKey = selectorKey(right);
-	return leftKey[0] === rightKey[0] && leftKey[1] === rightKey[1] && leftKey[2] === rightKey[2];
-}
-function orderedNumberValuesMatch(left, right) {
-	return left.length === right.length && left.every((value, index) => value === right[index]);
-}
-function runtimePolicyScopesMatch(left, right) {
-	return left.orgId === right.orgId && left.projectId === right.projectId && left.envId === right.envId && left.signingRootVersion === right.signingRootVersion;
-}
-function ecdsaChainTargetsMatch(left, right) {
-	if (left.kind !== right.kind) return false;
-	switch (left.kind) {
-		case "evm": return right.kind === "evm" && left.namespace === right.namespace && left.chainId === right.chainId && left.networkSlug === right.networkSlug;
-		case "tempo": return right.kind === "tempo" && left.chainId === right.chainId && left.networkSlug === right.networkSlug;
-		default: return assertNever(left);
-	}
-}
-function ecdsaCapabilityScopesMatch(left, right) {
-	return left.kind === right.kind && left.targetMemberships.length === right.targetMemberships.length && left.targetMemberships.every((target, index) => ecdsaChainTargetsMatch(target, right.targetMemberships[index]));
-}
-function ecdsaRoleLocalMaterialBindingsMatch(left, right) {
-	return left.kind === right.kind && left.keyHandle === right.keyHandle && left.ecdsaThresholdKeyId === right.ecdsaThresholdKeyId && left.clientVerifyingPublicKey33B64u === right.clientVerifyingPublicKey33B64u && orderedNumberValuesMatch(left.participantIds, right.participantIds) && left.relayerKeyId === right.relayerKeyId;
-}
-function ecdsaRoleLocalPublicFactsMatch(left, right) {
-	return left.walletId === right.walletId && ecdsaChainTargetsMatch(left.chainTarget, right.chainTarget) && left.keyHandle === right.keyHandle && left.ecdsaThresholdKeyId === right.ecdsaThresholdKeyId && left.signingRootId === right.signingRootId && left.signingRootVersion === right.signingRootVersion && left.applicationBindingDigestB64u === right.applicationBindingDigestB64u && left.clientParticipantId === right.clientParticipantId && left.relayerParticipantId === right.relayerParticipantId && orderedNumberValuesMatch(left.participantIds, right.participantIds) && left.contextBinding32B64u === right.contextBinding32B64u && left.derivationClientSharePublicKey33B64u === right.derivationClientSharePublicKey33B64u && left.relayerPublicKey33B64u === right.relayerPublicKey33B64u && left.groupPublicKey33B64u === right.groupPublicKey33B64u && left.ethereumAddress === right.ethereumAddress && sameRouterAbEcdsaDerivationPublicCapabilityV1(left.publicCapability, right.publicCapability);
-}
-function ecdsaRegisteredPublicFactsMatch(left, right) {
-	return left.kind === right.kind && left.keyHandle === right.keyHandle && left.publicKeyB64u === right.publicKeyB64u && left.participantIds.length === right.participantIds.length && left.participantIds.every((participantId, index) => participantId === right.participantIds[index]) && left.thresholdOwnerAddress === right.thresholdOwnerAddress;
-}
-function ecdsaManifestIdentitiesMatch(left, right) {
-	return left.manifestId === right.manifestId && left.manifestRevision === right.manifestRevision;
-}
-function ecdsaManifestRevisionExpectationsMatch(left, right) {
-	if (left.kind !== right.kind) return false;
-	switch (left.kind) {
-		case "no_current_manifest": return true;
-		case "exact_manifest": return right.kind === "exact_manifest" && left.manifestId === right.manifestId && left.manifestRevision === right.manifestRevision;
-		default: return assertNever(left);
-	}
-}
-function ecdsaServerGenerationExpectationsMatch(left, right) {
-	if (left.kind !== right.kind) return false;
-	switch (left.kind) {
-		case "no_current_generation": return true;
-		case "exact_generation": return right.kind === "exact_generation" && left.serverGeneration === right.serverGeneration;
-		default: return assertNever(left);
-	}
-}
-function ecdsaPreparedEvmFamilySignersMatch(left, right) {
-	return left.kind === right.kind && left.capability === right.capability && left.signerId === right.signerId && left.walletId === right.walletId && walletAuthAuthorityRefsMatch(left.authority, right.authority) && ecdsaCapabilityScopesMatch(left.scope, right.scope) && left.materialOwner === right.materialOwner && left.signingRootId === right.signingRootId && left.signingRootVersion === right.signingRootVersion;
-}
-function ecdsaRegisteredEvmFamilySignersMatch(left, right) {
-	return left.kind === right.kind && left.capability === right.capability && left.signerId === right.signerId && left.walletId === right.walletId && walletAuthAuthorityRefsMatch(left.authority, right.authority) && ecdsaCapabilityScopesMatch(left.scope, right.scope) && left.materialOwner === right.materialOwner && left.signingRootId === right.signingRootId && left.signingRootVersion === right.signingRootVersion && ecdsaRegisteredPublicFactsMatch(left.registeredPublicFacts, right.registeredPublicFacts);
-}
-function ecdsaEncryptedPendingCandidatesMatch(left, right) {
-	return left.kind === right.kind && left.sealingKeyId === right.sealingKeyId && left.iv12B64u === right.iv12B64u && left.ciphertextB64u === right.ciphertextB64u && left.ciphertextDigest === right.ciphertextDigest;
-}
-function ecdsaActivationBindingsMatch(left, right) {
-	return left.kind === right.kind && ecdsaManifestIdentitiesMatch(left.targetManifest, right.targetManifest) && ecdsaPreparedEvmFamilySignersMatch(left.signer, right.signer) && ecdsaRoleLocalMaterialBindingsMatch(left.roleLocalBinding, right.roleLocalBinding) && left.bindingDigest === right.bindingDigest && left.durableMaterialRef === right.durableMaterialRef;
-}
-function ecdsaServerActivationCommitsMatch(left, right) {
-	return left.kind === right.kind && left.correlationId === right.correlationId && left.activationRequestDigest === right.activationRequestDigest && left.serverGeneration === right.serverGeneration && ecdsaServerActivationReceiptsMatch(left.serverActivationReceipt, right.serverActivationReceipt);
-}
-function ecdsaServerActivationReceiptsMatch(left, right) {
-	return left.kind === right.kind && left.lifecycleId === right.lifecycleId && left.activationDigest === right.activationDigest && left.activatedAt === right.activatedAt && sameRouterAbEcdsaRegistrationActivationReceiptV1(left.protocolReceipt, right.protocolReceipt);
-}
-function ecdsaActivationCommandsMatch(left, right) {
-	return left.kind === right.kind && left.correlationId === right.correlationId && ecdsaServerGenerationExpectationsMatch(left.expectedGeneration, right.expectedGeneration) && left.requestDigest === right.requestDigest && left.canonicalRequest === right.canonicalRequest;
-}
-function ecdsaPreparedActivationCandidatesMatch(left, right) {
-	return left.kind === right.kind && ecdsaActivationBindingsMatch(left.activationBinding, right.activationBinding) && ecdsaEncryptedPendingCandidatesMatch(left.encryptedPending, right.encryptedPending);
-}
-function ecdsaActivationCommitJournalsMatch(left, right) {
-	if (left.kind !== right.kind) return false;
-	if (!(left.journalId === right.journalId && ecdsaManifestRevisionExpectationsMatch(left.expectedManifest, right.expectedManifest) && ecdsaActivationCommandsMatch(left.activationCommand, right.activationCommand) && ecdsaPreparedActivationCandidatesMatch(left.candidate, right.candidate) && left.createdAt === right.createdAt)) return false;
-	switch (left.kind) {
-		case "activation_prepared": return true;
-		case "server_activation_committed": return right.kind === "server_activation_committed" && ecdsaServerActivationCommitsMatch(left.serverActivation, right.serverActivation);
-		default: return assertNever(left);
-	}
-}
-function ecdsaDurableMaterialBindingsMatch(left, right) {
-	return left.kind === right.kind && mpcMaterialActivationRefsEqual(left.materialActivation, right.materialActivation) && sameRouterAbEcdsaDerivationNormalSigningStateV1(left.routerAbEcdsaDerivationNormalSigning, right.routerAbEcdsaDerivationNormalSigning) && ecdsaRoleLocalPublicFactsMatch(left.roleLocalPublicFacts, right.roleLocalPublicFacts) && ecdsaRoleLocalMaterialBindingsMatch(left.roleLocalBinding, right.roleLocalBinding) && left.durableMaterialRef === right.durableMaterialRef && left.bindingDigest === right.bindingDigest && left.lifecycleId === right.lifecycleId && left.ciphertextDigest === right.ciphertextDigest && left.activationDigest === right.activationDigest && left.activatedAt === right.activatedAt && runtimePolicyScopesMatch(left.runtimePolicyScope, right.runtimePolicyScope);
-}
-function ecdsaActiveMaterialActivationsMatch(left, right) {
-	return left.kind === right.kind && mpcMaterialActivationRefsEqual(left.materialActivation, right.materialActivation) && ecdsaServerActivationCommitsMatch(left.serverActivation, right.serverActivation) && left.retention === right.retention;
-}
-function ecdsaActiveCapabilityManifestsMatch(left, right) {
-	return left.kind === right.kind && ecdsaManifestIdentitiesMatch(left.identity, right.identity) && ecdsaRegisteredEvmFamilySignersMatch(left.signer, right.signer) && ecdsaActiveMaterialActivationsMatch(left.activation, right.activation) && ecdsaDurableMaterialBindingsMatch(left.durableMaterial, right.durableMaterial) && left.committedAt === right.committedAt;
-}
-function serverActivationRecordMatches(expected, record) {
-	try {
-		const receipt = requireRecord(record.serverActivationReceipt, "ECDSA server activation receipt");
-		return record.kind === expected.kind && parseCorrelationId(record.correlationId) === expected.correlationId && parseDigestB64u(record.activationRequestDigest) === expected.activationRequestDigest && parseEcdsaServerGeneration(record.serverGeneration) === expected.serverGeneration && receipt.kind === expected.serverActivationReceipt.kind && receipt.lifecycleId === String(expected.serverActivationReceipt.lifecycleId) && receipt.activationDigest === String(expected.serverActivationReceipt.activationDigest) && parseIsoTimestamp(receipt.activatedAt) === expected.serverActivationReceipt.activatedAt && sameRouterAbEcdsaRegistrationActivationReceiptV1(parseRouterAbEcdsaRegistrationActivationReceiptV1(receipt.protocolReceipt), expected.serverActivationReceipt.protocolReceipt);
-	} catch {
-		return false;
-	}
-}
-async function persistenceDigest(category, selector, detail) {
-	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify({
-		category,
-		capability_ref: selector.capability,
-		wallet_id: selector.authority.walletId,
-		authority_digest: selector.authority.authorityDigest,
-		wallet_auth_method_id: selector.authority.walletAuthMethodId,
-		detail
-	}))));
-}
-function retryCorrelation() {
-	return parseCorrelationId(secureRandomId("ecdsa-persistence-retry", 16, "ECDSA persistence retry correlations"));
-}
-function buildPreparedJournalFromEncryptedCandidate(input) {
-	const candidate = buildPreparedEcdsaActivationCandidate({
-		activationBinding: input.preparation.activationBinding,
-		encryptedPending: input.encryptedPending
-	});
-	switch (input.preparation.expectedManifest.kind) {
-		case "no_current_manifest":
-			if (input.preparation.expectedGeneration.kind !== "no_current_generation") throw new Error("Initial ECDSA activation cannot expect a server generation");
-			return buildPreparedEcdsaActivationJournal({
-				journalId: input.preparation.journalId,
-				expectedManifest: input.preparation.expectedManifest,
-				expectedGeneration: input.preparation.expectedGeneration,
-				candidate,
-				requestDigest: input.preparation.requestDigest,
-				canonicalRequest: input.preparation.canonicalRequest,
-				createdAt: input.preparation.createdAt
-			});
-		case "exact_manifest":
-			if (input.preparation.expectedGeneration.kind !== "exact_generation") throw new Error("Replacement ECDSA activation requires an exact server generation");
-			return buildPreparedEcdsaActivationJournal({
-				journalId: input.preparation.journalId,
-				expectedManifest: input.preparation.expectedManifest,
-				expectedGeneration: input.preparation.expectedGeneration,
-				candidate,
-				requestDigest: input.preparation.requestDigest,
-				canonicalRequest: input.preparation.canonicalRequest,
-				createdAt: input.preparation.createdAt
-			});
-		default: return assertNever(input.preparation.expectedManifest);
-	}
-}
-function decodeCanonicalStateBlob(value, label) {
-	if (typeof value !== "string" || value.length === 0 || !/^[A-Za-z0-9_-]+$/.test(value)) throw new Error(`${label} must be non-empty unpadded base64url`);
-	const bytes = base64UrlDecode(value);
-	if (bytes.length === 0 || base64UrlEncode(bytes) !== value) {
-		bytes.fill(0);
-		throw new Error(`${label} must be canonical base64url`);
-	}
-	return bytes;
-}
 function activationBindingAadProjection(binding) {
 	return {
 		target_manifest: binding.targetManifest,
@@ -266,24 +48,6 @@ function activationBindingAadProjection(binding) {
 		durable_material_ref: binding.durableMaterialRef
 	};
 }
-function activeManifestBindingAadProjection(manifest) {
-	return {
-		target_manifest: manifest.identity,
-		signer: {
-			capability: manifest.signer.capability,
-			signer_id: manifest.signer.signerId,
-			wallet_id: manifest.signer.walletId,
-			authority: manifest.signer.authority,
-			scope: manifest.signer.scope,
-			material_owner: manifest.signer.materialOwner,
-			signing_root_id: manifest.signer.signingRootId,
-			signing_root_version: manifest.signer.signingRootVersion
-		},
-		role_local_binding: manifest.durableMaterial.roleLocalBinding,
-		binding_digest: manifest.durableMaterial.bindingDigest,
-		durable_material_ref: manifest.durableMaterial.durableMaterialRef
-	};
-}
 function pendingAadProjection(input) {
 	if ("activationBinding" in input) return {
 		version: MATERIAL_AAD_VERSION,
@@ -311,604 +75,23 @@ function pendingAadProjection(input) {
 	};
 }
 function readyAadProjection(input) {
+	if (input.kind === "server_activation_committed") return readyAadProjectionFor(input.candidate.activationBinding, input.serverActivation);
+	return readyAadProjectionFor({
+		targetManifest: input.identity,
+		signer: input.signer,
+		roleLocalBinding: input.durableMaterial.roleLocalBinding,
+		bindingDigest: input.durableMaterial.bindingDigest,
+		durableMaterialRef: input.durableMaterial.durableMaterialRef
+	}, input.activation.serverActivation);
+}
+function readyAadProjectionFor(activationBinding, serverActivation) {
 	return {
 		version: MATERIAL_AAD_VERSION,
 		stage: "activation_ready",
-		activation_binding: input.kind === "server_activation_committed" ? activationBindingAadProjection(input.candidate.activationBinding) : activeManifestBindingAadProjection(input),
-		server_activation: input.kind === "server_activation_committed" ? input.serverActivation : input.activation.serverActivation
-	};
-}
-function importedReadyAadProjection(input) {
-	return {
-		version: MATERIAL_AAD_VERSION,
-		stage: "activation_ready",
-		activation_binding: activationBindingAadProjection(input.activationBinding),
-		server_activation: input.serverActivation
-	};
-}
-function additionalData(projection) {
-	return new TextEncoder().encode(alphabetizeStringify(projection));
-}
-function activeMaterialMatchesPresignaturePoolIdentity(material, poolIdentity) {
-	const scope = material.binding.routerAbEcdsaDerivationNormalSigning.scope;
-	const materialActivation = routerAbMpcMaterialActivationRefToWire(material.binding.materialActivation);
-	return scope.wallet_id === poolIdentity.walletId && base64UrlEncode(routerAbEcdsaDerivationNormalSigningScopeCanonicalBytesV1(scope)) === poolIdentity.signingScopeB64u && base64UrlEncode(canonicalRouterAbMpcMaterialActivationRefBytes(materialActivation)) === poolIdentity.materialActivationB64u && scope.signing_worker.key_epoch === poolIdentity.keyEpoch && scope.activation_epoch === poolIdentity.activationEpoch && materialActivation.activation_id === poolIdentity.materialActivationId && materialActivation.capability === poolIdentity.capability && materialActivation.key_binding === poolIdentity.keyBinding && materialActivation.material_owner === poolIdentity.walletId;
-}
-function parseDurableClientPresignatureRecordId(value) {
-	if (typeof value !== "string" || !/^ecdsa-client-presignature-[A-Za-z0-9_-]+$/.test(value)) throw new Error("ECDSA durable presignature record id is invalid");
-	return value;
-}
-function parsePresignatureTimestamp(value, label) {
-	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} is invalid`);
-	return value;
-}
-function rawRecordId(value) {
-	if (!value || typeof value !== "object" || !("record_id" in value)) return null;
-	const recordId = value.record_id;
-	return typeof recordId === "string" ? recordId : null;
-}
-function supportsStrictIndexedDbDurability() {
-	return typeof IDBTransaction !== "undefined" && "durability" in IDBTransaction.prototype;
-}
-async function deleteExpiredClientPresignatureRows(context, walletId, nowMs) {
-	let cursor = await context.store(PRESIGNATURE_STORE).index(SEAMS_WALLET_INDEXES.walletExpiresAt).openCursor(IDBKeyRange.bound([walletId, 0], [walletId, nowMs]));
-	let deletedCount = 0;
-	while (cursor && deletedCount < MAX_EXPIRED_CLIENT_PRESIGNATURE_DELETIONS_PER_TRANSACTION) {
-		await cursor.delete();
-		deletedCount += 1;
-		cursor = await cursor.continue();
-	}
-	return deletedCount;
-}
-function presignatureAadProjection(metadata) {
-	return {
-		domain: CLIENT_PRESIGNATURE_AAD_DOMAIN,
-		version: 1,
-		pool_identity: metadata.poolIdentity,
-		durable_material_ref: metadata.durableMaterialRef,
-		presignature_id: metadata.presignatureId,
-		group_public_key33_b64u: metadata.groupPublicKey33B64u,
-		big_r33_b64u: metadata.bigR33B64u,
-		created_at_ms: metadata.createdAtMs,
-		expires_at_ms: metadata.expiresAtMs,
-		sealing_key_id: metadata.sealingKeyId
-	};
-}
-function parseSealedAvailableClientPresignatureRow(value) {
-	const record = requireRecord(value, "ECDSA durable presignature row");
-	requireExactKeys(record, "ECDSA durable presignature row", [
-		"kind",
-		"record_id",
-		"pool_identity",
-		"pool_identity_key",
-		"wallet_id",
-		"material_activation_id",
-		"durable_material_ref",
-		"presignature_id",
-		"group_public_key33_b64u",
-		"big_r33_b64u",
-		"created_at_ms",
-		"expires_at_ms",
-		"sealed"
-	]);
-	if (record.kind !== "sealed_available_client_presignature_v1") throw new Error("ECDSA durable presignature row kind is invalid");
-	const poolIdentityRecord = requireRecord(record.pool_identity, "ECDSA durable presignature pool identity");
-	requireExactKeys(poolIdentityRecord, "ECDSA durable presignature pool identity", [
-		"activationEpoch",
-		"capability",
-		"keyBinding",
-		"keyEpoch",
-		"materialActivationB64u",
-		"materialActivationId",
-		"pairRole",
-		"protocolId",
-		"relayerUrl",
-		"signingScopeB64u",
-		"walletId"
-	]);
-	const poolIdentity = parseEcdsaClientPresignPoolIdentity(poolIdentityRecord);
-	const recordId = parseDurableClientPresignatureRecordId(record.record_id);
-	const poolIdentityKeyValue = String(record.pool_identity_key ?? "");
-	if (poolIdentityKeyValue !== ecdsaClientPresignPoolKey(poolIdentity)) throw new Error("ECDSA durable presignature pool identity index is inconsistent");
-	const walletId = String(record.wallet_id ?? "").trim();
-	const materialActivationId = String(record.material_activation_id ?? "").trim();
-	if (!walletId || walletId !== poolIdentity.walletId) throw new Error("ECDSA durable presignature wallet binding is inconsistent");
-	if (!materialActivationId || materialActivationId !== poolIdentity.materialActivationId) throw new Error("ECDSA durable presignature activation binding is inconsistent");
-	const durableMaterialRef = parseEcdsaRoleLocalPersistedMaterialRef(record.durable_material_ref);
-	if (durableMaterialRef.materialActivation.activationId !== poolIdentity.materialActivationId || durableMaterialRef.materialActivation.capability !== poolIdentity.capability || durableMaterialRef.materialActivation.keyBinding !== poolIdentity.keyBinding || durableMaterialRef.materialActivation.materialOwner !== poolIdentity.walletId) throw new Error("ECDSA durable presignature material binding is inconsistent");
-	const presignatureId = String(record.presignature_id ?? "").trim();
-	if (!presignatureId) throw new Error("ECDSA durable presignature id is invalid");
-	const groupPublicKey33B64u = parseEcdsaClientVerifyingPublicKey33B64u(record.group_public_key33_b64u);
-	const bigR33B64u = parseEcdsaClientVerifyingPublicKey33B64u(record.big_r33_b64u);
-	const createdAtMs = parsePresignatureTimestamp(record.created_at_ms, "created_at_ms");
-	const expiresAtMs = parsePresignatureTimestamp(record.expires_at_ms, "expires_at_ms");
-	if (createdAtMs > Date.now() + MAX_DURABLE_CLIENT_PRESIGNATURE_FUTURE_SKEW_MS) throw new Error("ECDSA durable presignature creation timestamp is in the future");
-	if (expiresAtMs <= createdAtMs) throw new Error("ECDSA durable presignature expiry must follow creation");
-	if (expiresAtMs - createdAtMs > 7776e6) throw new Error("ECDSA durable presignature lifetime exceeds the maximum");
-	const sealed = requireRecord(record.sealed, "ECDSA durable presignature sealed payload");
-	requireExactKeys(sealed, "ECDSA durable presignature sealed payload", [
-		"kind",
-		"sealing_key_id",
-		"iv12_b64u",
-		"ciphertext_b64u",
-		"ciphertext_digest_b64u"
-	]);
-	if (sealed.kind !== "ecdsa_activation_aes_gcm_v1") throw new Error("ECDSA durable presignature sealing kind is invalid");
-	return {
-		kind: "sealed_available_client_presignature_v1",
-		record_id: recordId,
-		pool_identity: poolIdentity,
-		pool_identity_key: poolIdentityKeyValue,
-		wallet_id: walletId,
-		material_activation_id: materialActivationId,
-		durable_material_ref: durableMaterialRef,
-		presignature_id: presignatureId,
-		group_public_key33_b64u: groupPublicKey33B64u,
-		big_r33_b64u: bigR33B64u,
-		created_at_ms: createdAtMs,
-		expires_at_ms: expiresAtMs,
-		sealed: {
-			kind: "ecdsa_activation_aes_gcm_v1",
-			sealing_key_id: parseEcdsaMaterialSealingKeyId(sealed.sealing_key_id),
-			iv12_b64u: parseEcdsaIv12B64u(sealed.iv12_b64u),
-			ciphertext_b64u: parseEcdsaCiphertextB64u(sealed.ciphertext_b64u),
-			ciphertext_digest_b64u: parseEcdsaCiphertextDigest(sealed.ciphertext_digest_b64u)
-		}
-	};
-}
-function metadataFromPresignatureRow(row) {
-	return {
-		kind: "sealed_available_client_presignature_v1",
-		recordId: row.record_id,
-		poolIdentity: row.pool_identity,
-		durableMaterialRef: row.durable_material_ref,
-		presignatureId: row.presignature_id,
-		groupPublicKey33B64u: row.group_public_key33_b64u,
-		bigR33B64u: row.big_r33_b64u,
-		createdAtMs: row.created_at_ms,
-		expiresAtMs: row.expires_at_ms,
-		sealingKeyId: row.sealed.sealing_key_id
-	};
-}
-async function encryptPresignatureBytes(input) {
-	const iv12 = crypto.getRandomValues(new Uint8Array(AES_GCM_IV_BYTES));
-	const aad = additionalData(presignatureAadProjection(input.metadata));
-	try {
-		const ciphertext = new Uint8Array(await crypto.subtle.encrypt({
-			name: "AES-GCM",
-			iv: iv12,
-			additionalData: aad
-		}, input.key, input.plaintext97));
-		try {
-			const ciphertextB64u = base64UrlEncode(ciphertext);
-			return {
-				iv12B64u: parseEcdsaIv12B64u(base64UrlEncode(iv12)),
-				ciphertextB64u: parseEcdsaCiphertextB64u(ciphertextB64u),
-				ciphertextDigestB64u: parseEcdsaCiphertextDigest(base64UrlEncode(await sha256Bytes(ciphertext)))
-			};
-		} finally {
-			ciphertext.fill(0);
-		}
-	} finally {
-		iv12.fill(0);
-		aad.fill(0);
-		input.plaintext97.fill(0);
-	}
-}
-async function decryptPresignatureBytes(input) {
-	const iv12 = base64UrlDecode(input.sealed.iv12_b64u);
-	const ciphertext = base64UrlDecode(input.sealed.ciphertext_b64u);
-	const aad = additionalData(presignatureAadProjection(input.metadata));
-	let plaintext = null;
-	try {
-		if (base64UrlEncode(await sha256Bytes(ciphertext)) !== input.sealed.ciphertext_digest_b64u) throw new Error("ECDSA durable presignature ciphertext digest mismatch");
-		plaintext = new Uint8Array(await crypto.subtle.decrypt({
-			name: "AES-GCM",
-			iv: iv12,
-			additionalData: aad
-		}, input.key, ciphertext));
-		if (plaintext.length !== 97) throw new Error("ECDSA durable presignature plaintext length is invalid");
-		return plaintext.slice();
-	} finally {
-		iv12.fill(0);
-		ciphertext.fill(0);
-		aad.fill(0);
-		plaintext?.fill(0);
-	}
-}
-async function generateMaterialSealingKey() {
-	return await crypto.subtle.generateKey({
-		name: "AES-GCM",
-		length: 256
-	}, false, ["encrypt", "decrypt"]);
-}
-async function encryptStateBlob(input) {
-	const plaintext = decodeCanonicalStateBlob(input.stateBlobB64u, "ECDSA state blob");
-	const iv12 = crypto.getRandomValues(new Uint8Array(AES_GCM_IV_BYTES));
-	const aad = additionalData(input.aadProjection);
-	try {
-		const ciphertext = new Uint8Array(await crypto.subtle.encrypt({
-			name: "AES-GCM",
-			iv: iv12,
-			additionalData: aad
-		}, input.key, plaintext));
-		try {
-			return {
-				iv12B64u: parseEcdsaIv12B64u(base64UrlEncode(iv12)),
-				ciphertextB64u: parseEcdsaCiphertextB64u(base64UrlEncode(ciphertext)),
-				digestB64u: base64UrlEncode(await sha256Bytes(ciphertext))
-			};
-		} finally {
-			ciphertext.fill(0);
-		}
-	} finally {
-		plaintext.fill(0);
-		aad.fill(0);
-	}
-}
-async function ciphertextDigestB64u(ciphertextB64u) {
-	const ciphertext = base64UrlDecode(ciphertextB64u);
-	try {
-		return base64UrlEncode(await sha256Bytes(ciphertext));
-	} finally {
-		ciphertext.fill(0);
-	}
-}
-async function decryptStateBlob(input) {
-	const iv12 = base64UrlDecode(input.iv12B64u);
-	const ciphertext = base64UrlDecode(input.ciphertextB64u);
-	const aad = additionalData(input.aadProjection);
-	let plaintext = null;
-	try {
-		plaintext = new Uint8Array(await crypto.subtle.decrypt({
-			name: "AES-GCM",
-			iv: iv12,
-			additionalData: aad
-		}, input.key, ciphertext));
-		if (plaintext.length === 0) throw new Error("decrypted ECDSA state blob must not be empty");
-		return base64UrlEncode(plaintext);
-	} finally {
-		iv12.fill(0);
-		ciphertext.fill(0);
-		aad.fill(0);
-		plaintext?.fill(0);
-	}
-}
-function parseManifestIdentity(value) {
-	const record = requireRecord(value, "ECDSA manifest identity");
-	requireExactKeys(record, "ECDSA manifest identity", ["manifestId", "manifestRevision"]);
-	return buildEcdsaManifestIdentity({
-		manifestId: parseEcdsaCapabilityManifestId(record.manifestId),
-		manifestRevision: parseEcdsaCapabilityManifestRevision(record.manifestRevision)
-	});
-}
-function parseManifestExpectation(value) {
-	const record = requireRecord(value, "ECDSA manifest expectation");
-	switch (record.kind) {
-		case "no_current_manifest":
-			requireExactKeys(record, "ECDSA no-current manifest expectation", ["kind"]);
-			return buildNoCurrentEcdsaManifestExpectation();
-		case "exact_manifest":
-			requireExactKeys(record, "ECDSA exact manifest expectation", [
-				"kind",
-				"manifestId",
-				"manifestRevision"
-			]);
-			return buildExactEcdsaManifestExpectation(buildEcdsaManifestIdentity({
-				manifestId: parseEcdsaCapabilityManifestId(record.manifestId),
-				manifestRevision: parseEcdsaCapabilityManifestRevision(record.manifestRevision)
-			}));
-		default: throw new Error("ECDSA manifest expectation kind is invalid");
-	}
-}
-function parseChainTarget(value) {
-	const record = requireRecord(value, "ECDSA capability target");
-	switch (record.kind) {
-		case "evm":
-			requireExactKeys(record, "ECDSA EVM capability target", [
-				"kind",
-				"namespace",
-				"chainId",
-				"networkSlug"
-			]);
-			return thresholdEcdsaChainTargetFromRequest({
-				kind: record.kind,
-				namespace: record.namespace,
-				chainId: record.chainId,
-				networkSlug: record.networkSlug
-			});
-		case "tempo":
-			requireExactKeys(record, "ECDSA Tempo capability target", [
-				"kind",
-				"chainId",
-				"networkSlug"
-			]);
-			return thresholdEcdsaChainTargetFromRequest({
-				kind: record.kind,
-				chainId: record.chainId,
-				networkSlug: record.networkSlug
-			});
-		default: throw new Error("ECDSA capability target kind is invalid");
-	}
-}
-function parseCapabilityScope(value) {
-	const record = requireRecord(value, "ECDSA capability scope");
-	requireExactKeys(record, "ECDSA capability scope", ["kind", "targetMemberships"]);
-	if (record.kind !== "evm_family") throw new Error("ECDSA capability scope kind is invalid");
-	const targetValues = requireArray(record.targetMemberships, "ECDSA capability target memberships");
-	const targets = [];
-	for (const targetValue of targetValues) targets.push(parseChainTarget(targetValue));
-	const [first, ...rest] = targets;
-	if (!first) throw new Error("ECDSA capability scope requires at least one target");
-	return buildEcdsaCapabilityScope({ targetMemberships: [first, ...rest] });
-}
-function parseRoleLocalBinding(value) {
-	const record = requireRecord(value, "ECDSA role-local material binding");
-	requireExactKeys(record, "ECDSA role-local material binding", [
-		"kind",
-		"keyHandle",
-		"ecdsaThresholdKeyId",
-		"clientVerifyingPublicKey33B64u",
-		"participantIds",
-		"relayerKeyId"
-	]);
-	if (record.kind !== "ecdsa_role_local_material_binding") throw new Error("ECDSA role-local material binding kind is invalid");
-	const participantValues = requireArray(record.participantIds, "ECDSA role-local participant ids");
-	const participantIds = [];
-	for (const participantValue of participantValues) participantIds.push(toParticipantId(participantValue));
-	const [firstParticipantId, ...remainingParticipantIds] = participantIds;
-	if (!firstParticipantId) throw new Error("ECDSA role-local material requires at least one participant");
-	return buildEcdsaRoleLocalMaterialBinding({
-		keyHandle: parseEcdsaKeyHandle(record.keyHandle),
-		ecdsaThresholdKeyId: parseEcdsaThresholdKeyId(record.ecdsaThresholdKeyId),
-		clientVerifyingPublicKey33B64u: parseEcdsaClientVerifyingPublicKey33B64u(record.clientVerifyingPublicKey33B64u),
-		participantIds: [firstParticipantId, ...remainingParticipantIds],
-		relayerKeyId: parseEcdsaRelayerKeyId(record.relayerKeyId)
-	});
-}
-function parsePreparedSigner(value) {
-	const record = requireRecord(value, "prepared ECDSA signer");
-	requireExactKeys(record, "prepared ECDSA signer", [
-		"kind",
-		"capability",
-		"signerId",
-		"walletId",
-		"authority",
-		"scope",
-		"materialOwner",
-		"signingRootId",
-		"signingRootVersion"
-	]);
-	if (record.kind !== "prepared_evm_family_signer") throw new Error("prepared ECDSA signer kind is invalid");
-	const authority = parseWalletAuthAuthorityRef(record.authority);
-	if (!authority) throw new Error("prepared ECDSA signer authority is invalid");
-	if (String(record.walletId) !== String(authority.walletId)) throw new Error("prepared ECDSA signer wallet does not match its authority");
-	return buildPreparedEvmFamilySigner({
-		capability: unwrapDomainId(parseCapabilityInstanceRef(record.capability)),
-		signerId: parseEvmFamilyEcdsaSignerId(record.signerId),
-		authority,
-		scope: parseCapabilityScope(record.scope),
-		materialOwner: unwrapDomainId(parseMpcMaterialOwnerRef(record.materialOwner)),
-		signingRootId: parseSdkEcdsaDerivationSigningRootId(record.signingRootId),
-		signingRootVersion: parseSdkEcdsaDerivationSigningRootVersion(record.signingRootVersion)
-	});
-}
-function parseEncryptedPendingCandidate(value) {
-	const record = requireRecord(value, "encrypted ECDSA pending candidate");
-	requireExactKeys(record, "encrypted ECDSA pending candidate", [
-		"kind",
-		"sealingKeyId",
-		"iv12B64u",
-		"ciphertextB64u",
-		"ciphertextDigest"
-	]);
-	if (record.kind !== "encrypted_ecdsa_pending_candidate") throw new Error("encrypted ECDSA pending candidate kind is invalid");
-	return buildEncryptedEcdsaPendingCandidate({
-		sealingKeyId: parseEcdsaMaterialSealingKeyId(record.sealingKeyId),
-		iv12B64u: parseEcdsaIv12B64u(record.iv12B64u),
-		ciphertextB64u: parseEcdsaCiphertextB64u(record.ciphertextB64u),
-		ciphertextDigest: parseEcdsaPendingCiphertextDigest(record.ciphertextDigest)
-	});
-}
-function parseActivationBinding(value) {
-	const record = requireRecord(value, "ECDSA activation binding");
-	requireExactKeys(record, "ECDSA activation binding", [
-		"kind",
-		"targetManifest",
-		"signer",
-		"roleLocalBinding",
-		"bindingDigest",
-		"durableMaterialRef"
-	]);
-	if (record.kind !== "ecdsa_activation_binding") throw new Error("ECDSA activation binding kind is invalid");
-	return buildEcdsaActivationBinding({
-		targetManifest: parseManifestIdentity(record.targetManifest),
-		signer: parsePreparedSigner(record.signer),
-		roleLocalBinding: parseRoleLocalBinding(record.roleLocalBinding),
-		bindingDigest: parseEcdsaRoleLocalBindingDigest(record.bindingDigest),
-		durableMaterialRef: parseEcdsaRoleLocalDurableMaterialRef(record.durableMaterialRef)
-	});
-}
-function parsePreparedCandidate(value) {
-	const record = requireRecord(value, "prepared ECDSA activation candidate");
-	requireExactKeys(record, "prepared ECDSA activation candidate", [
-		"kind",
-		"activationBinding",
-		"encryptedPending"
-	]);
-	if (record.kind !== "prepared_ecdsa_activation_candidate") throw new Error("prepared ECDSA activation candidate kind is invalid");
-	return buildPreparedEcdsaActivationCandidate({
-		activationBinding: parseActivationBinding(record.activationBinding),
-		encryptedPending: parseEncryptedPendingCandidate(record.encryptedPending)
-	});
-}
-function parseExpectedServerGeneration(value) {
-	const record = requireRecord(value, "ECDSA server generation expectation");
-	switch (record.kind) {
-		case "no_current_generation":
-			requireExactKeys(record, "ECDSA no-current server generation expectation", ["kind"]);
-			return buildNoCurrentEcdsaServerGenerationExpectation();
-		case "exact_generation":
-			requireExactKeys(record, "ECDSA exact server generation expectation", ["kind", "serverGeneration"]);
-			return buildExactEcdsaServerGenerationExpectation(parseEcdsaServerGeneration(record.serverGeneration));
-		default: throw new Error("ECDSA server generation expectation kind is invalid");
-	}
-}
-function parsePreparedJournal(value) {
-	const record = requireRecord(value, "prepared ECDSA activation journal");
-	requireExactKeys(record, "prepared ECDSA activation journal", [
-		"kind",
-		"journalId",
-		"expectedManifest",
-		"activationCommand",
-		"candidate",
-		"createdAt"
-	]);
-	if (record.kind !== "activation_prepared") throw new Error("prepared ECDSA activation journal kind is invalid");
-	const command = requireRecord(record.activationCommand, "ECDSA activation command");
-	requireExactKeys(command, "ECDSA activation command", [
-		"kind",
-		"correlationId",
-		"expectedGeneration",
-		"requestDigest",
-		"canonicalRequest"
-	]);
-	if (command.kind !== "ecdsa_server_activation_command") throw new Error("ECDSA activation command kind is invalid");
-	const journalId = parseCorrelationId(record.journalId);
-	if (parseCorrelationId(command.correlationId) !== journalId) throw new Error("ECDSA activation command correlation does not match its journal");
-	const expectedManifest = parseManifestExpectation(record.expectedManifest);
-	const expectedGeneration = parseExpectedServerGeneration(command.expectedGeneration);
-	const common = {
-		journalId,
-		candidate: parsePreparedCandidate(record.candidate),
-		requestDigest: parseDigestB64u(command.requestDigest),
-		canonicalRequest: parseCanonicalEcdsaServerActivationRequest(command.canonicalRequest),
-		createdAt: parseIsoTimestamp(record.createdAt)
-	};
-	switch (expectedManifest.kind) {
-		case "no_current_manifest":
-			if (expectedGeneration.kind !== "no_current_generation") throw new Error("initial ECDSA journal has an exact server generation");
-			return buildPreparedEcdsaActivationJournal({
-				...common,
-				expectedManifest,
-				expectedGeneration
-			});
-		case "exact_manifest":
-			if (expectedGeneration.kind !== "exact_generation") throw new Error("replacement ECDSA journal is missing its exact server generation");
-			return buildPreparedEcdsaActivationJournal({
-				...common,
-				expectedManifest,
-				expectedGeneration
-			});
-	}
-	return assertNever(expectedManifest);
-}
-function preparedJournalValueFromCommitted(record) {
-	return {
-		kind: "activation_prepared",
-		journalId: record.journalId,
-		expectedManifest: record.expectedManifest,
-		activationCommand: record.activationCommand,
-		candidate: record.candidate,
-		createdAt: record.createdAt
+		activation_binding: activationBindingAadProjection(activationBinding),
+		server_activation: serverActivation
 	};
 }
-function preparedJournalProjection(journal) {
-	if (journal.kind === "activation_prepared") return journal;
-	switch (journal.expectedManifest.kind) {
-		case "no_current_manifest":
-			if (journal.activationCommand.expectedGeneration.kind !== "no_current_generation") throw new Error("Initial ECDSA activation cannot expect a server generation");
-			return buildPreparedEcdsaActivationJournal({
-				journalId: journal.journalId,
-				expectedManifest: journal.expectedManifest,
-				expectedGeneration: journal.activationCommand.expectedGeneration,
-				candidate: journal.candidate,
-				requestDigest: journal.activationCommand.requestDigest,
-				canonicalRequest: journal.activationCommand.canonicalRequest,
-				createdAt: journal.createdAt
-			});
-		case "exact_manifest":
-			if (journal.activationCommand.expectedGeneration.kind !== "exact_generation") throw new Error("Replacement ECDSA activation requires an exact server generation");
-			return buildPreparedEcdsaActivationJournal({
-				journalId: journal.journalId,
-				expectedManifest: journal.expectedManifest,
-				expectedGeneration: journal.activationCommand.expectedGeneration,
-				candidate: journal.candidate,
-				requestDigest: journal.activationCommand.requestDigest,
-				canonicalRequest: journal.activationCommand.canonicalRequest,
-				createdAt: journal.createdAt
-			});
-		default: return assertNever(journal.expectedManifest);
-	}
-}
-function parseCommittedJournal(value) {
-	const record = requireRecord(value, "server-committed ECDSA activation journal");
-	requireExactKeys(record, "server-committed ECDSA activation journal", [
-		"kind",
-		"journalId",
-		"expectedManifest",
-		"activationCommand",
-		"candidate",
-		"createdAt",
-		"serverActivation"
-	]);
-	if (record.kind !== "server_activation_committed") throw new Error("server-committed ECDSA activation journal kind is invalid");
-	const preparedJournal = parsePreparedJournal(preparedJournalValueFromCommitted(record));
-	const serverActivation = requireRecord(record.serverActivation, "ECDSA server activation commit");
-	requireExactKeys(serverActivation, "ECDSA server activation commit", [
-		"kind",
-		"correlationId",
-		"activationRequestDigest",
-		"serverGeneration",
-		"serverActivationReceipt"
-	]);
-	if (serverActivation.kind !== "ecdsa_server_activation_commit") throw new Error("ECDSA server activation commit kind is invalid");
-	const receipt = requireRecord(serverActivation.serverActivationReceipt, "ECDSA server activation receipt");
-	requireExactKeys(receipt, "ECDSA server activation receipt", [
-		"kind",
-		"lifecycleId",
-		"activationDigest",
-		"activatedAt",
-		"protocolReceipt"
-	]);
-	if (receipt.kind !== "ecdsa_server_activation_receipt") throw new Error("ECDSA server activation receipt kind is invalid");
-	const committed = buildServerCommittedEcdsaActivationJournal({
-		preparedJournal,
-		serverCommit: {
-			correlationId: parseCorrelationId(serverActivation.correlationId),
-			activationRequestDigest: parseDigestB64u(serverActivation.activationRequestDigest),
-			serverGeneration: parseEcdsaServerGeneration(serverActivation.serverGeneration),
-			protocolReceipt: receipt.protocolReceipt
-		}
-	});
-	if (!serverActivationRecordMatches(committed.serverActivation, serverActivation)) throw new Error("ECDSA server activation commit fields are inconsistent");
-	return committed;
-}
-function parseJournal(value) {
-	const record = requireRecord(value, "ECDSA activation journal");
-	switch (record.kind) {
-		case "activation_prepared": return parsePreparedJournal(record);
-		case "server_activation_committed": return parseCommittedJournal(record);
-		default: throw new Error("ECDSA activation journal kind is invalid");
-	}
-}
-function parseRegisteredPublicFacts(value) {
-	const record = requireRecord(value, "registered ECDSA public facts");
-	requireExactKeys(record, "registered ECDSA public facts", [
-		"kind",
-		"keyHandle",
-		"publicKeyB64u",
-		"participantIds",
-		"thresholdOwnerAddress"
-	]);
-	if (record.kind !== "verified_ecdsa_public_facts") throw new Error("registered ECDSA public facts kind is invalid");
-	return buildVerifiedEcdsaPublicFacts({
-		keyHandle: toEvmFamilyEcdsaKeyHandle(record.keyHandle),
-		publicKeyB64u: record.publicKeyB64u,
-		participantIds: requireArray(record.participantIds, "registered ECDSA participant ids"),
-		thresholdOwnerAddress: record.thresholdOwnerAddress
-	});
-}
 function storedActiveProof(input) {
 	return {
 		activation_binding: input.activationBinding,
@@ -921,80 +104,12 @@ function storedActiveProof(input) {
 		committed_at: input.activeManifest.committedAt
 	};
 }
-function parseActiveProof(value) {
-	const record = requireRecord(value, "active ECDSA manifest proof");
-	requireExactKeys(record, "active ECDSA manifest proof", [
-		"activation_binding",
-		"server_activation",
-		"registered_public_facts",
-		"role_local_public_facts",
-		"router_ab_ecdsa_derivation_normal_signing",
-		"runtime_policy_scope",
-		"ciphertext_digest",
-		"committed_at"
-	]);
-	const activationBinding = parseActivationBinding(record.activation_binding);
-	const serverActivationRecord = requireRecord(record.server_activation, "ECDSA server activation commit");
-	requireExactKeys(serverActivationRecord, "ECDSA server activation commit", [
-		"kind",
-		"correlationId",
-		"activationRequestDigest",
-		"serverGeneration",
-		"serverActivationReceipt"
-	]);
-	if (serverActivationRecord.kind !== "ecdsa_server_activation_commit") throw new Error("ECDSA server activation commit kind is invalid");
-	const receipt = requireRecord(serverActivationRecord.serverActivationReceipt, "ECDSA server activation receipt");
-	requireExactKeys(receipt, "ECDSA server activation receipt", [
-		"kind",
-		"lifecycleId",
-		"activationDigest",
-		"activatedAt",
-		"protocolReceipt"
-	]);
-	if (receipt.kind !== "ecdsa_server_activation_receipt") throw new Error("ECDSA server activation receipt kind is invalid");
-	const serverActivation = buildEcdsaServerActivationCommit({
-		activationBinding,
-		serverCommit: {
-			correlationId: parseCorrelationId(serverActivationRecord.correlationId),
-			activationRequestDigest: parseDigestB64u(serverActivationRecord.activationRequestDigest),
-			serverGeneration: parseEcdsaServerGeneration(serverActivationRecord.serverGeneration),
-			protocolReceipt: receipt.protocolReceipt
-		}
-	});
-	if (!serverActivationRecordMatches(serverActivation, serverActivationRecord)) throw new Error("ECDSA server activation commit fields are inconsistent");
-	const durableMaterial = buildDurableEcdsaMaterialBinding({
-		activationBinding,
-		serverActivation,
-		routerAbEcdsaDerivationNormalSigning: requireRouterAbEcdsaDerivationNormalSigningStateV1(record.router_ab_ecdsa_derivation_normal_signing),
-		roleLocalPublicFacts: buildEcdsaRoleLocalPublicFacts(record.role_local_public_facts),
-		ciphertextDigest: parseEcdsaCiphertextDigest(record.ciphertext_digest),
-		runtimePolicyScope: normalizeRuntimePolicyScope(record.runtime_policy_scope)
-	});
-	const committedAt = parseIsoTimestamp(record.committed_at);
-	return {
-		activationBinding,
-		serverActivation,
-		durableMaterial,
-		activeManifest: buildActiveEcdsaCapabilityManifest({
-			activationBinding,
-			serverActivation,
-			registeredPublicFacts: parseRegisteredPublicFacts(record.registered_public_facts),
-			durableMaterial,
-			committedAt
-		}),
-		committedAt
-	};
-}
 function manifestRowCommon(proof, manifestState) {
-	const selector = selectorFromManifest(proof.activeManifest);
 	return {
 		record_version: MANIFEST_RECORD_VERSION,
 		manifest_id: proof.activeManifest.identity.manifestId,
 		manifest_revision: proof.activeManifest.identity.manifestRevision,
-		capability_ref: selector.capability,
-		wallet_id: selector.authority.walletId,
-		authority_digest: selector.authority.authorityDigest,
-		wallet_auth_method_id: selector.authority.walletAuthMethodId,
+		...selectorColumns(selectorFromManifest(proof.activeManifest)),
 		manifest_state: manifestState
 	};
 }
@@ -1011,215 +126,6 @@ function storedReplacedManifestRow(previous, replacement) {
 		replacement_proof: storedActiveProof(replacement)
 	};
 }
-function parseManifestRow(value) {
-	const record = requireRecord(value, "ECDSA capability manifest row");
-	const commonKeys = [
-		"record_version",
-		"manifest_id",
-		"manifest_revision",
-		"capability_ref",
-		"wallet_id",
-		"authority_digest",
-		"wallet_auth_method_id",
-		"manifest_state",
-		"active_proof"
-	];
-	switch (record.manifest_state) {
-		case "active": {
-			requireExactKeys(record, "active ECDSA capability manifest row", commonKeys);
-			const activeProof = parseActiveProof(record.active_proof);
-			const selector = selectorFromManifest(activeProof.activeManifest);
-			assertManifestRowCommon(record, activeProof.activeManifest, selector);
-			return {
-				state: "active",
-				selector,
-				manifest: activeProof.activeManifest,
-				activeProof
-			};
-		}
-		case "replaced": {
-			requireExactKeys(record, "replaced ECDSA capability manifest row", [...commonKeys, "replacement_proof"]);
-			const activeProof = parseActiveProof(record.active_proof);
-			const replacementProof = parseActiveProof(record.replacement_proof);
-			const manifest = buildReplacedEcdsaCapabilityManifest({
-				activeManifest: activeProof.activeManifest,
-				replacementManifest: replacementProof.activeManifest
-			});
-			const selector = selectorFromManifest(activeProof.activeManifest);
-			assertManifestRowCommon(record, activeProof.activeManifest, selector);
-			return {
-				state: "replaced",
-				selector,
-				manifest,
-				activeProof,
-				replacementProof
-			};
-		}
-		default: throw new Error("ECDSA capability manifest row state is invalid");
-	}
-}
-function assertManifestRowCommon(record, manifest, selector) {
-	if (record.record_version !== MANIFEST_RECORD_VERSION || parseEcdsaCapabilityManifestId(record.manifest_id) !== manifest.identity.manifestId || parseEcdsaCapabilityManifestRevision(record.manifest_revision) !== manifest.identity.manifestRevision || String(record.capability_ref) !== String(selector.capability) || String(record.wallet_id) !== String(selector.authority.walletId) || String(record.authority_digest) !== String(selector.authority.authorityDigest)) throw new Error("ECDSA capability manifest row identity is inconsistent");
-}
-function storedPointerRow(manifest) {
-	const selector = selectorFromManifest(manifest);
-	return {
-		record_version: POINTER_RECORD_VERSION,
-		capability_ref: selector.capability,
-		wallet_id: selector.authority.walletId,
-		authority_digest: selector.authority.authorityDigest,
-		wallet_auth_method_id: selector.authority.walletAuthMethodId,
-		manifest_id: manifest.identity.manifestId,
-		manifest_revision: manifest.identity.manifestRevision
-	};
-}
-function parsePointerRow(value) {
-	const record = requireRecord(value, "current ECDSA capability pointer");
-	requireExactKeys(record, "current ECDSA capability pointer", [
-		"record_version",
-		"capability_ref",
-		"wallet_id",
-		"authority_digest",
-		"wallet_auth_method_id",
-		"manifest_id",
-		"manifest_revision"
-	]);
-	if (record.record_version !== POINTER_RECORD_VERSION) throw new Error("current ECDSA capability pointer version is invalid");
-	const authority = parseWalletAuthAuthorityRef({
-		kind: "wallet_auth_authority_ref",
-		walletId: record.wallet_id,
-		authorityDigest: record.authority_digest,
-		walletAuthMethodId: record.wallet_auth_method_id
-	});
-	if (!authority) throw new Error("current ECDSA capability pointer authority is invalid");
-	return {
-		selector: {
-			capability: unwrapDomainId(parseCapabilityInstanceRef(record.capability_ref)),
-			authority
-		},
-		manifestId: parseEcdsaCapabilityManifestId(record.manifest_id),
-		manifestRevision: parseEcdsaCapabilityManifestRevision(record.manifest_revision)
-	};
-}
-function storedMaterialRow(material, manifest) {
-	const selector = selectorFromManifest(manifest);
-	return {
-		record_version: MATERIAL_RECORD_VERSION,
-		durable_material_ref: material.binding.durableMaterialRef,
-		binding_digest: material.binding.bindingDigest,
-		capability_ref: selector.capability,
-		wallet_id: selector.authority.walletId,
-		authority_digest: selector.authority.authorityDigest,
-		wallet_auth_method_id: selector.authority.walletAuthMethodId,
-		sealing_key_id: material.sealingKeyId,
-		iv: material.iv12B64u,
-		ciphertext: material.ciphertextB64u
-	};
-}
-function parseMaterialLocator(value) {
-	const record = requireRecord(value, "ECDSA role-local material row");
-	requireExactKeys(record, "ECDSA role-local material row", [
-		"record_version",
-		"durable_material_ref",
-		"binding_digest",
-		"capability_ref",
-		"wallet_id",
-		"authority_digest",
-		"wallet_auth_method_id",
-		"sealing_key_id",
-		"iv",
-		"ciphertext"
-	]);
-	if (record.record_version !== MATERIAL_RECORD_VERSION) throw new Error("ECDSA role-local material row version is invalid");
-	const authority = parseWalletAuthAuthorityRef({
-		kind: "wallet_auth_authority_ref",
-		walletId: record.wallet_id,
-		authorityDigest: record.authority_digest,
-		walletAuthMethodId: record.wallet_auth_method_id
-	});
-	if (!authority) throw new Error("ECDSA role-local material authority is invalid");
-	return {
-		durableMaterialRef: parseEcdsaRoleLocalDurableMaterialRef(record.durable_material_ref),
-		bindingDigest: parseEcdsaRoleLocalBindingDigest(record.binding_digest),
-		selector: {
-			capability: unwrapDomainId(parseCapabilityInstanceRef(record.capability_ref)),
-			authority
-		}
-	};
-}
-function parseMaterialRow(value, activeProof) {
-	const record = requireRecord(value, "ECDSA role-local material row");
-	const locator = parseMaterialLocator(record);
-	const material = buildValidatedEncryptedEcdsaReadyMaterial({
-		binding: activeProof.durableMaterial,
-		sealingKeyId: parseEcdsaMaterialSealingKeyId(record.sealing_key_id),
-		iv12B64u: parseEcdsaIv12B64u(record.iv),
-		ciphertextB64u: parseEcdsaCiphertextB64u(record.ciphertext)
-	});
-	if (locator.durableMaterialRef !== material.binding.durableMaterialRef || locator.bindingDigest !== material.binding.bindingDigest || !selectorsMatch(locator.selector, selectorFromManifest(activeProof.activeManifest))) throw new Error("ECDSA role-local material row binding is inconsistent");
-	return material;
-}
-function materialMatchesManifest(material, manifest) {
-	return material.binding.durableMaterialRef === manifest.durableMaterial.durableMaterialRef && material.binding.bindingDigest === manifest.durableMaterial.bindingDigest && material.binding.lifecycleId === manifest.durableMaterial.lifecycleId && material.binding.ciphertextDigest === manifest.durableMaterial.ciphertextDigest && material.binding.activationDigest === manifest.durableMaterial.activationDigest && material.binding.activatedAt === manifest.durableMaterial.activatedAt && mpcMaterialActivationRefsEqual(material.binding.materialActivation, manifest.durableMaterial.materialActivation) && ecdsaRoleLocalMaterialBindingsMatch(material.binding.roleLocalBinding, manifest.durableMaterial.roleLocalBinding);
-}
-function storedJournalRow(journal) {
-	const selector = selectorFromJournal(journal);
-	return {
-		record_version: JOURNAL_RECORD_VERSION,
-		journal_id: journal.journalId,
-		capability_ref: selector.capability,
-		wallet_id: selector.authority.walletId,
-		authority_digest: selector.authority.authorityDigest,
-		wallet_auth_method_id: selector.authority.walletAuthMethodId,
-		journal
-	};
-}
-function parseJournalRow(value) {
-	const record = requireRecord(value, "ECDSA activation commit journal row");
-	requireExactKeys(record, "ECDSA activation commit journal row", [
-		"record_version",
-		"journal_id",
-		"capability_ref",
-		"wallet_id",
-		"authority_digest",
-		"wallet_auth_method_id",
-		"journal"
-	]);
-	if (record.record_version !== JOURNAL_RECORD_VERSION) throw new Error("ECDSA activation commit journal row version is invalid");
-	const journal = parseJournal(record.journal);
-	const selector = selectorFromJournal(journal);
-	if (parseCorrelationId(record.journal_id) !== journal.journalId || String(record.capability_ref) !== String(selector.capability) || String(record.wallet_id) !== String(selector.authority.walletId) || String(record.authority_digest) !== String(selector.authority.authorityDigest)) throw new Error("ECDSA activation commit journal row identity is inconsistent");
-	return {
-		journal,
-		selector
-	};
-}
-function isNonExtractableAesGcmKey(value) {
-	if (typeof CryptoKey === "undefined" || !(value instanceof CryptoKey)) return false;
-	if (value.type !== "secret" || value.extractable || value.algorithm.name !== "AES-GCM") return false;
-	return value.usages.includes("encrypt") && value.usages.includes("decrypt");
-}
-function storedSealingKeyRow(keyId, key) {
-	return {
-		record_version: SEALING_KEY_RECORD_VERSION,
-		key_id: keyId,
-		key
-	};
-}
-function parseSealingKeyRow(value) {
-	const record = requireRecord(value, "ECDSA material sealing key row");
-	requireExactKeys(record, "ECDSA material sealing key row", [
-		"record_version",
-		"key_id",
-		"key"
-	]);
-	if (record.record_version !== SEALING_KEY_RECORD_VERSION) throw new Error("ECDSA material sealing key row version is invalid");
-	if (!isNonExtractableAesGcmKey(record.key)) throw new Error("ECDSA material sealing key must be a non-extractable AES-GCM key");
-	return {
-		keyId: parseEcdsaMaterialSealingKeyId(record.key_id),
-		key: record.key
-	};
-}
 async function prepareImportedWalletCustodyEcdsaContinuity(input) {
 	const serverActivation = buildEcdsaServerActivationCommit({
 		activationBinding: input.activationBinding,
@@ -1230,10 +136,7 @@ async function prepareImportedWalletCustodyEcdsaContinuity(input) {
 	const encrypted = await encryptStateBlob({
 		key: sealingKey,
 		stateBlobB64u: input.readyStateBlobB64u,
-		aadProjection: importedReadyAadProjection({
-			activationBinding: input.activationBinding,
-			serverActivation
-		})
+		aadProjection: readyAadProjectionFor(input.activationBinding, serverActivation)
 	});
 	const durableMaterial = buildDurableEcdsaMaterialBinding({
 		activationBinding: input.activationBinding,
@@ -1274,7 +177,7 @@ async function persistPreparedImportedWalletCustodyEcdsaContinuityInTransaction(
 	const selector = selectorFromManifest(prepared.activeManifest);
 	const pointerStore = context.store(POINTER_STORE);
 	const existingPointer = await pointerStore.get(selectorKey(selector));
-	const activeRows = await context.store(MANIFEST_STORE).index(SEAMS_WALLET_INDEXES.capabilityWalletAuthorityState).getAll([...selectorKey(selector), "active"]);
+	const activeRows = await readActiveManifestRows(context, selector);
 	if (existingPointer !== void 0 || activeRows.length !== 0) throw new FinalizationControlError("exact_record_conflict", "ECDSA custody import found an existing active manifest");
 	const activeProof = {
 		activationBinding: prepared.activationBinding,
@@ -1310,7 +213,7 @@ function assertExpectedPointer(expected, pointerRaw, selector) {
 			try {
 				pointer = parsePointerRow(pointerRaw);
 			} catch (error) {
-				throw new FinalizationControlError("corrupt", errorMessage(error));
+				throw new FinalizationControlError("corrupt", ecdsaManifestErrorMessage(error));
 			}
 			if (!selectorsMatch(pointer.selector, selector) || pointer.manifestId !== expected.manifestId || pointer.manifestRevision !== expected.manifestRevision) throw new FinalizationControlError("exact_record_conflict", "replacement ECDSA activation pointer CAS did not match");
 			return pointer;
@@ -1318,15 +221,6 @@ function assertExpectedPointer(expected, pointerRaw, selector) {
 	}
 	return assertNever(expected);
 }
-function errorMessage(error) {
-	return error instanceof Error ? error.message : String(error);
-}
-function isConstraintError(error) {
-	return error instanceof DOMException && error.name === "ConstraintError";
-}
-function assertNever(value) {
-	throw new Error(`Unexpected ECDSA persistence branch: ${String(value)}`);
-}
 async function cancelPreparedActivationInTransaction(preparedJournal, context) {
 	const journalStore = context.store(JOURNAL_STORE);
 	const raw = await journalStore.get(preparedJournal.journalId);
@@ -1348,11 +242,61 @@ async function cancelPreparedActivationInTransaction(preparedJournal, context) {
 	}
 	return assertNever(persisted.journal);
 }
-async function readPointerRowsForWallet(context, walletId) {
-	return await context.store(POINTER_STORE).index(SEAMS_WALLET_INDEXES.walletId).getAll(walletId);
+function persistPreparedContinuity(manager, prepared) {
+	return manager.runTransaction([
+		MANIFEST_STORE,
+		POINTER_STORE,
+		MATERIAL_STORE,
+		SEALING_KEY_STORE
+	], "readwrite", (context) => persistPreparedImportedWalletCustodyEcdsaContinuityInTransaction(context, prepared));
 }
-async function readActivationJournalRows(context) {
-	return await context.store(JOURNAL_STORE).getAll();
+async function importCommittedActivation(store, input, persist) {
+	const serverActivation = buildEcdsaServerActivationCommit({
+		activationBinding: input.activationBinding,
+		serverCommit: input.serverCommit
+	});
+	const selector = selectorFromSigner(input.activationBinding.signer);
+	const existing = await store.lookup(selector);
+	if (existing.kind === "active") {
+		if (activeManifestMatchesWalletCustodyImport(existing.manifest, input, serverActivation)) return {
+			kind: "committed",
+			manifest: existing.manifest,
+			material: existing.material
+		};
+		return {
+			kind: "exact_record_conflict",
+			selector,
+			conflictDigest: await persistenceDigest("custody_import_conflict", selector, "ECDSA custody import conflicts with the active manifest")
+		};
+	}
+	try {
+		const prepared = await prepareImportedWalletCustodyEcdsaContinuity(input);
+		await persist(prepared);
+		return {
+			kind: "committed",
+			manifest: prepared.activeManifest,
+			material: prepared.readyMaterial
+		};
+	} catch (error) {
+		if (error instanceof FinalizationControlError || isConstraintError(error)) {
+			const replay = await store.lookup(selector);
+			if (replay.kind === "active" && activeManifestMatchesWalletCustodyImport(replay.manifest, input, serverActivation)) return {
+				kind: "committed",
+				manifest: replay.manifest,
+				material: replay.material
+			};
+			return {
+				kind: "exact_record_conflict",
+				selector,
+				conflictDigest: await persistenceDigest("custody_import_conflict", selector, ecdsaManifestErrorMessage(error))
+			};
+		}
+		return {
+			kind: "corrupt",
+			selector,
+			corruptionDigest: await persistenceDigest("custody_import_corrupt", selector, ecdsaManifestErrorMessage(error))
+		};
+	}
 }
 var IndexedDbEcdsaCapabilityManifestStore = class {
 	constructor(manager = seamsWalletDB) {
@@ -1362,11 +306,11 @@ var IndexedDbEcdsaCapabilityManifestStore = class {
 		if (!supportsStrictIndexedDbDurability()) return { kind: "persistence_unavailable" };
 		const poolIdentity = parseEcdsaClientPresignPoolIdentity(input.poolIdentity);
 		const durableMaterialRef = parseEcdsaRoleLocalPersistedMaterialRef(input.durableMaterialRef);
-		if (durableMaterialRef.materialActivation.activationId !== poolIdentity.materialActivationId || durableMaterialRef.materialActivation.capability !== poolIdentity.capability || durableMaterialRef.materialActivation.keyBinding !== poolIdentity.keyBinding || durableMaterialRef.materialActivation.materialOwner !== poolIdentity.walletId) return { kind: "persistence_unavailable" };
+		if (!materialRefMatchesPoolIdentity(durableMaterialRef, poolIdentity)) return { kind: "persistence_unavailable" };
 		if (input.groupPublicKey33.length !== 33 || input.bigR33.length !== 33) return { kind: "persistence_unavailable" };
 		const createdAtMs = parsePresignatureTimestamp(input.createdAtMs, "createdAtMs");
 		const expiresAtMs = parsePresignatureTimestamp(input.expiresAtMs, "expiresAtMs");
-		if (createdAtMs > Date.now() + MAX_DURABLE_CLIENT_PRESIGNATURE_FUTURE_SKEW_MS || expiresAtMs <= createdAtMs || expiresAtMs > createdAtMs + 7776e6) return { kind: "persistence_unavailable" };
+		if (createdAtMs > Date.now() + 3e5 || expiresAtMs <= createdAtMs || expiresAtMs > createdAtMs + 7776e6) return { kind: "persistence_unavailable" };
 		const presignatureId = String(input.presignatureId || "").trim();
 		if (!presignatureId || input.plaintext97.length !== 97) return { kind: "persistence_unavailable" };
 		let lookup;
@@ -1376,7 +320,7 @@ var IndexedDbEcdsaCapabilityManifestStore = class {
 			return { kind: "persistence_unavailable" };
 		}
 		if (lookup.kind !== "active") return { kind: "persistence_unavailable" };
-		if (!activeMaterialMatchesPresignaturePoolIdentity(lookup.material, poolIdentity) || lookup.material.binding.durableMaterialRef !== durableMaterialRef.durableMaterialRef || lookup.material.binding.bindingDigest !== durableMaterialRef.bindingDigest || !mpcMaterialActivationRefsEqual(lookup.material.binding.materialActivation, durableMaterialRef.materialActivation)) return { kind: "persistence_unavailable" };
+		if (!activeMaterialMatchesPresignature(lookup.material, poolIdentity, durableMaterialRef)) return { kind: "persistence_unavailable" };
 		let sealingKey;
 		try {
 			sealingKey = await this.readMaterialSealingKey(lookup.material.sealingKeyId);
@@ -1433,20 +377,7 @@ var IndexedDbEcdsaCapabilityManifestStore = class {
 		};
 		try {
 			const result = await this.manager.runTransaction([PRESIGNATURE_STORE, MATERIAL_STORE], "readwrite", async (context) => {
-				const nowMs = Date.now();
-				await deleteExpiredClientPresignatureRows(context, poolIdentity.walletId, nowMs);
-				const store = context.store(PRESIGNATURE_STORE);
-				const rows = await store.index(SEAMS_WALLET_INDEXES.poolIdentityKey).getAll(row.pool_identity_key);
-				let availableCount = 0;
-				for (const raw of rows) try {
-					const existing = parseSealedAvailableClientPresignatureRow(raw);
-					if (existing.expires_at_ms <= nowMs) await store.delete(existing.record_id);
-					else availableCount += 1;
-				} catch {
-					const malformedRecordId = rawRecordId(raw);
-					if (malformedRecordId) await store.delete(malformedRecordId);
-				}
-				if (availableCount >= 5) return { kind: "capacity_full" };
+				if ((await readAvailableClientPresignatureRows(context, poolIdentity, Date.now())).length >= 5) return { kind: "capacity_full" };
 				const materialRow = await context.store(MATERIAL_STORE).get(durableMaterialRef.durableMaterialRef);
 				if (materialRow === void 0) return { kind: "persistence_unavailable" };
 				try {
@@ -1456,7 +387,7 @@ var IndexedDbEcdsaCapabilityManifestStore = class {
 				} catch {
 					return { kind: "persistence_unavailable" };
 				}
-				await store.put(row);
+				await context.store(PRESIGNATURE_STORE).put(row);
 				return { kind: "stored" };
 			}, { durability: "strict" });
 			return result.kind === "stored" ? {
@@ -1473,22 +404,7 @@ var IndexedDbEcdsaCapabilityManifestStore = class {
 		const nowMs = Date.now();
 		try {
 			return await this.manager.runTransaction([PRESIGNATURE_STORE], "readwrite", async (context) => {
-				await deleteExpiredClientPresignatureRows(context, poolIdentity.walletId, nowMs);
-				const store = context.store(PRESIGNATURE_STORE);
-				const rows = await store.index(SEAMS_WALLET_INDEXES.poolIdentityKey).getAll(ecdsaClientPresignPoolKey(poolIdentity));
-				const metadata = [];
-				for (const raw of rows) try {
-					const row = parseSealedAvailableClientPresignatureRow(raw);
-					if (row.expires_at_ms <= nowMs) {
-						await store.delete(row.record_id);
-						continue;
-					}
-					metadata.push(metadataFromPresignatureRow(row));
-				} catch {
-					const malformedRecordId = rawRecordId(raw);
-					if (malformedRecordId) await store.delete(malformedRecordId);
-				}
-				return metadata.sort((left, right) => left.createdAtMs - right.createdAtMs);
+				return (await readAvailableClientPresignatureRows(context, poolIdentity, nowMs)).map(metadataFromPresignatureRow).sort((left, right) => left.createdAtMs - right.createdAtMs);
 			});
 		} catch {
 			return [];
@@ -1537,7 +453,7 @@ var IndexedDbEcdsaCapabilityManifestStore = class {
 		} catch {
 			return { kind: "persistence_unavailable" };
 		}
-		if (lookup.kind !== "active" || !activeMaterialMatchesPresignaturePoolIdentity(lookup.material, poolIdentity) || lookup.material.sealingKeyId !== row.sealed.sealing_key_id || lookup.material.binding.durableMaterialRef !== row.durable_material_ref.durableMaterialRef || lookup.material.binding.bindingDigest !== row.durable_material_ref.bindingDigest || !mpcMaterialActivationRefsEqual(lookup.material.binding.materialActivation, row.durable_material_ref.materialActivation)) return { kind: "binding_rejected" };
+		if (lookup.kind !== "active" || !activeMaterialMatchesPresignature(lookup.material, poolIdentity, row.durable_material_ref) || lookup.material.sealingKeyId !== row.sealed.sealing_key_id) return { kind: "binding_rejected" };
 		let sealingKey;
 		try {
 			sealingKey = await this.readMaterialSealingKey(row.sealed.sealing_key_id);
@@ -1578,23 +494,12 @@ var IndexedDbEcdsaCapabilityManifestStore = class {
 				case "wallet": {
 					const walletId = String(target.walletId).trim();
 					if (!walletId) throw new Error("ECDSA durable presignature wallet id is required");
-					let cursor = await store.index(SEAMS_WALLET_INDEXES.walletId).openCursor(walletId);
-					while (cursor) {
-						await cursor.delete();
-						deletedCount += 1;
-						cursor = await cursor.continue();
-					}
+					deletedCount = await deleteCursorRows(await store.index(SEAMS_WALLET_INDEXES.walletId).openCursor(walletId));
 					break;
 				}
-				case "all": {
-					let cursor = await store.openCursor();
-					while (cursor) {
-						await cursor.delete();
-						deletedCount += 1;
-						cursor = await cursor.continue();
-					}
+				case "all":
+					deletedCount = await deleteCursorRows(await store.openCursor());
 					break;
-				}
 			}
 			return deletedCount;
 		});
@@ -1647,10 +552,7 @@ var IndexedDbEcdsaCapabilityManifestStore = class {
 			for (const row of rows) {
 				const signer = parseJournalRow(row).journal.candidate.activationBinding.signer;
 				if (signer.authority.walletId !== parsedWalletId.value) continue;
-				selectors.push({
-					capability: signer.capability,
-					authority: signer.authority
-				});
+				selectors.push(selectorFromSigner(signer));
 			}
 		} catch {
 			return { kind: "invalid_current_state" };
@@ -1661,10 +563,7 @@ var IndexedDbEcdsaCapabilityManifestStore = class {
 		};
 	}
 	async prepareActivation(input) {
-		const selector = {
-			capability: input.activationBinding.signer.capability,
-			authority: input.activationBinding.signer.authority
-		};
+		const selector = selectorFromSigner(input.activationBinding.signer);
 		try {
 			const keyId = parseEcdsaMaterialSealingKeyId(secureRandomId("ecdsa-material-key", 32, "ECDSA activation material sealing key"));
 			const key = await generateMaterialSealingKey();
@@ -1691,13 +590,10 @@ var IndexedDbEcdsaCapabilityManifestStore = class {
 				journal
 			};
 		} catch (error) {
-			if (isConstraintError(error)) return {
-				kind: "exact_record_conflict",
-				conflictDigest: await persistenceDigest("journal_constraint_conflict", selector, errorMessage(error))
-			};
+			if (isConstraintError(error)) return await journalConstraintConflict(selector, error);
 			if (error instanceof DOMException && error.name === "OperationError") return {
 				kind: "corrupt",
-				corruptionDigest: await persistenceDigest("journal_encryption_failed", selector, errorMessage(error))
+				corruptionDigest: await persistenceDigest("journal_encryption_failed", selector, ecdsaManifestErrorMessage(error))
 			};
 			if (error instanceof Error && !(error instanceof DOMException)) return {
 				kind: "corrupt",
@@ -1716,7 +612,7 @@ var IndexedDbEcdsaCapabilityManifestStore = class {
 		} catch (error) {
 			return {
 				kind: "corrupt",
-				corruptionDigest: await persistenceDigest("server_activation_commit_corrupt", selectorFromJournal(input.preparedJournal), errorMessage(error))
+				corruptionDigest: await persistenceDigest("server_activation_commit_corrupt", selectorFromJournal(input.preparedJournal), ecdsaManifestErrorMessage(error))
 			};
 		}
 		return await this.putActivationJournal(committedJournal);
@@ -1729,7 +625,7 @@ var IndexedDbEcdsaCapabilityManifestStore = class {
 		} catch (error) {
 			return {
 				kind: "corrupt",
-				corruptionDigest: await persistenceDigest("journal_input_corrupt", selectorFromJournal(journalInput), errorMessage(error))
+				corruptionDigest: await persistenceDigest("journal_input_corrupt", selectorFromJournal(journalInput), ecdsaManifestErrorMessage(error))
 			};
 		}
 		const selector = selectorFromJournal(journal);
@@ -1748,7 +644,7 @@ var IndexedDbEcdsaCapabilityManifestStore = class {
 				try {
 					parseSealingKeyRow(sealingKeyRaw);
 				} catch (error) {
-					throw new FinalizationControlError("corrupt", errorMessage(error));
+					throw new FinalizationControlError("corrupt", ecdsaManifestErrorMessage(error));
 				}
 				const journalStore = context.store(JOURNAL_STORE);
 				const existingRaw = await journalStore.get(journal.journalId);
@@ -1757,7 +653,7 @@ var IndexedDbEcdsaCapabilityManifestStore = class {
 				try {
 					existing = parseJournalRow(existingRaw);
 				} catch (error) {
-					throw new FinalizationControlError("corrupt", errorMessage(error));
+					throw new FinalizationControlError("corrupt", ecdsaManifestErrorMessage(error));
 				}
 				if (!selectorsMatch(existing.selector, selector) || existing.journal.kind === "activation_prepared" && !ecdsaActivationCommitJournalsMatch(existing.journal, preparedJournalProjection(journal)) || existing.journal.kind === "server_activation_committed" && !ecdsaActivationCommitJournalsMatch(existing.journal, journal)) throw new FinalizationControlError("exact_record_conflict", "ECDSA activation journal conflicts with its existing correlation");
 				await journalStore.put(storedJournalRow(journal));
@@ -1777,13 +673,10 @@ var IndexedDbEcdsaCapabilityManifestStore = class {
 					conflictDigest: digest
 				};
 			}
-			if (isConstraintError(error)) return {
-				kind: "exact_record_conflict",
-				conflictDigest: await persistenceDigest("journal_constraint_conflict", selector, errorMessage(error))
-			};
+			if (isConstraintError(error)) return await journalConstraintConflict(selector, error);
 			if (error instanceof DOMException && error.name === "OperationError") return {
 				kind: "corrupt",
-				corruptionDigest: await persistenceDigest("journal_ciphertext_corrupt", selector, errorMessage(error))
+				corruptionDigest: await persistenceDigest("journal_ciphertext_corrupt", selector, ecdsaManifestErrorMessage(error))
 			};
 			return {
 				kind: "persistence_unavailable",
@@ -1945,7 +838,7 @@ var IndexedDbEcdsaCapabilityManifestStore = class {
 			const lookup = await this.lookup(selector);
 			switch (lookup.kind) {
 				case "active":
-					if (mpcMaterialActivationRefsEqual(lookup.manifest.activation.materialActivation, materialActivation) && mpcMaterialActivationRefsEqual(lookup.manifest.durableMaterial.materialActivation, materialActivation) && mpcMaterialActivationRefsEqual(lookup.material.binding.materialActivation, materialActivation)) exact.push(lookup);
+					if (activeLookupUsesMaterialActivation(lookup, materialActivation)) exact.push(lookup);
 					break;
 				case "retired": break;
 				case "missing": return {
@@ -2019,7 +912,7 @@ var IndexedDbEcdsaCapabilityManifestStore = class {
 		const lookup = await this.lookup(locator.selector);
 		switch (lookup.kind) {
 			case "active":
-				if (lookup.manifest.durableMaterial.durableMaterialRef !== materialRef.durableMaterialRef || lookup.manifest.durableMaterial.bindingDigest !== materialRef.bindingDigest || !mpcMaterialActivationRefsEqual(lookup.manifest.activation.materialActivation, materialRef.materialActivation) || !mpcMaterialActivationRefsEqual(lookup.manifest.durableMaterial.materialActivation, materialRef.materialActivation) || !mpcMaterialActivationRefsEqual(lookup.material.binding.materialActivation, materialRef.materialActivation)) return {
+				if (lookup.manifest.durableMaterial.durableMaterialRef !== materialRef.durableMaterialRef || lookup.manifest.durableMaterial.bindingDigest !== materialRef.bindingDigest || !activeLookupUsesMaterialActivation(lookup, materialRef.materialActivation)) return {
 					kind: "exact_binding_mismatch",
 					capability
 				};
@@ -2114,7 +1007,7 @@ var IndexedDbEcdsaCapabilityManifestStore = class {
 			return {
 				kind: "corrupt",
 				selector,
-				corruptionDigest: await persistenceDigest("active_material_open_corrupt", selector, errorMessage(error))
+				corruptionDigest: await persistenceDigest("active_material_open_corrupt", selector, ecdsaManifestErrorMessage(error))
 			};
 		}
 	}
@@ -2125,28 +1018,9 @@ var IndexedDbEcdsaCapabilityManifestStore = class {
 		} catch {
 			return { kind: "corrupt" };
 		}
-		switch (lookup.kind) {
-			case "active": {
-				const opened = await this.openActiveMaterialLookup(lookup);
-				switch (opened.kind) {
-					case "active": return opened;
-					case "missing":
-					case "retired": return { kind: "missing" };
-					case "exact_binding_mismatch": return { kind: "binding_mismatch" };
-					case "exact_record_conflict":
-					case "corrupt": return { kind: "corrupt" };
-					case "persistence_unavailable": return { kind: "persistence_unavailable" };
-				}
-				return assertNever(opened);
-			}
-			case "missing":
-			case "retired": return { kind: "missing" };
-			case "exact_binding_mismatch": return { kind: "binding_mismatch" };
-			case "exact_record_conflict":
-			case "corrupt": return { kind: "corrupt" };
-			case "persistence_unavailable": return { kind: "persistence_unavailable" };
-		}
-		return assertNever(lookup);
+		if (lookup.kind !== "active") return materialRefOpenFailure(lookup);
+		const opened = await this.openActiveMaterialLookup(lookup);
+		return opened.kind === "active" ? opened : materialRefOpenFailure(opened);
 	}
 	async sealAndFinalizeActivation(input) {
 		const selector = selectorFromJournal(input.committedJournal);
@@ -2190,89 +1064,15 @@ var IndexedDbEcdsaCapabilityManifestStore = class {
 			return {
 				kind: "corrupt",
 				selector,
-				corruptionDigest: await persistenceDigest("activation_seal_corrupt", selector, errorMessage(error))
+				corruptionDigest: await persistenceDigest("activation_seal_corrupt", selector, ecdsaManifestErrorMessage(error))
 			};
 		}
 	}
 	async importCommittedWalletCustodyActivation(input) {
-		const serverActivation = buildEcdsaServerActivationCommit({
-			activationBinding: input.activationBinding,
-			serverCommit: input.serverCommit
-		});
-		const selector = {
-			capability: input.activationBinding.signer.capability,
-			authority: input.activationBinding.signer.authority
-		};
-		const existing = await this.lookup(selector);
-		if (existing.kind === "active") {
-			if (activeManifestMatchesWalletCustodyImport({
-				manifest: existing.manifest,
-				activationBinding: input.activationBinding,
-				serverActivation,
-				registeredPublicFacts: input.registeredPublicFacts,
-				roleLocalPublicFacts: input.roleLocalPublicFacts,
-				routerAbEcdsaDerivationNormalSigning: input.routerAbEcdsaDerivationNormalSigning,
-				runtimePolicyScope: input.runtimePolicyScope
-			})) return {
-				kind: "committed",
-				manifest: existing.manifest,
-				material: existing.material
-			};
-			return {
-				kind: "exact_record_conflict",
-				selector,
-				conflictDigest: await persistenceDigest("custody_import_conflict", selector, "ECDSA custody import conflicts with the active manifest")
-			};
-		}
-		try {
-			const prepared = await prepareImportedWalletCustodyEcdsaContinuity(input);
-			await this.manager.runTransaction([
-				MANIFEST_STORE,
-				POINTER_STORE,
-				MATERIAL_STORE,
-				SEALING_KEY_STORE
-			], "readwrite", (context) => persistPreparedImportedWalletCustodyEcdsaContinuityInTransaction(context, prepared));
-			return {
-				kind: "committed",
-				manifest: prepared.activeManifest,
-				material: prepared.readyMaterial
-			};
-		} catch (error) {
-			if (error instanceof FinalizationControlError || isConstraintError(error)) {
-				const replay = await this.lookup(selector);
-				if (replay.kind === "active" && activeManifestMatchesWalletCustodyImport({
-					manifest: replay.manifest,
-					activationBinding: input.activationBinding,
-					serverActivation,
-					registeredPublicFacts: input.registeredPublicFacts,
-					roleLocalPublicFacts: input.roleLocalPublicFacts,
-					routerAbEcdsaDerivationNormalSigning: input.routerAbEcdsaDerivationNormalSigning,
-					runtimePolicyScope: input.runtimePolicyScope
-				})) return {
-					kind: "committed",
-					manifest: replay.manifest,
-					material: replay.material
-				};
-				return {
-					kind: "exact_record_conflict",
-					selector,
-					conflictDigest: await persistenceDigest("custody_import_conflict", selector, errorMessage(error))
-				};
-			}
-			return {
-				kind: "corrupt",
-				selector,
-				corruptionDigest: await persistenceDigest("custody_import_corrupt", selector, errorMessage(error))
-			};
-		}
+		return await importCommittedActivation(this, input, (prepared) => persistPreparedContinuity(this.manager, prepared));
 	}
 	async persistPreparedWalletCustodyEcdsaContinuity(prepared) {
-		await this.manager.runTransaction([
-			MANIFEST_STORE,
-			POINTER_STORE,
-			MATERIAL_STORE,
-			SEALING_KEY_STORE
-		], "readwrite", (context) => persistPreparedImportedWalletCustodyEcdsaContinuityInTransaction(context, prepared));
+		await persistPreparedContinuity(this.manager, prepared);
 	}
 	async readMaterialSealingKey(keyIdInput) {
 		const keyId = parseEcdsaMaterialSealingKeyId(keyIdInput);
@@ -2291,7 +1091,7 @@ var IndexedDbEcdsaCapabilityManifestStore = class {
 			return {
 				kind: "corrupt",
 				selector,
-				corruptionDigest: await persistenceDigest("finalization_input_corrupt", selector, errorMessage(error))
+				corruptionDigest: await persistenceDigest("finalization_input_corrupt", selector, ecdsaManifestErrorMessage(error))
 			};
 		}
 		const selector = selectorFromManifest(activeProof.activeManifest);
@@ -2336,7 +1136,7 @@ var IndexedDbEcdsaCapabilityManifestStore = class {
 			if (isConstraintError(error)) return {
 				kind: "exact_record_conflict",
 				selector,
-				conflictDigest: await persistenceDigest("finalization_constraint_conflict", selector, errorMessage(error))
+				conflictDigest: await persistenceDigest("finalization_constraint_conflict", selector, ecdsaManifestErrorMessage(error))
 			};
 			return {
 				kind: "persistence_unavailable",
@@ -2346,405 +1146,6 @@ var IndexedDbEcdsaCapabilityManifestStore = class {
 		}
 	}
 };
-function buildWalletCustodyEcdsaContinuityImportInput(input) {
-	const authority = parseWalletAuthAuthorityRef(input.authority);
-	if (!authority || String(authority.walletId) !== String(input.walletId)) throw new Error("ECDSA custody import authority is invalid");
-	const publicCapability = parseRouterAbEcdsaDerivationPublicCapabilityV1(input.publicCapability);
-	const receipt = parseRouterAbEcdsaRegistrationActivationReceiptV1(input.activationReceipt);
-	const materialActivation = routerAbMpcMaterialActivationRefFromWire(receipt.ecdsa_activation.material_activation);
-	if (!mpcMaterialActivationRefsEqual(materialActivation, routerAbMpcMaterialActivationRefFromWire(publicCapability.material_activation))) throw new Error("ECDSA custody continuity changed the material activation");
-	const participantIds = [toParticipantId(input.participantIds[0]), toParticipantId(input.participantIds[1])];
-	const roleLocalBinding = buildEcdsaRoleLocalMaterialBinding({
-		keyHandle: parseEcdsaKeyHandle(input.keyHandle),
-		ecdsaThresholdKeyId: parseEcdsaThresholdKeyId(input.ecdsaThresholdKeyId),
-		clientVerifyingPublicKey33B64u: parseEcdsaClientVerifyingPublicKey33B64u(input.publicFacts.derivationClientSharePublicKey33B64u),
-		participantIds,
-		relayerKeyId: parseEcdsaRelayerKeyId(input.relayerKeyId)
-	});
-	const signer = buildPreparedEvmFamilySigner({
-		capability: materialActivation.capability,
-		signerId: parseEvmFamilyEcdsaSignerId(secureRandomId("ecdsa-signer", 32, "ECDSA custody signer identities")),
-		authority,
-		scope: buildEcdsaCapabilityScope({ targetMemberships: input.chainTargets }),
-		materialOwner: materialActivation.materialOwner,
-		signingRootId: parseSdkEcdsaDerivationSigningRootId(input.signingRootId),
-		signingRootVersion: parseSdkEcdsaDerivationSigningRootVersion(input.signingRootVersion)
-	});
-	const activationBinding = buildEcdsaActivationBinding({
-		targetManifest: buildEcdsaManifestIdentity({
-			manifestId: parseEcdsaCapabilityManifestId(secureRandomId("ecdsa-manifest", 32, "ECDSA custody manifest identities")),
-			manifestRevision: parseEcdsaCapabilityManifestRevision(1)
-		}),
-		signer,
-		roleLocalBinding,
-		bindingDigest: parseEcdsaRoleLocalBindingDigest(input.publicFacts.contextBinding32B64u),
-		durableMaterialRef: parseEcdsaRoleLocalDurableMaterialRef(secureRandomId("ecdsa-role-local-material", 32, "ECDSA custody material identities"))
-	});
-	const ethereumAddress = input.publicFacts.ethereumAddress;
-	const registeredPublicFacts = buildVerifiedEcdsaPublicFacts({
-		keyHandle: toEvmFamilyEcdsaKeyHandle(input.keyHandle),
-		publicKeyB64u: input.publicFacts.groupPublicKey33B64u,
-		participantIds,
-		thresholdOwnerAddress: ethereumAddress
-	});
-	const roleLocalPublicFacts = buildEcdsaRoleLocalPublicFacts({
-		walletId: authority.walletId,
-		chainTarget: input.chainTargets[0],
-		keyHandle: roleLocalBinding.keyHandle,
-		ecdsaThresholdKeyId: roleLocalBinding.ecdsaThresholdKeyId,
-		signingRootId: signer.signingRootId,
-		signingRootVersion: signer.signingRootVersion,
-		applicationBindingDigestB64u: publicCapability.context.application_binding_digest_b64u,
-		clientParticipantId: participantIds[0],
-		relayerParticipantId: participantIds[1],
-		participantIds,
-		contextBinding32B64u: input.publicFacts.contextBinding32B64u,
-		derivationClientSharePublicKey33B64u: input.publicFacts.derivationClientSharePublicKey33B64u,
-		relayerPublicKey33B64u: input.publicFacts.relayerPublicKey33B64u,
-		groupPublicKey33B64u: input.publicFacts.groupPublicKey33B64u,
-		ethereumAddress,
-		publicCapability
-	});
-	const normalSigning = {
-		kind: "router_ab_ecdsa_derivation_normal_signing_v1",
-		scope: {
-			wallet_id: String(authority.walletId),
-			ecdsa_threshold_key_id: String(roleLocalBinding.ecdsaThresholdKeyId),
-			signing_root_id: String(signer.signingRootId),
-			signing_root_version: String(signer.signingRootVersion),
-			context: receipt.ecdsa_activation.context,
-			public_identity: receipt.ecdsa_activation.public_identity,
-			material_activation: receipt.ecdsa_activation.material_activation,
-			signing_worker: receipt.ecdsa_activation.signing_worker,
-			activation_epoch: receipt.ecdsa_activation.activation_epoch
-		}
-	};
-	return {
-		activationBinding,
-		serverCommit: {
-			correlationId: receipt.activation_correlation_id,
-			activationRequestDigest: parseDigestB64u(base64UrlEncode(Uint8Array.from(receipt.activation_request_digest.bytes))),
-			serverGeneration: receipt.server_generation,
-			protocolReceipt: receipt
-		},
-		readyStateBlobB64u: input.readyStateBlobB64u,
-		registeredPublicFacts,
-		roleLocalPublicFacts,
-		routerAbEcdsaDerivationNormalSigning: normalSigning,
-		runtimePolicyScope: normalizeRuntimePolicyScope(input.runtimePolicyScope),
-		committedAt: parseIsoTimestamp(new Date(receipt.ecdsa_activation.activated_at_ms).toISOString())
-	};
-}
-async function prepareWalletCustodyEcdsaContinuity(input) {
-	return prepareImportedWalletCustodyEcdsaContinuity(buildWalletCustodyEcdsaContinuityImportInput(input));
-}
-async function importWalletCustodyEcdsaContinuity(input) {
-	const preparedInput = buildWalletCustodyEcdsaContinuityImportInput(input);
-	const serverActivation = buildEcdsaServerActivationCommit({
-		activationBinding: preparedInput.activationBinding,
-		serverCommit: preparedInput.serverCommit
-	});
-	const selector = {
-		capability: preparedInput.activationBinding.signer.capability,
-		authority: preparedInput.activationBinding.signer.authority
-	};
-	const existing = await input.store.lookup(selector);
-	if (existing.kind === "active") {
-		if (activeManifestMatchesWalletCustodyImport({
-			manifest: existing.manifest,
-			activationBinding: preparedInput.activationBinding,
-			serverActivation,
-			registeredPublicFacts: preparedInput.registeredPublicFacts,
-			roleLocalPublicFacts: preparedInput.roleLocalPublicFacts,
-			routerAbEcdsaDerivationNormalSigning: preparedInput.routerAbEcdsaDerivationNormalSigning,
-			runtimePolicyScope: preparedInput.runtimePolicyScope
-		})) return {
-			kind: "committed",
-			manifest: existing.manifest,
-			material: existing.material
-		};
-		return {
-			kind: "exact_record_conflict",
-			selector,
-			conflictDigest: await persistenceDigest("custody_import_conflict", selector, "ECDSA custody import conflicts with the active manifest")
-		};
-	}
-	try {
-		const prepared = await prepareImportedWalletCustodyEcdsaContinuity(preparedInput);
-		await input.store.persistPreparedWalletCustodyEcdsaContinuity(prepared);
-		return {
-			kind: "committed",
-			manifest: prepared.activeManifest,
-			material: prepared.readyMaterial
-		};
-	} catch (error) {
-		if (error instanceof FinalizationControlError || isConstraintError(error)) {
-			const replay = await input.store.lookup(selector);
-			if (replay.kind === "active" && activeManifestMatchesWalletCustodyImport({
-				manifest: replay.manifest,
-				activationBinding: preparedInput.activationBinding,
-				serverActivation,
-				registeredPublicFacts: preparedInput.registeredPublicFacts,
-				roleLocalPublicFacts: preparedInput.roleLocalPublicFacts,
-				routerAbEcdsaDerivationNormalSigning: preparedInput.routerAbEcdsaDerivationNormalSigning,
-				runtimePolicyScope: preparedInput.runtimePolicyScope
-			})) return {
-				kind: "committed",
-				manifest: replay.manifest,
-				material: replay.material
-			};
-			return {
-				kind: "exact_record_conflict",
-				selector,
-				conflictDigest: await persistenceDigest("custody_import_conflict", selector, errorMessage(error))
-			};
-		}
-		return {
-			kind: "corrupt",
-			selector,
-			corruptionDigest: await persistenceDigest("custody_import_corrupt", selector, errorMessage(error))
-		};
-	}
-}
-async function assertSharedWalletAuthorityMembership(input) {
-	const repositories = new SeamsWalletRepositories(seamsWalletDB);
-	for (const walletAuthMethodId of input.walletAuthMethodIds) {
-		const authMethod = await repositories.getWalletAuthMethodV2(String(walletAuthMethodId));
-		if (!authMethod || authMethod.status !== "active" || authMethod.walletId !== input.walletId || authMethod.walletAuthorityId !== input.walletAuthorityId) throw new Error(`ECDSA custody continuity method ${String(walletAuthMethodId)} is not an active member of the wallet authority`);
-	}
-}
-/**
-* R109C: give an added auth method its own encrypted access projection over the
-* activation the wallet already has. The activation is not re-created and the
-* source credential's authority is not widened; only a second method-bound
-* record over the same material appears.
-*
-* The membership check is the whole safety argument. Copying access to a method
-* on another wallet authority would hand that credential custody it was never
-* granted, so both methods are read back and required to be active members of
-* the exact same authority before anything is opened.
-*/
-async function copyWalletCustodyEcdsaContinuityToAuthMethod(input) {
-	if (input.targetAuthority.walletId !== input.walletId || input.targetAuthority.walletAuthMethodId === input.sourceWalletAuthMethodId) throw new Error("ECDSA custody continuity target is invalid");
-	await assertSharedWalletAuthorityMembership({
-		walletId: input.walletId,
-		walletAuthorityId: input.walletAuthorityId,
-		walletAuthMethodIds: [input.sourceWalletAuthMethodId, input.targetAuthority.walletAuthMethodId]
-	});
-	const store = new IndexedDbEcdsaCapabilityManifestStore();
-	const listed = await store.listActiveWalletCapabilitySubjects(input.walletId);
-	if (listed.kind !== "resolved") throw new Error(`ECDSA custody continuity inventory is ${listed.kind}`);
-	if (listed.subjects.length === 0) return;
-	const sources = listed.subjects.filter((subject) => subject.authority.walletAuthMethodId === input.sourceWalletAuthMethodId);
-	if (sources.length === 0) throw new Error(`ECDSA custody continuity found no active capability for source method ${String(input.sourceWalletAuthMethodId)} among [${listed.subjects.map((subject) => String(subject.authority.walletAuthMethodId)).join(", ")}]`);
-	for (const source of sources) {
-		const sourceLookup = await store.lookup(source);
-		if (sourceLookup.kind !== "active") throw new Error(`ECDSA custody continuity source is ${sourceLookup.kind}`);
-		const targetSelector = {
-			capability: source.capability,
-			authority: input.targetAuthority
-		};
-		const targetLookup = await store.lookup(targetSelector);
-		if (targetLookup.kind === "active") {
-			const targetMaterial = targetLookup.manifest.durableMaterial;
-			const sourceMaterial = sourceLookup.manifest.durableMaterial;
-			if (targetMaterial.activationDigest !== sourceMaterial.activationDigest || targetMaterial.bindingDigest !== sourceMaterial.bindingDigest || targetMaterial.roleLocalBinding.ecdsaThresholdKeyId !== sourceMaterial.roleLocalBinding.ecdsaThresholdKeyId || !ecdsaRoleLocalMaterialBindingsMatch(targetMaterial.roleLocalBinding, sourceMaterial.roleLocalBinding) || !ecdsaRoleLocalPublicFactsMatch(targetMaterial.roleLocalPublicFacts, sourceMaterial.roleLocalPublicFacts) || !ecdsaRegisteredPublicFactsMatch(targetLookup.manifest.signer.registeredPublicFacts, sourceLookup.manifest.signer.registeredPublicFacts)) throw new Error("ECDSA custody continuity target conflicts with source material");
-			continue;
-		}
-		if (targetLookup.kind !== "missing") throw new Error(`ECDSA custody continuity target is ${targetLookup.kind}`);
-		const opened = await store.openActiveMaterialLookup(sourceLookup);
-		if (opened.kind !== "active") throw new Error(`ECDSA custody continuity material is ${opened.kind}`);
-		const manifest = opened.manifest;
-		const publicFacts = manifest.durableMaterial.roleLocalPublicFacts;
-		const imported = await importWalletCustodyEcdsaContinuity({
-			store,
-			authority: input.targetAuthority,
-			chainTargets: manifest.signer.scope.targetMemberships,
-			walletId: String(input.walletId),
-			keyHandle: publicFacts.keyHandle,
-			ecdsaThresholdKeyId: String(publicFacts.ecdsaThresholdKeyId),
-			signingRootId: String(publicFacts.signingRootId),
-			signingRootVersion: String(publicFacts.signingRootVersion),
-			relayerKeyId: String(manifest.durableMaterial.roleLocalBinding.relayerKeyId),
-			participantIds: publicFacts.participantIds,
-			publicCapability: publicFacts.publicCapability,
-			activationReceipt: manifest.activation.serverActivation.serverActivationReceipt.protocolReceipt,
-			runtimePolicyScope: manifest.durableMaterial.runtimePolicyScope,
-			readyStateBlobB64u: opened.readyStateBlobB64u,
-			publicFacts: {
-				contextBinding32B64u: publicFacts.contextBinding32B64u,
-				derivationClientSharePublicKey33B64u: publicFacts.derivationClientSharePublicKey33B64u,
-				clientVerifyingShare33B64u: publicFacts.publicCapability.public_identity.derivation_client_share_public_key33_b64u,
-				relayerPublicKey33B64u: publicFacts.relayerPublicKey33B64u,
-				groupPublicKey33B64u: publicFacts.groupPublicKey33B64u,
-				ethereumAddress: publicFacts.ethereumAddress,
-				clientShareRetryCounter: publicFacts.publicCapability.public_identity.client_share_retry_counter,
-				relayerShareRetryCounter: publicFacts.publicCapability.public_identity.server_share_retry_counter
-			}
-		});
-		if (imported.kind !== "committed") throw new Error(`ECDSA custody continuity import is ${imported.kind}`);
-	}
-}
-async function lookupInTransaction(context, selector) {
-	const pointerRaw = await context.store(POINTER_STORE).get(selectorKey(selector));
-	if (pointerRaw === void 0) return await lookupWithoutPointer(context, selector);
-	let pointer;
-	try {
-		pointer = parsePointerRow(pointerRaw);
-	} catch (error) {
-		return {
-			kind: "corrupt",
-			detail: errorMessage(error)
-		};
-	}
-	if (!selectorsMatch(pointer.selector, selector)) return {
-		kind: "exact_binding_mismatch",
-		detail: "current ECDSA pointer belongs to a different exact authority"
-	};
-	const manifestRaw = await context.store(MANIFEST_STORE).get(pointer.manifestId);
-	if (manifestRaw === void 0) return {
-		kind: "exact_record_conflict",
-		detail: "current ECDSA pointer references a missing manifest"
-	};
-	let parsedManifest;
-	try {
-		parsedManifest = parseManifestRow(manifestRaw);
-	} catch (error) {
-		return {
-			kind: "corrupt",
-			detail: errorMessage(error)
-		};
-	}
-	if (!selectorsMatch(parsedManifest.selector, selector)) return {
-		kind: "exact_binding_mismatch",
-		detail: "current ECDSA manifest belongs to a different exact authority"
-	};
-	if (parsedManifest.manifest.identity.manifestId !== pointer.manifestId || parsedManifest.manifest.identity.manifestRevision !== pointer.manifestRevision) return {
-		kind: "exact_record_conflict",
-		detail: "current ECDSA pointer does not match its manifest identity"
-	};
-	if (parsedManifest.state === "replaced") return {
-		kind: "retired",
-		manifest: parsedManifest.manifest
-	};
-	const activeRows = await context.store(MANIFEST_STORE).index(SEAMS_WALLET_INDEXES.capabilityWalletAuthorityState).getAll([...selectorKey(selector), "active"]);
-	if (activeRows.length !== 1) return {
-		kind: "exact_record_conflict",
-		detail: "exact ECDSA authority has multiple current manifests"
-	};
-	let indexedActive;
-	try {
-		indexedActive = parseManifestRow(activeRows[0]);
-	} catch (error) {
-		return {
-			kind: "corrupt",
-			detail: errorMessage(error)
-		};
-	}
-	if (indexedActive.state !== "active" || indexedActive.manifest.identity.manifestId !== pointer.manifestId) return {
-		kind: "exact_record_conflict",
-		detail: "exact ECDSA current index disagrees with its pointer"
-	};
-	const materialRaw = await context.store(MATERIAL_STORE).get(parsedManifest.manifest.durableMaterial.durableMaterialRef);
-	if (materialRaw === void 0) return {
-		kind: "missing",
-		subject: "material",
-		detail: "active ECDSA manifest is missing its ready material"
-	};
-	let material;
-	try {
-		material = parseMaterialRow(materialRaw, parsedManifest.activeProof);
-	} catch (error) {
-		return {
-			kind: "corrupt",
-			detail: errorMessage(error)
-		};
-	}
-	if (!materialMatchesManifest(material, parsedManifest.manifest)) return {
-		kind: "exact_binding_mismatch",
-		detail: "active ECDSA material does not match its manifest"
-	};
-	const sealingKeyRaw = await context.store(SEALING_KEY_STORE).get(material.sealingKeyId);
-	if (sealingKeyRaw === void 0) return {
-		kind: "missing",
-		subject: "material",
-		detail: "active ECDSA material is missing its sealing key"
-	};
-	try {
-		if (parseSealingKeyRow(sealingKeyRaw).keyId !== material.sealingKeyId) return {
-			kind: "exact_binding_mismatch",
-			detail: "active ECDSA material sealing key id does not match"
-		};
-	} catch (error) {
-		return {
-			kind: "corrupt",
-			detail: errorMessage(error)
-		};
-	}
-	if (await ciphertextDigestB64u(material.ciphertextB64u) !== material.binding.ciphertextDigest) return {
-		kind: "corrupt",
-		detail: "active ECDSA material ciphertext digest is invalid"
-	};
-	return {
-		kind: "active",
-		manifest: parsedManifest.manifest,
-		material
-	};
-}
-async function lookupWithoutPointer(context, selector) {
-	const rows = await context.store(MANIFEST_STORE).index(SEAMS_WALLET_INDEXES.capabilityWallet).getAll([String(selector.capability), String(selector.authority.walletId)]);
-	if (rows.length === 0) return {
-		kind: "missing",
-		subject: "capability",
-		detail: "no ECDSA capability manifest exists"
-	};
-	let hasDifferentAuthority = false;
-	let hasExactAuthority = false;
-	let hasSameMethodUnderAnotherDigest = false;
-	for (const raw of rows) {
-		let parsed;
-		try {
-			parsed = parseManifestRow(raw);
-		} catch (error) {
-			return {
-				kind: "corrupt",
-				detail: errorMessage(error)
-			};
-		}
-		if (selectorsMatch(parsed.selector, selector)) {
-			hasExactAuthority = true;
-			continue;
-		}
-		hasDifferentAuthority = true;
-		if (parsed.selector.authority.walletAuthMethodId === selector.authority.walletAuthMethodId) hasSameMethodUnderAnotherDigest = true;
-	}
-	if (hasExactAuthority) return {
-		kind: "exact_record_conflict",
-		detail: "exact ECDSA authority has manifest history without a current pointer"
-	};
-	if (hasSameMethodUnderAnotherDigest) return {
-		kind: "exact_binding_mismatch",
-		detail: "ECDSA capability exists for this method under a different authority digest"
-	};
-	if (hasDifferentAuthority) return {
-		kind: "missing",
-		subject: "capability",
-		detail: "no ECDSA capability manifest exists for this exact authority"
-	};
-	return {
-		kind: "missing",
-		subject: "capability",
-		detail: "no exact ECDSA capability manifest exists"
-	};
-}
-async function retireClientPresignaturesForActivationInTransaction(context, walletId, materialActivationId) {
-	const store = context.store(PRESIGNATURE_STORE);
-	const rows = await store.index(SEAMS_WALLET_INDEXES.walletMaterialActivationId).getAll([walletId, materialActivationId]);
-	for (const raw of rows) {
-		const recordId = rawRecordId(raw);
-		if (recordId) await store.delete(recordId);
-	}
-}
 async function finalizeInTransaction(context, input, activeProof, selector) {
 	const journalStore = context.store(JOURNAL_STORE);
 	const journalRaw = await journalStore.get(input.committedJournal.journalId);
@@ -2753,7 +1154,7 @@ async function finalizeInTransaction(context, input, activeProof, selector) {
 	try {
 		persistedJournal = parseJournalRow(journalRaw);
 	} catch (error) {
-		throw new FinalizationControlError("corrupt", errorMessage(error));
+		throw new FinalizationControlError("corrupt", ecdsaManifestErrorMessage(error));
 	}
 	if (persistedJournal.journal.kind !== "server_activation_committed" || !selectorsMatch(persistedJournal.selector, selector) || !ecdsaActivationCommitJournalsMatch(persistedJournal.journal, input.committedJournal)) throw new FinalizationControlError("exact_record_conflict", "ECDSA finalization journal does not match its committed activation");
 	const sealingKeyRaw = await context.store(SEALING_KEY_STORE).get(input.readyMaterial.sealingKeyId);
@@ -2761,13 +1162,13 @@ async function finalizeInTransaction(context, input, activeProof, selector) {
 	try {
 		parseSealingKeyRow(sealingKeyRaw);
 	} catch (error) {
-		throw new FinalizationControlError("corrupt", errorMessage(error));
+		throw new FinalizationControlError("corrupt", ecdsaManifestErrorMessage(error));
 	}
 	const pointerStore = context.store(POINTER_STORE);
 	const pointerRaw = await pointerStore.get(selectorKey(selector));
 	const expected = input.committedJournal.expectedManifest;
 	const currentPointer = assertExpectedPointer(expected, pointerRaw, selector);
-	const activeRows = await context.store(MANIFEST_STORE).index(SEAMS_WALLET_INDEXES.capabilityWalletAuthorityState).getAll([...selectorKey(selector), "active"]);
+	const activeRows = await readActiveManifestRows(context, selector);
 	let previousProof = null;
 	let previousSealingKeyId = null;
 	if (currentPointer === null) {
@@ -2778,7 +1179,7 @@ async function finalizeInTransaction(context, input, activeProof, selector) {
 		try {
 			previousManifest = parseManifestRow(activeRows[0]);
 		} catch (error) {
-			throw new FinalizationControlError("corrupt", errorMessage(error));
+			throw new FinalizationControlError("corrupt", ecdsaManifestErrorMessage(error));
 		}
 		if (previousManifest.state !== "active" || previousManifest.manifest.identity.manifestId !== currentPointer.manifestId) throw new FinalizationControlError("exact_record_conflict", "replacement ECDSA activation current manifest does not match its pointer");
 		if (input.committedJournal.activationCommand.expectedGeneration.kind !== "exact_generation" || previousManifest.activeProof.serverActivation.serverGeneration !== input.committedJournal.activationCommand.expectedGeneration.serverGeneration) throw new FinalizationControlError("exact_record_conflict", "replacement ECDSA activation server generation CAS did not match");
@@ -2790,7 +1191,7 @@ async function finalizeInTransaction(context, input, activeProof, selector) {
 			if (previousMaterial.sealingKeyId === input.readyMaterial.sealingKeyId) throw new Error("replacement ECDSA activation must use a fresh material sealing key");
 			previousSealingKeyId = previousMaterial.sealingKeyId;
 		} catch (error) {
-			throw new FinalizationControlError("corrupt", errorMessage(error));
+			throw new FinalizationControlError("corrupt", ecdsaManifestErrorMessage(error));
 		}
 		previousProof = previousManifest.activeProof;
 	}
@@ -2809,6 +1210,6 @@ async function finalizeInTransaction(context, input, activeProof, selector) {
 	await journalStore.delete(input.committedJournal.journalId);
 }
 //#endregion
-export { IndexedDbEcdsaCapabilityManifestStore, copyWalletCustodyEcdsaContinuityToAuthMethod, importWalletCustodyEcdsaContinuity, persistPreparedImportedWalletCustodyEcdsaContinuityInTransaction, prepareWalletCustodyEcdsaContinuity };
+export { IndexedDbEcdsaCapabilityManifestStore, importCommittedActivation, persistPreparedImportedWalletCustodyEcdsaContinuityInTransaction, prepareImportedWalletCustodyEcdsaContinuity };
 
 //# sourceMappingURL=ecdsaCapabilityManifestStore.js.map