@seams/wallet 0.7.3 → 0.8.0

package/dist/esm/react/core/indexedDB/seamsWalletDB/repositories.js

@@ -1,4747 +0,0 @@
-import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
-import { normalizeTrimmedString } from "../../../shared-ts/src/utils/normalize.js";
-import "../../../shared-ts/src/utils/validation.js";
-import { sha256HexUtf8 } from "../../../shared-ts/src/utils/digests.js";
-import { mpcMaterialActivationRefsEqual, parseMpcMaterialActivationRef, parseVerifiedEmailAddress, parseWalletAuthMethodId, parseWalletAuthorityId, parseWalletId, parseWalletKeyId, parseWalletRecoveryOperationId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../shared-ts/src/utils/domainIds.js";
-import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { sameDelegatedWalletAuthorityV1 } from "../../../shared-ts/src/authorization/delegatedAuthority.js";
-import { parseEd25519PublicKeyB64u } from "../../../shared-ts/src/passkey-custody/primitives.js";
-import { walletSessionPreservesCapabilities } from "../../../shared-ts/src/device-linking/activeWalletSession.js";
-import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority, parseEmailOtpWalletAuthAuthority, parseWalletAuthAuthority, walletAuthAuthoritiesMatch } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { SIGNER_KINDS } from "../../../shared-ts/src/utils/signerDomain.js";
-import { walletIdFromString } from "../../../shared-ts/src/utils/registrationIds.js";
-import { thresholdEcdsaChainTargetFromRequest } from "../../signingEngine/interfaces/ecdsaChainTarget.js";
-import { toAccountId } from "../../types/accountIds.js";
-import { SEAMS_WALLET_INDEXES, SEAMS_WALLET_STORES } from "../schemaNames.js";
-import { parseEcdsaThresholdKeyId } from "../../signingEngine/session/keyMaterialBrands.js";
-import { parseWalletAuthMethodRecordV2 } from "../../../shared-ts/src/utils/walletAuthMethodRecord.js";
-import { parsePasskeyCustodyEnvelopeRecord, sameWalletCustodyEnvelopeOwnership } from "../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
-import "../../../shared-ts/src/passkey-custody/index.js";
-import { encodeWalletSignerActivationSetV1, extendEcdsaWalletAuthorityWithEd25519, isActiveEcdsaWalletAuthorityV1, isActiveRecoveredWalletAuthorityV1, isEcdsaExtensionOfEd25519WalletAuthority, parseWalletAuthorityV1, walletAuthorityDigestsMatchV1 } from "../../../shared-ts/src/authorization/walletAuthority.js";
-import { parseLocalAuthorityInstallationReceiptV1 } from "../../../shared-ts/src/device-linking/authorityActivation.js";
-import "../../../shared-ts/src/device-linking/index.js";
-import { parseNearProvisioningState } from "../../types/sdkSentEvents.js";
-import { upsertEd25519YaoPublicCapabilityReferenceInTransaction } from "../../signingEngine/threshold/ed25519/yaoPublicCapabilityReferences.js";
-import { buildEnvelopeAAD, normalizePayloadEnvelope, sanitizePayload } from "../keyMaterialEnvelope.js";
-import { normalizeIndexedDbAccountAddress, normalizeIndexedDbAccountModel, normalizeIndexedDbChainIdKey, normalizeLastUserScope, toIndexedDbChainTargetKey } from "../normalization.js";
-import { buildNearProfileId } from "../../accountData/near/profileId.js";
-import { parseWalletAuthorityLinkedSignerMaterialRecordV1 } from "../linkedAuthoritySignerMaterial.js";
-import { planAccountSignerActivation } from "../accountSignerLifecycle.js";
-import { parseLastProfileState } from "../lastProfileState.js";
-import { assertPendingWalletRegistrationIdentity, buildPendingWalletRegistrationCommitV1, parsePendingWalletRegistrationCommitAppStateRow, pendingWalletRegistrationCommitAppStateKey, splitPersistedMixedRegistrationRow, toPendingWalletRegistrationCommitAppStateRow } from "../pendingWalletRegistrationCommit.js";
-import { buildPendingWalletRecoveryCommitV1, parsePendingWalletRecoveryCommitAppStateRow, pendingWalletRecoveryCommitAppStateKey, pendingWalletRecoveryCommitAppStateRowsMatch, pendingWalletRecoveryCommitIdentityMatches, toPendingWalletRecoveryCommitAppStateRow } from "../pendingWalletRecoveryCommit.js";
-import { parseStoredExactWalletSessionAuthorizationRowV6, readExactActiveWalletSessionForScopeInTransaction, replaceExactActiveWalletSessionAuthorizationInTransaction, toStoredExactWalletSessionAuthorizationRowV6 } from "./walletSessionAuthorizationStore.js";
-import { persistPreparedImportedWalletCustodyEcdsaContinuityInTransaction } from "./ecdsaCapabilityManifestStore.js";
-//#region src/core/indexedDB/seamsWalletDB/repositories.ts
-function assertNever(value) {
-	throw new Error(`Unhandled wallet auth method branch: ${String(value)}`);
-}
-function exportRootEnvelopeMatchesAuthMethod(authMethod, envelope) {
-	if (envelope.binding.kind !== "ed25519_yao_client_root_v1") return false;
-	switch (authMethod.kind) {
-		case "passkey": return envelope.factor.kind === "passkey" && envelope.factor.rpId === authMethod.rpId && envelope.factor.credentialIdB64u === authMethod.credentialIdB64u && envelope.binding.targetFactor.kind === "passkey_prf";
-		case "email_otp": return envelope.factor.kind === "email_otp" && envelope.binding.targetFactor.kind === "email_otp";
-		default: return assertNever(authMethod);
-	}
-}
-function parseAppStateRow(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const key = Reflect.get(value, "key");
-	if (typeof key !== "string" || key.length === 0) return null;
-	return {
-		key,
-		value: Reflect.get(value, "value")
-	};
-}
-const LOCAL_AUTHORITY_PENDING_PROFILE_PROJECTION_APP_STATE_PREFIX_V1 = "local-authority/pending-profile-projection/v1/";
-function localAuthorityPendingProfileProjectionAppStateKeyV1(authorityId) {
-	return `${LOCAL_AUTHORITY_PENDING_PROFILE_PROJECTION_APP_STATE_PREFIX_V1}${authorityId}`;
-}
-function walletSelectionForInstalledAuthority(input, selection) {
-	return {
-		kind: "wallet_selection_v1",
-		walletId: input.authority.walletId,
-		walletAuthMethodId: input.authMethod.walletAuthMethodId,
-		lockGeneration: selection?.record.lockGeneration ?? 0,
-		lockState: selection?.record.lockState ?? "unlocked",
-		updatedAtMs: input.receipt.installedAtMs
-	};
-}
-function assertPendingWalletRegistrationRequestIdentity(pending, request) {
-	if (pending.operation !== request.operation || pending.registrationCeremonyId !== request.registrationCeremonyId || pending.idempotencyKey !== request.idempotencyKey || pending.walletId !== request.walletId || pending.walletAuthMethodId !== request.walletAuthMethodId) throw new Error("pending wallet registration commit does not match the request");
-}
-function validateFoundingWalletAuthorityInput(input) {
-	const authority = parseWalletAuthorityV1(input.authority);
-	const authMethod = parseWalletAuthMethodRecordV2(input.authMethod);
-	if (!authority.ok || authority.value.state !== "active" || !authMethod || authMethod.status !== "active" || authority.value.provenance.kind !== "wallet_registration" || authMethod.walletId !== authority.value.walletId || authMethod.walletAuthorityId !== authority.value.authorityId) throw new Error("founding wallet authority records are invalid");
-	return {
-		authority: authority.value,
-		authMethod
-	};
-}
-async function assertRegistrationFinalizeMatchesPending(input) {
-	const pending = input.pending;
-	const foundingMethod = input.foundingAuthority.authMethod;
-	const initialMethod = input.registration.initialAuthMethod;
-	assertPendingWalletRegistrationRequestIdentity(pending, input.request);
-	assertPendingWalletRegistrationIdentity(pending, {
-		operation: input.request.operation,
-		walletId: input.request.walletId,
-		walletAuthMethodId: input.request.walletAuthMethodId,
-		authority: input.authority
-	});
-	if (foundingMethod.walletId !== pending.walletId || foundingMethod.walletAuthMethodId !== pending.walletAuthMethodId || initialMethod.walletId !== pending.walletId || initialMethod.status !== "active" || initialMethod.localStatus !== "synced" || initialMethod.kind !== pending.auth.kind || foundingMethod.kind !== pending.auth.kind || !input.registration.profiles.some((profile) => profile.profileId === pending.walletId) || input.registration.lastProfileState.profileId !== pending.walletId) throw new Error("registration finalize batch does not match the pending wallet");
-	const profileIds = new Set(input.registration.profiles.map((profile) => profile.profileId));
-	for (const profile of input.registration.profiles) if (profile.passkeyCredential && (pending.auth.kind !== "passkey" || profile.passkeyCredential.rawId !== pending.auth.credentialIdB64u)) throw new Error("registration profile credential does not match the pending commit");
-	for (const activation of input.registration.signerActivations) if (!profileIds.has(activation.account.profileId)) throw new Error("registration signer account is outside the publication profiles");
-	for (const keyMaterial of input.registration.keyMaterials) if (!profileIds.has(keyMaterial.profileId)) throw new Error("registration key material is outside the publication profiles");
-	switch (pending.auth.kind) {
-		case "passkey":
-			if (!isPasskeyWalletAuthAuthority(input.authority) || initialMethod.kind !== "passkey" || foundingMethod.kind !== "passkey" || initialMethod.rpId !== pending.auth.rpId || initialMethod.credentialIdB64u !== pending.auth.credentialIdB64u || foundingMethod.rpId !== pending.auth.rpId || foundingMethod.credentialIdB64u !== pending.auth.credentialIdB64u || initialMethod.credentialPublicKeyB64u !== foundingMethod.credentialPublicKeyB64u) throw new Error("registration passkey records do not match the pending commit");
-			for (const authenticator of input.registration.authenticators) if (!profileIds.has(authenticator.profileId) || authenticator.credentialId !== pending.auth.credentialIdB64u || base64UrlEncode(authenticator.credentialPublicKey) !== initialMethod.credentialPublicKeyB64u) throw new Error("registration passkey authenticator does not match the pending commit");
-			return;
-		case "email_otp": {
-			if (initialMethod.kind !== "email_otp" || foundingMethod.kind !== "email_otp") throw new Error("registration Email OTP method records are invalid");
-			const emailAuthority = parseEmailOtpWalletAuthAuthority(initialMethod.authority);
-			if (!emailAuthority || !isEmailOtpWalletAuthAuthority(input.authority)) throw new Error("registration Email OTP authority records are invalid");
-			const expectedEmailHashHex = await sha256HexUtf8(pending.auth.email);
-			if (initialMethod.registrationAuthorityId !== pending.auth.registrationAuthorityId || foundingMethod.registrationAuthorityId !== pending.auth.registrationAuthorityId || initialMethod.emailHashHex !== expectedEmailHashHex || foundingMethod.emailHashHex !== expectedEmailHashHex || input.authority.verifier.emailHashHex !== expectedEmailHashHex || emailAuthority.factor.providerUserId !== pending.auth.providerSubject || emailAuthority.factor.provider !== input.authority.factor.provider || !walletAuthAuthoritiesMatch(emailAuthority, input.authority) || input.registration.authenticators.length !== 0) throw new Error("registration Email OTP records do not match the pending commit");
-			return;
-		}
-	}
-}
-function assertPendingWalletRecoveryPublicationMatchesProjection(input) {
-	const projection = input.pending.projection;
-	if (!walletAuthorityRecordsMatch(input.authority, projection.authority) || !walletAuthMethodRecordsMatch(input.authMethod, projection.authMethod)) throw new Error("recovery publication records do not match the committed projection");
-	const initialMethod = input.registration.initialAuthMethod;
-	const profiles = input.registration.profiles;
-	if (initialMethod.status !== "active" || initialMethod.localStatus !== "synced" || initialMethod.walletId !== projection.walletId || !profiles.some((profile) => profile.profileId === projection.walletId) || input.registration.lastProfileState.profileId !== projection.walletId || !Number.isSafeInteger(input.registration.lastProfileState.activeSignerSlot) || input.registration.lastProfileState.activeSignerSlot < 1) throw new Error("recovery profile publication does not match the committed projection");
-	const profileIds = new Set(profiles.map((profile) => profile.profileId));
-	for (const profile of profiles) if (profile.passkeyCredential && (projection.kind !== "passkey" || profile.passkeyCredential.rawId !== projection.target.credentialIdB64u)) throw new Error("recovery profile credential does not match the committed projection");
-	for (const activation of input.registration.signerActivations) if (!profileIds.has(activation.account.profileId)) throw new Error("recovery signer account is outside the publication profiles");
-	for (const keyMaterial of input.registration.keyMaterials) if (!profileIds.has(keyMaterial.profileId)) throw new Error("recovery key material is outside the publication profiles");
-	if (projection.kind === "passkey") {
-		if (initialMethod.kind !== "passkey") throw new Error("recovery passkey publication method branch is invalid");
-		if (initialMethod.rpId !== projection.target.rpId || initialMethod.credentialIdB64u !== projection.target.credentialIdB64u || initialMethod.credentialPublicKeyB64u !== projection.authMethod.credentialPublicKeyB64u || !input.registration.authenticators.some((authenticator) => authenticator.profileId === projection.walletId && authenticator.credentialId === projection.target.credentialIdB64u && base64UrlEncode(authenticator.credentialPublicKey) === projection.authMethod.credentialPublicKeyB64u)) throw new Error("recovery passkey publication does not match the committed projection");
-		return;
-	}
-	if (initialMethod.kind !== "email_otp") throw new Error("recovery Email OTP publication method branch is invalid");
-	if (initialMethod.emailHashHex !== projection.target.emailHashHex || initialMethod.registrationAuthorityId !== projection.target.registrationAuthorityId || input.registration.authenticators.length !== 0 || profiles.some((profile) => profile.passkeyCredential !== void 0)) throw new Error("recovery Email OTP publication does not match the committed projection");
-	const localAuthority = parseEmailOtpWalletAuthAuthority(initialMethod.authority);
-	if (!localAuthority || localAuthority.walletId !== projection.walletId || localAuthority.factor.provider !== "google" || localAuthority.factor.providerUserId !== projection.target.providerSubject || localAuthority.verifier.emailHashHex !== projection.target.emailHashHex) throw new Error("recovery Email OTP factor does not match the committed projection");
-}
-function shouldDeletePublishedPendingWalletRegistrationCommit(pending) {
-	switch (pending.operation) {
-		case "near_provisioning": return true;
-		case "registration_activate": return pending.signerPlanKind !== "near_ed25519";
-	}
-}
-function assertCredentialFreeRegistrationSessionProjectionMatchesExisting(input) {
-	if (input.incoming.walletId !== input.existing.walletId || input.incoming.authorityId !== input.existing.authorityId || input.incoming.authMethodId !== input.existing.authMethodId || input.incoming.authorizationId !== input.existing.authorizationId || input.incoming.quotaId !== input.existing.quotaId || input.incoming.issuedAtMs !== input.existing.issuedAtMs || input.incoming.expiresAtMs !== input.existing.expiresAtMs || input.incoming.expiresAtMs <= Date.now() || input.incoming.authorityRevocationEpoch !== input.existing.authorityRevocationEpoch || !walletSessionPreservesCapabilities(input.existing, input.incoming)) throw new Error("Credential-free registration projection changed immutable session identity");
-}
-const DEFAULT_NONCE_LANE_LOCK_TTL_MS = 5e3;
-const DEFAULT_NONCE_LANE_LOCK_WAIT_TIMEOUT_MS = 3e3;
-const DEFAULT_NONCE_LANE_LOCK_POLL_MS = 25;
-const LAST_PROFILE_STATE_APP_STATE_KEY = "lastProfileState";
-const WALLET_REGISTRATION_FINALIZE_STORES = [
-	SEAMS_WALLET_STORES.appState,
-	SEAMS_WALLET_STORES.wallets,
-	SEAMS_WALLET_STORES.walletAuthMethods,
-	SEAMS_WALLET_STORES.walletSigners,
-	SEAMS_WALLET_STORES.nearAccountProjections,
-	SEAMS_WALLET_STORES.signerOpsOutbox,
-	SEAMS_WALLET_STORES.keyMaterial
-];
-const WALLET_REGISTRATION_PUBLICATION_STORES = [
-	SEAMS_WALLET_STORES.appState,
-	SEAMS_WALLET_STORES.wallets,
-	SEAMS_WALLET_STORES.walletAuthMethods,
-	SEAMS_WALLET_STORES.walletAuthorities,
-	SEAMS_WALLET_STORES.walletSelections,
-	SEAMS_WALLET_STORES.walletSigners,
-	SEAMS_WALLET_STORES.nearAccountProjections,
-	SEAMS_WALLET_STORES.signerOpsOutbox,
-	SEAMS_WALLET_STORES.keyMaterial,
-	SEAMS_WALLET_STORES.walletSessionAuthorizations,
-	SEAMS_WALLET_STORES.ecdsaCapabilityManifests,
-	SEAMS_WALLET_STORES.ecdsaCurrentCapabilityManifests,
-	SEAMS_WALLET_STORES.ecdsaRoleLocalMaterial,
-	SEAMS_WALLET_STORES.ecdsaMaterialSealingKeys
-];
-const WALLET_RECOVERY_PUBLICATION_STORES = [
-	SEAMS_WALLET_STORES.appState,
-	SEAMS_WALLET_STORES.wallets,
-	SEAMS_WALLET_STORES.walletAuthMethods,
-	SEAMS_WALLET_STORES.walletAuthorities,
-	SEAMS_WALLET_STORES.walletSelections,
-	SEAMS_WALLET_STORES.walletSigners,
-	SEAMS_WALLET_STORES.nearAccountProjections,
-	SEAMS_WALLET_STORES.signerOpsOutbox,
-	SEAMS_WALLET_STORES.keyMaterial,
-	SEAMS_WALLET_STORES.ecdsaCapabilityManifests,
-	SEAMS_WALLET_STORES.ecdsaCurrentCapabilityManifests,
-	SEAMS_WALLET_STORES.ecdsaRoleLocalMaterial,
-	SEAMS_WALLET_STORES.ecdsaMaterialSealingKeys,
-	SEAMS_WALLET_STORES.ecdsaClientPresignatures
-];
-const DEFAULT_WALLET_RP_ID = "local";
-function requireWebAuthnRpId(value) {
-	const parsed = parseWebAuthnRpId(value);
-	if (!parsed.ok) throw new Error(parsed.error.message);
-	return parsed.value;
-}
-const CHAIN_ACCOUNT_PROJECTION_SIGNER_SLOT = 0;
-var SeamsWalletDBConstraintError = class extends Error {
-	constructor(code, message, details) {
-		super(message);
-		this.name = "SeamsWalletDBConstraintError";
-		this.code = code;
-		this.details = details;
-	}
-};
-function sleep(ms) {
-	return new Promise((resolve) => setTimeout(resolve, ms));
-}
-function createRandomToken(prefix) {
-	const bytes = new Uint8Array(16);
-	crypto.getRandomValues(bytes);
-	return `${prefix}-${Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
-}
-function nonceLeaseWalletId(record) {
-	if (record.family === "near") return record.walletId;
-	return record.accountId;
-}
-function nonceLeaseNearAccountId(record) {
-	return record.family === "near" ? record.nearAccountId : "";
-}
-function nonceLeaseRow(record) {
-	const leaseId = normalizeTrimmedString(record.leaseId || "");
-	const laneKey = normalizeTrimmedString(record.laneKey || "");
-	const walletId = normalizeTrimmedString(nonceLeaseWalletId(record) || "");
-	const nearAccountId = normalizeTrimmedString(nonceLeaseNearAccountId(record) || "");
-	if (!leaseId || !laneKey || !walletId) throw new Error("[SeamsWalletDB] nonce lease requires leaseId, laneKey, and wallet identity");
-	return {
-		lease_id: leaseId,
-		lane_key: laneKey,
-		wallet_id: walletId,
-		...nearAccountId ? { near_account_id: nearAccountId } : {},
-		state: record.state,
-		expires_at_ms: Math.floor(Number(record.expiresAtMs)),
-		record
-	};
-}
-function parseStoredNonEmptyString(value) {
-	return typeof value === "string" && value.length > 0 && value.trim() === value ? value : null;
-}
-function parseNonceLaneLockRow(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const lockKey = parseStoredNonEmptyString(Reflect.get(value, "lock_key"));
-	const ownerId = parseStoredNonEmptyString(Reflect.get(value, "owner_id"));
-	const fencingToken = parseStoredNonEmptyString(Reflect.get(value, "fencing_token"));
-	const acquiredAtMs = Reflect.get(value, "acquired_at_ms");
-	const expiresAtMs = Reflect.get(value, "expires_at_ms");
-	const updatedAtMs = Reflect.get(value, "updated_at_ms");
-	if (!lockKey || !ownerId || !fencingToken || !Number.isSafeInteger(acquiredAtMs) || acquiredAtMs < 0 || !Number.isSafeInteger(expiresAtMs) || expiresAtMs < 0 || !Number.isSafeInteger(updatedAtMs) || updatedAtMs < 0) return null;
-	return {
-		lock_key: lockKey,
-		owner_id: ownerId,
-		fencing_token: fencingToken,
-		acquired_at_ms: acquiredAtMs,
-		expires_at_ms: expiresAtMs,
-		updated_at_ms: updatedAtMs
-	};
-}
-function parseStoredThresholdEcdsaChainTarget(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	try {
-		return thresholdEcdsaChainTargetFromRequest({
-			kind: Reflect.get(value, "kind"),
-			namespace: Reflect.get(value, "namespace"),
-			chainId: Reflect.get(value, "chainId"),
-			networkSlug: Reflect.get(value, "networkSlug")
-		});
-	} catch {
-		return null;
-	}
-}
-function parseNonceLeaseRecord(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const version = Reflect.get(value, "v");
-	const leaseId = parseStoredNonEmptyString(Reflect.get(value, "leaseId"));
-	const laneKey = parseStoredNonEmptyString(Reflect.get(value, "laneKey"));
-	const networkKey = parseStoredNonEmptyString(Reflect.get(value, "networkKey"));
-	const nonce = parseStoredNonEmptyString(Reflect.get(value, "nonce"));
-	const operationId = parseStoredNonEmptyString(Reflect.get(value, "operationId"));
-	const operationFingerprint = parseStoredNonEmptyString(Reflect.get(value, "operationFingerprint"));
-	const reservedAtMs = Reflect.get(value, "reservedAtMs");
-	const expiresAtMs = Reflect.get(value, "expiresAtMs");
-	const updatedAtMs = Reflect.get(value, "updatedAtMs");
-	const state = Reflect.get(value, "state");
-	if (version !== 1 || !leaseId || !laneKey || !networkKey || !nonce || !operationId || !operationFingerprint || !Number.isSafeInteger(reservedAtMs) || !Number.isSafeInteger(expiresAtMs) || !Number.isSafeInteger(updatedAtMs) || state !== "reserved" && state !== "signed" && state !== "broadcast_accepted") return null;
-	const txHash = Reflect.get(value, "txHash");
-	if (state === "broadcast_accepted" && !parseStoredNonEmptyString(txHash)) return null;
-	if (state !== "broadcast_accepted" && txHash !== void 0) return null;
-	const runtimeId = Reflect.get(value, "runtimeId");
-	const fencingToken = Reflect.get(value, "fencingToken");
-	const batchId = Reflect.get(value, "batchId");
-	const txIndex = Reflect.get(value, "txIndex");
-	if (runtimeId !== void 0 && !parseStoredNonEmptyString(runtimeId) || fencingToken !== void 0 && !parseStoredNonEmptyString(fencingToken) || batchId !== void 0 && !parseStoredNonEmptyString(batchId) || txIndex !== void 0 && !Number.isSafeInteger(txIndex)) return null;
-	const family = Reflect.get(value, "family");
-	if (family === "near") {
-		const walletId = parseStoredNonEmptyString(Reflect.get(value, "walletId"));
-		const nearAccountId = parseStoredNonEmptyString(Reflect.get(value, "nearAccountId"));
-		const publicKey = parseStoredNonEmptyString(Reflect.get(value, "publicKey"));
-		if (!walletId || !nearAccountId || !publicKey) return null;
-		return {
-			v: 1,
-			leaseId,
-			laneKey,
-			networkKey,
-			nonce,
-			operationId,
-			operationFingerprint,
-			reservedAtMs,
-			expiresAtMs,
-			updatedAtMs,
-			family: "near",
-			walletId,
-			nearAccountId,
-			publicKey,
-			state,
-			...runtimeId === void 0 ? {} : { runtimeId },
-			...fencingToken === void 0 ? {} : { fencingToken },
-			...batchId === void 0 ? {} : { batchId },
-			...txIndex === void 0 ? {} : { txIndex },
-			...state === "broadcast_accepted" ? { txHash } : {}
-		};
-	}
-	if (family !== "evm") return null;
-	const chainTarget = parseStoredThresholdEcdsaChainTarget(Reflect.get(value, "chainTarget"));
-	const sender = parseStoredNonEmptyString(Reflect.get(value, "sender"));
-	const accountId = parseStoredNonEmptyString(Reflect.get(value, "accountId"));
-	if (!chainTarget || !sender || !accountId) return null;
-	const nonceKey = Reflect.get(value, "nonceKey");
-	if (nonceKey !== void 0 && !parseStoredNonEmptyString(nonceKey)) return null;
-	return {
-		v: 1,
-		leaseId,
-		laneKey,
-		networkKey,
-		nonce,
-		operationId,
-		operationFingerprint,
-		reservedAtMs,
-		expiresAtMs,
-		updatedAtMs,
-		family: "evm",
-		chainTarget,
-		sender,
-		accountId,
-		state,
-		...runtimeId === void 0 ? {} : { runtimeId },
-		...fencingToken === void 0 ? {} : { fencingToken },
-		...batchId === void 0 ? {} : { batchId },
-		...txIndex === void 0 ? {} : { txIndex },
-		...nonceKey === void 0 ? {} : { nonceKey },
-		...state === "broadcast_accepted" ? { txHash } : {}
-	};
-}
-function parseNonceLeaseRow(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const record = parseNonceLeaseRecord(Reflect.get(value, "record"));
-	if (!record) return null;
-	if (Reflect.get(value, "lease_id") !== record.leaseId) return null;
-	if (Reflect.get(value, "lane_key") !== record.laneKey) return null;
-	if (Reflect.get(value, "wallet_id") !== nonceLeaseWalletId(record)) return null;
-	if ((Reflect.get(value, "near_account_id") || "") !== nonceLeaseNearAccountId(record)) return null;
-	if (Reflect.get(value, "state") !== record.state) return null;
-	if (Reflect.get(value, "expires_at_ms") !== Math.floor(Number(record.expiresAtMs))) return null;
-	return record;
-}
-function keyRangeUpperBound(value) {
-	return IDBKeyRange.upperBound(value);
-}
-async function deleteRowsByIndex(args) {
-	let cursor = await args.store.index(args.indexName).openCursor(args.key);
-	while (cursor) {
-		await cursor.delete();
-		cursor = await cursor.continue();
-	}
-}
-function scopedLastProfileStateAppStateKey(scope) {
-	const normalized = normalizeLastUserScope(scope);
-	return normalized ? `${LAST_PROFILE_STATE_APP_STATE_KEY}::${normalized}` : LAST_PROFILE_STATE_APP_STATE_KEY;
-}
-function chainAccountProjectionId(args) {
-	return `${args.chainIdKey}\0${args.accountAddress}`;
-}
-function walletSignerId(args) {
-	return [
-		args.chainIdKey,
-		args.accountAddress,
-		args.signerId
-	].join("\0");
-}
-function signerChainTargetKey(args) {
-	return [args.chainIdKey, args.accountAddress].join("\0");
-}
-function normalizeEcdsaChainTargetKey(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return "";
-	const kind = normalizeTrimmedString(Reflect.get(value, "kind") || "");
-	const chainId = Number(Reflect.get(value, "chainId"));
-	if (!Number.isSafeInteger(chainId) || chainId <= 0) return "";
-	if (kind === "evm") {
-		if (normalizeTrimmedString(Reflect.get(value, "namespace") || "") !== "eip155") return "";
-		return toIndexedDbChainTargetKey({
-			kind: "evm",
-			namespace: "eip155",
-			chainId,
-			networkSlug: normalizeTrimmedString(Reflect.get(value, "networkSlug") || "")
-		});
-	}
-	if (kind === "tempo") return toIndexedDbChainTargetKey({
-		kind: "tempo",
-		chainId,
-		networkSlug: normalizeTrimmedString(Reflect.get(value, "networkSlug") || "")
-	});
-	return "";
-}
-function walletSignerScalarMirrors(record) {
-	if (record.signerKind === SIGNER_KINDS.thresholdEcdsa) {
-		const metadata = record.metadata || {};
-		const keyHandle = normalizeTrimmedString(metadata.keyHandle || "");
-		const ecdsaThresholdKeyId = normalizeTrimmedString(metadata.ecdsaThresholdKeyId || "");
-		const thresholdOwnerAddress = normalizeIndexedDbAccountAddress(metadata.thresholdOwnerAddress || "");
-		const chainTargetKey = normalizeEcdsaChainTargetKey(metadata.chainTarget);
-		if (!keyHandle || !ecdsaThresholdKeyId || !thresholdOwnerAddress || !chainTargetKey) throw new Error("[SeamsWalletDB] threshold ECDSA signer requires keyHandle, ecdsaThresholdKeyId, thresholdOwnerAddress, and chainTarget");
-		return {
-			chainTargetKey,
-			keyHandle,
-			ecdsaThresholdKeyId,
-			thresholdOwnerAddress
-		};
-	}
-	const signerSlot = Number(record.signerSlot);
-	if (!Number.isSafeInteger(signerSlot) || signerSlot < 1) throw new Error("[SeamsWalletDB] Ed25519 signer requires a positive signerSlot");
-	const nearEd25519SigningKeyId = normalizeTrimmedString(record.metadata?.nearEd25519SigningKeyId || "");
-	if (!nearEd25519SigningKeyId) throw new Error("[SeamsWalletDB] Ed25519 signer requires nearEd25519SigningKeyId");
-	return {
-		chainTargetKey: signerChainTargetKey({
-			chainIdKey: record.chainIdKey,
-			accountAddress: record.accountAddress
-		}),
-		nearSignerSlot: signerSlot,
-		nearEd25519SigningKeyId
-	};
-}
-function shouldWriteNearAccountProjection(args) {
-	return args.accountModel === "near-native" || args.chainIdKey.startsWith("near:");
-}
-function makeConstraintError(code, message, details) {
-	return new SeamsWalletDBConstraintError(code, message, details);
-}
-function profileRow(input, existing) {
-	const profileId = normalizeTrimmedString(input.profileId || "");
-	if (!profileId) throw new Error("[SeamsWalletDB] profileId is required");
-	const now = Date.now();
-	const passkeyCredential = input.passkeyCredential?.rawId ? input.passkeyCredential : existing?.passkeyCredential;
-	const nearProvisioning = existing?.nearProvisioning?.status === "near_ready" && input.nearProvisioning?.status !== "near_ready" ? existing.nearProvisioning : input.nearProvisioning ?? existing?.nearProvisioning;
-	const record = {
-		profileId,
-		defaultSignerSlot: input.defaultSignerSlot ?? existing?.defaultSignerSlot ?? 1,
-		...passkeyCredential ? { passkeyCredential } : {},
-		preferences: input.preferences ?? existing?.preferences,
-		...nearProvisioning ? { nearProvisioning } : {},
-		createdAt: existing?.createdAt ?? now,
-		updatedAt: now
-	};
-	return {
-		wallet_id: profileId,
-		rp_id: DEFAULT_WALLET_RP_ID,
-		status: "active",
-		created_at: record.createdAt,
-		updated_at: record.updatedAt,
-		record
-	};
-}
-function profileRowFromRecord(record) {
-	return {
-		wallet_id: record.profileId,
-		rp_id: DEFAULT_WALLET_RP_ID,
-		status: "active",
-		created_at: record.createdAt,
-		updated_at: record.updatedAt,
-		record
-	};
-}
-function profilePasskeyCredentialsMatch(left, right) {
-	if (left === void 0 || right === void 0) return left === right;
-	return left.id === right.id && left.rawId === right.rawId;
-}
-function userPreferencesMatch(left, right) {
-	if (left === void 0 || right === void 0) return left === right;
-	return left.useRelayer === right.useRelayer && left.useNetwork === right.useNetwork && left.confirmationConfig.uiMode === right.confirmationConfig.uiMode && left.confirmationConfig.behavior === right.confirmationConfig.behavior && left.confirmationConfig.autoProceedDelay === right.confirmationConfig.autoProceedDelay;
-}
-function nearProvisioningStatesMatch(left, right) {
-	if (left === void 0 || right === void 0) return left === right;
-	if (left.status !== right.status || left.updatedAtMs !== right.updatedAtMs) return false;
-	switch (left.status) {
-		case "near_pending":
-		case "near_provisioning": return true;
-		case "near_ready": return right.status === "near_ready" && left.nearAccountId === right.nearAccountId;
-		case "near_failed_retryable": return right.status === "near_failed_retryable" && left.error === right.error && left.errorCode === right.errorCode;
-		default: return assertNever(left);
-	}
-}
-function profileRecordsMatch(left, right) {
-	return left.profileId === right.profileId && left.defaultSignerSlot === right.defaultSignerSlot && profilePasskeyCredentialsMatch(left.passkeyCredential, right.passkeyCredential) && userPreferencesMatch(left.preferences, right.preferences) && nearProvisioningStatesMatch(left.nearProvisioning, right.nearProvisioning) && left.createdAt === right.createdAt && left.updatedAt === right.updatedAt;
-}
-function profileRowsMatch(left, right) {
-	return left.wallet_id === right.wallet_id && left.rp_id === right.rp_id && left.status === right.status && left.created_at === right.created_at && left.updated_at === right.updated_at && profileRecordsMatch(left.record, right.record);
-}
-function profileAuthenticatorTransportsMatch(left, right) {
-	if (left === void 0 || right === void 0) return left === right;
-	if (left.length !== right.length) return false;
-	return left.every((value, index) => value === right[index]);
-}
-function profileAuthenticatorRecordsMatch(left, right) {
-	return left.profileId === right.profileId && left.signerSlot === right.signerSlot && left.credentialId === right.credentialId && canonicalBytesMatch(left.credentialPublicKey, right.credentialPublicKey) && profileAuthenticatorTransportsMatch(left.transports, right.transports) && left.name === right.name && left.registered === right.registered && left.syncedAt === right.syncedAt;
-}
-function localWalletAuthMethodRecordsMatch(left, right) {
-	if (left.version !== right.version || left.kind !== right.kind || left.status !== right.status || left.localStatus !== right.localStatus || left.walletId !== right.walletId || left.createdAtMs !== right.createdAtMs || left.updatedAtMs !== right.updatedAtMs) return false;
-	switch (left.kind) {
-		case "passkey": return right.kind === "passkey" && left.rpId === right.rpId && left.credentialIdB64u === right.credentialIdB64u && left.credentialPublicKeyB64u === right.credentialPublicKeyB64u && left.counter === right.counter;
-		case "email_otp": return right.kind === "email_otp" && left.emailHashHex === right.emailHashHex && left.registrationAuthorityId === right.registrationAuthorityId && walletAuthAuthoritiesMatch(left.authority, right.authority);
-		default: return assertNever(left);
-	}
-}
-function localWalletAuthMethodRowsMatch(left, right) {
-	if (left.wallet_auth_method_id !== right.wallet_auth_method_id || left.wallet_id !== right.wallet_id || left.kind !== right.kind || left.auth_method !== right.auth_method || left.rp_id !== right.rp_id || left.auth_identifier_key !== right.auth_identifier_key || left.status !== right.status || left.updated_at !== right.updated_at || !localWalletAuthMethodRecordsMatch(left.record, right.record)) return false;
-	switch (left.kind) {
-		case "passkey": return right.kind === "passkey" && left.credential_id_b64u === right.credential_id_b64u && left.credential_public_key_b64u === right.credential_public_key_b64u && left.signer_slot === right.signer_slot && profileAuthenticatorRecordsMatch(left.authenticator, right.authenticator);
-		case "email_otp": return right.kind === "email_otp" && left.email_hash_hex === right.email_hash_hex && left.challenge_id === right.challenge_id;
-		default: return assertNever(left);
-	}
-}
-function accountSignerRollbackMetadataBaseline(metadata) {
-	if (metadata === void 0) return { kind: "account_signer_rollback_metadata_absent_v1" };
-	return {
-		kind: "account_signer_rollback_metadata_json_v1",
-		json: JSON.stringify(metadata)
-	};
-}
-function accountSignerRollbackMetadataMatchesBaseline(metadata, baseline) {
-	switch (baseline.kind) {
-		case "account_signer_rollback_metadata_absent_v1": return metadata === void 0;
-		case "account_signer_rollback_metadata_json_v1": return metadata !== void 0 && JSON.stringify(metadata) === baseline.json;
-		default: return assertNever(baseline);
-	}
-}
-function keyMaterialRollbackPayloadBaseline(payload) {
-	if (payload === void 0) return { kind: "key_material_rollback_payload_absent_v1" };
-	return {
-		kind: "key_material_rollback_payload_json_v1",
-		json: JSON.stringify(payload)
-	};
-}
-function keyMaterialRollbackPayloadMatchesBaseline(payload, baseline) {
-	switch (baseline.kind) {
-		case "key_material_rollback_payload_absent_v1": return payload === void 0;
-		case "key_material_rollback_payload_json_v1": return payload !== void 0 && JSON.stringify(payload) === baseline.json;
-		default: return assertNever(baseline);
-	}
-}
-function accountSignerRollbackRecordsMatch(current, committed, metadataBaseline) {
-	return current.profileId === committed.profileId && current.chainIdKey === committed.chainIdKey && current.accountAddress === committed.accountAddress && current.signerId === committed.signerId && current.signerSlot === committed.signerSlot && current.signerType === committed.signerType && current.signerKind === committed.signerKind && current.signerAuthMethod === committed.signerAuthMethod && current.signerSource === committed.signerSource && current.status === committed.status && current.addedAt === committed.addedAt && current.updatedAt === committed.updatedAt && current.removedAt === committed.removedAt && current.revocationReason === committed.revocationReason && accountSignerRollbackMetadataMatchesBaseline(current.metadata, metadataBaseline);
-}
-function keyMaterialRollbackRecordsMatch(current, committed, payloadBaseline) {
-	return current.profileId === committed.profileId && current.signerSlot === committed.signerSlot && current.chainIdKey === committed.chainIdKey && current.accountAddress === committed.accountAddress && current.keyKind === committed.keyKind && current.algorithm === committed.algorithm && current.publicKey === committed.publicKey && current.signerId === committed.signerId && current.wrapKeySalt === committed.wrapKeySalt && keyMaterialRollbackPayloadMatchesBaseline(current.payload, payloadBaseline) && keyMaterialPayloadEnvelopesMatch(current.payloadEnvelope, committed.payloadEnvelope) && current.timestamp === committed.timestamp && current.schemaVersion === committed.schemaVersion;
-}
-function keyMaterialPayloadEnvelopesMatch(left, right) {
-	if (left === void 0 || right === void 0) return left === right;
-	return left.encVersion === right.encVersion && left.alg === right.alg && left.nonce === right.nonce && left.ciphertext === right.ciphertext && left.tag === right.tag && left.aad.profileId === right.aad.profileId && left.aad.signerSlot === right.aad.signerSlot && left.aad.chainIdKey === right.aad.chainIdKey && left.aad.accountAddress === right.aad.accountAddress && left.aad.keyKind === right.aad.keyKind && left.aad.schemaVersion === right.aad.schemaVersion && left.aad.signerId === right.aad.signerId;
-}
-function lastProfileStatesMatch(left, right) {
-	return left.profileId === right.profileId && left.activeSignerSlot === right.activeSignerSlot && left.scope === right.scope;
-}
-function parseStoredProfilePreferences(value) {
-	if (value === void 0) return void 0;
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const useRelayer = Reflect.get(value, "useRelayer");
-	const useNetwork = Reflect.get(value, "useNetwork");
-	const confirmationConfig = Reflect.get(value, "confirmationConfig");
-	if (typeof useRelayer !== "boolean" || useNetwork !== "testnet" && useNetwork !== "mainnet" || confirmationConfig === null || typeof confirmationConfig !== "object" || Array.isArray(confirmationConfig)) return null;
-	const uiMode = Reflect.get(confirmationConfig, "uiMode");
-	const behavior = Reflect.get(confirmationConfig, "behavior");
-	const autoProceedDelay = Reflect.get(confirmationConfig, "autoProceedDelay");
-	const parsedAutoProceedDelay = autoProceedDelay === void 0 ? void 0 : typeof autoProceedDelay === "number" && Number.isSafeInteger(autoProceedDelay) && autoProceedDelay >= 0 ? autoProceedDelay : null;
-	if (uiMode !== "none" && uiMode !== "modal" && uiMode !== "drawer" || behavior !== "requireClick" && behavior !== "skipClick" || parsedAutoProceedDelay === null) return null;
-	return {
-		useRelayer,
-		useNetwork,
-		confirmationConfig: {
-			uiMode,
-			behavior,
-			...parsedAutoProceedDelay === void 0 ? {} : { autoProceedDelay: parsedAutoProceedDelay }
-		}
-	};
-}
-function parseStoredProfileRecord(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const profileIdRaw = Reflect.get(value, "profileId");
-	const profileId = parseWalletId(profileIdRaw);
-	const defaultSignerSlot = Reflect.get(value, "defaultSignerSlot");
-	const createdAt = Reflect.get(value, "createdAt");
-	const updatedAt = Reflect.get(value, "updatedAt");
-	if (!profileId.ok || profileId.value !== profileIdRaw || !Number.isSafeInteger(defaultSignerSlot) || Number(defaultSignerSlot) < 1 || !Number.isSafeInteger(createdAt) || Number(createdAt) < 0 || !Number.isSafeInteger(updatedAt) || Number(updatedAt) < 0) return null;
-	const passkeyCredentialRaw = Reflect.get(value, "passkeyCredential");
-	let passkeyCredential;
-	if (passkeyCredentialRaw !== void 0) {
-		if (passkeyCredentialRaw === null || typeof passkeyCredentialRaw !== "object" || Array.isArray(passkeyCredentialRaw)) return null;
-		const id = Reflect.get(passkeyCredentialRaw, "id");
-		const rawId = Reflect.get(passkeyCredentialRaw, "rawId");
-		if (typeof id !== "string" || typeof rawId !== "string" || !id || !rawId || id.trim() !== id || rawId.trim() !== rawId) return null;
-		passkeyCredential = {
-			id,
-			rawId
-		};
-	}
-	const preferences = parseStoredProfilePreferences(Reflect.get(value, "preferences"));
-	if (preferences === null) return null;
-	const nearProvisioningRaw = Reflect.get(value, "nearProvisioning");
-	let nearProvisioning;
-	if (nearProvisioningRaw !== void 0) {
-		const parsedNearProvisioning = parseNearProvisioningState(nearProvisioningRaw);
-		if (parsedNearProvisioning === null) return null;
-		nearProvisioning = parsedNearProvisioning;
-	}
-	return {
-		profileId: profileId.value,
-		defaultSignerSlot: Number(defaultSignerSlot),
-		...passkeyCredential === void 0 ? {} : { passkeyCredential },
-		...preferences === void 0 ? {} : { preferences },
-		...nearProvisioning === void 0 ? {} : { nearProvisioning },
-		createdAt: Number(createdAt),
-		updatedAt: Number(updatedAt)
-	};
-}
-function parseProfileRow(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const record = parseStoredProfileRecord(Reflect.get(value, "record"));
-	if (!record) return null;
-	if (Reflect.get(value, "wallet_id") !== record.profileId) return null;
-	if (Reflect.get(value, "created_at") !== record.createdAt) return null;
-	if (Reflect.get(value, "updated_at") !== record.updatedAt) return null;
-	return record;
-}
-function parseLocalAuthorityPendingProfileProjectionV1(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value) || Reflect.get(value, "kind") !== "local_authority_pending_profile_projection_v1") return null;
-	const profile = parseProfileStorageRowV1(Reflect.get(value, "profile"));
-	const authenticatorRaw = Reflect.get(value, "authenticator");
-	const localAuthMethodRaw = Reflect.get(value, "localAuthMethod");
-	const authenticator = authenticatorRaw === null ? null : parseWalletAuthMethodStorageRow(authenticatorRaw);
-	const localAuthMethod = localAuthMethodRaw === null ? null : parseWalletAuthMethodStorageRow(localAuthMethodRaw);
-	if (!profile || authenticatorRaw !== null && (!authenticator || authenticator.kind !== "passkey" || authenticator.status !== "active") || localAuthMethodRaw !== null && (!localAuthMethod || localAuthMethod.kind !== "email_otp" || localAuthMethod.status !== "active")) return null;
-	const authorityId = Reflect.get(value, "authorityId");
-	const walletId = Reflect.get(value, "walletId");
-	const authMethodId = Reflect.get(value, "authMethodId");
-	if (typeof authorityId !== "string" || typeof walletId !== "string" || typeof authMethodId !== "string" || !authorityId || !walletId || !authMethodId || authorityId.trim() !== authorityId || walletId.trim() !== walletId || authMethodId.trim() !== authMethodId || profile.wallet_id !== walletId || authenticator !== null && authenticator.wallet_id !== walletId || localAuthMethod !== null && localAuthMethod.wallet_id !== walletId) return null;
-	return {
-		kind: "local_authority_pending_profile_projection_v1",
-		authorityId,
-		walletId,
-		authMethodId,
-		profile,
-		authenticator: authenticator?.kind === "passkey" ? authenticator : null,
-		localAuthMethod: localAuthMethod?.kind === "email_otp" ? localAuthMethod : null
-	};
-}
-function parseProfileStorageRowV1(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const status = Reflect.get(value, "status");
-	const rpId = Reflect.get(value, "rp_id");
-	if (status !== "active" || typeof rpId !== "string") return null;
-	const record = parseProfileRow(value);
-	if (!record || Reflect.get(value, "wallet_id") !== record.profileId) return null;
-	return {
-		wallet_id: record.profileId,
-		rp_id: rpId,
-		status: "active",
-		created_at: record.createdAt,
-		updated_at: record.updatedAt,
-		record
-	};
-}
-function walletAuthMethodIdentifier(record) {
-	switch (record.kind) {
-		case "passkey": return normalizeTrimmedString(record.credentialIdB64u || "");
-		case "email_otp": return normalizeTrimmedString(record.emailHashHex || "");
-		default: {
-			const _exhaustive = record;
-			throw new Error(`[SeamsWalletDB] Unsupported auth-method binding: ${String(_exhaustive)}`);
-		}
-	}
-}
-function walletAuthMethodId(record) {
-	if (record.kind === "passkey") return [
-		normalizeTrimmedString(record.walletId || ""),
-		record.kind,
-		normalizeTrimmedString(record.rpId || ""),
-		walletAuthMethodIdentifier(record)
-	].join("\0");
-	return [
-		normalizeTrimmedString(record.walletId || ""),
-		record.kind,
-		walletAuthMethodIdentifier(record)
-	].join("\0");
-}
-function walletAuthMethodFields(record) {
-	if (record.version !== "wallet_auth_method_v1") throw new Error("[SeamsWalletDB] auth-method binding version is invalid");
-	const walletId = normalizeTrimmedString(record.walletId || "");
-	const rpId = record.kind === "passkey" ? normalizeTrimmedString(record.rpId || "") : "";
-	const authIdentifierKey = walletAuthMethodIdentifier(record);
-	const createdAtMs = Math.floor(Number(record.createdAtMs));
-	const updatedAtMs = Math.floor(Number(record.updatedAtMs));
-	if (!walletId || !authIdentifierKey || record.kind === "passkey" && !rpId) throw new Error("[SeamsWalletDB] auth-method binding requires walletId and branch identity");
-	if (record.status !== "active" && record.status !== "revoked") throw new Error("[SeamsWalletDB] auth-method binding status is invalid");
-	if (record.localStatus !== "synced" && record.localStatus !== "pending") throw new Error("[SeamsWalletDB] auth-method binding localStatus is invalid");
-	if (!Number.isSafeInteger(createdAtMs)) throw new Error("[SeamsWalletDB] auth-method binding createdAtMs is invalid");
-	if (!Number.isSafeInteger(updatedAtMs)) throw new Error("[SeamsWalletDB] auth-method binding updatedAtMs is invalid");
-	if (record.kind === "passkey") {
-		if (record.emailHashHex != null) throw new Error("[SeamsWalletDB] passkey auth-method binding has Email OTP fields");
-		if (!normalizeTrimmedString(record.credentialPublicKeyB64u || "")) throw new Error("[SeamsWalletDB] passkey auth-method binding requires credential public key");
-		if (!Number.isSafeInteger(record.counter) || record.counter < 0) throw new Error("[SeamsWalletDB] passkey auth-method binding counter is invalid");
-	}
-	if (record.kind === "email_otp") {
-		if (record.credentialIdB64u != null || record.credentialPublicKeyB64u != null || record.counter != null || record.rpId != null) throw new Error("[SeamsWalletDB] Email OTP auth-method binding has passkey fields");
-		if (!normalizeTrimmedString(record.registrationAuthorityId || "")) throw new Error("[SeamsWalletDB] Email OTP auth-method binding requires registrationAuthorityId");
-		if (!record.authority) throw new Error("[SeamsWalletDB] Email OTP auth-method binding requires authority");
-		const authority = parseEmailOtpWalletAuthAuthority(record.authority);
-		if (!authority || authority.walletId !== record.walletId || authority.verifier.emailHashHex !== record.emailHashHex || !walletAuthAuthoritiesMatch(authority, record.authority)) throw new Error("[SeamsWalletDB] Email OTP auth-method authority binding is invalid");
-	}
-	return {
-		wallet_auth_method_id: walletAuthMethodId(record),
-		wallet_id: walletId,
-		kind: record.kind,
-		auth_method: record.kind,
-		rp_id: rpId,
-		auth_identifier_key: authIdentifierKey,
-		status: record.status,
-		updated_at: updatedAtMs,
-		record
-	};
-}
-function isoTimestampFromMs(ms) {
-	return new Date(ms).toISOString();
-}
-function timestampMsFromIso(value, fallbackMs) {
-	const parsed = Date.parse(value);
-	return Number.isSafeInteger(parsed) ? parsed : fallbackMs;
-}
-function normalizeAuthenticatorRecord(record) {
-	const profileId = normalizeTrimmedString(record.profileId || "");
-	const credentialId = normalizeTrimmedString(record.credentialId || "");
-	const signerSlot = Number(record.signerSlot);
-	if (!profileId || !credentialId) throw new Error("[SeamsWalletDB] profileId and credentialId are required for authenticators");
-	if (!Number.isSafeInteger(signerSlot) || signerSlot < 1) throw new Error("[SeamsWalletDB] authenticator signerSlot must be an integer >= 1");
-	const credentialPublicKey = record.credentialPublicKey;
-	if (!(credentialPublicKey instanceof Uint8Array) || credentialPublicKey.byteLength === 0) throw new Error("[SeamsWalletDB] authenticator credentialPublicKey must be a non-empty Uint8Array");
-	return {
-		profileId,
-		signerSlot,
-		credentialId,
-		credentialPublicKey,
-		...Array.isArray(record.transports) ? { transports: record.transports } : {},
-		...record.name ? { name: String(record.name) } : {},
-		registered: normalizeTrimmedString(record.registered || ""),
-		syncedAt: normalizeTrimmedString(record.syncedAt || "")
-	};
-}
-function passkeyAuthenticatorFromBinding(record, signerSlot) {
-	const normalizedSignerSlot = Number(signerSlot);
-	if (!Number.isSafeInteger(normalizedSignerSlot) || normalizedSignerSlot < 1) throw new Error("[SeamsWalletDB] passkey auth-method signerSlot must be an integer >= 1");
-	return normalizeAuthenticatorRecord({
-		profileId: record.walletId,
-		signerSlot: normalizedSignerSlot,
-		credentialId: record.credentialIdB64u,
-		credentialPublicKey: base64UrlDecode(record.credentialPublicKeyB64u),
-		registered: isoTimestampFromMs(record.createdAtMs),
-		syncedAt: isoTimestampFromMs(record.updatedAtMs)
-	});
-}
-function passkeyBindingFromAuthenticator(authenticator, existing) {
-	const normalized = normalizeAuthenticatorRecord(authenticator);
-	const credentialPublicKeyB64u = base64UrlEncode(normalized.credentialPublicKey);
-	if (existing) {
-		if (existing.walletId !== normalized.profileId) throw new Error("[SeamsWalletDB] passkey auth-method walletId does not match authenticator profileId");
-		if (existing.credentialIdB64u !== normalized.credentialId) throw new Error("[SeamsWalletDB] passkey auth-method credentialId does not match authenticator credentialId");
-		if (existing.credentialPublicKeyB64u !== credentialPublicKeyB64u) throw new Error("[SeamsWalletDB] passkey auth-method public key does not match authenticator public key");
-		return existing;
-	}
-	const nowMs = Date.now();
-	return {
-		version: "wallet_auth_method_v1",
-		kind: "passkey",
-		status: "active",
-		localStatus: "synced",
-		walletId: walletIdFromString(normalized.profileId),
-		rpId: requireWebAuthnRpId(DEFAULT_WALLET_RP_ID),
-		credentialIdB64u: normalized.credentialId,
-		credentialPublicKeyB64u,
-		counter: 0,
-		createdAtMs: timestampMsFromIso(normalized.registered, nowMs),
-		updatedAtMs: timestampMsFromIso(normalized.syncedAt, nowMs)
-	};
-}
-function passkeyAuthMethodRow(input) {
-	const base = walletAuthMethodFields(input.binding);
-	const authenticator = normalizeAuthenticatorRecord(input.authenticator);
-	const credentialPublicKeyB64u = base64UrlEncode(authenticator.credentialPublicKey);
-	if (base.kind !== "passkey") throw new Error("[SeamsWalletDB] passkey auth-method row requires a passkey binding");
-	if (authenticator.profileId !== base.wallet_id) throw new Error("[SeamsWalletDB] passkey auth-method authenticator profileId mismatch");
-	if (authenticator.credentialId !== input.binding.credentialIdB64u) throw new Error("[SeamsWalletDB] passkey auth-method authenticator credentialId mismatch");
-	if (credentialPublicKeyB64u !== input.binding.credentialPublicKeyB64u) throw new Error("[SeamsWalletDB] passkey auth-method authenticator public key mismatch");
-	return {
-		...base,
-		kind: "passkey",
-		auth_method: "passkey",
-		record: input.binding,
-		credential_id_b64u: input.binding.credentialIdB64u,
-		credential_public_key_b64u: input.binding.credentialPublicKeyB64u,
-		signer_slot: authenticator.signerSlot,
-		authenticator
-	};
-}
-function emailOtpAuthMethodRow(record) {
-	const base = walletAuthMethodFields(record);
-	if (base.kind !== "email_otp") throw new Error("[SeamsWalletDB] Email OTP auth-method row requires an Email OTP binding");
-	return {
-		...base,
-		kind: "email_otp",
-		auth_method: "email_otp",
-		record,
-		email_hash_hex: record.emailHashHex,
-		challenge_id: record.registrationAuthorityId
-	};
-}
-function walletAuthMethodRowFromBinding(record, signerSlot) {
-	switch (record.kind) {
-		case "passkey": return passkeyAuthMethodRow({
-			binding: record,
-			authenticator: passkeyAuthenticatorFromBinding(record, signerSlot)
-		});
-		case "email_otp": return emailOtpAuthMethodRow(record);
-		default: {
-			const _exhaustive = record;
-			throw new Error(`[SeamsWalletDB] Unsupported auth-method row: ${String(_exhaustive)}`);
-		}
-	}
-}
-function walletAuthMethodRowFromAuthenticator(record, existing) {
-	const authenticator = normalizeAuthenticatorRecord(record);
-	return passkeyAuthMethodRow({
-		binding: passkeyBindingFromAuthenticator(authenticator, existing?.record),
-		authenticator
-	});
-}
-function buildLocalAuthorityPendingProfileProjectionV1(input) {
-	if (input.profile.wallet_id !== input.walletId || input.authenticator !== null && input.authenticator.wallet_id !== input.walletId || input.localAuthMethod !== null && input.localAuthMethod.wallet_id !== input.walletId) throw new Error("local authority profile projection identity does not match installation");
-	if (input.authenticator?.wallet_auth_method_id === input.authMethodId || input.localAuthMethod?.wallet_auth_method_id === input.authMethodId) throw new Error("local authority profile projection collides with the V2 auth-method key");
-	return {
-		kind: "local_authority_pending_profile_projection_v1",
-		authorityId: input.authorityId,
-		walletId: input.walletId,
-		authMethodId: input.authMethodId,
-		profile: input.profile,
-		authenticator: input.authenticator,
-		localAuthMethod: input.localAuthMethod
-	};
-}
-function localAuthorityPendingProfileProjectionsMatchV1(left, right) {
-	return left.authorityId === right.authorityId && left.walletId === right.walletId && left.authMethodId === right.authMethodId && profileRowsMatch(left.profile, right.profile) && (left.authenticator === null ? right.authenticator === null : right.authenticator !== null && localWalletAuthMethodRowsMatch(left.authenticator, right.authenticator)) && (left.localAuthMethod === null ? right.localAuthMethod === null : right.localAuthMethod !== null && localWalletAuthMethodRowsMatch(left.localAuthMethod, right.localAuthMethod));
-}
-function localAuthorityPendingProfileProjectionMatchesInputV1(projection, input) {
-	return projection.authorityId === input.authority.authorityId && projection.walletId === input.authority.walletId && projection.authMethodId === input.authMethod.walletAuthMethodId && projection.profile.record.profileId === input.profile.profileId && projection.profile.record.defaultSignerSlot === (input.profile.defaultSignerSlot ?? 1) && (input.profile.passkeyCredential === void 0 || projection.profile.record.passkeyCredential?.id === input.profile.passkeyCredential.id && projection.profile.record.passkeyCredential.rawId === input.profile.passkeyCredential.rawId) && (input.profile.preferences === void 0 || userPreferencesMatch(projection.profile.record.preferences, input.profile.preferences)) && (input.authenticator === null ? projection.authenticator === null : projection.authenticator !== null && profileAuthenticatorRecordsMatch(projection.authenticator.authenticator, input.authenticator)) && (input.localAuthMethod === null ? projection.localAuthMethod === null : projection.localAuthMethod !== null && localWalletAuthMethodRecordsMatch(projection.localAuthMethod.record, input.localAuthMethod));
-}
-function parseStoredProfileAuthenticator(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const profileId = parseStoredNonEmptyString(Reflect.get(value, "profileId"));
-	const signerSlot = Reflect.get(value, "signerSlot");
-	const credentialId = parseStoredNonEmptyString(Reflect.get(value, "credentialId"));
-	const credentialPublicKey = Reflect.get(value, "credentialPublicKey");
-	const registered = parseStoredNonEmptyString(Reflect.get(value, "registered"));
-	const syncedAt = parseStoredNonEmptyString(Reflect.get(value, "syncedAt"));
-	if (!profileId || !Number.isSafeInteger(signerSlot) || signerSlot < 1 || !credentialId || !(credentialPublicKey instanceof Uint8Array) || credentialPublicKey.byteLength === 0 || !registered || !syncedAt) return null;
-	const transportsRaw = Reflect.get(value, "transports");
-	const nameRaw = Reflect.get(value, "name");
-	if (transportsRaw !== void 0 && (!Array.isArray(transportsRaw) || transportsRaw.some((transport) => typeof transport !== "string")) || nameRaw !== void 0 && typeof nameRaw !== "string") return null;
-	return {
-		profileId,
-		signerSlot: Number(signerSlot),
-		credentialId,
-		credentialPublicKey: new Uint8Array(credentialPublicKey),
-		...transportsRaw === void 0 ? {} : { transports: [...transportsRaw] },
-		...nameRaw === void 0 ? {} : { name: nameRaw },
-		registered,
-		syncedAt
-	};
-}
-function parseStoredLocalWalletAuthMethodRecord(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const version = Reflect.get(value, "version");
-	const kind = Reflect.get(value, "kind");
-	const status = Reflect.get(value, "status");
-	const localStatus = Reflect.get(value, "localStatus");
-	const walletIdRaw = Reflect.get(value, "walletId");
-	const walletId = parseWalletId(walletIdRaw);
-	const createdAtMs = Reflect.get(value, "createdAtMs");
-	const updatedAtMs = Reflect.get(value, "updatedAtMs");
-	if (version !== "wallet_auth_method_v1" || kind !== "passkey" && kind !== "email_otp" || status !== "active" && status !== "revoked" || localStatus !== "synced" && localStatus !== "pending" || !walletId.ok || walletId.value !== walletIdRaw || !Number.isSafeInteger(createdAtMs) || Number(createdAtMs) < 0 || !Number.isSafeInteger(updatedAtMs) || Number(updatedAtMs) < 0) return null;
-	if (kind === "passkey") {
-		const rpIdRaw = Reflect.get(value, "rpId");
-		const rpId = parseWebAuthnRpId(rpIdRaw);
-		const credentialIdRaw = Reflect.get(value, "credentialIdB64u");
-		const credentialIdB64u = parseWebAuthnCredentialIdB64u(credentialIdRaw);
-		const credentialPublicKeyB64u = Reflect.get(value, "credentialPublicKeyB64u");
-		const counter = Reflect.get(value, "counter");
-		if (!rpId.ok || rpId.value !== rpIdRaw || !credentialIdB64u.ok || credentialIdB64u.value !== credentialIdRaw || typeof credentialPublicKeyB64u !== "string" || !credentialPublicKeyB64u || !Number.isSafeInteger(counter) || Number(counter) < 0) return null;
-		return {
-			version: "wallet_auth_method_v1",
-			kind: "passkey",
-			status,
-			localStatus,
-			walletId: walletId.value,
-			rpId: rpId.value,
-			credentialIdB64u: credentialIdB64u.value,
-			credentialPublicKeyB64u,
-			counter: Number(counter),
-			createdAtMs: Number(createdAtMs),
-			updatedAtMs: Number(updatedAtMs)
-		};
-	}
-	const emailHashHex = parseStoredNonEmptyString(Reflect.get(value, "emailHashHex"));
-	const registrationAuthorityId = parseStoredNonEmptyString(Reflect.get(value, "registrationAuthorityId"));
-	const authority = parseEmailOtpWalletAuthAuthority(Reflect.get(value, "authority"));
-	if (!emailHashHex || !registrationAuthorityId || !authority || authority.walletId !== walletId.value || authority.verifier.emailHashHex !== emailHashHex) return null;
-	return {
-		version: "wallet_auth_method_v1",
-		kind: "email_otp",
-		status,
-		localStatus,
-		walletId: walletId.value,
-		emailHashHex,
-		registrationAuthorityId,
-		authority,
-		createdAtMs: Number(createdAtMs),
-		updatedAtMs: Number(updatedAtMs)
-	};
-}
-function parseWalletAuthMethodStorageRow(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const record = parseStoredLocalWalletAuthMethodRecord(Reflect.get(value, "record"));
-	if (!record) return null;
-	let normalized;
-	try {
-		if (record.kind === "passkey") {
-			const authenticator = parseStoredProfileAuthenticator(Reflect.get(value, "authenticator"));
-			if (!authenticator) return null;
-			normalized = passkeyAuthMethodRow({
-				binding: record,
-				authenticator
-			});
-		} else if (record.kind === "email_otp") normalized = emailOtpAuthMethodRow(record);
-		else return null;
-	} catch {
-		return null;
-	}
-	if (Reflect.get(value, "wallet_auth_method_id") !== normalized.wallet_auth_method_id) return null;
-	if (Reflect.get(value, "wallet_id") !== normalized.wallet_id) return null;
-	if (Reflect.get(value, "kind") !== normalized.kind) return null;
-	if (Reflect.get(value, "auth_method") !== normalized.auth_method) return null;
-	if (normalized.kind === "passkey" && Reflect.get(value, "rp_id") !== normalized.rp_id) return null;
-	if (Reflect.get(value, "auth_identifier_key") !== normalized.auth_identifier_key) return null;
-	if (Reflect.get(value, "status") !== normalized.status) return null;
-	if (Reflect.get(value, "updated_at") !== normalized.updated_at) return null;
-	if (normalized.kind === "passkey") {
-		if (Reflect.get(value, "credential_id_b64u") !== normalized.credential_id_b64u) return null;
-		if (Reflect.get(value, "credential_public_key_b64u") !== normalized.credential_public_key_b64u) return null;
-		if (Reflect.get(value, "signer_slot") !== normalized.signer_slot) return null;
-	} else {
-		if (Reflect.get(value, "email_hash_hex") !== normalized.email_hash_hex) return null;
-		if (Reflect.get(value, "challenge_id") !== normalized.challenge_id) return null;
-	}
-	return normalized;
-}
-function parseWalletAuthMethodRow(value) {
-	const row = parseWalletAuthMethodStorageRow(value);
-	if (!row) return null;
-	return row.record;
-}
-function parseAuthenticatorRow(value) {
-	const row = parseWalletAuthMethodStorageRow(value);
-	if (!row || row.kind !== "passkey" || row.status !== "active") return null;
-	return row.authenticator;
-}
-function hasExactKeys(record, keys) {
-	if (Object.keys(record).length !== keys.length) return false;
-	for (const key of keys) if (!Object.prototype.hasOwnProperty.call(record, key)) return false;
-	return true;
-}
-function requireBoundaryParsed(result, label) {
-	if (!result.ok) throw new Error(`${label}: ${result.error.message}`);
-	return result.value;
-}
-function parseNonEmptyBoundaryString(raw, label) {
-	if (typeof raw !== "string" || raw.length === 0 || raw.trim() !== raw) throw new Error(`${label} must be a non-empty canonical string`);
-	return raw;
-}
-function parseNonNegativeSafeInteger(raw, label) {
-	if (!Number.isSafeInteger(raw) || Number(raw) < 0) throw new Error(`${label} must be a non-negative safe integer`);
-	return Number(raw);
-}
-function rawValueIsPresent(value) {
-	return value !== void 0;
-}
-function parseWalletAuthorityStorageRow(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const parsed = parseWalletAuthorityV1(Reflect.get(value, "record"));
-	if (!parsed.ok) return null;
-	const record = parsed.value;
-	if (Reflect.get(value, "authority_id") !== record.authorityId || Reflect.get(value, "wallet_id") !== record.walletId || Reflect.get(value, "state") !== record.state || Reflect.get(value, "device_id") !== record.principal.deviceId || Reflect.get(value, "updated_at") !== record.updatedAtMs) return null;
-	return {
-		authority_id: record.authorityId,
-		wallet_id: record.walletId,
-		state: record.state,
-		device_id: record.principal.deviceId,
-		updated_at: record.updatedAtMs,
-		record
-	};
-}
-function walletAuthorityStorageRow(record) {
-	return {
-		authority_id: record.authorityId,
-		wallet_id: record.walletId,
-		state: record.state,
-		device_id: record.principal.deviceId,
-		updated_at: record.updatedAtMs,
-		record
-	};
-}
-function unavailableWalletAuthMethodPresentation(record) {
-	switch (record.kind) {
-		case "passkey": return {
-			version: "wallet_auth_method_local_presentation_v1",
-			kind: "passkey"
-		};
-		case "email_otp": return {
-			version: "wallet_auth_method_local_presentation_v1",
-			kind: "email_otp",
-			email: { kind: "unavailable" }
-		};
-		default: throw new Error("Wallet auth-method presentation kind is invalid");
-	}
-}
-function parseWalletAuthMethodLocalPresentationV1(value, record) {
-	if (value === void 0) return unavailableWalletAuthMethodPresentation(record);
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	if (Reflect.get(value, "version") !== "wallet_auth_method_local_presentation_v1" || Reflect.get(value, "kind") !== record.kind) return null;
-	switch (record.kind) {
-		case "passkey":
-			if (!hasExactKeys(value, ["version", "kind"])) return null;
-			return {
-				version: "wallet_auth_method_local_presentation_v1",
-				kind: "passkey"
-			};
-		case "email_otp": {
-			if (!hasExactKeys(value, [
-				"version",
-				"kind",
-				"email"
-			])) return null;
-			const email = Reflect.get(value, "email");
-			if (email === null || typeof email !== "object" || Array.isArray(email)) return null;
-			switch (Reflect.get(email, "kind")) {
-				case "unavailable":
-					if (!hasExactKeys(email, ["kind"])) return null;
-					return {
-						version: "wallet_auth_method_local_presentation_v1",
-						kind: "email_otp",
-						email: { kind: "unavailable" }
-					};
-				case "verified": {
-					if (!hasExactKeys(email, ["kind", "address"])) return null;
-					const address = parseVerifiedEmailAddress(Reflect.get(email, "address"));
-					if (!address.ok) return null;
-					return {
-						version: "wallet_auth_method_local_presentation_v1",
-						kind: "email_otp",
-						email: {
-							kind: "verified",
-							address: address.value
-						}
-					};
-				}
-				default: return null;
-			}
-		}
-		default: return null;
-	}
-}
-function parseWalletAuthMethodV2StorageRow(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const record = parseWalletAuthMethodRecordV2(Reflect.get(value, "record"));
-	if (!record) return null;
-	const presentation = parseWalletAuthMethodLocalPresentationV1(Reflect.get(value, "presentation"), record);
-	if (!presentation) return null;
-	if (Reflect.get(value, "wallet_auth_method_id") !== record.walletAuthMethodId || Reflect.get(value, "wallet_id") !== record.walletId || Reflect.get(value, "wallet_authority_id") !== record.walletAuthorityId || Reflect.get(value, "kind") !== record.kind || Reflect.get(value, "status") !== record.status || Reflect.get(value, "updated_at") !== record.updatedAtMs) return null;
-	return walletAuthMethodV2StorageRow(localWalletAuthMethodProjectionV2(record, presentation));
-}
-function walletAuthMethodV2StorageRow(projection) {
-	switch (projection.kind) {
-		case "passkey": return {
-			wallet_auth_method_id: projection.record.walletAuthMethodId,
-			wallet_id: projection.record.walletId,
-			wallet_authority_id: projection.record.walletAuthorityId,
-			kind: "passkey",
-			status: projection.record.status,
-			updated_at: projection.record.updatedAtMs,
-			presentation: projection.presentation,
-			record: projection.record
-		};
-		case "email_otp": return {
-			wallet_auth_method_id: projection.record.walletAuthMethodId,
-			wallet_id: projection.record.walletId,
-			wallet_authority_id: projection.record.walletAuthorityId,
-			kind: "email_otp",
-			status: projection.record.status,
-			updated_at: projection.record.updatedAtMs,
-			presentation: projection.presentation,
-			record: projection.record
-		};
-		default: throw new Error("Wallet auth-method projection kind is invalid");
-	}
-}
-function verifiedEmailPresentationFromLocalRecords(record, rows) {
-	const addresses = /* @__PURE__ */ new Set();
-	for (const row of rows) {
-		const local = parseWalletAuthMethodStorageRow(row)?.record;
-		if (!local || local.kind !== "email_otp" || local.emailHashHex !== record.emailHashHex || local.authority.bindingId !== record.walletAuthMethodId) continue;
-		const address = parseVerifiedEmailAddress(local.authority.factor.providerUserId);
-		if (address.ok) addresses.add(String(address.value));
-	}
-	if (addresses.size !== 1) return null;
-	const address = parseVerifiedEmailAddress([...addresses][0]);
-	if (!address.ok) return null;
-	return {
-		version: "wallet_auth_method_local_presentation_v1",
-		kind: "email_otp",
-		email: {
-			kind: "verified",
-			address: address.value
-		}
-	};
-}
-function walletAuthMethodLocalPresentation(record, rows, current) {
-	switch (record.kind) {
-		case "passkey": return unavailableWalletAuthMethodPresentation(record);
-		case "email_otp": return verifiedEmailPresentationFromLocalRecords(record, rows) ?? (current?.kind === "email_otp" && current.email.kind === "verified" ? current : unavailableWalletAuthMethodPresentation(record));
-		default: throw new Error("Wallet auth-method presentation kind is invalid");
-	}
-}
-function walletAuthMethodLocalPresentationsMatch(left, right) {
-	if (left.kind !== right.kind) return false;
-	if (left.kind === "passkey" && right.kind === "passkey") return true;
-	if (left.kind !== "email_otp" || right.kind !== "email_otp") return false;
-	if (left.email.kind !== right.email.kind) return false;
-	if (left.email.kind === "unavailable" && right.email.kind === "unavailable") return true;
-	return left.email.kind === "verified" && right.email.kind === "verified" && left.email.address === right.email.address;
-}
-function rawWalletAuthMethodRowHasPresentation(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Reflect.get(value, "presentation") !== void 0;
-}
-function localWalletAuthMethodProjectionV2(record, presentation) {
-	switch (record.kind) {
-		case "passkey":
-			if (presentation.kind !== "passkey") throw new Error("Passkey auth method has non-passkey local presentation");
-			return {
-				kind: "passkey",
-				record,
-				presentation
-			};
-		case "email_otp":
-			if (presentation.kind !== "email_otp") throw new Error("Email OTP auth method has non-email local presentation");
-			return {
-				kind: "email_otp",
-				record,
-				presentation
-			};
-		default: throw new Error("Wallet auth-method projection kind is invalid");
-	}
-}
-async function walletAuthMethodV2StorageRowForStore(store, record) {
-	const existing = parseWalletAuthMethodV2StorageRow(await store.get(record.walletAuthMethodId));
-	return walletAuthMethodV2StorageRow(localWalletAuthMethodProjectionV2(record, walletAuthMethodLocalPresentation(record, await store.index(SEAMS_WALLET_INDEXES.walletId).getAll(record.walletId), existing?.presentation ?? null)));
-}
-function parseWalletAuthoritySignerMaterialRecord(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error("signer material record must be an object");
-	const kind = Reflect.get(value, "kind");
-	const keyFamily = Reflect.get(value, "keyFamily");
-	if (kind === "wallet_authority_linked_signer_material_v1") return parseWalletAuthorityLinkedSignerMaterialRecordV1(value);
-	if (kind !== "wallet_authority_signer_material_v1") throw new Error("signer material record kind is invalid");
-	if (keyFamily !== "ed25519" && keyFamily !== "ecdsa_secp256k1") throw new Error("signer material keyFamily is invalid");
-	const commonKeys = [
-		"kind",
-		"authorityId",
-		"walletAuthMethodId",
-		"activationId",
-		"keyFamily",
-		"materialActivation",
-		"sealedMaterialB64u",
-		"sealedMaterialDigestB64u"
-	];
-	if (!hasExactKeys(value, keyFamily === "ecdsa_secp256k1" ? [...commonKeys, "ecdsaThresholdKeyId"] : commonKeys)) throw new Error("signer material record fields are invalid");
-	const authorityId = requireBoundaryParsed(parseWalletAuthorityId(Reflect.get(value, "authorityId")), "authorityId");
-	const walletAuthMethodId = requireBoundaryParsed(parseWalletAuthMethodId(Reflect.get(value, "walletAuthMethodId")), "walletAuthMethodId");
-	const materialActivation = requireBoundaryParsed(parseMpcMaterialActivationRef(Reflect.get(value, "materialActivation")), "materialActivation");
-	const activationId = parseNonEmptyBoundaryString(Reflect.get(value, "activationId"), "activationId");
-	const sealedMaterialB64u = parseNonEmptyBoundaryString(Reflect.get(value, "sealedMaterialB64u"), "sealedMaterialB64u");
-	const sealedMaterialDigestB64u = parseDigestB64u(Reflect.get(value, "sealedMaterialDigestB64u"));
-	if (materialActivation.activationId !== activationId) throw new Error("signer material activationId does not match materialActivation");
-	if (keyFamily === "ed25519") return {
-		kind: "wallet_authority_signer_material_v1",
-		authorityId,
-		walletAuthMethodId,
-		activationId: materialActivation.activationId,
-		keyFamily: "ed25519",
-		materialActivation,
-		sealedMaterialB64u,
-		sealedMaterialDigestB64u
-	};
-	return {
-		kind: "wallet_authority_signer_material_v1",
-		authorityId,
-		walletAuthMethodId,
-		activationId: materialActivation.activationId,
-		keyFamily: "ecdsa_secp256k1",
-		ecdsaThresholdKeyId: parseEcdsaThresholdKeyId(Reflect.get(value, "ecdsaThresholdKeyId")),
-		materialActivation,
-		sealedMaterialB64u,
-		sealedMaterialDigestB64u
-	};
-}
-function parseWalletAuthoritySignerMaterialStorageRow(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	try {
-		const record = parseWalletAuthoritySignerMaterialRecord(Reflect.get(value, "record"));
-		if (Reflect.get(value, "wallet_authority_id") !== record.authorityId || Reflect.get(value, "wallet_auth_method_id") !== record.walletAuthMethodId || Reflect.get(value, "activation_id") !== record.activationId || Reflect.get(value, "key_family") !== record.keyFamily || Reflect.get(value, "ecdsa_threshold_key_id") !== (record.keyFamily === "ecdsa_secp256k1" ? record.ecdsaThresholdKeyId : void 0) || Reflect.get(value, "sealed_material_b64u") !== record.sealedMaterialB64u || Reflect.get(value, "sealed_material_digest_b64u") !== record.sealedMaterialDigestB64u) return null;
-		return {
-			wallet_authority_id: record.authorityId,
-			wallet_auth_method_id: record.walletAuthMethodId,
-			activation_id: record.activationId,
-			key_family: record.keyFamily,
-			ecdsa_threshold_key_id: record.keyFamily === "ecdsa_secp256k1" ? record.ecdsaThresholdKeyId : void 0,
-			sealed_material_b64u: record.sealedMaterialB64u,
-			sealed_material_digest_b64u: record.sealedMaterialDigestB64u,
-			record
-		};
-	} catch {
-		return null;
-	}
-}
-function walletAuthoritySignerMaterialStorageRow(record) {
-	return {
-		wallet_authority_id: record.authorityId,
-		wallet_auth_method_id: record.walletAuthMethodId,
-		activation_id: record.activationId,
-		key_family: record.keyFamily,
-		ecdsa_threshold_key_id: record.keyFamily === "ecdsa_secp256k1" ? record.ecdsaThresholdKeyId : void 0,
-		sealed_material_b64u: record.sealedMaterialB64u,
-		sealed_material_digest_b64u: record.sealedMaterialDigestB64u,
-		record
-	};
-}
-function parseWalletAuthorityExportRootRecord(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error("export root record must be an object");
-	if (!hasExactKeys(value, [
-		"kind",
-		"authorityId",
-		"walletAuthMethodId",
-		"walletKeyId",
-		"envelope"
-	])) throw new Error("export root record fields are invalid");
-	if (Reflect.get(value, "kind") !== "wallet_authority_export_root_v1") throw new Error("export root record kind is invalid");
-	const walletKeyId = requireBoundaryParsed(parseWalletKeyId(Reflect.get(value, "walletKeyId")), "walletKeyId");
-	const envelope = parsePasskeyCustodyEnvelopeRecord(Reflect.get(value, "envelope"));
-	if (envelope.binding.kind !== "ed25519_yao_client_root_v1" || envelope.binding.walletKeyId !== walletKeyId) throw new Error("export root envelope does not match walletKeyId");
-	return {
-		kind: "wallet_authority_export_root_v1",
-		authorityId: requireBoundaryParsed(parseWalletAuthorityId(Reflect.get(value, "authorityId")), "authorityId"),
-		walletAuthMethodId: requireBoundaryParsed(parseWalletAuthMethodId(Reflect.get(value, "walletAuthMethodId")), "walletAuthMethodId"),
-		walletKeyId,
-		envelope
-	};
-}
-function parseWalletAuthorityExportRootStorageRow(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	try {
-		const record = parseWalletAuthorityExportRootRecord(Reflect.get(value, "record"));
-		if (Reflect.get(value, "wallet_authority_id") !== record.authorityId || Reflect.get(value, "wallet_auth_method_id") !== record.walletAuthMethodId || Reflect.get(value, "wallet_key_id") !== record.walletKeyId || Reflect.get(value, "sealed_root_b64u") !== record.envelope.sealedCustodySecretB64u || Reflect.get(value, "sealed_root_digest_b64u") !== record.envelope.ciphertextDigestB64u) return null;
-		return {
-			wallet_authority_id: record.authorityId,
-			wallet_auth_method_id: record.walletAuthMethodId,
-			wallet_key_id: record.walletKeyId,
-			sealed_root_b64u: record.envelope.sealedCustodySecretB64u,
-			sealed_root_digest_b64u: record.envelope.ciphertextDigestB64u,
-			record
-		};
-	} catch {
-		return null;
-	}
-}
-function walletAuthorityExportRootStorageRow(record) {
-	return {
-		wallet_authority_id: record.authorityId,
-		wallet_auth_method_id: record.walletAuthMethodId,
-		wallet_key_id: record.walletKeyId,
-		sealed_root_b64u: record.envelope.sealedCustodySecretB64u,
-		sealed_root_digest_b64u: record.envelope.ciphertextDigestB64u,
-		record
-	};
-}
-function parseLocalAuthorityInstallationReceiptStorageRow(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	try {
-		const record = parseLocalAuthorityInstallationReceiptV1(Reflect.get(value, "record"));
-		if (Reflect.get(value, "authority_id") !== record.authorityId || Reflect.get(value, "wallet_id") !== record.walletId || Reflect.get(value, "wallet_auth_method_id") !== record.authMethodId || Reflect.get(value, "device_id") !== record.deviceId || Reflect.get(value, "package_set_digest_b64u") !== record.packageSetDigestB64u || Reflect.get(value, "installed_at_ms") !== record.installedAtMs) return null;
-		return {
-			authority_id: record.authorityId,
-			wallet_id: record.walletId,
-			wallet_auth_method_id: record.authMethodId,
-			device_id: record.deviceId,
-			package_set_digest_b64u: record.packageSetDigestB64u,
-			installed_at_ms: record.installedAtMs,
-			record
-		};
-	} catch {
-		return null;
-	}
-}
-function localAuthorityInstallationReceiptStorageRow(record) {
-	return {
-		authority_id: record.authorityId,
-		wallet_id: record.walletId,
-		wallet_auth_method_id: record.authMethodId,
-		device_id: record.deviceId,
-		package_set_digest_b64u: record.packageSetDigestB64u,
-		installed_at_ms: record.installedAtMs,
-		record
-	};
-}
-function parseWalletSelectionRecord(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error("wallet selection record must be an object");
-	if (!hasExactKeys(value, [
-		"kind",
-		"walletId",
-		"walletAuthMethodId",
-		"lockGeneration",
-		"lockState",
-		"updatedAtMs"
-	])) throw new Error("wallet selection record fields are invalid");
-	if (Reflect.get(value, "kind") !== "wallet_selection_v1") throw new Error("wallet selection record kind is invalid");
-	const lockState = Reflect.get(value, "lockState");
-	if (lockState !== "locked" && lockState !== "unlocked") throw new Error("wallet selection lockState is invalid");
-	return {
-		kind: "wallet_selection_v1",
-		walletId: requireBoundaryParsed(parseWalletId(Reflect.get(value, "walletId")), "walletId"),
-		walletAuthMethodId: requireBoundaryParsed(parseWalletAuthMethodId(Reflect.get(value, "walletAuthMethodId")), "walletAuthMethodId"),
-		lockGeneration: parseNonNegativeSafeInteger(Reflect.get(value, "lockGeneration"), "lockGeneration"),
-		lockState,
-		updatedAtMs: parseNonNegativeSafeInteger(Reflect.get(value, "updatedAtMs"), "updatedAtMs")
-	};
-}
-function parseWalletSelectionStorageRow(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	try {
-		const record = parseWalletSelectionRecord(Reflect.get(value, "record"));
-		if (Reflect.get(value, "wallet_id") !== record.walletId || Reflect.get(value, "wallet_auth_method_id") !== record.walletAuthMethodId || Reflect.get(value, "lock_generation") !== record.lockGeneration || Reflect.get(value, "lock_state") !== record.lockState || Reflect.get(value, "updated_at_ms") !== record.updatedAtMs) return null;
-		return {
-			wallet_id: record.walletId,
-			wallet_auth_method_id: record.walletAuthMethodId,
-			lock_generation: record.lockGeneration,
-			lock_state: record.lockState,
-			updated_at_ms: record.updatedAtMs,
-			record
-		};
-	} catch {
-		return null;
-	}
-}
-function walletSelectionStorageRow(record) {
-	return {
-		wallet_id: record.walletId,
-		wallet_auth_method_id: record.walletAuthMethodId,
-		lock_generation: record.lockGeneration,
-		lock_state: record.lockState,
-		updated_at_ms: record.updatedAtMs,
-		record
-	};
-}
-function signerMaterialExpectations(value) {
-	if (value.keyFamilies.length === 1 && value.keyFamilies[0] === "ed25519") {
-		if (value.ed25519) return [{
-			keyFamily: "ed25519",
-			materialActivation: value.ed25519.materialActivation
-		}];
-	}
-	if (value.keyFamilies.length === 1 && value.keyFamilies[0] === "ecdsa_secp256k1") {
-		if (value.ecdsa) return [{
-			keyFamily: "ecdsa_secp256k1",
-			materialActivation: value.ecdsa.materialActivation
-		}];
-	}
-	if (value.keyFamilies.length === 2) {
-		if (value.ed25519 && value.ecdsa) return [{
-			keyFamily: "ed25519",
-			materialActivation: value.ed25519.materialActivation
-		}, {
-			keyFamily: "ecdsa_secp256k1",
-			materialActivation: value.ecdsa.materialActivation
-		}];
-	}
-	throw new Error("wallet signer activation families are invalid");
-}
-function ed25519WalletKeyId(value) {
-	if (value.keyFamilies.length === 1 && value.keyFamilies[0] === "ed25519") return value.ed25519 ? value.ed25519.signer.walletKeyId : null;
-	if (value.keyFamilies.length === 2) return value.ed25519 ? value.ed25519.signer.walletKeyId : null;
-	throw new Error("wallet signer activation families are invalid");
-}
-function hasEd25519SignerFamily(value) {
-	return value.keyFamilies.length === 2 || value.keyFamilies[0] === "ed25519";
-}
-function canonicalBytesMatch(left, right) {
-	if (left.byteLength !== right.byteLength) return false;
-	for (let index = 0; index < left.byteLength; index += 1) if (left[index] !== right[index]) return false;
-	return true;
-}
-function walletAuthorityLinkedMaterialTargetFactorsMatch(left, right) {
-	if (left.kind !== right.kind || left.walletAuthMethodId !== right.walletAuthMethodId || left.verificationDigestB64u !== right.verificationDigestB64u) return false;
-	switch (left.kind) {
-		case "passkey": return right.kind === "passkey" && left.rpId === right.rpId && left.credentialIdB64u === right.credentialIdB64u;
-		case "email_otp": return right.kind === "email_otp" && left.emailHashHex === right.emailHashHex && left.registrationAuthorityId === right.registrationAuthorityId;
-		default: return assertNever(left);
-	}
-}
-function walletAuthorityLinkedSignerMaterialRecordsMatch(left, right) {
-	if (right.kind !== left.kind || left.authorityId !== right.authorityId || left.walletAuthMethodId !== right.walletAuthMethodId || left.activationId !== right.activationId || !mpcMaterialActivationRefsEqual(left.materialActivation, right.materialActivation) || left.sealedMaterialB64u !== right.sealedMaterialB64u || left.sealedMaterialDigestB64u !== right.sealedMaterialDigestB64u || left.packageSetDigestB64u !== right.packageSetDigestB64u || !walletAuthorityLinkedMaterialTargetFactorsMatch(left.targetFactor, right.targetFactor)) return false;
-	switch (left.keyFamily) {
-		case "ed25519": return right.keyFamily === "ed25519";
-		case "ecdsa_secp256k1": return right.keyFamily === "ecdsa_secp256k1" && left.ecdsaThresholdKeyId === right.ecdsaThresholdKeyId;
-		default: return assertNever(left);
-	}
-}
-function walletCustodyEnvelopeLifecyclesMatch(left, right) {
-	if (left.state !== right.state) return false;
-	switch (left.state) {
-		case "active": return right.state === "active" && left.activatedAtMs === right.activatedAtMs;
-		case "retired": return right.state === "retired" && left.activatedAtMs === right.activatedAtMs && left.retiredAtMs === right.retiredAtMs;
-		case "revoked": return right.state === "revoked" && left.activatedAtMs === right.activatedAtMs && left.revokedAtMs === right.revokedAtMs;
-		default: return assertNever(left);
-	}
-}
-function walletCustodyEnvelopeFactorsMatch(left, right) {
-	if (left.kind !== right.kind) return false;
-	switch (left.kind) {
-		case "passkey": return right.kind === "passkey" && left.rpId === right.rpId && left.credentialIdB64u === right.credentialIdB64u && left.kekVersion === right.kekVersion;
-		case "email_otp": return right.kind === "email_otp" && left.enrollmentId === right.enrollmentId && left.enrollmentSealKeyVersion === right.enrollmentSealKeyVersion && left.kekVersion === right.kekVersion;
-		default: return assertNever(left);
-	}
-}
-function walletAuthorityExportRootEnvelopesMatch(left, right) {
-	if (left.kind !== right.kind || left.envelopeId !== right.envelopeId || left.walletId !== right.walletId || !sameWalletCustodyEnvelopeOwnership(left.ownership, right.ownership) || left.envelopeVersion !== right.envelopeVersion || left.envelopeRevision !== right.envelopeRevision || left.nonceB64u !== right.nonceB64u || left.sealedCustodySecretB64u !== right.sealedCustodySecretB64u || left.ciphertextDigestB64u !== right.ciphertextDigestB64u || left.aadHashB64u !== right.aadHashB64u || !walletCustodyEnvelopeLifecyclesMatch(left.lifecycle, right.lifecycle) || left.createdAtMs !== right.createdAtMs || left.updatedAtMs !== right.updatedAtMs) return false;
-	return left.binding.kind === "ed25519_yao_client_root_v1" && right.binding.kind === "ed25519_yao_client_root_v1" && left.binding.linkSessionId === right.binding.linkSessionId && left.binding.walletKeyId === right.binding.walletKeyId && left.binding.targetFactor.kind === right.binding.targetFactor.kind && left.binding.applicationBindingDigestB64u === right.binding.applicationBindingDigestB64u && left.binding.registeredPublicKeyB64u === right.binding.registeredPublicKeyB64u && left.binding.enrollmentId === right.binding.enrollmentId && left.binding.deviceId === right.binding.deviceId && left.binding.revocationEpoch === right.binding.revocationEpoch && walletCustodyEnvelopeFactorsMatch(left.factor, right.factor);
-}
-function walletSignerActivationSetsMatch(left, right) {
-	return canonicalBytesMatch(encodeWalletSignerActivationSetV1(left), encodeWalletSignerActivationSetV1(right));
-}
-function walletAuthorityPermissionsMatch(left, right) {
-	return sameDelegatedWalletAuthorityV1({
-		kind: "delegated_wallet_authority_v1",
-		permissions: left.permissions
-	}, {
-		kind: "delegated_wallet_authority_v1",
-		permissions: right.permissions
-	});
-}
-function walletAuthorityProvenancesMatch(left, right) {
-	if (left.kind !== right.kind) return false;
-	switch (left.kind) {
-		case "wallet_registration": return true;
-		case "device_link": return right.kind === "device_link" && left.enrollmentId === right.enrollmentId && left.sourceAuthorityId === right.sourceAuthorityId && left.linkSessionId === right.linkSessionId;
-		case "wallet_recovery": return right.kind === "wallet_recovery" && left.recoveryOperationId === right.recoveryOperationId && left.continuityAuthorityId === right.continuityAuthorityId;
-		default: return assertNever(left);
-	}
-}
-function walletAuthorityLifecycleFieldsMatch(left, right) {
-	if (left.state !== right.state) return false;
-	switch (left.state) {
-		case "pending_local_install": return right.state === "pending_local_install" && left.localInstallPackageSetDigestB64u === right.localInstallPackageSetDigestB64u;
-		case "active": return right.state === "active" && left.activatedAtMs === right.activatedAtMs;
-		case "revoked": return right.state === "revoked" && left.activatedAtMs === right.activatedAtMs && left.revokedAtMs === right.revokedAtMs;
-	}
-	return assertNever(left);
-}
-function walletAuthorityRecordsMatch(left, right) {
-	return left.kind === right.kind && left.authorityId === right.authorityId && left.walletId === right.walletId && left.principal.kind === right.principal.kind && left.principal.deviceId === right.principal.deviceId && walletAuthorityProvenancesMatch(left.provenance, right.provenance) && walletAuthorityPermissionsMatch(left, right) && walletAuthorityLifecycleFieldsMatch(left, right) && left.revocationEpoch === right.revocationEpoch && left.createdAtMs === right.createdAtMs && left.updatedAtMs === right.updatedAtMs && left.signerActivationSetDigestB64u === right.signerActivationSetDigestB64u && left.authorityDigestB64u === right.authorityDigestB64u && walletSignerActivationSetsMatch(left.signerActivations, right.signerActivations);
-}
-function walletAuthorityPendingMatchesActive(pending, active) {
-	return pending.kind === active.kind && pending.authorityId === active.authorityId && pending.walletId === active.walletId && pending.principal.kind === active.principal.kind && pending.principal.deviceId === active.principal.deviceId && walletAuthorityProvenancesMatch(pending.provenance, active.provenance) && walletAuthorityPermissionsMatch(pending, active) && walletSignerActivationSetsMatch(pending.signerActivations, active.signerActivations) && pending.signerActivationSetDigestB64u === active.signerActivationSetDigestB64u && pending.revocationEpoch === active.revocationEpoch && pending.createdAtMs === active.createdAtMs;
-}
-function walletAuthMethodRecordsMatch(left, right) {
-	if (left.version !== right.version || left.walletAuthMethodId !== right.walletAuthMethodId || left.walletId !== right.walletId || left.walletAuthorityId !== right.walletAuthorityId || left.createdAtMs !== right.createdAtMs || left.updatedAtMs !== right.updatedAtMs || left.kind !== right.kind || left.status !== right.status) return false;
-	switch (left.kind) {
-		case "passkey": return right.kind === "passkey" && left.rpId === right.rpId && left.credentialIdB64u === right.credentialIdB64u && left.credentialPublicKeyB64u === right.credentialPublicKeyB64u && left.counter === right.counter && (left.status === "pending_local_install" || left.activatedAtMs === right.activatedAtMs) && (left.status !== "revoked" || left.revokedAtMs === right.revokedAtMs);
-		case "email_otp": return right.kind === "email_otp" && left.emailHashHex === right.emailHashHex && left.registrationAuthorityId === right.registrationAuthorityId && (left.status === "pending_local_install" || left.activatedAtMs === right.activatedAtMs) && (left.status !== "revoked" || left.revokedAtMs === right.revokedAtMs);
-	}
-	return assertNever(left);
-}
-function walletAuthMethodPendingMatchesActive(pending, active) {
-	if (pending.version !== active.version || pending.walletAuthMethodId !== active.walletAuthMethodId || pending.walletId !== active.walletId || pending.walletAuthorityId !== active.walletAuthorityId || pending.kind !== active.kind || pending.createdAtMs !== active.createdAtMs) return false;
-	switch (pending.kind) {
-		case "passkey": return active.kind === "passkey" && pending.rpId === active.rpId && pending.credentialIdB64u === active.credentialIdB64u && pending.credentialPublicKeyB64u === active.credentialPublicKeyB64u && pending.counter === active.counter;
-		case "email_otp": return active.kind === "email_otp" && pending.emailHashHex === active.emailHashHex && pending.registrationAuthorityId === active.registrationAuthorityId;
-	}
-	return assertNever(pending);
-}
-function walletAuthoritySignerMaterialRecordsMatch(left, right) {
-	switch (left.kind) {
-		case "wallet_authority_signer_material_v1":
-			if (right.kind !== left.kind) return false;
-			if (left.authorityId !== right.authorityId || left.walletAuthMethodId !== right.walletAuthMethodId || left.activationId !== right.activationId || !mpcMaterialActivationRefsEqual(left.materialActivation, right.materialActivation) || left.sealedMaterialB64u !== right.sealedMaterialB64u || left.sealedMaterialDigestB64u !== right.sealedMaterialDigestB64u) return false;
-			switch (left.keyFamily) {
-				case "ed25519": return right.keyFamily === "ed25519";
-				case "ecdsa_secp256k1": return right.keyFamily === "ecdsa_secp256k1" && left.ecdsaThresholdKeyId === right.ecdsaThresholdKeyId;
-				default: return assertNever(left);
-			}
-		case "wallet_authority_linked_signer_material_v1": return right.kind === "wallet_authority_linked_signer_material_v1" && walletAuthorityLinkedSignerMaterialRecordsMatch(left, right);
-		default: return assertNever(left);
-	}
-}
-function walletAuthorityExportRootsMatch(left, right) {
-	return left.kind === right.kind && left.authorityId === right.authorityId && left.walletAuthMethodId === right.walletAuthMethodId && left.walletKeyId === right.walletKeyId && walletAuthorityExportRootEnvelopesMatch(left.envelope, right.envelope);
-}
-function localAuthorityInstallationReceiptsMatch(left, right) {
-	return left.kind === right.kind && left.authorityId === right.authorityId && left.walletId === right.walletId && left.authMethodId === right.authMethodId && left.deviceId === right.deviceId && left.packageSetDigestB64u === right.packageSetDigestB64u && walletSignerActivationSetsMatch(left.installedActivationRefs, right.installedActivationRefs) && left.installedRecordSetDigestB64u === right.installedRecordSetDigestB64u && left.targetFactorVerificationDigestB64u === right.targetFactorVerificationDigestB64u && left.installedAtMs === right.installedAtMs;
-}
-function walletSessionRecordsMatch(left, right) {
-	if (left.kind !== right.kind || left.walletId !== right.walletId || left.authorityId !== right.authorityId || left.authMethodId !== right.authMethodId || left.authorizationId !== right.authorizationId || left.quotaId !== right.quotaId || left.authorityDigestB64u !== right.authorityDigestB64u || left.authorityRevocationEpoch !== right.authorityRevocationEpoch || left.issuedAtMs !== right.issuedAtMs || left.expiresAtMs !== right.expiresAtMs || left.capabilitySubjects.length !== right.capabilitySubjects.length) return false;
-	for (let index = 0; index < left.capabilitySubjects.length; index += 1) {
-		const leftSubject = left.capabilitySubjects[index];
-		const rightSubject = right.capabilitySubjects[index];
-		if (leftSubject.kind !== rightSubject.kind) return false;
-		if (leftSubject.kind === "link_devices" || leftSubject.kind === "revoke_devices") {
-			if (rightSubject.kind !== leftSubject.kind) return false;
-			continue;
-		}
-		if (rightSubject.kind !== leftSubject.kind || leftSubject.keyFamily !== rightSubject.keyFamily || !mpcMaterialActivationRefsEqual(leftSubject.materialActivation, rightSubject.materialActivation)) return false;
-	}
-	return true;
-}
-function localAuthorityInstallationError(error) {
-	return error instanceof Error ? error.message : "local authority installation input is invalid";
-}
-function parseLocalEmailOtpAuthMethodForInstallation(input) {
-	const row = emailOtpAuthMethodRow(input.localAuthMethod);
-	if (row.status !== "active" || row.record.localStatus !== "synced") throw new Error("local Email OTP auth method must be active and synced");
-	if (row.record.walletId !== input.authority.walletId || row.record.emailHashHex !== input.authMethod.emailHashHex || row.record.registrationAuthorityId !== input.authMethod.registrationAuthorityId || row.record.authority.walletId !== input.authority.walletId || row.record.authority.bindingId !== input.authMethod.walletAuthMethodId) throw new Error("local Email OTP auth method does not match authMethod");
-	return row.record;
-}
-function parseLocalAuthorityInstallationInput(input) {
-	try {
-		const authority = requireBoundaryParsed(parseWalletAuthorityV1(input.authority), "authority");
-		if (authority.state !== "pending_local_install") throw new Error("authority must be pending_local_install");
-		const authMethod = parseWalletAuthMethodRecordV2(input.authMethod);
-		if (!authMethod || authMethod.status !== "pending_local_install") throw new Error("authMethod must be a pending_local_install V2 record");
-		const profileId = normalizeTrimmedString(input.profile.profileId || "");
-		if (!profileId || profileId !== String(authority.walletId)) throw new Error("profile identity does not match authority");
-		const defaultSignerSlot = input.profile.defaultSignerSlot === void 0 ? 1 : parseNonNegativeSafeInteger(input.profile.defaultSignerSlot, "profile.defaultSignerSlot");
-		if (defaultSignerSlot < 1) throw new Error("profile.defaultSignerSlot must be a positive safe integer");
-		const profile = {
-			profileId,
-			defaultSignerSlot,
-			...input.profile.passkeyCredential ? { passkeyCredential: input.profile.passkeyCredential } : {},
-			...input.profile.preferences ? { preferences: input.profile.preferences } : {},
-			...input.profile.nearProvisioning ? { nearProvisioning: input.profile.nearProvisioning } : {}
-		};
-		const authenticator = input.authenticator === null ? null : normalizeAuthenticatorRecord(input.authenticator);
-		let localAuthMethod = null;
-		if (authMethod.kind === "passkey") {
-			if (input.localAuthMethod !== null) throw new Error("Passkey installation cannot include a local Email OTP auth method");
-			const passkeyCredential = profile.passkeyCredential;
-			if (!passkeyCredential || passkeyCredential.id !== authMethod.credentialIdB64u || passkeyCredential.rawId !== authMethod.credentialIdB64u) throw new Error("profile passkey credential does not match authMethod");
-			if (!authenticator || authenticator.profileId !== profileId || authenticator.signerSlot !== defaultSignerSlot || authenticator.credentialId !== authMethod.credentialIdB64u || base64UrlEncode(authenticator.credentialPublicKey) !== authMethod.credentialPublicKeyB64u) throw new Error("profile authenticator does not match authMethod");
-		} else {
-			if (authenticator !== null || profile.passkeyCredential !== void 0) throw new Error("Email OTP installation cannot include passkey profile records");
-			if (input.localAuthMethod === null) throw new Error("Email OTP installation requires a local auth method");
-			localAuthMethod = parseLocalEmailOtpAuthMethodForInstallation({
-				localAuthMethod: input.localAuthMethod,
-				authority,
-				authMethod
-			});
-		}
-		if (!Array.isArray(input.signerMaterials)) throw new Error("signerMaterials must be an array");
-		const signerMaterials = [];
-		for (const rawMaterial of input.signerMaterials) signerMaterials.push(parseWalletAuthoritySignerMaterialRecord(rawMaterial));
-		const exportRoot = input.exportRoot === null ? null : parseWalletAuthorityExportRootRecord(input.exportRoot);
-		const receipt = parseLocalAuthorityInstallationReceiptV1(input.receipt);
-		const expectedLockGeneration = parseNonNegativeSafeInteger(input.expectedLockGeneration, "expectedLockGeneration");
-		if (authMethod.walletId !== authority.walletId || authMethod.walletAuthorityId !== authority.authorityId || receipt.walletId !== authority.walletId || receipt.authorityId !== authority.authorityId || receipt.authMethodId !== authMethod.walletAuthMethodId || receipt.deviceId !== authority.principal.deviceId || receipt.packageSetDigestB64u !== authority.localInstallPackageSetDigestB64u) throw new Error("authority, authMethod, and receipt identities do not match");
-		if (!walletSignerActivationSetsMatch(receipt.installedActivationRefs, authority.signerActivations)) throw new Error("receipt signer activations do not match authority");
-		const expectations = signerMaterialExpectations(authority.signerActivations);
-		if (signerMaterials.length !== expectations.length) throw new Error("signer material records do not match authority signer families");
-		for (let index = 0; index < expectations.length; index += 1) {
-			const material = signerMaterials[index];
-			const expected = expectations[index];
-			if (material.authorityId !== authority.authorityId || material.walletAuthMethodId !== authMethod.walletAuthMethodId || material.keyFamily !== expected.keyFamily || !mpcMaterialActivationRefsEqual(material.materialActivation, expected.materialActivation)) throw new Error("signer material record does not match authority activation");
-		}
-		if ((hasEd25519SignerFamily(authority.signerActivations) && authority.permissions.includes("export_keys")) !== (exportRoot !== null)) throw new Error("Ed25519 export root presence does not match authority permissions");
-		if (exportRoot) {
-			const expectedWalletKeyId = ed25519WalletKeyId(authority.signerActivations);
-			if (expectedWalletKeyId === null || exportRoot.authorityId !== authority.authorityId || exportRoot.walletAuthMethodId !== authMethod.walletAuthMethodId || exportRoot.walletKeyId !== expectedWalletKeyId || exportRoot.envelope.walletId !== authority.walletId || exportRoot.envelope.binding.kind !== "ed25519_yao_client_root_v1" || exportRoot.envelope.binding.walletKeyId !== expectedWalletKeyId || exportRoot.envelope.binding.registeredPublicKeyB64u !== authority.signerActivations.ed25519?.signer.registeredPublicKeyB64u || authority.principal.kind !== "owner_device" || String(exportRoot.envelope.binding.deviceId) !== String(authority.principal.deviceId) || exportRoot.envelope.lifecycle.state !== "active" || !exportRootEnvelopeMatchesAuthMethod(authMethod, exportRoot.envelope)) throw new Error("export root does not match the Ed25519 authority activation");
-		}
-		return {
-			ok: true,
-			value: {
-				authority,
-				authMethod,
-				profile,
-				authenticator,
-				localAuthMethod,
-				signerMaterials,
-				exportRoot,
-				receipt,
-				expectedLockGeneration
-			}
-		};
-	} catch (error) {
-		return {
-			ok: false,
-			error: localAuthorityInstallationError(error)
-		};
-	}
-}
-function passkeyCredentialIndexKey(row) {
-	return [
-		"passkey",
-		row.rp_id,
-		row.credential_id_b64u
-	].join("\0");
-}
-function walletAuthMethodRowsForRegistrationFinalize(input) {
-	const authenticators = input.authenticators.map((authenticator) => normalizeAuthenticatorRecord(authenticator));
-	const rows = /* @__PURE__ */ new Map();
-	const credentialRows = /* @__PURE__ */ new Map();
-	if (input.initialAuthMethod.kind === "passkey") {
-		const matchingAuthenticator = authenticators.find((authenticator) => authenticator.profileId === input.initialAuthMethod.walletId && authenticator.credentialId === input.initialAuthMethod.credentialIdB64u);
-		if (!matchingAuthenticator) throw new Error("[SeamsWalletDB] passkey registration finalize requires matching authenticator material");
-		const row = passkeyAuthMethodRow({
-			binding: input.initialAuthMethod,
-			authenticator: matchingAuthenticator
-		});
-		rows.set(row.wallet_auth_method_id, row);
-		credentialRows.set(passkeyCredentialIndexKey(row), row);
-	} else {
-		const row = emailOtpAuthMethodRow(input.initialAuthMethod);
-		rows.set(row.wallet_auth_method_id, row);
-	}
-	for (const authenticator of authenticators) {
-		if (input.initialAuthMethod.kind === "passkey" && authenticator.profileId === input.initialAuthMethod.walletId && authenticator.credentialId === input.initialAuthMethod.credentialIdB64u) {
-			const row = passkeyAuthMethodRow({
-				binding: input.initialAuthMethod,
-				authenticator
-			});
-			rows.set(row.wallet_auth_method_id, row);
-			credentialRows.set(passkeyCredentialIndexKey(row), row);
-			continue;
-		}
-		const row = walletAuthMethodRowFromAuthenticator(authenticator);
-		const credentialKey = passkeyCredentialIndexKey(row);
-		const existingCredentialRow = credentialRows.get(credentialKey);
-		if (existingCredentialRow) {
-			if (existingCredentialRow.credential_public_key_b64u !== row.credential_public_key_b64u) throw new Error("[SeamsWalletDB] duplicate passkey credential has conflicting public key");
-			if (existingCredentialRow.wallet_auth_method_id === row.wallet_auth_method_id) {
-				rows.set(row.wallet_auth_method_id, row);
-				credentialRows.set(credentialKey, row);
-			}
-			continue;
-		}
-		rows.set(row.wallet_auth_method_id, row);
-		credentialRows.set(credentialKey, row);
-	}
-	return [...rows.values()];
-}
-function chainAccountProjectionRow(input, existing) {
-	const profileId = normalizeTrimmedString(input.profileId || "");
-	const chainIdKey = normalizeIndexedDbChainIdKey(input.chainIdKey);
-	const accountAddress = normalizeIndexedDbAccountAddress(input.accountAddress);
-	const accountModel = normalizeIndexedDbAccountModel(input.accountModel);
-	if (!profileId || !chainIdKey || !accountAddress) throw new Error("[SeamsWalletDB] profileId, chainIdKey, and accountAddress are required");
-	if (!accountModel) throw new Error("[SeamsWalletDB] accountModel is required");
-	const now = Date.now();
-	const record = {
-		profileId,
-		chainIdKey,
-		accountAddress,
-		accountModel,
-		isPrimary: input.isPrimary ?? existing?.isPrimary ?? false,
-		createdAt: existing?.createdAt ?? now,
-		updatedAt: now
-	};
-	return {
-		wallet_id: profileId,
-		near_account_id: chainAccountProjectionId({
-			chainIdKey,
-			accountAddress
-		}),
-		signer_slot: CHAIN_ACCOUNT_PROJECTION_SIGNER_SLOT,
-		profile_id: profileId,
-		chain_id_key: chainIdKey,
-		account_address: accountAddress,
-		account_model: accountModel,
-		is_primary: !!record.isPrimary,
-		updated_at: record.updatedAt,
-		record
-	};
-}
-function parseStoredChainAccountRecord(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const profileId = parseStoredNonEmptyString(Reflect.get(value, "profileId"));
-	const chainIdKey = normalizeIndexedDbChainIdKey(Reflect.get(value, "chainIdKey"));
-	const accountAddress = normalizeIndexedDbAccountAddress(Reflect.get(value, "accountAddress"));
-	const accountModel = normalizeIndexedDbAccountModel(Reflect.get(value, "accountModel"));
-	const createdAt = Reflect.get(value, "createdAt");
-	const updatedAt = Reflect.get(value, "updatedAt");
-	const isPrimary = Reflect.get(value, "isPrimary");
-	if (!profileId || !chainIdKey || !accountAddress || !accountModel || !Number.isSafeInteger(createdAt) || Number(createdAt) < 0 || !Number.isSafeInteger(updatedAt) || Number(updatedAt) < 0 || isPrimary !== void 0 && typeof isPrimary !== "boolean") return null;
-	return {
-		profileId,
-		chainIdKey,
-		accountAddress,
-		accountModel,
-		...isPrimary === void 0 ? {} : { isPrimary },
-		createdAt: Number(createdAt),
-		updatedAt: Number(updatedAt)
-	};
-}
-function parseChainAccountProjectionRow(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const record = parseStoredChainAccountRecord(Reflect.get(value, "record"));
-	if (!record) return null;
-	if (Reflect.get(value, "wallet_id") !== record.profileId) return null;
-	if (Reflect.get(value, "profile_id") !== record.profileId) return null;
-	if (Reflect.get(value, "chain_id_key") !== record.chainIdKey) return null;
-	if (Reflect.get(value, "account_address") !== record.accountAddress) return null;
-	if (Reflect.get(value, "account_model") !== record.accountModel) return null;
-	if (Reflect.get(value, "is_primary") !== !!record.isPrimary) return null;
-	if (Reflect.get(value, "updated_at") !== record.updatedAt) return null;
-	if (Reflect.get(value, "near_account_id") !== chainAccountProjectionId({
-		chainIdKey: record.chainIdKey,
-		accountAddress: record.accountAddress
-	})) return null;
-	return record;
-}
-function accountSignerRow(record) {
-	const profileId = normalizeTrimmedString(record.profileId || "");
-	const chainIdKey = normalizeIndexedDbChainIdKey(record.chainIdKey);
-	const accountAddress = normalizeIndexedDbAccountAddress(record.accountAddress);
-	const signerId = normalizeTrimmedString(record.signerId || "");
-	const signerKind = normalizeTrimmedString(record.signerKind || "");
-	if (!profileId || !chainIdKey || !accountAddress || !signerId || !signerKind) throw new Error("[SeamsWalletDB] signer requires profileId, chainIdKey, accountAddress, signerId, and signerKind");
-	const mirrors = walletSignerScalarMirrors({
-		...record,
-		profileId,
-		chainIdKey,
-		accountAddress,
-		signerId
-	});
-	const isActive = record.status === "active";
-	return {
-		wallet_signer_id: walletSignerId({
-			chainIdKey,
-			accountAddress,
-			signerId
-		}),
-		wallet_id: profileId,
-		kind: signerKind,
-		chain_target_key: mirrors.chainTargetKey,
-		...isActive && mirrors.nearSignerSlot != null ? { near_signer_slot: mirrors.nearSignerSlot } : {},
-		...isActive && mirrors.nearEd25519SigningKeyId ? { near_ed25519_signing_key_id: mirrors.nearEd25519SigningKeyId } : {},
-		...isActive && mirrors.keyHandle ? { key_handle: mirrors.keyHandle } : {},
-		...isActive && mirrors.ecdsaThresholdKeyId ? { ecdsa_threshold_key_id: mirrors.ecdsaThresholdKeyId } : {},
-		...isActive && mirrors.thresholdOwnerAddress ? { threshold_owner_address: mirrors.thresholdOwnerAddress } : {},
-		status: record.status,
-		updated_at: record.updatedAt,
-		record: {
-			...record,
-			profileId,
-			chainIdKey,
-			accountAddress,
-			signerId
-		}
-	};
-}
-function parseStoredAccountSignerRecord(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const profileId = parseStoredNonEmptyString(Reflect.get(value, "profileId"));
-	const chainIdKey = normalizeIndexedDbChainIdKey(Reflect.get(value, "chainIdKey"));
-	const accountAddress = normalizeIndexedDbAccountAddress(Reflect.get(value, "accountAddress"));
-	const signerId = parseStoredNonEmptyString(Reflect.get(value, "signerId"));
-	const signerSlot = Reflect.get(value, "signerSlot");
-	const signerType = parseStoredNonEmptyString(Reflect.get(value, "signerType"));
-	const signerKind = Reflect.get(value, "signerKind");
-	const signerAuthMethod = Reflect.get(value, "signerAuthMethod");
-	const signerSource = Reflect.get(value, "signerSource");
-	const status = Reflect.get(value, "status");
-	const addedAt = Reflect.get(value, "addedAt");
-	const updatedAt = Reflect.get(value, "updatedAt");
-	if (!profileId || !chainIdKey || !accountAddress || !signerId || !Number.isSafeInteger(signerSlot) || Number(signerSlot) < 1 || !signerType || signerKind !== SIGNER_KINDS.thresholdEd25519 && signerKind !== SIGNER_KINDS.thresholdEcdsa || signerAuthMethod !== "passkey" && signerAuthMethod !== "email_otp" || signerSource !== "passkey_registration" && signerSource !== "email_otp_registration" && signerSource !== "self_hosted_import" || status !== "active" && status !== "pending" && status !== "revoked" || !Number.isSafeInteger(addedAt) || Number(addedAt) < 0 || !Number.isSafeInteger(updatedAt) || Number(updatedAt) < 0) return null;
-	const metadataRaw = Reflect.get(value, "metadata");
-	let metadata;
-	if (metadataRaw !== void 0) {
-		if (metadataRaw === null || typeof metadataRaw !== "object" || Array.isArray(metadataRaw)) return null;
-		metadata = {};
-		for (const key of Object.keys(metadataRaw)) metadata[key] = Reflect.get(metadataRaw, key);
-	}
-	const removedAt = Reflect.get(value, "removedAt");
-	const revocationReason = Reflect.get(value, "revocationReason");
-	if (removedAt !== void 0 && (!Number.isSafeInteger(removedAt) || Number(removedAt) < 0) || revocationReason !== void 0 && typeof revocationReason !== "string") return null;
-	return {
-		profileId,
-		chainIdKey,
-		accountAddress,
-		signerId,
-		signerSlot: Number(signerSlot),
-		signerType,
-		signerKind,
-		signerAuthMethod,
-		signerSource,
-		status,
-		addedAt: Number(addedAt),
-		updatedAt: Number(updatedAt),
-		...removedAt === void 0 ? {} : { removedAt: Number(removedAt) },
-		...revocationReason === void 0 ? {} : { revocationReason },
-		...metadata === void 0 ? {} : { metadata }
-	};
-}
-function parseAccountSignerRow(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const record = parseStoredAccountSignerRecord(Reflect.get(value, "record"));
-	if (!record) return null;
-	if (Reflect.get(value, "wallet_signer_id") !== walletSignerId({
-		chainIdKey: record.chainIdKey,
-		accountAddress: record.accountAddress,
-		signerId: record.signerId
-	})) return null;
-	if (Reflect.get(value, "wallet_id") !== record.profileId) return null;
-	if (Reflect.get(value, "kind") !== record.signerKind) return null;
-	let mirrors;
-	try {
-		mirrors = walletSignerScalarMirrors(record);
-	} catch {
-		return null;
-	}
-	const requiresActiveMirrors = record.status === "active";
-	if (record.signerKind === SIGNER_KINDS.thresholdEd25519) {
-		const chainTargetKey = Reflect.get(value, "chain_target_key");
-		const nearSignerSlot = Reflect.get(value, "near_signer_slot");
-		const nearEd25519SigningKeyId = Reflect.get(value, "near_ed25519_signing_key_id");
-		if (chainTargetKey !== void 0 && chainTargetKey !== mirrors.chainTargetKey) return null;
-		if (requiresActiveMirrors && nearSignerSlot !== mirrors.nearSignerSlot) return null;
-		if (!requiresActiveMirrors && nearSignerSlot !== void 0 && nearSignerSlot !== mirrors.nearSignerSlot) return null;
-		if (requiresActiveMirrors && nearEd25519SigningKeyId !== mirrors.nearEd25519SigningKeyId) return null;
-		if (!requiresActiveMirrors && nearEd25519SigningKeyId !== void 0 && nearEd25519SigningKeyId !== mirrors.nearEd25519SigningKeyId) return null;
-	} else if (requiresActiveMirrors && Reflect.get(value, "chain_target_key") !== mirrors.chainTargetKey) return null;
-	else if (!requiresActiveMirrors && Reflect.get(value, "chain_target_key") !== void 0 && Reflect.get(value, "chain_target_key") !== mirrors.chainTargetKey) return null;
-	const keyHandle = Reflect.get(value, "key_handle");
-	const ecdsaThresholdKeyId = Reflect.get(value, "ecdsa_threshold_key_id");
-	const thresholdOwnerAddress = Reflect.get(value, "threshold_owner_address");
-	if (requiresActiveMirrors && keyHandle !== mirrors.keyHandle) return null;
-	if (!requiresActiveMirrors && keyHandle !== void 0 && keyHandle !== mirrors.keyHandle) return null;
-	if (requiresActiveMirrors && ecdsaThresholdKeyId !== mirrors.ecdsaThresholdKeyId) return null;
-	if (!requiresActiveMirrors && ecdsaThresholdKeyId !== void 0 && ecdsaThresholdKeyId !== mirrors.ecdsaThresholdKeyId) return null;
-	if (requiresActiveMirrors && thresholdOwnerAddress !== mirrors.thresholdOwnerAddress) return null;
-	if (!requiresActiveMirrors && thresholdOwnerAddress !== void 0 && thresholdOwnerAddress !== mirrors.thresholdOwnerAddress) return null;
-	if (Reflect.get(value, "status") !== record.status) return null;
-	if (Reflect.get(value, "updated_at") !== record.updatedAt) return null;
-	return record;
-}
-async function deleteConflictingThresholdEcdsaSignerRows(args) {
-	const row = args.nextRow;
-	if (row.kind !== SIGNER_KINDS.thresholdEcdsa || row.status === "revoked") return;
-	if (!row.key_handle || !row.ecdsa_threshold_key_id) return;
-	const walletRows = await args.store.index(SEAMS_WALLET_INDEXES.walletId).getAll(row.wallet_id);
-	const conflictingRowIds = /* @__PURE__ */ new Set();
-	for (const rawExisting of walletRows) {
-		if (rawExisting === null || typeof rawExisting !== "object" || Array.isArray(rawExisting)) continue;
-		if (!parseAccountSignerRow(rawExisting)) continue;
-		const existingRowId = normalizeTrimmedString(Reflect.get(rawExisting, "wallet_signer_id") || "");
-		if (!existingRowId || existingRowId === row.wallet_signer_id) continue;
-		if (Reflect.get(rawExisting, "kind") !== row.kind || Reflect.get(rawExisting, "chain_target_key") !== row.chain_target_key) continue;
-		if (Reflect.get(rawExisting, "key_handle") === row.key_handle || Reflect.get(rawExisting, "ecdsa_threshold_key_id") === row.ecdsa_threshold_key_id) conflictingRowIds.add(existingRowId);
-	}
-	for (const rowId of conflictingRowIds) await args.store.delete(rowId);
-}
-function signerOutboxRow(record) {
-	const opId = normalizeTrimmedString(record.opId || "");
-	const idempotencyKey = normalizeTrimmedString(record.idempotencyKey || "");
-	const chainIdKey = normalizeIndexedDbChainIdKey(record.chainIdKey);
-	const accountAddress = normalizeIndexedDbAccountAddress(record.accountAddress);
-	const signerId = normalizeTrimmedString(record.signerId || "");
-	if (!opId || !idempotencyKey || !chainIdKey || !accountAddress || !signerId) throw new Error("[SeamsWalletDB] signer op requires opId, idempotencyKey, chainIdKey, accountAddress, and signerId");
-	return {
-		op_id: opId,
-		idempotency_key: idempotencyKey,
-		status: record.status,
-		next_attempt_at: record.nextAttemptAt,
-		wallet_id: normalizeTrimmedString(String(record.payload?.profileId || "")),
-		chain_target_key: signerChainTargetKey({
-			chainIdKey,
-			accountAddress
-		}),
-		updated_at: record.updatedAt,
-		record: {
-			...record,
-			opId,
-			idempotencyKey,
-			chainIdKey,
-			accountAddress,
-			signerId
-		}
-	};
-}
-function parseStoredSignerOutboxRecord(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const opId = parseStoredNonEmptyString(Reflect.get(value, "opId"));
-	const idempotencyKey = parseStoredNonEmptyString(Reflect.get(value, "idempotencyKey"));
-	const opType = parseStoredNonEmptyString(Reflect.get(value, "opType"));
-	const chainIdKey = normalizeIndexedDbChainIdKey(Reflect.get(value, "chainIdKey"));
-	const accountAddress = normalizeIndexedDbAccountAddress(Reflect.get(value, "accountAddress"));
-	const signerId = parseStoredNonEmptyString(Reflect.get(value, "signerId"));
-	const status = Reflect.get(value, "status");
-	const attemptCount = Reflect.get(value, "attemptCount");
-	const nextAttemptAt = Reflect.get(value, "nextAttemptAt");
-	const createdAt = Reflect.get(value, "createdAt");
-	const updatedAt = Reflect.get(value, "updatedAt");
-	if (!opId || !idempotencyKey || !opType || !chainIdKey || !accountAddress || !signerId || status !== "queued" && status !== "submitted" && status !== "confirmed" && status !== "failed" && status !== "dead-letter" || !Number.isSafeInteger(attemptCount) || Number(attemptCount) < 0 || !Number.isSafeInteger(nextAttemptAt) || Number(nextAttemptAt) < 0 || !Number.isSafeInteger(createdAt) || Number(createdAt) < 0 || !Number.isSafeInteger(updatedAt) || Number(updatedAt) < 0) return null;
-	const payloadRaw = Reflect.get(value, "payload");
-	const payload = sanitizePayload(payloadRaw);
-	if (payloadRaw !== void 0 && (payloadRaw === null || typeof payloadRaw !== "object" || Array.isArray(payloadRaw))) return null;
-	const lastError = Reflect.get(value, "lastError");
-	const txHash = Reflect.get(value, "txHash");
-	if (lastError !== void 0 && typeof lastError !== "string" || txHash !== void 0 && typeof txHash !== "string") return null;
-	return {
-		opId,
-		idempotencyKey,
-		opType,
-		chainIdKey,
-		accountAddress,
-		signerId,
-		status,
-		attemptCount: Number(attemptCount),
-		nextAttemptAt: Number(nextAttemptAt),
-		createdAt: Number(createdAt),
-		updatedAt: Number(updatedAt),
-		...payload === void 0 ? {} : { payload },
-		...lastError === void 0 ? {} : { lastError },
-		...txHash === void 0 ? {} : { txHash }
-	};
-}
-function parseSignerOutboxRow(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const record = parseStoredSignerOutboxRecord(Reflect.get(value, "record"));
-	if (!record) return null;
-	if (Reflect.get(value, "op_id") !== record.opId) return null;
-	if (Reflect.get(value, "idempotency_key") !== record.idempotencyKey) return null;
-	if (Reflect.get(value, "status") !== record.status) return null;
-	if (Reflect.get(value, "next_attempt_at") !== record.nextAttemptAt) return null;
-	if (Reflect.get(value, "chain_target_key") !== signerChainTargetKey({
-		chainIdKey: record.chainIdKey,
-		accountAddress: record.accountAddress
-	})) return null;
-	const payloadProfileId = normalizeTrimmedString(String(record.payload && Reflect.get(record.payload, "profileId") ? Reflect.get(record.payload, "profileId") : ""));
-	if (Reflect.get(value, "wallet_id") !== payloadProfileId) return null;
-	if (Reflect.get(value, "updated_at") !== record.updatedAt) return null;
-	return record;
-}
-function keyMaterialId(args) {
-	return [args.walletSignerId, args.keyKind].join("\0");
-}
-function walletSignerIdForKeyMaterial(record) {
-	return walletSignerId({
-		chainIdKey: record.chainIdKey,
-		accountAddress: record.accountAddress,
-		signerId: record.signerId
-	});
-}
-function keyMaterialRow(data) {
-	const profileId = normalizeTrimmedString(data.profileId || "");
-	const signerId = normalizeTrimmedString(data.signerId || "");
-	const wrapKeySalt = normalizeTrimmedString(data.wrapKeySalt || "");
-	const chainIdKey = normalizeTrimmedString(data.chainIdKey || "").toLowerCase();
-	const accountAddress = normalizeIndexedDbAccountAddress(data.accountAddress);
-	const keyKind = normalizeTrimmedString(data.keyKind || "");
-	const algorithm = normalizeTrimmedString(data.algorithm || "");
-	const publicKey = normalizeTrimmedString(data.publicKey || "");
-	if (!profileId) throw new Error("[SeamsWalletDB] Missing profileId for key material record");
-	if (!Number.isSafeInteger(data.signerSlot) || data.signerSlot < 1) throw new Error("[SeamsWalletDB] Invalid signerSlot for key material record");
-	if (!chainIdKey) throw new Error("[SeamsWalletDB] Missing chainIdKey for key material record");
-	if (!accountAddress) throw new Error("[SeamsWalletDB] Missing accountAddress for key material record");
-	if (!signerId) throw new Error("[SeamsWalletDB] Missing signerId for key material record");
-	if (!keyKind) throw new Error("[SeamsWalletDB] Missing keyKind for key material record");
-	if (!algorithm) throw new Error("[SeamsWalletDB] Missing algorithm for key material record");
-	if (!publicKey) throw new Error("[SeamsWalletDB] Missing publicKey for key material record");
-	if (typeof data.timestamp !== "number") throw new Error("[SeamsWalletDB] Missing timestamp for key material record");
-	if (!Number.isSafeInteger(data.schemaVersion) || data.schemaVersion < 1) throw new Error("[SeamsWalletDB] Invalid schemaVersion for key material record");
-	const expectedAAD = buildEnvelopeAAD({
-		profileId,
-		signerSlot: data.signerSlot,
-		chainIdKey,
-		accountAddress,
-		keyKind,
-		schemaVersion: data.schemaVersion,
-		signerId
-	});
-	const payloadEnvelope = normalizePayloadEnvelope(data.payloadEnvelope, expectedAAD, `${profileId}/${data.signerSlot}/${chainIdKey}/${keyKind}`);
-	const payload = sanitizePayload(data.payload);
-	const record = {
-		profileId,
-		signerSlot: data.signerSlot,
-		chainIdKey,
-		accountAddress,
-		keyKind,
-		algorithm,
-		publicKey,
-		signerId,
-		...wrapKeySalt ? { wrapKeySalt } : {},
-		...payload ? { payload } : {},
-		...payloadEnvelope ? { payloadEnvelope } : {},
-		timestamp: data.timestamp,
-		schemaVersion: data.schemaVersion
-	};
-	const walletSignerId = walletSignerIdForKeyMaterial(record);
-	const chainTargetKey = signerChainTargetKey({
-		chainIdKey,
-		accountAddress
-	});
-	return {
-		key_material_id: keyMaterialId({
-			walletSignerId,
-			keyKind
-		}),
-		wallet_id: profileId,
-		wallet_signer_id: walletSignerId,
-		chain_target_key: chainTargetKey,
-		key_handle: signerId,
-		public_key: publicKey,
-		updated_at: data.timestamp,
-		record
-	};
-}
-function signerKeyMaterialPairKey(args) {
-	return [
-		normalizeTrimmedString(args.profileId || ""),
-		normalizeIndexedDbChainIdKey(args.chainIdKey),
-		normalizeIndexedDbAccountAddress(args.accountAddress),
-		normalizeTrimmedString(args.signerId || ""),
-		String(Number(args.signerSlot))
-	].join("\0");
-}
-function assertSignerKeyMaterialPairs(args) {
-	const signerKeys = new Set(args.signers.map((signer) => signerKeyMaterialPairKey({
-		profileId: signer.profileId,
-		chainIdKey: signer.chainIdKey,
-		accountAddress: signer.accountAddress,
-		signerId: signer.signerId,
-		signerSlot: signer.signerSlot
-	})));
-	const keyMaterialKeys = new Set(args.keyMaterials.filter((keyMaterial) => keyMaterial.keyKind === "threshold_share_v1").map((keyMaterial) => signerKeyMaterialPairKey({
-		profileId: keyMaterial.profileId,
-		chainIdKey: keyMaterial.chainIdKey,
-		accountAddress: keyMaterial.accountAddress,
-		signerId: keyMaterial.signerId,
-		signerSlot: keyMaterial.signerSlot
-	})));
-	const missingSigner = args.signers.find((signer) => signer.status === "active" && !keyMaterialKeys.has(signerKeyMaterialPairKey({
-		profileId: signer.profileId,
-		chainIdKey: signer.chainIdKey,
-		accountAddress: signer.accountAddress,
-		signerId: signer.signerId,
-		signerSlot: signer.signerSlot
-	})));
-	if (missingSigner) throw new Error(`[SeamsWalletDB] active signer ${missingSigner.signerId} requires matching threshold key material`);
-	const orphanedKeyMaterial = args.keyMaterials.find((keyMaterial) => keyMaterial.keyKind === "threshold_share_v1" && !signerKeys.has(signerKeyMaterialPairKey({
-		profileId: keyMaterial.profileId,
-		chainIdKey: keyMaterial.chainIdKey,
-		accountAddress: keyMaterial.accountAddress,
-		signerId: keyMaterial.signerId,
-		signerSlot: keyMaterial.signerSlot
-	})));
-	if (orphanedKeyMaterial) throw new Error(`[SeamsWalletDB] threshold key material for signer ${orphanedKeyMaterial.signerId} has no matching signer activation`);
-}
-function parseStoredKeyMaterialRecord(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const profileId = parseStoredNonEmptyString(Reflect.get(value, "profileId"));
-	const signerSlot = Reflect.get(value, "signerSlot");
-	const chainIdKey = normalizeIndexedDbChainIdKey(Reflect.get(value, "chainIdKey"));
-	const accountAddress = normalizeIndexedDbAccountAddress(Reflect.get(value, "accountAddress"));
-	const keyKind = parseStoredNonEmptyString(Reflect.get(value, "keyKind"));
-	const algorithm = parseStoredNonEmptyString(Reflect.get(value, "algorithm"));
-	const publicKey = parseStoredNonEmptyString(Reflect.get(value, "publicKey"));
-	const signerId = parseStoredNonEmptyString(Reflect.get(value, "signerId"));
-	const timestamp = Reflect.get(value, "timestamp");
-	const schemaVersion = Reflect.get(value, "schemaVersion");
-	if (!profileId || !Number.isSafeInteger(signerSlot) || Number(signerSlot) < 1 || !chainIdKey || !accountAddress || !keyKind || !algorithm || !publicKey || !signerId || typeof timestamp !== "number" || !Number.isSafeInteger(schemaVersion) || Number(schemaVersion) < 1) return null;
-	const wrapKeySaltRaw = Reflect.get(value, "wrapKeySalt");
-	if (wrapKeySaltRaw !== void 0 && typeof wrapKeySaltRaw !== "string") return null;
-	const payloadRaw = Reflect.get(value, "payload");
-	const payload = sanitizePayload(payloadRaw);
-	if (payloadRaw !== void 0 && (payloadRaw === null || typeof payloadRaw !== "object" || Array.isArray(payloadRaw))) return null;
-	const expectedAAD = buildEnvelopeAAD({
-		profileId,
-		signerSlot: Number(signerSlot),
-		chainIdKey,
-		accountAddress,
-		keyKind,
-		schemaVersion: Number(schemaVersion),
-		signerId
-	});
-	let payloadEnvelope;
-	try {
-		payloadEnvelope = normalizePayloadEnvelope(Reflect.get(value, "payloadEnvelope"), expectedAAD, `${profileId}/${signerSlot}/${chainIdKey}/${keyKind}`);
-	} catch {
-		return null;
-	}
-	return {
-		profileId,
-		signerSlot: Number(signerSlot),
-		chainIdKey,
-		accountAddress,
-		keyKind,
-		algorithm,
-		publicKey,
-		signerId,
-		...wrapKeySaltRaw === void 0 ? {} : { wrapKeySalt: wrapKeySaltRaw },
-		...payload === void 0 ? {} : { payload },
-		...payloadEnvelope === void 0 ? {} : { payloadEnvelope },
-		timestamp,
-		schemaVersion: Number(schemaVersion)
-	};
-}
-function parseKeyMaterialRow(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
-	const record = parseStoredKeyMaterialRecord(Reflect.get(value, "record"));
-	if (!record) return null;
-	if (Reflect.get(value, "key_material_id") !== keyMaterialId({
-		walletSignerId: walletSignerIdForKeyMaterial(record),
-		keyKind: record.keyKind
-	})) return null;
-	if (Reflect.get(value, "wallet_id") !== record.profileId) return null;
-	if (Reflect.get(value, "wallet_signer_id") !== walletSignerIdForKeyMaterial(record)) return null;
-	if (Reflect.get(value, "chain_target_key") !== signerChainTargetKey({
-		chainIdKey: record.chainIdKey,
-		accountAddress: record.accountAddress
-	})) return null;
-	if (Reflect.get(value, "key_handle") !== normalizeTrimmedString(record.signerId || "")) return null;
-	if (Reflect.get(value, "public_key") !== record.publicKey) return null;
-	if (Reflect.get(value, "updated_at") !== record.timestamp) return null;
-	return record;
-}
-function signerKeyMaterialPairKeyForSigner(signer) {
-	return signerKeyMaterialPairKey({
-		profileId: signer.profileId,
-		chainIdKey: signer.chainIdKey,
-		accountAddress: signer.accountAddress,
-		signerId: signer.signerId,
-		signerSlot: signer.signerSlot
-	});
-}
-function signerKeyMaterialPairKeyForMaterial(keyMaterial) {
-	return signerKeyMaterialPairKey({
-		profileId: keyMaterial.profileId,
-		chainIdKey: keyMaterial.chainIdKey,
-		accountAddress: keyMaterial.accountAddress,
-		signerId: keyMaterial.signerId,
-		signerSlot: keyMaterial.signerSlot
-	});
-}
-function collectSignerKeyMaterialProfileIds(args) {
-	const profileIds = /* @__PURE__ */ new Set();
-	for (const signer of args.signers) {
-		const profileId = normalizeTrimmedString(signer.profileId || "");
-		if (profileId) profileIds.add(profileId);
-	}
-	for (const keyMaterial of args.keyMaterials) {
-		const profileId = normalizeTrimmedString(keyMaterial.profileId || "");
-		if (profileId) profileIds.add(profileId);
-	}
-	return [...profileIds];
-}
-async function readActiveSignersForProfilesInTransaction(ctx, profileIds) {
-	const store = ctx.store(SEAMS_WALLET_STORES.walletSigners);
-	const signers = [];
-	for (const profileId of profileIds) {
-		const rows = await store.index(SEAMS_WALLET_INDEXES.walletId).getAll(profileId);
-		for (const row of rows) {
-			const parsed = parseAccountSignerRow(row);
-			if (parsed?.status === "active") signers.push(parsed);
-		}
-	}
-	return signers;
-}
-async function readThresholdKeyMaterialsForProfilesInTransaction(ctx, profileIds) {
-	const store = ctx.store(SEAMS_WALLET_STORES.keyMaterial);
-	const keyMaterials = [];
-	for (const profileId of profileIds) {
-		const rows = await store.index(SEAMS_WALLET_INDEXES.walletId).getAll(profileId);
-		for (const row of rows) {
-			const parsed = parseKeyMaterialRow(row);
-			if (parsed?.keyKind === "threshold_share_v1") keyMaterials.push(parsed);
-		}
-	}
-	return keyMaterials;
-}
-function mergeKeyMaterialsById(args) {
-	const merged = /* @__PURE__ */ new Map();
-	for (const keyMaterial of args.existing) merged.set(keyMaterialId({
-		walletSignerId: walletSignerIdForKeyMaterial(keyMaterial),
-		keyKind: keyMaterial.keyKind
-	}), keyMaterial);
-	for (const keyMaterial of args.incoming) merged.set(keyMaterialId({
-		walletSignerId: walletSignerIdForKeyMaterial(keyMaterial),
-		keyKind: keyMaterial.keyKind
-	}), keyMaterial);
-	return [...merged.values()];
-}
-async function assertSignerKeyMaterialPairsInTransaction(args) {
-	const profileIds = collectSignerKeyMaterialProfileIds({
-		signers: args.signers,
-		keyMaterials: args.keyMaterials
-	});
-	if (profileIds.length === 0) return;
-	const activeSigners = await readActiveSignersForProfilesInTransaction(args.ctx, profileIds);
-	const activeSignerKeys = new Set(activeSigners.map(signerKeyMaterialPairKeyForSigner));
-	assertSignerKeyMaterialPairs({
-		signers: activeSigners,
-		keyMaterials: mergeKeyMaterialsById({
-			existing: (await readThresholdKeyMaterialsForProfilesInTransaction(args.ctx, profileIds)).filter((keyMaterial) => activeSignerKeys.has(signerKeyMaterialPairKeyForMaterial(keyMaterial))),
-			incoming: args.keyMaterials
-		})
-	});
-}
-function isUsableKeyMaterialForRead(record) {
-	if (record.keyKind !== "threshold_share_v1" || record.algorithm !== "ed25519") return true;
-	const payload = record.payload || {};
-	return !!normalizeTrimmedString(payload.relayerKeyId || "") && !!normalizeTrimmedString(payload.keyVersion || "");
-}
-function selectKeyMaterialForRead(args) {
-	const activeSignerKeys = new Set(args.activeSigners.map(signerKeyMaterialPairKeyForSigner));
-	const usableActive = args.matches.filter((record) => activeSignerKeys.has(signerKeyMaterialPairKeyForMaterial(record))).find(isUsableKeyMaterialForRead);
-	if (usableActive) return usableActive;
-	const usable = args.matches.find(isUsableKeyMaterialForRead);
-	if (usable) return usable;
-	return [...args.matches].sort((a, b) => b.timestamp - a.timestamp)[0] || null;
-}
-var SeamsWalletRepositories = class {
-	constructor(manager) {
-		this.manager = manager;
-	}
-	async installLocalAuthority(input) {
-		const parsed = parseLocalAuthorityInstallationInput(input);
-		if (!parsed.ok) return {
-			kind: "integrity_error",
-			reason: parsed.error
-		};
-		if (!await walletAuthorityDigestsMatchV1(parsed.value.authority)) return {
-			kind: "integrity_error",
-			reason: "authority digest does not match canonical encoding"
-		};
-		return this.manager.runTransaction([
-			SEAMS_WALLET_STORES.appState,
-			SEAMS_WALLET_STORES.wallets,
-			SEAMS_WALLET_STORES.walletAuthMethods,
-			SEAMS_WALLET_STORES.walletAuthorities,
-			SEAMS_WALLET_STORES.walletAuthoritySignerMaterials,
-			SEAMS_WALLET_STORES.walletAuthorityExportRoots,
-			SEAMS_WALLET_STORES.walletAuthorityInstallationReceipts,
-			SEAMS_WALLET_STORES.walletSelections
-		], "readwrite", this.installLocalAuthorityInTransaction.bind(this, parsed.value));
-	}
-	async finalizeLocalAuthorityActivation(input) {
-		const authorityResult = parseWalletAuthorityV1(input.authority);
-		if (!authorityResult.ok || authorityResult.value.state !== "active") throw new Error("active WalletAuthorityV1 is invalid");
-		const authMethod = parseWalletAuthMethodRecordV2(input.authMethod);
-		if (!authMethod || authMethod.status !== "active") throw new Error("active WalletAuthMethodRecordV2 is invalid");
-		const walletSession = parseStoredExactWalletSessionAuthorizationRowV6(toStoredExactWalletSessionAuthorizationRowV6(input.walletSession, input.operationCredential))?.record ?? null;
-		if (!walletSession) throw new Error("active Wallet Session is invalid");
-		const expectedLockGeneration = parseNonNegativeSafeInteger(input.expectedLockGeneration, "expectedLockGeneration");
-		if (authMethod.walletId !== authorityResult.value.walletId || authMethod.walletAuthorityId !== authorityResult.value.authorityId || walletSession.walletId !== authorityResult.value.walletId || walletSession.authorityId !== authorityResult.value.authorityId || walletSession.authMethodId !== authMethod.walletAuthMethodId || walletSession.authorityDigestB64u !== authorityResult.value.authorityDigestB64u || walletSession.authorityRevocationEpoch !== authorityResult.value.revocationEpoch) throw new Error("active authority, auth method, and Wallet Session identities differ");
-		return await this.manager.runTransaction([
-			SEAMS_WALLET_STORES.appState,
-			SEAMS_WALLET_STORES.wallets,
-			SEAMS_WALLET_STORES.walletAuthorities,
-			SEAMS_WALLET_STORES.walletAuthMethods,
-			SEAMS_WALLET_STORES.walletAuthorityInstallationReceipts,
-			SEAMS_WALLET_STORES.walletSelections,
-			SEAMS_WALLET_STORES.walletSessionAuthorizations
-		], "readwrite", this.finalizeLocalAuthorityActivationInTransaction.bind(this, {
-			authority: authorityResult.value,
-			authMethod,
-			walletSession,
-			operationCredential: input.operationCredential,
-			expectedLockGeneration
-		}));
-	}
-	async publishLocalAuthorityActivation(input) {
-		const authorityResult = parseWalletAuthorityV1(input.authority);
-		if (!authorityResult.ok || authorityResult.value.state !== "active") throw new Error("active WalletAuthorityV1 is invalid");
-		const authMethod = parseWalletAuthMethodRecordV2(input.authMethod);
-		if (!authMethod || authMethod.status !== "active") throw new Error("active WalletAuthMethodRecordV2 is invalid");
-		const expectedLockGeneration = parseNonNegativeSafeInteger(input.expectedLockGeneration, "expectedLockGeneration");
-		if (authMethod.walletId !== authorityResult.value.walletId || authMethod.walletAuthorityId !== authorityResult.value.authorityId) throw new Error("active authority and auth method identities differ");
-		if (!await walletAuthorityDigestsMatchV1(authorityResult.value)) throw new Error("active WalletAuthorityV1 digest is invalid");
-		return await this.manager.runTransaction([
-			SEAMS_WALLET_STORES.appState,
-			SEAMS_WALLET_STORES.wallets,
-			SEAMS_WALLET_STORES.walletAuthorities,
-			SEAMS_WALLET_STORES.walletAuthMethods,
-			SEAMS_WALLET_STORES.walletAuthorityInstallationReceipts,
-			SEAMS_WALLET_STORES.walletSelections
-		], "readwrite", this.publishLocalAuthorityActivationInTransaction.bind(this, {
-			authority: authorityResult.value,
-			authMethod,
-			expectedLockGeneration
-		}));
-	}
-	async advanceWalletLockGeneration(input) {
-		const walletId = requireBoundaryParsed(parseWalletId(input.walletId), "walletId");
-		const lockedAtMs = parseNonNegativeSafeInteger(input.lockedAtMs, "lockedAtMs");
-		return this.manager.runTransaction([SEAMS_WALLET_STORES.walletSelections], "readwrite", this.advanceWalletLockGenerationInTransaction.bind(this, {
-			walletId,
-			lockedAtMs
-		}));
-	}
-	async markWalletSelectionUnlocked(input) {
-		const walletId = requireBoundaryParsed(parseWalletId(input.walletId), "walletId");
-		const walletAuthMethodId = requireBoundaryParsed(parseWalletAuthMethodId(input.walletAuthMethodId), "walletAuthMethodId");
-		const unlockedAtMs = parseNonNegativeSafeInteger(input.unlockedAtMs, "unlockedAtMs");
-		await this.manager.runTransaction([SEAMS_WALLET_STORES.walletSelections, SEAMS_WALLET_STORES.walletAuthMethods], "readwrite", this.markWalletSelectionUnlockedInTransaction.bind(this, {
-			walletId,
-			walletAuthMethodId,
-			unlockedAtMs
-		}));
-	}
-	async persistRecoveredWalletAuthority(input) {
-		const authority = requireBoundaryParsed(parseWalletAuthorityV1(input.authority), "authority");
-		const authMethod = parseWalletAuthMethodRecordV2(input.authMethod);
-		const recoveredAtMs = parseNonNegativeSafeInteger(input.recoveredAtMs, "recoveredAtMs");
-		if (authority.state !== "active" || !isActiveRecoveredWalletAuthorityV1(authority) || !authMethod || authMethod.status !== "active" || authMethod.walletId !== authority.walletId || authMethod.walletAuthorityId !== authority.authorityId) throw new Error("recovered Wallet Authority projection is invalid");
-		if (!await walletAuthorityDigestsMatchV1(authority)) throw new Error("recovered Wallet Authority digest is invalid");
-		await this.manager.runTransaction([
-			SEAMS_WALLET_STORES.walletAuthorities,
-			SEAMS_WALLET_STORES.walletSelections,
-			SEAMS_WALLET_STORES.walletAuthMethods
-		], "readwrite", this.persistRecoveredWalletAuthorityInTransaction.bind(this, {
-			authority,
-			authMethod,
-			recoveredAtMs
-		}));
-	}
-	async getLocalAuthorityInstallationReceipt(authorityId) {
-		const parsedAuthorityId = parseWalletAuthorityId(authorityId);
-		if (!parsedAuthorityId.ok) return null;
-		return parseLocalAuthorityInstallationReceiptStorageRow(await (await this.manager.getDB()).get(SEAMS_WALLET_STORES.walletAuthorityInstallationReceipts, parsedAuthorityId.value))?.record || null;
-	}
-	async finalizeLocalAuthorityActivationInTransaction(input, ctx) {
-		const appStateStore = ctx.store(SEAMS_WALLET_STORES.appState);
-		const authorityStore = ctx.store(SEAMS_WALLET_STORES.walletAuthorities);
-		const authMethodStore = ctx.store(SEAMS_WALLET_STORES.walletAuthMethods);
-		const receiptStore = ctx.store(SEAMS_WALLET_STORES.walletAuthorityInstallationReceipts);
-		const selectionStore = ctx.store(SEAMS_WALLET_STORES.walletSelections);
-		const sessionStore = ctx.store(SEAMS_WALLET_STORES.walletSessionAuthorizations);
-		const authorityRaw = await authorityStore.get(input.authority.authorityId);
-		const authMethodRaw = await authMethodStore.get(input.authMethod.walletAuthMethodId);
-		const receiptRaw = await receiptStore.get(input.authority.authorityId);
-		const sessionRaw = await sessionStore.get(input.operationCredential.walletSessionId);
-		const profileProjectionRaw = await appStateStore.get(localAuthorityPendingProfileProjectionAppStateKeyV1(input.authority.authorityId));
-		const profileProjection = profileProjectionRaw === void 0 ? null : parseLocalAuthorityPendingProfileProjectionV1(profileProjectionRaw.value);
-		if (profileProjectionRaw !== void 0 && !profileProjection) throw new Error("local authority profile projection is missing or corrupt");
-		const existingAuthority = authorityRaw === void 0 ? null : parseWalletAuthorityStorageRow(authorityRaw);
-		const existingAuthMethod = authMethodRaw === void 0 ? null : parseWalletAuthMethodV2StorageRow(authMethodRaw);
-		const receipt = receiptRaw === void 0 ? null : parseLocalAuthorityInstallationReceiptStorageRow(receiptRaw);
-		const existingSessionWithCredential = sessionRaw === void 0 ? null : parseStoredExactWalletSessionAuthorizationRowV6(sessionRaw);
-		const existingSession = existingSessionWithCredential?.record ?? null;
-		if (!receipt) throw new Error("local authority installation receipt is missing or corrupt");
-		if (receipt.record.authorityId !== input.authority.authorityId || receipt.record.walletId !== input.authority.walletId || receipt.record.authMethodId !== input.authMethod.walletAuthMethodId || !walletSignerActivationSetsMatch(receipt.record.installedActivationRefs, input.authority.signerActivations)) throw new Error("local authority installation receipt does not match active authority");
-		if (!existingAuthority || !existingAuthMethod) throw new Error("pending local authority records are missing");
-		if (existingAuthority.record.state === "active") {
-			if (!walletAuthorityRecordsMatch(existingAuthority.record, input.authority) || existingAuthMethod.record.status !== "active" || !walletAuthMethodRecordsMatch(existingAuthMethod.record, input.authMethod)) throw new Error("active local authority replay conflicts with supplied records");
-			if (profileProjection) await this.publishPendingLocalAuthorityProfileProjectionInTransaction(input.authority, input.authMethod, profileProjection, ctx);
-			if (!existingSession) {
-				const selectionRaw = await selectionStore.get(input.authority.walletId);
-				if (selectionRaw === void 0) throw new Error("wallet selection is missing");
-				const selection = parseWalletSelectionStorageRow(selectionRaw);
-				if (!selection || selection.wallet_id !== input.authority.walletId) throw new Error("wallet selection is corrupt");
-				if (selection.lock_generation !== input.expectedLockGeneration) return {
-					kind: "stale_lock_generation",
-					expectedLockGeneration: input.expectedLockGeneration,
-					actualLockGeneration: selection.lock_generation
-				};
-				if (selection.record.lockState === "locked") return {
-					kind: "wallet_locked",
-					lockGeneration: selection.lock_generation
-				};
-				await sessionStore.put(toStoredExactWalletSessionAuthorizationRowV6(input.walletSession, input.operationCredential));
-				await selectionStore.put(walletSelectionStorageRow({
-					kind: "wallet_selection_v1",
-					walletId: selection.record.walletId,
-					walletAuthMethodId: input.authMethod.walletAuthMethodId,
-					lockGeneration: selection.record.lockGeneration,
-					lockState: "unlocked",
-					updatedAtMs: input.walletSession.issuedAtMs
-				}));
-				return { kind: "finalized" };
-			}
-			if (existingSession.kind !== "active_wallet_session_v1" || !walletSessionRecordsMatch(existingSession, input.walletSession) || existingSessionWithCredential?.operationCredential.token !== input.operationCredential.token) throw new Error("active local authority replay conflicts with supplied Wallet Session");
-			await sessionStore.put(toStoredExactWalletSessionAuthorizationRowV6(input.walletSession, input.operationCredential));
-			return { kind: "finalized" };
-		}
-		if (existingAuthority.record.state !== "pending_local_install" || existingAuthMethod.record.status !== "pending_local_install" || !walletAuthorityPendingMatchesActive(existingAuthority.record, input.authority) || !walletAuthMethodPendingMatchesActive(existingAuthMethod.record, input.authMethod)) throw new Error("local authority records are not the expected pending installation");
-		if (existingSession && existingSession.kind !== "active_wallet_session_v1") throw new Error("Wallet Session authorization is not active");
-		if (existingSession?.kind === "active_wallet_session_v1" && (!walletSessionRecordsMatch(existingSession, input.walletSession) || existingSessionWithCredential?.operationCredential.token !== input.operationCredential.token)) throw new Error("Wallet Session authorization conflicts with finalization");
-		const selectionRaw = await selectionStore.get(input.authority.walletId);
-		if (selectionRaw === void 0) throw new Error("wallet selection is missing");
-		const selection = parseWalletSelectionStorageRow(selectionRaw);
-		if (!selection || selection.wallet_id !== input.authority.walletId) throw new Error("wallet selection is corrupt");
-		if (selection.lock_generation !== input.expectedLockGeneration) return {
-			kind: "stale_lock_generation",
-			expectedLockGeneration: input.expectedLockGeneration,
-			actualLockGeneration: selection.lock_generation
-		};
-		if (selection.record.lockState === "locked") return {
-			kind: "wallet_locked",
-			lockGeneration: selection.lock_generation
-		};
-		if (!profileProjection) throw new Error("local authority profile projection is missing or corrupt");
-		await this.publishPendingLocalAuthorityProfileProjectionInTransaction(input.authority, input.authMethod, profileProjection, ctx);
-		await authorityStore.put(walletAuthorityStorageRow(input.authority));
-		await authMethodStore.put(await walletAuthMethodV2StorageRowForStore(authMethodStore, input.authMethod));
-		await sessionStore.put(toStoredExactWalletSessionAuthorizationRowV6(input.walletSession, input.operationCredential));
-		await selectionStore.put(walletSelectionStorageRow({
-			kind: "wallet_selection_v1",
-			walletId: selection.record.walletId,
-			walletAuthMethodId: input.authMethod.walletAuthMethodId,
-			lockGeneration: selection.record.lockGeneration,
-			lockState: "unlocked",
-			updatedAtMs: input.walletSession.issuedAtMs
-		}));
-		return { kind: "finalized" };
-	}
-	async publishPendingLocalAuthorityProfileProjectionInTransaction(authority, authMethod, projection, ctx) {
-		if (projection.authorityId !== authority.authorityId || projection.walletId !== authority.walletId || projection.authMethodId !== authMethod.walletAuthMethodId) throw new Error("local authority profile projection identity does not match activation");
-		if (projection.authenticator?.wallet_auth_method_id === authMethod.walletAuthMethodId || projection.localAuthMethod?.wallet_auth_method_id === authMethod.walletAuthMethodId) throw new Error("local authority profile projection collides with the V2 auth-method key");
-		const profileStore = ctx.store(SEAMS_WALLET_STORES.wallets);
-		const authMethodStore = ctx.store(SEAMS_WALLET_STORES.walletAuthMethods);
-		const existingProfileRaw = await profileStore.get(projection.profile.wallet_id);
-		const existingProfile = existingProfileRaw === void 0 ? null : parseProfileStorageRowV1(existingProfileRaw);
-		if (existingProfileRaw !== void 0 && !existingProfile) throw new Error("stored wallet profile is corrupt during authority publication");
-		if (existingProfile && !profileRowsMatch(existingProfile, projection.profile)) throw new Error("stored wallet profile changed during authority publication");
-		await profileStore.put(projection.profile);
-		for (const row of [projection.authenticator, projection.localAuthMethod]) {
-			if (!row) continue;
-			const existingRaw = await authMethodStore.get(row.wallet_auth_method_id);
-			if (existingRaw !== void 0) {
-				const existing = parseWalletAuthMethodStorageRow(existingRaw);
-				if (!existing || !localWalletAuthMethodRowsMatch(existing, row)) throw new Error("stored local auth method changed during authority publication");
-			}
-			await authMethodStore.put(row);
-		}
-		await authMethodStore.put(await walletAuthMethodV2StorageRowForStore(authMethodStore, authMethod));
-		await ctx.store(SEAMS_WALLET_STORES.appState).delete(localAuthorityPendingProfileProjectionAppStateKeyV1(authority.authorityId));
-	}
-	async publishLocalAuthorityActivationInTransaction(input, ctx) {
-		const profileProjectionRaw = await ctx.store(SEAMS_WALLET_STORES.appState).get(localAuthorityPendingProfileProjectionAppStateKeyV1(input.authority.authorityId));
-		const profileProjection = profileProjectionRaw === void 0 ? null : parseLocalAuthorityPendingProfileProjectionV1(profileProjectionRaw.value);
-		if (profileProjectionRaw !== void 0 && !profileProjection) throw new Error("local authority profile projection is missing or corrupt");
-		const authorityRaw = await ctx.store(SEAMS_WALLET_STORES.walletAuthorities).get(input.authority.authorityId);
-		const authMethodRaw = await ctx.store(SEAMS_WALLET_STORES.walletAuthMethods).get(input.authMethod.walletAuthMethodId);
-		const receiptRaw = await ctx.store(SEAMS_WALLET_STORES.walletAuthorityInstallationReceipts).get(input.authority.authorityId);
-		const authority = authorityRaw === void 0 ? null : parseWalletAuthorityStorageRow(authorityRaw);
-		const authMethod = authMethodRaw === void 0 ? null : parseWalletAuthMethodV2StorageRow(authMethodRaw);
-		const receipt = receiptRaw === void 0 ? null : parseLocalAuthorityInstallationReceiptStorageRow(receiptRaw);
-		if (!authority || !authMethod || !receipt) throw new Error("local authority publication prerequisites are missing");
-		if (receipt.record.authorityId !== input.authority.authorityId || receipt.record.walletId !== input.authority.walletId || receipt.record.authMethodId !== input.authMethod.walletAuthMethodId || !walletSignerActivationSetsMatch(receipt.record.installedActivationRefs, input.authority.signerActivations)) throw new Error("local authority installation receipt does not match publication");
-		if (authority.record.state === "active") {
-			if (!walletAuthorityRecordsMatch(authority.record, input.authority) || authMethod.record.status !== "active" || !walletAuthMethodRecordsMatch(authMethod.record, input.authMethod)) throw new Error("active local authority publication conflicts with stored records");
-			if (profileProjection) await this.publishPendingLocalAuthorityProfileProjectionInTransaction(input.authority, input.authMethod, profileProjection, ctx);
-			return { kind: "published" };
-		}
-		if (authority.record.state !== "pending_local_install" || authMethod.record.status !== "pending_local_install" || !walletAuthorityPendingMatchesActive(authority.record, input.authority) || !walletAuthMethodPendingMatchesActive(authMethod.record, input.authMethod)) throw new Error("local authority records are not the expected pending installation");
-		const selectionRaw = await ctx.store(SEAMS_WALLET_STORES.walletSelections).get(input.authority.walletId);
-		if (selectionRaw === void 0) throw new Error("wallet selection is missing");
-		const selection = parseWalletSelectionStorageRow(selectionRaw);
-		if (!selection || selection.wallet_id !== input.authority.walletId) throw new Error("wallet selection is corrupt");
-		if (selection.lock_generation !== input.expectedLockGeneration) return {
-			kind: "stale_lock_generation",
-			expectedLockGeneration: input.expectedLockGeneration,
-			actualLockGeneration: selection.lock_generation
-		};
-		if (selection.record.lockState === "locked") return {
-			kind: "wallet_locked",
-			lockGeneration: selection.lock_generation
-		};
-		if (!profileProjection) throw new Error("local authority profile projection is missing or corrupt");
-		await this.publishPendingLocalAuthorityProfileProjectionInTransaction(input.authority, input.authMethod, profileProjection, ctx);
-		await ctx.store(SEAMS_WALLET_STORES.walletAuthorities).put(walletAuthorityStorageRow(input.authority));
-		return { kind: "published" };
-	}
-	async advanceWalletLockGenerationInTransaction(input, ctx) {
-		const selectionStore = ctx.store(SEAMS_WALLET_STORES.walletSelections);
-		const selectionRaw = await selectionStore.get(input.walletId);
-		if (selectionRaw === void 0) throw new Error("wallet selection is missing");
-		const selection = parseWalletSelectionStorageRow(selectionRaw);
-		if (!selection || selection.wallet_id !== input.walletId) throw new Error("wallet selection is corrupt");
-		if (selection.record.lockGeneration >= Number.MAX_SAFE_INTEGER) throw new Error("wallet lock generation cannot advance");
-		const lockGeneration = selection.record.lockGeneration + 1;
-		await selectionStore.put(walletSelectionStorageRow({
-			kind: "wallet_selection_v1",
-			walletId: selection.record.walletId,
-			walletAuthMethodId: selection.record.walletAuthMethodId,
-			lockGeneration,
-			lockState: "locked",
-			updatedAtMs: input.lockedAtMs
-		}));
-		return lockGeneration;
-	}
-	async assertSelectionMoveBetweenAuthorityMembers(input, ctx) {
-		const authMethodStore = ctx.store(SEAMS_WALLET_STORES.walletAuthMethods);
-		const fromRaw = await authMethodStore.get(input.fromWalletAuthMethodId);
-		const toRaw = await authMethodStore.get(input.toWalletAuthMethodId);
-		const from = fromRaw === void 0 ? null : parseWalletAuthMethodV2StorageRow(fromRaw);
-		const to = toRaw === void 0 ? null : parseWalletAuthMethodV2StorageRow(toRaw);
-		if (!from || !to || to.record.status !== "active" || to.record.walletId !== input.walletId || from.record.walletId !== input.walletId || from.record.walletAuthorityId !== to.record.walletAuthorityId) throw new Error("wallet selection is missing or corrupt");
-	}
-	async markWalletSelectionUnlockedInTransaction(input, ctx) {
-		const selectionStore = ctx.store(SEAMS_WALLET_STORES.walletSelections);
-		const selectionRaw = await selectionStore.get(input.walletId);
-		const selection = selectionRaw === void 0 ? null : parseWalletSelectionStorageRow(selectionRaw);
-		if (!selection || selection.wallet_id !== input.walletId) throw new Error("wallet selection is missing or corrupt");
-		if (selection.record.walletAuthMethodId !== input.walletAuthMethodId) await this.assertSelectionMoveBetweenAuthorityMembers({
-			walletId: input.walletId,
-			fromWalletAuthMethodId: selection.record.walletAuthMethodId,
-			toWalletAuthMethodId: input.walletAuthMethodId
-		}, ctx);
-		await selectionStore.put(walletSelectionStorageRow({
-			kind: "wallet_selection_v1",
-			walletId: selection.record.walletId,
-			walletAuthMethodId: input.walletAuthMethodId,
-			lockGeneration: selection.record.lockGeneration,
-			lockState: "unlocked",
-			updatedAtMs: input.unlockedAtMs
-		}));
-	}
-	async persistRecoveredWalletAuthorityInTransaction(input, ctx) {
-		const authorityStore = ctx.store(SEAMS_WALLET_STORES.walletAuthorities);
-		const existingAuthorityRaw = await authorityStore.get(input.authority.authorityId);
-		const existingAuthority = existingAuthorityRaw === void 0 ? null : parseWalletAuthorityStorageRow(existingAuthorityRaw)?.record;
-		if (existingAuthorityRaw !== void 0 && !existingAuthority) throw new Error("local Wallet Authority is corrupt");
-		if (existingAuthority && !walletAuthorityRecordsMatch(existingAuthority, input.authority)) throw new Error("recovered Wallet Authority conflicts with local authority");
-		await authorityStore.put(walletAuthorityStorageRow(input.authority));
-		const authMethodStore = ctx.store(SEAMS_WALLET_STORES.walletAuthMethods);
-		await authMethodStore.put(await walletAuthMethodV2StorageRowForStore(authMethodStore, input.authMethod));
-		const selectionStore = ctx.store(SEAMS_WALLET_STORES.walletSelections);
-		const selectionRaw = await selectionStore.get(input.authority.walletId);
-		const selection = selectionRaw === void 0 ? null : parseWalletSelectionStorageRow(selectionRaw);
-		if (selectionRaw !== void 0 && !selection) throw new Error("recovered wallet selection is corrupt");
-		await selectionStore.put(walletSelectionStorageRow({
-			kind: "wallet_selection_v1",
-			walletId: input.authority.walletId,
-			walletAuthMethodId: input.authMethod.walletAuthMethodId,
-			lockGeneration: selection?.record.lockGeneration ?? 0,
-			lockState: "locked",
-			updatedAtMs: input.recoveredAtMs
-		}));
-	}
-	async installLocalAuthorityInTransaction(input, ctx) {
-		const appStateStore = ctx.store(SEAMS_WALLET_STORES.appState);
-		const profileRaw = await ctx.store(SEAMS_WALLET_STORES.wallets).get(input.profile.profileId);
-		const existingProfile = profileRaw === void 0 ? null : parseProfileRow(profileRaw);
-		if (profileRaw !== void 0 && !existingProfile) return {
-			kind: "integrity_error",
-			reason: "wallet profile row is invalid"
-		};
-		const authenticatorStore = ctx.store(SEAMS_WALLET_STORES.walletAuthMethods);
-		const authenticatorLookupRow = input.authenticator ? walletAuthMethodRowFromAuthenticator(input.authenticator) : null;
-		const localAuthMethodRow = input.localAuthMethod ? walletAuthMethodRowFromBinding(input.localAuthMethod, input.profile.defaultSignerSlot ?? 1) : null;
-		const authenticatorRaw = authenticatorLookupRow ? await authenticatorStore.get(authenticatorLookupRow.wallet_auth_method_id) : void 0;
-		const existingAuthenticatorRow = authenticatorRaw === void 0 ? null : parseWalletAuthMethodStorageRow(authenticatorRaw);
-		const authenticatorRow = input.authenticator ? walletAuthMethodRowFromAuthenticator(input.authenticator, existingAuthenticatorRow?.kind === "passkey" ? existingAuthenticatorRow : void 0) : null;
-		const localAuthMethodRaw = localAuthMethodRow ? await authenticatorStore.get(localAuthMethodRow.wallet_auth_method_id) : void 0;
-		const existingLocalAuthMethodRow = localAuthMethodRaw === void 0 ? null : parseWalletAuthMethodStorageRow(localAuthMethodRaw);
-		const selectionStore = ctx.store(SEAMS_WALLET_STORES.walletSelections);
-		const selectionRaw = await selectionStore.get(input.authority.walletId);
-		const selection = selectionRaw === void 0 ? null : parseWalletSelectionStorageRow(selectionRaw);
-		if (selectionRaw !== void 0 && (!selection || selection.wallet_id !== input.authority.walletId)) return {
-			kind: "integrity_error",
-			reason: "wallet selection row is invalid"
-		};
-		if (selection && selection.lock_generation !== input.expectedLockGeneration) return {
-			kind: "stale_lock_generation",
-			expectedLockGeneration: input.expectedLockGeneration,
-			actualLockGeneration: selection.lock_generation
-		};
-		if (!selection && input.expectedLockGeneration !== 0) return {
-			kind: "integrity_error",
-			reason: "initial wallet selection requires lock generation zero"
-		};
-		const authorityStore = ctx.store(SEAMS_WALLET_STORES.walletAuthorities);
-		const authMethodStore = ctx.store(SEAMS_WALLET_STORES.walletAuthMethods);
-		const signerMaterialStore = ctx.store(SEAMS_WALLET_STORES.walletAuthoritySignerMaterials);
-		const exportRootStore = ctx.store(SEAMS_WALLET_STORES.walletAuthorityExportRoots);
-		const receiptStore = ctx.store(SEAMS_WALLET_STORES.walletAuthorityInstallationReceipts);
-		const profileProjectionKey = localAuthorityPendingProfileProjectionAppStateKeyV1(input.authority.authorityId);
-		const profileProjectionRaw = await appStateStore.get(profileProjectionKey);
-		const profileProjection = profileProjectionRaw === void 0 ? null : parseLocalAuthorityPendingProfileProjectionV1(profileProjectionRaw.value);
-		if (profileProjectionRaw !== void 0 && !profileProjection) return {
-			kind: "integrity_error",
-			reason: "local authority profile projection is missing or corrupt"
-		};
-		const profileProjectionRecord = profileProjection ?? buildLocalAuthorityPendingProfileProjectionV1({
-			authorityId: input.authority.authorityId,
-			walletId: input.authority.walletId,
-			authMethodId: input.authMethod.walletAuthMethodId,
-			profile: profileRow(input.profile, existingProfile || void 0),
-			authenticator: authenticatorRow,
-			localAuthMethod: localAuthMethodRow?.kind === "email_otp" ? localAuthMethodRow : null
-		});
-		const authorityRaw = await authorityStore.get(input.authority.authorityId);
-		const authMethodRaw = await authMethodStore.get(input.authMethod.walletAuthMethodId);
-		const signerMaterialRaws = [];
-		for (const material of input.signerMaterials) signerMaterialRaws.push(await signerMaterialStore.get([
-			material.authorityId,
-			material.walletAuthMethodId,
-			material.activationId
-		]));
-		const exportRootRaw = input.exportRoot ? await exportRootStore.get([
-			input.exportRoot.authorityId,
-			input.exportRoot.walletAuthMethodId,
-			input.exportRoot.walletKeyId
-		]) : void 0;
-		const receiptRaw = await receiptStore.get(input.receipt.authorityId);
-		const existingAuthority = authorityRaw === void 0 ? null : parseWalletAuthorityStorageRow(authorityRaw);
-		const existingAuthMethod = authMethodRaw === void 0 ? null : parseWalletAuthMethodV2StorageRow(authMethodRaw);
-		const existingSignerMaterials = [];
-		for (let index = 0; index < signerMaterialRaws.length; index += 1) {
-			const raw = signerMaterialRaws[index];
-			existingSignerMaterials.push(raw === void 0 ? null : parseWalletAuthoritySignerMaterialStorageRow(raw)?.record || null);
-		}
-		const existingExportRoot = exportRootRaw === void 0 ? null : parseWalletAuthorityExportRootStorageRow(exportRootRaw)?.record || null;
-		const existingReceipt = receiptRaw === void 0 ? null : parseLocalAuthorityInstallationReceiptStorageRow(receiptRaw)?.record || null;
-		if (profileProjection && !localAuthorityPendingProfileProjectionMatchesInputV1(profileProjection, input)) return {
-			kind: "integrity_error",
-			reason: "local authority profile projection conflicts with replay"
-		};
-		const installationStateExists = authorityRaw !== void 0 || authMethodRaw !== void 0 || signerMaterialRaws.some(rawValueIsPresent) || exportRootRaw !== void 0 || receiptRaw !== void 0 || profileProjectionRaw !== void 0;
-		const allInstallationRecords = authorityRaw !== void 0 && authMethodRaw !== void 0 && signerMaterialRaws.every(rawValueIsPresent) && (input.exportRoot === null ? exportRootRaw === void 0 : exportRootRaw !== void 0) && receiptRaw !== void 0;
-		if (installationStateExists) {
-			if (!selection || !allInstallationRecords || !existingAuthority || !existingAuthMethod || !existingReceipt || !profileProjection || !localAuthorityPendingProfileProjectionsMatchV1(profileProjection, profileProjectionRecord)) return {
-				kind: "integrity_error",
-				reason: "local authority replay is incomplete or malformed"
-			};
-			if (!walletAuthorityRecordsMatch(existingAuthority.record, input.authority) || !walletAuthMethodRecordsMatch(existingAuthMethod.record, input.authMethod) || !localAuthorityInstallationReceiptsMatch(existingReceipt, input.receipt)) return {
-				kind: "integrity_error",
-				reason: "local authority replay conflicts with stored records"
-			};
-			if (existingProfile && !profileRecordsMatch(existingProfile, profileProjection.profile.record) || profileProjection.authenticator && existingAuthenticatorRow !== null && !localWalletAuthMethodRowsMatch(existingAuthenticatorRow, profileProjection.authenticator) || profileProjection.localAuthMethod && existingLocalAuthMethodRow !== null && !localWalletAuthMethodRowsMatch(existingLocalAuthMethodRow, profileProjection.localAuthMethod)) return {
-				kind: "integrity_error",
-				reason: "stored local profile projection conflicts with replay"
-			};
-			for (let index = 0; index < input.signerMaterials.length; index += 1) {
-				const existingMaterial = existingSignerMaterials[index];
-				if (!existingMaterial || !walletAuthoritySignerMaterialRecordsMatch(existingMaterial, input.signerMaterials[index])) return {
-					kind: "integrity_error",
-					reason: "stored signer material conflicts with replay"
-				};
-			}
-			if (input.exportRoot) {
-				if (!existingExportRoot || !walletAuthorityExportRootsMatch(existingExportRoot, input.exportRoot)) return {
-					kind: "integrity_error",
-					reason: "stored export root conflicts with replay"
-				};
-			}
-			await selectionStore.put(walletSelectionStorageRow(walletSelectionForInstalledAuthority(input, selection)));
-			return {
-				kind: "idempotent_replay",
-				receipt: existingReceipt
-			};
-		}
-		await appStateStore.put({
-			key: profileProjectionKey,
-			value: profileProjectionRecord
-		});
-		await authorityStore.put(walletAuthorityStorageRow(input.authority));
-		await authMethodStore.put(await walletAuthMethodV2StorageRowForStore(authMethodStore, input.authMethod));
-		for (const material of input.signerMaterials) await signerMaterialStore.put(walletAuthoritySignerMaterialStorageRow(material));
-		if (input.exportRoot) await exportRootStore.put(walletAuthorityExportRootStorageRow(input.exportRoot));
-		await receiptStore.put(localAuthorityInstallationReceiptStorageRow(input.receipt));
-		await selectionStore.put(walletSelectionStorageRow(walletSelectionForInstalledAuthority(input, selection)));
-		return {
-			kind: "installed",
-			receipt: input.receipt
-		};
-	}
-	async getWalletAuthority(walletAuthorityId) {
-		const parsedId = parseWalletAuthorityId(walletAuthorityId);
-		if (!parsedId.ok) return null;
-		const row = parseWalletAuthorityStorageRow(await (await this.manager.getDB()).get(SEAMS_WALLET_STORES.walletAuthorities, parsedId.value));
-		if (!row || !await walletAuthorityDigestsMatchV1(row.record)) return null;
-		return row.record;
-	}
-	async persistFoundingWalletAuthority(input) {
-		const validated = validateFoundingWalletAuthorityInput(input);
-		await this.manager.runTransaction([
-			SEAMS_WALLET_STORES.appState,
-			SEAMS_WALLET_STORES.walletAuthorities,
-			SEAMS_WALLET_STORES.walletAuthMethods,
-			SEAMS_WALLET_STORES.wallets,
-			SEAMS_WALLET_STORES.walletSelections
-		], "readwrite", this.persistFoundingWalletAuthorityInTransaction.bind(this, validated, "activate"));
-	}
-	async persistFoundingWalletAuthorityInTransaction(input, selectionPolicy, ctx) {
-		if (selectionPolicy === "preserve") {
-			const selection = parseWalletSelectionStorageRow(await ctx.store(SEAMS_WALLET_STORES.walletSelections).get(input.authority.walletId));
-			if (!selection || selection.record.lockState !== "unlocked" || selection.record.walletAuthMethodId !== input.authMethod.walletAuthMethodId) throw new Error("Deferred registration publication was interrupted by wallet lock");
-		}
-		await ctx.store(SEAMS_WALLET_STORES.walletAuthorities).put(walletAuthorityStorageRow(input.authority));
-		const authMethodStore = ctx.store(SEAMS_WALLET_STORES.walletAuthMethods);
-		await authMethodStore.put(await walletAuthMethodV2StorageRowForStore(authMethodStore, input.authMethod));
-		if (selectionPolicy === "preserve") return;
-		await ctx.store(SEAMS_WALLET_STORES.walletSelections).put(walletSelectionStorageRow({
-			kind: "wallet_selection_v1",
-			walletId: input.authority.walletId,
-			walletAuthMethodId: input.authMethod.walletAuthMethodId,
-			lockGeneration: 0,
-			lockState: "unlocked",
-			updatedAtMs: input.authMethod.activatedAtMs
-		}));
-	}
-	async getWalletAuthMethodV2(walletAuthMethodId) {
-		const parsedId = parseWalletAuthMethodId(walletAuthMethodId);
-		if (!parsedId.ok) return null;
-		return parseWalletAuthMethodV2StorageRow(await (await this.manager.getDB()).get(SEAMS_WALLET_STORES.walletAuthMethods, parsedId.value))?.record || null;
-	}
-	async listWalletSelections() {
-		return (await (await this.manager.getDB()).transaction(SEAMS_WALLET_STORES.walletSelections, "readonly").store.getAll()).flatMap((row) => {
-			const parsed = parseWalletSelectionStorageRow(row);
-			return parsed ? [parsed.record] : [];
-		});
-	}
-	async listWalletSelectionWalletIds() {
-		return (await (await this.manager.getDB()).transaction(SEAMS_WALLET_STORES.walletSelections, "readonly").store.getAllKeys()).flatMap((key) => {
-			const parsed = parseWalletId(key);
-			return parsed.ok ? [parsed.value] : [];
-		});
-	}
-	async listWalletAuthMethodsV2ForWallet(walletId) {
-		const normalizedWalletId = normalizeTrimmedString(walletId || "");
-		if (!normalizedWalletId) return [];
-		return (await (await this.manager.getDB()).transaction(SEAMS_WALLET_STORES.walletAuthMethods, "readonly").store.index(SEAMS_WALLET_INDEXES.walletId).getAll(normalizedWalletId)).flatMap((row) => {
-			const parsed = parseWalletAuthMethodV2StorageRow(row);
-			return parsed ? [parsed.record] : [];
-		});
-	}
-	async listLocalWalletAuthMethodProjectionsV2ForWallet(walletId) {
-		const normalizedWalletId = normalizeTrimmedString(walletId || "");
-		if (!normalizedWalletId) return [];
-		return await this.manager.runTransaction([SEAMS_WALLET_STORES.walletAuthMethods], "readwrite", async (ctx) => {
-			const store = ctx.store(SEAMS_WALLET_STORES.walletAuthMethods);
-			const rows = await store.index(SEAMS_WALLET_INDEXES.walletId).getAll(normalizedWalletId);
-			const projections = [];
-			for (const raw of rows) {
-				const parsed = parseWalletAuthMethodV2StorageRow(raw);
-				if (!parsed) continue;
-				const presentation = walletAuthMethodLocalPresentation(parsed.record, rows, parsed.presentation);
-				if (!rawWalletAuthMethodRowHasPresentation(raw) || !walletAuthMethodLocalPresentationsMatch(parsed.presentation, presentation)) await store.put(walletAuthMethodV2StorageRow(localWalletAuthMethodProjectionV2(parsed.record, presentation)));
-				projections.push(localWalletAuthMethodProjectionV2(parsed.record, presentation));
-			}
-			return projections;
-		});
-	}
-	async retainVerifiedEmailOtpLocalPresentation(input) {
-		const emailHashHex = await sha256HexUtf8(String(input.emailAddress));
-		return await this.manager.runTransaction([SEAMS_WALLET_STORES.walletAuthMethods], "readwrite", async (ctx) => {
-			const store = ctx.store(SEAMS_WALLET_STORES.walletAuthMethods);
-			const row = parseWalletAuthMethodV2StorageRow(await store.get(input.walletAuthMethodId));
-			if (!row) return {
-				kind: "not_retained",
-				reason: "missing_auth_method"
-			};
-			if (row.record.walletId !== input.walletId) return {
-				kind: "not_retained",
-				reason: "wallet_mismatch"
-			};
-			if (row.record.kind !== "email_otp") return {
-				kind: "not_retained",
-				reason: "auth_method_not_email_otp"
-			};
-			if (row.record.emailHashHex !== emailHashHex) return {
-				kind: "not_retained",
-				reason: "email_hash_mismatch"
-			};
-			const presentation = {
-				version: "wallet_auth_method_local_presentation_v1",
-				kind: "email_otp",
-				email: {
-					kind: "verified",
-					address: input.emailAddress
-				}
-			};
-			await store.put(walletAuthMethodV2StorageRow({
-				kind: "email_otp",
-				record: row.record,
-				presentation
-			}));
-			return {
-				kind: "retained",
-				projection: {
-					kind: "email_otp",
-					record: row.record,
-					presentation
-				}
-			};
-		});
-	}
-	async resolveSelectedWalletAuthority(walletId) {
-		return await this.resolveWalletAuthorityForSelection(walletId, null);
-	}
-	/**
-	* Resolve the authority as a named method rather than as the selected one.
-	*
-	* Unlocking a sibling is how an added method comes into use - invariant 9
-	* makes lock and unlock the route - and the unlock moves the selection to it.
-	* Resolving through the selection first would make that impossible: the
-	* method cannot become selected until it unlocks, and it cannot unlock until
-	* it is selected. Naming the method breaks the circle; the move itself is
-	* still guarded, and still only between members of one authority.
-	*/
-	async resolveWalletAuthorityForMethod(walletId, walletAuthMethodId) {
-		const parsed = parseWalletAuthMethodId(walletAuthMethodId);
-		if (!parsed.ok) return {
-			kind: "integrity_error",
-			reason: "walletAuthMethodId is invalid"
-		};
-		return await this.resolveWalletAuthorityForSelection(walletId, parsed.value);
-	}
-	async resolveWalletAuthorityForSelection(walletId, walletAuthMethodId) {
-		const parsedWalletId = parseWalletId(walletId);
-		if (!parsedWalletId.ok) return {
-			kind: "integrity_error",
-			reason: "walletId is invalid"
-		};
-		return this.manager.runTransaction([
-			SEAMS_WALLET_STORES.walletSelections,
-			SEAMS_WALLET_STORES.walletAuthMethods,
-			SEAMS_WALLET_STORES.walletAuthorities,
-			SEAMS_WALLET_STORES.walletAuthoritySignerMaterials,
-			SEAMS_WALLET_STORES.walletAuthorityExportRoots
-		], "readonly", (ctx) => this.resolveSelectedWalletAuthorityInTransaction(parsedWalletId.value, ctx, walletAuthMethodId));
-	}
-	async resolveSelectedWalletAuthorityInTransaction(walletId, ctx, requestedWalletAuthMethodId = null) {
-		const selectionRaw = await ctx.store(SEAMS_WALLET_STORES.walletSelections).get(walletId);
-		if (selectionRaw === void 0) return { kind: "missing_selection" };
-		const selection = parseWalletSelectionStorageRow(selectionRaw);
-		if (!selection || selection.wallet_id !== walletId) return {
-			kind: "integrity_error",
-			reason: "wallet selection row is invalid"
-		};
-		const resolvedAuthMethodId = requestedWalletAuthMethodId ?? selection.record.walletAuthMethodId;
-		const authMethodRaw = await ctx.store(SEAMS_WALLET_STORES.walletAuthMethods).get(String(resolvedAuthMethodId));
-		if (authMethodRaw === void 0) return {
-			kind: "missing_auth_method",
-			walletAuthMethodId: resolvedAuthMethodId
-		};
-		const authMethod = parseWalletAuthMethodV2StorageRow(authMethodRaw);
-		if (!authMethod || authMethod.wallet_id !== walletId) return {
-			kind: "integrity_error",
-			reason: "selected V2 auth method row is invalid"
-		};
-		const authorityRaw = await ctx.store(SEAMS_WALLET_STORES.walletAuthorities).get(authMethod.wallet_authority_id);
-		if (authorityRaw === void 0) return {
-			kind: "missing_authority",
-			walletAuthorityId: authMethod.record.walletAuthorityId
-		};
-		const authority = parseWalletAuthorityStorageRow(authorityRaw);
-		if (!authority || authority.wallet_id !== walletId) return {
-			kind: "integrity_error",
-			reason: "selected wallet authority row is invalid"
-		};
-		if (authority.authority_id !== authMethod.wallet_authority_id) return {
-			kind: "integrity_error",
-			reason: "auth method authority reference does not resolve exactly"
-		};
-		if (authority.record.provenance.kind === "wallet_registration" || authority.record.provenance.kind === "wallet_recovery") {
-			if (!await walletAuthorityDigestsMatchV1(authority.record)) return {
-				kind: "integrity_error",
-				reason: "selected wallet authority digest is invalid"
-			};
-			return {
-				kind: "resolved",
-				selection: selection.record,
-				authMethod: authMethod.record,
-				authority: authority.record,
-				signerMaterials: [],
-				exportRoot: null
-			};
-		}
-		const signerMaterialStore = ctx.store(SEAMS_WALLET_STORES.walletAuthoritySignerMaterials);
-		const signerMaterials = [];
-		let expectations;
-		try {
-			expectations = signerMaterialExpectations(authority.record.signerActivations);
-		} catch {
-			return {
-				kind: "integrity_error",
-				reason: "selected authority signer activations are invalid"
-			};
-		}
-		for (const expected of expectations) {
-			const rawMaterial = await signerMaterialStore.get([
-				authority.record.authorityId,
-				authMethod.record.walletAuthMethodId,
-				expected.materialActivation.activationId
-			]);
-			if (rawMaterial === void 0) return {
-				kind: "integrity_error",
-				reason: "selected signer material row is missing"
-			};
-			const materialRow = parseWalletAuthoritySignerMaterialStorageRow(rawMaterial);
-			if (!materialRow || materialRow.wallet_authority_id !== authority.record.authorityId || materialRow.wallet_auth_method_id !== authMethod.record.walletAuthMethodId || materialRow.activation_id !== expected.materialActivation.activationId || materialRow.key_family !== expected.keyFamily || !mpcMaterialActivationRefsEqual(materialRow.record.materialActivation, expected.materialActivation)) return {
-				kind: "integrity_error",
-				reason: "selected signer material row is invalid"
-			};
-			signerMaterials.push(materialRow.record);
-		}
-		const exportRootRaws = await ctx.store(SEAMS_WALLET_STORES.walletAuthorityExportRoots).index(SEAMS_WALLET_INDEXES.walletAuthorityAuthMethodId).getAll([authority.record.authorityId, authMethod.record.walletAuthMethodId]);
-		const requiresExportRoot = hasEd25519SignerFamily(authority.record.signerActivations) && authority.record.permissions.includes("export_keys");
-		if (exportRootRaws.length !== (requiresExportRoot ? 1 : 0)) return {
-			kind: "integrity_error",
-			reason: "selected authority export-root cardinality is invalid"
-		};
-		let exportRoot = null;
-		if (requiresExportRoot) {
-			const row = parseWalletAuthorityExportRootStorageRow(exportRootRaws[0]);
-			const expectedWalletKeyId = ed25519WalletKeyId(authority.record.signerActivations);
-			if (!row || expectedWalletKeyId === null || row.wallet_authority_id !== authority.record.authorityId || row.wallet_auth_method_id !== authMethod.record.walletAuthMethodId || row.record.walletKeyId !== expectedWalletKeyId || row.record.envelope.walletId !== walletId || row.record.envelope.binding.kind !== "ed25519_yao_client_root_v1" || row.record.envelope.binding.walletKeyId !== expectedWalletKeyId || row.record.envelope.binding.registeredPublicKeyB64u !== authority.record.signerActivations.ed25519?.signer.registeredPublicKeyB64u || authority.record.principal.kind !== "owner_device" || String(row.record.envelope.binding.deviceId) !== String(authority.record.principal.deviceId) || row.record.envelope.lifecycle.state !== "active" || !exportRootEnvelopeMatchesAuthMethod(authMethod.record, row.record.envelope)) return {
-				kind: "integrity_error",
-				reason: "selected authority export root is invalid"
-			};
-			exportRoot = row.record;
-		}
-		if (!await walletAuthorityDigestsMatchV1(authority.record)) return {
-			kind: "integrity_error",
-			reason: "selected wallet authority digest is invalid"
-		};
-		return {
-			kind: "resolved",
-			selection: selection.record,
-			authMethod: authMethod.record,
-			authority: authority.record,
-			signerMaterials,
-			exportRoot
-		};
-	}
-	async getAppState(key) {
-		const normalizedKey = normalizeTrimmedString(key || "");
-		if (!normalizedKey) return void 0;
-		return (await (await this.manager.getDB()).get(SEAMS_WALLET_STORES.appState, normalizedKey))?.value;
-	}
-	async listAppStateEntriesByPrefix(prefix) {
-		const normalizedPrefix = normalizeTrimmedString(prefix || "");
-		if (!normalizedPrefix) return [];
-		return (await (await this.manager.getDB()).getAll(SEAMS_WALLET_STORES.appState)).flatMap((raw) => {
-			const row = parseAppStateRow(raw);
-			return row && row.key.startsWith(normalizedPrefix) ? [row] : [];
-		});
-	}
-	async setAppState(key, value) {
-		const normalizedKey = normalizeTrimmedString(key || "");
-		if (!normalizedKey) return;
-		await this.manager.runTransaction([SEAMS_WALLET_STORES.appState], "readwrite", async (ctx) => {
-			await ctx.store(SEAMS_WALLET_STORES.appState).put({
-				key: normalizedKey,
-				value
-			});
-		});
-	}
-	async putPendingWalletRegistrationCommits(records) {
-		const rows = records.map(toPendingWalletRegistrationCommitAppStateRow);
-		await this.manager.runTransaction([SEAMS_WALLET_STORES.appState], "readwrite", async (ctx) => {
-			const store = ctx.store(SEAMS_WALLET_STORES.appState);
-			for (const row of rows) {
-				if (await store.get(row.key)) throw new Error("Registration checkpoint already exists");
-				await store.put(row);
-			}
-		});
-	}
-	async advancePendingNearRegistration(input) {
-		const current = input.expected;
-		const next = input.next;
-		if (current.registrationCeremonyId !== next.registrationCeremonyId || current.walletId !== next.walletId || current.walletAuthMethodId !== next.walletAuthMethodId || current.signedSetup !== next.signedSetup || current.signerPlanKind !== next.signerPlanKind || current.createdAtMs !== next.createdAtMs || next.updatedAtMs < current.updatedAtMs || JSON.stringify(current.auth) !== JSON.stringify(next.auth) || !(current.phase === "planned" && next.phase === "execution_prepared" || current.phase === "execution_prepared" && next.phase === "joined")) throw new Error("Invalid NEAR registration checkpoint transition");
-		if (current.phase === "planned" && next.phase === "execution_prepared" && (current.idempotencyKey !== next.idempotencyKey || JSON.stringify(current.admissionRequest) !== JSON.stringify(next.admissionRequest) || JSON.stringify(current.baseCustodyCommit) !== JSON.stringify(next.baseCustodyCommit))) throw new Error("NEAR preparation changed its immutable request");
-		if (current.phase === "execution_prepared" && next.phase === "joined" && (next.completion.kind !== "encrypted_checkpoint" || JSON.stringify(next.completion.prepared) !== JSON.stringify(current))) throw new Error("Joined NEAR must retain its exact encrypted completion checkpoint");
-		const row = toPendingWalletRegistrationCommitAppStateRow(current);
-		const nextRow = toPendingWalletRegistrationCommitAppStateRow(next);
-		await this.manager.runTransaction([SEAMS_WALLET_STORES.appState], "readwrite", async (ctx) => {
-			const store = ctx.store(SEAMS_WALLET_STORES.appState);
-			const saved = parsePendingWalletRegistrationCommitAppStateRow(await store.get(row.key));
-			if (!saved || JSON.stringify(saved.record) !== JSON.stringify(current)) throw new Error("NEAR registration checkpoint changed concurrently");
-			await store.put(nextRow);
-		});
-	}
-	async putPendingWalletRegistrationCommit(record) {
-		const row = toPendingWalletRegistrationCommitAppStateRow(record);
-		await this.manager.runTransaction([SEAMS_WALLET_STORES.appState], "readwrite", async (ctx) => {
-			await ctx.store(SEAMS_WALLET_STORES.appState).put(row);
-		});
-	}
-	async migratePendingMixedRegistrationRows() {
-		const rows = await (await this.manager.getDB()).getAll(SEAMS_WALLET_STORES.appState);
-		const candidates = await Promise.all(rows.map(splitPersistedMixedRegistrationRow));
-		await this.manager.runTransaction([SEAMS_WALLET_STORES.appState], "readwrite", async (ctx) => {
-			const store = ctx.store(SEAMS_WALLET_STORES.appState);
-			for (const candidate of candidates) {
-				if (!candidate) continue;
-				const activation = toPendingWalletRegistrationCommitAppStateRow(candidate.activation);
-				if (JSON.stringify(await store.get(activation.key)) !== JSON.stringify(candidate.original)) continue;
-				const near = toPendingWalletRegistrationCommitAppStateRow(candidate.near);
-				const savedNear = await store.get(near.key);
-				if (savedNear && JSON.stringify(savedNear) !== JSON.stringify(near)) throw new Error("Conflicting NEAR continuation during registration migration");
-				await store.put(near);
-				await store.put(activation);
-			}
-		});
-	}
-	async getPendingWalletRegistrationCommit(input) {
-		await this.migratePendingMixedRegistrationRows();
-		const registrationCeremonyId = normalizeTrimmedString(input.registrationCeremonyId || "");
-		if (!registrationCeremonyId) return null;
-		return parsePendingWalletRegistrationCommitAppStateRow(await (await this.manager.getDB()).get(SEAMS_WALLET_STORES.appState, pendingWalletRegistrationCommitAppStateKey({
-			registrationCeremonyId,
-			operation: input.operation
-		})))?.record || null;
-	}
-	async listPendingWalletRegistrationCommits() {
-		await this.migratePendingMixedRegistrationRows();
-		return (await (await this.manager.getDB()).getAll(SEAMS_WALLET_STORES.appState)).flatMap((raw) => {
-			const parsed = parsePendingWalletRegistrationCommitAppStateRow(raw);
-			return parsed ? [parsed.record] : [];
-		});
-	}
-	async deletePendingWalletRegistrationCommit(input) {
-		const registrationCeremonyId = normalizeTrimmedString(input.registrationCeremonyId || "");
-		if (!registrationCeremonyId) return;
-		await this.manager.runTransaction([SEAMS_WALLET_STORES.appState], "readwrite", async (ctx) => {
-			await ctx.store(SEAMS_WALLET_STORES.appState).delete(pendingWalletRegistrationCommitAppStateKey({
-				registrationCeremonyId,
-				operation: input.operation
-			}));
-		});
-	}
-	/**
-	* Adopts the authority the Gateway returned after this wallet added an ECDSA
-	* signer: the local authority extended with exactly the activation this
-	* device made, nothing else changed. The Gateway promoted the wallet's live
-	* Wallet Sessions to it; the next exact status read carries that promotion
-	* into the local session, which keeps its operation credential.
-	*/
-	async adoptAddedEcdsaSignerAuthority(input) {
-		const parsed = parseWalletAuthorityV1(input.authority);
-		if (!parsed.ok || parsed.value.state !== "active" || !await walletAuthorityDigestsMatchV1(parsed.value)) throw new Error("Added ECDSA signer authority is invalid");
-		const next = parsed.value;
-		const nextEcdsa = next.signerActivations.ecdsa;
-		if (!nextEcdsa || !mpcMaterialActivationRefsEqual(nextEcdsa.materialActivation, input.materialActivation)) throw new Error("Added ECDSA signer authority does not carry the activated signer");
-		await this.manager.runTransaction([SEAMS_WALLET_STORES.walletAuthorities], "readwrite", async (ctx) => {
-			const store = ctx.store(SEAMS_WALLET_STORES.walletAuthorities);
-			const current = parseWalletAuthorityStorageRow(await store.get(next.authorityId));
-			if (!current || current.record.state !== "active") throw new Error("Added ECDSA signer has no active local authority to extend");
-			if (current.record.authorityDigestB64u === next.authorityDigestB64u) return;
-			if (!isEcdsaExtensionOfEd25519WalletAuthority(current.record, next)) throw new Error("Added ECDSA signer authority is not an extension of the local authority");
-			await store.put(walletAuthorityStorageRow(next));
-		});
-	}
-	/**
-	* Replaces the exact active Wallet Session with the one a status read
-	* returned, only while it still binds the wallet's stored authority and its
-	* unlocked selection. The status crosses the network, and a publication
-	* can commit meanwhile: deferred NEAR provisioning extends the authority
-	* and rebinds the session in one transaction. Writing the older status
-	* after it would bind the session to an authority digest no longer stored,
-	* and every exact-session check would refuse it until another status read.
-	*/
-	async replaceExactActiveWalletSessionFromStatus(input) {
-		return await this.manager.runTransaction([
-			SEAMS_WALLET_STORES.walletAuthorities,
-			SEAMS_WALLET_STORES.walletSessionAuthorizations,
-			SEAMS_WALLET_STORES.walletSelections
-		], "readwrite", this.replaceExactActiveWalletSessionFromStatusInTransaction.bind(this, input));
-	}
-	async replaceExactActiveWalletSessionFromStatusInTransaction(input, ctx) {
-		const authority = parseWalletAuthorityStorageRow(await ctx.store(SEAMS_WALLET_STORES.walletAuthorities).get(input.active.authorityId));
-		const selection = parseWalletSelectionStorageRow(await ctx.store(SEAMS_WALLET_STORES.walletSelections).get(input.active.walletId));
-		if (!authority || authority.record.state !== "active" || authority.record.walletId !== input.active.walletId || authority.record.authorityDigestB64u !== input.active.authorityDigestB64u || authority.record.revocationEpoch !== input.active.authorityRevocationEpoch || !selection || selection.record.lockState !== "unlocked" || selection.record.walletAuthMethodId !== input.active.authMethodId) return { kind: "superseded" };
-		await replaceExactActiveWalletSessionAuthorizationInTransaction({
-			ctx,
-			active: input.active,
-			operationCredential: input.operationCredential
-		});
-		return { kind: "replaced" };
-	}
-	async reconcilePendingNearRegistrationAuthority(input) {
-		const authority = await this.getWalletAuthority(input.walletSession.authorityId);
-		if (!authority || authority.state !== "active" || !isActiveEcdsaWalletAuthorityV1(authority)) return;
-		const rows = await this.listPendingWalletRegistrationCommits();
-		for (const pending of rows) {
-			if (pending.operation !== "near_provisioning" || pending.phase !== "joined" || pending.signerPlanKind !== "near_ed25519_and_evm_family_ecdsa" || pending.walletId !== input.walletSession.walletId || pending.walletAuthMethodId !== input.walletSession.authMethodId) continue;
-			const metadata = pending.localMaterial.ed25519.metadata;
-			const extended = await extendEcdsaWalletAuthorityWithEd25519({
-				authority,
-				ed25519: {
-					kind: "wallet_ed25519_signer_activation_v1",
-					signer: {
-						kind: "exact_administered_ed25519_signer_v1",
-						keyFamily: "ed25519",
-						walletId: pending.walletId,
-						walletKeyId: requireBoundaryParsed(parseWalletKeyId(`wallet-key:ed25519:${pending.walletId}:${metadata.nearEd25519SigningKeyId}`), "NEAR wallet key"),
-						registeredPublicKeyB64u: parseEd25519PublicKeyB64u(metadata.registeredPublicKeyB64u)
-					},
-					materialActivation: metadata.materialActivation
-				},
-				now: Date.now()
-			});
-			if (extended.authorityDigestB64u !== input.walletSession.authorityDigestB64u || extended.revocationEpoch !== input.walletSession.authorityRevocationEpoch) continue;
-			await this.manager.runTransaction([
-				SEAMS_WALLET_STORES.appState,
-				SEAMS_WALLET_STORES.walletAuthorities,
-				SEAMS_WALLET_STORES.walletSessionAuthorizations,
-				SEAMS_WALLET_STORES.walletSelections
-			], "readwrite", this.reconcilePendingNearRegistrationAuthorityInTransaction.bind(this, {
-				pending,
-				authority: extended,
-				previousDigest: authority.authorityDigestB64u,
-				walletSession: input.walletSession,
-				operationCredential: input.operationCredential
-			}));
-			return;
-		}
-	}
-	async reconcilePendingNearRegistrationAuthorityInTransaction(input, ctx) {
-		const current = await readExactActiveWalletSessionForScopeInTransaction({
-			ctx,
-			walletId: input.pending.walletId,
-			authorityId: input.authority.authorityId,
-			authMethodId: input.pending.walletAuthMethodId
-		});
-		const selection = parseWalletSelectionStorageRow(await ctx.store(SEAMS_WALLET_STORES.walletSelections).get(input.pending.walletId));
-		const authority = parseWalletAuthorityStorageRow(await ctx.store(SEAMS_WALLET_STORES.walletAuthorities).get(input.authority.authorityId));
-		const pending = parsePendingWalletRegistrationCommitAppStateRow(await ctx.store(SEAMS_WALLET_STORES.appState).get(pendingWalletRegistrationCommitAppStateKey(input.pending)));
-		if (current.kind !== "found" || current.operationCredential.token !== input.operationCredential.token || !selection || selection.record.lockState !== "unlocked" || selection.record.walletAuthMethodId !== input.pending.walletAuthMethodId || !authority || authority.record.state !== "active" || authority.record.authorityDigestB64u !== input.previousDigest && authority.record.authorityDigestB64u !== input.authority.authorityDigestB64u || !pending || JSON.stringify(pending.record) !== JSON.stringify(input.pending)) throw new Error("NEAR authority reconciliation was superseded");
-		assertCredentialFreeRegistrationSessionProjectionMatchesExisting({
-			incoming: input.walletSession,
-			existing: current.record
-		});
-		await ctx.store(SEAMS_WALLET_STORES.walletAuthorities).put(walletAuthorityStorageRow(input.authority));
-		await replaceExactActiveWalletSessionAuthorizationInTransaction({
-			ctx,
-			active: input.walletSession,
-			operationCredential: current.operationCredential
-		});
-	}
-	async completePendingNearRegistration(input) {
-		await this.manager.runTransaction([
-			SEAMS_WALLET_STORES.appState,
-			SEAMS_WALLET_STORES.wallets,
-			SEAMS_WALLET_STORES.walletSessionAuthorizations,
-			SEAMS_WALLET_STORES.walletSelections
-		], "readwrite", this.completePendingNearRegistrationInTransaction.bind(this, input));
-	}
-	async completePendingNearRegistrationInTransaction(input, ctx) {
-		const current = await readExactActiveWalletSessionForScopeInTransaction({
-			ctx,
-			walletId: input.pending.walletId,
-			authorityId: input.walletSession.authorityId,
-			authMethodId: input.pending.walletAuthMethodId
-		});
-		if (current.kind !== "found" || current.operationCredential.token !== input.operationCredential.token || current.record.authorityDigestB64u !== input.walletSession.authorityDigestB64u) throw new Error("NEAR readiness requires the current Wallet Session");
-		assertCredentialFreeRegistrationSessionProjectionMatchesExisting({
-			incoming: input.walletSession,
-			existing: current.record
-		});
-		const selection = parseWalletSelectionStorageRow(await ctx.store(SEAMS_WALLET_STORES.walletSelections).get(input.pending.walletId));
-		if (!selection || selection.record.lockState !== "unlocked" || selection.record.walletAuthMethodId !== input.pending.walletAuthMethodId) throw new Error("NEAR readiness was interrupted by a wallet lock or selection change");
-		const pendingKey = pendingWalletRegistrationCommitAppStateKey(input.pending);
-		const stored = parsePendingWalletRegistrationCommitAppStateRow(await ctx.store(SEAMS_WALLET_STORES.appState).get(pendingKey));
-		if (!stored || JSON.stringify(stored.record) !== JSON.stringify(input.pending)) throw new Error("NEAR readiness journal changed concurrently");
-		const profile = parseProfileRow(await ctx.store(SEAMS_WALLET_STORES.wallets).get(input.pending.walletId));
-		if (!profile) throw new Error("NEAR readiness requires its committed wallet");
-		await ctx.store(SEAMS_WALLET_STORES.wallets).put(profileRow({
-			profileId: profile.profileId,
-			nearProvisioning: {
-				status: "near_ready",
-				nearAccountId: input.nearAccountId,
-				updatedAtMs: Date.now()
-			}
-		}, profile));
-		await ctx.store(SEAMS_WALLET_STORES.appState).delete(pendingKey);
-	}
-	async putPendingWalletRecoveryCommit(record) {
-		const row = await toPendingWalletRecoveryCommitAppStateRow(record);
-		await this.manager.runTransaction([SEAMS_WALLET_STORES.appState], "readwrite", async (ctx) => {
-			await ctx.store(SEAMS_WALLET_STORES.appState).put(row);
-		});
-	}
-	async advancePendingWalletRecoveryCommit(input) {
-		const awaiting = await buildPendingWalletRecoveryCommitV1(input.awaiting);
-		const promoted = await buildPendingWalletRecoveryCommitV1(input.promoted);
-		if (awaiting.stage !== "awaiting_server_promotion" || promoted.stage !== "server_promoted" || !pendingWalletRecoveryCommitIdentityMatches(awaiting, promoted)) throw new Error("pending wallet recovery promotion changed its immutable identity");
-		const awaitingRow = await toPendingWalletRecoveryCommitAppStateRow(awaiting);
-		const promotedRow = await toPendingWalletRecoveryCommitAppStateRow(promoted);
-		return this.manager.runTransaction([SEAMS_WALLET_STORES.appState], "readwrite", async (ctx) => {
-			const store = ctx.store(SEAMS_WALLET_STORES.appState);
-			const stored = await store.get(awaitingRow.key);
-			if (pendingWalletRecoveryCommitAppStateRowsMatch(stored, awaitingRow)) {
-				await store.put(promotedRow);
-				return promoted;
-			}
-			if (pendingWalletRecoveryCommitAppStateRowsMatch(stored, promotedRow)) return promoted;
-			throw new Error("stored pending wallet recovery commit does not match the expected stage");
-		});
-	}
-	async getPendingWalletRecoveryCommit(recoveryOperationId) {
-		const parsedRecoveryOperationId = requireBoundaryParsed(parseWalletRecoveryOperationId(recoveryOperationId), "recoveryOperationId");
-		return (await parsePendingWalletRecoveryCommitAppStateRow(await (await this.manager.getDB()).get(SEAMS_WALLET_STORES.appState, pendingWalletRecoveryCommitAppStateKey(parsedRecoveryOperationId))))?.record ?? null;
-	}
-	async listPendingWalletRecoveryCommits() {
-		const db = await this.manager.getDB();
-		return (await Promise.all((await db.getAll(SEAMS_WALLET_STORES.appState)).map(parsePendingWalletRecoveryCommitAppStateRow))).flatMap((parsed) => parsed ? [parsed.record] : []);
-	}
-	async deletePendingWalletRecoveryCommit(recoveryOperationId) {
-		const parsedRecoveryOperationId = requireBoundaryParsed(parseWalletRecoveryOperationId(recoveryOperationId), "recoveryOperationId");
-		await this.manager.runTransaction([SEAMS_WALLET_STORES.appState], "readwrite", async (ctx) => {
-			await ctx.store(SEAMS_WALLET_STORES.appState).delete(pendingWalletRecoveryCommitAppStateKey(parsedRecoveryOperationId));
-		});
-	}
-	async getProfile(profileId) {
-		const normalizedProfileId = normalizeTrimmedString(profileId || "");
-		if (!normalizedProfileId) return null;
-		return parseProfileRow(await (await this.manager.getDB()).get(SEAMS_WALLET_STORES.wallets, normalizedProfileId));
-	}
-	async getWalletPreferences(walletId) {
-		return (await this.getProfile(walletId))?.preferences || {};
-	}
-	async listProfiles(args) {
-		const db = await this.manager.getDB();
-		const limit = Number.isSafeInteger(args?.limit) && Number(args?.limit) > 0 ? Number(args?.limit) : void 0;
-		return (limit ? await db.getAll(SEAMS_WALLET_STORES.wallets, void 0, limit) : await db.getAll(SEAMS_WALLET_STORES.wallets)).flatMap((row) => {
-			const parsed = parseProfileRow(row);
-			return parsed ? [parsed] : [];
-		});
-	}
-	async upsertProfile(input) {
-		const profileId = normalizeTrimmedString(input.profileId || "");
-		if (!profileId) throw new Error("[SeamsWalletDB] profileId is required");
-		let written = null;
-		await this.manager.runTransaction([SEAMS_WALLET_STORES.wallets], "readwrite", async (ctx) => {
-			const store = ctx.store(SEAMS_WALLET_STORES.wallets);
-			const next = profileRow(input, parseProfileRow(await store.get(profileId)) || void 0);
-			written = next.record;
-			await store.put(next);
-		});
-		if (!written) throw new Error("[SeamsWalletDB] profile write did not complete");
-		return written;
-	}
-	async upsertWalletAuthMethod(record) {
-		const fields = walletAuthMethodFields(record);
-		let written = null;
-		await this.manager.runTransaction([SEAMS_WALLET_STORES.wallets, SEAMS_WALLET_STORES.walletAuthMethods], "readwrite", async (ctx) => {
-			const profile = parseProfileRow(await ctx.store(SEAMS_WALLET_STORES.wallets).get(fields.wallet_id));
-			if (!profile) throw makeConstraintError("MISSING_PROFILE", `Cannot upsert auth-method binding for unknown wallet: ${fields.wallet_id}`, {
-				profileId: fields.wallet_id,
-				authIdentifierKey: fields.auth_identifier_key
-			});
-			const store = ctx.store(SEAMS_WALLET_STORES.walletAuthMethods);
-			const existing = parseWalletAuthMethodStorageRow(await store.get(fields.wallet_auth_method_id));
-			const row = record.kind === "passkey" && existing?.kind === "passkey" ? passkeyAuthMethodRow({
-				binding: record,
-				authenticator: existing.authenticator
-			}) : walletAuthMethodRowFromBinding(record, profile.defaultSignerSlot);
-			await store.put(row);
-			written = row.record;
-		});
-		if (!written) throw new Error("[SeamsWalletDB] auth-method write did not complete");
-		return written;
-	}
-	async upsertWalletAuthMethodV2(record) {
-		const parsed = parseWalletAuthMethodRecordV2(record);
-		if (!parsed) throw new Error("[SeamsWalletDB] auth-method V2 record is invalid");
-		await this.manager.runTransaction([SEAMS_WALLET_STORES.wallets, SEAMS_WALLET_STORES.walletAuthMethods], "readwrite", async (ctx) => {
-			if (!parseProfileRow(await ctx.store(SEAMS_WALLET_STORES.wallets).get(parsed.walletId))) throw makeConstraintError("MISSING_PROFILE", `Cannot upsert auth-method V2 binding for unknown wallet: ${String(parsed.walletId)}`, { profileId: String(parsed.walletId) });
-			const authMethodStore = ctx.store(SEAMS_WALLET_STORES.walletAuthMethods);
-			await authMethodStore.put(await walletAuthMethodV2StorageRowForStore(authMethodStore, parsed));
-		});
-	}
-	async getWalletAuthMethod(args) {
-		const kind = args.kind;
-		const rpId = normalizeTrimmedString(args.rpId || "");
-		const authIdentifierKey = normalizeTrimmedString(args.authIdentifierKey || "");
-		if (!rpId || !authIdentifierKey) return null;
-		const parsed = (await (await this.manager.getDB()).transaction(SEAMS_WALLET_STORES.walletAuthMethods, "readonly").store.index(SEAMS_WALLET_INDEXES.kindRpIdAuthIdentifier).getAll([
-			kind,
-			rpId,
-			authIdentifierKey
-		])).flatMap((row) => {
-			const record = parseWalletAuthMethodRow(row);
-			return record ? [record] : [];
-		});
-		return parsed.length === 1 ? parsed[0] : null;
-	}
-	async listWalletAuthMethodsForWallet(walletId) {
-		const normalizedWalletId = normalizeTrimmedString(walletId || "");
-		if (!normalizedWalletId) return [];
-		return (await (await this.manager.getDB()).transaction(SEAMS_WALLET_STORES.walletAuthMethods, "readonly").store.index(SEAMS_WALLET_INDEXES.walletId).getAll(normalizedWalletId)).flatMap((row) => {
-			const parsed = parseWalletAuthMethodRow(row);
-			return parsed ? [parsed] : [];
-		});
-	}
-	async upsertChainAccount(input) {
-		const profileId = normalizeTrimmedString(input.profileId || "");
-		const chainIdKey = normalizeIndexedDbChainIdKey(input.chainIdKey);
-		const accountAddress = normalizeIndexedDbAccountAddress(input.accountAddress);
-		if (!profileId || !chainIdKey || !accountAddress) throw new Error("[SeamsWalletDB] profileId, chainIdKey, and accountAddress are required");
-		let written = null;
-		await this.manager.runTransaction([SEAMS_WALLET_STORES.wallets, SEAMS_WALLET_STORES.nearAccountProjections], "readwrite", async (ctx) => {
-			if (!parseProfileRow(await ctx.store(SEAMS_WALLET_STORES.wallets).get(profileId))) throw new Error(`[SeamsWalletDB] Cannot upsert chain account for unknown profile: ${profileId}`);
-			const store = ctx.store(SEAMS_WALLET_STORES.nearAccountProjections);
-			const projectionId = chainAccountProjectionId({
-				chainIdKey,
-				accountAddress
-			});
-			const next = chainAccountProjectionRow(input, parseChainAccountProjectionRow(await store.get([
-				profileId,
-				projectionId,
-				CHAIN_ACCOUNT_PROJECTION_SIGNER_SLOT
-			])) || void 0);
-			written = next.record;
-			if (next.record.isPrimary) {
-				const rows = await store.index(SEAMS_WALLET_INDEXES.profileId).getAll(profileId);
-				for (const row of rows || []) {
-					const parsed = parseChainAccountProjectionRow(row);
-					if (!parsed || parsed.chainIdKey !== chainIdKey || !parsed.isPrimary) continue;
-					if (parsed.accountAddress === accountAddress) continue;
-					await store.put(chainAccountProjectionRow({
-						profileId: parsed.profileId,
-						chainIdKey: parsed.chainIdKey,
-						accountAddress: parsed.accountAddress,
-						accountModel: parsed.accountModel,
-						isPrimary: false
-					}, parsed));
-				}
-			}
-			await store.put(next);
-		});
-		if (!written) throw new Error("[SeamsWalletDB] chain-account write did not complete");
-		return written;
-	}
-	async listChainAccountsByProfile(profileId) {
-		const normalizedProfileId = normalizeTrimmedString(profileId || "");
-		if (!normalizedProfileId) return [];
-		const tx = (await this.manager.getDB()).transaction(SEAMS_WALLET_STORES.nearAccountProjections, "readonly");
-		const rows = await tx.store.index(SEAMS_WALLET_INDEXES.profileId).getAll(normalizedProfileId);
-		await tx.done;
-		return rows.flatMap((row) => {
-			const parsed = parseChainAccountProjectionRow(row);
-			return parsed ? [parsed] : [];
-		});
-	}
-	async listChainAccountsByProfileAndChain(profileId, chainIdKey) {
-		const normalizedChainIdKey = normalizeIndexedDbChainIdKey(chainIdKey);
-		if (!normalizedChainIdKey) return [];
-		return (await this.listChainAccountsByProfile(profileId)).filter((row) => row.chainIdKey === normalizedChainIdKey);
-	}
-	async getChainAccount(input) {
-		const profileId = normalizeTrimmedString(input.profileId || "");
-		const chainIdKey = normalizeIndexedDbChainIdKey(input.chainIdKey);
-		const accountAddress = normalizeIndexedDbAccountAddress(input.accountAddress);
-		if (!profileId || !chainIdKey || !accountAddress) return null;
-		return parseChainAccountProjectionRow(await (await this.manager.getDB()).get(SEAMS_WALLET_STORES.nearAccountProjections, [
-			profileId,
-			chainAccountProjectionId({
-				chainIdKey,
-				accountAddress
-			}),
-			CHAIN_ACCOUNT_PROJECTION_SIGNER_SLOT
-		]));
-	}
-	async resolveProfileAccountContext(accountRef) {
-		const chainIdKey = normalizeIndexedDbChainIdKey(accountRef.chainIdKey);
-		const accountAddress = normalizeIndexedDbAccountAddress(accountRef.accountAddress);
-		if (!chainIdKey || !accountAddress) return null;
-		const match = (await (await this.manager.getDB()).getAll(SEAMS_WALLET_STORES.nearAccountProjections)).flatMap((row) => {
-			const parsed = parseChainAccountProjectionRow(row);
-			return parsed ? [parsed] : [];
-		}).find((row) => row.chainIdKey === chainIdKey && row.accountAddress === accountAddress);
-		if (!match?.profileId) return null;
-		return {
-			profileId: match.profileId,
-			accountRef: {
-				chainIdKey,
-				accountAddress
-			}
-		};
-	}
-	async listChainAccountsByChain(chainIdKey) {
-		const normalizedChainIdKey = normalizeIndexedDbChainIdKey(chainIdKey);
-		if (!normalizedChainIdKey) return [];
-		return (await (await this.manager.getDB()).getAll(SEAMS_WALLET_STORES.nearAccountProjections)).flatMap((row) => {
-			const parsed = parseChainAccountProjectionRow(row);
-			return parsed && parsed.chainIdKey === normalizedChainIdKey ? [parsed] : [];
-		});
-	}
-	buildAccountSignerRecord(args) {
-		const removedAt = args.status === "revoked" ? args.removedAt ?? args.existing?.removedAt ?? args.now : void 0;
-		return {
-			profileId: args.profileId,
-			chainIdKey: args.chainIdKey,
-			accountAddress: args.accountAddress,
-			signerId: args.signerId,
-			signerSlot: args.signerSlot,
-			signerType: args.signerType,
-			signerKind: args.signerKind,
-			signerAuthMethod: args.signerAuthMethod,
-			signerSource: args.signerSource,
-			status: args.status,
-			addedAt: args.existing?.addedAt ?? args.now,
-			updatedAt: args.now,
-			...removedAt != null ? { removedAt } : {},
-			...args.revocationReason ? { revocationReason: normalizeTrimmedString(args.revocationReason) } : args.existing?.revocationReason ? { revocationReason: args.existing.revocationReason } : {},
-			...args.metadata != null ? { metadata: args.metadata } : args.existing?.metadata != null ? { metadata: args.existing.metadata } : {}
-		};
-	}
-	assertSignerWriteInvariants(args) {
-		const { next } = args;
-		if (next.status !== "revoked") {
-			if (!next.signerKind || !next.signerAuthMethod || !next.signerSource) throw makeConstraintError("MISSING_SIGNER_KIND", "Active and pending account signers require signerKind, signerAuthMethod, and signerSource", {
-				chainIdKey: next.chainIdKey,
-				accountAddress: next.accountAddress,
-				signerId: next.signerId,
-				status: next.status
-			});
-		}
-		if (next.status === "revoked" && next.removedAt == null) throw makeConstraintError("REVOKED_SIGNER_REQUIRES_REMOVED_AT", `Revoked signer ${next.signerId} must include removedAt`, {
-			chainIdKey: next.chainIdKey,
-			accountAddress: next.accountAddress,
-			signerId: next.signerId
-		});
-		if (next.status === "active") {
-			const conflictingSlot = args.activeSigners.find((row) => row.signerId !== next.signerId && row.signerSlot === next.signerSlot);
-			if (conflictingSlot) throw makeConstraintError("DUPLICATE_ACTIVE_SIGNER_SLOT", `Active signer slot ${next.signerSlot} is already used for ${next.chainIdKey}/${next.accountAddress}`, {
-				chainIdKey: next.chainIdKey,
-				accountAddress: next.accountAddress,
-				signerId: next.signerId,
-				signerSlot: next.signerSlot,
-				conflictingSignerId: conflictingSlot.signerId
-			});
-		}
-		if (args.existingStatus && args.existingStatus !== next.status) {
-			if (!{
-				pending: new Set([
-					"pending",
-					"active",
-					"revoked"
-				]),
-				active: new Set(["active", "revoked"]),
-				revoked: new Set(["revoked"])
-			}[args.existingStatus]?.has(next.status)) throw makeConstraintError("INVALID_SIGNER_STATUS_TRANSITION", `Invalid signer status transition ${args.existingStatus} -> ${next.status}`, {
-				chainIdKey: next.chainIdKey,
-				accountAddress: next.accountAddress,
-				signerId: next.signerId,
-				previousStatus: args.existingStatus,
-				nextStatus: next.status
-			});
-		}
-		if (next.status === "active" && String(next.signerKind || "") === "threshold-ecdsa") {
-			const metadata = next.metadata || {};
-			if (!normalizeTrimmedString(metadata.keyHandle)) throw makeConstraintError("INVALID_SIGNER_METADATA", "Active threshold ECDSA signer requires metadata.keyHandle", {
-				chainIdKey: next.chainIdKey,
-				accountAddress: next.accountAddress,
-				signerId: next.signerId
-			});
-			if (!normalizeTrimmedString(metadata.ecdsaThresholdKeyId)) throw makeConstraintError("INVALID_SIGNER_METADATA", "Active threshold ECDSA signer requires metadata.ecdsaThresholdKeyId", {
-				chainIdKey: next.chainIdKey,
-				accountAddress: next.accountAddress,
-				signerId: next.signerId
-			});
-			const thresholdOwnerAddress = normalizeIndexedDbAccountAddress(metadata.thresholdOwnerAddress);
-			if (!thresholdOwnerAddress || thresholdOwnerAddress !== next.accountAddress) throw makeConstraintError("INVALID_SIGNER_METADATA", "Active threshold ECDSA signer requires metadata.thresholdOwnerAddress matching accountAddress", {
-				chainIdKey: next.chainIdKey,
-				accountAddress: next.accountAddress,
-				signerId: next.signerId
-			});
-			const chainTargetKey = normalizeEcdsaChainTargetKey(metadata.chainTarget);
-			if (!chainTargetKey) throw makeConstraintError("INVALID_SIGNER_METADATA", "Active threshold ECDSA signer requires metadata.chainTarget", {
-				chainIdKey: next.chainIdKey,
-				accountAddress: next.accountAddress,
-				signerId: next.signerId
-			});
-			if (chainTargetKey !== next.chainIdKey) throw makeConstraintError("INVALID_SIGNER_METADATA", "Active threshold ECDSA signer metadata.chainTarget must match chainIdKey", {
-				chainIdKey: next.chainIdKey,
-				chainTargetKey,
-				accountAddress: next.accountAddress,
-				signerId: next.signerId
-			});
-		}
-	}
-	async enqueueSignerOperationInTransaction(store, input) {
-		const opId = normalizeTrimmedString(input.opId || "");
-		const idempotencyKey = normalizeTrimmedString(input.idempotencyKey || "");
-		const chainIdKey = normalizeIndexedDbChainIdKey(input.chainIdKey);
-		const accountAddress = normalizeIndexedDbAccountAddress(input.accountAddress);
-		const signerId = normalizeTrimmedString(input.signerId || "");
-		if (!opId || !idempotencyKey || !chainIdKey || !accountAddress || !signerId) throw new Error("[SeamsWalletDB] opId, idempotencyKey, chainIdKey, accountAddress, and signerId are required");
-		const existing = parseSignerOutboxRow(await store.get(opId));
-		if (!existing) {
-			const byIdempotency = parseSignerOutboxRow(await store.index(SEAMS_WALLET_INDEXES.idempotencyKey).get(idempotencyKey));
-			if (byIdempotency) return byIdempotency;
-		}
-		const now = Date.now();
-		const next = {
-			opId,
-			idempotencyKey,
-			opType: input.opType,
-			chainIdKey,
-			accountAddress,
-			signerId,
-			payload: input.payload ?? existing?.payload,
-			status: input.status ?? existing?.status ?? "queued",
-			attemptCount: input.attemptCount ?? existing?.attemptCount ?? 0,
-			nextAttemptAt: input.nextAttemptAt ?? existing?.nextAttemptAt ?? now,
-			lastError: input.lastError ?? existing?.lastError,
-			txHash: input.txHash ?? existing?.txHash,
-			createdAt: existing?.createdAt ?? now,
-			updatedAt: now
-		};
-		await store.put(signerOutboxRow(next));
-		return next;
-	}
-	async activateAccountSignerInTransaction(ctx, input) {
-		const profileId = normalizeTrimmedString(input.account.profileId || "");
-		const chainIdKey = normalizeIndexedDbChainIdKey(input.account.chainIdKey);
-		const accountAddress = normalizeIndexedDbAccountAddress(input.account.accountAddress);
-		const accountModel = normalizeIndexedDbAccountModel(input.account.accountModel);
-		const signerId = normalizeTrimmedString(input.signer.signerId || "");
-		const signerKind = input.signer.signerKind;
-		const signerAuthMethod = input.signer.signerAuthMethod;
-		const signerSource = input.signer.signerSource;
-		if (!profileId || !chainIdKey || !accountAddress || !accountModel || !signerId || !signerKind || !signerAuthMethod || !signerSource) throw new Error("[SeamsWalletDB] profileId, chainIdKey, accountAddress, accountModel, signerId, signerKind, signerAuthMethod, and signerSource are required");
-		const signerStore = ctx.store(SEAMS_WALLET_STORES.walletSigners);
-		if (!parseProfileRow(await ctx.store(SEAMS_WALLET_STORES.wallets).get(profileId))) throw makeConstraintError("MISSING_PROFILE", `Cannot upsert signer without profile row: ${profileId}`, {
-			profileId,
-			chainIdKey,
-			accountAddress,
-			signerId
-		});
-		if (shouldWriteNearAccountProjection({
-			accountModel,
-			chainIdKey
-		})) {
-			const chainAccountStore = ctx.store(SEAMS_WALLET_STORES.nearAccountProjections);
-			const existingChainAccount = parseChainAccountProjectionRow(await chainAccountStore.get([
-				profileId,
-				chainAccountProjectionId({
-					chainIdKey,
-					accountAddress
-				}),
-				CHAIN_ACCOUNT_PROJECTION_SIGNER_SLOT
-			]));
-			const chainAccount = chainAccountProjectionRow({
-				profileId,
-				chainIdKey,
-				accountAddress,
-				accountModel,
-				isPrimary: input.selectAsActive === true ? true : existingChainAccount?.isPrimary ?? true
-			}, existingChainAccount || void 0);
-			await chainAccountStore.put(chainAccount);
-		}
-		const allActiveSigners = (await signerStore.index(SEAMS_WALLET_INDEXES.status).getAll("active")).flatMap((row) => {
-			const parsed = parseAccountSignerRow(row);
-			return parsed ? [parsed] : [];
-		});
-		const activeSigners = allActiveSigners.flatMap((parsed) => {
-			return parsed.chainIdKey === chainIdKey && parsed.accountAddress === accountAddress ? [parsed] : [];
-		});
-		const plan = planAccountSignerActivation({
-			activeSigners,
-			signer: {
-				signerId,
-				signerKind,
-				signerAuthMethod,
-				signerSource
-			},
-			activationPolicy: input.activationPolicy,
-			...input.preferredSlot != null ? { preferredSlot: input.preferredSlot } : {}
-		});
-		const now = Date.now();
-		await this.revokeSignersForReplacement({
-			signerStore,
-			allActiveSigners,
-			accountActiveSigners: activeSigners,
-			profileId,
-			chainIdKey,
-			accountModel,
-			signerId,
-			activationPolicy: input.activationPolicy,
-			now
-		});
-		const activeSignersForInvariant = this.activeSignersAfterReplacement({
-			allActiveSigners,
-			accountActiveSigners: activeSigners,
-			profileId,
-			chainIdKey,
-			signerId,
-			activationPolicy: input.activationPolicy
-		});
-		const existingSigner = parseAccountSignerRow(await signerStore.get(walletSignerId({
-			chainIdKey,
-			accountAddress,
-			signerId
-		})));
-		if (existingSigner && existingSigner.profileId !== profileId) throw makeConstraintError("CHAIN_ACCOUNT_PROFILE_MISMATCH", `Signer row belongs to a different profile for ${chainIdKey}/${accountAddress}/${signerId}`, {
-			expectedProfileId: profileId,
-			existingProfileId: existingSigner.profileId
-		});
-		const signer = this.buildAccountSignerRecord({
-			profileId,
-			chainIdKey,
-			accountAddress,
-			signerId,
-			signerSlot: plan.signerSlot,
-			signerType: input.signer.signerType,
-			signerKind,
-			signerAuthMethod,
-			signerSource,
-			status: "active",
-			existing: existingSigner || void 0,
-			now,
-			...input.signer.metadata ? { metadata: input.signer.metadata } : {}
-		});
-		this.assertSignerWriteInvariants({
-			next: signer,
-			accountModel,
-			existingStatus: existingSigner?.status,
-			activeSigners: activeSignersForInvariant
-		});
-		const signerRow = accountSignerRow(signer);
-		await deleteConflictingThresholdEcdsaSignerRows({
-			store: signerStore,
-			nextRow: signerRow
-		});
-		await signerStore.put(signerRow);
-		if (input.selectAsActive ?? true) await ctx.store(SEAMS_WALLET_STORES.appState).put({
-			key: scopedLastProfileStateAppStateKey(),
-			value: {
-				profileId,
-				activeSignerSlot: plan.signerSlot
-			}
-		});
-		if (input.mutation?.routeThroughOutbox ?? false) {
-			const opId = normalizeTrimmedString(input.mutation?.opId || "") || createRandomToken("add-signer");
-			const idempotencyKey = normalizeTrimmedString(input.mutation?.idempotencyKey || "") || `add-signer:${signer.chainIdKey}:${signer.accountAddress}:${signer.signerId}:${signer.signerSlot}`;
-			await this.enqueueSignerOperationInTransaction(ctx.store(SEAMS_WALLET_STORES.signerOpsOutbox), {
-				opId,
-				idempotencyKey,
-				opType: "add-signer",
-				chainIdKey: signer.chainIdKey,
-				accountAddress: signer.accountAddress,
-				signerId: signer.signerId,
-				payload: this.signerOutboxPayload(signer, input.mutation),
-				status: input.mutation?.outboxStatus || "queued"
-			});
-		}
-		return {
-			signer,
-			signerSlot: plan.signerSlot
-		};
-	}
-	activeSignersAfterReplacement(args) {
-		const replacedSignerIds = /* @__PURE__ */ new Set();
-		for (const signer of this.signersRetiredByActivationPolicy(args)) replacedSignerIds.add(signer.signerId);
-		if (replacedSignerIds.size === 0) return args.accountActiveSigners;
-		const retained = [];
-		for (const signer of args.accountActiveSigners) if (!replacedSignerIds.has(signer.signerId)) retained.push(signer);
-		return retained;
-	}
-	signersRetiredByActivationPolicy(args) {
-		const retired = [];
-		switch (args.activationPolicy.mode) {
-			case "replace_slot":
-				for (const signer of args.accountActiveSigners) if (signer.signerSlot === args.activationPolicy.signerSlot && signer.signerId !== args.signerId) retired.push(signer);
-				return retired;
-			case "replace_profile_chain_kind":
-				for (const signer of args.allActiveSigners) if (signer.profileId === args.profileId && signer.chainIdKey === args.chainIdKey && signer.signerKind === args.activationPolicy.replacedSignerKind && signer.signerId !== args.signerId) retired.push(signer);
-				return retired;
-			default: return retired;
-		}
-	}
-	async revokeSignersForReplacement(args) {
-		const retired = this.signersRetiredByActivationPolicy(args);
-		if (retired.length === 0) return;
-		const revocationReason = normalizeTrimmedString(args.activationPolicy.mode === "replace_slot" || args.activationPolicy.mode === "replace_profile_chain_kind" ? args.activationPolicy.revocationReason : "");
-		for (const signer of retired) {
-			const revoked = this.buildAccountSignerRecord({
-				...signer,
-				status: "revoked",
-				existing: signer,
-				now: args.now,
-				removedAt: args.now,
-				revocationReason
-			});
-			this.assertSignerWriteInvariants({
-				next: revoked,
-				accountModel: args.accountModel,
-				existingStatus: signer.status,
-				activeSigners: args.accountActiveSigners
-			});
-			await args.signerStore.put(accountSignerRow(revoked));
-		}
-	}
-	async activateAccountSigner(input) {
-		let result = null;
-		await this.manager.runTransaction([
-			SEAMS_WALLET_STORES.appState,
-			SEAMS_WALLET_STORES.wallets,
-			SEAMS_WALLET_STORES.wallets,
-			SEAMS_WALLET_STORES.nearAccountProjections,
-			SEAMS_WALLET_STORES.walletSigners,
-			SEAMS_WALLET_STORES.appState,
-			SEAMS_WALLET_STORES.signerOpsOutbox
-		], "readwrite", async (ctx) => {
-			result = await this.activateAccountSignerInTransaction(ctx, input);
-		});
-		if (!result) throw new Error("[SeamsWalletDB] signer activation did not complete");
-		return result;
-	}
-	async stageAccountSigner(input) {
-		return this.writePreparedAccountSigner({
-			account: input.account,
-			signer: input.signer,
-			status: "pending",
-			signerSlot: input.signer.signerSlot,
-			mutation: input.mutation
-		});
-	}
-	async writePreparedAccountSigner(input) {
-		const profileId = normalizeTrimmedString(input.account.profileId || "");
-		const chainIdKey = normalizeIndexedDbChainIdKey(input.account.chainIdKey);
-		const accountAddress = normalizeIndexedDbAccountAddress(input.account.accountAddress);
-		const accountModel = normalizeIndexedDbAccountModel(input.account.accountModel);
-		const signerId = normalizeTrimmedString(input.signer.signerId || "");
-		const signerSlot = Number(input.signerSlot);
-		const signerKind = input.signer.signerKind;
-		const signerAuthMethod = input.signer.signerAuthMethod;
-		const signerSource = input.signer.signerSource;
-		if (!profileId || !chainIdKey || !accountAddress || !accountModel || !signerId || !signerKind || !signerAuthMethod || !signerSource) throw new Error("[SeamsWalletDB] profileId, chainIdKey, accountAddress, accountModel, signerId, signerKind, signerAuthMethod, and signerSource are required");
-		if (!Number.isSafeInteger(signerSlot) || signerSlot < 1) throw new Error("[SeamsWalletDB] signerSlot must be an integer >= 1");
-		let result = null;
-		await this.manager.runTransaction([
-			SEAMS_WALLET_STORES.wallets,
-			SEAMS_WALLET_STORES.nearAccountProjections,
-			SEAMS_WALLET_STORES.walletSigners,
-			SEAMS_WALLET_STORES.signerOpsOutbox
-		], "readwrite", async (ctx) => {
-			if (!parseProfileRow(await ctx.store(SEAMS_WALLET_STORES.wallets).get(profileId))) throw makeConstraintError("MISSING_PROFILE", `Cannot upsert signer without profile row: ${profileId}`, {
-				profileId,
-				chainIdKey,
-				accountAddress,
-				signerId
-			});
-			const chainAccountStore = ctx.store(SEAMS_WALLET_STORES.nearAccountProjections);
-			const existingChainAccount = parseChainAccountProjectionRow(await chainAccountStore.get([
-				profileId,
-				chainAccountProjectionId({
-					chainIdKey,
-					accountAddress
-				}),
-				CHAIN_ACCOUNT_PROJECTION_SIGNER_SLOT
-			]));
-			const chainAccount = chainAccountProjectionRow({
-				profileId,
-				chainIdKey,
-				accountAddress,
-				accountModel,
-				isPrimary: existingChainAccount?.isPrimary
-			}, existingChainAccount || void 0);
-			await chainAccountStore.put(chainAccount);
-			const signerStore = ctx.store(SEAMS_WALLET_STORES.walletSigners);
-			const existingSigner = parseAccountSignerRow(await signerStore.get(walletSignerId({
-				chainIdKey,
-				accountAddress,
-				signerId
-			})));
-			if (existingSigner && existingSigner.profileId !== profileId) throw makeConstraintError("CHAIN_ACCOUNT_PROFILE_MISMATCH", `Signer row belongs to a different profile for ${chainIdKey}/${accountAddress}/${signerId}`, {
-				expectedProfileId: profileId,
-				existingProfileId: existingSigner.profileId
-			});
-			const activeSigners = (await signerStore.index(SEAMS_WALLET_INDEXES.status).getAll("active")).flatMap((row) => {
-				const parsed = parseAccountSignerRow(row);
-				return parsed && parsed.chainIdKey === chainIdKey && parsed.accountAddress === accountAddress ? [parsed] : [];
-			});
-			const now = Date.now();
-			const signer = this.buildAccountSignerRecord({
-				profileId,
-				chainIdKey,
-				accountAddress,
-				signerId,
-				signerSlot,
-				signerType: input.signer.signerType,
-				signerKind,
-				signerAuthMethod,
-				signerSource,
-				status: input.status,
-				existing: existingSigner || void 0,
-				now,
-				...input.signer.metadata ? { metadata: input.signer.metadata } : {}
-			});
-			this.assertSignerWriteInvariants({
-				next: signer,
-				accountModel,
-				existingStatus: existingSigner?.status,
-				activeSigners
-			});
-			const signerRow = accountSignerRow(signer);
-			await deleteConflictingThresholdEcdsaSignerRows({
-				store: signerStore,
-				nextRow: signerRow
-			});
-			await signerStore.put(signerRow);
-			if (input.mutation?.routeThroughOutbox ?? false) {
-				const opId = normalizeTrimmedString(input.mutation?.opId || "") || createRandomToken("add-signer");
-				const idempotencyKey = normalizeTrimmedString(input.mutation?.idempotencyKey || "") || `add-signer:${signer.chainIdKey}:${signer.accountAddress}:${signer.signerId}:${signer.signerSlot}`;
-				await this.enqueueSignerOperationInTransaction(ctx.store(SEAMS_WALLET_STORES.signerOpsOutbox), {
-					opId,
-					idempotencyKey,
-					opType: "add-signer",
-					chainIdKey: signer.chainIdKey,
-					accountAddress: signer.accountAddress,
-					signerId: signer.signerId,
-					payload: this.signerOutboxPayload(signer, input.mutation),
-					status: input.mutation?.outboxStatus || "queued"
-				});
-			}
-			result = {
-				signer,
-				signerSlot
-			};
-		});
-		if (!result) throw new Error("[SeamsWalletDB] signer write did not complete");
-		return result;
-	}
-	signerOutboxPayload(signer, mutation) {
-		return {
-			profileId: signer.profileId,
-			signerSlot: signer.signerSlot,
-			signerType: signer.signerType,
-			signerKind: signer.signerKind,
-			signerAuthMethod: signer.signerAuthMethod,
-			signerSource: signer.signerSource,
-			...signer.metadata ? { signerMetadata: signer.metadata } : {},
-			...mutation?.outboxPayload ? mutation.outboxPayload : {}
-		};
-	}
-	async listAccountSigners(args) {
-		const chainIdKey = normalizeIndexedDbChainIdKey(args.chainIdKey);
-		const accountAddress = normalizeIndexedDbAccountAddress(args.accountAddress);
-		if (!chainIdKey || !accountAddress) return [];
-		const db = await this.manager.getDB();
-		return (args.status ? await db.transaction(SEAMS_WALLET_STORES.walletSigners, "readonly").store.index(SEAMS_WALLET_INDEXES.status).getAll(args.status) : await db.getAll(SEAMS_WALLET_STORES.walletSigners)).flatMap((row) => {
-			const parsed = parseAccountSignerRow(row);
-			return parsed && parsed.chainIdKey === chainIdKey && parsed.accountAddress === accountAddress ? [parsed] : [];
-		});
-	}
-	async listAccountSignersByProfile(args) {
-		const profileId = normalizeTrimmedString(args.profileId || "");
-		if (!profileId) return [];
-		return (await (await this.manager.getDB()).transaction(SEAMS_WALLET_STORES.walletSigners, "readonly").store.index(SEAMS_WALLET_INDEXES.walletId).getAll(profileId)).flatMap((row) => {
-			const parsed = parseAccountSignerRow(row);
-			return parsed && (!args.status || parsed.status === args.status) ? [parsed] : [];
-		});
-	}
-	/**
-	* The wallet's active signers, resolved from its identity — not from a guess
-	* that the wallet id is a profile key.
-	*
-	* Two local profile identities exist: the canonical wallet profile, keyed by
-	* the wallet id and carrying NEAR provisioning, and the NEAR account profile
-	* (`buildNearProfileId`), which owns the signer rows. Reading signer rows
-	* with the wallet id as the profile key answered "none" for every registered
-	* wallet, which surfaced far away as an unresolvable session identity and as
-	* ECDSA material reporting `device_link_required` on a device that was never
-	* linked.
-	*
-	* The pivot goes through branded constructors on purpose: only a NEAR
-	* account id proven by the wallet's own provisioning record can become the
-	* profile key. Rows written directly under the wallet id are still read —
-	* that is the canonical wallet profile's own signer set.
-	*/
-	async listActiveWalletSigners(args) {
-		const walletId = normalizeTrimmedString(args.walletId || "");
-		if (!walletId) return [];
-		const signerKind = args.signerFamily === "ecdsa" ? SIGNER_KINDS.thresholdEcdsa : SIGNER_KINDS.thresholdEd25519;
-		const profileIds = [walletId];
-		const provisioning = (await this.getProfile(walletId))?.nearProvisioning;
-		if (provisioning?.status === "near_ready" && provisioning.nearAccountId) profileIds.push(String(buildNearProfileId(toAccountId(provisioning.nearAccountId))));
-		const collected = [];
-		const seen = /* @__PURE__ */ new Set();
-		for (const profileId of profileIds) {
-			const signers = await this.listAccountSignersByProfile({
-				profileId,
-				status: "active"
-			});
-			for (const signer of signers) {
-				if (signer.signerKind !== signerKind) continue;
-				const metadataWalletId = normalizeTrimmedString(String(signer.metadata?.walletId ?? ""));
-				if (metadataWalletId && metadataWalletId !== walletId) continue;
-				const key = `${signer.chainIdKey}/${signer.accountAddress}/${signer.signerId}`;
-				if (seen.has(key)) continue;
-				seen.add(key);
-				collected.push(signer);
-			}
-		}
-		return collected;
-	}
-	async getActiveWalletSignerForChainTarget(args) {
-		const walletId = normalizeTrimmedString(args.walletId || "");
-		if (!walletId) return null;
-		const chainTargetKey = toIndexedDbChainTargetKey(args.chainTarget);
-		const matches = (await this.listActiveWalletSigners({
-			walletId,
-			signerFamily: "ecdsa"
-		})).filter((signer) => signer.chainIdKey === chainTargetKey);
-		if (matches.length > 1) throw new Error(`[SeamsWalletDB] ambiguous active ECDSA wallet signer for ${walletId}/${chainTargetKey}`);
-		return matches[0] || null;
-	}
-	async getAccountSigner(args) {
-		const chainIdKey = normalizeIndexedDbChainIdKey(args.chainIdKey);
-		const accountAddress = normalizeIndexedDbAccountAddress(args.accountAddress);
-		const signerId = normalizeTrimmedString(args.signerId || "");
-		if (!chainIdKey || !accountAddress || !signerId) return null;
-		return parseAccountSignerRow(await (await this.manager.getDB()).get(SEAMS_WALLET_STORES.walletSigners, walletSignerId({
-			chainIdKey,
-			accountAddress,
-			signerId
-		})));
-	}
-	async setAccountSignerStatus(args) {
-		const existing = await this.getAccountSigner(args);
-		if (!existing) return null;
-		const chainAccount = await this.getChainAccount({
-			profileId: existing.profileId,
-			chainIdKey: existing.chainIdKey,
-			accountAddress: existing.accountAddress
-		});
-		if (!chainAccount) throw makeConstraintError("MISSING_CHAIN_ACCOUNT", `Cannot update signer status without chain account row: ${existing.profileId}/${existing.chainIdKey}/${existing.accountAddress}`, {
-			profileId: existing.profileId,
-			chainIdKey: existing.chainIdKey,
-			accountAddress: existing.accountAddress,
-			signerId: existing.signerId
-		});
-		let updated = null;
-		await this.manager.runTransaction([SEAMS_WALLET_STORES.walletSigners, SEAMS_WALLET_STORES.signerOpsOutbox], "readwrite", async (ctx) => {
-			const signerStore = ctx.store(SEAMS_WALLET_STORES.walletSigners);
-			const activeSigners = (await signerStore.index(SEAMS_WALLET_INDEXES.status).getAll("active")).flatMap((row) => {
-				const parsed = parseAccountSignerRow(row);
-				return parsed && parsed.chainIdKey === existing.chainIdKey && parsed.accountAddress === existing.accountAddress ? [parsed] : [];
-			});
-			const next = this.buildAccountSignerRecord({
-				...existing,
-				status: args.status,
-				existing,
-				now: Date.now(),
-				...args.removedAt != null ? { removedAt: args.removedAt } : {},
-				...args.revocationReason ? { revocationReason: args.revocationReason } : {}
-			});
-			this.assertSignerWriteInvariants({
-				next,
-				accountModel: chainAccount.accountModel,
-				existingStatus: existing.status,
-				activeSigners
-			});
-			await signerStore.put(accountSignerRow(next));
-			if (args.mutation?.routeThroughOutbox ?? true) {
-				const opType = args.status === "revoked" ? "revoke-signer" : "add-signer";
-				const opId = normalizeTrimmedString(args.mutation?.opId || "") || createRandomToken(opType);
-				const idempotencyKey = normalizeTrimmedString(args.mutation?.idempotencyKey || "") || `signer-status:${args.status}:${next.chainIdKey}:${next.accountAddress}:${next.signerId}`;
-				await this.enqueueSignerOperationInTransaction(ctx.store(SEAMS_WALLET_STORES.signerOpsOutbox), {
-					opId,
-					idempotencyKey,
-					opType,
-					chainIdKey: next.chainIdKey,
-					accountAddress: next.accountAddress,
-					signerId: next.signerId,
-					payload: {
-						profileId: next.profileId,
-						signerSlot: next.signerSlot,
-						status: next.status,
-						...next.removedAt != null ? { removedAt: next.removedAt } : {},
-						...next.revocationReason ? { revocationReason: next.revocationReason } : {},
-						...args.mutation?.outboxPayload ? args.mutation.outboxPayload : {}
-					},
-					status: args.mutation?.outboxStatus || "queued"
-				});
-			}
-			updated = next;
-		});
-		return updated;
-	}
-	async enqueueSignerOperation(input) {
-		let record = null;
-		await this.manager.runTransaction([SEAMS_WALLET_STORES.signerOpsOutbox], "readwrite", async (ctx) => {
-			record = await this.enqueueSignerOperationInTransaction(ctx.store(SEAMS_WALLET_STORES.signerOpsOutbox), input);
-		});
-		if (!record) throw new Error("[SeamsWalletDB] signer op enqueue did not complete");
-		return record;
-	}
-	async listSignerOperations(args) {
-		const statuses = args?.statuses && args.statuses.length > 0 ? args.statuses : [
-			"queued",
-			"submitted",
-			"failed"
-		];
-		const dueBeforeRaw = typeof args?.dueBefore === "number" ? args.dueBefore : Date.now();
-		const dueBefore = Number.isFinite(dueBeforeRaw) ? dueBeforeRaw : Number.MAX_SAFE_INTEGER;
-		const limit = Number.isSafeInteger(args?.limit) && Number(args?.limit) > 0 ? Number(args?.limit) : 100;
-		const db = await this.manager.getDB();
-		const collected = [];
-		for (const status of statuses) {
-			const tx = db.transaction(SEAMS_WALLET_STORES.signerOpsOutbox, "readonly");
-			const rows = await tx.store.index(SEAMS_WALLET_INDEXES.statusNextAttemptAt).getAll(IDBKeyRange.bound([status, Number.MIN_SAFE_INTEGER], [status, dueBefore]));
-			await tx.done;
-			collected.push(...(rows || []).flatMap((row) => {
-				const parsed = parseSignerOutboxRow(row);
-				return parsed ? [parsed] : [];
-			}));
-		}
-		collected.sort((a, b) => {
-			const timeDelta = (a.nextAttemptAt || 0) - (b.nextAttemptAt || 0);
-			if (timeDelta !== 0) return timeDelta;
-			return String(a.opId || "").localeCompare(String(b.opId || ""));
-		});
-		return collected.slice(0, limit);
-	}
-	async setSignerOperationStatus(args) {
-		const opId = normalizeTrimmedString(args.opId || "");
-		if (!opId) return null;
-		let updated = null;
-		await this.manager.runTransaction([SEAMS_WALLET_STORES.signerOpsOutbox], "readwrite", async (ctx) => {
-			const store = ctx.store(SEAMS_WALLET_STORES.signerOpsOutbox);
-			const existing = parseSignerOutboxRow(await store.get(opId));
-			if (!existing) return;
-			const attemptDelta = Number.isFinite(args.attemptDelta) ? Number(args.attemptDelta) : 0;
-			const attemptCount = Math.max(0, (existing.attemptCount || 0) + attemptDelta);
-			const next = {
-				...existing,
-				status: args.status,
-				attemptCount,
-				nextAttemptAt: typeof args.nextAttemptAt === "number" ? args.nextAttemptAt : existing.nextAttemptAt,
-				...args.lastError === null ? { lastError: void 0 } : typeof args.lastError === "string" ? { lastError: args.lastError } : { lastError: existing.lastError },
-				...args.txHash === null ? { txHash: void 0 } : typeof args.txHash === "string" ? { txHash: args.txHash } : { txHash: existing.txHash },
-				updatedAt: Date.now()
-			};
-			await store.put(signerOutboxRow(next));
-			updated = next;
-		});
-		return updated;
-	}
-	async getProfileContinuitySnapshot(profileId) {
-		const profile = await this.getProfile(profileId);
-		if (!profile) return null;
-		return {
-			profile,
-			chainAccounts: await this.listChainAccountsByProfile(profile.profileId),
-			accountSigners: await this.listAccountSignersByProfile({ profileId: profile.profileId })
-		};
-	}
-	async listProfileAuthenticators(profileId) {
-		const normalizedProfileId = normalizeTrimmedString(profileId || "");
-		if (!normalizedProfileId) return [];
-		const tx = (await this.manager.getDB()).transaction(SEAMS_WALLET_STORES.walletAuthMethods, "readonly");
-		const rows = await tx.store.index(SEAMS_WALLET_INDEXES.walletIdKind).getAll([normalizedProfileId, "passkey"]);
-		await tx.done;
-		return rows.flatMap((row) => {
-			const parsed = parseAuthenticatorRow(row);
-			return parsed ? [parsed] : [];
-		});
-	}
-	async listWalletPasskeyAuthenticators(walletId) {
-		const own = await this.listProfileAuthenticators(walletId);
-		const provisioning = (await this.getProfile(walletId))?.nearProvisioning;
-		if (provisioning?.status !== "near_ready" || !provisioning.nearAccountId) return own;
-		const nearProfileId = String(buildNearProfileId(toAccountId(provisioning.nearAccountId)));
-		if (nearProfileId === walletId) return own;
-		const nearRows = await this.listProfileAuthenticators(nearProfileId);
-		const seen = new Set(own.map((record) => record.credentialId));
-		return [...own, ...nearRows.filter((record) => !seen.has(record.credentialId))];
-	}
-	async getWalletPasskeyAuthenticator(args) {
-		const credentialId = normalizeTrimmedString(args.credentialId || "");
-		if (!credentialId) return null;
-		return (await this.listWalletPasskeyAuthenticators(args.walletId)).find((record) => record.credentialId === credentialId) ?? null;
-	}
-	async upsertProfileAuthenticator(record) {
-		const normalized = normalizeAuthenticatorRecord(record);
-		await this.manager.runTransaction([SEAMS_WALLET_STORES.wallets, SEAMS_WALLET_STORES.walletAuthMethods], "readwrite", async (ctx) => {
-			if (!parseProfileRow(await ctx.store(SEAMS_WALLET_STORES.wallets).get(normalized.profileId))) throw makeConstraintError("MISSING_PROFILE", `Cannot upsert authenticator for unknown profile: ${normalized.profileId}`, {
-				profileId: normalized.profileId,
-				credentialId: normalized.credentialId
-			});
-			const store = ctx.store(SEAMS_WALLET_STORES.walletAuthMethods);
-			const existing = parseWalletAuthMethodStorageRow(await store.index(SEAMS_WALLET_INDEXES.passkeyRpIdCredentialId).get([
-				"passkey",
-				DEFAULT_WALLET_RP_ID,
-				normalized.credentialId
-			]));
-			const row = walletAuthMethodRowFromAuthenticator(normalized, existing?.kind === "passkey" ? existing : void 0);
-			await store.put(row);
-		});
-	}
-	async getProfileAuthenticatorByCredentialId(profileId, credentialId) {
-		const normalizedProfileId = normalizeTrimmedString(profileId || "");
-		const normalizedCredentialId = normalizeTrimmedString(credentialId || "");
-		if (!normalizedProfileId || !normalizedCredentialId) return null;
-		const row = parseAuthenticatorRow(await (await this.manager.getDB()).transaction(SEAMS_WALLET_STORES.walletAuthMethods, "readonly").store.index(SEAMS_WALLET_INDEXES.passkeyRpIdCredentialId).get([
-			"passkey",
-			DEFAULT_WALLET_RP_ID,
-			normalizedCredentialId
-		]));
-		return row?.profileId === normalizedProfileId ? row : null;
-	}
-	async persistWalletRegistrationFinalize(input) {
-		return this.manager.runTransaction(WALLET_REGISTRATION_FINALIZE_STORES, "readwrite", this.persistWalletRegistrationFinalizeInTransaction.bind(this, input));
-	}
-	async publishPendingWalletRegistrationCommit(input) {
-		return await this.publishPendingWalletRegistrationCommitWithDisposition(input, true);
-	}
-	async publishPendingWalletRegistrationCommitAndRetain(input) {
-		return await this.publishPendingWalletRegistrationCommitWithDisposition(input, false);
-	}
-	async publishPendingWalletRegistrationCommitWithDisposition(input, deletePending) {
-		const pending = buildPendingWalletRegistrationCommitV1(input.pending);
-		const authority = parseWalletAuthAuthority(input.authority);
-		if (!authority) throw new Error("registration wallet auth authority is invalid");
-		const foundingAuthority = validateFoundingWalletAuthorityInput(input.foundingAuthority);
-		await assertRegistrationFinalizeMatchesPending({
-			request: input.request,
-			pending,
-			authority,
-			foundingAuthority,
-			registration: input.registration
-		});
-		const walletSession = input.walletSessionPublication.walletSession;
-		if (walletSession.walletId !== pending.walletId || walletSession.authorityId !== foundingAuthority.authority.authorityId || walletSession.authMethodId !== pending.walletAuthMethodId || walletSession.authorityDigestB64u !== foundingAuthority.authority.authorityDigestB64u || walletSession.authorityRevocationEpoch !== foundingAuthority.authority.revocationEpoch) throw new Error("registration Wallet Session identity does not match the pending wallet");
-		return this.manager.runTransaction(WALLET_REGISTRATION_PUBLICATION_STORES, "readwrite", this.publishPendingWalletRegistrationCommitInTransaction.bind(this, {
-			request: input.request,
-			pending,
-			authority,
-			foundingAuthority,
-			registration: input.registration,
-			ecdsaContinuity: input.ecdsaContinuity,
-			walletSessionPublication: input.walletSessionPublication,
-			deletePending
-		}));
-	}
-	async publishPendingWalletRecoveryCommit(input) {
-		const pending = await buildPendingWalletRecoveryCommitV1(input.pending);
-		if (pending.stage !== "server_promoted") throw new Error("pending wallet recovery commit is not server-promoted");
-		const authority = requireBoundaryParsed(parseWalletAuthorityV1(input.authority), "authority");
-		if (authority.state !== "active" || !isActiveRecoveredWalletAuthorityV1(authority)) throw new Error("recovered Wallet Authority projection is invalid");
-		const authMethod = parseWalletAuthMethodRecordV2(input.authMethod);
-		if (!authMethod || authMethod.status !== "active") throw new Error("recovered Wallet Auth Method projection is invalid");
-		if (!await walletAuthorityDigestsMatchV1(authority)) throw new Error("recovered Wallet Authority digest is invalid");
-		const normalizedInput = {
-			pending,
-			authority,
-			authMethod,
-			registration: input.registration,
-			ecdsaContinuity: input.ecdsaContinuity,
-			ed25519PublicCapabilityReferences: input.ed25519PublicCapabilityReferences
-		};
-		assertPendingWalletRecoveryPublicationMatchesProjection(normalizedInput);
-		const pendingRow = await toPendingWalletRecoveryCommitAppStateRow(pending);
-		return this.manager.runTransaction(WALLET_RECOVERY_PUBLICATION_STORES, "readwrite", this.publishPendingWalletRecoveryCommitInTransaction.bind(this, {
-			...normalizedInput,
-			pendingRow
-		}));
-	}
-	async publishPendingWalletRegistrationCommitInTransaction(input, ctx) {
-		const pendingKey = pendingWalletRegistrationCommitAppStateKey({
-			registrationCeremonyId: input.request.registrationCeremonyId,
-			operation: input.request.operation
-		});
-		const storedPendingRow = parsePendingWalletRegistrationCommitAppStateRow(await ctx.store(SEAMS_WALLET_STORES.appState).get(pendingKey));
-		const storedPending = storedPendingRow?.record;
-		if (storedPending) assertPendingWalletRegistrationRequestIdentity(storedPending, input.request);
-		if (!storedPendingRow || !storedPending || storedPendingRow?.registration_ceremony_id !== input.request.registrationCeremonyId || storedPendingRow.operation !== input.request.operation || storedPendingRow.wallet_id !== input.request.walletId || storedPendingRow.wallet_auth_method_id !== input.request.walletAuthMethodId || storedPendingRow.updated_at_ms !== input.pending.updatedAtMs || storedPending.idempotencyKey !== input.pending.idempotencyKey || storedPending.signerPlanKind !== input.pending.signerPlanKind) throw new Error("stored pending wallet registration commit does not match the expected row");
-		let credentialFreeSessionReconciled = false;
-		if (input.walletSessionPublication.kind === "issued") await replaceExactActiveWalletSessionAuthorizationInTransaction({
-			ctx,
-			active: input.walletSessionPublication.walletSession,
-			operationCredential: input.walletSessionPublication.operationCredential
-		});
-		else {
-			const existingSession = await readExactActiveWalletSessionForScopeInTransaction({
-				ctx,
-				walletId: input.pending.walletId,
-				authorityId: input.foundingAuthority.authority.authorityId,
-				authMethodId: input.pending.walletAuthMethodId
-			});
-			if (existingSession.kind !== "found") throw new Error("Credential-free registration projection has no exact local Wallet Session");
-			assertCredentialFreeRegistrationSessionProjectionMatchesExisting({
-				incoming: input.walletSessionPublication.walletSession,
-				existing: existingSession.record
-			});
-			await replaceExactActiveWalletSessionAuthorizationInTransaction({
-				ctx,
-				active: input.walletSessionPublication.walletSession,
-				operationCredential: existingSession.operationCredential
-			});
-			credentialFreeSessionReconciled = true;
-		}
-		const result = await this.persistWalletRegistrationFinalizeInTransaction(input.registration, ctx);
-		await this.persistFoundingWalletAuthorityInTransaction(input.foundingAuthority, input.walletSessionPublication.kind === "credential_free_projection" ? "preserve" : "activate", ctx);
-		for (const continuity of input.ecdsaContinuity) await persistPreparedImportedWalletCustodyEcdsaContinuityInTransaction(ctx, continuity);
-		if (input.deletePending && (input.walletSessionPublication.kind === "issued" ? shouldDeletePublishedPendingWalletRegistrationCommit(input.pending) : credentialFreeSessionReconciled)) await ctx.store(SEAMS_WALLET_STORES.appState).delete(pendingKey);
-		return result;
-	}
-	async publishPendingWalletRecoveryCommitInTransaction(input, ctx) {
-		if (!pendingWalletRecoveryCommitAppStateRowsMatch(await ctx.store(SEAMS_WALLET_STORES.appState).get(input.pendingRow.key), input.pendingRow)) throw new Error("stored pending wallet recovery commit does not match the expected row");
-		const result = await this.persistWalletRegistrationFinalizeInTransaction(input.registration, ctx);
-		await this.persistRecoveredWalletAuthorityInTransaction({
-			authority: input.authority,
-			authMethod: input.authMethod,
-			recoveredAtMs: input.pending.updatedAtMs
-		}, ctx);
-		await deleteRowsByIndex({
-			store: ctx.store(SEAMS_WALLET_STORES.ecdsaClientPresignatures),
-			indexName: SEAMS_WALLET_INDEXES.walletId,
-			key: IDBKeyRange.only(String(input.authority.walletId))
-		});
-		for (const continuity of input.ecdsaContinuity) await persistPreparedImportedWalletCustodyEcdsaContinuityInTransaction(ctx, continuity);
-		const appStateStore = ctx.store(SEAMS_WALLET_STORES.appState);
-		for (const reference of input.ed25519PublicCapabilityReferences) await upsertEd25519YaoPublicCapabilityReferenceInTransaction(appStateStore, reference);
-		await ctx.store(SEAMS_WALLET_STORES.appState).delete(input.pendingRow.key);
-		return result;
-	}
-	async persistWalletRegistrationFinalizeInTransaction(input, ctx) {
-		const authMethodRows = walletAuthMethodRowsForRegistrationFinalize(input);
-		const keyMaterialRows = input.keyMaterials.map((keyMaterial) => keyMaterialRow(keyMaterial));
-		const signerActivations = [];
-		const profileStore = ctx.store(SEAMS_WALLET_STORES.wallets);
-		for (const profile of input.profiles) {
-			const profileId = normalizeTrimmedString(profile.profileId || "");
-			if (!profileId) throw new Error("[SeamsWalletDB] profileId is required");
-			const existing = parseProfileRow(await profileStore.get(profileId)) || void 0;
-			await profileStore.put(profileRow(profile, existing));
-		}
-		const authMethodStore = ctx.store(SEAMS_WALLET_STORES.walletAuthMethods);
-		for (const row of authMethodRows) {
-			if (!parseProfileRow(await profileStore.get(row.wallet_id))) throw makeConstraintError("MISSING_PROFILE", `Cannot upsert auth method for unknown wallet: ${row.wallet_id}`, {
-				profileId: row.wallet_id,
-				authIdentifierKey: row.auth_identifier_key
-			});
-			await authMethodStore.put(row);
-		}
-		for (const activation of input.signerActivations) signerActivations.push(await this.activateAccountSignerInTransaction(ctx, activation));
-		await assertSignerKeyMaterialPairsInTransaction({
-			ctx,
-			signers: signerActivations.map((activation) => activation.signer),
-			keyMaterials: input.keyMaterials
-		});
-		const keyMaterialStore = ctx.store(SEAMS_WALLET_STORES.keyMaterial);
-		for (const row of keyMaterialRows) await keyMaterialStore.put(row);
-		if (input.lastProfileState) await ctx.store(SEAMS_WALLET_STORES.appState).put({
-			key: scopedLastProfileStateAppStateKey(input.lastProfileState.scope),
-			value: {
-				profileId: input.lastProfileState.profileId,
-				activeSignerSlot: input.lastProfileState.activeSignerSlot,
-				...input.lastProfileState.scope ? { scope: normalizeLastUserScope(input.lastProfileState.scope) } : {}
-			}
-		});
-		return { signerActivations };
-	}
-	async persistWalletSignerFinalize(input) {
-		const keyMaterialRows = input.keyMaterials.map((keyMaterial) => keyMaterialRow(keyMaterial));
-		const signerActivations = [];
-		const profiles = [];
-		let lastProfileState = null;
-		await this.manager.runTransaction([
-			SEAMS_WALLET_STORES.appState,
-			SEAMS_WALLET_STORES.wallets,
-			SEAMS_WALLET_STORES.walletSigners,
-			SEAMS_WALLET_STORES.nearAccountProjections,
-			SEAMS_WALLET_STORES.signerOpsOutbox,
-			SEAMS_WALLET_STORES.keyMaterial
-		], "readwrite", async (ctx) => {
-			const profileStore = ctx.store(SEAMS_WALLET_STORES.wallets);
-			if (input.lastProfileState) {
-				const appStateStore = ctx.store(SEAMS_WALLET_STORES.appState);
-				const key = scopedLastProfileStateAppStateKey(input.lastProfileState.scope);
-				const previousRow = parseAppStateRow(await appStateStore.get(key));
-				lastProfileState = {
-					key,
-					committed: {
-						profileId: input.lastProfileState.profileId,
-						activeSignerSlot: input.lastProfileState.activeSignerSlot,
-						...input.lastProfileState.scope ? { scope: normalizeLastUserScope(input.lastProfileState.scope) } : {}
-					},
-					previousPresent: previousRow !== null,
-					previousValue: previousRow?.value
-				};
-			}
-			for (const profile of input.profiles) {
-				const profileId = normalizeTrimmedString(profile.profileId || "");
-				if (!profileId) throw new Error("[SeamsWalletDB] profileId is required");
-				const existing = parseProfileRow(await profileStore.get(profileId));
-				const committedRow = profileRow(profile, existing || void 0);
-				await profileStore.put(committedRow);
-				profiles.push({
-					committed: committedRow.record,
-					previous: existing
-				});
-			}
-			for (const activation of input.signerActivations) signerActivations.push(await this.activateAccountSignerInTransaction(ctx, activation));
-			await assertSignerKeyMaterialPairsInTransaction({
-				ctx,
-				signers: signerActivations.map((activation) => activation.signer),
-				keyMaterials: input.keyMaterials
-			});
-			const keyMaterialStore = ctx.store(SEAMS_WALLET_STORES.keyMaterial);
-			for (const row of keyMaterialRows) await keyMaterialStore.put(row);
-			if (input.lastProfileState) {
-				const appStateStore = ctx.store(SEAMS_WALLET_STORES.appState);
-				if (!lastProfileState) throw new Error("[SeamsWalletDB] last profile rollback state was not captured");
-				await appStateStore.put({
-					key: lastProfileState.key,
-					value: lastProfileState.committed
-				});
-			}
-		});
-		return {
-			signerActivations,
-			rollbackReceipt: {
-				kind: "wallet_signer_finalize_rollback_v1",
-				profiles,
-				signers: signerActivations.map((activation) => ({
-					committed: activation.signer,
-					metadataBaseline: accountSignerRollbackMetadataBaseline(activation.signer.metadata)
-				})),
-				keyMaterials: keyMaterialRows.map((row) => ({
-					committed: row.record,
-					payloadBaseline: keyMaterialRollbackPayloadBaseline(row.record.payload)
-				})),
-				lastProfileState
-			}
-		};
-	}
-	async rollbackWalletSignerFinalize(receipt) {
-		if (receipt.kind !== "wallet_signer_finalize_rollback_v1") throw new Error("[SeamsWalletDB] invalid wallet signer rollback receipt");
-		await this.manager.runTransaction([
-			SEAMS_WALLET_STORES.appState,
-			SEAMS_WALLET_STORES.wallets,
-			SEAMS_WALLET_STORES.walletSigners,
-			SEAMS_WALLET_STORES.keyMaterial
-		], "readwrite", async (ctx) => {
-			const profileStore = ctx.store(SEAMS_WALLET_STORES.wallets);
-			const signerStore = ctx.store(SEAMS_WALLET_STORES.walletSigners);
-			const keyMaterialStore = ctx.store(SEAMS_WALLET_STORES.keyMaterial);
-			const appStateStore = ctx.store(SEAMS_WALLET_STORES.appState);
-			for (const profile of receipt.profiles) {
-				const current = parseProfileRow(await profileStore.get(profile.committed.profileId));
-				if (current === null || !profileRecordsMatch(current, profile.committed)) throw new Error("[SeamsWalletDB] wallet signer rollback profile changed");
-			}
-			for (const signerEntry of receipt.signers) {
-				const signer = signerEntry.committed;
-				const id = walletSignerId({
-					chainIdKey: signer.chainIdKey,
-					accountAddress: signer.accountAddress,
-					signerId: signer.signerId
-				});
-				const current = parseAccountSignerRow(await signerStore.get(id));
-				if (current === null || !accountSignerRollbackRecordsMatch(current, signer, signerEntry.metadataBaseline)) throw new Error("[SeamsWalletDB] wallet signer rollback signer changed");
-			}
-			for (const keyMaterialEntry of receipt.keyMaterials) {
-				const keyMaterial = keyMaterialEntry.committed;
-				const id = keyMaterialId({
-					walletSignerId: walletSignerIdForKeyMaterial(keyMaterial),
-					keyKind: keyMaterial.keyKind
-				});
-				const current = parseKeyMaterialRow(await keyMaterialStore.get(id));
-				if (current === null || !keyMaterialRollbackRecordsMatch(current, keyMaterial, keyMaterialEntry.payloadBaseline)) throw new Error("[SeamsWalletDB] wallet signer rollback key material changed");
-			}
-			if (receipt.lastProfileState) {
-				const current = parseLastProfileState(parseAppStateRow(await appStateStore.get(receipt.lastProfileState.key))?.value);
-				if (current === null || !lastProfileStatesMatch(current, receipt.lastProfileState.committed)) throw new Error("[SeamsWalletDB] wallet signer rollback selection changed");
-			}
-			for (const signerEntry of receipt.signers) {
-				const signer = signerEntry.committed;
-				await signerStore.delete(walletSignerId({
-					chainIdKey: signer.chainIdKey,
-					accountAddress: signer.accountAddress,
-					signerId: signer.signerId
-				}));
-			}
-			for (const keyMaterialEntry of receipt.keyMaterials) {
-				const keyMaterial = keyMaterialEntry.committed;
-				await keyMaterialStore.delete(keyMaterialId({
-					walletSignerId: walletSignerIdForKeyMaterial(keyMaterial),
-					keyKind: keyMaterial.keyKind
-				}));
-			}
-			for (const profile of receipt.profiles) if (profile.previous) await profileStore.put(profileRowFromRecord(profile.previous));
-			else await profileStore.delete(profile.committed.profileId);
-			if (receipt.lastProfileState) if (receipt.lastProfileState.previousPresent) await appStateStore.put({
-				key: receipt.lastProfileState.key,
-				value: receipt.lastProfileState.previousValue
-			});
-			else await appStateStore.delete(receipt.lastProfileState.key);
-		});
-	}
-	async clearProfileAuthenticators(profileId) {
-		const normalizedProfileId = normalizeTrimmedString(profileId || "");
-		if (!normalizedProfileId) return;
-		await this.manager.runTransaction([SEAMS_WALLET_STORES.walletAuthMethods], "readwrite", async (ctx) => {
-			let cursor = await ctx.store(SEAMS_WALLET_STORES.walletAuthMethods).index(SEAMS_WALLET_INDEXES.walletIdKind).openCursor(IDBKeyRange.only([normalizedProfileId, "passkey"]));
-			while (cursor) {
-				await cursor.delete();
-				cursor = await cursor.continue();
-			}
-		});
-	}
-	async selectProfileAuthenticatorsForPrompt(args) {
-		const profileId = normalizeTrimmedString(args.profileId || "");
-		const authenticators = Array.isArray(args.authenticators) ? args.authenticators : [];
-		if (!profileId || authenticators.length <= 1) return { authenticatorsForPrompt: authenticators };
-		const lastProfileState = await this.getLastProfileState().catch(() => null);
-		if (!lastProfileState) return { authenticatorsForPrompt: authenticators };
-		const expectedSignerSlot = Number(lastProfileState.activeSignerSlot);
-		const bySignerSlot = authenticators.filter((authenticator) => {
-			return authenticator.signerSlot === expectedSignerSlot;
-		});
-		const expectedCredentialId = normalizeTrimmedString(bySignerSlot[0]?.credentialId || authenticators[0]?.credentialId || "");
-		const byCredentialId = expectedCredentialId ? authenticators.filter((authenticator) => authenticator.credentialId === expectedCredentialId) : [];
-		const authenticatorsForPrompt = byCredentialId.length > 0 ? byCredentialId : bySignerSlot.length > 0 ? bySignerSlot : authenticators;
-		const selectedCredentialRawId = normalizeTrimmedString(args.selectedCredentialRawId || "");
-		const accountLabel = normalizeTrimmedString(args.accountLabel || profileId);
-		return {
-			authenticatorsForPrompt,
-			wrongPasskeyError: selectedCredentialRawId && expectedCredentialId && selectedCredentialRawId !== expectedCredentialId ? `You have multiple passkeys for account ${accountLabel}, but used a different passkey than the most recently logged-in one. Please use the passkey for the most recently active signer.` : void 0
-		};
-	}
-	async updatePreferences(args) {
-		const profileId = normalizeTrimmedString(args.profileId || "");
-		if (!profileId) return null;
-		let updatedPreferences = null;
-		await this.manager.runTransaction([SEAMS_WALLET_STORES.wallets], "readwrite", async (ctx) => {
-			const store = ctx.store(SEAMS_WALLET_STORES.wallets);
-			const profile = parseProfileRow(await store.get(profileId));
-			if (!profile) return;
-			updatedPreferences = {
-				...profile.preferences || {},
-				...args.preferences
-			};
-			const next = profileRow({
-				profileId: profile.profileId,
-				defaultSignerSlot: profile.defaultSignerSlot,
-				preferences: updatedPreferences,
-				...profile.passkeyCredential ? { passkeyCredential: profile.passkeyCredential } : {}
-			}, profile);
-			await store.put(next);
-		});
-		return updatedPreferences;
-	}
-	async updateWalletPreferences(args) {
-		const walletId = normalizeTrimmedString(args.walletId || "");
-		if (!walletId) return null;
-		return await this.updatePreferences({
-			profileId: walletId,
-			preferences: args.preferences
-		});
-	}
-	async deleteProfileData(profileId, scope) {
-		const normalizedProfileId = normalizeTrimmedString(profileId || "");
-		if (!normalizedProfileId) return;
-		await this.manager.runTransaction([
-			SEAMS_WALLET_STORES.appState,
-			SEAMS_WALLET_STORES.wallets,
-			SEAMS_WALLET_STORES.walletAuthMethods,
-			SEAMS_WALLET_STORES.walletSigners,
-			SEAMS_WALLET_STORES.nearAccountProjections,
-			SEAMS_WALLET_STORES.signerOpsOutbox,
-			SEAMS_WALLET_STORES.keyMaterial,
-			SEAMS_WALLET_STORES.ecdsaClientPresignatures
-		], "readwrite", async (ctx) => {
-			const appStateStore = ctx.store(SEAMS_WALLET_STORES.appState);
-			if (parseLastProfileState((await appStateStore.get(scopedLastProfileStateAppStateKey()))?.value)?.profileId === normalizedProfileId) await appStateStore.put({
-				key: scopedLastProfileStateAppStateKey(),
-				value: null
-			});
-			const scopedKey = scopedLastProfileStateAppStateKey(scope);
-			if (scopedKey !== scopedLastProfileStateAppStateKey()) {
-				if (parseLastProfileState((await appStateStore.get(scopedKey))?.value)?.profileId === normalizedProfileId) await appStateStore.put({
-					key: scopedKey,
-					value: null
-				});
-			}
-			await ctx.store(SEAMS_WALLET_STORES.wallets).delete(normalizedProfileId);
-			await deleteRowsByIndex({
-				store: ctx.store(SEAMS_WALLET_STORES.walletAuthMethods),
-				indexName: SEAMS_WALLET_INDEXES.walletId,
-				key: IDBKeyRange.only(normalizedProfileId)
-			});
-			await deleteRowsByIndex({
-				store: ctx.store(SEAMS_WALLET_STORES.walletSigners),
-				indexName: SEAMS_WALLET_INDEXES.walletId,
-				key: IDBKeyRange.only(normalizedProfileId)
-			});
-			await deleteRowsByIndex({
-				store: ctx.store(SEAMS_WALLET_STORES.nearAccountProjections),
-				indexName: SEAMS_WALLET_INDEXES.profileId,
-				key: IDBKeyRange.only(normalizedProfileId)
-			});
-			await deleteRowsByIndex({
-				store: ctx.store(SEAMS_WALLET_STORES.signerOpsOutbox),
-				indexName: SEAMS_WALLET_INDEXES.walletId,
-				key: IDBKeyRange.only(normalizedProfileId)
-			});
-			await deleteRowsByIndex({
-				store: ctx.store(SEAMS_WALLET_STORES.keyMaterial),
-				indexName: SEAMS_WALLET_INDEXES.walletId,
-				key: IDBKeyRange.only(normalizedProfileId)
-			});
-			await deleteRowsByIndex({
-				store: ctx.store(SEAMS_WALLET_STORES.ecdsaClientPresignatures),
-				indexName: SEAMS_WALLET_INDEXES.walletId,
-				key: IDBKeyRange.only(normalizedProfileId)
-			});
-		});
-	}
-	async getLastProfileState(scope) {
-		const key = scopedLastProfileStateAppStateKey(scope);
-		return parseLastProfileState(await this.getAppState(key).catch(() => void 0));
-	}
-	async setLastProfileState(state, scope) {
-		const key = scopedLastProfileStateAppStateKey(scope);
-		const normalizedState = state ? parseLastProfileState(state) : null;
-		if (state && !normalizedState) throw new Error("[SeamsWalletDB] invalid last profile state");
-		await this.setAppState(key, normalizedState);
-	}
-	async setLastProfileStateForProfile(profileId, activeSignerSlot, scope) {
-		const normalizedProfileId = normalizeTrimmedString(profileId || "");
-		const normalizedActiveSignerSlot = Number(activeSignerSlot);
-		if (!normalizedProfileId) throw new Error("[SeamsWalletDB] profileId is required");
-		if (!Number.isSafeInteger(normalizedActiveSignerSlot) || normalizedActiveSignerSlot < 1) throw new Error("[SeamsWalletDB] activeSignerSlot must be an integer >= 1");
-		const normalizedScope = normalizeLastUserScope(scope);
-		await this.setLastProfileState({
-			profileId: normalizedProfileId,
-			activeSignerSlot: normalizedActiveSignerSlot,
-			...normalizedScope ? { scope: normalizedScope } : {}
-		}, normalizedScope);
-	}
-	async clearLastProfileSelection(scope) {
-		await this.setLastProfileState(null, scope);
-	}
-	async storeKeyMaterial(data) {
-		const row = keyMaterialRow(data);
-		await this.manager.runTransaction([SEAMS_WALLET_STORES.keyMaterial], "readwrite", async (ctx) => {
-			await ctx.store(SEAMS_WALLET_STORES.keyMaterial).put(row);
-		});
-	}
-	async getKeyMaterial(profileId, signerSlot, chainIdKey, keyKind) {
-		const normalizedProfileId = normalizeTrimmedString(profileId || "");
-		const normalizedChainIdKey = normalizeTrimmedString(chainIdKey || "").toLowerCase();
-		const normalizedKeyKind = normalizeTrimmedString(keyKind || "");
-		if (!normalizedProfileId || !normalizedChainIdKey || !normalizedKeyKind) return null;
-		let selected = null;
-		await this.manager.runTransaction([SEAMS_WALLET_STORES.keyMaterial, SEAMS_WALLET_STORES.walletSigners], "readonly", async (ctx) => {
-			const matches = (await ctx.store(SEAMS_WALLET_STORES.keyMaterial).index(SEAMS_WALLET_INDEXES.walletId).getAll(normalizedProfileId)).flatMap((row) => {
-				const parsed = parseKeyMaterialRow(row);
-				return parsed && parsed.signerSlot === signerSlot && parsed.chainIdKey === normalizedChainIdKey && parsed.keyKind === normalizedKeyKind ? [parsed] : [];
-			});
-			if (matches.length === 0) {
-				selected = null;
-				return;
-			}
-			selected = selectKeyMaterialForRead({
-				matches,
-				activeSigners: (await ctx.store(SEAMS_WALLET_STORES.walletSigners).index(SEAMS_WALLET_INDEXES.walletId).getAll(normalizedProfileId)).flatMap((row) => {
-					const parsed = parseAccountSignerRow(row);
-					return parsed?.status === "active" && parsed.signerSlot === signerSlot && parsed.chainIdKey === normalizedChainIdKey ? [parsed] : [];
-				})
-			});
-		});
-		return selected;
-	}
-	async listKeyMaterialByProfile(profileId, chainIdKey) {
-		const normalizedProfileId = normalizeTrimmedString(profileId || "");
-		const normalizedChainIdKey = normalizeTrimmedString(chainIdKey || "").toLowerCase();
-		if (!normalizedProfileId) return [];
-		const tx = (await this.manager.getDB()).transaction(SEAMS_WALLET_STORES.keyMaterial, "readonly");
-		const rows = await tx.store.index(SEAMS_WALLET_INDEXES.walletId).getAll(normalizedProfileId);
-		await tx.done;
-		const records = rows.flatMap((row) => {
-			const parsed = parseKeyMaterialRow(row);
-			return parsed ? [parsed] : [];
-		});
-		if (!normalizedChainIdKey) return records;
-		return records.filter((record) => record.chainIdKey === normalizedChainIdKey);
-	}
-	async listKeyMaterialByProfileAndSignerSlot(profileId, signerSlot, chainIdKey) {
-		if (!Number.isSafeInteger(signerSlot) || signerSlot < 1) return [];
-		return (await this.listKeyMaterialByProfile(profileId, chainIdKey)).filter((record) => record.signerSlot === signerSlot);
-	}
-	async deleteKeyMaterial(profileId, signerSlot, chainIdKey, keyKind) {
-		const normalizedProfileId = normalizeTrimmedString(profileId || "");
-		const normalizedChainIdKey = normalizeTrimmedString(chainIdKey || "").toLowerCase();
-		const normalizedKeyKind = normalizeTrimmedString(keyKind || "");
-		if (!normalizedProfileId || !normalizedChainIdKey || !normalizedKeyKind) return;
-		if (!Number.isSafeInteger(signerSlot) || signerSlot < 1) return;
-		await this.manager.runTransaction([SEAMS_WALLET_STORES.keyMaterial], "readwrite", async (ctx) => {
-			const store = ctx.store(SEAMS_WALLET_STORES.keyMaterial);
-			const rows = await store.index(SEAMS_WALLET_INDEXES.walletId).getAll(normalizedProfileId);
-			for (const row of rows) {
-				const parsed = parseKeyMaterialRow(row);
-				if (parsed && parsed.signerSlot === signerSlot && parsed.chainIdKey === normalizedChainIdKey && parsed.keyKind === normalizedKeyKind) await store.delete(keyMaterialId({
-					walletSignerId: walletSignerIdForKeyMaterial(parsed),
-					keyKind: parsed.keyKind
-				}));
-			}
-		});
-	}
-	async readNonceLaneLeaseRecords(laneKey) {
-		const normalizedLaneKey = normalizeTrimmedString(laneKey || "");
-		if (!normalizedLaneKey) return [];
-		const tx = (await this.manager.getDB()).transaction(SEAMS_WALLET_STORES.nonceLaneLeases, "readonly");
-		const rows = await tx.store.index(SEAMS_WALLET_INDEXES.laneKey).getAll(normalizedLaneKey);
-		await tx.done;
-		return rows.flatMap((row) => {
-			const parsed = parseNonceLeaseRow(row);
-			return parsed ? [parsed] : [];
-		});
-	}
-	async listNonceLaneLeaseRecords(args) {
-		const walletId = normalizeTrimmedString(args?.walletId || "");
-		const tx = (await this.manager.getDB()).transaction(SEAMS_WALLET_STORES.nonceLaneLeases, "readonly");
-		const rows = walletId ? await tx.store.index(SEAMS_WALLET_INDEXES.walletId).getAll(walletId) : await tx.store.getAll();
-		await tx.done;
-		return rows.flatMap((row) => {
-			const parsed = parseNonceLeaseRow(row);
-			return parsed ? [parsed] : [];
-		});
-	}
-	async upsertNonceLaneLeaseRecord(record) {
-		const row = nonceLeaseRow(record);
-		await this.manager.runTransaction([SEAMS_WALLET_STORES.nonceLaneLeases], "readwrite", async (ctx) => {
-			await ctx.store(SEAMS_WALLET_STORES.nonceLaneLeases).put(row);
-		});
-	}
-	async removeNonceLaneLeaseRecord(input) {
-		const leaseId = normalizeTrimmedString(input.leaseId || "");
-		if (!leaseId) return;
-		await this.manager.runTransaction([SEAMS_WALLET_STORES.nonceLaneLeases], "readwrite", async (ctx) => {
-			await ctx.store(SEAMS_WALLET_STORES.nonceLaneLeases).delete(leaseId);
-		});
-	}
-	async clearNonceLaneLeaseRecordsForWallet(walletId) {
-		const normalizedWalletId = normalizeTrimmedString(walletId || "");
-		if (!normalizedWalletId) return;
-		await this.manager.runTransaction([SEAMS_WALLET_STORES.nonceLaneLeases], "readwrite", async (ctx) => {
-			const store = ctx.store(SEAMS_WALLET_STORES.nonceLaneLeases);
-			const rows = await store.index(SEAMS_WALLET_INDEXES.walletId).getAll(normalizedWalletId);
-			for (const row of rows) {
-				const parsed = parseNonceLeaseRow(row);
-				if (parsed && parsed.state !== "broadcast_accepted") await store.delete(parsed.leaseId);
-			}
-		});
-	}
-	async clearAllNonceLaneLeaseRecords() {
-		await this.manager.runTransaction([SEAMS_WALLET_STORES.nonceLaneLeases], "readwrite", async (ctx) => {
-			await ctx.store(SEAMS_WALLET_STORES.nonceLaneLeases).clear();
-		});
-	}
-	async pruneExpiredNonceLaneLeaseRecords(nowMs) {
-		const normalizedNow = Math.floor(Number(nowMs));
-		if (!Number.isSafeInteger(normalizedNow)) return;
-		await this.manager.runTransaction([SEAMS_WALLET_STORES.nonceLaneLeases], "readwrite", async (ctx) => {
-			const store = ctx.store(SEAMS_WALLET_STORES.nonceLaneLeases);
-			const rows = await store.index(SEAMS_WALLET_INDEXES.expiresAtMs).getAll(keyRangeUpperBound(normalizedNow));
-			for (const row of rows) {
-				const parsed = parseNonceLeaseRow(row);
-				if (parsed && parsed.state !== "broadcast_accepted") await store.delete(parsed.leaseId);
-			}
-		});
-	}
-	async withNonceLaneCoordinationLock(input, task) {
-		const lockKey = normalizeTrimmedString(input.lockKey || "");
-		const ownerId = normalizeTrimmedString(input.ownerId || "");
-		if (!lockKey || !ownerId) throw new Error("[SeamsWalletDB] nonce lane lock requires lockKey and ownerId");
-		const ttlMs = Math.max(1, Math.floor(Number(input.ttlMs) || DEFAULT_NONCE_LANE_LOCK_TTL_MS));
-		const waitTimeoutMs = Math.max(1, Math.floor(Number(input.waitTimeoutMs) || DEFAULT_NONCE_LANE_LOCK_WAIT_TIMEOUT_MS));
-		const fencingToken = createRandomToken("nonce-lane-lock");
-		const deadlineMs = Date.now() + waitTimeoutMs;
-		const tryAcquire = async () => {
-			let acquired = false;
-			await this.manager.runTransaction([SEAMS_WALLET_STORES.nonceLaneLocks], "readwrite", async (ctx) => {
-				const store = ctx.store(SEAMS_WALLET_STORES.nonceLaneLocks);
-				const nowMs = Date.now();
-				const existing = parseNonceLaneLockRow(await store.get(lockKey));
-				if (existing && existing.expires_at_ms > nowMs) return;
-				const next = {
-					lock_key: lockKey,
-					owner_id: ownerId,
-					fencing_token: fencingToken,
-					acquired_at_ms: nowMs,
-					expires_at_ms: nowMs + ttlMs,
-					updated_at_ms: nowMs
-				};
-				await store.put(next);
-				acquired = true;
-			});
-			return acquired;
-		};
-		while (!await tryAcquire()) {
-			if (Date.now() >= deadlineMs) {
-				const error = /* @__PURE__ */ new Error("[SeamsWalletDB] durable nonce lane lock timed out");
-				error.code = "durable_lock_timeout";
-				throw error;
-			}
-			await sleep(DEFAULT_NONCE_LANE_LOCK_POLL_MS);
-		}
-		try {
-			return await task();
-		} finally {
-			await this.manager.runTransaction([SEAMS_WALLET_STORES.nonceLaneLocks], "readwrite", async (ctx) => {
-				const store = ctx.store(SEAMS_WALLET_STORES.nonceLaneLocks);
-				if (parseNonceLaneLockRow(await store.get(lockKey))?.fencing_token === fencingToken) await store.delete(lockKey);
-			}).catch(() => void 0);
-		}
-	}
-};
-//#endregion
-export { SeamsWalletRepositories };
-
-//# sourceMappingURL=repositories.js.map