@seams/wallet 0.7.1 → 0.8.0

package/dist/esm/sdk/accountLifecycle-BAGG_rbk.js

@@ -1,1341 +0,0 @@
-import { B as normalizeTrimmedString } from "./domainIds-lcrFg6Sa.js";
-import { M as base58Encode, S as compactImplicitNearAccountId, t as asRecord } from "./validation-gat4LEKm.js";
-import { i as base64UrlEncode, r as base64UrlDecode } from "./base64-Clm8C-e9.js";
-import { h as sha256HexUtf8 } from "./chains-BMh3btVo.js";
-import { c as toWalletId, o as thresholdEcdsaChainTargetKey } from "./ecdsaChainTarget-Bl-JWyuw.js";
-import { i as SIGNER_SOURCES, n as SIGNER_AUTH_METHODS, r as SIGNER_KINDS } from "./signerDomain-IEAVrOrc.js";
-import { a as toIndexedDbChainTargetKey, t as normalizeIndexedDbAccountAddress } from "./normalization-CBt413-z.js";
-import { t as toAccountId } from "./accountIds-DhIPGOSN.js";
-import { i as nearEd25519SigningKeyIdFromString } from "./registrationIds-DLSdEKSv.js";
-import { t as parseSignerSlot } from "./signerSlot-_ovonwVX.js";
-import { t as NEAR_ED25519_YAO_KEY_VERSION_V1 } from "./registrationSignerPlan-CAikVZZQ.js";
-import { a as getNearChainCandidates, i as buildNearAccountRefs, n as resolveProfileAccountContextFromCandidates, o as inferNearChainIdKey, r as resolveProfileAccountProjection, t as getLastSelectedProfileAccountByChain } from "./profileAccountProjection-uZVJuBvS.js";
-//#region src/core/accountData/near/profileId.ts
-const NEAR_PROFILE_PREFIX = "near-profile";
-function parseNearAccountProjectionProfileId(raw) {
-	if (typeof raw !== "string") return {
-		ok: false,
-		message: "NEAR account projection profile id must be a string"
-	};
-	const value = raw.trim();
-	if (!value) return {
-		ok: false,
-		message: "NEAR account projection profile id is required"
-	};
-	return {
-		ok: true,
-		value
-	};
-}
-function buildNearProfileId(accountId) {
-	return `${NEAR_PROFILE_PREFIX}:${String(accountId)}`;
-}
-//#endregion
-//#region src/core/indexedDB/keyMaterialEnvelope.ts
-function sanitizePayload(value) {
-	const record = asRecord(value);
-	if (!record) return void 0;
-	return { ...record };
-}
-function buildEnvelopeAAD(args) {
-	const signerId = normalizeTrimmedString(args.signerId || "");
-	const accountAddress = normalizeTrimmedString(args.accountAddress || "").toLowerCase();
-	return {
-		profileId: normalizeTrimmedString(args.profileId || ""),
-		signerSlot: args.signerSlot,
-		chainIdKey: normalizeTrimmedString(args.chainIdKey || "").toLowerCase(),
-		accountAddress,
-		keyKind: normalizeTrimmedString(args.keyKind || ""),
-		schemaVersion: args.schemaVersion,
-		signerId
-	};
-}
-function normalizeEnvelopeAAD(raw, expected, context) {
-	const record = asRecord(raw);
-	const profileId = String(record?.profileId ?? expected.profileId).trim();
-	const chainIdKey = String(record?.chainIdKey ?? expected.chainIdKey).trim().toLowerCase();
-	const keyKind = String(record?.keyKind ?? expected.keyKind).trim();
-	const schemaVersionRaw = Number(record?.schemaVersion ?? expected.schemaVersion);
-	const schemaVersion = Number.isSafeInteger(schemaVersionRaw) && schemaVersionRaw >= 1 ? schemaVersionRaw : expected.schemaVersion;
-	const signerSlotRaw = Number(record?.signerSlot ?? expected.signerSlot);
-	const signerSlot = Number.isSafeInteger(signerSlotRaw) && signerSlotRaw >= 1 ? signerSlotRaw : expected.signerSlot;
-	const signerId = String(record?.signerId ?? expected.signerId).trim();
-	const normalized = {
-		profileId,
-		signerSlot,
-		chainIdKey,
-		accountAddress: normalizeTrimmedString(record?.accountAddress ?? expected.accountAddress).toLowerCase(),
-		keyKind,
-		schemaVersion,
-		signerId
-	};
-	if (!(normalized.profileId === expected.profileId && normalized.signerSlot === expected.signerSlot && normalized.chainIdKey === expected.chainIdKey && normalized.accountAddress === expected.accountAddress && normalized.keyKind === expected.keyKind && normalized.schemaVersion === expected.schemaVersion && normalized.signerId === expected.signerId)) throw new Error(`KeyMaterialStore: payloadEnvelope.aad mismatch for ${context}`);
-	return normalized;
-}
-function normalizePayloadEnvelope(raw, expectedAAD, context) {
-	if (raw == null) return void 0;
-	const record = asRecord(raw);
-	if (!record) throw new Error(`KeyMaterialStore: Invalid payloadEnvelope object for ${context}`);
-	const encVersionRaw = Number(record.encVersion);
-	const encVersion = Number.isSafeInteger(encVersionRaw) && encVersionRaw >= 1 ? encVersionRaw : NaN;
-	const alg = normalizeTrimmedString(record.alg || "");
-	const nonce = normalizeTrimmedString(record.nonce || "");
-	const ciphertext = normalizeTrimmedString(record.ciphertext || "");
-	const tag = normalizeTrimmedString(record.tag || "");
-	if (!Number.isFinite(encVersion)) throw new Error(`KeyMaterialStore: Invalid payloadEnvelope.encVersion for ${context}`);
-	if (!alg || !nonce || !ciphertext) throw new Error(`KeyMaterialStore: Missing payloadEnvelope cryptographic fields for ${context}`);
-	const envelope = {
-		encVersion,
-		alg,
-		nonce,
-		ciphertext,
-		aad: normalizeEnvelopeAAD(record.aad, expectedAAD, context)
-	};
-	if (tag) envelope.tag = tag;
-	return envelope;
-}
-//#endregion
-//#region src/core/accountData/near/accountProjection.ts
-function toWalletAuthMethod(authMethod) {
-	if (authMethod === SIGNER_AUTH_METHODS.emailOtp) return SIGNER_AUTH_METHODS.emailOtp;
-	if (authMethod === SIGNER_AUTH_METHODS.passkey) return SIGNER_AUTH_METHODS.passkey;
-	return null;
-}
-function signerLoginDisplayName(args) {
-	if (args.authMethod === SIGNER_AUTH_METHODS.emailOtp) {
-		const email = normalizeTrimmedString(args.metadata.email || "");
-		if (email) return email;
-	}
-	return args.walletId;
-}
-async function getNearAccountProjection(clientDB, nearAccountId, signerSlot) {
-	const accountId = toAccountId(nearAccountId);
-	const accountAddress = normalizeIndexedDbAccountAddress(accountId);
-	if (!accountAddress) return null;
-	const projection = await resolveProfileAccountProjection(clientDB, {
-		accountRefs: getNearChainCandidates(accountId).map((chainIdKey) => ({
-			chainIdKey,
-			accountAddress
-		})),
-		signerSlot
-	});
-	if (!projection) return null;
-	const metadata = projection.selectedSigner.metadata || {};
-	const passkeyCredentialRawId = typeof metadata.passkeyCredentialRawId === "string" ? metadata.passkeyCredentialRawId : projection.selectedSigner.signerId;
-	const passkeyCredentialId = typeof metadata.passkeyCredentialId === "string" ? metadata.passkeyCredentialId : projection.profile.passkeyCredential?.id || passkeyCredentialRawId;
-	const operationalPublicKey = typeof metadata.operationalPublicKey === "string" ? metadata.operationalPublicKey : "";
-	const nearEd25519SigningKeyId = normalizeTrimmedString(metadata.nearEd25519SigningKeyId || "");
-	if (!nearEd25519SigningKeyId) return null;
-	const walletId = normalizeTrimmedString(metadata.walletId || "");
-	if (!walletId) return null;
-	const authMethod = toWalletAuthMethod(projection.selectedSigner.signerAuthMethod);
-	return {
-		walletId,
-		nearAccountId: accountId,
-		loginDisplayName: signerLoginDisplayName({
-			walletId,
-			authMethod,
-			metadata
-		}),
-		signerSlot: projection.selectedSigner.signerSlot,
-		version: 2,
-		registeredAt: projection.profile.createdAt,
-		lastLogin: projection.profile.updatedAt,
-		lastUpdated: projection.profile.updatedAt,
-		operationalPublicKey,
-		nearEd25519SigningKeyId,
-		passkeyCredential: {
-			id: passkeyCredentialId,
-			rawId: passkeyCredentialRawId
-		},
-		authMethod,
-		preferences: projection.profile.preferences
-	};
-}
-async function getLastSelectedNearAccount(clientDB) {
-	const last = await getLastSelectedProfileAccountByChain(clientDB, { chainIdKeys: ["near:testnet", "near:mainnet"] });
-	if (!last?.chainAccount?.accountAddress) return null;
-	let nearAccountId;
-	try {
-		nearAccountId = toAccountId(last.chainAccount.accountAddress);
-	} catch {
-		return null;
-	}
-	return {
-		nearAccountId,
-		profileId: last.profileId,
-		signerSlot: last.signerSlot
-	};
-}
-async function getLastSelectedNearAccountProjection(clientDB) {
-	const last = await getLastSelectedNearAccount(clientDB).catch(() => null);
-	if (!last) return null;
-	return getNearAccountProjection(clientDB, last.nearAccountId, last.signerSlot);
-}
-async function listNearAccountProjections(clientDB) {
-	const [nearTestnetRows, nearMainnetRows] = await Promise.all([clientDB.listChainAccountsByChain("near:testnet"), clientDB.listChainAccountsByChain("near:mainnet")]);
-	const accountCandidates = /* @__PURE__ */ new Set();
-	for (const row of [...nearTestnetRows, ...nearMainnetRows]) {
-		const candidate = normalizeTrimmedString(row.accountAddress || "");
-		if (!candidate) continue;
-		try {
-			accountCandidates.add(toAccountId(candidate));
-		} catch {}
-	}
-	const users = [];
-	const seenSignerRefs = /* @__PURE__ */ new Set();
-	for (const accountId of accountCandidates) {
-		const projection = await resolveProfileAccountProjection(clientDB, { accountRefs: getNearChainCandidates(accountId).map((chainIdKey) => ({
-			chainIdKey,
-			accountAddress: normalizeIndexedDbAccountAddress(accountId)
-		})) }).catch(() => null);
-		if (!projection) continue;
-		const activeSigners = projection.activeSigners.filter((signer) => signer.signerKind === SIGNER_KINDS.thresholdEd25519 && toWalletAuthMethod(signer.signerAuthMethod)).slice().sort((a, b) => a.signerSlot - b.signerSlot);
-		for (const signer of activeSigners) {
-			const signerSlot = Number(signer.signerSlot);
-			if (!Number.isSafeInteger(signerSlot) || signerSlot < 1) continue;
-			const signerRef = `${String(accountId)}:${signerSlot}`;
-			if (seenSignerRefs.has(signerRef)) continue;
-			seenSignerRefs.add(signerRef);
-			const projected = await getNearAccountProjection(clientDB, accountId, signerSlot).catch(() => null);
-			if (projected) users.push(projected);
-		}
-	}
-	return users;
-}
-//#endregion
-//#region src/core/indexedDB/walletCustodyEd25519MaterialRecord.ts
-const WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND = "wallet_custody_ed25519_active_client_v1";
-const WALLET_CUSTODY_ED25519_MATERIAL_ALGORITHM = "chacha20poly1305-hkdf-sha256-wallet-custody-seed-v1";
-const WALLET_CUSTODY_ED25519_MATERIAL_SCHEMA_VERSION = 1;
-/** Rejects a row binding that cannot be found or reopened after persistence. */
-function assertWalletCustodyEd25519MaterialBindingV1(binding) {
-	for (const [label, value] of [
-		["walletId", binding.walletId],
-		["nearAccountId", binding.nearAccountId],
-		["nearEd25519SigningKeyId", binding.nearEd25519SigningKeyId],
-		["signingWorkerId", binding.signingWorkerId],
-		["applicationBindingDigestB64u", binding.applicationBindingDigestB64u],
-		["signingWorkerVerifyingShareB64u", binding.signingWorkerVerifyingShareB64u],
-		["stateEpoch", binding.stateEpoch]
-	]) if (!String(value || "").trim()) throw new Error(`Wallet custody Ed25519 material binding requires ${label}`);
-	if (binding.participantIds.length !== 2) throw new Error("Wallet custody Ed25519 material binding requires exactly two participants");
-}
-/** Builds the IndexedDB row from material already sealed by the custody ceremony. */
-function buildWalletCustodyEd25519MaterialRecordV1(input) {
-	const { binding, sealed, target } = input;
-	assertWalletCustodyEd25519MaterialBindingV1(binding);
-	const registeredPublicKey = base64UrlDecode(binding.registeredPublicKeyB64u);
-	if (registeredPublicKey.length !== 32) throw new Error("Wallet custody Ed25519 material requires a 32-byte registered public key");
-	if (!sealed.ciphertextB64u || !sealed.nonceB64u) throw new Error("Wallet custody Ed25519 material requires its sealed ciphertext and nonce");
-	return {
-		profileId: target.profileId,
-		signerSlot: binding.signerSlot,
-		chainIdKey: target.chainIdKey,
-		accountAddress: target.accountAddress,
-		keyKind: WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND,
-		algorithm: "ed25519",
-		publicKey: `ed25519:${base58Encode(registeredPublicKey)}`,
-		signerId: binding.nearEd25519SigningKeyId,
-		payload: { binding },
-		payloadEnvelope: {
-			encVersion: 1,
-			alg: WALLET_CUSTODY_ED25519_MATERIAL_ALGORITHM,
-			nonce: sealed.nonceB64u,
-			ciphertext: sealed.ciphertextB64u,
-			aad: buildEnvelopeAAD({
-				profileId: target.profileId,
-				signerSlot: binding.signerSlot,
-				chainIdKey: target.chainIdKey,
-				accountAddress: target.accountAddress,
-				keyKind: WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND,
-				schemaVersion: WALLET_CUSTODY_ED25519_MATERIAL_SCHEMA_VERSION,
-				signerId: binding.nearEd25519SigningKeyId
-			})
-		},
-		timestamp: Date.now(),
-		schemaVersion: WALLET_CUSTODY_ED25519_MATERIAL_SCHEMA_VERSION
-	};
-}
-//#endregion
-//#region src/core/signingEngine/flows/registration/accountLifecycle.ts
-const WALLET_SUBJECT_CHAIN_ID_KEY = "wallet";
-const WALLET_SUBJECT_ACCOUNT_MODEL = "wallet";
-const THRESHOLD_ECDSA_ACCOUNT_MODEL = "threshold-ecdsa";
-const PASSKEY_REGISTRATION_SIGNER_SOURCE = {
-	signerAuthMethod: SIGNER_AUTH_METHODS.passkey,
-	signerSource: SIGNER_SOURCES.passkeyRegistration
-};
-const EMAIL_OTP_REGISTRATION_SIGNER_SOURCE = {
-	signerAuthMethod: SIGNER_AUTH_METHODS.emailOtp,
-	signerSource: SIGNER_SOURCES.emailOtpRegistration
-};
-function verifiedCredentialPublicKeyBytes(value, field) {
-	const credentialPublicKeyB64u = String(value || "").trim();
-	if (!credentialPublicKeyB64u) throw new Error(`SeamsWalletDB: ${field} is required`);
-	const credentialPublicKey = base64UrlDecode(credentialPublicKeyB64u);
-	if (credentialPublicKey.length === 0) throw new Error(`SeamsWalletDB: ${field} decoded to empty credential public key`);
-	return credentialPublicKey;
-}
-async function resolveNearProfileContext(deps, nearAccountId) {
-	const accountId = toAccountId(nearAccountId);
-	const context = await resolveProfileAccountContextFromCandidates(deps.accountStore, buildNearAccountRefs(accountId)).catch(() => null);
-	if (!context?.profileId) return null;
-	const profileId = parseNearAccountProjectionProfileId(context.profileId);
-	if (!profileId.ok) return null;
-	return {
-		profileId: profileId.value,
-		chainIdKey: context.accountRef.chainIdKey,
-		accountAddress: context.accountRef.accountAddress
-	};
-}
-async function storeUserData(deps, userData) {
-	const nearAccountId = toAccountId(userData.nearAccountId);
-	const signerSlot = Number(userData.signerSlot);
-	if (!Number.isSafeInteger(signerSlot) || signerSlot < 1) throw new Error("SeamsWalletDB: storeUserData requires an exact signerSlot");
-	const normalizedSignerSlot = signerSlot;
-	const walletId = toWalletId(userData.walletId);
-	const profileId = buildNearProfileId(nearAccountId);
-	const chainIdKey = inferNearChainIdKey(nearAccountId, userData.preferences?.useNetwork);
-	const accountAddress = normalizeIndexedDbAccountAddress(nearAccountId);
-	const signerId = String(userData.passkeyCredential?.rawId || "").trim() || `signer-${normalizedSignerSlot}`;
-	await deps.accountStore.upsertProfile({
-		profileId,
-		defaultSignerSlot: normalizedSignerSlot,
-		passkeyCredential: userData.passkeyCredential,
-		...userData.preferences ? { preferences: userData.preferences } : {}
-	});
-	const existingSigner = await deps.accountStore.getAccountSigner({
-		chainIdKey,
-		accountAddress,
-		signerId
-	}).catch(() => null);
-	const activation = await deps.accountStore.activateAccountSigner({
-		account: {
-			profileId,
-			chainIdKey,
-			accountAddress,
-			accountModel: "near-native"
-		},
-		signer: {
-			signerId,
-			signerType: "threshold",
-			signerKind: SIGNER_KINDS.thresholdEd25519,
-			signerAuthMethod: SIGNER_AUTH_METHODS.passkey,
-			signerSource: SIGNER_SOURCES.passkeyRegistration,
-			metadata: {
-				...existingSigner?.metadata || {},
-				walletId: String(walletId),
-				nearAccountId: String(nearAccountId),
-				nearEd25519SigningKeyId: userData.nearEd25519SigningKeyId,
-				operationalPublicKey: userData.operationalPublicKey,
-				passkeyCredentialId: userData.passkeyCredential?.id,
-				passkeyCredentialRawId: userData.passkeyCredential?.rawId
-			}
-		},
-		activationPolicy: { mode: "allocate_next_free" },
-		preferredSlot: normalizedSignerSlot,
-		mutation: { routeThroughOutbox: false }
-	});
-	if (activation.signerSlot !== normalizedSignerSlot) await deps.accountStore.upsertProfile({
-		profileId,
-		defaultSignerSlot: activation.signerSlot,
-		passkeyCredential: userData.passkeyCredential,
-		...userData.preferences ? { preferences: userData.preferences } : {}
-	});
-	await deps.accountStore.setLastProfileStateForProfile(profileId, activation.signerSlot);
-	return { signerSlot: activation.signerSlot };
-}
-function getAllUsers(deps) {
-	return listNearAccountProjections(deps.accountStore);
-}
-function getUserBySignerSlot(deps, nearAccountId, signerSlot) {
-	return getNearAccountProjection(deps.accountStore, nearAccountId, signerSlot);
-}
-function getLastUser(deps) {
-	return getLastSelectedNearAccountProjection(deps.accountStore);
-}
-function mapProfileAuthenticatorToClient(profileAuthenticator, nearAccountId, signerSlotOverride) {
-	return {
-		nearAccountId,
-		signerSlot: signerSlotOverride ?? profileAuthenticator.signerSlot,
-		credentialId: profileAuthenticator.credentialId,
-		credentialPublicKey: profileAuthenticator.credentialPublicKey,
-		transports: profileAuthenticator.transports,
-		name: profileAuthenticator.name,
-		registered: profileAuthenticator.registered,
-		syncedAt: profileAuthenticator.syncedAt
-	};
-}
-function passkeySignerAuthenticatorBinding(signer) {
-	if (signer.signerAuthMethod !== SIGNER_AUTH_METHODS.passkey) return null;
-	const walletId = String(signer.metadata?.walletId || "").trim();
-	const credentialId = String(signer.metadata?.passkeyCredentialRawId || "").trim();
-	if (!walletId || !credentialId) return null;
-	return {
-		walletId,
-		credentialId,
-		signerSlot: signer.signerSlot
-	};
-}
-async function listCanonicalPasskeyAuthenticatorsForNearAccount(deps, args) {
-	const bindings = (await deps.accountStore.listAccountSigners({
-		chainIdKey: args.chainIdKey,
-		accountAddress: args.accountAddress,
-		status: "active"
-	})).map(passkeySignerAuthenticatorBinding).filter((binding) => binding !== null);
-	const byWalletId = /* @__PURE__ */ new Map();
-	for (const binding of bindings) {
-		const existing = byWalletId.get(binding.walletId);
-		if (existing) existing.push(binding);
-		else byWalletId.set(binding.walletId, [binding]);
-	}
-	const authenticators = [];
-	for (const [walletId, walletBindings] of byWalletId.entries()) {
-		const walletAuthenticators = await deps.accountStore.listProfileAuthenticators(walletId);
-		for (const binding of walletBindings) {
-			const matched = walletAuthenticators.find((authenticator) => authenticator.credentialId === binding.credentialId);
-			if (!matched) continue;
-			authenticators.push(mapProfileAuthenticatorToClient(matched, args.nearAccountId, binding.signerSlot));
-		}
-	}
-	return authenticators;
-}
-async function nearAuthenticatorsByAccount(deps, nearAccountId) {
-	const accountId = toAccountId(nearAccountId);
-	const context = await resolveProfileAccountContextFromCandidates(deps.accountStore, buildNearAccountRefs(accountId)).catch(() => null);
-	if (!context?.accountRef) return [];
-	return await listCanonicalPasskeyAuthenticatorsForNearAccount(deps, {
-		nearAccountId: accountId,
-		chainIdKey: context.accountRef.chainIdKey,
-		accountAddress: context.accountRef.accountAddress
-	});
-}
-async function setLastUser(deps, walletId, signerSlot) {
-	const normalizedSignerSlot = Number(signerSlot);
-	if (!Number.isSafeInteger(normalizedSignerSlot) || normalizedSignerSlot < 1) throw new Error("SeamsWalletDB: signerSlot must be an integer >= 1");
-	const selectedId = String(walletId || "").trim();
-	if (!selectedId) throw new Error("SeamsWalletDB: selected wallet id is required");
-	const selectedProfile = await deps.accountStore.getProfile(selectedId).catch(() => null);
-	if (!selectedProfile?.profileId) throw new Error(`SeamsWalletDB: Missing profile for wallet ${selectedId}`);
-	await deps.accountStore.setLastProfileStateForProfile(selectedProfile.profileId, normalizedSignerSlot);
-}
-function storedSignerWalletId(value) {
-	try {
-		return toWalletId(value);
-	} catch {
-		return null;
-	}
-}
-function storedSignerNearAccountId(value) {
-	if (typeof value !== "string") return null;
-	try {
-		return toAccountId(value);
-	} catch {
-		return null;
-	}
-}
-function storedSignerNearEd25519SigningKeyId(value) {
-	if (typeof value !== "string" || !value.trim()) return null;
-	try {
-		return nearEd25519SigningKeyIdFromString(value);
-	} catch {
-		return null;
-	}
-}
-async function resolveAuthenticatedWalletProfileBinding(deps, args) {
-	let projection = null;
-	try {
-		projection = await resolveProfileAccountProjection(deps.accountStore, {
-			accountRefs: buildNearAccountRefs(args.nearAccountId),
-			signerSlot: args.signerSlot
-		});
-	} catch {
-		projection = null;
-	}
-	if (!projection) throw new Error("Authenticated wallet activation requires an exact NEAR signer projection");
-	const nearProjectionProfileId = parseNearAccountProjectionProfileId(projection.context.profileId);
-	if (!nearProjectionProfileId.ok) throw new Error(nearProjectionProfileId.message);
-	const selectedSigner = projection.selectedSigner;
-	const metadata = selectedSigner.metadata || {};
-	const storedWalletId = storedSignerWalletId(metadata.walletId);
-	const storedNearAccountId = storedSignerNearAccountId(metadata.nearAccountId);
-	const nearEd25519SigningKeyId = storedSignerNearEd25519SigningKeyId(metadata.nearEd25519SigningKeyId);
-	const operationalPublicKey = typeof metadata.operationalPublicKey === "string" ? metadata.operationalPublicKey.trim() : "";
-	if (selectedSigner.signerKind !== SIGNER_KINDS.thresholdEd25519 || selectedSigner.signerSlot !== args.signerSlot || storedWalletId !== args.walletId || storedNearAccountId !== args.nearAccountId || !nearEd25519SigningKeyId || !operationalPublicKey) throw new Error("Authenticated wallet activation requires an exact wallet signer binding");
-	return {
-		kind: "authenticated_near_ed25519_wallet_profile_binding",
-		walletId: storedWalletId,
-		nearProjectionProfileId: nearProjectionProfileId.value,
-		nearAccountId: storedNearAccountId,
-		nearEd25519SigningKeyId,
-		signerSlot: selectedSigner.signerSlot,
-		operationalPublicKey
-	};
-}
-async function getWalletNearProvisioningState(deps, walletId) {
-	return (await deps.accountStore.getProfile(String(walletId)))?.nearProvisioning ?? null;
-}
-/**
-* Writes the wallet root profile's NEAR provisioning state. The durable record
-* is authoritative, so this is the write every publish is sequenced behind.
-*/
-async function setWalletNearProvisioningState(deps, write) {
-	const profileId = String(write.walletId || "").trim();
-	if (!profileId) throw new Error("SeamsWalletDB: walletId is required");
-	const updatedAtMs = Date.now();
-	const state = write.status === "near_ready" ? {
-		status: "near_ready",
-		updatedAtMs,
-		nearAccountId: write.nearAccountId
-	} : write.status === "near_failed_retryable" ? {
-		status: "near_failed_retryable",
-		updatedAtMs,
-		error: write.errorCode,
-		errorCode: write.errorCode
-	} : {
-		status: write.status,
-		updatedAtMs
-	};
-	await deps.accountStore.upsertProfile({
-		profileId,
-		nearProvisioning: state
-	});
-}
-async function activateAuthenticatedWalletState(deps, args) {
-	const accountId = toAccountId(args.nearAccountId);
-	const walletId = toWalletId(args.walletId);
-	const signerSlot = parseSignerSlot(args.signerSlot);
-	if (!signerSlot) throw new Error("Authenticated wallet activation requires an exact signerSlot");
-	const binding = await resolveAuthenticatedWalletProfileBinding(deps, {
-		walletId,
-		nearAccountId: accountId,
-		signerSlot
-	});
-	await deps.accountStore.setLastProfileStateForProfile(binding.nearProjectionProfileId, binding.signerSlot);
-	deps.userPreferencesManager.setCurrentWallet(binding.walletId);
-	await deps.userPreferencesManager.reloadUserSettings().catch(() => void 0);
-	deps.nonceCoordinator.initializeNearAccessKey({
-		walletId: binding.walletId,
-		nearAccountId: binding.nearAccountId,
-		publicKey: binding.operationalPublicKey
-	});
-	if (args.nearClient) deps.nonceCoordinator.prefetchNearContext({
-		kind: "initialized_state",
-		nearClient: args.nearClient
-	}).catch((prefetchErr) => console.debug("Nonce prefetch after authentication state initialization failed (non-fatal):", prefetchErr));
-}
-async function storeAuthenticator(deps, authenticatorData) {
-	const signerSlot = Number(authenticatorData.signerSlot);
-	if (!Number.isSafeInteger(signerSlot) || signerSlot < 1) throw new Error("SeamsWalletDB: authenticator signerSlot must be an integer >= 1");
-	const authData = {
-		...authenticatorData,
-		nearAccountId: toAccountId(authenticatorData.nearAccountId),
-		signerSlot
-	};
-	const context = await resolveNearProfileContext(deps, authData.nearAccountId);
-	if (!context?.profileId) throw new Error(`SeamsWalletDB: Missing profile/account mapping for NEAR account ${authData.nearAccountId}`);
-	await deps.accountStore.upsertProfileAuthenticator({
-		profileId: context.profileId,
-		signerSlot: authData.signerSlot,
-		credentialId: authData.credentialId,
-		credentialPublicKey: authData.credentialPublicKey,
-		transports: authData.transports,
-		name: authData.name,
-		registered: authData.registered,
-		syncedAt: authData.syncedAt
-	});
-}
-function extractUsername(nearAccountId) {
-	const normalized = String(nearAccountId).trim();
-	const compactImplicit = compactImplicitNearAccountId(normalized);
-	if (compactImplicit) return compactImplicit;
-	return normalized.split(".")[0] || "";
-}
-function passkeyAuthMethod(args) {
-	const nowMs = Date.now();
-	return {
-		version: "wallet_auth_method_v1",
-		kind: "passkey",
-		status: "active",
-		localStatus: "synced",
-		walletId: args.walletId,
-		rpId: args.rpId,
-		credentialIdB64u: args.credentialId,
-		credentialPublicKeyB64u: base64UrlEncode(args.credentialPublicKey),
-		counter: 0,
-		createdAtMs: nowMs,
-		updatedAtMs: nowMs
-	};
-}
-async function emailOtpAuthMethod(args) {
-	const walletId = String(args.walletId || "").trim();
-	const email = String(args.email || "").trim().toLowerCase();
-	const registrationAuthorityId = String(args.registrationAuthorityId || "").trim();
-	if (!walletId || !email || !registrationAuthorityId) throw new Error("SeamsWalletDB: Email OTP auth method requires walletId, email, and registrationAuthorityId");
-	const emailHashHex = await sha256HexUtf8(email);
-	if (String(args.authority.walletId) !== walletId || args.authority.verifier.emailHashHex !== emailHashHex) throw new Error("SeamsWalletDB: Email OTP auth method authority does not match wallet or email");
-	const nowMs = Date.now();
-	return {
-		version: "wallet_auth_method_v1",
-		kind: "email_otp",
-		status: "active",
-		localStatus: "synced",
-		walletId: args.walletId,
-		emailHashHex,
-		registrationAuthorityId,
-		authority: args.authority,
-		createdAtMs: nowMs,
-		updatedAtMs: nowMs
-	};
-}
-async function rollbackUserRegistration(deps, nearAccountId) {
-	const accountId = toAccountId(nearAccountId);
-	const context = await resolveNearProfileContext(deps, accountId);
-	if (!context?.profileId) return;
-	await deps.accountStore.deleteProfileData(context.profileId, { eventAccountId: accountId });
-}
-async function hasPasskeyCredential(deps, nearAccountId) {
-	return (await nearAuthenticatorsByAccount(deps, toAccountId(nearAccountId))).length > 0;
-}
-function keyMaterialForSignerActivation(args) {
-	const metadata = args.activation.signer.metadata || {};
-	const signerKind = args.activation.signer.signerKind;
-	const publicKey = signerKind === SIGNER_KINDS.thresholdEcdsa ? requireStoreWalletString(metadata.thresholdEcdsaPublicKeyB64u, "ECDSA key material publicKey") : requireStoreWalletString(metadata.operationalPublicKey, "Ed25519 key material publicKey");
-	const record = {
-		profileId: requireStoreWalletString(args.activation.account.profileId, "profileId"),
-		signerSlot: args.signerSlot,
-		chainIdKey: requireStoreWalletString(args.activation.account.chainIdKey, "chainIdKey"),
-		accountAddress: requireStoreWalletString(args.activation.account.accountAddress, "accountAddress"),
-		signerId: requireStoreWalletString(args.activation.signer.signerId, "signerId"),
-		keyKind: "threshold_share_v1",
-		algorithm: signerKind === SIGNER_KINDS.thresholdEcdsa ? "secp256k1" : "ed25519",
-		publicKey,
-		timestamp: args.timestamp,
-		schemaVersion: 1
-	};
-	if (signerKind === SIGNER_KINDS.thresholdEd25519) record.payload = {
-		walletId: requireStoreWalletString(metadata.walletId, "walletId"),
-		nearAccountId: requireStoreWalletString(metadata.nearAccountId, "nearAccountId"),
-		nearEd25519SigningKeyId: requireStoreWalletString(metadata.nearEd25519SigningKeyId, "nearEd25519SigningKeyId"),
-		relayerKeyId: requireStoreWalletString(metadata.relayerKeyId, "relayerKeyId"),
-		keyVersion: requireStoreWalletString(metadata.keyVersion, "keyVersion")
-	};
-	return record;
-}
-function walletEd25519RegistrationActivationPolicy(args) {
-	switch (args.mode.kind) {
-		case "fresh_registration": return {
-			mode: "fail_if_occupied",
-			signerSlot: args.signerSlot
-		};
-		case "wallet_recovery_replacement": return {
-			mode: "replace_slot",
-			signerSlot: args.signerSlot,
-			replacedSignerKind: SIGNER_KINDS.thresholdEd25519,
-			revocationReason: "wallet_recovery_replacement"
-		};
-	}
-}
-function walletEcdsaSignerActivationPolicy(args) {
-	switch (args.mode.kind) {
-		case "fresh_registration": return { mode: "allocate_next_free" };
-		case "wallet_recovery_replacement": return {
-			mode: "replace_profile_chain_kind",
-			signerSlot: args.signerSlot,
-			replacedSignerKind: SIGNER_KINDS.thresholdEcdsa,
-			revocationReason: "wallet_recovery_replacement"
-		};
-	}
-}
-function requireWalletEd25519SignerIdentity(args) {
-	const signerSlot = Number(args.signerSlot);
-	if (!Number.isSafeInteger(signerSlot) || signerSlot < 1) throw new Error("SeamsWalletDB: wallet signerSlot must be an integer >= 1");
-	const walletId = String(args.walletId || "").trim();
-	if (!walletId) throw new Error("SeamsWalletDB: walletId is required");
-	const nearAccountId = toAccountId(args.nearAccountId);
-	const nearEd25519SigningKeyId = String(args.nearEd25519SigningKeyId || "").trim();
-	if (!nearEd25519SigningKeyId) throw new Error("SeamsWalletDB: nearEd25519SigningKeyId is required");
-	return {
-		signerSlot,
-		walletId,
-		nearAccountId,
-		nearEd25519SigningKeyId
-	};
-}
-/** The metadata an Ed25519 signer records; `authFields` name the credential that owns it. */
-function walletEd25519SignerMetadata(identity, args, authFields) {
-	return {
-		walletId: identity.walletId,
-		nearAccountId: String(identity.nearAccountId),
-		nearEd25519SigningKeyId: identity.nearEd25519SigningKeyId,
-		operationalPublicKey: args.operationalPublicKey,
-		relayerKeyId: args.relayerKeyId,
-		keyVersion: args.keyVersion,
-		...authFields,
-		...args.participantIds ? { participantIds: args.participantIds } : {},
-		...args.clientParticipantId != null ? { clientParticipantId: args.clientParticipantId } : {},
-		...args.relayerParticipantId != null ? { relayerParticipantId: args.relayerParticipantId } : {}
-	};
-}
-/** One Ed25519 signer, activated on the wallet subject and on its NEAR account. */
-function walletEd25519SignerActivations(args) {
-	const signerId = requireStoreWalletString(args.operationalPublicKey, "Ed25519 signerId");
-	const { signerSlot, walletId, nearAccountId } = args.identity;
-	const activation = (account) => ({
-		input: {
-			account,
-			signer: {
-				signerId,
-				signerType: "threshold",
-				signerKind: SIGNER_KINDS.thresholdEd25519,
-				signerAuthMethod: args.source.signerAuthMethod,
-				signerSource: args.source.signerSource,
-				metadata: args.metadata
-			},
-			activationPolicy: args.activationPolicy,
-			preferredSlot: signerSlot,
-			mutation: { routeThroughOutbox: false }
-		},
-		signerSlot
-	});
-	return [activation({
-		profileId: walletId,
-		chainIdKey: WALLET_SUBJECT_CHAIN_ID_KEY,
-		accountAddress: walletId,
-		accountModel: WALLET_SUBJECT_ACCOUNT_MODEL
-	}), activation({
-		profileId: args.nearProfileId,
-		chainIdKey: inferNearChainIdKey(nearAccountId),
-		accountAddress: normalizeIndexedDbAccountAddress(nearAccountId),
-		accountModel: "near-native"
-	})];
-}
-/** Each activation's input and its key material, all stamped with one timestamp. */
-function signerActivationRecords(activations) {
-	const signerActivations = activations.map((activation) => activation.input);
-	const keyMaterialTimestamp = Date.now();
-	return {
-		signerActivations,
-		keyMaterials: activations.map((activation) => keyMaterialForSignerActivation({
-			activation: activation.input,
-			signerSlot: activation.signerSlot,
-			timestamp: keyMaterialTimestamp
-		}))
-	};
-}
-/** The ECDSA signers a registration's composition adds after its two Ed25519 activations. */
-function walletRegistrationEcdsaActivations(walletId, composition, source, mode) {
-	return composition.kind === "near_ed25519_and_evm_family_ecdsa" ? prepareWalletEcdsaSignerActivations({
-		walletId,
-		walletKeys: composition.walletKeys
-	}, source, mode).signerActivations : [];
-}
-function storedWalletEcdsaSigner(activation, stored) {
-	return {
-		chainTarget: activation.chainTarget,
-		targetKey: activation.targetKey,
-		signerSlot: stored.signerSlot,
-		signerId: activation.signerId
-	};
-}
-function prepareWalletEd25519RegistrationBatch(args, mode, composition) {
-	const credentialId = String(args.credential.rawId || "").trim();
-	if (!credentialId) throw new Error("SeamsWalletDB: registration credential rawId is required");
-	const participantIds = args.participantIds === void 0 ? void 0 : normalizeEd25519ParticipantIds(args.participantIds);
-	return prepareWalletEd25519RegistrationBatchFromFacts({
-		walletId: args.walletId,
-		nearAccountId: args.nearAccountId,
-		nearEd25519SigningKeyId: args.nearEd25519SigningKeyId,
-		rpId: args.rpId,
-		signerSlot: args.signerSlot,
-		operationalPublicKey: args.operationalPublicKey,
-		relayerKeyId: args.relayerKeyId,
-		keyVersion: args.keyVersion,
-		participantIds,
-		clientParticipantId: args.clientParticipantId,
-		relayerParticipantId: args.relayerParticipantId,
-		credentialFacts: {
-			credentialId,
-			credentialDisplayId: args.credential.id,
-			credentialPublicKey: verifiedCredentialPublicKeyBytes(args.credentialPublicKeyB64u, "credentialPublicKeyB64u"),
-			transports: args.credential.response?.transports ?? []
-		}
-	}, mode, composition);
-}
-function prepareWalletEd25519RegistrationBatchFromFacts(args, mode, composition) {
-	const credentialId = args.credentialFacts.credentialId;
-	const identity = requireWalletEd25519SignerIdentity(args);
-	const { signerSlot, walletId, nearAccountId } = identity;
-	const passkeyCredential = {
-		id: args.credentialFacts.credentialDisplayId,
-		rawId: credentialId
-	};
-	const nowIso = (/* @__PURE__ */ new Date()).toISOString();
-	const nearProfileId = buildNearProfileId(nearAccountId);
-	const { signerActivations, keyMaterials } = signerActivationRecords([...walletEd25519SignerActivations({
-		identity,
-		nearProfileId,
-		operationalPublicKey: args.operationalPublicKey,
-		source: PASSKEY_REGISTRATION_SIGNER_SOURCE,
-		metadata: walletEd25519SignerMetadata(identity, args, {
-			passkeyCredentialId: args.credentialFacts.credentialDisplayId,
-			passkeyCredentialRawId: credentialId
-		}),
-		activationPolicy: walletEd25519RegistrationActivationPolicy({
-			mode,
-			signerSlot
-		})
-	}), ...walletRegistrationEcdsaActivations(args.walletId, composition, PASSKEY_REGISTRATION_SIGNER_SOURCE, mode)]);
-	return {
-		profiles: [walletId, nearProfileId].map((profileId) => ({
-			profileId,
-			defaultSignerSlot: signerSlot,
-			passkeyCredential
-		})),
-		initialAuthMethod: passkeyAuthMethod({
-			walletId: args.walletId,
-			rpId: args.rpId,
-			credentialId,
-			credentialPublicKey: args.credentialFacts.credentialPublicKey
-		}),
-		authenticators: [walletId, nearProfileId].map((profileId) => ({
-			profileId,
-			signerSlot,
-			credentialId,
-			credentialPublicKey: args.credentialFacts.credentialPublicKey,
-			transports: [...args.credentialFacts.transports],
-			name: `Passkey for ${extractUsername(nearAccountId)}`,
-			registered: nowIso,
-			syncedAt: nowIso
-		})),
-		signerActivations,
-		keyMaterials,
-		lastProfileState: {
-			profileId: walletId,
-			activeSignerSlot: signerSlot
-		}
-	};
-}
-function storedRegistrationResult(result, ecdsaActivations) {
-	const storedNearActivation = result.signerActivations[1];
-	if (!storedNearActivation) throw new Error("SeamsWalletDB: wallet Ed25519 registration batch did not complete");
-	const storedSigners = [];
-	for (let index = 0; index < ecdsaActivations.length; index += 1) {
-		const activation = ecdsaActivations[index];
-		const stored = result.signerActivations[index + 2];
-		if (!activation || !stored) throw new Error("SeamsWalletDB: mixed wallet ECDSA registration batch did not complete");
-		storedSigners.push(storedWalletEcdsaSigner(activation, stored));
-	}
-	return {
-		signerSlot: storedNearActivation.signerSlot,
-		storedSigners
-	};
-}
-function prepareWalletEd25519RegistrationPublication(args) {
-	return buildWalletEd25519RegistrationPublication(prepareWalletEd25519RegistrationBatch(args, { kind: "fresh_registration" }, { kind: "near_ed25519_only" }), args, args.participantIds, [args.custodyMaterial]);
-}
-function prepareWalletEd25519RegistrationProjectionPublication(args) {
-	const credentialId = String(args.credentialIdB64u || "").trim();
-	if (!credentialId) throw new Error("SeamsWalletDB: registration credential projection id is required");
-	return buildWalletEd25519RegistrationPublication(prepareWalletEd25519RegistrationBatchFromFacts({
-		walletId: args.walletId,
-		nearAccountId: args.nearAccountId,
-		nearEd25519SigningKeyId: args.nearEd25519SigningKeyId,
-		rpId: args.rpId,
-		signerSlot: args.signerSlot,
-		operationalPublicKey: args.operationalPublicKey,
-		relayerKeyId: args.relayerKeyId,
-		keyVersion: args.keyVersion,
-		participantIds: args.participantIds,
-		credentialFacts: {
-			credentialId,
-			credentialDisplayId: credentialId,
-			credentialPublicKey: verifiedCredentialPublicKeyBytes(args.credentialPublicKeyB64u, "credentialPublicKeyB64u"),
-			transports: [...args.transports]
-		}
-	}, { kind: "fresh_registration" }, { kind: "near_ed25519_only" }), args, args.participantIds, [args.custodyMaterial]);
-}
-function buildWalletEd25519RegistrationPublication(prepared, identity, participantIds, materials) {
-	const nearAccountId = toAccountId(identity.nearAccountId);
-	const custodyMaterials = materials.map((material) => {
-		const binding = material.binding;
-		if (binding.walletId !== String(identity.walletId) || binding.nearAccountId !== String(nearAccountId) || binding.nearEd25519SigningKeyId !== String(identity.nearEd25519SigningKeyId) || binding.signerSlot !== Number(identity.signerSlot) || binding.participantIds[0] !== participantIds[0] || binding.participantIds[1] !== participantIds[1]) throw new Error("Wallet custody Ed25519 material does not match registration identity");
-		return buildWalletCustodyEd25519MaterialRecordV1({
-			target: {
-				profileId: String(buildNearProfileId(nearAccountId)),
-				chainIdKey: inferNearChainIdKey(nearAccountId),
-				accountAddress: normalizeIndexedDbAccountAddress(nearAccountId)
-			},
-			binding,
-			sealed: material.sealed
-		});
-	});
-	const lastProfileState = prepared.lastProfileState;
-	if (!lastProfileState) throw new Error("Wallet Ed25519 registration publication requires last profile state");
-	return {
-		profiles: prepared.profiles,
-		initialAuthMethod: prepared.initialAuthMethod,
-		authenticators: prepared.authenticators,
-		signerActivations: prepared.signerActivations,
-		keyMaterials: [...prepared.keyMaterials, ...custodyMaterials],
-		lastProfileState: {
-			profileId: lastProfileState.profileId,
-			activeSignerSlot: lastProfileState.activeSignerSlot,
-			scope: lastProfileState.scope ?? null
-		}
-	};
-}
-function requireNonEmptyWalletEcdsaKeys(walletKeys) {
-	const first = walletKeys[0];
-	if (!first) throw new Error("SeamsWalletDB: threshold ECDSA walletKeys are required");
-	return [first, ...walletKeys.slice(1)];
-}
-function walletEcdsaRegistrationSignerSource(kind) {
-	switch (kind) {
-		case "email_otp": return EMAIL_OTP_REGISTRATION_SIGNER_SOURCE;
-		case "passkey": return PASSKEY_REGISTRATION_SIGNER_SOURCE;
-		default: return assertNeverWalletEcdsaRegistrationKind(kind);
-	}
-}
-function assertNeverWalletEcdsaRegistrationKind(value) {
-	throw new Error(`Unsupported wallet ECDSA registration kind: ${String(value)}`);
-}
-async function prepareWalletEcdsaRegistrationPublicationWithMode(args, mode) {
-	const { signerActivations, keyMaterials } = signerActivationRecords(prepareWalletEcdsaSignerActivations({
-		walletId: args.walletId,
-		walletKeys: args.walletKeys
-	}, walletEcdsaRegistrationSignerSource(args.kind), mode).signerActivations);
-	switch (args.kind) {
-		case "passkey": {
-			const credentialId = requireStoreWalletString(args.credentialIdB64u, "credentialIdB64u");
-			const credentialPublicKey = verifiedCredentialPublicKeyBytes(args.credentialPublicKeyB64u, "credentialPublicKeyB64u");
-			const nowIso = (/* @__PURE__ */ new Date()).toISOString();
-			return {
-				profiles: [{
-					profileId: args.walletId,
-					defaultSignerSlot: 1,
-					passkeyCredential: {
-						id: credentialId,
-						rawId: credentialId
-					}
-				}],
-				initialAuthMethod: passkeyAuthMethod({
-					walletId: args.walletId,
-					rpId: args.rpId,
-					credentialId,
-					credentialPublicKey
-				}),
-				authenticators: [{
-					profileId: args.walletId,
-					signerSlot: 1,
-					credentialId,
-					credentialPublicKey,
-					transports: [...args.transports],
-					name: "Passkey for wallet",
-					registered: nowIso,
-					syncedAt: nowIso
-				}],
-				signerActivations,
-				keyMaterials,
-				lastProfileState: {
-					profileId: args.walletId,
-					activeSignerSlot: 1,
-					scope: null
-				}
-			};
-		}
-		case "email_otp": return {
-			profiles: [{
-				profileId: args.walletId,
-				defaultSignerSlot: 1
-			}],
-			initialAuthMethod: await emailOtpAuthMethod({
-				walletId: args.walletId,
-				email: args.email,
-				registrationAuthorityId: args.registrationAuthorityId,
-				authority: args.authority
-			}),
-			authenticators: [],
-			signerActivations,
-			keyMaterials,
-			lastProfileState: {
-				profileId: args.walletId,
-				activeSignerSlot: 1,
-				scope: null
-			}
-		};
-	}
-}
-function prepareWalletEcdsaRegistrationPublication(args) {
-	return prepareWalletEcdsaRegistrationPublicationWithMode(args, { kind: "fresh_registration" });
-}
-async function prepareWalletRecoveryPasskeyPublication(args) {
-	const credentialId = requireStoreWalletString(args.credentialIdB64u, "credentialIdB64u");
-	if (args.kind === "near_ed25519") return buildWalletEd25519RegistrationPublication(prepareWalletEd25519RegistrationBatchFromFacts({
-		walletId: args.walletId,
-		nearAccountId: args.nearAccountId,
-		nearEd25519SigningKeyId: args.nearEd25519SigningKeyId,
-		rpId: args.rpId,
-		signerSlot: args.signerSlot,
-		operationalPublicKey: args.operationalPublicKey,
-		relayerKeyId: args.relayerKeyId,
-		keyVersion: NEAR_ED25519_YAO_KEY_VERSION_V1,
-		participantIds: normalizeEd25519ParticipantIds(args.participantIds),
-		credentialFacts: {
-			credentialId,
-			credentialDisplayId: credentialId,
-			credentialPublicKey: verifiedCredentialPublicKeyBytes(args.credentialPublicKeyB64u, "credentialPublicKeyB64u"),
-			transports: args.transports
-		}
-	}, { kind: "wallet_recovery_replacement" }, args.walletKeys.length > 0 ? {
-		kind: "near_ed25519_and_evm_family_ecdsa",
-		walletKeys: args.walletKeys
-	} : { kind: "near_ed25519_only" }), args, normalizeEd25519ParticipantIds(args.participantIds), args.custodyMaterials);
-	return await prepareWalletEcdsaRegistrationPublicationWithMode({
-		kind: "passkey",
-		walletId: args.walletId,
-		rpId: args.rpId,
-		credentialIdB64u: credentialId,
-		credentialPublicKeyB64u: args.credentialPublicKeyB64u,
-		transports: args.transports,
-		walletKeys: requireNonEmptyWalletEcdsaKeys(args.walletKeys)
-	}, { kind: "wallet_recovery_replacement" });
-}
-async function prepareWalletRecoveryEmailOtpPublication(args) {
-	if (args.kind === "near_ed25519") return buildWalletEd25519RegistrationPublication(await prepareWalletEmailOtpEd25519RegistrationBatch({
-		walletId: args.walletId,
-		nearAccountId: args.nearAccountId,
-		nearEd25519SigningKeyId: args.nearEd25519SigningKeyId,
-		email: args.email,
-		registrationAuthorityId: args.registrationAuthorityId,
-		authority: args.authority,
-		signerSlot: args.signerSlot,
-		operationalPublicKey: args.operationalPublicKey,
-		relayerKeyId: args.relayerKeyId,
-		keyVersion: NEAR_ED25519_YAO_KEY_VERSION_V1,
-		participantIds: normalizeEd25519ParticipantIds(args.participantIds)
-	}, args.walletKeys.length > 0 ? {
-		kind: "near_ed25519_and_evm_family_ecdsa",
-		walletKeys: args.walletKeys
-	} : { kind: "near_ed25519_only" }, { kind: "wallet_recovery_replacement" }), args, normalizeEd25519ParticipantIds(args.participantIds), args.custodyMaterials);
-	return await prepareWalletEcdsaRegistrationPublicationWithMode({
-		kind: "email_otp",
-		walletId: args.walletId,
-		email: args.email,
-		registrationAuthorityId: args.registrationAuthorityId,
-		authority: args.authority,
-		walletKeys: requireNonEmptyWalletEcdsaKeys(args.walletKeys)
-	}, { kind: "wallet_recovery_replacement" });
-}
-async function storeWalletEd25519RegistrationDataWithMode(deps, args, mode, composition) {
-	const prepared = prepareWalletEd25519RegistrationBatch(args, mode, composition);
-	return storedRegistrationResult(await deps.accountStore.persistWalletRegistrationFinalize(prepared), walletRegistrationEcdsaActivations(args.walletId, composition, PASSKEY_REGISTRATION_SIGNER_SOURCE));
-}
-async function storeWalletEd25519RegistrationData(deps, args) {
-	return { signerSlot: (await storeWalletEd25519RegistrationDataWithMode(deps, args, { kind: "fresh_registration" }, { kind: "near_ed25519_only" })).signerSlot };
-}
-async function storeWalletMixedRegistrationData(deps, args) {
-	return await storeWalletEd25519RegistrationDataWithMode(deps, args, { kind: "fresh_registration" }, {
-		kind: "near_ed25519_and_evm_family_ecdsa",
-		walletKeys: args.walletKeys
-	});
-}
-async function storeWalletEd25519RecoveryRegistrationData(deps, args) {
-	return { signerSlot: (await storeWalletEd25519RegistrationDataWithMode(deps, args, { kind: "wallet_recovery_replacement" }, { kind: "near_ed25519_only" })).signerSlot };
-}
-async function prepareWalletEmailOtpEd25519RegistrationBatch(args, composition, mode = { kind: "fresh_registration" }) {
-	const identity = requireWalletEd25519SignerIdentity(args);
-	const { signerSlot, walletId, nearAccountId } = identity;
-	const nearProfileId = buildNearProfileId(nearAccountId);
-	const { signerActivations, keyMaterials } = signerActivationRecords([...walletEd25519SignerActivations({
-		identity,
-		nearProfileId,
-		operationalPublicKey: args.operationalPublicKey,
-		source: EMAIL_OTP_REGISTRATION_SIGNER_SOURCE,
-		metadata: walletEd25519SignerMetadata(identity, args, {
-			email: String(args.email || "").trim().toLowerCase(),
-			registrationAuthorityId: String(args.registrationAuthorityId || "").trim()
-		}),
-		activationPolicy: walletEd25519RegistrationActivationPolicy({
-			mode,
-			signerSlot
-		})
-	}), ...walletRegistrationEcdsaActivations(args.walletId, composition, EMAIL_OTP_REGISTRATION_SIGNER_SOURCE, mode)]);
-	return {
-		profiles: [walletId, nearProfileId].map((profileId) => ({
-			profileId,
-			defaultSignerSlot: signerSlot
-		})),
-		initialAuthMethod: await emailOtpAuthMethod({
-			walletId: args.walletId,
-			email: args.email,
-			registrationAuthorityId: args.registrationAuthorityId,
-			authority: args.authority
-		}),
-		authenticators: [],
-		signerActivations,
-		keyMaterials,
-		lastProfileState: {
-			profileId: walletId,
-			activeSignerSlot: signerSlot
-		}
-	};
-}
-async function storeWalletEmailOtpEd25519RegistrationDataWithComposition(deps, args, composition) {
-	const prepared = await prepareWalletEmailOtpEd25519RegistrationBatch(args, composition);
-	const result = await deps.accountStore.persistWalletRegistrationFinalize(prepared);
-	const ecdsaActivations = walletRegistrationEcdsaActivations(args.walletId, composition, EMAIL_OTP_REGISTRATION_SIGNER_SOURCE);
-	const storedNearActivation = result.signerActivations[1];
-	if (!storedNearActivation) throw new Error("SeamsWalletDB: wallet Email OTP Ed25519 registration batch did not complete");
-	const storedSigners = [];
-	for (let index = 0; index < ecdsaActivations.length; index += 1) {
-		const activation = ecdsaActivations[index];
-		const stored = result.signerActivations[index + 2];
-		if (!activation || !stored) throw new Error("SeamsWalletDB: mixed wallet Email OTP ECDSA registration batch did not complete");
-		storedSigners.push(storedWalletEcdsaSigner(activation, stored));
-	}
-	return {
-		signerSlot: storedNearActivation.signerSlot,
-		storedSigners
-	};
-}
-async function prepareWalletEmailOtpEd25519RegistrationPublication(args) {
-	return buildWalletEd25519RegistrationPublication(await prepareWalletEmailOtpEd25519RegistrationBatch(args, { kind: "near_ed25519_only" }), args, args.participantIds, [args.custodyMaterial]);
-}
-async function storeWalletEmailOtpEd25519RegistrationData(deps, args) {
-	return { signerSlot: (await storeWalletEmailOtpEd25519RegistrationDataWithComposition(deps, args, { kind: "near_ed25519_only" })).signerSlot };
-}
-async function storeWalletEmailOtpMixedRegistrationData(deps, args) {
-	return storeWalletEmailOtpEd25519RegistrationDataWithComposition(deps, args, {
-		kind: "near_ed25519_and_evm_family_ecdsa",
-		walletKeys: args.walletKeys
-	});
-}
-async function finalizeWalletEd25519SignerRegistration(deps, args) {
-	const credentialId = String(args.auth.credential.rawId || args.auth.credential.id || "").trim();
-	if (!credentialId) throw new Error("SeamsWalletDB: add-signer credential id is required");
-	const identity = requireWalletEd25519SignerIdentity(args);
-	const { signerSlot, walletId, nearAccountId } = identity;
-	const passkeyCredential = {
-		id: args.auth.credential.id,
-		rawId: credentialId
-	};
-	const nearProfileId = buildNearProfileId(nearAccountId);
-	const { signerActivations, keyMaterials } = signerActivationRecords(walletEd25519SignerActivations({
-		identity,
-		nearProfileId,
-		operationalPublicKey: args.operationalPublicKey,
-		source: PASSKEY_REGISTRATION_SIGNER_SOURCE,
-		metadata: walletEd25519SignerMetadata(identity, args, {
-			passkeyCredentialId: args.auth.credential.id,
-			passkeyCredentialRawId: credentialId
-		}),
-		activationPolicy: {
-			mode: "fail_if_occupied",
-			signerSlot
-		}
-	}));
-	const result = await deps.accountStore.persistWalletSignerFinalize({
-		profiles: [walletId, nearProfileId].map((profileId) => ({
-			profileId,
-			defaultSignerSlot: signerSlot,
-			passkeyCredential
-		})),
-		signerActivations,
-		keyMaterials,
-		lastProfileState: {
-			profileId: walletId,
-			activeSignerSlot: signerSlot
-		}
-	});
-	const storedNearActivation = result.signerActivations[1];
-	if (!storedNearActivation) throw new Error("SeamsWalletDB: wallet Ed25519 signer batch did not complete");
-	return {
-		signerSlot: storedNearActivation.signerSlot,
-		rollbackReceipt: result.rollbackReceipt
-	};
-}
-async function rollbackWalletEd25519SignerRegistration(deps, receipt) {
-	await deps.accountStore.rollbackWalletSignerFinalize(receipt);
-}
-function requireStoreWalletString(value, field) {
-	const normalized = String(value || "").trim();
-	if (!normalized) throw new Error(`SeamsWalletDB: ${field} is required`);
-	return normalized;
-}
-function normalizeEd25519ParticipantIds(value) {
-	if (value.length !== 2 || value.some((participantId) => !Number.isSafeInteger(participantId) || participantId < 1)) throw new Error("SeamsWalletDB: Ed25519 participantIds must contain two positive integers");
-	return [value[0], value[1]];
-}
-function normalizeStoreWalletParticipantIds(value) {
-	if (!Array.isArray(value) || value.length !== 2 || value[0] !== 1 || value[1] !== 2) throw new Error("SeamsWalletDB: threshold ECDSA participantIds must be [1, 2]");
-	return [1, 2];
-}
-function prepareWalletEcdsaSignerActivations(args, source = PASSKEY_REGISTRATION_SIGNER_SOURCE, mode = { kind: "fresh_registration" }) {
-	const expectedWalletId = requireStoreWalletString(args.walletId, "walletId");
-	if (!Array.isArray(args.walletKeys) || args.walletKeys.length === 0) throw new Error("SeamsWalletDB: threshold ECDSA walletKeys are required");
-	const signerActivations = [];
-	for (const walletKey of args.walletKeys) {
-		if (walletKey.keyScope !== "evm-family") throw new Error("SeamsWalletDB: threshold ECDSA wallet keyScope must be evm-family");
-		const walletId = requireStoreWalletString(walletKey.walletId, "wallet key walletId");
-		if (walletId !== expectedWalletId) throw new Error("SeamsWalletDB: threshold ECDSA wallet key walletId mismatch");
-		const keyHandle = requireStoreWalletString(walletKey.keyHandle, "wallet key keyHandle");
-		const ecdsaThresholdKeyId = requireStoreWalletString(walletKey.ecdsaThresholdKeyId, "wallet key ecdsaThresholdKeyId");
-		const signingRootId = requireStoreWalletString(walletKey.signingRootId, "wallet key signingRootId");
-		const signingRootVersion = requireStoreWalletString(walletKey.signingRootVersion, "wallet key signingRootVersion");
-		const relayerKeyId = requireStoreWalletString(walletKey.relayerKeyId, "wallet key relayerKeyId");
-		const thresholdEcdsaPublicKeyB64u = requireStoreWalletString(walletKey.thresholdEcdsaPublicKeyB64u, "wallet key thresholdEcdsaPublicKeyB64u");
-		const participantIds = normalizeStoreWalletParticipantIds(walletKey.participantIds);
-		const thresholdOwnerAddress = normalizeIndexedDbAccountAddress(walletKey.thresholdOwnerAddress);
-		if (!thresholdOwnerAddress) throw new Error("SeamsWalletDB: wallet key thresholdOwnerAddress is required");
-		const chainIdKey = toIndexedDbChainTargetKey(walletKey.chainTarget);
-		const targetKey = thresholdEcdsaChainTargetKey(walletKey.chainTarget);
-		const signerSlot = 1;
-		signerActivations.push({
-			chainTarget: walletKey.chainTarget,
-			targetKey,
-			signerId: thresholdOwnerAddress,
-			signerSlot,
-			input: {
-				account: {
-					profileId: walletId,
-					chainIdKey,
-					accountAddress: thresholdOwnerAddress,
-					accountModel: THRESHOLD_ECDSA_ACCOUNT_MODEL
-				},
-				signer: {
-					signerId: thresholdOwnerAddress,
-					signerType: "threshold",
-					signerKind: SIGNER_KINDS.thresholdEcdsa,
-					signerAuthMethod: source.signerAuthMethod,
-					signerSource: source.signerSource,
-					metadata: {
-						accountModel: THRESHOLD_ECDSA_ACCOUNT_MODEL,
-						accountAddress: thresholdOwnerAddress,
-						ownerAddress: thresholdOwnerAddress,
-						thresholdOwnerAddress,
-						keyScope: walletKey.keyScope,
-						keyHandle,
-						walletId,
-						ecdsaThresholdKeyId,
-						signingRootId,
-						signingRootVersion,
-						relayerKeyId,
-						relayerVerifyingShareB64u: requireStoreWalletString(walletKey.relayerVerifyingShareB64u, "wallet key relayerVerifyingShareB64u"),
-						publicCapability: walletKey.publicCapability,
-						roleLocalMaterialRef: walletKey.roleLocalMaterialRef,
-						ecdsaRoleLocalPublicFacts: walletKey.ecdsaRoleLocalPublicFacts,
-						thresholdEcdsaPublicKeyB64u,
-						participantIds,
-						chainTarget: walletKey.chainTarget,
-						targetMembership: {
-							targetKey,
-							chainTarget: walletKey.chainTarget
-						},
-						sharedEvmFamilyKey: {
-							walletId,
-							keyScope: walletKey.keyScope,
-							keyHandle,
-							ecdsaThresholdKeyId,
-							signingRootId,
-							signingRootVersion,
-							participantIds,
-							thresholdOwnerAddress,
-							thresholdEcdsaPublicKeyB64u
-						},
-						chainId: walletKey.chainTarget.chainId
-					}
-				},
-				activationPolicy: walletEcdsaSignerActivationPolicy({
-					mode,
-					signerSlot
-				}),
-				preferredSlot: signerSlot,
-				mutation: { routeThroughOutbox: false }
-			}
-		});
-	}
-	return {
-		walletId: expectedWalletId,
-		signerActivations
-	};
-}
-function persistWalletEcdsaSigners(deps, prepared) {
-	return deps.accountStore.persistWalletSignerFinalize({
-		profiles: [{ profileId: prepared.walletId }],
-		...signerActivationRecords(prepared.signerActivations)
-	});
-}
-async function storeWalletEcdsaSignerRecords(deps, args) {
-	const prepared = prepareWalletEcdsaSignerActivations(args);
-	const batch = await persistWalletEcdsaSigners(deps, prepared);
-	return { storedSigners: prepared.signerActivations.map((activation, index) => {
-		const result = batch.signerActivations[index];
-		if (!result) throw new Error("SeamsWalletDB: wallet ECDSA signer batch did not complete");
-		return storedWalletEcdsaSigner(activation, result);
-	}) };
-}
-async function storeWalletEcdsaRecoverySignerRecords(deps, args) {
-	const prepared = prepareWalletEcdsaSignerActivations(args, PASSKEY_REGISTRATION_SIGNER_SOURCE, { kind: "wallet_recovery_replacement" });
-	const batch = await persistWalletEcdsaSigners(deps, prepared);
-	return { storedSigners: prepared.signerActivations.map((activation, index) => {
-		const result = batch.signerActivations[index];
-		if (!result) throw new Error("SeamsWalletDB: wallet recovery ECDSA signer batch did not complete");
-		return storedWalletEcdsaSigner(activation, result);
-	}) };
-}
-async function storeWalletEmailOtpEcdsaSignerRecords(deps, args) {
-	const prepared = prepareWalletEcdsaSignerActivations(args, EMAIL_OTP_REGISTRATION_SIGNER_SOURCE);
-	const batch = await persistWalletEcdsaSigners(deps, prepared);
-	return { storedSigners: prepared.signerActivations.map((activation, index) => {
-		const result = batch.signerActivations[index];
-		if (!result) throw new Error("SeamsWalletDB: wallet Email OTP ECDSA signer batch did not complete");
-		return storedWalletEcdsaSigner(activation, result);
-	}) };
-}
-async function finalizeWalletEcdsaRegistration(deps, args) {
-	const credentialId = String(args.credential.rawId || "").trim();
-	if (!credentialId) throw new Error("SeamsWalletDB: registration credential rawId is required");
-	const preparedEcdsa = prepareWalletEcdsaSignerActivations({
-		walletId: args.walletId,
-		walletKeys: args.walletKeys
-	});
-	const registration = await prepareWalletEcdsaRegistrationPublication({
-		kind: "passkey",
-		walletId: args.walletId,
-		rpId: args.rpId,
-		credentialIdB64u: credentialId,
-		credentialPublicKeyB64u: args.credentialPublicKeyB64u,
-		transports: args.credential.response?.transports ?? [],
-		walletKeys: requireNonEmptyWalletEcdsaKeys(args.walletKeys)
-	});
-	const batch = await deps.accountStore.persistWalletRegistrationFinalize(registration);
-	return { storedSigners: preparedEcdsa.signerActivations.map((activation, index) => {
-		const result = batch.signerActivations[index];
-		if (!result) throw new Error("SeamsWalletDB: wallet ECDSA registration batch did not complete");
-		return storedWalletEcdsaSigner(activation, result);
-	}) };
-}
-async function storeWalletEmailOtpEcdsaRegistrationData(deps, args) {
-	const preparedEcdsa = prepareWalletEcdsaSignerActivations({
-		walletId: args.walletId,
-		walletKeys: args.walletKeys
-	}, EMAIL_OTP_REGISTRATION_SIGNER_SOURCE);
-	const registration = await prepareWalletEcdsaRegistrationPublication({
-		kind: "email_otp",
-		walletId: args.walletId,
-		email: args.email,
-		registrationAuthorityId: args.registrationAuthorityId,
-		authority: args.authority,
-		walletKeys: requireNonEmptyWalletEcdsaKeys(args.walletKeys)
-	});
-	const batch = await deps.accountStore.persistWalletRegistrationFinalize(registration);
-	return { storedSigners: preparedEcdsa.signerActivations.map((activation, index) => {
-		const result = batch.signerActivations[index];
-		if (!result) throw new Error("SeamsWalletDB: wallet Email OTP ECDSA registration batch did not complete");
-		return storedWalletEcdsaSigner(activation, result);
-	}) };
-}
-//#endregion
-export { storeWalletMixedRegistrationData as A, buildNearProfileId as B, storeWalletEcdsaSignerRecords as C, storeWalletEmailOtpEcdsaSignerRecords as D, storeWalletEmailOtpEcdsaRegistrationData as E, getLastSelectedNearAccount as F, getNearAccountProjection as I, buildEnvelopeAAD as L, WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND as M, assertWalletCustodyEd25519MaterialBindingV1 as N, storeWalletEmailOtpEd25519RegistrationData as O, buildWalletCustodyEd25519MaterialRecordV1 as P, normalizePayloadEnvelope as R, storeWalletEcdsaRecoverySignerRecords as S, storeWalletEd25519RegistrationData as T, rollbackWalletEd25519SignerRegistration as _, getLastUser as a, storeAuthenticator as b, hasPasskeyCredential as c, prepareWalletEd25519RegistrationProjectionPublication as d, prepareWalletEd25519RegistrationPublication as f, rollbackUserRegistration as g, prepareWalletRecoveryPasskeyPublication as h, getAllUsers as i, WALLET_CUSTODY_ED25519_MATERIAL_ALGORITHM as j, storeWalletEmailOtpMixedRegistrationData as k, nearAuthenticatorsByAccount as l, prepareWalletRecoveryEmailOtpPublication as m, finalizeWalletEcdsaRegistration as n, getUserBySignerSlot as o, prepareWalletEmailOtpEd25519RegistrationPublication as p, finalizeWalletEd25519SignerRegistration as r, getWalletNearProvisioningState as s, activateAuthenticatedWalletState as t, prepareWalletEcdsaRegistrationPublication as u, setLastUser as v, storeWalletEd25519RecoveryRegistrationData as w, storeUserData as x, setWalletNearProvisioningState as y, sanitizePayload as z };