@seams/wallet 0.7.3 → 0.8.0

package/dist/esm/react/core/rpcClients/relayer/walletRegistration.js

@@ -1,2349 +0,0 @@
-import { parseImplicitNearAccountId, parseNamedNearAccountId } from "../../../shared-ts/src/utils/near.js";
-import { normalizeThresholdRuntimePolicyScope } from "../../signingEngine/threshold/sessionPolicy.js";
-import { parseWalletAuthMethodId, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../shared-ts/src/utils/domainIds.js";
-import { parseDigestB64u } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { parseWalletAuthAuthority } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { parseRouterAbEcdsaRegistrationPublicActivationReceiptV1, parseRouterAbEcdsaRegistrationRequestFactsV1, parseRouterAbEcdsaStrictForwardedRegistrationResponseV1, requireRouterAbEcdsaDerivationNormalSigningStateV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { walletIdFromString } from "../../../shared-ts/src/utils/registrationIds.js";
-import { thresholdEcdsaChainTargetsEqual } from "../../signingEngine/interfaces/ecdsaChainTarget.js";
-import { normalizeRegistrationAuthMethodInput } from "../../../shared-ts/src/utils/registrationAuthMethodInput.js";
-import { parsePasskeyCustodyEnvelopeRecord } from "../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
-import { parseWalletCustodyRegistrationOutcome } from "../../../shared-ts/src/passkey-custody/ceremonyCommitPayload.js";
-import "../../../shared-ts/src/passkey-custody/index.js";
-import { parseWalletAddAuthMethodRegistrationOptions } from "../../../shared-ts/src/utils/addAuthMethodRegistration.js";
-import { parseRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../shared-ts/src/utils/routerAbEd25519Yao.js";
-import { parseWalletAuthorityV1 } from "../../../shared-ts/src/authorization/walletAuthority.js";
-import { parseWebAuthnAuthenticatorDeviceInfo } from "../../../shared-ts/src/utils/webauthnDeviceInfo.js";
-import { buildBearerAuthorizationHeader, buildRelayerJsonPostRequestInit, normalizeRelayerBaseUrl } from "./relayerHttp.js";
-import { normalizeRegistrationSignerPlan, registrationSignerSetSelectionFromPlan } from "../../../shared-ts/src/utils/registrationSignerPlan.js";
-import { addAuthMethodIntentGrantFromString, addSignerIntentGrantFromString, computeRegistrationIntentDigestB64u, parseAddAuthMethodIntentV1, parseAddSignerIntentV1, sameAddAuthMethodIntentV1, sameAddSignerIntentV1 } from "../../../shared-ts/src/utils/registrationIntent.js";
-import { parseRegistrationEstablishedSessionResultV2 } from "../../../shared-ts/src/utils/registrationEstablishedSession.js";
-import { parseThresholdEcdsaKeyIdentityTargets } from "../../signingEngine/session/passkey/ecdsaKeyFactsInventory.js";
-import { parseThresholdEcdsaDerivationRoleLocalBootstrapValue } from "./thresholdEcdsa.js";
-import { parseWalletAddSignerChainTarget, parseWalletAddSignerEcdsaWalletKey, parseWalletEd25519YaoSignerPublicResult, parseWalletRegistrationFinalizeAuthority, parseWalletRegistrationFinalizeAuthorityBranch, parseWalletRegistrationFinalizeDiagnostics, parseWalletRegistrationFinalizeResponse, requireResponseParticipantPair, requireResponseRpId, requireResponseSafeInteger, requireResponseString } from "./walletRegistrationTerminalResponse.js";
-//#region src/core/rpcClients/relayer/walletRegistration.ts
-/**
-* Declared once in the shared package. The server mints these options, this
-* client hands them to `navigator.credentials.create`, and the linked-device
-* target preparation carries them to Device 2 — one declaration, so none of
-* the three can drift from the ceremony.
-*/
-const REGISTRATION_ROUTE_PAYLOAD_DIAGNOSTICS_LABEL = "[Registration] wallet route payload summary";
-const ROUTE_PAYLOAD_BREAKDOWN_MAX_DEPTH = 2;
-const ROUTE_PAYLOAD_BREAKDOWN_MAX_FIELDS = 64;
-const WALLET_REGISTRATION_SETUP_PATH = "/wallets/register/setup";
-const WALLET_REGISTRATION_RESPOND_PATH = "/wallets/register/respond";
-const WALLET_REGISTRATION_ACTIVATE_PATH = "/wallets/register/activate";
-const WALLET_REGISTRATION_NEAR_PROVISIONING_PATH = "/wallets/register/near-provisioning";
-/** Managed environment id header for Router API `api_credentials` auth. */
-const ROUTER_API_ENVIRONMENT_ID_HEADER = "X-Seams-Environment-Id";
-const WALLET_REGISTRATION_PREPARE_PATH = "/wallets/register/prepare";
-const WRANGLER_WORKER_RESTARTED_MID_REQUEST = "Your worker restarted mid-request";
-function utf8Bytes(value) {
-	try {
-		return new TextEncoder().encode(String(value || "")).length;
-	} catch {
-		return String(value || "").length;
-	}
-}
-function registrationBenchmarkDiagnosticsEnabled() {
-	try {
-		return globalThis.__SEAMS_REGISTRATION_BENCHMARK_DIAGNOSTICS === true;
-	} catch {
-		return false;
-	}
-}
-function collectPayloadSizeBreakdown(input) {
-	if (!input.value || typeof input.value !== "object" || Array.isArray(input.value)) return;
-	if (Object.keys(input.out).length >= ROUTE_PAYLOAD_BREAKDOWN_MAX_FIELDS) return;
-	for (const [key, entry] of Object.entries(input.value)) {
-		if (Object.keys(input.out).length >= ROUTE_PAYLOAD_BREAKDOWN_MAX_FIELDS) return;
-		const fieldPath = input.path ? `${input.path}.${key}` : key;
-		if (typeof entry === "string") input.out[`${fieldPath}Bytes`] = utf8Bytes(entry);
-		else if (Array.isArray(entry)) input.out[`${fieldPath}Count`] = entry.length;
-		else if (input.depth > 0 && entry && typeof entry === "object") collectPayloadSizeBreakdown({
-			value: entry,
-			out: input.out,
-			path: fieldPath,
-			depth: input.depth - 1
-		});
-	}
-}
-function payloadSizeBreakdown(value) {
-	const out = {};
-	collectPayloadSizeBreakdown({
-		value,
-		out,
-		path: "",
-		depth: ROUTE_PAYLOAD_BREAKDOWN_MAX_DEPTH
-	});
-	return out;
-}
-function parseJsonText(text) {
-	try {
-		return JSON.parse(text);
-	} catch {
-		return;
-	}
-}
-function readParsedJsonField(value, field) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return void 0;
-	return Reflect.get(value, field);
-}
-async function readResponseText(response) {
-	try {
-		return await response.text();
-	} catch {
-		return "{}";
-	}
-}
-function walletRegistrationPostMaxAttempts(path) {
-	return path === WALLET_REGISTRATION_PREPARE_PATH ? 2 : 1;
-}
-function isWranglerWorkerRestartedMidRequestResponse(input) {
-	return input.path === WALLET_REGISTRATION_PREPARE_PATH && input.attempt === 0 && input.status === 503 && input.responseText.includes(WRANGLER_WORKER_RESTARTED_MID_REQUEST);
-}
-async function postJson(args) {
-	const startedAt = Date.now();
-	const requestBody = JSON.stringify(args.body);
-	const maxAttempts = walletRegistrationPostMaxAttempts(args.path);
-	for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
-		const response = await fetch(`${normalizeRelayerBaseUrl(args.relayerUrl, { trim: false })}${args.path}`, buildRelayerJsonPostRequestInit({
-			headers: args.headers,
-			body: args.body,
-			bodyJson: requestBody
-		}));
-		if (args.onServerTiming) try {
-			args.onServerTiming(response.headers.get("Server-Timing"));
-		} catch {}
-		const responseText = await readResponseText(response);
-		const data = parseJsonText(responseText);
-		if (registrationBenchmarkDiagnosticsEnabled()) console.info(REGISTRATION_ROUTE_PAYLOAD_DIAGNOSTICS_LABEL, {
-			path: args.path,
-			status: response.status,
-			attempt,
-			requestBytes: utf8Bytes(requestBody),
-			requestSizeBreakdown: payloadSizeBreakdown(args.body),
-			responseBytes: utf8Bytes(responseText),
-			responseSizeBreakdown: payloadSizeBreakdown(data),
-			totalMs: Date.now() - startedAt
-		});
-		if (isWranglerWorkerRestartedMidRequestResponse({
-			path: args.path,
-			status: response.status,
-			responseText,
-			attempt
-		})) continue;
-		if (!response.ok || readParsedJsonField(data, "ok") === false) throw new Error(String(readParsedJsonField(data, "message") || readParsedJsonField(data, "error") || readParsedJsonField(data, "code") || `HTTP ${response.status}`));
-		return data;
-	}
-	throw new Error("wallet registration request exhausted retry attempts");
-}
-const FUND_IMPLICIT_NEAR_SUCCESS_REQUIRED_FIELDS = [
-	"ok",
-	"walletId",
-	"nearAccountId",
-	"fundedAmountYocto"
-];
-const FUND_IMPLICIT_NEAR_SUCCESS_OPTIONAL_FIELDS = ["transactionHash", "message"];
-const FUND_IMPLICIT_NEAR_FAILURE_FIELDS = [
-	"ok",
-	"code",
-	"message"
-];
-function requireFundImplicitNearResponseObject(value, label) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
-	return value;
-}
-function assertFundImplicitNearResponseFields(value, requiredFields, optionalFields, label) {
-	const allowedFields = new Set([...requiredFields, ...optionalFields]);
-	const actualFields = Object.keys(value);
-	if (actualFields.some((field) => !allowedFields.has(field))) throw new Error(`${label} contains unexpected fields`);
-	for (const field of requiredFields) if (!actualFields.includes(field)) throw new Error(`${label}.${field} is required`);
-}
-function readFundImplicitNearResponseField(value, field) {
-	return Reflect.get(value, field);
-}
-function requireFundImplicitNearResponseString(value, field) {
-	if (typeof value !== "string" || value.trim().length === 0) throw new Error(`${field} must be a non-empty string`);
-	return value.trim();
-}
-function requireFundImplicitNearOptionalString(value, field) {
-	if (value === void 0) return void 0;
-	if (typeof value !== "string") throw new Error(`${field} must be a string`);
-	return value;
-}
-function parseFundImplicitNearAccountForTestingResponse(value) {
-	const response = requireFundImplicitNearResponseObject(value, "fund implicit NEAR account response");
-	const ok = readFundImplicitNearResponseField(response, "ok");
-	if (ok === true) {
-		assertFundImplicitNearResponseFields(response, FUND_IMPLICIT_NEAR_SUCCESS_REQUIRED_FIELDS, FUND_IMPLICIT_NEAR_SUCCESS_OPTIONAL_FIELDS, "fund implicit NEAR account success response");
-		const walletIdResult = parseWalletId(readFundImplicitNearResponseField(response, "walletId"));
-		if (!walletIdResult.ok) throw new Error("fund implicit NEAR account walletId is invalid");
-		const nearAccountIdResult = parseImplicitNearAccountId(readFundImplicitNearResponseField(response, "nearAccountId"));
-		if (!nearAccountIdResult.ok) throw new Error("fund implicit NEAR account nearAccountId is invalid");
-		const transactionHash = requireFundImplicitNearOptionalString(readFundImplicitNearResponseField(response, "transactionHash"), "fund implicit NEAR account transactionHash");
-		const message = requireFundImplicitNearOptionalString(readFundImplicitNearResponseField(response, "message"), "fund implicit NEAR account message");
-		return {
-			ok: true,
-			walletId: walletIdResult.value,
-			nearAccountId: nearAccountIdResult.value,
-			fundedAmountYocto: requireFundImplicitNearResponseString(readFundImplicitNearResponseField(response, "fundedAmountYocto"), "fund implicit NEAR account fundedAmountYocto"),
-			...transactionHash === void 0 ? {} : { transactionHash },
-			...message === void 0 ? {} : { message }
-		};
-	}
-	if (ok === false) {
-		assertFundImplicitNearResponseFields(response, FUND_IMPLICIT_NEAR_FAILURE_FIELDS, [], "fund implicit NEAR account failure response");
-		return {
-			ok: false,
-			code: requireFundImplicitNearResponseString(readFundImplicitNearResponseField(response, "code"), "fund implicit NEAR account code"),
-			message: requireFundImplicitNearResponseString(readFundImplicitNearResponseField(response, "message"), "fund implicit NEAR account message")
-		};
-	}
-	throw new Error("fund implicit NEAR account response has an invalid ok discriminator");
-}
-async function fundImplicitNearAccountForTesting(args) {
-	const walletId = String(args.walletId || "").trim();
-	const nearAccountId = String(args.nearAccountId || "").trim();
-	const nearPublicKeyStr = String(args.nearPublicKeyStr || "").trim();
-	const walletSessionToken = String(args.walletSessionToken || "").trim();
-	if (!walletId) throw new Error("walletId is required for implicit NEAR account funding");
-	if (!nearAccountId) throw new Error("nearAccountId is required for implicit NEAR account funding");
-	if (!nearPublicKeyStr) throw new Error("nearPublicKeyStr is required for implicit NEAR account funding");
-	if (!walletSessionToken) throw new Error("walletSessionToken is required for implicit NEAR account funding");
-	return parseFundImplicitNearAccountForTestingResponse(await postJson({
-		relayerUrl: args.relayerUrl,
-		path: `/wallets/${encodeURIComponent(walletId)}/near/implicit-account/fund`,
-		headers: buildBearerAuthorizationHeader({
-			token: walletSessionToken,
-			missingMessage: "walletSessionToken is required for implicit NEAR account funding"
-		}),
-		body: {
-			nearAccountId,
-			nearPublicKeyStr
-		}
-	}));
-}
-function registrationPreparationIdFromString(value) {
-	const normalized = String(value || "").trim();
-	if (!normalized) throw new Error("Registration preparation id is required");
-	return normalized;
-}
-const WALLET_REGISTRATION_ECDSA_PREPARE_FIELDS = [
-	"formatVersion",
-	"walletId",
-	"evmFamilySigningKeySlotId",
-	"ecdsaThresholdKeyId",
-	"signingRootId",
-	"signingRootVersion",
-	"keyScope",
-	"relayerKeyId",
-	"registrationPreparationId",
-	"requestId",
-	"thresholdSessionId",
-	"ttlMs",
-	"remainingUses",
-	"participantIds",
-	"runtimePolicyScope"
-];
-function requireWalletRegistrationResponseObject(args) {
-	if (args.value === null || typeof args.value !== "object" || Array.isArray(args.value)) throw new Error(`${args.responseName} response missing ${args.field}`);
-	return args.value;
-}
-function readWalletRegistrationResponseField(record, field, label) {
-	if (!Object.keys(record).includes(field)) throw new Error(`${label} is missing ${field}`);
-	return Reflect.get(record, field);
-}
-function readOptionalWalletRegistrationResponseField(record, field, _label) {
-	if (!Object.keys(record).includes(field)) return void 0;
-	return Reflect.get(record, field);
-}
-function assertWalletRegistrationResponseKeys(record, allowed, label) {
-	const allowedSet = new Set(allowed);
-	for (const key of Object.keys(record)) if (!allowedSet.has(key)) throw new Error(`${label} contains unexpected ${key}`);
-}
-function requireWalletRegistrationResponseArray(value, label) {
-	if (!Array.isArray(value)) throw new Error(`${label} must be an array`);
-	return value;
-}
-function hasWalletRegistrationResponseField(record, field) {
-	return Object.keys(record).includes(field);
-}
-function requireWalletRegistrationSetupString(value, label) {
-	if (typeof value !== "string" || value.length === 0 || value.trim() !== value) throw new Error(`${label} must be a non-empty canonical string`);
-	return value;
-}
-function requireWalletRegistrationSetupSafeInteger(value, label, minimum) {
-	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < minimum) throw new Error(`${label} must be a safe integer`);
-	return value;
-}
-function readWalletRegistrationSetupString(record, field, label) {
-	return requireWalletRegistrationSetupString(readWalletRegistrationResponseField(record, field, label), `${label}.${field}`);
-}
-function readWalletRegistrationSetupOptionalString(record, field, label) {
-	if (!hasWalletRegistrationResponseField(record, field)) return void 0;
-	return requireWalletRegistrationSetupString(readWalletRegistrationResponseField(record, field, label), `${label}.${field}`);
-}
-function readWalletRegistrationSetupSafeInteger(record, field, label, minimum) {
-	return requireWalletRegistrationSetupSafeInteger(readWalletRegistrationResponseField(record, field, label), `${label}.${field}`, minimum);
-}
-function parseWalletRegistrationSetupParticipantIds(value, label) {
-	const values = requireWalletRegistrationResponseArray(value, label);
-	if (values.length === 0) throw new Error(`${label} must not be empty`);
-	const participantIds = [];
-	for (let index = 0; index < values.length; index += 1) participantIds.push(requireWalletRegistrationSetupSafeInteger(values[index], `${label}[${index}]`, 1));
-	return participantIds;
-}
-function parseWalletRegistrationSetupParticipantPair(value, label) {
-	const participantIds = parseWalletRegistrationSetupParticipantIds(value, label);
-	if (participantIds.length !== 2 || participantIds[0] !== 1 || participantIds[1] !== 2) throw new Error(`${label} must be [1, 2]`);
-	return [1, 2];
-}
-function parseWalletRegistrationSetupRuntimePolicyScope(value, responseName, requireSigningRootVersion = false) {
-	if (value === void 0) return void 0;
-	const scopeName = `${responseName} runtimePolicyScope`;
-	const scope = requireWalletRegistrationResponseObject({
-		responseName: scopeName,
-		field: "value",
-		value
-	});
-	assertWalletRegistrationResponseKeys(scope, [
-		"orgId",
-		"projectId",
-		"envId",
-		"signingRootVersion"
-	], scopeName);
-	const signingRootVersion = readWalletRegistrationSetupOptionalString(scope, "signingRootVersion", scopeName);
-	if (requireSigningRootVersion && signingRootVersion === void 0) throw new Error(`${scopeName}.signingRootVersion is required`);
-	const base = {
-		orgId: readWalletRegistrationSetupString(scope, "orgId", scopeName),
-		projectId: readWalletRegistrationSetupString(scope, "projectId", scopeName),
-		envId: readWalletRegistrationSetupString(scope, "envId", scopeName)
-	};
-	return signingRootVersion === void 0 ? base : {
-		...base,
-		signingRootVersion
-	};
-}
-function parseWalletRegistrationSetupPrepareRuntimePolicyScope(value, responseName) {
-	const runtimePolicyScope = parseWalletRegistrationSetupRuntimePolicyScope(value, responseName, true);
-	if (!runtimePolicyScope || runtimePolicyScope.signingRootVersion === void 0) throw new Error(`${responseName} runtimePolicyScope is invalid`);
-	return {
-		orgId: runtimePolicyScope.orgId,
-		projectId: runtimePolicyScope.projectId,
-		envId: runtimePolicyScope.envId,
-		signingRootVersion: runtimePolicyScope.signingRootVersion
-	};
-}
-function parseWalletRegistrationSetupAuthMethod(value) {
-	const responseName = "Wallet registration setup intent authMethod";
-	const authMethod = requireWalletRegistrationResponseObject({
-		responseName,
-		field: "value",
-		value
-	});
-	switch (readWalletRegistrationSetupString(authMethod, "kind", responseName)) {
-		case "passkey":
-			assertWalletRegistrationResponseKeys(authMethod, [
-				"kind",
-				"rpId",
-				"authenticatorOptions"
-			], responseName);
-			if (!parseWebAuthnRpId(readWalletRegistrationSetupString(authMethod, "rpId", responseName)).ok) throw new Error(`${responseName}.rpId is invalid`);
-			if (!hasWalletRegistrationResponseField(authMethod, "authenticatorOptions")) break;
-			if (readWalletRegistrationResponseField(authMethod, "authenticatorOptions", responseName) === void 0) throw new Error(`${responseName}.authenticatorOptions must be defined when present`);
-			break;
-		case "email_otp":
-			switch (readWalletRegistrationSetupString(authMethod, "proofKind", responseName)) {
-				case "otp_challenge":
-					assertWalletRegistrationResponseKeys(authMethod, [
-						"kind",
-						"proofKind",
-						"email",
-						"providerSubject",
-						"otpCode",
-						"challengeId"
-					], responseName);
-					readWalletRegistrationSetupOptionalString(authMethod, "challengeId", responseName);
-					readWalletRegistrationSetupString(authMethod, "email", responseName);
-					readWalletRegistrationSetupString(authMethod, "providerSubject", responseName);
-					readWalletRegistrationSetupString(authMethod, "otpCode", responseName);
-					break;
-				case "google_sso_registration":
-					assertWalletRegistrationResponseKeys(authMethod, [
-						"kind",
-						"proofKind",
-						"email",
-						"providerSubject",
-						"googleEmailOtpRegistrationAttemptId",
-						"googleEmailOtpRegistrationOfferId",
-						"googleEmailOtpRegistrationCandidateId"
-					], responseName);
-					readWalletRegistrationSetupString(authMethod, "email", responseName);
-					readWalletRegistrationSetupString(authMethod, "providerSubject", responseName);
-					readWalletRegistrationSetupString(authMethod, "googleEmailOtpRegistrationAttemptId", responseName);
-					readWalletRegistrationSetupString(authMethod, "googleEmailOtpRegistrationOfferId", responseName);
-					readWalletRegistrationSetupString(authMethod, "googleEmailOtpRegistrationCandidateId", responseName);
-					break;
-				default: throw new Error(`${responseName}.proofKind is invalid`);
-			}
-			break;
-		default: throw new Error(`${responseName}.kind is invalid`);
-	}
-	const normalized = normalizeRegistrationAuthMethodInput(value);
-	if (!normalized) throw new Error(`${responseName} is invalid`);
-	return normalized;
-}
-function parseWalletRegistrationSetupNearAccountProvisioning(value) {
-	const responseName = "Wallet registration setup intent accountProvisioning";
-	const provisioning = requireWalletRegistrationResponseObject({
-		responseName,
-		field: "value",
-		value
-	});
-	const kind = readWalletRegistrationSetupString(provisioning, "kind", responseName);
-	switch (kind) {
-		case "implicit_account":
-			assertWalletRegistrationResponseKeys(provisioning, ["kind", "accountIdSource"], responseName);
-			if (readWalletRegistrationSetupString(provisioning, "accountIdSource", responseName) !== "ed25519_public_key") throw new Error(`${responseName}.accountIdSource is invalid`);
-			return {
-				kind,
-				accountIdSource: "ed25519_public_key"
-			};
-		case "sponsored_named_account": {
-			assertWalletRegistrationResponseKeys(provisioning, [
-				"kind",
-				"requestedAccountId",
-				"sponsor"
-			], responseName);
-			if (readWalletRegistrationSetupString(provisioning, "sponsor", responseName) !== "relayer") throw new Error(`${responseName}.sponsor is invalid`);
-			const requestedAccountId = parseNamedNearAccountId(readWalletRegistrationSetupString(provisioning, "requestedAccountId", responseName));
-			if (!requestedAccountId.ok) throw new Error(`${responseName}.requestedAccountId is invalid`);
-			return {
-				kind,
-				requestedAccountId: requestedAccountId.value,
-				sponsor: "relayer"
-			};
-		}
-		default: throw new Error(`${responseName}.kind is invalid`);
-	}
-}
-function sameWalletRegistrationSetupChainTarget(left, right) {
-	switch (left.kind) {
-		case "evm": return right.kind === "evm" && left.namespace === right.namespace && left.chainId === right.chainId && left.networkSlug === right.networkSlug;
-		case "tempo": return right.kind === "tempo" && left.chainId === right.chainId && left.networkSlug === right.networkSlug;
-		default: return assertNeverWalletRegistrationSetupChainTarget(left);
-	}
-}
-function assertNeverWalletRegistrationSetupChainTarget(value) {
-	throw new Error(`Unsupported wallet registration setup chain target: ${String(value)}`);
-}
-function parseWalletRegistrationSetupEcdsaChainTarget(value, responseName) {
-	const target = requireWalletRegistrationResponseObject({
-		responseName,
-		field: "chainTarget",
-		value
-	});
-	const kind = readWalletRegistrationSetupString(target, "kind", responseName);
-	switch (kind) {
-		case "evm": {
-			assertWalletRegistrationResponseKeys(target, [
-				"kind",
-				"namespace",
-				"chainId",
-				"networkSlug"
-			], responseName);
-			if (readWalletRegistrationSetupString(target, "namespace", responseName) !== "eip155") throw new Error(`${responseName}.namespace is invalid`);
-			const chainId = readWalletRegistrationSetupSafeInteger(target, "chainId", responseName, 1);
-			const networkSlug = readWalletRegistrationSetupOptionalString(target, "networkSlug", responseName);
-			return networkSlug === void 0 ? {
-				kind,
-				namespace: "eip155",
-				chainId
-			} : {
-				kind,
-				namespace: "eip155",
-				chainId,
-				networkSlug
-			};
-		}
-		case "tempo": {
-			assertWalletRegistrationResponseKeys(target, [
-				"kind",
-				"chainId",
-				"networkSlug"
-			], responseName);
-			const chainId = readWalletRegistrationSetupSafeInteger(target, "chainId", responseName, 1);
-			const networkSlug = readWalletRegistrationSetupOptionalString(target, "networkSlug", responseName);
-			return networkSlug === void 0 ? {
-				kind,
-				chainId
-			} : {
-				kind,
-				chainId,
-				networkSlug
-			};
-		}
-		default: throw new Error(`${responseName}.kind is invalid`);
-	}
-}
-function normalizeWalletRegistrationSetupEcdsaChainTarget(value) {
-	try {
-		return parseWalletRegistrationSetupEcdsaChainTarget(value, "Wallet registration setup intent");
-	} catch {
-		return null;
-	}
-}
-function parseWalletRegistrationSetupSignerRequest(value) {
-	const responseName = "Wallet registration setup intent signer";
-	const signer = requireWalletRegistrationResponseObject({
-		responseName,
-		field: "value",
-		value
-	});
-	const kind = readWalletRegistrationSetupString(signer, "kind", responseName);
-	switch (kind) {
-		case "near_ed25519":
-			assertWalletRegistrationResponseKeys(signer, [
-				"kind",
-				"accountProvisioning",
-				"signerSlot",
-				"participantIds",
-				"derivationVersion"
-			], responseName);
-			if (readWalletRegistrationSetupSafeInteger(signer, "derivationVersion", responseName, 1) !== 1) throw new Error(`${responseName}.derivationVersion is invalid`);
-			return {
-				kind,
-				accountProvisioning: parseWalletRegistrationSetupNearAccountProvisioning(readWalletRegistrationResponseField(signer, "accountProvisioning", responseName)),
-				signerSlot: readWalletRegistrationSetupSafeInteger(signer, "signerSlot", responseName, 1),
-				participantIds: parseWalletRegistrationSetupParticipantIds(readWalletRegistrationResponseField(signer, "participantIds", responseName), `${responseName}.participantIds`),
-				derivationVersion: 1
-			};
-		case "evm_family_ecdsa": {
-			assertWalletRegistrationResponseKeys(signer, [
-				"kind",
-				"participantIds",
-				"chainTargets"
-			], responseName);
-			const chainTargets = requireWalletRegistrationResponseArray(readWalletRegistrationResponseField(signer, "chainTargets", responseName), `${responseName}.chainTargets`);
-			if (chainTargets.length === 0) throw new Error(`${responseName}.chainTargets must not be empty`);
-			const parsedChainTargets = [];
-			for (const chainTarget of chainTargets) {
-				const parsed = parseWalletRegistrationSetupEcdsaChainTarget(chainTarget, `${responseName}.chainTargets`);
-				if (parsedChainTargets.some((existing) => sameWalletRegistrationSetupChainTarget(existing, parsed))) throw new Error(`${responseName}.chainTargets contains a duplicate target`);
-				parsedChainTargets.push(parsed);
-			}
-			return {
-				kind,
-				participantIds: parseWalletRegistrationSetupParticipantIds(readWalletRegistrationResponseField(signer, "participantIds", responseName), `${responseName}.participantIds`),
-				chainTargets: parsedChainTargets
-			};
-		}
-		default: throw new Error(`${responseName}.kind is invalid`);
-	}
-}
-function parseWalletRegistrationSetupSignerSelection(value) {
-	const responseName = "Wallet registration setup intent signerSelection";
-	const selection = requireWalletRegistrationResponseObject({
-		responseName,
-		field: "value",
-		value
-	});
-	assertWalletRegistrationResponseKeys(selection, ["kind", "signers"], responseName);
-	if (readWalletRegistrationSetupString(selection, "kind", responseName) !== "signer_set") throw new Error(`${responseName}.kind is invalid`);
-	const rawSigners = requireWalletRegistrationResponseArray(readWalletRegistrationResponseField(selection, "signers", responseName), `${responseName}.signers`);
-	if (rawSigners.length === 0) throw new Error(`${responseName}.signers must not be empty`);
-	const signers = [];
-	for (const rawSigner of rawSigners) signers.push(parseWalletRegistrationSetupSignerRequest(rawSigner));
-	return {
-		kind: "signer_set",
-		signers
-	};
-}
-function parseWalletRegistrationSetupIntent(value) {
-	const responseName = "Wallet registration setup intent";
-	const intent = requireWalletRegistrationResponseObject({
-		responseName,
-		field: "intent",
-		value
-	});
-	assertWalletRegistrationResponseKeys(intent, [
-		"version",
-		"walletId",
-		"authMethod",
-		"signerSelection",
-		"foundingWalletAuthMethodId",
-		"runtimePolicyScope",
-		"nonceB64u"
-	], responseName);
-	if (readWalletRegistrationSetupString(intent, "version", responseName) !== "registration_intent_v1") throw new Error(`${responseName}.version is invalid`);
-	const walletId = parseWalletId(readWalletRegistrationSetupString(intent, "walletId", responseName));
-	if (!walletId.ok) throw new Error(`${responseName}.walletId is invalid`);
-	const foundingWalletAuthMethodId = parseWalletAuthMethodId(readWalletRegistrationSetupString(intent, "foundingWalletAuthMethodId", responseName));
-	if (!foundingWalletAuthMethodId.ok) throw new Error(`${responseName}.foundingWalletAuthMethodId is invalid`);
-	const authMethod = parseWalletRegistrationSetupAuthMethod(readWalletRegistrationResponseField(intent, "authMethod", responseName));
-	const signerSelection = parseWalletRegistrationSetupSignerSelection(readWalletRegistrationResponseField(intent, "signerSelection", responseName));
-	const runtimePolicyScope = parseWalletRegistrationSetupRuntimePolicyScope(readOptionalWalletRegistrationResponseField(intent, "runtimePolicyScope", responseName), responseName);
-	const nonceB64u = readWalletRegistrationSetupString(intent, "nonceB64u", responseName);
-	return runtimePolicyScope === void 0 ? {
-		version: "registration_intent_v1",
-		walletId: walletId.value,
-		authMethod,
-		signerSelection,
-		foundingWalletAuthMethodId: foundingWalletAuthMethodId.value,
-		nonceB64u
-	} : {
-		version: "registration_intent_v1",
-		walletId: walletId.value,
-		authMethod,
-		signerSelection,
-		foundingWalletAuthMethodId: foundingWalletAuthMethodId.value,
-		runtimePolicyScope,
-		nonceB64u
-	};
-}
-function parseWalletAddSignerEcdsaRespondResponse(value) {
-	const responseName = "Wallet add-signer ECDSA derivation";
-	const response = requireWalletRegistrationResponseObject({
-		responseName,
-		field: "response",
-		value
-	});
-	assertWalletRegistrationResponseKeys(response, [
-		"ok",
-		"addSignerCeremonyId",
-		"ecdsa"
-	], `${responseName} response`);
-	if (readWalletRegistrationResponseField(response, "ok", `${responseName} response`) !== true) throw new Error(`${responseName} response is not successful`);
-	const ecdsa = requireWalletRegistrationResponseObject({
-		responseName,
-		field: "ecdsa",
-		value: readWalletRegistrationResponseField(response, "ecdsa", `${responseName} response`)
-	});
-	assertWalletRegistrationResponseKeys(ecdsa, ["kind", "strictResult"], `${responseName} response ecdsa`);
-	if (readWalletRegistrationResponseField(ecdsa, "kind", `${responseName} response ecdsa`) !== "router_ab_ecdsa_registration_forwarded_v1") throw new Error(`${responseName} response kind is invalid`);
-	return {
-		ok: true,
-		addSignerCeremonyId: requireResponseString({
-			responseName,
-			field: "addSignerCeremonyId",
-			value: readWalletRegistrationResponseField(response, "addSignerCeremonyId", responseName)
-		}),
-		ecdsa: {
-			kind: "router_ab_ecdsa_registration_forwarded_v1",
-			strictResult: parseRouterAbEcdsaStrictForwardedRegistrationResponseV1(readWalletRegistrationResponseField(ecdsa, "strictResult", `${responseName} response ecdsa`))
-		}
-	};
-}
-function parseWalletAddSignerEcdsaActivationResponse(value) {
-	const responseName = "Wallet add-signer ECDSA activation";
-	const response = requireWalletRegistrationResponseObject({
-		responseName,
-		field: "response",
-		value
-	});
-	assertWalletRegistrationResponseKeys(response, [
-		"ok",
-		"addSignerCeremonyId",
-		"ecdsa"
-	], `${responseName} response`);
-	if (readWalletRegistrationResponseField(response, "ok", `${responseName} response`) !== true) throw new Error(`${responseName} response is not successful`);
-	const ecdsa = requireWalletRegistrationResponseObject({
-		responseName,
-		field: "ecdsa",
-		value: readWalletRegistrationResponseField(response, "ecdsa", `${responseName} response`)
-	});
-	assertWalletRegistrationResponseKeys(ecdsa, [
-		"kind",
-		"activation",
-		"bootstrap"
-	], `${responseName} response ecdsa`);
-	if (readWalletRegistrationResponseField(ecdsa, "kind", `${responseName} response ecdsa`) !== "router_ab_ecdsa_registration_activated_v1") throw new Error(`${responseName} response kind is invalid`);
-	return {
-		ok: true,
-		addSignerCeremonyId: requireResponseString({
-			responseName,
-			field: "addSignerCeremonyId",
-			value: readWalletRegistrationResponseField(response, "addSignerCeremonyId", responseName)
-		}),
-		ecdsa: {
-			kind: "router_ab_ecdsa_registration_activated_v1",
-			activation: parseRouterAbEcdsaRegistrationPublicActivationReceiptV1(readWalletRegistrationResponseField(ecdsa, "activation", `${responseName} response ecdsa`)),
-			bootstrap: parseThresholdEcdsaDerivationRoleLocalBootstrapValue(readWalletRegistrationResponseField(ecdsa, "bootstrap", `${responseName} response ecdsa`))
-		}
-	};
-}
-function isEmailOtpWalletRegistrationFinalizeResponse(response) {
-	return response.authMethod.kind === "email_otp";
-}
-function parseCreateAddAuthMethodIntentResponse(value) {
-	const responseName = "Wallet add-auth-method intent";
-	const response = requireWalletRegistrationResponseObject({
-		responseName,
-		field: "body",
-		value
-	});
-	assertWalletRegistrationResponseKeys(response, [
-		"ok",
-		"intent",
-		"addAuthMethodIntentDigestB64u",
-		"addAuthMethodIntentGrant",
-		"expiresAtMs"
-	], responseName);
-	if (readWalletRegistrationResponseField(response, "ok", responseName) !== true) throw new Error(`${responseName} response is not successful`);
-	const intent = parseAddAuthMethodIntentV1(readWalletRegistrationResponseField(response, "intent", responseName));
-	let addAuthMethodIntentDigestB64u;
-	try {
-		addAuthMethodIntentDigestB64u = parseDigestB64u(readWalletRegistrationResponseField(response, "addAuthMethodIntentDigestB64u", responseName));
-	} catch {
-		throw new Error(`${responseName} response has invalid addAuthMethodIntentDigestB64u`);
-	}
-	const grantValue = readWalletRegistrationResponseField(response, "addAuthMethodIntentGrant", responseName);
-	if (typeof grantValue !== "string" || !grantValue.trim()) throw new Error(`${responseName} response is missing addAuthMethodIntentGrant`);
-	return {
-		ok: true,
-		intent,
-		addAuthMethodIntentDigestB64u,
-		addAuthMethodIntentGrant: addAuthMethodIntentGrantFromString(grantValue),
-		expiresAtMs: requireResponseSafeInteger({
-			responseName,
-			field: "expiresAtMs",
-			value: readWalletRegistrationResponseField(response, "expiresAtMs", responseName),
-			minimum: 1
-		})
-	};
-}
-function parseCreateAddSignerIntentResponse(value) {
-	const responseName = "Wallet add-signer intent";
-	const response = requireWalletRegistrationResponseObject({
-		responseName,
-		field: "body",
-		value
-	});
-	assertWalletRegistrationResponseKeys(response, [
-		"ok",
-		"intent",
-		"addSignerIntentDigestB64u",
-		"addSignerIntentGrant",
-		"expiresAtMs"
-	], responseName);
-	if (readWalletRegistrationResponseField(response, "ok", responseName) !== true) throw new Error(`${responseName} response is not successful`);
-	const intent = parseAddSignerIntentV1(readWalletRegistrationResponseField(response, "intent", responseName));
-	let addSignerIntentDigestB64u;
-	try {
-		addSignerIntentDigestB64u = parseDigestB64u(readWalletRegistrationResponseField(response, "addSignerIntentDigestB64u", responseName));
-	} catch {
-		throw new Error(`${responseName} response has invalid addSignerIntentDigestB64u`);
-	}
-	const grantValue = readWalletRegistrationResponseField(response, "addSignerIntentGrant", responseName);
-	if (typeof grantValue !== "string" || !grantValue.trim()) throw new Error(`${responseName} response is missing addSignerIntentGrant`);
-	return {
-		ok: true,
-		intent,
-		addSignerIntentDigestB64u,
-		addSignerIntentGrant: addSignerIntentGrantFromString(grantValue),
-		expiresAtMs: requireResponseSafeInteger({
-			responseName,
-			field: "expiresAtMs",
-			value: readWalletRegistrationResponseField(response, "expiresAtMs", responseName),
-			minimum: 1
-		})
-	};
-}
-function parseWalletAddAuthMethodFinalizeResponse(value) {
-	const responseName = "Wallet add-auth-method finalize";
-	const response = requireWalletRegistrationResponseObject({
-		responseName,
-		field: "body",
-		value
-	});
-	if (readWalletRegistrationResponseField(response, "ok", responseName) !== true) throw new Error(`${responseName} response is not successful`);
-	const authMethod = requireWalletRegistrationResponseObject({
-		responseName,
-		field: "authMethod",
-		value: readWalletRegistrationResponseField(response, "authMethod", responseName)
-	});
-	const authMethodKind = readWalletRegistrationResponseField(authMethod, "kind", `${responseName} authMethod`);
-	if (authMethodKind !== "passkey" && authMethodKind !== "email_otp") throw new Error(`${responseName} response has invalid authMethod kind`);
-	const walletIdResult = parseWalletId(readWalletRegistrationResponseField(response, "walletId", responseName));
-	if (!walletIdResult.ok) throw new Error(`${responseName} response has invalid walletId`);
-	const authority = parseWalletAuthAuthority(readWalletRegistrationResponseField(response, "authority", responseName));
-	if (!authority) throw new Error(`${responseName} response has invalid authority`);
-	if (authority.walletId !== walletIdResult.value) throw new Error(`${responseName} response authority wallet mismatch`);
-	if (authMethodKind === "passkey") {
-		assertWalletRegistrationResponseKeys(response, [
-			"ok",
-			"walletId",
-			"authority",
-			"rpId",
-			"authMethod"
-		], responseName);
-		assertWalletRegistrationResponseKeys(authMethod, [
-			"kind",
-			"status",
-			"credentialIdB64u",
-			"credentialPublicKeyB64u",
-			"counter",
-			"device"
-		], `${responseName} authMethod`);
-		if (readWalletRegistrationResponseField(authMethod, "status", responseName) !== "active") throw new Error(`${responseName} response has invalid authMethod status`);
-		if (authority.factor.kind !== "passkey" || authority.verifier.kind !== "webauthn") throw new Error(`${responseName} response has inconsistent passkey authority`);
-		const rpId = parseWebAuthnRpId(readWalletRegistrationResponseField(response, "rpId", responseName));
-		if (!rpId.ok) throw new Error(`${responseName} response has invalid rpId`);
-		const credentialIdB64u = parseWebAuthnCredentialIdB64u(readWalletRegistrationResponseField(authMethod, "credentialIdB64u", responseName));
-		if (!credentialIdB64u.ok) throw new Error(`${responseName} response has invalid credentialIdB64u`);
-		const credentialPublicKeyB64uValue = readWalletRegistrationResponseField(authMethod, "credentialPublicKeyB64u", responseName);
-		if (typeof credentialPublicKeyB64uValue !== "string" || !credentialPublicKeyB64uValue.trim()) throw new Error(`${responseName} response is missing credentialPublicKeyB64u`);
-		const counter = readWalletRegistrationResponseField(authMethod, "counter", responseName);
-		if (typeof counter !== "number" || !Number.isSafeInteger(counter) || counter < 0) throw new Error(`${responseName} response has invalid counter`);
-		const device = parseWebAuthnAuthenticatorDeviceInfo(readWalletRegistrationResponseField(authMethod, "device", responseName));
-		if (!device) throw new Error(`${responseName} response has invalid device`);
-		if (authority.factor.credentialIdB64u !== credentialIdB64u.value || authority.verifier.rpId !== rpId.value) throw new Error(`${responseName} response passkey authority binding mismatch`);
-		return {
-			ok: true,
-			walletId: walletIdResult.value,
-			authority,
-			rpId: rpId.value,
-			authMethod: {
-				kind: "passkey",
-				status: "active",
-				credentialIdB64u: credentialIdB64u.value,
-				credentialPublicKeyB64u: credentialPublicKeyB64uValue.trim(),
-				counter,
-				device
-			}
-		};
-	}
-	assertWalletRegistrationResponseKeys(response, [
-		"ok",
-		"walletId",
-		"authority",
-		"authMethod"
-	], responseName);
-	assertWalletRegistrationResponseKeys(authMethod, ["kind", "status"], `${responseName} authMethod`);
-	if (readWalletRegistrationResponseField(authMethod, "status", responseName) !== "active") throw new Error(`${responseName} response has invalid authMethod status`);
-	if (authority.factor.kind !== "email_otp" || authority.verifier.kind !== "email_otp_wallet_auth_method") throw new Error(`${responseName} response has inconsistent email OTP authority`);
-	return {
-		ok: true,
-		walletId: walletIdResult.value,
-		authority,
-		authMethod: {
-			kind: "email_otp",
-			status: "active"
-		}
-	};
-}
-function parseWalletAddAuthMethodStartResponse(args) {
-	const responseName = "Wallet add-auth-method start";
-	const record = requireWalletRegistrationResponseObject({
-		responseName,
-		field: "body",
-		value: args.value
-	});
-	if (readWalletRegistrationResponseField(record, "ok", responseName) !== true) throw new Error(`${responseName} response is not successful`);
-	const addAuthMethodCeremonyId = requireResponseString({
-		responseName,
-		field: "addAuthMethodCeremonyId",
-		value: readWalletRegistrationResponseField(record, "addAuthMethodCeremonyId", responseName)
-	});
-	const intent = requireExactAddAuthMethodIntent(readWalletRegistrationResponseField(record, "intent", responseName), args.expectedIntent);
-	if (args.expectedIntent.authMethod.kind === "email_otp") {
-		assertWalletRegistrationResponseKeys(record, [
-			"ok",
-			"addAuthMethodCeremonyId",
-			"intent",
-			"custodyEnvelope",
-			"addAuthMethodCeremonyExpiresAtMs"
-		], responseName);
-		return {
-			ok: true,
-			addAuthMethodCeremonyId,
-			intent,
-			custodyEnvelope: parsePasskeyCustodyEnvelopeRecord(readWalletRegistrationResponseField(record, "custodyEnvelope", responseName)),
-			addAuthMethodCeremonyExpiresAtMs: requireResponseSafeInteger({
-				responseName,
-				field: "addAuthMethodCeremonyExpiresAtMs",
-				value: readWalletRegistrationResponseField(record, "addAuthMethodCeremonyExpiresAtMs", responseName),
-				minimum: 1
-			})
-		};
-	}
-	assertWalletRegistrationResponseKeys(record, [
-		"ok",
-		"addAuthMethodCeremonyId",
-		"intent",
-		"custodyEnvelope",
-		"registration",
-		"addAuthMethodCeremonyExpiresAtMs"
-	], responseName);
-	return {
-		ok: true,
-		addAuthMethodCeremonyId,
-		intent,
-		custodyEnvelope: parsePasskeyCustodyEnvelopeRecord(readWalletRegistrationResponseField(record, "custodyEnvelope", responseName)),
-		registration: parseWalletAddAuthMethodRegistrationOptions(readWalletRegistrationResponseField(record, "registration", responseName)),
-		addAuthMethodCeremonyExpiresAtMs: requireResponseSafeInteger({
-			responseName,
-			field: "addAuthMethodCeremonyExpiresAtMs",
-			value: readWalletRegistrationResponseField(record, "addAuthMethodCeremonyExpiresAtMs", responseName),
-			minimum: 1
-		})
-	};
-}
-function requireExactAddSignerIntent(value, expected) {
-	try {
-		if (!sameAddSignerIntentV1(parseAddSignerIntentV1(value), expected)) throw new Error("intent mismatch");
-	} catch {
-		throw new Error("Wallet add-signer start response changed the admitted intent");
-	}
-	return expected;
-}
-function requireExactAddAuthMethodIntent(value, expected) {
-	try {
-		if (!sameAddAuthMethodIntentV1(parseAddAuthMethodIntentV1(value), expected)) throw new Error("intent mismatch");
-	} catch {
-		throw new Error("Wallet add-auth-method start response changed the admitted intent");
-	}
-	return expected;
-}
-function parseWalletAddSignerEcdsaPrepareContext(value, responseName) {
-	const prepare = requireWalletRegistrationResponseObject({
-		responseName,
-		field: "ecdsa.prepare",
-		value
-	});
-	assertWalletRegistrationResponseKeys(prepare, WALLET_REGISTRATION_ECDSA_PREPARE_FIELDS, responseName);
-	if (readWalletRegistrationResponseField(prepare, "formatVersion", responseName) !== "ecdsa-derivation-role-local" || readWalletRegistrationResponseField(prepare, "keyScope", responseName) !== "evm-family") throw new Error(`${responseName} response has invalid prepare discriminator`);
-	const runtimePolicyScope = normalizeThresholdRuntimePolicyScope(readWalletRegistrationResponseField(prepare, "runtimePolicyScope", responseName));
-	if (!runtimePolicyScope) throw new Error(`${responseName} response has invalid runtimePolicyScope`);
-	return {
-		formatVersion: "ecdsa-derivation-role-local",
-		walletId: requireResponseString({
-			responseName,
-			field: "prepare.walletId",
-			value: readWalletRegistrationResponseField(prepare, "walletId", responseName)
-		}),
-		evmFamilySigningKeySlotId: requireResponseString({
-			responseName,
-			field: "prepare.evmFamilySigningKeySlotId",
-			value: readWalletRegistrationResponseField(prepare, "evmFamilySigningKeySlotId", responseName)
-		}),
-		ecdsaThresholdKeyId: requireResponseString({
-			responseName,
-			field: "prepare.ecdsaThresholdKeyId",
-			value: readWalletRegistrationResponseField(prepare, "ecdsaThresholdKeyId", responseName)
-		}),
-		signingRootId: requireResponseString({
-			responseName,
-			field: "prepare.signingRootId",
-			value: readWalletRegistrationResponseField(prepare, "signingRootId", responseName)
-		}),
-		signingRootVersion: requireResponseString({
-			responseName,
-			field: "prepare.signingRootVersion",
-			value: readWalletRegistrationResponseField(prepare, "signingRootVersion", responseName)
-		}),
-		keyScope: "evm-family",
-		relayerKeyId: requireResponseString({
-			responseName,
-			field: "prepare.relayerKeyId",
-			value: readWalletRegistrationResponseField(prepare, "relayerKeyId", responseName)
-		}),
-		registrationPreparationId: registrationPreparationIdFromString(requireResponseString({
-			responseName,
-			field: "prepare.registrationPreparationId",
-			value: readWalletRegistrationResponseField(prepare, "registrationPreparationId", responseName)
-		})),
-		requestId: requireResponseString({
-			responseName,
-			field: "prepare.requestId",
-			value: readWalletRegistrationResponseField(prepare, "requestId", responseName)
-		}),
-		thresholdSessionId: requireResponseString({
-			responseName,
-			field: "prepare.thresholdSessionId",
-			value: readWalletRegistrationResponseField(prepare, "thresholdSessionId", responseName)
-		}),
-		ttlMs: requireResponseSafeInteger({
-			responseName,
-			field: "prepare.ttlMs",
-			value: readWalletRegistrationResponseField(prepare, "ttlMs", responseName),
-			minimum: 1
-		}),
-		remainingUses: requireResponseSafeInteger({
-			responseName,
-			field: "prepare.remainingUses",
-			value: readWalletRegistrationResponseField(prepare, "remainingUses", responseName),
-			minimum: 0
-		}),
-		participantIds: [...requireResponseParticipantPair(readWalletRegistrationResponseField(prepare, "participantIds", responseName), responseName)],
-		runtimePolicyScope
-	};
-}
-function assertWalletRegistrationSetupEcdsaPrepareContext(value, responseName) {
-	const prepare = requireWalletRegistrationResponseObject({
-		responseName,
-		field: "ecdsa.prepare",
-		value
-	});
-	assertWalletRegistrationResponseKeys(prepare, WALLET_REGISTRATION_ECDSA_PREPARE_FIELDS, responseName);
-	if (readWalletRegistrationResponseField(prepare, "formatVersion", responseName) !== "ecdsa-derivation-role-local" || readWalletRegistrationResponseField(prepare, "keyScope", responseName) !== "evm-family") throw new Error(`${responseName} response has invalid prepare discriminator`);
-	for (const field of [
-		"walletId",
-		"evmFamilySigningKeySlotId",
-		"ecdsaThresholdKeyId",
-		"signingRootId",
-		"signingRootVersion",
-		"relayerKeyId",
-		"registrationPreparationId",
-		"requestId",
-		"thresholdSessionId"
-	]) readWalletRegistrationSetupString(prepare, field, responseName);
-	readWalletRegistrationSetupSafeInteger(prepare, "ttlMs", responseName, 1);
-	readWalletRegistrationSetupSafeInteger(prepare, "remainingUses", responseName, 0);
-	parseWalletRegistrationSetupParticipantPair(readWalletRegistrationResponseField(prepare, "participantIds", responseName), `${responseName}.participantIds`);
-	parseWalletRegistrationSetupPrepareRuntimePolicyScope(readWalletRegistrationResponseField(prepare, "runtimePolicyScope", responseName), responseName);
-}
-function parseWalletRegistrationEcdsaPrepare(value) {
-	const responseName = "Wallet registration setup ECDSA";
-	const ecdsa = requireWalletRegistrationResponseObject({
-		responseName,
-		field: "ecdsa",
-		value
-	});
-	assertWalletRegistrationResponseKeys(ecdsa, [
-		"kind",
-		"chainTargets",
-		"prepare",
-		"strictRegistration"
-	], responseName);
-	if (readWalletRegistrationResponseField(ecdsa, "kind", responseName) !== "evm_family_ecdsa_keygen") throw new Error(`${responseName} response has an invalid kind`);
-	const rawChainTargets = readWalletRegistrationResponseField(ecdsa, "chainTargets", responseName);
-	if (!Array.isArray(rawChainTargets) || rawChainTargets.length === 0) throw new Error(`${responseName} response has invalid chainTargets`);
-	const chainTargets = [];
-	for (const rawChainTarget of rawChainTargets) {
-		const chainTarget = parseWalletRegistrationSetupEcdsaChainTarget(rawChainTarget, `${responseName}.chainTargets`);
-		if (chainTargets.some((existing) => sameWalletRegistrationSetupChainTarget(existing, chainTarget))) throw new Error(`${responseName} response has duplicate chainTargets`);
-		chainTargets.push(chainTarget);
-	}
-	const [firstTarget, ...remainingTargets] = chainTargets;
-	if (!firstTarget) throw new Error(`${responseName} response has invalid chainTargets`);
-	const rawPrepare = readWalletRegistrationResponseField(ecdsa, "prepare", responseName);
-	assertWalletRegistrationSetupEcdsaPrepareContext(rawPrepare, responseName);
-	const prepare = parseWalletAddSignerEcdsaPrepareContext(rawPrepare, responseName);
-	const strictRegistration = parseRouterAbEcdsaRegistrationRequestFactsV1(readWalletRegistrationResponseField(ecdsa, "strictRegistration", responseName));
-	if (strictRegistration.registration_purpose !== "wallet_registration") throw new Error(`${responseName} response has an invalid registration purpose`);
-	return {
-		kind: "evm_family_ecdsa_keygen",
-		chainTargets: [firstTarget, ...remainingTargets],
-		prepare,
-		strictRegistration
-	};
-}
-function walletRegistrationSetupKindFromIntent(intent) {
-	let hasNearEd25519 = false;
-	let hasEvmFamilyEcdsa = false;
-	for (const signer of intent.signerSelection.signers) switch (signer.kind) {
-		case "near_ed25519":
-			hasNearEd25519 = true;
-			break;
-		case "evm_family_ecdsa":
-			hasEvmFamilyEcdsa = true;
-			break;
-		default: return assertNeverWalletRegistrationSetupSigner(signer);
-	}
-	if (hasNearEd25519 && hasEvmFamilyEcdsa) return "near_ed25519_and_evm_family_ecdsa";
-	if (hasEvmFamilyEcdsa) return "evm_family_ecdsa";
-	if (hasNearEd25519) return "near_ed25519";
-	throw new Error("Wallet registration setup intent has no signer branch");
-}
-function assertNeverWalletRegistrationSetupSigner(value) {
-	throw new Error(`Unsupported wallet registration setup signer: ${String(value)}`);
-}
-function sameWalletRegistrationSetupParticipantIds(left, right) {
-	if (left.length !== right.length) return false;
-	for (let index = 0; index < left.length; index += 1) if (left[index] !== right[index]) return false;
-	return true;
-}
-function sameWalletRegistrationSetupRuntimePolicyScope(left, right) {
-	return left !== void 0 && left.orgId === right.orgId && left.projectId === right.projectId && left.envId === right.envId && left.signingRootVersion === right.signingRootVersion;
-}
-function sameWalletRegistrationSetupChainTargetValue(left, right) {
-	try {
-		return sameWalletRegistrationSetupChainTarget(parseWalletRegistrationSetupEcdsaChainTarget(left, "Wallet registration setup intent"), right);
-	} catch {
-		return false;
-	}
-}
-function assertWalletRegistrationSetupEcdsaBindings(args) {
-	const ecdsaSigner = args.intent.signerSelection.signers.find((signer) => signer.kind === "evm_family_ecdsa");
-	if (!ecdsaSigner) throw new Error(`${args.responseName} response has no ECDSA intent branch`);
-	if (ecdsaSigner.chainTargets.length !== args.ecdsa.chainTargets.length || ecdsaSigner.chainTargets.some((target, index) => !sameWalletRegistrationSetupChainTargetValue(target, args.ecdsa.chainTargets[index]))) throw new Error(`${args.responseName} response ECDSA chainTargets do not match intent`);
-	if (!sameWalletRegistrationSetupParticipantIds(ecdsaSigner.participantIds, args.ecdsa.prepare.participantIds)) throw new Error(`${args.responseName} response ECDSA participantIds do not match intent`);
-	if (args.ecdsa.prepare.walletId !== String(args.walletId)) throw new Error(`${args.responseName} response ECDSA prepare walletId does not match response`);
-	if (!sameWalletRegistrationSetupRuntimePolicyScope(args.intent.runtimePolicyScope, args.ecdsa.prepare.runtimePolicyScope)) throw new Error(`${args.responseName} response ECDSA runtimePolicyScope does not match intent`);
-	const strictLifecycle = args.ecdsa.strictRegistration.lifecycle;
-	if (strictLifecycle.lifecycle_id !== args.registrationCeremonyId || strictLifecycle.account_id !== String(args.walletId) || args.ecdsa.strictRegistration.client_id !== String(args.walletId)) throw new Error(`${args.responseName} response ECDSA identities do not match response`);
-}
-function parseWalletRegistrationSetupResponseV2(value) {
-	const responseName = "Wallet registration setup";
-	const response = requireWalletRegistrationResponseObject({
-		responseName,
-		field: "body",
-		value
-	});
-	if (readWalletRegistrationResponseField(response, "ok", responseName) !== true) throw new Error(`${responseName} response is not successful`);
-	const kind = readWalletRegistrationResponseField(response, "kind", responseName);
-	if (kind !== "near_ed25519" && kind !== "evm_family_ecdsa" && kind !== "near_ed25519_and_evm_family_ecdsa") throw new Error(`${responseName} response kind is invalid`);
-	const carriesEcdsa = kind !== "near_ed25519";
-	assertWalletRegistrationResponseKeys(response, [
-		"ok",
-		"registrationCeremonyId",
-		"walletId",
-		"walletAuthMethodId",
-		"registrationIntentDigestB64u",
-		"intent",
-		"signedSetup",
-		"kind",
-		...carriesEcdsa ? ["ecdsa"] : []
-	], responseName);
-	const registrationCeremonyId = readWalletRegistrationSetupString(response, "registrationCeremonyId", responseName);
-	const walletId = parseWalletId(readWalletRegistrationSetupString(response, "walletId", responseName));
-	if (!walletId.ok) throw new Error(`${responseName} response has an invalid walletId`);
-	const walletAuthMethodId = parseWalletAuthMethodId(readWalletRegistrationSetupString(response, "walletAuthMethodId", responseName));
-	if (!walletAuthMethodId.ok) throw new Error(`${responseName} response has an invalid walletAuthMethodId`);
-	const intent = parseWalletRegistrationSetupIntent(readWalletRegistrationResponseField(response, "intent", responseName));
-	if (intent.walletId !== walletId.value) throw new Error(`${responseName} response walletId does not match intent`);
-	if (intent.foundingWalletAuthMethodId !== walletAuthMethodId.value) throw new Error(`${responseName} response walletAuthMethodId does not match intent`);
-	let registrationIntentDigestB64u;
-	try {
-		registrationIntentDigestB64u = parseDigestB64u(readWalletRegistrationResponseField(response, "registrationIntentDigestB64u", responseName));
-	} catch {
-		throw new Error(`${responseName} response has an invalid registrationIntentDigestB64u`);
-	}
-	const signedSetup = readWalletRegistrationResponseField(response, "signedSetup", responseName);
-	if (typeof signedSetup !== "string" || !signedSetup.trim()) throw new Error(`${responseName} response missing signedSetup`);
-	if (!carriesEcdsa) {
-		if (walletRegistrationSetupKindFromIntent(intent) !== kind) throw new Error(`${responseName} response kind does not match intent`);
-		return {
-			ok: true,
-			registrationCeremonyId,
-			walletId: walletId.value,
-			walletAuthMethodId: walletAuthMethodId.value,
-			registrationIntentDigestB64u,
-			intent,
-			signedSetup,
-			kind: "near_ed25519"
-		};
-	}
-	const ecdsa = parseWalletRegistrationEcdsaPrepare(readWalletRegistrationResponseField(response, "ecdsa", responseName));
-	if (walletRegistrationSetupKindFromIntent(intent) !== kind) throw new Error(`${responseName} response kind does not match intent`);
-	assertWalletRegistrationSetupEcdsaBindings({
-		responseName,
-		registrationCeremonyId,
-		walletId: walletId.value,
-		intent,
-		ecdsa
-	});
-	return {
-		ok: true,
-		registrationCeremonyId,
-		walletId: walletId.value,
-		walletAuthMethodId: walletAuthMethodId.value,
-		registrationIntentDigestB64u,
-		intent,
-		signedSetup,
-		kind,
-		ecdsa
-	};
-}
-function normalizeWalletRegistrationSetupRequestForBinding(request) {
-	const authMethod = normalizeRegistrationAuthMethodInput(request.authMethod);
-	if (!authMethod) throw new Error("Wallet registration setup request authMethod is invalid");
-	const signerPlan = normalizeRegistrationSignerPlan(request.signerSelection);
-	if (!signerPlan.ok) throw new Error(`Wallet registration setup request signerSelection is invalid: ${signerPlan.message}`);
-	const signerSelection = registrationSignerSetSelectionFromPlan(signerPlan.value, { normalizeEcdsaChainTarget: normalizeWalletRegistrationSetupEcdsaChainTarget });
-	if (!signerSelection.ok) throw new Error(`Wallet registration setup request signerSelection is invalid: ${signerSelection.message}`);
-	return {
-		authMethod,
-		signerSelection: signerSelection.value
-	};
-}
-function registrationIntentWithExpectedSetupRequest(intent, request) {
-	const base = {
-		version: "registration_intent_v1",
-		walletId: intent.walletId,
-		authMethod: request.authMethod,
-		signerSelection: request.signerSelection,
-		foundingWalletAuthMethodId: intent.foundingWalletAuthMethodId,
-		nonceB64u: intent.nonceB64u
-	};
-	return intent.runtimePolicyScope === void 0 ? base : {
-		...base,
-		runtimePolicyScope: intent.runtimePolicyScope
-	};
-}
-async function assertWalletRegistrationSetupRequestBindings(args) {
-	if (args.requestedWallet?.kind === "provided") {
-		if (String(args.requestedWallet.walletId) !== args.response.walletId) throw new Error("Wallet registration setup response walletId does not match request");
-	}
-	if (await computeRegistrationIntentDigestB64u(args.response.intent) !== args.response.registrationIntentDigestB64u) throw new Error("Wallet registration setup response digest does not match intent");
-	if (await computeRegistrationIntentDigestB64u(registrationIntentWithExpectedSetupRequest(args.response.intent, args.request)) !== args.response.registrationIntentDigestB64u) throw new Error("Wallet registration setup response intent does not match request");
-}
-function parseWalletAddSignerEcdsaPrepare(value, expectedIntent) {
-	const responseName = "Wallet add-signer ECDSA start";
-	const record = requireWalletRegistrationResponseObject({
-		responseName,
-		field: "ecdsa",
-		value
-	});
-	assertWalletRegistrationResponseKeys(record, [
-		"kind",
-		"chainTargets",
-		"prepare",
-		"strictRegistration",
-		"custodyEnvelope"
-	], responseName);
-	const kind = readWalletRegistrationResponseField(record, "kind", responseName);
-	const responseChainTargets = readWalletRegistrationResponseField(record, "chainTargets", responseName);
-	if (kind !== "evm_family_ecdsa_keygen" || !Array.isArray(responseChainTargets)) throw new Error(`${responseName} response has invalid payload`);
-	if (expectedIntent.signerSelection.mode !== "ecdsa") throw new Error(`${responseName} response substituted signer branch`);
-	const expectedTargets = expectedIntent.signerSelection.ecdsa.chainTargets;
-	if (responseChainTargets.length !== expectedTargets.length) throw new Error(`${responseName} response changed target count`);
-	const chainTargets = [];
-	for (let index = 0; index < responseChainTargets.length; index += 1) {
-		const target = responseChainTargets[index];
-		const actual = parseWalletAddSignerChainTarget(target, responseName);
-		const expectedValue = expectedTargets[index];
-		if (!expectedValue) throw new Error(`${responseName} response changed chainTarget`);
-		if (!thresholdEcdsaChainTargetsEqual(actual, parseWalletAddSignerChainTarget(expectedValue, responseName))) throw new Error(`${responseName} response changed chainTarget`);
-		chainTargets.push(actual);
-	}
-	const [firstTarget, ...remainingTargets] = chainTargets;
-	if (!firstTarget) throw new Error(`${responseName} response requires an EVM-family target`);
-	const prepare = parseWalletAddSignerEcdsaPrepareContext(readWalletRegistrationResponseField(record, "prepare", responseName), responseName);
-	const strictRegistration = parseRouterAbEcdsaRegistrationRequestFactsV1(readWalletRegistrationResponseField(record, "strictRegistration", responseName));
-	if (strictRegistration.registration_purpose !== "wallet_add_signer") throw new Error(`${responseName} response has invalid registration purpose`);
-	return {
-		kind: "evm_family_ecdsa_keygen",
-		chainTargets: [firstTarget, ...remainingTargets],
-		prepare,
-		strictRegistration
-	};
-}
-function parseWalletAddSignerStartResponse(args) {
-	const responseName = "Wallet add-signer start";
-	const record = requireWalletRegistrationResponseObject({
-		responseName,
-		field: "body",
-		value: args.value
-	});
-	assertWalletRegistrationResponseKeys(record, [
-		"ok",
-		"addSignerCeremonyId",
-		"intent",
-		"authorizationKind",
-		"kind",
-		"ed25519",
-		"ecdsa"
-	], responseName);
-	if (readWalletRegistrationResponseField(record, "ok", responseName) !== true) throw new Error(`${responseName} response is not successful`);
-	const addSignerCeremonyId = requireResponseString({
-		responseName,
-		field: "addSignerCeremonyId",
-		value: readWalletRegistrationResponseField(record, "addSignerCeremonyId", responseName)
-	});
-	const intent = requireExactAddSignerIntent(readWalletRegistrationResponseField(record, "intent", responseName), args.expectedIntent);
-	const authorizationKind = readWalletRegistrationResponseField(record, "authorizationKind", responseName);
-	if (authorizationKind !== "webauthn_assertion") throw new Error(`${responseName} response has invalid authorization kind`);
-	switch (readWalletRegistrationResponseField(record, "kind", responseName)) {
-		case "near_ed25519": {
-			if (authorizationKind !== "webauthn_assertion" || intent.signerSelection.mode !== "ed25519" || readOptionalWalletRegistrationResponseField(record, "ecdsa", responseName) !== void 0) throw new Error(`${responseName} response substituted signer branch`);
-			const ed25519 = requireWalletRegistrationResponseObject({
-				responseName,
-				field: "ed25519",
-				value: readWalletRegistrationResponseField(record, "ed25519", responseName)
-			});
-			assertWalletRegistrationResponseKeys(ed25519, ["admissionRequest", "custodyEnvelope"], responseName);
-			const admission = parseRouterAbEd25519YaoRegistrationAdmissionRequestV1(readWalletRegistrationResponseField(ed25519, "admissionRequest", responseName));
-			if (!admission.ok) throw new Error(admission.message);
-			return {
-				ok: true,
-				addSignerCeremonyId,
-				intent,
-				authorizationKind: "webauthn_assertion",
-				kind: "near_ed25519",
-				ed25519: {
-					admissionRequest: admission.value,
-					custodyEnvelope: parsePasskeyCustodyEnvelopeRecord(readWalletRegistrationResponseField(ed25519, "custodyEnvelope", responseName))
-				}
-			};
-		}
-		case "evm_family_ecdsa": {
-			if (intent.signerSelection.mode !== "ecdsa" || readOptionalWalletRegistrationResponseField(record, "ed25519", responseName) !== void 0) throw new Error(`${responseName} response substituted signer branch`);
-			const rawEcdsa = readWalletRegistrationResponseField(record, "ecdsa", responseName);
-			const ecdsa = parseWalletAddSignerEcdsaPrepare(rawEcdsa, intent);
-			const ecdsaRecord = requireWalletRegistrationResponseObject({
-				responseName,
-				field: "ecdsa",
-				value: rawEcdsa
-			});
-			return {
-				ok: true,
-				addSignerCeremonyId,
-				intent,
-				authorizationKind: "webauthn_assertion",
-				kind: "evm_family_ecdsa",
-				ecdsa: {
-					...ecdsa,
-					custodyEnvelope: parsePasskeyCustodyEnvelopeRecord(readWalletRegistrationResponseField(ecdsaRecord, "custodyEnvelope", responseName))
-				}
-			};
-		}
-		default: throw new Error(`${responseName} response has invalid kind`);
-	}
-}
-function parseWalletAddSignerFinalizeResponse(args) {
-	const responseName = "Wallet add-signer finalize";
-	const record = requireWalletRegistrationResponseObject({
-		responseName,
-		field: "body",
-		value: args.value
-	});
-	assertWalletRegistrationResponseKeys(record, [
-		"ok",
-		"walletId",
-		"kind",
-		"rpId",
-		"credentialIdB64u",
-		"ed25519",
-		"ecdsa",
-		"authority"
-	], responseName);
-	const ok = readWalletRegistrationResponseField(record, "ok", responseName);
-	const kind = readWalletRegistrationResponseField(record, "kind", responseName);
-	if (ok !== true || kind !== args.expectedKind) throw new Error(`${responseName} response substituted signer branch`);
-	const walletId = walletIdFromString(requireResponseString({
-		responseName,
-		field: "walletId",
-		value: readWalletRegistrationResponseField(record, "walletId", responseName)
-	}));
-	const rpId = requireResponseRpId(readWalletRegistrationResponseField(record, "rpId", responseName), responseName);
-	switch (kind) {
-		case "near_ed25519": {
-			if (readOptionalWalletRegistrationResponseField(record, "ecdsa", responseName) !== void 0 || readOptionalWalletRegistrationResponseField(record, "authority", responseName) !== void 0) throw new Error(`${responseName} response mixed signer branches`);
-			const ed25519 = parseWalletEd25519YaoSignerPublicResult(readWalletRegistrationResponseField(record, "ed25519", responseName), "Wallet add-signer Ed25519 finalize");
-			return {
-				ok: true,
-				walletId,
-				kind: "near_ed25519",
-				rpId,
-				credentialIdB64u: requireResponseString({
-					responseName,
-					field: "credentialIdB64u",
-					value: readWalletRegistrationResponseField(record, "credentialIdB64u", responseName)
-				}),
-				ed25519
-			};
-		}
-		case "evm_family_ecdsa": {
-			if (readOptionalWalletRegistrationResponseField(record, "ed25519", responseName) !== void 0 || readOptionalWalletRegistrationResponseField(record, "credentialIdB64u", responseName) !== void 0) throw new Error(`${responseName} response mixed signer branches`);
-			const ecdsa = requireWalletRegistrationResponseObject({
-				responseName,
-				field: "ecdsa",
-				value: readWalletRegistrationResponseField(record, "ecdsa", responseName)
-			});
-			assertWalletRegistrationResponseKeys(ecdsa, ["walletKeys"], responseName);
-			const walletKeys = requireWalletRegistrationResponseArray(readWalletRegistrationResponseField(ecdsa, "walletKeys", responseName), `${responseName} walletKeys`);
-			if (walletKeys.length === 0) throw new Error(`${responseName} response has invalid walletKeys`);
-			const authority = parseWalletAuthorityV1(readWalletRegistrationResponseField(record, "authority", responseName));
-			if (!authority.ok || authority.value.state !== "active" || authority.value.walletId !== walletId) throw new Error(`${responseName} response has invalid authority`);
-			return {
-				ok: true,
-				walletId,
-				kind: "evm_family_ecdsa",
-				rpId,
-				ecdsa: { walletKeys: walletKeys.map(parseWalletAddSignerEcdsaFinalizeWalletKey) },
-				authority: authority.value
-			};
-		}
-		default: throw new Error(`${responseName} response has invalid kind`);
-	}
-}
-function parseWalletAddSignerEcdsaFinalizeWalletKey(value) {
-	return parseWalletAddSignerEcdsaWalletKey(value, "Wallet add-signer ECDSA finalize");
-}
-function requireMatchingString(args) {
-	const expected = String(args.expected || "").trim();
-	const actual = String(args.actual || "").trim();
-	if (!expected || !actual) throw new Error(`ECDSA registration bootstrap returned incomplete ${args.field}`);
-	if (expected !== actual) throw new Error(`ECDSA registration bootstrap ${args.field} mismatch`);
-	return actual;
-}
-function requireMatchingParticipantIds(args) {
-	const expected = args.expected.map((participantId) => Math.floor(Number(participantId)));
-	const actual = args.actual.map((participantId) => Math.floor(Number(participantId)));
-	if (expected.length === 0 || actual.length === 0 || expected.some((participantId) => !Number.isSafeInteger(participantId) || participantId <= 0) || actual.some((participantId) => !Number.isSafeInteger(participantId) || participantId <= 0)) throw new Error("ECDSA registration bootstrap returned incomplete participantIds");
-	if (expected.length !== actual.length || expected.some((id, index) => id !== actual[index])) throw new Error("ECDSA registration bootstrap participantIds mismatch");
-	return actual;
-}
-function parseWalletRegistrationEcdsaDerivationRespond(args) {
-	const clientBootstrap = args.clientBootstrap;
-	const serverBootstrap = args.serverBootstrap;
-	requireMatchingString({
-		field: "derivationClientSharePublicKey33B64u",
-		expected: clientBootstrap.derivationClientSharePublicKey33B64u,
-		actual: serverBootstrap.publicIdentity.derivationClientSharePublicKey33B64u
-	});
-	const contextBinding32B64u = requireMatchingString({
-		field: "contextBinding32B64u",
-		expected: clientBootstrap.contextBinding32B64u,
-		actual: serverBootstrap.contextBinding32B64u
-	});
-	const walletId = requireMatchingString({
-		field: "walletId",
-		expected: clientBootstrap.walletId,
-		actual: serverBootstrap.walletId
-	});
-	const evmFamilySigningKeySlotId = requireMatchingString({
-		field: "evmFamilySigningKeySlotId",
-		expected: clientBootstrap.evmFamilySigningKeySlotId,
-		actual: serverBootstrap.evmFamilySigningKeySlotId
-	});
-	requireMatchingString({
-		field: "activationEpoch",
-		expected: args.activationEpoch,
-		actual: serverBootstrap.activationEpoch
-	});
-	const participantIds = requireMatchingParticipantIds({
-		expected: clientBootstrap.participantIds,
-		actual: serverBootstrap.participantIds
-	});
-	const routerAbEcdsaDerivationNormalSigning = requireRouterAbEcdsaDerivationNormalSigningStateV1(serverBootstrap.routerAbEcdsaDerivationNormalSigning);
-	const ecdsaThresholdKeyId = String(serverBootstrap.ecdsaThresholdKeyId || "").trim();
-	const keyHandle = String(serverBootstrap.keyHandle || "").trim();
-	const signingRootId = String(serverBootstrap.signingRootId || "").trim();
-	const signingRootVersion = String(serverBootstrap.signingRootVersion || "").trim();
-	const applicationBindingDigestB64u = String(serverBootstrap.applicationBindingDigestB64u || "").trim();
-	const thresholdEcdsaPublicKeyB64u = String(serverBootstrap.thresholdEcdsaPublicKeyB64u || "").trim();
-	const ethereumAddress = String(serverBootstrap.ethereumAddress || "").trim();
-	const relayerKeyId = String(serverBootstrap.relayerKeyId || "").trim();
-	const relayerVerifyingShareB64u = String(serverBootstrap.relayerVerifyingShareB64u || "").trim();
-	const relayerShareRetryCounter = Math.floor(Number(serverBootstrap.relayerShareRetryCounter));
-	if (!walletId || !evmFamilySigningKeySlotId || !keyHandle || !ecdsaThresholdKeyId || !signingRootId || !signingRootVersion || !applicationBindingDigestB64u || !thresholdEcdsaPublicKeyB64u || !ethereumAddress || !relayerKeyId || !relayerVerifyingShareB64u || !Number.isSafeInteger(relayerShareRetryCounter) || relayerShareRetryCounter < 0 || !participantIds.length || participantIds.some((participantId) => !Number.isSafeInteger(participantId) || participantId <= 0)) throw new Error("ECDSA registration bootstrap returned incomplete session material");
-	return {
-		walletId,
-		evmFamilySigningKeySlotId,
-		ecdsaThresholdKeyId,
-		relayerKeyId,
-		applicationBindingDigestB64u,
-		contextBinding32B64u,
-		publicIdentity: serverBootstrap.publicIdentity,
-		relayerShareRetryCounter,
-		keyHandle,
-		signingRootId,
-		signingRootVersion,
-		thresholdEcdsaPublicKeyB64u,
-		ethereumAddress,
-		relayerVerifyingShareB64u,
-		participantIds,
-		routerAbEcdsaDerivationNormalSigning
-	};
-}
-function parseWalletEcdsaKeyFactsInventoryResponse(args) {
-	const responseName = "Wallet ECDSA key-facts inventory";
-	const response = requireWalletRegistrationResponseObject({
-		responseName,
-		field: "body",
-		value: args.value
-	});
-	assertWalletRegistrationResponseKeys(response, [
-		"ok",
-		"ecdsaKeyIdentityTargets",
-		"diagnostics"
-	], responseName);
-	if (readWalletRegistrationResponseField(response, "ok", responseName) !== true) throw new Error(`${responseName} response is not successful`);
-	const records = requireWalletRegistrationResponseArray(readWalletRegistrationResponseField(response, "ecdsaKeyIdentityTargets", responseName), `${responseName} ecdsaKeyIdentityTargets`);
-	return {
-		ok: true,
-		records: parseThresholdEcdsaKeyIdentityTargets({
-			walletId: args.walletId,
-			rpId: args.rpId,
-			records
-		}),
-		diagnostics: readWalletRegistrationResponseField(response, "diagnostics", responseName)
-	};
-}
-/**
-* `POST /wallets/register/setup` — the single admitted entry point replacing
-* the grant, intent, and start calls below.
-*
-* It is called *before* the WebAuthn create prompt, because its response
-* carries the challenge that create must sign. The server-side preparation
-* therefore overlaps the user's authenticator interaction.
-*/
-async function setupWalletRegistration(args) {
-	const publishableKey = String(args.auth?.publishableKey || "").trim();
-	const environmentId = String(args.auth?.environmentId || "").trim();
-	if (!publishableKey || !environmentId) return {
-		ok: false,
-		code: "invalid_body",
-		message: "registration setup requires a publishable key and environment id"
-	};
-	const normalizedRequest = normalizeWalletRegistrationSetupRequestForBinding(args.request);
-	const parsed = parseWalletRegistrationSetupResponseV2(await postJson({
-		relayerUrl: args.relayerUrl,
-		path: WALLET_REGISTRATION_SETUP_PATH,
-		headers: {
-			...args.headers,
-			Authorization: `Bearer ${publishableKey}`,
-			[ROUTER_API_ENVIRONMENT_ID_HEADER]: environmentId
-		},
-		body: {
-			...args.request.wallet ? { wallet: args.request.wallet } : {},
-			signerSelection: normalizedRequest.signerSelection,
-			authMethod: normalizedRequest.authMethod
-		},
-		...args.onServerTiming ? { onServerTiming: args.onServerTiming } : {}
-	}));
-	if (!parsed.ok) return parsed;
-	await assertWalletRegistrationSetupRequestBindings({
-		response: parsed,
-		...args.request.wallet ? { requestedWallet: args.request.wallet } : {},
-		request: normalizedRequest
-	});
-	return parsed;
-}
-async function createWalletAddSignerIntent(args) {
-	const walletId = String(args.walletId || "").trim();
-	if (!walletId) throw new Error("walletId is required for add-signer intent");
-	const publishableKey = String(args.auth.publishableKey || "").trim();
-	const environmentId = String(args.auth.environmentId || "").trim();
-	if (!publishableKey || !environmentId) throw new Error("add-signer intent requires a publishable key and environment id");
-	return parseCreateAddSignerIntentResponse(await postJson({
-		relayerUrl: args.relayerUrl,
-		path: `/wallets/${encodeURIComponent(walletId)}/signers/intent`,
-		headers: {
-			Authorization: `Bearer ${publishableKey}`,
-			[ROUTER_API_ENVIRONMENT_ID_HEADER]: environmentId
-		},
-		body: args.request
-	}));
-}
-function parseRevokeWalletAuthMethodResponse(value) {
-	const responseName = "Wallet auth-method revoke";
-	const response = requireWalletRegistrationResponseObject({
-		responseName,
-		field: "body",
-		value
-	});
-	if (readWalletRegistrationResponseField(response, "ok", responseName) !== true) throw new Error(`${responseName} response is not successful`);
-	const walletIdResult = parseWalletId(readWalletRegistrationResponseField(response, "walletId", responseName));
-	if (!walletIdResult.ok) throw new Error(`${responseName} response has invalid walletId`);
-	const authMethod = requireWalletRegistrationResponseObject({
-		responseName,
-		field: "authMethod",
-		value: readWalletRegistrationResponseField(response, "authMethod", responseName)
-	});
-	assertWalletRegistrationResponseKeys(authMethod, ["kind", "status"], `${responseName} response authMethod`);
-	if (readWalletRegistrationResponseField(authMethod, "status", responseName) !== "revoked") throw new Error(`${responseName} response has invalid authMethod status`);
-	switch (readWalletRegistrationResponseField(authMethod, "kind", responseName)) {
-		case "passkey":
-			assertWalletRegistrationResponseKeys(response, [
-				"ok",
-				"walletId",
-				"authMethod",
-				"rpId"
-			], responseName);
-			return {
-				ok: true,
-				walletId: walletIdResult.value,
-				authMethod: {
-					kind: "passkey",
-					status: "revoked"
-				},
-				rpId: requireResponseRpId(readWalletRegistrationResponseField(response, "rpId", responseName), responseName)
-			};
-		case "email_otp":
-			assertWalletRegistrationResponseKeys(response, [
-				"ok",
-				"walletId",
-				"authMethod"
-			], responseName);
-			return {
-				ok: true,
-				walletId: walletIdResult.value,
-				authMethod: {
-					kind: "email_otp",
-					status: "revoked"
-				}
-			};
-		default: throw new Error(`${responseName} response has invalid authMethod kind`);
-	}
-}
-/**
-* Revoke one auth method using a proof from a different active one.
-*
-* The route is the wallet's own auth-method management, not device linking:
-* a sibling on the same device is not a device, and the linked-device
-* management path authenticates an owner *request* rather than a factor proof
-* bound to this exact revocation.
-*/
-async function revokeWalletAuthMethod(args) {
-	const walletId = String(args.walletId || "").trim();
-	const walletAuthMethodId = String(args.walletAuthMethodId || "").trim();
-	if (!walletId || !walletAuthMethodId) throw new Error("auth-method revoke requires a wallet and a target method");
-	const request = {
-		relayerUrl: args.relayerUrl,
-		path: `/wallets/${encodeURIComponent(walletId)}/auth-methods/${encodeURIComponent(walletAuthMethodId)}/revoke`,
-		body: {
-			walletId,
-			walletAuthMethodId,
-			requestedAtMs: args.requestedAtMs,
-			sourceProof: args.sourceProof
-		}
-	};
-	let response;
-	try {
-		response = await postJson(request);
-	} catch (error) {
-		if (!(error instanceof TypeError)) throw error;
-		response = await postJson(request);
-	}
-	return parseRevokeWalletAuthMethodResponse(response);
-}
-async function createWalletAddAuthMethodIntent(args) {
-	const walletId = String(args.walletId || "").trim();
-	if (!walletId) throw new Error("walletId is required for add-auth-method intent");
-	const publishableKey = String(args.auth.publishableKey || "").trim();
-	const environmentId = String(args.auth.environmentId || "").trim();
-	if (!publishableKey || !environmentId) throw new Error("add-auth-method intent requires a publishable key and environment id");
-	const callerBody = args.request.caller.caller === "same_device_addition" ? {
-		caller: "same_device_addition",
-		source: args.request.caller.source
-	} : { caller: "linked_device_ceremony" };
-	return parseCreateAddAuthMethodIntentResponse(await postJson({
-		relayerUrl: args.relayerUrl,
-		path: `/wallets/${encodeURIComponent(walletId)}/auth-methods/intent`,
-		headers: {
-			Authorization: `Bearer ${publishableKey}`,
-			[ROUTER_API_ENVIRONMENT_ID_HEADER]: environmentId
-		},
-		body: {
-			walletId: args.request.walletId,
-			rpId: args.request.rpId,
-			authMethod: args.request.authMethod,
-			...callerBody
-		}
-	}));
-}
-/**
-* Strict boundary parser for route 2.
-*
-* `kind` selects which fields are legal, so the allowed-key set is computed
-* from it: a mixed response missing its Ed25519 arm, or an ECDSA-only response
-* carrying one, is rejected rather than silently narrowed. That is the point
-* of the discriminated union — a wallet whose NEAR branch was requested but
-* whose deferred work never arrived must fail loudly here, not register as
-* ECDSA-only.
-*/
-function parseWalletRegistrationRespondResponseV2(value) {
-	const responseName = "Wallet registration respond";
-	const response = requireWalletRegistrationResponseObject({
-		responseName,
-		field: "body",
-		value
-	});
-	if (readWalletRegistrationResponseField(response, "ok", responseName) !== true) throw new Error(`${responseName} response is not successful`);
-	const registrationCeremonyId = requireResponseString({
-		responseName,
-		field: "registrationCeremonyId",
-		value: readWalletRegistrationResponseField(response, "registrationCeremonyId", responseName)
-	});
-	const kind = readWalletRegistrationResponseField(response, "kind", responseName);
-	if (kind !== "evm_family_ecdsa" && kind !== "near_ed25519_and_evm_family_ecdsa" && kind !== "near_ed25519") throw new Error(`${responseName} response kind is invalid`);
-	const carriesEcdsa = kind !== "near_ed25519";
-	const carriesEd25519 = kind !== "evm_family_ecdsa";
-	assertWalletRegistrationResponseKeys(response, [
-		"ok",
-		"registrationCeremonyId",
-		"kind",
-		...carriesEcdsa ? ["ecdsa"] : [],
-		...carriesEd25519 ? ["ed25519"] : []
-	], responseName);
-	const ed25519Response = readOptionalWalletRegistrationResponseField(response, "ed25519", responseName);
-	if (carriesEd25519 && ed25519Response === void 0) throw new Error(`${responseName} signer plan is missing its ed25519 deferred work`);
-	if (!carriesEcdsa) return {
-		ok: true,
-		registrationCeremonyId,
-		kind: "near_ed25519",
-		ed25519: parseWalletRegistrationRespondEd25519DeferredWork(ed25519Response)
-	};
-	const ecdsaRecord = requireWalletRegistrationResponseObject({
-		responseName,
-		field: "ecdsa",
-		value: readWalletRegistrationResponseField(response, "ecdsa", responseName)
-	});
-	assertWalletRegistrationResponseKeys(ecdsaRecord, ["kind", "strictResult"], `${responseName} ecdsa`);
-	if (readWalletRegistrationResponseField(ecdsaRecord, "kind", `${responseName} ecdsa`) !== "router_ab_ecdsa_registration_forwarded_v1") throw new Error(`${responseName} ecdsa kind is invalid`);
-	const ed25519 = carriesEd25519 ? parseWalletRegistrationRespondEd25519DeferredWork(ed25519Response) : null;
-	const ecdsa = {
-		kind: "router_ab_ecdsa_registration_forwarded_v1",
-		strictResult: parseRouterAbEcdsaStrictForwardedRegistrationResponseV1(readWalletRegistrationResponseField(ecdsaRecord, "strictResult", `${responseName} ecdsa`))
-	};
-	return ed25519 ? {
-		ok: true,
-		registrationCeremonyId,
-		kind: "near_ed25519_and_evm_family_ecdsa",
-		ecdsa,
-		ed25519
-	} : {
-		ok: true,
-		registrationCeremonyId,
-		kind: "evm_family_ecdsa",
-		ecdsa
-	};
-}
-function parseWalletRegistrationRespondEd25519DeferredWork(value) {
-	const responseName = "Wallet registration respond ed25519";
-	const record = requireWalletRegistrationResponseObject({
-		responseName,
-		field: "ed25519",
-		value
-	});
-	assertWalletRegistrationResponseKeys(record, ["status", "admissionRequest"], responseName);
-	if (readWalletRegistrationResponseField(record, "status", responseName) !== "deferred") throw new Error(`${responseName} status is invalid`);
-	const admissionRequest = parseRouterAbEd25519YaoRegistrationAdmissionRequestV1(readWalletRegistrationResponseField(record, "admissionRequest", responseName));
-	if (!admissionRequest.ok) throw new Error(`${responseName} admissionRequest is invalid`);
-	return {
-		status: "deferred",
-		admissionRequest: admissionRequest.value
-	};
-}
-function walletRegistrationRespondBody(args) {
-	const body = {
-		registrationCeremonyId: args.registrationCeremonyId,
-		signedSetup: args.signedSetup,
-		kind: args.signerPlanKind
-	};
-	switch (args.kind) {
-		case "passkey":
-			body.webauthn_registration = args.webauthnRegistration;
-			break;
-		case "email_otp":
-			body.emailOtpRegistrationProof = args.emailOtpRegistrationProof;
-			break;
-	}
-	if (args.ecdsa) body.ecdsa = args.ecdsa;
-	return body;
-}
-async function respondWalletRegistration(args) {
-	return parseWalletRegistrationRespondResponseV2(await postJson({
-		relayerUrl: args.relayerUrl,
-		path: WALLET_REGISTRATION_RESPOND_PATH,
-		headers: args.headers,
-		body: walletRegistrationRespondBody(args),
-		onServerTiming: args.onServerTiming
-	}));
-}
-function parseRegistrationEstablishedSessionResult(value, expectedWalletId) {
-	const responseName = "Wallet registration established session";
-	const parsed = parseRegistrationEstablishedSessionResultV2(value);
-	if (parsed === null || parsed.session.walletId !== expectedWalletId) throw new Error(`${responseName} direct session result is invalid`);
-	return parsed;
-}
-function buildWalletRegistrationFinalizeTerminalResponse(record, ecdsa) {
-	const responseName = "Wallet registration activate";
-	const registrationDiagnostics = readOptionalWalletRegistrationResponseField(record, "registrationDiagnostics", responseName);
-	const rpId = readOptionalWalletRegistrationResponseField(record, "rpId", responseName);
-	const walletCustody = readOptionalWalletRegistrationResponseField(record, "walletCustody", responseName);
-	const custodyKeyManifestDigestB64u = readOptionalWalletRegistrationResponseField(record, "custodyKeyManifestDigestB64u", responseName);
-	return {
-		ok: readWalletRegistrationResponseField(record, "ok", responseName),
-		walletId: readWalletRegistrationResponseField(record, "walletId", responseName),
-		authority: readWalletRegistrationResponseField(record, "authority", responseName),
-		foundingAuthority: readWalletRegistrationResponseField(record, "foundingAuthority", responseName),
-		foundingAuthMethod: readWalletRegistrationResponseField(record, "foundingAuthMethod", responseName),
-		...registrationDiagnostics === void 0 ? {} : { registrationDiagnostics },
-		...rpId === void 0 ? {} : { rpId },
-		authMethod: readWalletRegistrationResponseField(record, "authMethod", responseName),
-		...walletCustody === void 0 ? {} : { walletCustody },
-		...custodyKeyManifestDigestB64u === void 0 ? {} : { custodyKeyManifestDigestB64u },
-		kind: "evm_family_ecdsa",
-		ecdsa: { walletKeys: readWalletRegistrationResponseField(ecdsa, "walletKeys", responseName) }
-	};
-}
-function buildWalletRegistrationNearFinalizeTerminalResponse(record) {
-	const responseName = "Wallet registration NEAR provisioning";
-	const registrationDiagnostics = readOptionalWalletRegistrationResponseField(record, "registrationDiagnostics", responseName);
-	const rpId = readOptionalWalletRegistrationResponseField(record, "rpId", responseName);
-	const walletCustody = readOptionalWalletRegistrationResponseField(record, "walletCustody", responseName);
-	const custodyKeyManifestDigestB64u = readOptionalWalletRegistrationResponseField(record, "custodyKeyManifestDigestB64u", responseName);
-	return {
-		ok: readWalletRegistrationResponseField(record, "ok", responseName),
-		walletId: readWalletRegistrationResponseField(record, "walletId", responseName),
-		authority: readWalletRegistrationResponseField(record, "authority", responseName),
-		foundingAuthority: readWalletRegistrationResponseField(record, "foundingAuthority", responseName),
-		foundingAuthMethod: readWalletRegistrationResponseField(record, "foundingAuthMethod", responseName),
-		...registrationDiagnostics === void 0 ? {} : { registrationDiagnostics },
-		...rpId === void 0 ? {} : { rpId },
-		authMethod: readWalletRegistrationResponseField(record, "authMethod", responseName),
-		...walletCustody === void 0 ? {} : { walletCustody },
-		...custodyKeyManifestDigestB64u === void 0 ? {} : { custodyKeyManifestDigestB64u },
-		kind: "near_ed25519",
-		authorityScope: readWalletRegistrationResponseField(record, "authorityScope", responseName),
-		accountProvisioning: readWalletRegistrationResponseField(record, "accountProvisioning", responseName),
-		resolvedAccount: readWalletRegistrationResponseField(record, "resolvedAccount", responseName),
-		ed25519: readWalletRegistrationResponseField(record, "ed25519", responseName)
-	};
-}
-/**
-* Strict boundary parser for route 3.
-*
-* The terminal wallet body is exactly the finalize success this route
-* absorbed, so it is parsed by the existing finalize parser rather than a
-* second copy that could drift from it. Only `nearProvisioning` is new.
-*
-* That field is a status and nothing else: NEAR identifiers before readiness
-* are precisely what the deferred lifecycle exists to prevent, so a payload
-* carrying them here is rejected instead of passed through.
-*/
-function parseWalletRegistrationActivateResponseV2(value) {
-	const responseName = "Wallet registration activate";
-	const record = requireWalletRegistrationResponseObject({
-		responseName,
-		field: "body",
-		value
-	});
-	const kind = readWalletRegistrationResponseField(record, "kind", responseName);
-	const nearProvisioning = readOptionalWalletRegistrationResponseField(record, "nearProvisioning", responseName);
-	const rawEstablishedSession = readOptionalWalletRegistrationResponseField(record, "registrationEstablishedSession", responseName);
-	if (kind === "near_ed25519") {
-		const provisioning = requireWalletRegistrationResponseObject({
-			responseName,
-			field: "nearProvisioning",
-			value: nearProvisioning
-		});
-		assertWalletRegistrationResponseKeys(provisioning, ["status"], `${responseName} nearProvisioning`);
-		if (readWalletRegistrationResponseField(provisioning, "status", `${responseName} nearProvisioning`) !== "near_pending") throw new Error(`${responseName} Ed25519-only wallet must be pending NEAR provisioning`);
-		if (rawEstablishedSession !== void 0) throw new Error(`${responseName} pending Ed25519 wallet cannot carry an established session`);
-		assertWalletRegistrationResponseKeys(record, [
-			"ok",
-			"walletId",
-			"authority",
-			"registrationDiagnostics",
-			"rpId",
-			"authMethod",
-			"walletCustody",
-			"kind",
-			"nearProvisioning"
-		], responseName);
-		if (readWalletRegistrationResponseField(record, "ok", responseName) !== true) throw new Error(`${responseName} did not return a pending Ed25519 wallet`);
-		const walletId = walletIdFromString(requireResponseString({
-			responseName,
-			field: "walletId",
-			value: readWalletRegistrationResponseField(record, "walletId", responseName)
-		}));
-		const authority = parseWalletRegistrationFinalizeAuthority(readWalletRegistrationResponseField(record, "authority", responseName));
-		const authorityBranch = parseWalletRegistrationFinalizeAuthorityBranch({
-			response: {
-				authMethod: readWalletRegistrationResponseField(record, "authMethod", responseName),
-				rpId: readOptionalWalletRegistrationResponseField(record, "rpId", responseName)
-			},
-			walletId,
-			authority
-		});
-		const registrationDiagnosticsValue = readOptionalWalletRegistrationResponseField(record, "registrationDiagnostics", responseName);
-		const registrationDiagnostics = registrationDiagnosticsValue === void 0 ? void 0 : parseWalletRegistrationFinalizeDiagnostics(registrationDiagnosticsValue);
-		if (authorityBranch.kind === "passkey") return {
-			ok: true,
-			kind: "near_ed25519",
-			walletId,
-			authority,
-			...registrationDiagnostics ? { registrationDiagnostics } : {},
-			rpId: authorityBranch.rpId,
-			authMethod: authorityBranch.authMethod,
-			nearProvisioning: { status: "near_pending" }
-		};
-		return {
-			ok: true,
-			kind: "near_ed25519",
-			walletId,
-			authority,
-			...registrationDiagnostics ? { registrationDiagnostics } : {},
-			authMethod: authorityBranch.authMethod,
-			...readOptionalWalletRegistrationResponseField(record, "walletCustody", responseName) === void 0 ? {} : { walletCustody: parseWalletCustodyRegistrationOutcome(readWalletRegistrationResponseField(record, "walletCustody", responseName), responseName) },
-			nearProvisioning: { status: "near_pending" }
-		};
-	}
-	if (kind !== "evm_family_ecdsa") throw new Error(`${responseName} response has invalid kind`);
-	const ecdsaRecord = requireWalletRegistrationResponseObject({
-		responseName,
-		field: "ecdsa",
-		value: readWalletRegistrationResponseField(record, "ecdsa", responseName)
-	});
-	assertWalletRegistrationResponseKeys(record, [
-		"ok",
-		"walletId",
-		"authority",
-		"foundingAuthority",
-		"foundingAuthMethod",
-		"registrationDiagnostics",
-		"rpId",
-		"authMethod",
-		"walletCustody",
-		"custodyKeyManifestDigestB64u",
-		"kind",
-		"ecdsa",
-		"nearProvisioning",
-		"registrationEstablishedSession"
-	], responseName);
-	assertWalletRegistrationResponseKeys(ecdsaRecord, [
-		"walletKeys",
-		"activation",
-		"bootstrap"
-	], responseName);
-	const activation = readOptionalWalletRegistrationResponseField(ecdsaRecord, "activation", responseName);
-	const bootstrap = readOptionalWalletRegistrationResponseField(ecdsaRecord, "bootstrap", responseName);
-	if (nearProvisioning !== void 0) {
-		const provisioning = requireWalletRegistrationResponseObject({
-			responseName,
-			field: "nearProvisioning",
-			value: nearProvisioning
-		});
-		assertWalletRegistrationResponseKeys(provisioning, ["status"], `${responseName} nearProvisioning`);
-		if (readWalletRegistrationResponseField(provisioning, "status", `${responseName} nearProvisioning`) !== "near_pending") throw new Error(`${responseName} nearProvisioning status is invalid`);
-	}
-	if (activation === void 0 || bootstrap === void 0) throw new Error(`${responseName} is missing the activation payload the client needs to build its ECDSA session`);
-	const finalized = parseWalletRegistrationFinalizeResponse({
-		value: buildWalletRegistrationFinalizeTerminalResponse(record, ecdsaRecord),
-		expectedKind: "evm_family_ecdsa"
-	});
-	if (!finalized.ok || finalized.kind !== "evm_family_ecdsa") throw new Error(`${responseName} did not return an activated ECDSA wallet`);
-	const registrationEstablishedSession = parseRegistrationEstablishedSessionResult(rawEstablishedSession, finalized.walletId);
-	return {
-		...finalized,
-		ecdsa: {
-			...finalized.ecdsa,
-			activation: parseRouterAbEcdsaRegistrationPublicActivationReceiptV1(activation),
-			bootstrap: parseThresholdEcdsaDerivationRoleLocalBootstrapValue(bootstrap)
-		},
-		registrationEstablishedSession,
-		...nearProvisioning === void 0 ? {} : { nearProvisioning: { status: "near_pending" } }
-	};
-}
-function walletRegistrationActivateBody(args) {
-	const body = {
-		registrationCeremonyId: args.registrationCeremonyId,
-		kind: args.signerPlanKind,
-		signedSetup: args.signedSetup,
-		idempotencyKey: args.idempotencyKey
-	};
-	if (args.ecdsa) body.ecdsa = args.ecdsa;
-	if (args.emailOtpEnrollment) body.emailOtpEnrollment = args.emailOtpEnrollment;
-	if (args.walletCustodyCommit) body.walletCustodyCommit = args.walletCustodyCommit;
-	return body;
-}
-async function activateWalletRegistration(args) {
-	return parseWalletRegistrationActivateResponseV2(await postJson({
-		relayerUrl: args.relayerUrl,
-		path: WALLET_REGISTRATION_ACTIVATE_PATH,
-		headers: args.headers,
-		body: walletRegistrationActivateBody(args),
-		onServerTiming: args.onServerTiming
-	}));
-}
-function parseWalletRegistrationSessionSealResponse(value) {
-	const responseName = "Wallet registration session seal";
-	const record = requireWalletRegistrationResponseObject({
-		responseName,
-		field: "body",
-		value
-	});
-	assertWalletRegistrationResponseKeys(record, [
-		"ciphertext",
-		"keyVersion",
-		"expiresAtMs",
-		"remainingUses"
-	], responseName);
-	const ciphertext = readWalletRegistrationResponseField(record, "ciphertext", responseName);
-	const keyVersion = readWalletRegistrationResponseField(record, "keyVersion", responseName);
-	const expiresAtMs = readWalletRegistrationResponseField(record, "expiresAtMs", responseName);
-	const remainingUses = readWalletRegistrationResponseField(record, "remainingUses", responseName);
-	if (typeof ciphertext !== "string" || !ciphertext.trim() || typeof keyVersion !== "string" || !keyVersion.trim() || typeof expiresAtMs !== "number" || !Number.isSafeInteger(expiresAtMs) || expiresAtMs <= 0 || typeof remainingUses !== "number" || !Number.isSafeInteger(remainingUses) || remainingUses < 0) throw new Error(`${responseName} is invalid`);
-	return {
-		ciphertext,
-		keyVersion,
-		expiresAtMs,
-		remainingUses
-	};
-}
-function parseWalletRegistrationNearProvisioningResponseV2(value) {
-	const responseName = "Wallet registration NEAR provisioning";
-	const record = requireWalletRegistrationResponseObject({
-		responseName,
-		field: "body",
-		value
-	});
-	if (readWalletRegistrationResponseField(record, "ok", responseName) !== true) {
-		assertWalletRegistrationResponseKeys(record, [
-			"ok",
-			"code",
-			"message",
-			"nearProvisioning"
-		], responseName);
-		const code = readWalletRegistrationResponseField(record, "code", responseName);
-		const message = readWalletRegistrationResponseField(record, "message", responseName);
-		if (typeof code !== "string" || typeof message !== "string") throw new Error(`${responseName} failure is invalid`);
-		const nearProvisioning = readOptionalWalletRegistrationResponseField(record, "nearProvisioning", responseName);
-		if (nearProvisioning !== void 0) {
-			const status = requireWalletRegistrationResponseObject({
-				responseName,
-				field: "nearProvisioning",
-				value: nearProvisioning
-			});
-			assertWalletRegistrationResponseKeys(status, ["status"], `${responseName} nearProvisioning`);
-			if (readWalletRegistrationResponseField(status, "status", `${responseName} nearProvisioning`) !== "near_failed_retryable") throw new Error(`${responseName} failure status is invalid`);
-			return {
-				ok: false,
-				code,
-				message,
-				nearProvisioning: { status: "near_failed_retryable" }
-			};
-		}
-		return {
-			ok: false,
-			code,
-			message
-		};
-	}
-	assertWalletRegistrationResponseKeys(record, [
-		"ok",
-		"walletId",
-		"authority",
-		"foundingAuthority",
-		"foundingAuthMethod",
-		"registrationDiagnostics",
-		"rpId",
-		"authMethod",
-		"walletCustody",
-		"custodyKeyManifestDigestB64u",
-		"kind",
-		"accountProvisioning",
-		"resolvedAccount",
-		"ed25519",
-		"authorityScope",
-		"nearProvisioning",
-		"registrationEstablishedSession",
-		"sessionSeal"
-	], responseName);
-	const provisioning = requireWalletRegistrationResponseObject({
-		responseName,
-		field: "nearProvisioning",
-		value: readWalletRegistrationResponseField(record, "nearProvisioning", responseName)
-	});
-	assertWalletRegistrationResponseKeys(provisioning, ["status"], `${responseName} nearProvisioning`);
-	if (readWalletRegistrationResponseField(provisioning, "status", `${responseName} nearProvisioning`) !== "near_ready") throw new Error(`${responseName} success status is invalid`);
-	const finalized = parseWalletRegistrationFinalizeResponse({
-		value: buildWalletRegistrationNearFinalizeTerminalResponse(record),
-		expectedKind: "near_ed25519"
-	});
-	if (!finalized.ok || finalized.kind !== "near_ed25519") throw new Error(`${responseName} did not return a finalized Ed25519 wallet`);
-	const sessionSeal = readOptionalWalletRegistrationResponseField(record, "sessionSeal", responseName);
-	const registrationEstablishedSession = parseRegistrationEstablishedSessionResult(readWalletRegistrationResponseField(record, "registrationEstablishedSession", responseName), finalized.walletId);
-	if (isEmailOtpWalletRegistrationFinalizeResponse(finalized)) {
-		if (sessionSeal !== void 0) throw new Error(`${responseName} returned a session seal for an Email OTP authority`);
-		return {
-			...finalized,
-			nearProvisioning: { status: "near_ready" },
-			registrationEstablishedSession
-		};
-	}
-	const success = {
-		...finalized,
-		nearProvisioning: { status: "near_ready" },
-		registrationEstablishedSession
-	};
-	if (sessionSeal === void 0) return success;
-	return {
-		...success,
-		sessionSeal: parseWalletRegistrationSessionSealResponse(sessionSeal)
-	};
-}
-async function completeWalletRegistrationNearProvisioning(args) {
-	const body = {
-		registrationCeremonyId: args.registrationCeremonyId,
-		signedSetup: args.signedSetup,
-		idempotencyKey: args.idempotencyKey,
-		ed25519: args.ed25519
-	};
-	if (args.auth.kind === "email_otp") body.emailOtpEnrollment = args.auth.enrollment;
-	if (args.walletCustodyCommit) body.walletCustodyCommit = args.walletCustodyCommit;
-	if (args.sessionSeal) body.sessionSeal = args.sessionSeal;
-	return parseWalletRegistrationNearProvisioningResponseV2(await postJson({
-		relayerUrl: args.relayerUrl,
-		path: WALLET_REGISTRATION_NEAR_PROVISIONING_PATH,
-		headers: args.headers,
-		body,
-		...args.onServerTiming ? { onServerTiming: args.onServerTiming } : {}
-	}));
-}
-function addSignerAuthBody(auth) {
-	switch (auth.kind) {
-		case "webauthn_assertion": return {
-			kind: "webauthn_assertion",
-			rpId: auth.rpId,
-			credential: auth.credential,
-			expectedChallengeDigestB64u: auth.expectedChallengeDigestB64u
-		};
-	}
-}
-function addAuthMethodAuthBody(auth) {
-	switch (auth.kind) {
-		case "webauthn_assertion": return {
-			kind: "webauthn_assertion",
-			rpId: auth.rpId,
-			credential: auth.credential,
-			expectedChallengeDigestB64u: auth.expectedChallengeDigestB64u
-		};
-		case "wallet_session": return { kind: "wallet_session" };
-		case "email_otp": return {
-			kind: "email_otp",
-			challengeId: auth.challengeId,
-			otpCode: auth.otpCode,
-			expectedChallengeDigestB64u: auth.expectedChallengeDigestB64u
-		};
-	}
-}
-function addAuthMethodAuthorityBody(authority) {
-	switch (authority.kind) {
-		case "passkey": return {};
-		case "email_otp": return { emailOtpRegistrationProof: authority.emailOtpRegistrationProof };
-	}
-}
-async function startWalletAddSigner(args) {
-	const walletId = String(args.walletId || "").trim();
-	if (!walletId) throw new Error("walletId is required for add-signer start");
-	return parseWalletAddSignerStartResponse({
-		value: await postJson({
-			relayerUrl: args.relayerUrl,
-			path: `/wallets/${encodeURIComponent(walletId)}/signers/start`,
-			body: {
-				addSignerIntentGrant: args.addSignerIntentGrant,
-				addSignerIntentDigestB64u: args.addSignerIntentDigestB64u,
-				intent: args.intent,
-				auth: addSignerAuthBody(args.auth)
-			}
-		}),
-		expectedIntent: args.intent
-	});
-}
-function parseAddAuthMethodEmailOtpChallengeResponse(value) {
-	const responseName = "Email OTP enrollment code";
-	const response = requireWalletRegistrationResponseObject({
-		responseName,
-		field: "body",
-		value
-	});
-	assertWalletRegistrationResponseKeys(response, [
-		"ok",
-		"challengeId",
-		"expiresAtMs",
-		"emailHint"
-	], responseName);
-	if (readWalletRegistrationResponseField(response, "ok", responseName) !== true) throw new Error(`${responseName} response is not successful`);
-	const challengeIdValue = readWalletRegistrationResponseField(response, "challengeId", responseName);
-	if (typeof challengeIdValue !== "string" || !challengeIdValue.trim()) throw new Error(`${responseName} response missing challengeId`);
-	const expiresAtMs = readWalletRegistrationResponseField(response, "expiresAtMs", responseName);
-	if (typeof expiresAtMs !== "number" || !Number.isSafeInteger(expiresAtMs) || expiresAtMs < 1) throw new Error(`${responseName} response has invalid expiresAtMs`);
-	const emailHint = readWalletRegistrationResponseField(response, "emailHint", responseName);
-	if (typeof emailHint !== "string") throw new Error(`${responseName} response has invalid emailHint`);
-	return {
-		challengeId: challengeIdValue.trim(),
-		expiresAtMs,
-		emailHint
-	};
-}
-/**
-* Sends the enrollment code for an Email OTP addition.
-*
-* Carries no address: the server reads it from the intent the grant names, so
-* a client cannot redirect a wallet's enrollment code. Callable more than once
-* for the same intent, which is what a resend is.
-*/
-async function requestAddAuthMethodEmailOtpChallenge(args) {
-	const walletId = String(args.walletId || "").trim();
-	if (!walletId) throw new Error("walletId is required for the Email OTP enrollment code");
-	return parseAddAuthMethodEmailOtpChallengeResponse(await postJson({
-		relayerUrl: args.relayerUrl,
-		path: `/wallets/${encodeURIComponent(walletId)}/auth-methods/email-otp/challenge`,
-		body: {
-			addAuthMethodIntentGrant: args.addAuthMethodIntentGrant,
-			addAuthMethodIntentDigestB64u: args.addAuthMethodIntentDigestB64u
-		}
-	}));
-}
-async function startWalletAddAuthMethod(args) {
-	const walletId = String(args.walletId || "").trim();
-	if (!walletId) throw new Error("walletId is required for add-auth-method start");
-	return parseWalletAddAuthMethodStartResponse({
-		value: await postJson({
-			relayerUrl: args.relayerUrl,
-			path: `/wallets/${encodeURIComponent(walletId)}/auth-methods/start`,
-			body: {
-				addAuthMethodIntentGrant: args.addAuthMethodIntentGrant,
-				addAuthMethodIntentDigestB64u: args.addAuthMethodIntentDigestB64u,
-				intent: args.intent,
-				auth: addAuthMethodAuthBody(args.auth),
-				...addAuthMethodAuthorityBody(args.authority)
-			},
-			...args.auth.kind === "wallet_session" ? { headers: { authorization: `Bearer ${args.auth.walletSessionToken}` } } : {}
-		}),
-		expectedIntent: args.intent
-	});
-}
-async function respondWalletAddSignerEcdsa(args) {
-	const walletId = String(args.walletId || "").trim();
-	if (!walletId) throw new Error("walletId is required for add-signer ECDSA respond");
-	return parseWalletAddSignerEcdsaRespondResponse(await postJson({
-		relayerUrl: args.relayerUrl,
-		path: `/wallets/${encodeURIComponent(walletId)}/signers/derivation/respond`,
-		body: {
-			addSignerCeremonyId: args.addSignerCeremonyId,
-			ecdsa: args.ecdsa
-		}
-	}));
-}
-async function activateWalletAddSignerEcdsa(args) {
-	const walletId = String(args.walletId || "").trim();
-	if (!walletId) throw new Error("walletId is required for add-signer ECDSA activation");
-	return parseWalletAddSignerEcdsaActivationResponse(await postJson({
-		relayerUrl: args.relayerUrl,
-		path: `/wallets/${encodeURIComponent(walletId)}/signers/derivation/activate`,
-		body: {
-			addSignerCeremonyId: args.addSignerCeremonyId,
-			ecdsa: {
-				kind: "router_ab_ecdsa_registration_activation_v1",
-				activationCorrelationId: args.activationCorrelationId,
-				publicFacts: args.publicFacts,
-				expectedActivationRequestDigest: args.expectedActivationRequestDigest
-			}
-		}
-	}));
-}
-function addSignerFinalizeBody(args) {
-	switch (args.kind) {
-		case "near_ed25519": return {
-			addSignerCeremonyId: args.addSignerCeremonyId,
-			idempotencyKey: args.idempotencyKey,
-			kind: args.kind,
-			ed25519: args.ed25519,
-			custodyKeySet: args.custodyKeySet
-		};
-		case "evm_family_ecdsa": return {
-			addSignerCeremonyId: args.addSignerCeremonyId,
-			idempotencyKey: args.idempotencyKey,
-			kind: args.kind,
-			ecdsa: args.ecdsa,
-			custodyKeySet: args.custodyKeySet
-		};
-	}
-}
-async function finalizeWalletAddSigner(args) {
-	const walletId = String(args.walletId || "").trim();
-	if (!walletId) throw new Error("walletId is required for add-signer finalize");
-	return parseWalletAddSignerFinalizeResponse({
-		value: await postJson({
-			relayerUrl: args.relayerUrl,
-			path: `/wallets/${encodeURIComponent(walletId)}/signers/finalize`,
-			body: addSignerFinalizeBody(args)
-		}),
-		expectedKind: args.kind
-	});
-}
-async function finalizeWalletAddAuthMethod(args) {
-	const walletId = String(args.walletId || "").trim();
-	if (!walletId) throw new Error("walletId is required for add-auth-method finalize");
-	const body = args.custodyEnvelope === void 0 ? { addAuthMethodCeremonyId: args.addAuthMethodCeremonyId } : args.webauthnRegistration === void 0 ? {
-		addAuthMethodCeremonyId: args.addAuthMethodCeremonyId,
-		custodyEnvelope: parsePasskeyCustodyEnvelopeRecord(args.custodyEnvelope),
-		emailOtpTarget: args.emailOtpTarget
-	} : {
-		addAuthMethodCeremonyId: args.addAuthMethodCeremonyId,
-		webauthnRegistration: args.webauthnRegistration,
-		custodyEnvelope: parsePasskeyCustodyEnvelopeRecord(args.custodyEnvelope)
-	};
-	const request = {
-		relayerUrl: args.relayerUrl,
-		path: `/wallets/${encodeURIComponent(walletId)}/auth-methods/finalize`,
-		body
-	};
-	let response;
-	try {
-		response = await postJson(request);
-	} catch (error) {
-		if (!(error instanceof TypeError)) throw error;
-		response = await postJson(request);
-	}
-	return parseWalletAddAuthMethodFinalizeResponse(response);
-}
-async function fetchWalletEcdsaKeyFactsInventoryWithOperationCredential(args) {
-	const walletId = String(args.walletId || "").trim();
-	const rpId = String(args.rpId || "").trim();
-	const operationCredential = args.operationCredential;
-	if (!walletId) throw new Error("walletId is required for ECDSA key-facts inventory");
-	if (!rpId) throw new Error("rpId is required for ECDSA key-facts inventory");
-	return parseWalletEcdsaKeyFactsInventoryResponse({
-		value: await postJson({
-			relayerUrl: args.relayerUrl,
-			path: `/wallets/${encodeURIComponent(walletId)}/signers/ecdsa/key-facts/inventory`,
-			headers: buildBearerAuthorizationHeader({
-				token: operationCredential.token,
-				missingMessage: "Wallet Session operation credential is required for ECDSA key-facts inventory"
-			}),
-			body: {
-				rpId,
-				keyTargets: args.keyTargets,
-				auth: {
-					kind: operationCredential.kind,
-					walletSessionId: operationCredential.walletSessionId
-				}
-			}
-		}),
-		walletId: args.walletId,
-		rpId
-	});
-}
-async function fetchWalletEcdsaKeyFactsInventoryWithWebAuthn(args) {
-	const walletId = String(args.walletId || "").trim();
-	const rpId = String(args.rpId || "").trim();
-	const serverNonceB64u = String(args.serverNonceB64u || "").trim();
-	const expectedChallengeDigestB64u = String(args.expectedChallengeDigestB64u || "").trim();
-	if (!walletId) throw new Error("walletId is required for ECDSA key-facts inventory");
-	if (!rpId) throw new Error("rpId is required for ECDSA key-facts inventory");
-	if (!serverNonceB64u || !expectedChallengeDigestB64u) throw new Error("WebAuthn ECDSA key-facts inventory requires challenge binding");
-	return parseWalletEcdsaKeyFactsInventoryResponse({
-		value: await postJson({
-			relayerUrl: args.relayerUrl,
-			path: `/wallets/${encodeURIComponent(walletId)}/signers/ecdsa/key-facts/inventory`,
-			body: {
-				rpId,
-				keyTargets: args.keyTargets,
-				auth: {
-					kind: "webauthn_assertion",
-					credential: args.credential,
-					serverNonceB64u,
-					expectedChallengeDigestB64u,
-					...args.runtimePolicyScope ? { runtimePolicyScope: args.runtimePolicyScope } : {}
-				}
-			}
-		}),
-		walletId: args.walletId,
-		rpId
-	});
-}
-//#endregion
-export { activateWalletAddSignerEcdsa, activateWalletRegistration, completeWalletRegistrationNearProvisioning, createWalletAddAuthMethodIntent, createWalletAddSignerIntent, fetchWalletEcdsaKeyFactsInventoryWithOperationCredential, fetchWalletEcdsaKeyFactsInventoryWithWebAuthn, finalizeWalletAddAuthMethod, finalizeWalletAddSigner, fundImplicitNearAccountForTesting, isEmailOtpWalletRegistrationFinalizeResponse, parseWalletRegistrationEcdsaDerivationRespond, requestAddAuthMethodEmailOtpChallenge, respondWalletAddSignerEcdsa, respondWalletRegistration, revokeWalletAuthMethod, setupWalletRegistration, startWalletAddAuthMethod, startWalletAddSigner };
-
-//# sourceMappingURL=walletRegistration.js.map