@seams/wallet 0.8.0 → 0.9.0

package/dist/esm/SeamsWeb/operations/registration/registration.js

@@ -1,3818 +0,0 @@
-import { parseThresholdEd25519SessionId, parseWalletAuthMethodId, parseWebAuthnCredentialIdB64u } from "../../../shared-ts/src/utils/domainIds.js";
-import { isObject } from "../../../shared-ts/src/utils/validation.js";
-import { base64UrlDecode, base64UrlEncode } from "../../../shared-ts/src/utils/base64.js";
-import { alphabetizeStringify, sha256BytesUtf8, sha256HexUtf8 } from "../../../shared-ts/src/utils/digests.js";
-import { parseCorrelationId, parseDigestB64u, parseIsoTimestamp } from "../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { walletSessionPreservesCapabilities } from "../../../shared-ts/src/device-linking/activeWalletSession.js";
-import { WalletSessionStatusReadScope } from "../../../core/rpcClients/relayer/walletSessionAuthorizationStatus.js";
-import { base58Encode } from "../../../shared-ts/src/utils/base58.js";
-import { deriveImplicitNearAccountIdFromEd25519PublicKey } from "../../../shared-ts/src/utils/near.js";
-import { toAccountId } from "../../../core/types/accountIds.js";
-import { RegistrationEventPhase, createRegistrationFlowEvent } from "../../../core/types/sdkSentEvents.js";
-import { publishNearProvisioningState, runSingleFlightNearProvisioning } from "../../../core/signingEngine/flows/registration/nearProvisioningRegistry.js";
-import { parseNearEd25519SigningKeyId, walletIdFromString } from "../../../shared-ts/src/utils/registrationIds.js";
-import { thresholdEcdsaChainTargetFromChainFamily, toWalletId } from "../../../core/signingEngine/interfaces/ecdsaChainTarget.js";
-import { normalizeRuntimePolicyScope } from "../../../shared-ts/src/threshold/signingRootScope.js";
-import { requireEvmFamilySigningKeySlotId } from "../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
-import "../../../shared-ts/src/signing-lanes/index.js";
-import { toParticipantId, toRpId } from "../../../core/signingEngine/session/identity/evmFamilyEcdsaIdentity.js";
-import { nearEd25519SignerBindingFromBoundaryFields } from "../../../core/signingEngine/session/identity/exactSigningLaneIdentity.js";
-import { buildEmailOtpEnvelopeFactor, buildPasskeyEnvelopeFactor } from "../../../shared-ts/src/passkey-custody/custodyEnvelope.js";
-import { walletCustodyCommitPayloadWithRecoveryBackupAcknowledgement } from "../../../shared-ts/src/passkey-custody/ceremonyCommitPayload.js";
-import "../../../shared-ts/src/passkey-custody/index.js";
-import { recordWalletCustodyTiming } from "../../../core/signingEngine/walletCustody/ceremonyDriver.js";
-import { joinCustodyJsonFromEstablishedCommitPayload, walletCustodyCommitPayloadForWire } from "../../../core/signingEngine/walletCustody/registrationCeremony.js";
-import { ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1, sameRouterAbEd25519YaoRegistrationAdmissionRequestV1 } from "../../../shared-ts/src/utils/routerAbEd25519Yao.js";
-import { redactCredentialExtensionOutputs } from "../../../core/signingEngine/webauthnAuth/credentials/credentialExtensions.js";
-import { createRouterAbTraceContextV1 } from "../../../shared-ts/src/utils/routerAbTraceContext.js";
-import { RouterAbEd25519YaoClientV1 } from "../../../core/signingEngine/threshold/ed25519/yaoClient.js";
-import { parseSdkEcdsaDerivationSigningRootId, parseSdkEcdsaDerivationSigningRootVersion } from "../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
-import { parseEcdsaRelayerKeyId } from "../../../shared-ts/src/threshold/keyMaterialBrands.js";
-import { parseEcdsaClientVerifyingPublicKey33B64u, parseEcdsaRoleLocalBindingDigest, parseEcdsaThresholdKeyId } from "../../../core/signingEngine/session/keyMaterialBrands.js";
-import { buildEmailOtpWalletAuthAuthority, parseEmailOtpWalletAuthAuthority, walletAuthAuthorityRef } from "../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { parseCanonicalEcdsaServerActivationRequest } from "../../../shared-ts/src/utils/ecdsaCapabilityActivation.js";
-import { parseRouterAbEcdsaVerifiedClientActivationFactsV1 } from "../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { buildRecoveredCustodyEnvelopeRecord } from "../../../core/signingEngine/walletCustody/recoveryReplacementEnvelope.js";
-import { WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND } from "../../../core/indexedDB/walletCustodyEd25519MaterialRecord.js";
-import { getUserFriendlyErrorMessage } from "../../../shared-ts/src/utils/errors.js";
-import { findRegistrationSignerPlanEvmFamilyEcdsaBranch, findRegistrationSignerPlanNearEd25519Branch, registrationSignerPlanFromSelection } from "../../../shared-ts/src/utils/registrationSignerPlan.js";
-import { planPendingNearRegistration, preparePendingNearRegistration } from "../../../core/indexedDB/pendingWalletRegistrationCommit.js";
-import { walletSessionAuthorizations } from "../../../core/indexedDB/seamsWalletDB/walletSessionAuthorizationStore.js";
-import { nearEd25519YaoMaterialActivationFromMetadata } from "../../../core/signingEngine/session/material/nearEd25519YaoMaterialActivation.js";
-import { activateWalletRegistration, completeWalletRegistrationNearProvisioning, createWalletAddSignerIntent, finalizeWalletAddSigner, isEmailOtpWalletRegistrationFinalizeResponse, parseWalletRegistrationEcdsaDerivationRespond, respondWalletRegistration, setupWalletRegistration, startWalletAddSigner } from "../../../core/rpcClients/relayer/walletRegistration.js";
-import { buildEmailOtpAuthContext, emailOtpAuthContextEmailHashHex, emailOtpAuthContextProvider, emailOtpAuthContextProviderUserId } from "../../../core/signingEngine/session/identity/laneIdentity.js";
-import { persistPasskeyEd25519YaoSignerMaterialV1 } from "../../../core/signingEngine/session/passkey/ed25519YaoLocalMaterial.js";
-import { IndexedDBManager } from "../../../core/indexedDB/index.js";
-import { prepareWalletEcdsaRegistrationPublication, prepareWalletEd25519RegistrationPublication, prepareWalletEmailOtpEd25519RegistrationPublication } from "../../../core/signingEngine/flows/registration/accountLifecycle.js";
-import { computeAddSignerIntentDigest } from "../../../utils/intentDigest.js";
-import { establishUnlockedWalletEd25519ExportRootCapabilityV1, walletCustodyCeremonyTransportFromWorkerContextV1 } from "../../../core/signingEngine/walletCustody/unlockedEd25519ExportRootCapability.js";
-import { rememberPasskeyCustodySessionEnvelope } from "../../../core/signingEngine/session/passkey/passkeyCustodySessionCache.js";
-import { listConfiguredThresholdEcdsaPublicationTargets } from "../session/thresholdEcdsaProvisioning.js";
-import { openWalletCustodyEd25519ActiveClientV1, walletCustodyCacheEnvelopeFromRecordV1 } from "../../../core/signingEngine/walletCustody/openCustodyCache.js";
-import { RegistrationTimingRecorder, assertNever, createFailedRegistrationTimingSummary, createSucceededRegistrationTimingSummary, emitNearRegistrationTiming, emitRegistrationTimingSpan, emitRegistrationTimingSummary, recordRegistrationServerTimingBuckets, recordStrictEcdsaServerTimingBuckets, registrationTimingSignerSetFromPlan, roundDurationMs, zeroEmailOtpYaoPrewarmDiagnostics } from "./registrationTiming.js";
-import { joinCustodyWireFromEnvelopeRecord } from "../../../core/signingEngine/walletCustody/joinCustodyWire.js";
-import { buildStrictRegistrationClientBootstrap, closeStrictEcdsaRegistrationCeremony, finalizeStrictEcdsaFamilyLocalActivation, measureStrictEcdsaCeremonyStep, registrationRouteHeaders, requireIssuedRegistrationEstablishedSession, runStrictEcdsaFamilyCeremony } from "./registrationStrictEcdsa.js";
-import { admitDeferredNearRegistration, buildRegistrationEmailOtpEd25519SessionState, buildRegistrationPasskeyEd25519SessionHydration, passkeyWalletAuthAuthorityFromCredential, registrationEd25519MaterialFacts, requireEd25519YaoRegistrationPublicResultMatches, requireEmailOtpEd25519YaoRegistrationPublicResultMatches, requireEmailOtpRegistrationEnrollmentMaterial, requirePasskeyRegistrationIntent } from "./registrationEd25519Yao.js";
-import { requirePasskeyPrfFirstB64u } from "../authMethods/passkey/ecdsaBootstrap.js";
-import { registrationProjectionFromPending, restorePendingNearRegistrationMaterial } from "./pendingRegistrationRecovery.js";
-import { scheduleEcdsaSessionPresignaturePrefill } from "../auth/scheduleEcdsaSessionPresignaturePrefill.js";
-import { resolveManagedRuntimeScopeBootstrap } from "../../../core/config/managedRuntimeScope.js";
-import { exactPasskeyWalletAuthAuthorityRefForCredential } from "../authMethods/passkey/exactPasskeyAuthority.js";
-import { collectPasskeyRegistrationAuthority } from "../authMethods/passkey/registrationAuthority.js";
-import { showWalletRecoveryCodeBackupUi } from "../recovery/walletRecoveryCodeBackup.js";
-import { pendingWalletRecoveryCodeBackupRepository } from "../../../core/indexedDB/seamsWalletDB/pendingWalletRecoveryCodeBackup.js";
-import { registrationFinalizeIdempotencyKeyFromString } from "../../publicApi/types.js";
-import { collectEmailOtpRegistrationAuthority } from "../authMethods/emailOtp/registrationAuthority.js";
-import { admitVerifiedPasskeyEd25519YaoAddSignerV1 } from "../../../core/signingEngine/flows/registration/services/passkeyEd25519YaoAddSigner.js";
-import { buildPendingRegistrationCommit, buildRegistrationPersistenceAuth, buildRegistrationPersistenceEcdsa, buildRegistrationPersistencePlan, commitRegistrationPersistencePlan, finalizeRegistrationEcdsaSessions, finalizeResponseViewFromActivatedEcdsa, requireFinalizedPasskeyCredentialPublicKeyB64u, requireWebAuthnRpId } from "./registrationTerminalCommit.js";
-//#region src/SeamsWeb/operations/registration/registration.ts
-async function confirmWalletRecoveryCodesBackedUp(context, walletId, backup, recoveryCodes) {
-	if (recoveryCodes.length !== 10 || new Set(recoveryCodes).size !== 10) throw new Error("Wallet custody must issue exactly ten distinct recovery codes");
-	switch ((await resolveRegistrationRecoveryCodeBackup({
-		backup,
-		context,
-		request: {
-			kind: "wallet_recovery_code_backup_request_v1",
-			walletId,
-			recoveryCodes,
-			continuation: "registration_may_defer"
-		}
-	}))?.kind) {
-		case "wallet_recovery_codes_backed_up_v1": return;
-		case "wallet_recovery_code_backup_deferred_v1":
-			await pendingWalletRecoveryCodeBackupRepository.write({
-				walletId,
-				recoveryCodes
-			});
-			return;
-		default: throw new Error("Wallet recovery-code backup result is invalid");
-	}
-}
-async function resolveRegistrationRecoveryCodeBackup(input) {
-	if (!input.backup) return { kind: "wallet_recovery_code_backup_deferred_v1" };
-	switch (input.backup.kind) {
-		case "defer_to_account_menu": return { kind: "wallet_recovery_code_backup_deferred_v1" };
-		case "show_builtin_dialog": return await showWalletRecoveryCodeBackupUi(input.request, input.context.signingEngine.getWalletIframeSurfaceMeasurementBinding());
-		case "custom_handler": return await input.backup.handler(input.request);
-		default: return assertNever(input.backup);
-	}
-}
-function zeroizeArrayBuffer(buffer) {
-	if (buffer.byteLength > 0) new Uint8Array(buffer).fill(0);
-}
-function walletCustodyRegistrationMaterial(args) {
-	const metadata = args.established.metadata;
-	return {
-		binding: {
-			kind: WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND,
-			applicationBindingDigestB64u: args.established.localMaterial.applicationBindingDigestB64u,
-			registeredPublicKeyB64u: base64UrlEncode(metadata.registeredPublicKey),
-			participantIds: metadata.participantIds,
-			stateEpoch: String(metadata.stateEpoch),
-			walletId: args.walletId,
-			nearAccountId: args.nearAccountId,
-			nearEd25519SigningKeyId: args.nearEd25519SigningKeyId,
-			signerSlot: args.signerSlot,
-			signingWorkerId: metadata.scope.signing_worker_id,
-			signingWorkerVerifyingShareB64u: base64UrlEncode(metadata.signingWorkerVerifyingShare)
-		},
-		sealed: {
-			ciphertextB64u: args.established.localMaterial.b64u,
-			nonceB64u: args.established.localMaterial.nonceB64u
-		}
-	};
-}
-function pendingRegistrationEd25519MetadataFromJoined(joined) {
-	const metadata = joined.metadata;
-	return {
-		materialActivation: nearEd25519YaoMaterialActivationFromMetadata(metadata),
-		registeredPublicKeyB64u: base64UrlEncode(metadata.registeredPublicKey),
-		signingWorkerVerifyingShareB64u: base64UrlEncode(metadata.signingWorkerVerifyingShare),
-		stateEpoch: String(metadata.stateEpoch),
-		signingWorkerId: metadata.scope.signing_worker_id,
-		participantIds: metadata.participantIds,
-		nearEd25519SigningKeyId: metadata.applicationBinding.near_ed25519_signing_key_id,
-		signerSlot: metadata.applicationBinding.key_creation_signer_slot
-	};
-}
-function walletCustodyCacheEnvelopeFromRegistrationCommit(commit) {
-	const established = commit.establishedCustody;
-	if (!established) throw new Error("Mixed registration custody commit is missing its established envelope");
-	return {
-		bindingJson: established.envelopeBindingJson,
-		nonceB64u: established.envelopeNonceB64u,
-		ciphertextB64u: established.sealedCustodySecretB64u,
-		aadHashB64u: established.envelopeAadHashB64u,
-		ciphertextDigestB64u: established.envelopeCiphertextDigestB64u
-	};
-}
-function custodyEnvelopeFromRegistrationCommit(args) {
-	const established = args.commit.establishedCustody;
-	if (!established) throw new Error("Passkey registration custody commit is missing its established envelope");
-	return buildRecoveredCustodyEnvelopeRecord({
-		expectedWalletId: args.walletId,
-		replacement: established,
-		activatedAtMs: args.activatedAtMs
-	});
-}
-async function establishPasskeyRegistrationEd25519ExportRootCapability(args) {
-	await args.signingEngine.establishUnlockedWalletEd25519ExportRootCapabilityV1({
-		existingEnvelope: custodyEnvelopeFromRegistrationCommit({
-			commit: args.commit,
-			walletId: args.walletId,
-			activatedAtMs: Date.now()
-		}),
-		passkeyPrfFirstB64u: args.passkeyPrfFirstB64u,
-		walletId: args.walletId,
-		walletAuthMethodId: args.walletAuthMethodId,
-		walletSessionId: args.walletSessionId,
-		expiresAtMs: args.expiresAtMs
-	});
-}
-async function establishEmailOtpRegistrationEd25519ExportRootCapability(args) {
-	try {
-		await establishUnlockedWalletEd25519ExportRootCapabilityV1(walletCustodyCeremonyTransportFromWorkerContextV1(args.context.signingEngine.getSignerWorkerContext()), {
-			existingEnvelope: custodyEnvelopeFromRegistrationCommit({
-				commit: args.commit,
-				walletId: args.walletId,
-				activatedAtMs: Date.now()
-			}),
-			existingFactorSecret: args.factorSecret32,
-			walletId: args.walletId,
-			walletAuthMethodId: String(args.emailOtpAuthContext.authority.bindingId),
-			walletSessionId: args.walletSessionId,
-			expiresAtMs: args.expiresAtMs
-		});
-	} catch (error) {
-		console.warn("[registration][email-otp] unlocked Ed25519 export-root capability was not established:", error instanceof Error ? error.message : String(error || "unknown error"));
-	}
-}
-async function rememberPasskeyRegistrationCustodyEnvelope(args) {
-	const envelope = custodyEnvelopeFromRegistrationCommit(args);
-	if (envelope.factor.kind !== "passkey") throw new Error("Passkey registration custody commit has a non-passkey factor");
-	await rememberPasskeyCustodySessionEnvelope({
-		walletId: args.walletId,
-		credentialIdB64u: envelope.factor.credentialIdB64u,
-		envelope
-	});
-}
-function buildRegistrationEmailOtpEd25519RecoveryBootstrap(args) {
-	const metadata = args.joined.metadata;
-	const thresholdSessionId = parseThresholdEd25519SessionId(metadata.scope.threshold_session_id);
-	if (!thresholdSessionId.ok) throw new Error("Registration Ed25519 capability has an invalid threshold session");
-	return {
-		kind: ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1,
-		session: {
-			walletId: args.walletId,
-			nearAccountId: args.nearAccountId,
-			nearEd25519SigningKeyId: args.nearEd25519SigningKeyId,
-			authorityScope: {
-				kind: "email_otp",
-				provider: emailOtpAuthContextProvider(args.authContext),
-				providerUserId: emailOtpAuthContextProviderUserId(args.authContext)
-			},
-			thresholdSessionId: thresholdSessionId.value,
-			authorizationId: args.sessionState.signingWalletSession.authorizationId,
-			walletSessionId: args.sessionState.walletSessionId,
-			quotaId: args.sessionState.quotaId,
-			expiresAtMs: args.sessionState.signingWalletSession.expiresAtMs,
-			participantIds: metadata.participantIds,
-			remainingUses: args.sessionState.signingWalletSession.remainingUses,
-			signingRootId: args.sessionState.signingRootId,
-			signingRootVersion: args.sessionState.signingRootVersion,
-			runtimePolicyScope: args.sessionState.runtimePolicyScope,
-			routerAbNormalSigning: args.sessionState.routerAbNormalSigning
-		},
-		capability: {
-			kind: "router_ab_ed25519_yao_active_capability_v1",
-			materialActivation: metadata.materialActivation,
-			activeCapabilityBinding: metadata.activeCapabilityBinding,
-			registeredPublicKey: [...metadata.registeredPublicKey],
-			nearAccountId: args.nearAccountId,
-			applicationBinding: metadata.applicationBinding,
-			runtimePolicyScope: args.sessionState.runtimePolicyScope,
-			participantIds: metadata.participantIds,
-			lifecycle: {
-				lifecycleId: metadata.scope.lifecycle_id,
-				rootShareEpoch: metadata.scope.root_share_epoch,
-				accountId: metadata.scope.account_id,
-				thresholdSessionId: thresholdSessionId.value,
-				signerSetId: metadata.scope.signer_set_id,
-				signingWorkerId: metadata.scope.signing_worker_id
-			},
-			stateEpoch: Number(metadata.stateEpoch),
-			registrationContinuity: {
-				kind: "registration",
-				admissionRequest: args.deferredNear.admissionRequest,
-				admissionReceipt: args.admissionReceipt,
-				activationTranscript: [...metadata.transcript]
-			}
-		}
-	};
-}
-const hostedPasskeyRegistrationPreparedBrand = Symbol("hostedPasskeyRegistrationPrepared");
-const hostedPasskeyRegistrationStates = /* @__PURE__ */ new WeakMap();
-function registrationSignerPlanFromSignerSet(selection) {
-	const plan = registrationSignerPlanFromSelection(selection);
-	if (!plan.ok) throw new Error(plan.message);
-	return plan.value;
-}
-function registrationWarmupWork(context) {
-	return context.signingEngine.warmCriticalResources.bind(context.signingEngine, { kind: "none" });
-}
-function registrationPlanBranchIncludesNearEd25519(branch) {
-	return branch.kind === "near_ed25519";
-}
-function registrationSelectionRequiresEmailOtpYaoWarmup(signerSelection) {
-	return registrationSignerPlanFromSignerSet(signerSelection).branches.some(registrationPlanBranchIncludesNearEd25519);
-}
-function noEmailOtpYaoPrewarm() {
-	return Promise.resolve(zeroEmailOtpYaoPrewarmDiagnostics());
-}
-function registrationSelectionIncludesEcdsa(signerSelection) {
-	return signerSelection.signers.some((signer) => signer.kind === "evm_family_ecdsa");
-}
-function registrationEmailOtpYaoPrewarmWork(input) {
-	if (input.authMethod.kind !== "email_otp" || !registrationSelectionRequiresEmailOtpYaoWarmup(input.signerSelection)) return noEmailOtpYaoPrewarm;
-	return executeRegistrationEmailOtpYaoPrewarm.bind(void 0, { prewarm: input.context.signingEngine.prewarmEmailOtpYao.bind(input.context.signingEngine) });
-}
-function recoverEmailOtpYaoPrewarmFailure(_error, startedAt) {
-	const elapsedMs = roundDurationMs(startedAt);
-	return {
-		kind: "failed",
-		elapsedMs,
-		workerPrewarmMs: elapsedMs,
-		yaoWasmInitMs: 0,
-		failureStage: "worker_ready"
-	};
-}
-function executeRegistrationEmailOtpYaoPrewarm(input) {
-	const startedAt = performance.now();
-	return input.prewarm().catch((error) => recoverEmailOtpYaoPrewarmFailure(error, startedAt));
-}
-function completedRegistrationWarmup(results) {
-	const [diagnostics, emailOtpYao] = results;
-	return {
-		kind: "completed",
-		diagnostics: {
-			...diagnostics,
-			emailOtpWorkerPrewarmMs: emailOtpYao.workerPrewarmMs,
-			emailOtpYaoWasmInitMs: emailOtpYao.yaoWasmInitMs,
-			emailOtpYaoPrewarm: emailOtpYao
-		}
-	};
-}
-function failedRegistrationWarmup(error) {
-	return {
-		kind: "failed",
-		error
-	};
-}
-function startRegistrationWarmup(input) {
-	const genericWarmup = input.recorder.measure("registrationWarmupMs", registrationWarmupWork(input.context));
-	const emailOtpYaoWarmup = input.recorder.measure("registrationWarmupEmailOtpYaoWasmInitMs", registrationEmailOtpYaoPrewarmWork({
-		context: input.context,
-		authMethod: input.authMethod,
-		signerSelection: input.signerSelection
-	}));
-	if (registrationSelectionIncludesEcdsa(input.signerSelection)) input.context.signingEngine.prewarmEcdsaRegistrationCrypto?.().catch(() => {});
-	return Promise.all([genericWarmup, emailOtpYaoWarmup]).then(completedRegistrationWarmup, failedRegistrationWarmup);
-}
-function observeRegistrationWarmup(input) {
-	input.warmup.then((outcome) => {
-		if (outcome.kind === "completed") input.recorder.captureWarmupDiagnostics(outcome.diagnostics);
-	});
-}
-function registrationPreparationSignerSlot(signerSelection) {
-	return findRegistrationSignerPlanNearEd25519Branch(registrationSignerPlanFromSignerSet(signerSelection))?.signerSlot ?? 1;
-}
-async function resolvePasskeyRegistrationAuthority(args) {
-	if (args.passkeyExecution?.kind === "use_hosted_preparation") return await args.passkeyExecution.authority;
-	return await collectPasskeyRegistrationAuthority({
-		context: args.context,
-		walletId: args.walletId,
-		signerSlot: args.signerSlot,
-		registrationIntentDigestB64u: args.registrationIntentDigestB64u,
-		options: args.options,
-		confirmationConfigOverride: args.confirmationConfigOverride
-	});
-}
-function hostedPasskeyRegistrationState(prepared) {
-	if (prepared[hostedPasskeyRegistrationPreparedBrand] !== true) throw new Error("Invalid hosted passkey registration preparation");
-	const state = hostedPasskeyRegistrationStates.get(prepared);
-	if (!state) throw new Error("Hosted passkey registration preparation is unknown");
-	return state;
-}
-function hostedPasskeyRegistrationBinding(args) {
-	return alphabetizeStringify({
-		wallet: args.wallet,
-		signerSelection: args.signerSelection,
-		authMethod: args.authMethod,
-		walletId: args.walletId,
-		signerSlot: args.signerSlot,
-		rpId: args.rpId,
-		challengeB64u: args.challengeB64u
-	});
-}
-/**
-* Near-provisioning retries must present the SAME operation identity.
-*
-* The server's Yao consume writes a first-writer consumer binding derived from
-* the request fingerprint, which includes this key. A fresh key per attempt
-* would permanently poison the activation on any ambiguous first attempt —
-* the retry would arrive as a different consumer and hit `activation_consumed`
-* forever. Deriving the key from the ceremony and activation reference makes
-* every retry the same consumer, so takeover resume works instead.
-*/
-async function deriveNearProvisioningIdempotencyKey(input) {
-	return registrationFinalizeIdempotencyKeyFromString(`wallet-registration-near-provisioning:${await sha256HexUtf8([
-		"wallet-registration-near-provisioning",
-		input.registrationCeremonyId,
-		input.activationReference.lifecycle_id,
-		input.activationReference.session_id.map((byte) => byte.toString(16).padStart(2, "0")).join("")
-	].join(":"))}`);
-}
-function createRegistrationOperationIdempotencyKey(label) {
-	const cryptoApi = globalThis.crypto;
-	if (cryptoApi && typeof cryptoApi.randomUUID === "function") return registrationFinalizeIdempotencyKeyFromString(`${label}:${cryptoApi.randomUUID()}`);
-	const bytes = new Uint8Array(16);
-	if (!cryptoApi || typeof cryptoApi.getRandomValues !== "function") throw new Error("Secure randomness is required for registration finalization");
-	cryptoApi.getRandomValues(bytes);
-	return registrationFinalizeIdempotencyKeyFromString(`${label}:${[...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("")}`);
-}
-function startEmailOtpRegistrationEnrollmentMaterial(input) {
-	return input.recorder.measure("emailOtpEnrollmentMaterialMs", () => resolveEmailOtpRegistrationEnrollmentMaterial({
-		context: input.context,
-		authMethod: input.authMethod,
-		relayerUrl: input.relayerUrl,
-		walletId: input.walletId,
-		providerSubject: input.providerSubject,
-		clientSecret32: input.clientSecret32
-	}));
-}
-function assertEmailOtpRegistrationHasNoLegacyEcdsaRoot(material) {
-	if (material.emailOtpSessionHandle.kind !== "not_requested") throw new Error("Strict ECDSA registration received obsolete Email OTP root-share material");
-}
-async function resolveEmailOtpRegistrationEnrollmentMaterial(input) {
-	if (input.authMethod.kind !== "email_otp") throw new Error("Email OTP enrollment material requires Email OTP auth");
-	try {
-		const material = await input.context.signingEngine.prepareEmailOtpRegistrationEnrollmentMaterialInternal({
-			relayUrl: input.relayerUrl,
-			walletId: toWalletId(input.walletId),
-			userId: input.providerSubject,
-			clientSecret32: input.clientSecret32
-		});
-		assertEmailOtpRegistrationHasNoLegacyEcdsaRoot(material);
-		return material;
-	} finally {
-		input.clientSecret32.fill(0);
-	}
-}
-function createRegistrationLifecycleEvent(input) {
-	const authMethod = input.event.authMethod;
-	const accountId = registrationEventAccountId(input.accountId);
-	return createRegistrationFlowEvent({
-		...input.event,
-		flowId: `registration:${authMethod}:${accountId}`,
-		accountId,
-		authMethod
-	});
-}
-function registrationEventAccountId(value) {
-	const accountId = String(value || "").trim();
-	if (!accountId) throw new Error("Registration event account id is required");
-	return accountId;
-}
-function registrationErrorCodeFromUnknown(error) {
-	return isObject(error) && "code" in error ? String(error.code || "").trim() : "";
-}
-function registrationErrorWithCode(message, errorCode) {
-	return Object.assign(new Error(message), errorCode ? { code: errorCode } : {});
-}
-function webAuthnTransportsFromRaw(value) {
-	if (!Array.isArray(value)) return [];
-	return value.filter((transport) => {
-		switch (transport) {
-			case "ble":
-			case "hybrid":
-			case "internal":
-			case "nfc":
-			case "smart-card":
-			case "usb": return true;
-			default: return false;
-		}
-	});
-}
-function emitRegistrationEvent(onEvent, accountId, event) {
-	onEvent?.(createRegistrationLifecycleEvent({
-		accountId,
-		event
-	}));
-}
-async function emailOtpEmailHashHex(email) {
-	const normalizedEmail = String(email || "").trim().toLowerCase();
-	if (!normalizedEmail) throw new Error("Email OTP registration auth context requires email");
-	return sha256HexUtf8(normalizedEmail);
-}
-function emailOtpProviderFromRegistrationProof(proof) {
-	switch (proof.proofKind) {
-		case "otp_challenge": return "email";
-		case "google_sso_registration": return "google";
-		default: return assertNever(proof);
-	}
-}
-function registrationThreeRouteAuthorityPayload(authority) {
-	switch (authority.kind) {
-		case "passkey": return {
-			kind: "passkey",
-			webauthnRegistration: authority.webauthnRegistration
-		};
-		case "email_otp": return {
-			kind: "email_otp",
-			emailOtpRegistrationProof: authority.emailOtpRegistrationProof
-		};
-		default: return assertNever(authority);
-	}
-}
-async function startNearRegistrationAdmission(args) {
-	const startedAt = performance.now();
-	try {
-		const admissionReceipt = await admitDeferredNearRegistration(args.deferredNear, {
-			routerOrigin: new URL(args.relayerUrl).origin,
-			authorization: {
-				kind: "bearer",
-				value: `Bearer ${args.signedSetup}`
-			},
-			fetch: globalThis.fetch,
-			...args.traceContext ? { traceContext: args.traceContext } : {}
-		});
-		emitNearRegistrationTiming({
-			ceremonyId: args.registrationCeremonyId,
-			stage: "early_admission",
-			startedAt,
-			outcome: "success"
-		});
-		return {
-			deferredNear: args.deferredNear,
-			admissionReceipt
-		};
-	} catch (error) {
-		emitNearRegistrationTiming({
-			ceremonyId: args.registrationCeremonyId,
-			stage: "early_admission",
-			startedAt,
-			outcome: "failure"
-		});
-		throw error;
-	}
-}
-function requireNearRegistrationAdmission(admission) {
-	if (!admission) throw new Error("Mixed registration did not start NEAR admission");
-	return admission;
-}
-function registrationEd25519LaneAuthorization(auth, passkeyCredentialIdB64u, session) {
-	switch (auth.kind) {
-		case "passkey": return { auth: {
-			kind: "passkey",
-			rpId: toRpId(auth.rpId),
-			credentialIdB64u: passkeyCredentialIdB64u
-		} };
-		case "email_otp": return {
-			auth: {
-				kind: "email_otp",
-				providerSubjectId: emailOtpAuthContextProviderUserId(auth.emailOtpAuthContext)
-			},
-			remainingUses: session.remainingUses,
-			expiresAtMs: session.expiresAtMs
-		};
-		default: return assertNever(auth);
-	}
-}
-async function buildThreeRouteCanonicalActivationCommand(args) {
-	const canonicalRequest = parseCanonicalEcdsaServerActivationRequest(alphabetizeStringify({
-		operation: "wallet_registration_activate_v2",
-		registrationCeremonyId: args.registrationCeremonyId,
-		activationCorrelationId: args.activationCorrelationId,
-		idempotencyKey: args.idempotencyKey,
-		publicFacts: args.publicFacts
-	}));
-	return {
-		canonicalRequest,
-		requestDigest: parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(String(canonicalRequest))))
-	};
-}
-async function persistThreeRouteCanonicalActivation(args) {
-	const planInput = {
-		authority: args.materialAuthority,
-		targetMemberships: args.chainTargets,
-		evmFamilySigningKeySlotId: requireEvmFamilySigningKeySlotId(args.ecdsaPrepare.prepare.evmFamilySigningKeySlotId, "registration ECDSA signing key slot"),
-		ecdsaThresholdKeyId: parseEcdsaThresholdKeyId(args.ecdsaPrepare.prepare.ecdsaThresholdKeyId),
-		signingRootId: parseSdkEcdsaDerivationSigningRootId(args.ecdsaPrepare.prepare.signingRootId),
-		signingRootVersion: parseSdkEcdsaDerivationSigningRootVersion(args.ecdsaPrepare.prepare.signingRootVersion),
-		runtimePolicyScope: args.ecdsaPrepare.prepare.runtimePolicyScope,
-		clientVerifyingPublicKey33B64u: parseEcdsaClientVerifyingPublicKey33B64u(args.clientActivation.derivationClientSharePublicKey33B64u),
-		participantIds: [toParticipantId(args.ecdsaPrepare.prepare.participantIds[0]), toParticipantId(args.ecdsaPrepare.prepare.participantIds[1])],
-		relayerKeyId: parseEcdsaRelayerKeyId(args.ecdsaPrepare.prepare.relayerKeyId),
-		bindingDigest: parseEcdsaRoleLocalBindingDigest(args.clientActivation.contextBinding32B64u),
-		journalId: args.activationCorrelationId,
-		requestDigest: args.activationCommand.requestDigest,
-		canonicalRequest: args.activationCommand.canonicalRequest,
-		createdAt: parseIsoTimestamp((/* @__PURE__ */ new Date()).toISOString())
-	};
-	const persisted = await args.context.signingEngine.persistInitialCanonicalEcdsaActivation({
-		kind: "persist_initial_canonical_ecdsa_activation_v1",
-		bootstrapOwner: "wallet_custody",
-		clientActivation: args.clientActivation,
-		ceremonyId: args.ceremonyId,
-		planInput
-	});
-	if (!persisted.ok) throw new Error(`Canonical ECDSA activation persistence failed (${persisted.code}): ${persisted.message}`);
-	return persisted;
-}
-function ethereumAddressFromAddress20B64u(value) {
-	const bytes = base64UrlDecode(value);
-	if (bytes.length !== 20) throw new Error("ECDSA activation address must contain 20 bytes");
-	return `0x${Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
-}
-/**
-* Calls `/wallets/register/setup`, which replaces the bootstrap grant, the
-* registration intent, and registration start.
-*
-* Runs before the authenticator prompt, because its response carries the
-* challenge that prompt must sign — so the Router's ECDSA preparation overlaps
-* the user's interaction instead of being serialized after it.
-*/
-async function setupThreeRouteRegistration(args) {
-	const relayerUrl = String(args.context.configs.network.relayer.url || "").trim();
-	if (!relayerUrl) throw new Error("registerWallet requires relayer.url");
-	const registration = args.context.configs.registration;
-	const publishableKey = String(registration?.publishableKey || "").trim();
-	const environmentId = String(registration?.projectEnvironmentId || "").trim();
-	if (!publishableKey || !environmentId) throw new Error("registerWallet requires registration.publishableKey and registration.projectEnvironmentId");
-	const registrationWarmup = startRegistrationWarmup({
-		recorder: args.recorder,
-		context: args.context,
-		authMethod: args.authMethod,
-		signerSelection: args.signerSelection
-	});
-	const setup = await args.recorder.measure("registrationIntentMs", () => setupWalletRegistration({
-		relayerUrl,
-		request: {
-			...args.wallet.kind === "provided" ? { wallet: args.wallet } : {},
-			signerSelection: args.signerSelection,
-			authMethod: args.authMethod
-		},
-		auth: {
-			publishableKey,
-			environmentId
-		}
-	}));
-	if (!setup.ok) throw registrationErrorWithCode(setup.message, setup.code);
-	return {
-		relayerUrl,
-		setup,
-		registrationWarmup
-	};
-}
-async function setupRegistrationForPasskeyExecution(args) {
-	if (args.passkeyExecution.kind === "collect_during_registration") return await setupThreeRouteRegistration({
-		context: args.context,
-		authMethod: args.authMethod,
-		wallet: args.wallet,
-		signerSelection: args.signerSelection,
-		recorder: args.recorder
-	});
-	if (args.authMethod.kind !== "passkey") throw new Error("Hosted passkey preparation requires passkey registration");
-	const state = hostedPasskeyRegistrationState(args.passkeyExecution.prepared);
-	if (state.context !== args.context || state.lifecycle === "cancelled") throw new Error("Hosted passkey registration preparation belongs to a different operation");
-	const setup = state.setup;
-	const intent = requirePasskeyRegistrationIntent(setup.setup.intent);
-	const challengeB64u = String(setup.setup.registrationIntentDigestB64u || "").trim();
-	const signerSlot = registrationPreparationSignerSlot(args.signerSelection);
-	if (hostedPasskeyRegistrationBinding({
-		wallet: args.wallet,
-		signerSelection: args.signerSelection,
-		authMethod: args.authMethod,
-		walletId: walletIdFromString(String(intent.walletId)),
-		signerSlot,
-		rpId: requireWebAuthnRpId(String(args.authMethod.rpId)),
-		challengeB64u
-	}) !== state.binding || String(intent.walletId) !== String(args.passkeyExecution.prepared.walletId) || challengeB64u !== args.passkeyExecution.prepared.challengeB64u) throw new Error("Hosted passkey registration preparation binding changed");
-	return setup;
-}
-function ecdsaRegistrationClientCeremonyForExecution(args) {
-	if (args.passkeyExecution.kind === "collect_during_registration") return { kind: "create_after_authority" };
-	const state = hostedPasskeyRegistrationState(args.passkeyExecution.prepared);
-	if (state.ecdsaClientCeremony.kind !== "started" || state.ecdsaClientCeremony.ceremonyId !== args.ceremonyId) throw new Error("Hosted passkey registration has no matching ECDSA client ceremony");
-	return {
-		kind: "use_hosted_preparation",
-		ceremonyId: state.ecdsaClientCeremony.ceremonyId,
-		operation: state.ecdsaClientCeremony.operation
-	};
-}
-async function awaitHostedPreparedEcdsaClientCeremony(operation) {
-	return await operation;
-}
-function ecdsaRegistrationClientCeremonyOperation(args) {
-	switch (args.clientCeremony.kind) {
-		case "create_after_authority": return args.context.signingEngine.createRouterAbEcdsaRegistrationCeremony.bind(args.context.signingEngine, {
-			kind: "create_router_ab_ecdsa_registration_ceremony_v1",
-			ceremonyId: args.ceremonyId,
-			registration: args.registration
-		});
-		case "use_hosted_preparation":
-			if (args.clientCeremony.ceremonyId !== args.ceremonyId) throw new Error("Prepared ECDSA client ceremony identity changed");
-			return awaitHostedPreparedEcdsaClientCeremony.bind(void 0, args.clientCeremony.operation);
-		default: return assertNever(args.clientCeremony);
-	}
-}
-async function runEcdsaEnabledThreeRouteRegistrationCeremony(args) {
-	const [firstChainTarget, ...remainingChainTargets] = args.ecdsaPrepare.chainTargets;
-	if (!firstChainTarget) throw new Error("Strict ECDSA ceremony requires at least one EVM-family target");
-	const ceremonyId = args.registrationCeremonyId;
-	const activationCorrelationId = parseCorrelationId(ceremonyId);
-	let deferredNearCustodyWork = null;
-	try {
-		const created = await measureStrictEcdsaCeremonyStep({
-			registrationTiming: args.registrationTiming,
-			bucket: "ecdsaRegistrationClientCreateMs",
-			operation: ecdsaRegistrationClientCeremonyOperation({
-				context: args.context,
-				ceremonyId,
-				registration: args.ecdsaPrepare.strictRegistration,
-				clientCeremony: args.clientCeremony
-			})
-		});
-		const responded = await measureStrictEcdsaCeremonyStep({
-			registrationTiming: args.registrationTiming,
-			bucket: "ecdsaRegistrationGatewayRespondMs",
-			operation: respondWalletRegistration.bind(void 0, {
-				relayerUrl: args.relayerUrl,
-				headers: registrationRouteHeaders(args.traceContext),
-				registrationCeremonyId: ceremonyId,
-				signerPlanKind: args.signerPlanKind,
-				signedSetup: args.signedSetup,
-				ecdsa: {
-					kind: "router_ab_ecdsa_registration_v1",
-					strictRegistration: created.registrationRequest,
-					requestDigestB64u: created.registrationRequestDigestB64u
-				},
-				...registrationThreeRouteAuthorityPayload(args.authority),
-				onServerTiming: (header) => recordStrictEcdsaServerTimingBuckets(args.registrationTiming, "respond", header)
-			})
-		});
-		if (responded.kind === "near_ed25519") throw new Error("ECDSA registration ceremony received an Ed25519-only respond result");
-		const deferredNear = responded.kind === "near_ed25519_and_evm_family_ecdsa" ? responded.ed25519 : null;
-		const nearAdmission = deferredNear ? startNearRegistrationAdmission({
-			relayerUrl: args.relayerUrl,
-			registrationCeremonyId: ceremonyId,
-			signedSetup: args.signedSetup,
-			deferredNear,
-			traceContext: args.traceContext
-		}) : null;
-		nearAdmission?.catch(ignoreNearCustodyFailure);
-		const verified = await measureStrictEcdsaCeremonyStep({
-			registrationTiming: args.registrationTiming,
-			bucket: "ecdsaRegistrationClientProofVerifyMs",
-			operation: args.context.signingEngine.verifyRouterAbEcdsaRegistrationClientProofs.bind(args.context.signingEngine, {
-				kind: "verify_router_ab_ecdsa_registration_client_proofs_v1",
-				bootstrapOwner: "wallet_custody",
-				ceremonyId,
-				clientProofFinalization: {
-					kind: "finalize_encrypted_client_proof_bundles_v2",
-					bundles: responded.ecdsa.strictResult.response.bundles
-				}
-			})
-		});
-		const activateEmailOtp = await args.resolveActivateEmailOtp();
-		const chainTargets = [firstChainTarget, ...remainingChainTargets];
-		const walletCustodyFactorJson = args.authority.kind === "passkey" ? args.authority.walletCustodyFactorJson : activateEmailOtp.walletCustodyFactorJson;
-		if (!walletCustodyFactorJson) throw new Error("ECDSA registration has no wallet custody factor binding");
-		const walletCustodyFactorSecret = args.authority.walletCustodyFactorSecret;
-		const activationHolder = {};
-		const established = await args.context.signingEngine.establishWalletCustodyEvmFamilyKeySet({
-			walletId: args.ecdsaPrepare.prepare.walletId,
-			factorJson: walletCustodyFactorJson,
-			factorSecret: walletCustodyFactorSecret,
-			evmFamilySigningKeySlotId: args.ecdsaPrepare.prepare.evmFamilySigningKeySlotId,
-			applicationBindingDigestB64u: verified.applicationBindingDigestB64u,
-			confirmRecoveryCodesBackedUp: args.confirmRecoveryCodesBackedUp,
-			runRelayerRound: async (bootstrap) => {
-				const clientActivation = parseRouterAbEcdsaVerifiedClientActivationFactsV1({
-					registrationRequestDigestB64u: verified.registrationRequestDigestB64u,
-					proofTranscriptDigestB64u: verified.proofTranscriptDigestB64u,
-					contextBinding32B64u: bootstrap.contextBinding32B64u,
-					derivationClientSharePublicKey33B64u: bootstrap.clientSharePublicKey33B64u,
-					clientShareRetryCounter: bootstrap.clientShareRetryCounter,
-					participantId: 1
-				});
-				const activationCommand = await buildThreeRouteCanonicalActivationCommand({
-					registrationCeremonyId: ceremonyId,
-					activationCorrelationId,
-					idempotencyKey: args.idempotencyKey,
-					publicFacts: clientActivation
-				});
-				const ecdsaCustodyCommit = walletCustodyCommitPayloadForWire(bootstrap.preActivationCommitPayload);
-				const ecdsaReplay = {
-					activationJournalId: activationCorrelationId,
-					clientActivation,
-					activationRequestDigestB64u: activationCommand.requestDigest
-				};
-				if (args.signerPlanKind === "near_ed25519_and_evm_family_ecdsa") {
-					if (!deferredNear) throw new Error("Mixed registration has no NEAR continuation");
-					await args.persistPendingCommit({
-						signerPlanKind: args.signerPlanKind,
-						localMaterial: {
-							keyFamilies: ["ecdsa_secp256k1"],
-							custodyCommit: ecdsaCustodyCommit,
-							ecdsa: ecdsaReplay
-						},
-						emailOtpEnrollment: activateEmailOtp.enrollment,
-						deferredNear
-					});
-					deferredNearCustodyWork = args.startDeferredNearCustody({
-						admission: requireNearRegistrationAdmission(nearAdmission),
-						establishedEvmCustodyCommit: bootstrap.preActivationCommitPayload
-					});
-					deferredNearCustodyWork.catch(ignoreNearCustodyFailure);
-				} else await args.persistPendingCommit({
-					signerPlanKind: args.signerPlanKind,
-					localMaterial: {
-						keyFamilies: ["ecdsa_secp256k1"],
-						custodyCommit: ecdsaCustodyCommit,
-						ecdsa: ecdsaReplay
-					},
-					emailOtpEnrollment: activateEmailOtp.enrollment
-				});
-				const persisted = await persistThreeRouteCanonicalActivation({
-					context: args.context,
-					ceremonyId,
-					materialAuthority: args.materialAuthority,
-					ecdsaPrepare: args.ecdsaPrepare,
-					chainTargets,
-					activationCorrelationId,
-					activationCommand,
-					clientActivation
-				});
-				if (String(persisted.journalId) !== String(activationCorrelationId)) throw new Error("ECDSA activation journal identity changed before activate");
-				const response = await measureStrictEcdsaCeremonyStep({
-					registrationTiming: args.registrationTiming,
-					bucket: "ecdsaRegistrationGatewayActivateMs",
-					operation: activateWalletRegistration.bind(void 0, {
-						relayerUrl: args.relayerUrl,
-						headers: registrationRouteHeaders(args.traceContext),
-						registrationCeremonyId: ceremonyId,
-						signerPlanKind: args.signerPlanKind,
-						signedSetup: args.signedSetup,
-						idempotencyKey: args.idempotencyKey,
-						ecdsa: {
-							clientActivation,
-							activationCorrelationId,
-							activationRequestDigestB64u: activationCommand.requestDigest
-						},
-						walletCustodyCommit: bootstrap.preActivationCommitPayload,
-						...activateEmailOtp.enrollment ? { emailOtpEnrollment: activateEmailOtp.enrollment } : {},
-						onServerTiming: (header) => recordStrictEcdsaServerTimingBuckets(args.registrationTiming, "activate", header)
-					})
-				});
-				if (response.kind !== "evm_family_ecdsa" || !response.ecdsa) throw new Error("ECDSA registration ceremony received a non-ECDSA activate result");
-				activationHolder.value = response;
-				activationHolder.journalId = persisted.journalId;
-				const identity = response.ecdsa.activation.ecdsa_activation.public_identity;
-				return JSON.stringify({
-					relayerKeyId: args.ecdsaPrepare.prepare.relayerKeyId,
-					relayerPublicKey33B64u: identity.server_public_key33_b64u,
-					groupPublicKey33B64u: identity.threshold_public_key33_b64u,
-					ethereumAddress: ethereumAddressFromAddress20B64u(identity.ethereum_address20_b64u),
-					relayerShareRetryCounter: identity.server_share_retry_counter
-				});
-			}
-		});
-		if (!activationHolder.value || !activationHolder.journalId) throw new Error("Wallet custody ECDSA activation did not return its committed receipt");
-		const activated = activationHolder.value;
-		if (activated.walletCustody?.status !== "committed") {
-			const status = activated.walletCustody?.status ?? "not_reported";
-			throw new Error(`Wallet custody did not commit during ECDSA activation (${status})`);
-		}
-		const clientBootstrap = buildStrictRegistrationClientBootstrap({
-			prepare: args.ecdsaPrepare.prepare,
-			verified: established.clientBootstrap
-		});
-		const registrationBootstrap = parseWalletRegistrationEcdsaDerivationRespond({
-			clientBootstrap,
-			serverBootstrap: activated.ecdsa.bootstrap,
-			activationEpoch: activated.ecdsa.activation.ecdsa_activation.activation_epoch
-		});
-		const finalized = await args.context.signingEngine.finalizeRouterAbEcdsaRegistrationActivation({
-			kind: "finalize_router_ab_ecdsa_registration_activation_v1",
-			bootstrapOwner: "wallet_custody",
-			journalId: activationHolder.journalId,
-			activationReceipt: activated.ecdsa.activation,
-			routerAbEcdsaDerivationNormalSigning: registrationBootstrap.routerAbEcdsaDerivationNormalSigning,
-			readyStateBlobB64u: established.localMaterial.readyStateBlobB64u,
-			walletCustodyPublicFacts: established.localMaterial.publicFacts
-		});
-		return {
-			session: {
-				chainTargets: [firstChainTarget, ...remainingChainTargets],
-				clientBootstrap,
-				bootstrap: registrationBootstrap,
-				activatedThresholdSessionId: activated.ecdsa.bootstrap.thresholdSessionId,
-				roleLocalMaterial: finalized.roleLocalMaterial,
-				authority: await walletAuthAuthorityRef({ authority: activated.authority }),
-				materialActivation: finalized.materialActivation,
-				clientPublicFacts: finalized.publicFacts,
-				publicCapability: finalized.publicCapability,
-				registrationEstablishedSession: requireIssuedRegistrationEstablishedSession(activated.registrationEstablishedSession)
-			},
-			activated,
-			deferredNear,
-			activateEmailOtp: { enrollment: activateEmailOtp.enrollment },
-			walletCustody: established,
-			deferredNearCustodyWork
-		};
-	} catch (error) {
-		discardDeferredNearCustodyWork(deferredNearCustodyWork);
-		await closeStrictEcdsaRegistrationCeremony({
-			context: args.context,
-			ceremonyId
-		});
-		throw error;
-	}
-}
-function materializeWalletRegistrationSetupChainTarget(target) {
-	switch (target.kind) {
-		case "evm": return thresholdEcdsaChainTargetFromChainFamily({
-			chain: "evm",
-			chainId: target.chainId,
-			networkSlug: target.networkSlug
-		});
-		case "tempo": return thresholdEcdsaChainTargetFromChainFamily({
-			chain: "tempo",
-			chainId: target.chainId,
-			networkSlug: target.networkSlug
-		});
-		default: return assertNever(target);
-	}
-}
-function materializeWalletRegistrationSetupEcdsaPrepare(setup) {
-	const [firstTarget, ...remainingTargets] = setup.chainTargets;
-	if (!firstTarget) throw new Error("Registration setup ECDSA chain targets are required");
-	return {
-		kind: setup.kind,
-		chainTargets: [materializeWalletRegistrationSetupChainTarget(firstTarget), ...remainingTargets.map(materializeWalletRegistrationSetupChainTarget)],
-		prepare: setup.prepare,
-		strictRegistration: setup.strictRegistration
-	};
-}
-function requireEcdsaRegistrationSetup(setup, expectedKind) {
-	switch (setup.kind) {
-		case "near_ed25519": throw new Error("Registration setup returned an Ed25519-only signer branch");
-		case "evm_family_ecdsa":
-		case "near_ed25519_and_evm_family_ecdsa":
-			if (setup.kind !== expectedKind) throw new Error("Registration setup returned a different signer branch");
-			return setup;
-		default: return assertNever(setup);
-	}
-}
-function registrationPasskeySignerSlot(args) {
-	switch (args.kind) {
-		case "evm_family_ecdsa": return 1;
-		case "near_ed25519_and_evm_family_ecdsa": return args.ed25519Selection.signerSlot;
-		default: return assertNever(args);
-	}
-}
-function pendingRegistrationAuthFromRegistrationInputs(args) {
-	if (args.authMethod.kind === "passkey") {
-		if (!args.passkeyAuthority) throw new Error("Passkey registration authority was not collected");
-		return {
-			kind: "passkey",
-			rpId: args.authMethod.rpId,
-			credentialIdB64u: String(args.passkeyAuthority.credential.rawId || args.passkeyAuthority.credential.id || "").trim(),
-			transports: [...args.passkeyAuthority.webauthnRegistration.response.transports]
-		};
-	}
-	return {
-		kind: "email_otp",
-		email: args.email,
-		registrationAuthorityId: args.registrationAuthorityId,
-		providerSubject: args.providerSubject,
-		enrollment: requirePendingEmailOtpEnrollment(args.emailOtpEnrollment)
-	};
-}
-function requirePendingEmailOtpEnrollment(enrollment) {
-	if (!enrollment) throw new Error("Email OTP registration has no enrollment material for pending recovery");
-	return enrollment;
-}
-async function persistPendingRegistrationCommit(input) {
-	const nowMs = Date.now();
-	const pending = buildPendingRegistrationCommit({
-		...input,
-		createdAtMs: nowMs,
-		updatedAtMs: nowMs
-	});
-	await IndexedDBManager.putPendingWalletRegistrationCommit(pending);
-	return pending;
-}
-function requireMixedRegistrationActivatePendingCommit(pending) {
-	if (!pending || pending.operation !== "registration_activate" || pending.signerPlanKind !== "near_ed25519_and_evm_family_ecdsa") throw new Error("Mixed registration activation commit was not persisted");
-	return pending;
-}
-async function prepareRegistrationEcdsaPublication(args) {
-	const walletKeys = args.walletKeys;
-	if (args.auth.kind === "passkey") {
-		const credentialIdB64u = String(args.auth.credential.rawId || args.auth.credential.id || "").trim();
-		if (!credentialIdB64u) throw new Error("Passkey registration publication has no credential id");
-		return await prepareWalletEcdsaRegistrationPublication({
-			kind: "passkey",
-			walletId: args.walletId,
-			rpId: requireWebAuthnRpId(args.auth.rpId),
-			credentialIdB64u,
-			credentialPublicKeyB64u: args.auth.credentialPublicKeyB64u,
-			transports: args.auth.credential.response?.transports ?? [],
-			walletKeys
-		});
-	}
-	return await prepareWalletEcdsaRegistrationPublication({
-		kind: "email_otp",
-		walletId: args.walletId,
-		email: args.auth.email,
-		registrationAuthorityId: args.auth.registrationAuthorityId,
-		authority: args.auth.authority,
-		walletKeys
-	});
-}
-async function publishMixedEcdsaRegistrationCommit(args) {
-	const walletKeys = await finalizeRegistrationEcdsaSessions({
-		context: args.context,
-		relayerUrl: args.relayerUrl,
-		registrationTiming: args.registrationTiming,
-		plan: args.plan
-	});
-	const registration = await prepareRegistrationEcdsaPublication({
-		auth: args.plan.auth,
-		walletId: args.plan.walletId,
-		walletKeys
-	});
-	const registrationSession = args.plan.ecdsa.session.registrationEstablishedSession;
-	await IndexedDBManager.publishPendingWalletRegistrationCommit({
-		pending: args.pending,
-		authority: args.activated.authority,
-		foundingAuthority: {
-			authority: args.activated.foundingAuthority,
-			authMethod: args.activated.foundingAuthMethod
-		},
-		request: {
-			operation: args.pending.operation,
-			registrationCeremonyId: args.pending.registrationCeremonyId,
-			idempotencyKey: args.pending.idempotencyKey,
-			walletId: args.pending.walletId,
-			walletAuthMethodId: args.pending.walletAuthMethodId
-		},
-		walletSessionPublication: {
-			kind: "issued",
-			walletSession: registrationSession.walletSession,
-			operationCredential: registrationSession.operationCredential
-		},
-		ecdsaContinuity: [],
-		registration
-	});
-}
-async function discardDeferredNearCustodyWork(work) {
-	if (!work) return;
-	try {
-		zeroizeArrayBuffer((await work).factorSecret32);
-	} catch {}
-}
-function buildDeferredRegistrationFinalizeAuthMaterial(args) {
-	switch (args.auth.kind) {
-		case "passkey": {
-			if (!args.passkeyAuthority) throw new Error("Deferred passkey registration requires authority material");
-			const credentialIdB64u = String(args.passkeyAuthority.credential.rawId || args.passkeyAuthority.credential.id || "").trim();
-			const prfFirstB64u = String(args.passkeyAuthority.prfFirstB64u || "").trim();
-			if (!credentialIdB64u || !prfFirstB64u) throw new Error("Deferred passkey registration requires credential PRF material");
-			return {
-				kind: "passkey",
-				rpId: args.auth.rpId,
-				credentialIdB64u,
-				prfFirstB64u
-			};
-		}
-		case "email_otp":
-			if (!args.emailOtpEnrollment) throw new Error("Deferred Email OTP registration requires enrollment material");
-			return {
-				kind: "email_otp",
-				enrollment: args.emailOtpEnrollment,
-				emailOtpAuthContext: args.auth.emailOtpAuthContext
-			};
-		default: return assertNever(args.auth);
-	}
-}
-async function persistPreparedNearRegistration(pending, receipt, checkpointJson) {
-	const startedAt = performance.now();
-	await IndexedDBManager.advancePendingNearRegistration({
-		expected: pending,
-		next: preparePendingNearRegistration(pending, receipt, checkpointJson)
-	});
-	recordWalletCustodyTiming(pending.registrationCeremonyId, "journal_prepared", startedAt);
-}
-function ignoreNearCustodyFailure() {}
-async function startDeferredNearWalletCustody(base, input) {
-	const factorSecret = base.factorSecretOwner.value;
-	if (!factorSecret) throw new Error("Mixed registration has no NEAR custody factor secret");
-	base.factorSecretOwner.value = null;
-	const startedAt = performance.now();
-	let outcome = "failure";
-	try {
-		const pending = await IndexedDBManager.getPendingWalletRegistrationCommit({
-			registrationCeremonyId: base.registrationCeremonyId,
-			operation: "near_provisioning"
-		});
-		if (!pending || pending.operation !== "near_provisioning" || pending.phase !== "planned") throw new Error("NEAR registration has no planned continuation");
-		let preAdmittedReceipt;
-		try {
-			const admitted = await input.admission;
-			if (!sameRouterAbEd25519YaoRegistrationAdmissionRequestV1(admitted.deferredNear.admissionRequest, pending.admissionRequest)) throw new Error("NEAR admission changed the authorized request");
-			preAdmittedReceipt = admitted.admissionReceipt;
-		} catch (error) {
-			if (error instanceof Error && error.message === "NEAR admission changed the authorized request") throw error;
-			preAdmittedReceipt = void 0;
-		}
-		const { joined, admissionReceipt } = await continueNearRegistrationCustody({
-			pending,
-			signingEngine: base.context.signingEngine,
-			relayerUrl: base.relayerUrl,
-			credential: base.signedSetup,
-			traceContext: base.traceContext,
-			factorSecret,
-			...preAdmittedReceipt ? { admitted: preAdmittedReceipt } : {}
-		});
-		outcome = "success";
-		return {
-			admissionReceipt,
-			joined,
-			admissionRequest: pending.admissionRequest,
-			envelope: custodyEnvelopeFromRegistrationCommit({
-				commit: input.establishedEvmCustodyCommit,
-				walletId: pending.walletId,
-				activatedAtMs: Date.now()
-			}),
-			factorSecret32: factorSecret
-		};
-	} catch (error) {
-		zeroizeArrayBuffer(factorSecret);
-		throw error;
-	} finally {
-		emitNearRegistrationTiming({
-			ceremonyId: base.registrationCeremonyId,
-			stage: "custody_join",
-			startedAt,
-			outcome
-		});
-	}
-}
-async function resolveNearRegistrationAdmissionReceipt(args) {
-	if (args.pending.phase === "execution_prepared") return args.pending.admissionReceipt;
-	if (args.admitted) return args.admitted;
-	return await admitDeferredNearRegistration({
-		status: "deferred",
-		admissionRequest: args.pending.admissionRequest
-	}, {
-		routerOrigin: new URL(args.relayerUrl).origin,
-		authorization: {
-			kind: "bearer",
-			value: `Bearer ${args.credential}`
-		},
-		fetch: globalThis.fetch,
-		traceContext: args.traceContext
-	});
-}
-async function continueNearRegistrationCustody(args) {
-	const journal = args.pending;
-	if (journal.phase === "joined" && journal.completion.kind !== "encrypted_checkpoint") throw new Error("Joined material has no encrypted execution checkpoint");
-	const pending = journal.phase === "joined" && journal.completion.kind === "encrypted_checkpoint" ? journal.completion.prepared : journal;
-	if (pending.phase === "joined") throw new Error("Invalid NEAR continuation phase");
-	const admission = pending.admissionRequest;
-	const admissionStartedAt = performance.now();
-	const admissionReceipt = await resolveNearRegistrationAdmissionReceipt({
-		pending,
-		relayerUrl: args.relayerUrl,
-		credential: args.credential,
-		traceContext: args.traceContext,
-		...args.admitted ? { admitted: args.admitted } : {}
-	});
-	recordWalletCustodyTiming(pending.registrationCeremonyId, "admission", admissionStartedAt);
-	const joined = await args.signingEngine.joinWalletCustodyNearEd25519KeySet({
-		...pending.phase === "planned" ? {
-			preparation: { kind: "fresh" },
-			beforeRouterRound: persistPreparedNearRegistration.bind(void 0, pending, admissionReceipt)
-		} : { preparation: {
-			kind: "checkpoint",
-			checkpointJson: pending.checkpointJson
-		} },
-		custodyJson: joinCustodyJsonFromEstablishedCommitPayload(pending.baseCustodyCommit),
-		factorSecret: args.factorSecret,
-		nearEd25519SigningKeyId: admission.application_binding.near_ed25519_signing_key_id,
-		registrationCeremonyId: pending.registrationCeremonyId,
-		admissionRequest: admission,
-		admissionReceipt,
-		participantIds: admission.participant_ids,
-		routerOrigin: new URL(args.relayerUrl).origin,
-		authorization: `Bearer ${args.credential}`,
-		traceContext: args.traceContext
-	});
-	if (journal.phase === "joined") {
-		if (base64UrlEncode(joined.metadata.registeredPublicKey) !== journal.localMaterial.ed25519.metadata.registeredPublicKeyB64u || JSON.stringify(joined.activationReference) !== JSON.stringify(journal.localMaterial.ed25519.activationReference)) throw new Error("Restored NEAR checkpoint changed the joined key");
-		return {
-			joined,
-			admissionReceipt
-		};
-	}
-	const journalStartedAt = performance.now();
-	const prepared = await IndexedDBManager.getPendingWalletRegistrationCommit({
-		registrationCeremonyId: pending.registrationCeremonyId,
-		operation: "near_provisioning"
-	});
-	if (!prepared || prepared.operation !== "near_provisioning" || prepared.phase !== "execution_prepared") throw new Error("NEAR execution checkpoint was not persisted");
-	const joinedPending = buildPendingRegistrationCommit({
-		operation: "near_provisioning",
-		signerPlanKind: "near_ed25519_and_evm_family_ecdsa",
-		completion: {
-			kind: "encrypted_checkpoint",
-			prepared
-		},
-		registrationCeremonyId: prepared.registrationCeremonyId,
-		idempotencyKey: await deriveNearProvisioningIdempotencyKey({
-			registrationCeremonyId: prepared.registrationCeremonyId,
-			activationReference: joined.activationReference
-		}),
-		walletId: prepared.walletId,
-		walletAuthMethodId: prepared.walletAuthMethodId,
-		signedSetup: prepared.signedSetup,
-		auth: prepared.auth,
-		createdAtMs: prepared.createdAtMs,
-		updatedAtMs: Date.now(),
-		localMaterial: {
-			keyFamilies: ["ed25519"],
-			custodyCommit: joined.commitPayload,
-			ed25519: {
-				activationReference: joined.activationReference,
-				localMaterial: joined.localMaterial,
-				metadata: pendingRegistrationEd25519MetadataFromJoined(joined)
-			}
-		}
-	});
-	if (joinedPending.operation !== "near_provisioning" || joinedPending.phase !== "joined") throw new Error("Invalid joined NEAR continuation");
-	await IndexedDBManager.advancePendingNearRegistration({
-		expected: prepared,
-		next: joinedPending
-	});
-	recordWalletCustodyTiming(pending.registrationCeremonyId, "journal_joined", journalStartedAt);
-	return {
-		joined,
-		admissionReceipt
-	};
-}
-function nearRegistrationChainTarget(target) {
-	return target.chainTarget;
-}
-function resumedNearRegistrationAuth(pending, factor) {
-	if (pending.auth.kind === "passkey" && factor.kind === "passkey" && pending.auth.rpId === factor.rpId && pending.auth.credentialIdB64u === factor.credentialIdB64u) return {
-		kind: "passkey",
-		rpId: factor.rpId,
-		credentialIdB64u: factor.credentialIdB64u,
-		prfFirstB64u: factor.prfFirstB64u
-	};
-	if (pending.auth.kind === "email_otp" && factor.kind === "email_otp" && pending.auth.providerSubject === factor.providerSubject) {
-		const authority = parseEmailOtpWalletAuthAuthority({
-			walletId: pending.walletId,
-			bindingId: pending.walletAuthMethodId,
-			factor: {
-				kind: "email_otp",
-				provider: factor.provider,
-				providerUserId: factor.providerSubject
-			},
-			verifier: {
-				kind: "email_otp_wallet_auth_method",
-				emailHashHex: factor.emailHashHex
-			}
-		});
-		if (!authority) throw new Error("NEAR continuation requires its founding Email OTP method");
-		return {
-			kind: "email_otp",
-			enrollment: pending.auth.enrollment,
-			emailOtpAuthContext: buildEmailOtpAuthContext({
-				policy: "session",
-				retention: "session",
-				reason: "login",
-				authority
-			})
-		};
-	}
-	throw new Error("NEAR continuation requires its founding authentication method");
-}
-async function resumeNearRegistrationCustodyWork(args) {
-	await requireCurrentNearRegistrationSession(args.sessionAuthority);
-	if (args.pending.phase === "joined" && args.pending.completion.kind === "sealed_material") {
-		const restored = await restorePendingNearRegistrationMaterial({
-			pending: args.pending,
-			relayerUrl: args.relayerUrl,
-			operationCredential: args.sessionAuthority.operationCredential
-		});
-		return {
-			joined: restored.joined,
-			admissionRequest: restored.admissionRequest,
-			admissionReceipt: restored.admissionReceipt,
-			envelope: args.envelope,
-			factorSecret32: args.factorSecret
-		};
-	}
-	const prepared = args.pending.phase === "joined" ? args.pending.completion.prepared : args.pending;
-	if (!prepared) throw new Error("NEAR continuation has no encrypted checkpoint");
-	const result = await continueNearRegistrationCustody({
-		pending: args.pending,
-		signingEngine: args.context.signingEngine,
-		relayerUrl: args.relayerUrl,
-		credential: args.sessionAuthority.operationCredential.token,
-		traceContext: createRouterAbTraceContextV1(),
-		factorSecret: args.factorSecret
-	});
-	return {
-		joined: result.joined,
-		admissionReceipt: result.admissionReceipt,
-		admissionRequest: prepared.admissionRequest,
-		envelope: args.envelope,
-		factorSecret32: args.factorSecret
-	};
-}
-/** Owns the factor copy; ordinary unlock is already complete when this starts. */
-async function resumeNearRegistrationAfterUnlock(args) {
-	const startedAt = performance.now();
-	try {
-		const rows = await IndexedDBManager.listPendingWalletRegistrationCommits();
-		for (const pending of rows) {
-			if (pending.operation !== "near_provisioning" || pending.walletId !== args.sessionAuthority.record.walletId || pending.walletAuthMethodId !== args.sessionAuthority.record.authMethodId || pending.signerPlanKind !== "near_ed25519_and_evm_family_ecdsa") continue;
-			if (await IndexedDBManager.getPendingWalletRegistrationCommit({
-				registrationCeremonyId: pending.registrationCeremonyId,
-				operation: "registration_activate"
-			})) continue;
-			const relayerUrl = args.context.configs.network.relayer.url;
-			const authMaterial = resumedNearRegistrationAuth(pending, args.factor);
-			const work = resumeNearRegistrationCustodyWork.bind(void 0, {
-				context: args.context,
-				pending,
-				envelope: args.custodyEnvelope,
-				relayerUrl,
-				sessionAuthority: args.sessionAuthority,
-				factorSecret: args.ownedFactorSecret
-			});
-			await runDeferredEd25519Provisioning({
-				context: args.context,
-				walletId: pending.walletId,
-				commit: {
-					context: args.context,
-					registrationTiming: null,
-					registrationStartedAt: startedAt,
-					clientPrewarm: Promise.resolve(),
-					relayerUrl,
-					registrationCeremonyId: pending.registrationCeremonyId,
-					signedSetup: pending.signedSetup,
-					headers: registrationRouteHeaders(),
-					nearCustodyWork: work,
-					sessionAuthority: args.sessionAuthority,
-					expectedChainTargets: listConfiguredThresholdEcdsaPublicationTargets(args.context.configs.network.chains).map(nearRegistrationChainTarget),
-					walletId: pending.walletId,
-					authMaterial
-				}
-			});
-		}
-	} catch (error) {
-		console.warn("[registration] NEAR continuation remains pending", error instanceof Error ? error.message : "continuation failed");
-	} finally {
-		zeroizeArrayBuffer(args.ownedFactorSecret);
-	}
-}
-function requireDeferredNearCustodyWork(work) {
-	if (!work) throw new Error("Mixed registration did not start its NEAR custody join");
-	return work;
-}
-function mixedRegistrationSessionFromDeferredResult(existing, result, finalAuthority, finalAuthMethod) {
-	if (result.kind !== "already_committed" || result.session.tokens.kind !== "near_ed25519_and_evm_family_ecdsa") throw new Error("NEAR completion must extend the current Wallet Session");
-	const projection = result.session;
-	const current = existing.record;
-	const next = projection.walletSession;
-	if (projection.walletId !== current.walletId || projection.authorizationId !== current.authorizationId || projection.quotaId !== current.quotaId || projection.walletSessionId !== existing.operationCredential.walletSessionId || next.authorityId !== current.authorityId || next.authMethodId !== current.authMethodId || next.issuedAtMs !== current.issuedAtMs || next.expiresAtMs !== current.expiresAtMs || next.authorityRevocationEpoch !== current.authorityRevocationEpoch || next.expiresAtMs <= Date.now() || !walletSessionPreservesCapabilities(current, next) || finalAuthority.authorityId !== next.authorityId || finalAuthority.walletId !== next.walletId || finalAuthority.authorityDigestB64u !== next.authorityDigestB64u || finalAuthority.revocationEpoch !== next.authorityRevocationEpoch || finalAuthMethod.walletAuthMethodId !== next.authMethodId || finalAuthMethod.walletId !== next.walletId || finalAuthMethod.walletAuthorityId !== next.authorityId) throw new Error("NEAR completion changed the current Wallet Session authority");
-	return {
-		kind: "registration_established_wallet_session_v2",
-		walletId: projection.walletId,
-		authorizationId: projection.authorizationId,
-		walletSessionId: projection.walletSessionId,
-		quotaId: projection.quotaId,
-		expiresAtMs: projection.expiresAtMs,
-		remainingUses: projection.remainingUses,
-		walletSession: next,
-		operationCredential: existing.operationCredential,
-		tokens: projection.tokens
-	};
-}
-async function requireCurrentNearRegistrationSession(expected) {
-	const current = await walletSessionAuthorizations.readExactWithOperationCredential({
-		walletId: expected.record.walletId,
-		authorityId: expected.record.authorityId,
-		authMethodId: expected.record.authMethodId
-	});
-	if (current.kind !== "found" || current.record.expiresAtMs <= Date.now() || current.record.authorizationId !== expected.record.authorizationId || current.record.authorityRevocationEpoch !== expected.record.authorityRevocationEpoch || current.operationCredential.token !== expected.operationCredential.token) throw new Error("NEAR continuation requires the current unlocked Wallet Session");
-}
-async function readJoinedNearRegistrationCommit(args) {
-	const pending = await IndexedDBManager.getPendingWalletRegistrationCommit({
-		registrationCeremonyId: args.registrationCeremonyId,
-		operation: "near_provisioning"
-	});
-	if (!pending || pending.operation !== "near_provisioning" || pending.phase !== "joined" || pending.walletId !== args.walletId || pending.walletAuthMethodId !== args.walletAuthMethodId) throw new Error("NEAR joined checkpoint was not persisted");
-	return pending;
-}
-async function activatePasskeyRegistrationEd25519Material(args) {
-	const { metadata, materialFacts } = args;
-	const activationFacts = {
-		materialActivation: nearEd25519YaoMaterialActivationFromMetadata(metadata),
-		lifecycleId: metadata.scope.lifecycle_id,
-		signingRootVersion: metadata.scope.root_share_epoch,
-		signingRootId: metadata.applicationBinding.signing_root_id,
-		signerSetId: metadata.scope.signer_set_id,
-		thresholdSessionId: materialFacts.identity.thresholdSessionId,
-		activationTranscriptB64u: base64UrlEncode(metadata.transcript),
-		activationCapabilityBindingB64u: base64UrlEncode(Uint8Array.from(metadata.activeCapabilityBinding))
-	};
-	let activeClient = null;
-	try {
-		activeClient = await openWalletCustodyEd25519ActiveClientV1({
-			material: args.material,
-			activation: activationFacts,
-			envelope: args.envelope,
-			ownedFactorSecret: args.ownedFactorSecret
-		});
-		await persistPasskeyEd25519YaoSignerMaterialV1({
-			store: IndexedDBManager,
-			activeClient,
-			identity: {
-				walletId: materialFacts.identity.walletId,
-				nearAccountId: materialFacts.identity.nearAccountId,
-				nearEd25519SigningKeyId: materialFacts.identity.nearEd25519SigningKeyId,
-				thresholdSessionId: materialFacts.identity.thresholdSessionId,
-				signerSlot: materialFacts.identity.signerSlot,
-				rpId: args.rpId,
-				credentialIdB64u: args.credentialIdB64u,
-				signingRootId: materialFacts.identity.signingRootId,
-				signingRootVersion: materialFacts.identity.signingRootVersion,
-				signingWorkerId: materialFacts.stableServerScope.routerAbNormalSigning.signingWorkerId
-			},
-			stableServerScope: materialFacts.stableServerScope,
-			passkeyPrfFirstB64u: args.passkeyPrfFirstB64u
-		});
-		await requireCurrentNearRegistrationSession(args.sessionAuthority);
-		await args.signingEngine.activateVerifiedNearEd25519YaoMaterial({
-			activeClient,
-			facts: {
-				thresholdSessionId: materialFacts.identity.thresholdSessionId,
-				signer: nearEd25519SignerBindingFromBoundaryFields({
-					walletId: toWalletId(materialFacts.identity.walletId),
-					nearAccountId: toAccountId(materialFacts.identity.nearAccountId),
-					nearEd25519SigningKeyId: parseNearEd25519SigningKeyId(materialFacts.identity.nearEd25519SigningKeyId),
-					signerSlot: materialFacts.identity.signerSlot
-				}),
-				signingRootId: materialFacts.identity.signingRootId,
-				signingRootVersion: materialFacts.identity.signingRootVersion,
-				routerAbNormalSigning: materialFacts.stableServerScope.routerAbNormalSigning,
-				runtimePolicyScope: materialFacts.stableServerScope.runtimePolicyScope,
-				relayerUrl: args.relayerUrl
-			}
-		});
-		await requireCurrentNearRegistrationSession(args.sessionAuthority);
-		activeClient = null;
-	} catch (error) {
-		activeClient?.dispose();
-		throw error;
-	} finally {
-		args.ownedFactorSecret.fill(0);
-	}
-}
-async function prewarmDeferredPasskeyEd25519Client(auth) {
-	if (auth.kind !== "passkey") return;
-	try {
-		await RouterAbEd25519YaoClientV1.initializeBundled();
-	} catch {}
-}
-async function hydrateDeferredNearRegistrationSession(args) {
-	const startedAt = performance.now();
-	let outcome = "failure";
-	try {
-		await args.signingEngine.hydrateSigningSession(args.input);
-		outcome = "success";
-		return { kind: "completed" };
-	} catch (error) {
-		return {
-			kind: "failed",
-			error
-		};
-	} finally {
-		emitNearRegistrationTiming({
-			ceremonyId: args.ceremonyId,
-			stage: "session_hydration",
-			startedAt,
-			outcome
-		});
-	}
-}
-async function prepareDeferredNearSessionHydration(args) {
-	const startedAt = performance.now();
-	let outcome = "failure";
-	try {
-		await args.signingEngine.prepareSigningSessionHydration(args.input);
-		outcome = "success";
-		return { kind: "completed" };
-	} catch (error) {
-		return {
-			kind: "failed",
-			error
-		};
-	} finally {
-		emitNearRegistrationTiming({
-			ceremonyId: args.ceremonyId,
-			stage: "session_seal_preparation",
-			startedAt,
-			outcome
-		});
-	}
-}
-function startNearRegistrationSealPreparation(args) {
-	const sessionId = parseThresholdEd25519SessionId(args.thresholdSessionId);
-	if (!sessionId.ok) throw new Error("Invalid admitted NEAR session identity");
-	const preparationId = createRegistrationOperationIdempotencyKey("near-session-client-seal");
-	return {
-		kind: "preparing",
-		thresholdSessionId: String(sessionId.value),
-		preparationId,
-		result: prepareDeferredNearSessionHydration({
-			signingEngine: args.signingEngine,
-			ceremonyId: args.ceremonyId,
-			input: {
-				preparationId,
-				thresholdSessionId: String(sessionId.value),
-				prfFirstB64u: args.prfFirstB64u
-			}
-		})
-	};
-}
-async function prepareNearSessionSealWhileCustodyRuns(args) {
-	try {
-		await requireCurrentNearRegistrationSession(args.sessionAuthority);
-		const pending = await IndexedDBManager.getPendingWalletRegistrationCommit({
-			registrationCeremonyId: args.ceremonyId,
-			operation: "near_provisioning"
-		});
-		if (!pending || pending.operation !== "near_provisioning" || pending.phase === "joined") return { kind: "none" };
-		if (pending.walletId !== args.sessionAuthority.record.walletId || pending.walletAuthMethodId !== args.sessionAuthority.record.authMethodId) return { kind: "none" };
-		return startNearRegistrationSealPreparation({
-			signingEngine: args.signingEngine,
-			ceremonyId: args.ceremonyId,
-			thresholdSessionId: pending.admissionRequest.scope.threshold_session_id,
-			prfFirstB64u: args.prfFirstB64u
-		});
-	} catch {
-		return { kind: "none" };
-	}
-}
-function nearRegistrationProfileUnavailable() {
-	return null;
-}
-/** NEAR failures retain their repair journal while the committed ECDSA wallet stays usable. */
-async function commitDeferredEd25519Registration(args) {
-	const auth = args.authMaterial;
-	const startedAt = performance.now();
-	let outcome = "failure";
-	let retainedFactorSecret32 = null;
-	let hydration = Promise.resolve({ kind: "completed" });
-	let preparation = { kind: "none" };
-	try {
-		if (auth.kind === "passkey") preparation = await prepareNearSessionSealWhileCustodyRuns({
-			signingEngine: args.context.signingEngine,
-			ceremonyId: args.registrationCeremonyId,
-			sessionAuthority: args.sessionAuthority,
-			prfFirstB64u: auth.prfFirstB64u
-		});
-		const nearCustody = await args.nearCustodyWork();
-		retainedFactorSecret32 = nearCustody.factorSecret32;
-		const joined = nearCustody.joined;
-		const clientPublicKey = `ed25519:${base58Encode(joined.metadata.registeredPublicKey)}`;
-		const activationReference = joined.activationReference;
-		const nearProvisioningIdempotencyKey = await deriveNearProvisioningIdempotencyKey({
-			registrationCeremonyId: args.registrationCeremonyId,
-			activationReference
-		});
-		const pending = await readJoinedNearRegistrationCommit({
-			registrationCeremonyId: args.registrationCeremonyId,
-			walletId: args.walletId,
-			walletAuthMethodId: String(args.sessionAuthority.record.authMethodId)
-		});
-		await requireCurrentNearRegistrationSession(args.sessionAuthority);
-		if (auth.kind === "passkey" && preparation.kind === "none") preparation = startNearRegistrationSealPreparation({
-			signingEngine: args.context.signingEngine,
-			ceremonyId: args.registrationCeremonyId,
-			thresholdSessionId: joined.metadata.scope.threshold_session_id,
-			prfFirstB64u: auth.prfFirstB64u
-		});
-		let preparedSessionSeal;
-		if (preparation.kind === "preparing") {
-			const preparationWaitStartedAt = performance.now();
-			const prepared = await preparation.result;
-			emitNearRegistrationTiming({
-				ceremonyId: args.registrationCeremonyId,
-				stage: "session_seal_preparation_wait",
-				startedAt: preparationWaitStartedAt,
-				outcome: prepared.kind === "completed" ? "success" : "failure"
-			});
-			if (prepared.kind === "failed") throw prepared.error;
-			await requireCurrentNearRegistrationSession(args.sessionAuthority);
-			const clientSeal = await args.context.signingEngine.readPreparedSigningSessionHydration({
-				thresholdSessionId: preparation.thresholdSessionId,
-				preparationId: preparation.preparationId
-			});
-			preparedSessionSeal = {
-				preparationId: preparation.preparationId,
-				thresholdSessionId: preparation.thresholdSessionId,
-				ciphertext: clientSeal.ciphertext
-			};
-		}
-		const finalizationStartedAt = performance.now();
-		const nearProvisioningRequest = {
-			relayerUrl: args.relayerUrl,
-			registrationCeremonyId: args.registrationCeremonyId,
-			signedSetup: args.signedSetup,
-			headers: {
-				...args.headers,
-				Authorization: `Bearer ${args.sessionAuthority.operationCredential.token}`
-			},
-			idempotencyKey: nearProvisioningIdempotencyKey,
-			ed25519: { activationReference },
-			walletCustodyCommit: joined.commitPayload,
-			onServerTiming: recordRegistrationServerTimingBuckets.bind(void 0, args.registrationTiming)
-		};
-		let completed;
-		if (preparedSessionSeal) {
-			if (args.authMaterial.kind !== "passkey") throw new Error("Prepared session sealing requires a passkey authority");
-			completed = await completeWalletRegistrationNearProvisioning({
-				...nearProvisioningRequest,
-				auth: { kind: "passkey" },
-				sessionSeal: {
-					thresholdSessionId: preparedSessionSeal.thresholdSessionId,
-					ciphertext: preparedSessionSeal.ciphertext
-				}
-			});
-		} else completed = await completeWalletRegistrationNearProvisioning({
-			...nearProvisioningRequest,
-			auth: args.authMaterial
-		});
-		if (!completed.ok) throw new Error("Deferred NEAR provisioning did not complete");
-		const finalized = completed;
-		if (finalized.kind !== "near_ed25519") throw new Error("Deferred Ed25519 finalize returned a different signer branch");
-		if (finalized.walletCustody?.status !== "joined") {
-			const status = finalized.walletCustody?.status ?? "not_reported";
-			throw new Error(`Deferred NEAR custody join did not commit (${status})`);
-		}
-		if (preparedSessionSeal && !finalized.sessionSeal) throw new Error("Deferred NEAR finalization did not return the prepared session seal");
-		emitNearRegistrationTiming({
-			ceremonyId: args.registrationCeremonyId,
-			stage: "server_finalize",
-			startedAt: finalizationStartedAt,
-			outcome: "success"
-		});
-		const registrationSession = mixedRegistrationSessionFromDeferredResult(args.sessionAuthority, finalized.registrationEstablishedSession, finalized.foundingAuthority, finalized.foundingAuthMethod);
-		const nearAccountId = toAccountId(finalized.ed25519.nearAccountId);
-		const passkeyCredentialIdB64u = args.authMaterial.kind === "passkey" ? args.authMaterial.credentialIdB64u : "";
-		if (auth.kind === "passkey") requireEd25519YaoRegistrationPublicResultMatches({
-			clientPublicKey,
-			finalized,
-			expectedRpId: auth.rpId,
-			expectedWalletId: args.walletId
-		});
-		else requireEmailOtpEd25519YaoRegistrationPublicResultMatches({
-			clientPublicKey,
-			finalized,
-			expectedRegistrationAuthorityId: pending.auth.kind === "email_otp" ? pending.auth.registrationAuthorityId : "",
-			expectedWalletId: args.walletId
-		});
-		const materialFacts = registrationEd25519MaterialFacts({
-			deferredNear: {
-				status: "deferred",
-				admissionRequest: nearCustody.admissionRequest
-			},
-			finalized: finalized.ed25519,
-			walletId: args.walletId,
-			expectedRuntimePolicyScope: normalizeRuntimePolicyScope(finalized.ed25519.runtimePolicyScope)
-		});
-		const metadata = joined.metadata;
-		const materialActivation = nearEd25519YaoMaterialActivationFromMetadata(metadata);
-		const custodyMaterial = walletCustodyRegistrationMaterial({
-			established: joined,
-			walletId: String(args.walletId),
-			nearAccountId: String(nearAccountId),
-			nearEd25519SigningKeyId: finalized.ed25519.nearEd25519SigningKeyId,
-			signerSlot: finalized.ed25519.signerSlot
-		});
-		const publicationStartedAt = performance.now();
-		const registration = await registrationProjectionFromPending(pending, finalized);
-		await requireCurrentNearRegistrationSession(args.sessionAuthority);
-		const storedNearActivation = (await IndexedDBManager.publishPendingWalletRegistrationCommitAndRetain({
-			pending,
-			ecdsaContinuity: [],
-			authority: finalized.authority,
-			foundingAuthority: {
-				authority: finalized.foundingAuthority,
-				authMethod: finalized.foundingAuthMethod
-			},
-			request: {
-				operation: pending.operation,
-				registrationCeremonyId: args.registrationCeremonyId,
-				idempotencyKey: pending.idempotencyKey,
-				walletId: args.walletId,
-				walletAuthMethodId: finalized.foundingAuthMethod.walletAuthMethodId
-			},
-			walletSessionPublication: {
-				kind: "credential_free_projection",
-				walletSession: registrationSession.walletSession
-			},
-			registration
-		})).signerActivations[0];
-		if (!storedNearActivation || storedNearActivation.signerSlot !== finalized.ed25519.signerSlot) throw new Error("Deferred Ed25519 registration persisted a different signer slot");
-		const prefillStatusReads = new WalletSessionStatusReadScope();
-		for (const chainTarget of args.expectedChainTargets) scheduleEcdsaSessionPresignaturePrefill({
-			signingEngine: args.context.signingEngine,
-			walletId: args.walletId,
-			chainTarget,
-			trigger: "registration",
-			statusReads: prefillStatusReads
-		});
-		emitNearRegistrationTiming({
-			ceremonyId: args.registrationCeremonyId,
-			stage: "local_publication",
-			startedAt: publicationStartedAt,
-			outcome: "success"
-		});
-		await requireCurrentNearRegistrationSession(args.sessionAuthority);
-		if (args.authMaterial.kind === "passkey" && registrationSession.remainingUses > 0) hydration = hydrateDeferredNearRegistrationSession({
-			signingEngine: args.context.signingEngine,
-			ceremonyId: args.registrationCeremonyId,
-			input: buildRegistrationPasskeyEd25519SessionHydration({
-				session: registrationSession,
-				ceremonyId: args.registrationCeremonyId,
-				walletId: String(args.walletId),
-				relayerUrl: args.relayerUrl,
-				prfFirstB64u: args.authMaterial.prfFirstB64u,
-				preparedServerSeal: preparedSessionSeal && finalized.sessionSeal ? {
-					preparationId: preparedSessionSeal.preparationId,
-					...finalized.sessionSeal
-				} : null,
-				restore: {
-					rpId: args.authMaterial.rpId,
-					nearAccountId: String(nearAccountId),
-					nearEd25519SigningKeyId: finalized.ed25519.nearEd25519SigningKeyId,
-					relayerKeyId: finalized.ed25519.relayerKeyId,
-					participantIds: finalized.ed25519.participantIds,
-					signerSlot: finalized.ed25519.signerSlot,
-					credentialIdB64u: args.authMaterial.credentialIdB64u,
-					materialActivation
-				}
-			})
-		});
-		const sessionStartedAt = performance.now();
-		await args.context.signingEngine.activateAuthenticatedWalletState({
-			walletId: args.walletId,
-			nearAccountId,
-			signerSlot: finalized.ed25519.signerSlot,
-			nearClient: args.context.nearClient
-		});
-		await args.context.signingEngine.upsertEd25519YaoPublicCapabilityLaneReference({
-			walletId: args.walletId,
-			nearAccountId,
-			thresholdSessionId: materialFacts.identity.thresholdSessionId,
-			runtimePolicyScope: materialFacts.stableServerScope.runtimePolicyScope,
-			materialActivation,
-			...registrationEd25519LaneAuthorization(auth, passkeyCredentialIdB64u, registrationSession),
-			nearEd25519SigningKeyId: parseNearEd25519SigningKeyId(finalized.ed25519.nearEd25519SigningKeyId),
-			signerSlot: finalized.ed25519.signerSlot
-		});
-		emitNearRegistrationTiming({
-			ceremonyId: args.registrationCeremonyId,
-			stage: "session_install",
-			startedAt: sessionStartedAt,
-			outcome: "success"
-		});
-		const activationStartedAt = performance.now();
-		if (auth.kind === "email_otp" && registrationSession.remainingUses > 0) {
-			const walletSessionState = await buildRegistrationEmailOtpEd25519SessionState({
-				registrationEstablishedSession: registrationSession,
-				walletId: args.walletId,
-				nearAccountId: String(nearAccountId),
-				nearEd25519SigningKeyId: finalized.ed25519.nearEd25519SigningKeyId,
-				thresholdSessionId: materialFacts.identity.thresholdSessionId,
-				runtimePolicyScope: materialFacts.stableServerScope.runtimePolicyScope,
-				signerSlot: finalized.ed25519.signerSlot,
-				relayerUrl: args.relayerUrl,
-				emailOtpAuthContext: auth.emailOtpAuthContext
-			});
-			const bootstrap = buildRegistrationEmailOtpEd25519RecoveryBootstrap({
-				walletId: args.walletId,
-				nearAccountId: String(nearAccountId),
-				nearEd25519SigningKeyId: finalized.ed25519.nearEd25519SigningKeyId,
-				sessionState: walletSessionState,
-				joined,
-				deferredNear: {
-					status: "deferred",
-					admissionRequest: nearCustody.admissionRequest
-				},
-				admissionReceipt: nearCustody.admissionReceipt,
-				authContext: auth.emailOtpAuthContext
-			});
-			await args.context.signingEngine.activateEmailOtpEd25519RegistrationMaterialInternal({
-				walletSession: {
-					walletId: args.walletId,
-					walletSessionUserId: String(args.walletId)
-				},
-				providerSubject: emailOtpAuthContextProviderUserId(auth.emailOtpAuthContext),
-				emailHashHex: emailOtpAuthContextEmailHashHex(auth.emailOtpAuthContext),
-				signerSlot: finalized.ed25519.signerSlot,
-				expectedOperationalPublicKey: clientPublicKey,
-				expectedThresholdSessionId: materialFacts.identity.thresholdSessionId,
-				bootstrap,
-				material: custodyMaterial,
-				envelope: walletCustodyCacheEnvelopeFromRecordV1(nearCustody.envelope),
-				factorSecret32: retainedFactorSecret32
-			});
-			retainedFactorSecret32 = null;
-		} else if (auth.kind === "passkey") {
-			if (args.authMaterial.kind !== "passkey") throw new Error("Deferred passkey registration has no Passkey authorization material");
-			if (!retainedFactorSecret32) throw new Error("Deferred passkey registration has no custody factor secret");
-			await args.clientPrewarm;
-			await activatePasskeyRegistrationEd25519Material({
-				signingEngine: args.context.signingEngine,
-				sessionAuthority: args.sessionAuthority,
-				metadata,
-				material: custodyMaterial,
-				materialFacts,
-				envelope: walletCustodyCacheEnvelopeFromRecordV1(nearCustody.envelope),
-				ownedFactorSecret: new Uint8Array(retainedFactorSecret32),
-				rpId: args.authMaterial.rpId,
-				credentialIdB64u: args.authMaterial.credentialIdB64u,
-				passkeyPrfFirstB64u: args.authMaterial.prfFirstB64u,
-				relayerUrl: args.relayerUrl
-			});
-			retainedFactorSecret32 = null;
-		}
-		if (args.authMaterial.kind === "passkey") await rememberPasskeyCustodySessionEnvelope({
-			walletId: String(args.walletId),
-			credentialIdB64u: args.authMaterial.credentialIdB64u,
-			envelope: nearCustody.envelope
-		});
-		emitNearRegistrationTiming({
-			ceremonyId: args.registrationCeremonyId,
-			stage: "signer_activation",
-			startedAt: activationStartedAt,
-			outcome: "success"
-		});
-		await requireCurrentNearRegistrationSession(args.sessionAuthority);
-		const hydrationWaitStartedAt = performance.now();
-		const hydrated = await hydration;
-		emitNearRegistrationTiming({
-			ceremonyId: args.registrationCeremonyId,
-			stage: "session_hydration_wait",
-			startedAt: hydrationWaitStartedAt,
-			outcome: hydrated.kind === "completed" ? "success" : "failure"
-		});
-		if (hydrated.kind === "failed") throw hydrated.error;
-		await requireCurrentNearRegistrationSession(args.sessionAuthority);
-		const readyStartedAt = performance.now();
-		await IndexedDBManager.completePendingNearRegistration({
-			pending,
-			walletSession: registrationSession.walletSession,
-			operationCredential: registrationSession.operationCredential,
-			nearAccountId: String(nearAccountId)
-		});
-		emitNearRegistrationTiming({
-			ceremonyId: args.registrationCeremonyId,
-			stage: "durable_ready",
-			startedAt: readyStartedAt,
-			outcome: "success"
-		});
-		outcome = "success";
-		return {
-			status: "near_ready",
-			updatedAtMs: Date.now(),
-			nearAccountId: String(nearAccountId)
-		};
-	} catch (error) {
-		const profile = await IndexedDBManager.getProfile(String(args.walletId)).catch(nearRegistrationProfileUnavailable);
-		if (profile?.nearProvisioning?.status === "near_ready") return profile.nearProvisioning;
-		const errorCode = nearProvisioningErrorCode(error);
-		try {
-			await args.context.signingEngine.setWalletNearProvisioningState({
-				walletId: String(args.walletId),
-				status: "near_failed_retryable",
-				errorCode
-			});
-		} catch {}
-		return {
-			status: "near_failed_retryable",
-			updatedAtMs: Date.now(),
-			error: getUserFriendlyErrorMessage(error, "registration", String(args.walletId)),
-			errorCode
-		};
-	} finally {
-		await hydration;
-		if (preparation.kind === "preparing") {
-			await preparation.result;
-			await args.context.signingEngine.discardSigningSessionHydration({
-				thresholdSessionId: preparation.thresholdSessionId,
-				preparationId: preparation.preparationId
-			}).catch(ignoreNearCustodyFailure);
-		}
-		if (retainedFactorSecret32) zeroizeArrayBuffer(retainedFactorSecret32);
-		emitNearRegistrationTiming({
-			ceremonyId: args.registrationCeremonyId,
-			stage: "provisioning_total",
-			startedAt,
-			outcome
-		});
-		emitNearRegistrationTiming({
-			ceremonyId: args.registrationCeremonyId,
-			stage: "registration_total",
-			startedAt: args.registrationStartedAt,
-			outcome
-		});
-	}
-}
-async function runDeferredEd25519Provisioning(args) {
-	try {
-		await args.context.signingEngine.setWalletNearProvisioningState({
-			walletId: String(args.walletId),
-			status: "near_provisioning"
-		});
-	} catch (error) {
-		const errorCode = nearProvisioningErrorCode(error);
-		const state = {
-			status: "near_failed_retryable",
-			updatedAtMs: Date.now(),
-			error: getUserFriendlyErrorMessage(error, "registration", String(args.walletId)),
-			errorCode
-		};
-		try {
-			await args.context.signingEngine.setWalletNearProvisioningState({
-				walletId: String(args.walletId),
-				status: "near_failed_retryable",
-				errorCode
-			});
-		} catch {}
-		publishNearProvisioningState(args.walletId, state);
-		return;
-	}
-	await runSingleFlightNearProvisioning({
-		walletId: args.walletId,
-		nowMs: Date.now,
-		attempt: commitDeferredEd25519Registration.bind(void 0, args.commit)
-	});
-}
-/** Maps a deferred-commit throw onto the closed set of provisioning codes. */
-function nearProvisioningErrorCode(error) {
-	const message = error instanceof Error ? error.message : String(error);
-	if (message.includes("finalize")) return "near_finalize_failed";
-	if (message.includes("seal") || message.includes("Yao")) return "near_seal_failed";
-	if (message.includes("wallet session")) return "near_capability_persist_failed";
-	return "near_provisioning_failed";
-}
-async function markMixedNearProvisioningRetryable(args) {
-	const errorCode = nearProvisioningErrorCode(args.error);
-	const errorMessage = getUserFriendlyErrorMessage(args.error, "registration", String(args.walletId));
-	try {
-		await args.context.signingEngine.setWalletNearProvisioningState({
-			walletId: String(args.walletId),
-			status: "near_failed_retryable",
-			errorCode
-		});
-	} catch {}
-	publishNearProvisioningState(args.walletId, {
-		status: "near_failed_retryable",
-		updatedAtMs: Date.now(),
-		error: errorMessage,
-		errorCode
-	});
-	return {
-		status: "retryable",
-		error: errorMessage,
-		errorCode
-	};
-}
-async function markMixedNearProvisioningPending(args) {
-	try {
-		await args.context.signingEngine.setWalletNearProvisioningState({
-			walletId: String(args.walletId),
-			status: "near_pending"
-		});
-		publishNearProvisioningState(args.walletId, {
-			status: "near_pending",
-			updatedAtMs: Date.now()
-		});
-		return { status: "pending" };
-	} catch (error) {
-		return await markMixedNearProvisioningRetryable({
-			context: args.context,
-			walletId: args.walletId,
-			error
-		});
-	}
-}
-async function registerEcdsaOrMixedWallet(args) {
-	const { context, wallet, signerSelection } = args;
-	const options = args.options || {};
-	const { onEvent, onError, afterCall } = options;
-	const startedAt = performance.now();
-	const registrationTiming = new RegistrationTimingRecorder(startedAt);
-	const clientPrewarm = args.kind === "near_ed25519_and_evm_family_ecdsa" ? prewarmDeferredPasskeyEd25519Client(args.authMethod) : Promise.resolve();
-	const traceContext = createRouterAbTraceContextV1();
-	let postTouchIdCompletedAt = null;
-	let emailOtpCustodyCapabilityFactorSecret32 = null;
-	const initialEventAccountId = registrationEventAccountId(wallet.kind === "provided" ? String(wallet.walletId) : "wallet-registration");
-	emitRegistrationEvent(onEvent, initialEventAccountId, {
-		authMethod: args.authMethod.kind,
-		phase: RegistrationEventPhase.STEP_01_STARTED,
-		status: "started"
-	});
-	try {
-		const finalizeIdempotencyKey = createRegistrationOperationIdempotencyKey("wallet-registration-finalize");
-		const prepared = await setupRegistrationForPasskeyExecution({
-			context,
-			authMethod: args.authMethod,
-			wallet,
-			signerSelection,
-			recorder: registrationTiming,
-			passkeyExecution: args.passkeyExecution
-		});
-		if (args.authMethod.kind === "email_otp") observeRegistrationWarmup({
-			recorder: registrationTiming,
-			warmup: prepared.registrationWarmup
-		});
-		const { relayerUrl, setup } = prepared;
-		const ecdsaPrepare = materializeWalletRegistrationSetupEcdsaPrepare(requireEcdsaRegistrationSetup(setup, args.kind).ecdsa);
-		const ecdsaClientCeremony = ecdsaRegistrationClientCeremonyForExecution({
-			passkeyExecution: args.passkeyExecution,
-			ceremonyId: setup.registrationCeremonyId
-		});
-		const intentResponse = {
-			intent: setup.intent,
-			registrationIntentDigestB64u: setup.registrationIntentDigestB64u
-		};
-		const walletId = intentResponse.intent.walletId;
-		const eventAccountId = registrationEventAccountId(String(walletId));
-		let emailOtpEnrollmentMaterial = null;
-		let emailOtpRegistrationAuthorityId = "";
-		let emailOtpEmail = "";
-		let emailOtpProviderSubject = "";
-		let emailOtpProvider = null;
-		let emailOtpWalletCustodyFactorSecret = null;
-		let passkeyAuthority = null;
-		let startAuthority;
-		if (args.authMethod.kind === "passkey") {
-			emitRegistrationEvent(onEvent, eventAccountId, {
-				authMethod: args.authMethod.kind,
-				phase: RegistrationEventPhase.STEP_04_PASSKEY_CREATE_STARTED,
-				status: "waiting_for_user",
-				interaction: {
-					kind: "passkey_create",
-					overlay: "show"
-				}
-			});
-			const confirmationConfig = {
-				uiMode: "modal",
-				behavior: "requireClick",
-				...args.confirmationConfigOverride ?? options?.confirmationConfig ?? {}
-			};
-			passkeyAuthority = await registrationTiming.measure("authProofMs", () => resolvePasskeyRegistrationAuthority({
-				context,
-				walletId,
-				signerSlot: registrationPasskeySignerSlot(args),
-				registrationIntentDigestB64u: intentResponse.registrationIntentDigestB64u,
-				options,
-				confirmationConfigOverride: confirmationConfig,
-				passkeyExecution: args.passkeyExecution
-			}));
-			registrationTiming.capturePasskeyAuthDiagnostics(passkeyAuthority.diagnostics);
-			postTouchIdCompletedAt = performance.now();
-			const custodyCredentialId = parseWebAuthnCredentialIdB64u(String(passkeyAuthority.credential.rawId || passkeyAuthority.credential.id || "").trim());
-			if (!custodyCredentialId.ok) throw new Error(`passkey credential id ${custodyCredentialId.error.message}`);
-			startAuthority = {
-				kind: "passkey",
-				webauthnRegistration: passkeyAuthority.webauthnRegistration,
-				walletCustodyFactorJson: JSON.stringify({
-					envelopeId: `wallet-custody-envelope:${crypto.randomUUID()}`,
-					factor: buildPasskeyEnvelopeFactor({
-						rpId: requireWebAuthnRpId(args.authMethod.rpId),
-						credentialIdB64u: custodyCredentialId.value
-					}),
-					walletAuthMethodId: intentResponse.intent.foundingWalletAuthMethodId
-				}),
-				walletCustodyFactorSecret: base64UrlDecode(passkeyAuthority.prfFirstB64u).buffer
-			};
-			emitRegistrationEvent(onEvent, eventAccountId, {
-				authMethod: args.authMethod.kind,
-				phase: RegistrationEventPhase.STEP_04_PASSKEY_CREATE_SUCCEEDED,
-				status: "succeeded",
-				interaction: {
-					kind: "passkey_create",
-					overlay: "hide"
-				}
-			});
-		} else {
-			const emailOtpAuthMethod = args.authMethod;
-			const emailOtpEnrollmentSecret = crypto.getRandomValues(new Uint8Array(32));
-			emailOtpCustodyCapabilityFactorSecret32 = emailOtpEnrollmentSecret.slice();
-			emailOtpWalletCustodyFactorSecret = emailOtpEnrollmentSecret.slice().buffer;
-			const emailAuthority = await registrationTiming.measure("authProofMs", () => collectEmailOtpRegistrationAuthority({
-				authMethod: emailOtpAuthMethod,
-				relayUrl: relayerUrl,
-				walletId: String(walletId),
-				registrationIntentDigestB64u: intentResponse.registrationIntentDigestB64u
-			}));
-			emailOtpEnrollmentMaterial = startEmailOtpRegistrationEnrollmentMaterial({
-				recorder: registrationTiming,
-				context,
-				authMethod: emailOtpAuthMethod,
-				relayerUrl,
-				walletId: String(walletId),
-				providerSubject: emailAuthority.providerSubject,
-				clientSecret32: emailOtpEnrollmentSecret
-			});
-			emailOtpRegistrationAuthorityId = emailAuthority.registrationAuthorityId;
-			emailOtpEmail = emailAuthority.email;
-			emailOtpProviderSubject = emailAuthority.providerSubject;
-			emailOtpProvider = emailOtpProviderFromRegistrationProof(emailAuthority.proof);
-			startAuthority = {
-				kind: "email_otp",
-				emailOtpRegistrationProof: emailAuthority.proof,
-				walletCustodyFactorSecret: emailOtpWalletCustodyFactorSecret
-			};
-		}
-		const setupWalletAuthMethodId = parseWalletAuthMethodId(setup.walletAuthMethodId);
-		if (!setupWalletAuthMethodId.ok) throw new Error(`Registration setup auth-method identity is invalid: ${setupWalletAuthMethodId.error.message}`);
-		let materialAuthority;
-		if (args.authMethod.kind === "passkey") {
-			if (!passkeyAuthority) throw new Error("ECDSA registration is missing its verified passkey authority");
-			materialAuthority = await walletAuthAuthorityRef({ authority: {
-				...passkeyWalletAuthAuthorityFromCredential({
-					walletId,
-					rpId: args.authMethod.rpId,
-					credential: passkeyAuthority.credential
-				}),
-				bindingId: setupWalletAuthMethodId.value
-			} });
-		} else {
-			if (!emailOtpProvider) throw new Error("Email OTP registration is missing its verified provider");
-			materialAuthority = await walletAuthAuthorityRef({ authority: {
-				...buildEmailOtpWalletAuthAuthority({
-					walletId,
-					provider: emailOtpProvider,
-					providerUserId: emailOtpProviderSubject,
-					emailHashHex: await emailOtpEmailHashHex(emailOtpEmail)
-				}),
-				bindingId: setupWalletAuthMethodId.value
-			} });
-		}
-		emitRegistrationEvent(onEvent, eventAccountId, {
-			authMethod: args.authMethod.kind,
-			phase: RegistrationEventPhase.STEP_05_ED25519_SIGNER_PREPARE_STARTED,
-			status: "running"
-		});
-		const walletCustodyNearJoinFactorSecretOwner = { value: args.kind === "near_ed25519_and_evm_family_ecdsa" ? startAuthority.walletCustodyFactorSecret.slice(0) : null };
-		let persistedPendingCommit = null;
-		let ceremony;
-		try {
-			ceremony = await registrationTiming.measure("ecdsaRegistrationTotalMs", () => runEcdsaEnabledThreeRouteRegistrationCeremony({
-				context,
-				relayerUrl,
-				registrationCeremonyId: setup.registrationCeremonyId,
-				signerPlanKind: args.kind,
-				signedSetup: setup.signedSetup,
-				ecdsaPrepare,
-				clientCeremony: ecdsaClientCeremony,
-				authority: startAuthority,
-				materialAuthority,
-				idempotencyKey: finalizeIdempotencyKey,
-				resolveActivateEmailOtp: async () => {
-					let enrollment = null;
-					let walletCustodyFactorJson = null;
-					if (args.authMethod.kind === "email_otp") {
-						const material = await requireEmailOtpRegistrationEnrollmentMaterial({
-							material: emailOtpEnrollmentMaterial,
-							operation: "activate"
-						});
-						enrollment = material.emailOtpEnrollment ?? null;
-						walletCustodyFactorJson = JSON.stringify({
-							envelopeId: `wallet-custody-envelope:${crypto.randomUUID()}`,
-							factor: buildEmailOtpEnvelopeFactor({
-								enrollmentId: material.enrollmentId,
-								enrollmentSealKeyVersion: material.enrollmentSealKeyVersion
-							}),
-							walletAuthMethodId: intentResponse.intent.foundingWalletAuthMethodId
-						});
-					}
-					return {
-						enrollment,
-						walletCustodyFactorJson
-					};
-				},
-				traceContext,
-				registrationTiming,
-				confirmRecoveryCodesBackedUp: confirmWalletRecoveryCodesBackedUp.bind(void 0, context, String(walletId), options.recoveryCodeBackup),
-				persistPendingCommit: async (input) => {
-					const common = {
-						operation: "registration_activate",
-						registrationCeremonyId: setup.registrationCeremonyId,
-						idempotencyKey: finalizeIdempotencyKey,
-						walletId: String(walletId),
-						walletAuthMethodId: String(intentResponse.intent.foundingWalletAuthMethodId),
-						signedSetup: String(setup.signedSetup),
-						auth: pendingRegistrationAuthFromRegistrationInputs({
-							authMethod: args.authMethod,
-							passkeyAuthority,
-							email: emailOtpEmail,
-							registrationAuthorityId: emailOtpRegistrationAuthorityId,
-							providerSubject: emailOtpProviderSubject,
-							emailOtpEnrollment: input.emailOtpEnrollment
-						})
-					};
-					if (input.signerPlanKind === "near_ed25519_and_evm_family_ecdsa") {
-						const nowMs = Date.now();
-						const activation = requireMixedRegistrationActivatePendingCommit(buildPendingRegistrationCommit({
-							...common,
-							signerPlanKind: input.signerPlanKind,
-							localMaterial: input.localMaterial,
-							createdAtMs: nowMs,
-							updatedAtMs: nowMs
-						}));
-						const continuation = planPendingNearRegistration(activation, input.deferredNear.admissionRequest);
-						await IndexedDBManager.putPendingWalletRegistrationCommits([activation, continuation]);
-						persistedPendingCommit = activation;
-						return;
-					}
-					persistedPendingCommit = await persistPendingRegistrationCommit({
-						...common,
-						signerPlanKind: input.signerPlanKind,
-						localMaterial: input.localMaterial
-					});
-				},
-				startDeferredNearCustody: startDeferredNearWalletCustody.bind(void 0, {
-					context,
-					factorSecretOwner: walletCustodyNearJoinFactorSecretOwner,
-					registrationCeremonyId: setup.registrationCeremonyId,
-					relayerUrl,
-					signedSetup: String(setup.signedSetup),
-					traceContext
-				})
-			}));
-		} finally {
-			zeroizeArrayBuffer(startAuthority.walletCustodyFactorSecret);
-			if (walletCustodyNearJoinFactorSecretOwner.value) {
-				zeroizeArrayBuffer(walletCustodyNearJoinFactorSecretOwner.value);
-				walletCustodyNearJoinFactorSecretOwner.value = null;
-			}
-		}
-		const ecdsaSession = ceremony.session;
-		if (ceremony.activated.kind !== "evm_family_ecdsa") throw new Error("Wallet registration activate returned a different signer branch");
-		const finalized = finalizeResponseViewFromActivatedEcdsa(ceremony.activated);
-		const emailOtpEnrollment = ceremony.activateEmailOtp.enrollment;
-		if (finalized.kind !== "evm_family_ecdsa") throw new Error("Wallet registration finalize returned a different signer branch");
-		if (args.authMethod.kind === "email_otp") {
-			if (!isEmailOtpWalletRegistrationFinalizeResponse(finalized)) throw new Error("Email OTP registration finalize returned a different auth method");
-		}
-		registrationTiming.captureRouteDiagnostics(finalized.registrationDiagnostics);
-		const walletKeys = finalized.ecdsa.walletKeys;
-		if (walletKeys.length === 0) throw new Error("Wallet registration finalize did not return ECDSA wallet keys");
-		const persistenceAuth = await buildRegistrationPersistenceAuth({
-			authMethod: args.authMethod,
-			configs: context.configs,
-			walletId: toWalletId(finalized.walletId),
-			finalized,
-			passkeyAuthority,
-			email: emailOtpEmail,
-			providerSubject: emailOtpProviderSubject,
-			registrationAuthorityId: emailOtpRegistrationAuthorityId
-		});
-		const persistencePlan = buildRegistrationPersistencePlan({
-			walletId: toWalletId(finalized.walletId),
-			auth: persistenceAuth,
-			foundingAuthority: finalized.foundingAuthority,
-			foundingAuthMethod: finalized.foundingAuthMethod,
-			ecdsa: buildRegistrationPersistenceEcdsa({
-				session: ecdsaSession,
-				walletKeys,
-				expectedChainTargets: ecdsaSession.chainTargets
-			})
-		});
-		emitRegistrationEvent(onEvent, eventAccountId, {
-			authMethod: args.authMethod.kind,
-			phase: RegistrationEventPhase.STEP_05_ED25519_SIGNER_PREPARE_SUCCEEDED,
-			status: "succeeded"
-		});
-		emitRegistrationEvent(onEvent, eventAccountId, {
-			authMethod: args.authMethod.kind,
-			phase: RegistrationEventPhase.STEP_08_STORAGE_PERSIST_STARTED,
-			status: "running"
-		});
-		const deferredWalletId = toWalletId(finalized.walletId);
-		let registrationNearProvisioning = { status: "pending" };
-		if (args.kind === "near_ed25519_and_evm_family_ecdsa") {
-			await publishMixedEcdsaRegistrationCommit({
-				context,
-				relayerUrl,
-				registrationTiming,
-				pending: requireMixedRegistrationActivatePendingCommit(persistedPendingCommit),
-				plan: persistencePlan,
-				activated: ceremony.activated
-			});
-			registrationNearProvisioning = await markMixedNearProvisioningPending({
-				context,
-				walletId: deferredWalletId
-			});
-		} else await commitRegistrationPersistencePlan({
-			context,
-			relayerUrl,
-			registrationTiming,
-			plan: persistencePlan
-		});
-		const prefillStatusReads = new WalletSessionStatusReadScope();
-		for (const chainTarget of ecdsaSession.chainTargets) scheduleEcdsaSessionPresignaturePrefill({
-			signingEngine: context.signingEngine,
-			walletId: deferredWalletId,
-			chainTarget,
-			trigger: "registration",
-			statusReads: prefillStatusReads
-		});
-		const primaryEcdsaKey = persistencePlan.ecdsa.walletKeys[0];
-		if (args.authMethod.kind === "passkey") {
-			if (!passkeyAuthority) throw new Error("Passkey registration authority was not collected");
-			const registrationSession = persistencePlan.ecdsa.session.registrationEstablishedSession;
-			try {
-				await establishPasskeyRegistrationEd25519ExportRootCapability({
-					signingEngine: context.signingEngine,
-					commit: ceremony.walletCustody.commitPayload,
-					passkeyPrfFirstB64u: passkeyAuthority.prfFirstB64u,
-					walletId: String(walletId),
-					walletAuthMethodId: String(persistencePlan.foundingAuthMethod.walletAuthMethodId),
-					walletSessionId: String(registrationSession.walletSessionId),
-					expiresAtMs: registrationSession.expiresAtMs
-				});
-			} catch (error) {
-				if (args.kind !== "near_ed25519_and_evm_family_ecdsa") throw error;
-				registrationNearProvisioning = await markMixedNearProvisioningRetryable({
-					context,
-					walletId: deferredWalletId,
-					error
-				});
-			}
-		} else {
-			if (persistenceAuth.kind !== "email_otp" || !emailOtpCustodyCapabilityFactorSecret32) throw new Error("Email OTP registration has no custody capability material");
-			const registrationSession = persistencePlan.ecdsa.session.registrationEstablishedSession;
-			await establishEmailOtpRegistrationEd25519ExportRootCapability({
-				context,
-				commit: ceremony.walletCustody.commitPayload,
-				factorSecret32: emailOtpCustodyCapabilityFactorSecret32,
-				emailOtpAuthContext: persistenceAuth.emailOtpAuthContext,
-				walletId: String(walletId),
-				walletSessionId: String(registrationSession.walletSessionId),
-				expiresAtMs: registrationSession.expiresAtMs
-			});
-		}
-		if (args.kind === "near_ed25519_and_evm_family_ecdsa") {
-			const deferredAuthMaterial = buildDeferredRegistrationFinalizeAuthMaterial({
-				auth: persistencePlan.auth,
-				emailOtpEnrollment,
-				passkeyAuthority
-			});
-			try {
-				runDeferredEd25519Provisioning({
-					context,
-					walletId: deferredWalletId,
-					commit: {
-						context,
-						registrationTiming,
-						registrationStartedAt: startedAt,
-						clientPrewarm,
-						relayerUrl,
-						registrationCeremonyId: setup.registrationCeremonyId,
-						signedSetup: setup.signedSetup,
-						headers: registrationRouteHeaders(traceContext),
-						nearCustodyWork: requireDeferredNearCustodyWork.bind(void 0, ceremony.deferredNearCustodyWork),
-						sessionAuthority: {
-							record: persistencePlan.ecdsa.session.registrationEstablishedSession.walletSession,
-							operationCredential: persistencePlan.ecdsa.session.registrationEstablishedSession.operationCredential
-						},
-						expectedChainTargets: persistencePlan.ecdsa.expectedChainTargets,
-						walletId: deferredWalletId,
-						authMaterial: deferredAuthMaterial
-					}
-				});
-			} catch (error) {
-				const errorCode = nearProvisioningErrorCode(error);
-				registrationNearProvisioning = {
-					status: "retryable",
-					error: getUserFriendlyErrorMessage(error, "registration", String(deferredWalletId)),
-					errorCode
-				};
-				publishNearProvisioningState(deferredWalletId, {
-					status: "near_failed_retryable",
-					updatedAtMs: Date.now(),
-					error: registrationNearProvisioning.error,
-					errorCode
-				});
-			}
-		}
-		if (args.kind === "evm_family_ecdsa") await IndexedDBManager.deletePendingWalletRegistrationCommit({
-			registrationCeremonyId: setup.registrationCeremonyId,
-			operation: "registration_activate"
-		});
-		const result = args.kind === "near_ed25519_and_evm_family_ecdsa" ? {
-			success: true,
-			kind: "ecdsa_wallet_registered_near_pending",
-			walletId: finalized.walletId,
-			capabilities: [{
-				kind: "evm_family_ecdsa",
-				thresholdEcdsaEthereumAddress: primaryEcdsaKey.thresholdOwnerAddress,
-				thresholdEcdsaPublicKeyB64u: primaryEcdsaKey.thresholdEcdsaPublicKeyB64u
-			}],
-			nearProvisioning: registrationNearProvisioning
-		} : {
-			success: true,
-			kind: "wallet_registered",
-			walletId: finalized.walletId,
-			capabilities: [{
-				kind: "evm_family_ecdsa",
-				thresholdEcdsaEthereumAddress: primaryEcdsaKey.thresholdOwnerAddress,
-				thresholdEcdsaPublicKeyB64u: primaryEcdsaKey.thresholdEcdsaPublicKeyB64u
-			}]
-		};
-		emitRegistrationEvent(onEvent, eventAccountId, {
-			authMethod: args.authMethod.kind,
-			phase: RegistrationEventPhase.STEP_08_STORAGE_PERSIST_SUCCEEDED,
-			status: "succeeded"
-		});
-		emitRegistrationEvent(onEvent, eventAccountId, {
-			authMethod: args.authMethod.kind,
-			phase: RegistrationEventPhase.STEP_11_COMPLETED,
-			status: "succeeded"
-		});
-		if (postTouchIdCompletedAt !== null) {
-			const walletReadyAt = performance.now();
-			emitRegistrationTimingSpan({
-				callback: options.onTimingSpan,
-				span: "registration.post_touch_id",
-				outcome: "success",
-				durationMs: walletReadyAt - postTouchIdCompletedAt,
-				traceContext
-			});
-			emitRegistrationTimingSpan({
-				callback: options.onTimingSpan,
-				span: "frontend.wallet_ready",
-				outcome: "success",
-				durationMs: 0,
-				traceContext
-			});
-		}
-		emitRegistrationTimingSummary(createSucceededRegistrationTimingSummary({
-			recorder: registrationTiming,
-			authMethod: args.authMethod.kind,
-			signerSet: registrationTimingSignerSetFromPlan(args.signerPlan)
-		}));
-		commitSuccessfulWalletAuthentication(args.context, result, args.authMethod.kind);
-		afterCall?.(true, result);
-		return result;
-	} catch (error) {
-		const errorCode = registrationErrorCodeFromUnknown(error);
-		const errorMessage = getUserFriendlyErrorMessage(error, "registration", initialEventAccountId);
-		if (postTouchIdCompletedAt !== null) emitRegistrationTimingSpan({
-			callback: options.onTimingSpan,
-			span: "registration.post_touch_id",
-			outcome: "failure",
-			durationMs: performance.now() - postTouchIdCompletedAt,
-			traceContext
-		});
-		const errorObject = registrationErrorWithCode(errorMessage, errorCode);
-		onError?.(errorObject);
-		emitRegistrationEvent(onEvent, initialEventAccountId, {
-			authMethod: args.authMethod.kind,
-			phase: RegistrationEventPhase.FAILED,
-			status: "failed",
-			message: errorMessage,
-			interaction: {
-				kind: "passkey_create",
-				overlay: "hide"
-			},
-			error: {
-				...errorCode ? { code: errorCode } : {},
-				message: errorMessage
-			}
-		});
-		const result = {
-			success: false,
-			error: errorMessage,
-			...errorCode ? { errorCode } : {}
-		};
-		emitRegistrationTimingSummary(createFailedRegistrationTimingSummary({
-			recorder: registrationTiming,
-			authMethod: args.authMethod.kind,
-			signerSet: registrationTimingSignerSetFromPlan(args.signerPlan),
-			errorCode: errorCode || null
-		}));
-		afterCall?.(false);
-		return result;
-	} finally {
-		emailOtpCustodyCapabilityFactorSecret32?.fill(0);
-	}
-}
-async function registerEmailOtpEd25519YaoWalletOnly(args) {
-	const { context, options } = args;
-	const initialEventAccountId = registrationEventAccountId(args.wallet.kind === "provided" ? String(args.wallet.walletId) : "wallet-registration");
-	const registrationTiming = new RegistrationTimingRecorder(performance.now());
-	let emailOtpCustodyCapabilityFactorSecret32 = null;
-	emitRegistrationEvent(options.onEvent, initialEventAccountId, {
-		authMethod: "email_otp",
-		phase: RegistrationEventPhase.STEP_01_STARTED,
-		status: "started"
-	});
-	try {
-		const finalizeIdempotencyKey = createRegistrationOperationIdempotencyKey("wallet-registration-finalize");
-		const prepared = await setupThreeRouteRegistration({
-			context,
-			authMethod: args.authMethod,
-			wallet: args.wallet,
-			signerSelection: args.signerSelection,
-			recorder: registrationTiming
-		});
-		observeRegistrationWarmup({
-			recorder: registrationTiming,
-			warmup: prepared.registrationWarmup
-		});
-		const { relayerUrl, setup } = prepared;
-		const walletId = setup.intent.walletId;
-		const eventAccountId = registrationEventAccountId(String(walletId));
-		const emailAuthority = await registrationTiming.measure("authProofMs", collectEmailOtpRegistrationAuthority.bind(void 0, {
-			authMethod: args.authMethod,
-			relayUrl: relayerUrl,
-			walletId: String(walletId),
-			registrationIntentDigestB64u: setup.registrationIntentDigestB64u
-		}));
-		const emailOtpEnrollmentSecret = crypto.getRandomValues(new Uint8Array(32));
-		emailOtpCustodyCapabilityFactorSecret32 = emailOtpEnrollmentSecret.slice();
-		const emailOtpWalletCustodyFactorSecret = emailOtpEnrollmentSecret.slice().buffer;
-		const enrollmentMaterial = startEmailOtpRegistrationEnrollmentMaterial({
-			recorder: registrationTiming,
-			context,
-			authMethod: args.authMethod,
-			relayerUrl,
-			walletId: String(walletId),
-			providerSubject: emailAuthority.providerSubject,
-			clientSecret32: emailOtpEnrollmentSecret
-		});
-		emitRegistrationEvent(options.onEvent, eventAccountId, {
-			authMethod: "email_otp",
-			phase: RegistrationEventPhase.STEP_05_ED25519_SIGNER_PREPARE_STARTED,
-			status: "running"
-		});
-		const responded = await registrationTiming.measure("walletRegisterStartMs", respondWalletRegistration.bind(void 0, {
-			relayerUrl,
-			registrationCeremonyId: setup.registrationCeremonyId,
-			signerPlanKind: "near_ed25519",
-			signedSetup: setup.signedSetup,
-			headers: registrationRouteHeaders(),
-			kind: "email_otp",
-			emailOtpRegistrationProof: emailAuthority.proof
-		}));
-		if (responded.kind !== "near_ed25519") throw new Error("Ed25519-only registration respond returned a different signer branch");
-		const materialForActivate = await requireEmailOtpRegistrationEnrollmentMaterial({
-			material: enrollmentMaterial,
-			operation: "activate"
-		});
-		let established;
-		try {
-			established = await context.signingEngine.establishWalletCustodyNearEd25519KeySet({
-				walletId: String(walletId),
-				factorJson: JSON.stringify({
-					envelopeId: `wallet-custody-envelope:${crypto.randomUUID()}`,
-					factor: buildEmailOtpEnvelopeFactor({
-						enrollmentId: materialForActivate.enrollmentId,
-						enrollmentSealKeyVersion: materialForActivate.enrollmentSealKeyVersion
-					}),
-					walletAuthMethodId: setup.intent.foundingWalletAuthMethodId
-				}),
-				factorSecret: emailOtpWalletCustodyFactorSecret,
-				nearEd25519SigningKeyId: responded.ed25519.admissionRequest.application_binding.near_ed25519_signing_key_id,
-				registrationCeremonyId: setup.registrationCeremonyId,
-				admissionRequest: responded.ed25519.admissionRequest,
-				admissionReceipt: await admitDeferredNearRegistration(responded.ed25519, {
-					routerOrigin: new URL(relayerUrl).origin,
-					authorization: {
-						kind: "bearer",
-						value: `Bearer ${String(setup.signedSetup)}`
-					},
-					fetch: globalThis.fetch
-				}),
-				participantIds: responded.ed25519.admissionRequest.participant_ids,
-				routerOrigin: new URL(relayerUrl).origin,
-				authorization: `Bearer ${String(setup.signedSetup)}`
-			});
-		} finally {
-			zeroizeArrayBuffer(emailOtpWalletCustodyFactorSecret);
-		}
-		await confirmWalletRecoveryCodesBackedUp(context, String(walletId), options.recoveryCodeBackup, established.recoveryCodes);
-		const walletCustodyCommit = walletCustodyCommitPayloadWithRecoveryBackupAcknowledgement(established.commitPayload);
-		if (!established.localMaterial) throw new Error("Email OTP registration produced no sealed local custody material");
-		await persistPendingRegistrationCommit({
-			operation: "registration_activate",
-			signerPlanKind: "near_ed25519",
-			registrationCeremonyId: setup.registrationCeremonyId,
-			idempotencyKey: finalizeIdempotencyKey,
-			walletId: String(walletId),
-			walletAuthMethodId: String(setup.intent.foundingWalletAuthMethodId),
-			signedSetup: String(setup.signedSetup),
-			auth: {
-				kind: "email_otp",
-				email: emailAuthority.email,
-				registrationAuthorityId: emailAuthority.registrationAuthorityId,
-				providerSubject: emailAuthority.providerSubject,
-				enrollment: materialForActivate.emailOtpEnrollment
-			},
-			localMaterial: {
-				keyFamilies: ["ed25519"],
-				custodyCommit: walletCustodyCommit,
-				ed25519: {
-					activationReference: established.activationReference,
-					localMaterial: established.localMaterial,
-					metadata: pendingRegistrationEd25519MetadataFromJoined(established)
-				}
-			}
-		});
-		const activated = await activateWalletRegistration({
-			relayerUrl,
-			registrationCeremonyId: setup.registrationCeremonyId,
-			signerPlanKind: "near_ed25519",
-			signedSetup: setup.signedSetup,
-			headers: registrationRouteHeaders(),
-			idempotencyKey: finalizeIdempotencyKey,
-			emailOtpEnrollment: materialForActivate.emailOtpEnrollment
-		});
-		if (activated.kind !== "near_ed25519" || activated.nearProvisioning?.status !== "near_pending") throw new Error("Ed25519-only activate did not return a wallet pending NEAR provisioning");
-		const nearProvisioningIdempotencyKey = await deriveNearProvisioningIdempotencyKey({
-			registrationCeremonyId: setup.registrationCeremonyId,
-			activationReference: established.activationReference
-		});
-		const nearProvisioningPending = await persistPendingRegistrationCommit({
-			operation: "near_provisioning",
-			completion: { kind: "sealed_material" },
-			signerPlanKind: "near_ed25519",
-			registrationCeremonyId: setup.registrationCeremonyId,
-			idempotencyKey: nearProvisioningIdempotencyKey,
-			walletId: String(walletId),
-			walletAuthMethodId: String(setup.intent.foundingWalletAuthMethodId),
-			signedSetup: String(setup.signedSetup),
-			auth: {
-				kind: "email_otp",
-				email: emailAuthority.email,
-				registrationAuthorityId: emailAuthority.registrationAuthorityId,
-				providerSubject: emailAuthority.providerSubject,
-				enrollment: materialForActivate.emailOtpEnrollment
-			},
-			localMaterial: {
-				keyFamilies: ["ed25519"],
-				custodyCommit: walletCustodyCommit,
-				ed25519: {
-					activationReference: established.activationReference,
-					localMaterial: established.localMaterial,
-					metadata: pendingRegistrationEd25519MetadataFromJoined(established)
-				}
-			}
-		});
-		await IndexedDBManager.deletePendingWalletRegistrationCommit({
-			registrationCeremonyId: setup.registrationCeremonyId,
-			operation: "registration_activate"
-		});
-		const clientPublicKey = `ed25519:${base58Encode(established.metadata.registeredPublicKey)}`;
-		const finalized = await registrationTiming.measure("walletRegisterFinalizeMs", completeWalletRegistrationNearProvisioning.bind(void 0, {
-			relayerUrl,
-			registrationCeremonyId: setup.registrationCeremonyId,
-			signedSetup: setup.signedSetup,
-			headers: registrationRouteHeaders(),
-			idempotencyKey: nearProvisioningIdempotencyKey,
-			ed25519: { activationReference: established.activationReference },
-			auth: {
-				kind: "email_otp",
-				enrollment: materialForActivate.emailOtpEnrollment
-			},
-			walletCustodyCommit
-		}));
-		if (!finalized.ok) throw new Error("Deferred NEAR provisioning did not complete");
-		registrationTiming.captureRouteDiagnostics(finalized.registrationDiagnostics);
-		if (finalized.kind !== "near_ed25519") throw new Error("Wallet registration finalize returned a different signer branch");
-		if (!isEmailOtpWalletRegistrationFinalizeResponse(finalized)) throw new Error("Email OTP registration finalize returned a different auth method");
-		if (finalized.walletCustody?.status !== "committed") {
-			const status = finalized.walletCustody?.status ?? "not_reported";
-			throw new Error(`Wallet custody did not commit (${status})`);
-		}
-		if (finalized.ed25519.signerSlot !== args.ed25519Selection.signerSlot) throw new Error("Ed25519 Yao finalize returned a different signer slot");
-		const registrationSession = requireIssuedRegistrationEstablishedSession(finalized.registrationEstablishedSession);
-		requireEmailOtpEd25519YaoRegistrationPublicResultMatches({
-			clientPublicKey,
-			finalized,
-			expectedRegistrationAuthorityId: emailAuthority.registrationAuthorityId,
-			expectedWalletId: walletId
-		});
-		const persistenceAuth = await buildRegistrationPersistenceAuth({
-			authMethod: args.authMethod,
-			configs: context.configs,
-			walletId: toWalletId(finalized.walletId),
-			finalized,
-			passkeyAuthority: null,
-			email: emailAuthority.email,
-			providerSubject: emailAuthority.providerSubject,
-			registrationAuthorityId: emailAuthority.registrationAuthorityId
-		});
-		if (persistenceAuth.kind !== "email_otp") throw new Error("Email OTP Ed25519 registration produced a different persistence authority");
-		emitRegistrationEvent(options.onEvent, eventAccountId, {
-			authMethod: "email_otp",
-			phase: RegistrationEventPhase.STEP_05_ED25519_SIGNER_PREPARE_SUCCEEDED,
-			status: "succeeded"
-		});
-		emitRegistrationEvent(options.onEvent, eventAccountId, {
-			authMethod: "email_otp",
-			phase: RegistrationEventPhase.STEP_08_STORAGE_PERSIST_STARTED,
-			status: "running"
-		});
-		const materialFacts = registrationEd25519MaterialFacts({
-			deferredNear: responded.ed25519,
-			finalized: finalized.ed25519,
-			walletId,
-			expectedRuntimePolicyScope: normalizeRuntimePolicyScope(setup.intent.runtimePolicyScope)
-		});
-		const metadata = established.metadata;
-		const nearAccountId = toAccountId(finalized.ed25519.nearAccountId);
-		const custodyMaterial = walletCustodyRegistrationMaterial({
-			established,
-			walletId: String(finalized.walletId),
-			nearAccountId: String(nearAccountId),
-			nearEd25519SigningKeyId: finalized.ed25519.nearEd25519SigningKeyId,
-			signerSlot: finalized.ed25519.signerSlot
-		});
-		const registration = await prepareWalletEmailOtpEd25519RegistrationPublication({
-			walletId: finalized.walletId,
-			nearAccountId,
-			nearEd25519SigningKeyId: finalized.ed25519.nearEd25519SigningKeyId,
-			email: persistenceAuth.email,
-			registrationAuthorityId: persistenceAuth.registrationAuthorityId,
-			authority: persistenceAuth.authority,
-			signerSlot: finalized.ed25519.signerSlot,
-			operationalPublicKey: clientPublicKey,
-			relayerKeyId: finalized.ed25519.relayerKeyId,
-			keyVersion: finalized.ed25519.keyVersion,
-			participantIds: [...finalized.ed25519.participantIds],
-			custodyMaterial
-		});
-		const storedNearActivation = (await IndexedDBManager.publishPendingWalletRegistrationCommit({
-			pending: nearProvisioningPending,
-			ecdsaContinuity: [],
-			authority: finalized.authority,
-			foundingAuthority: {
-				authority: finalized.foundingAuthority,
-				authMethod: finalized.foundingAuthMethod
-			},
-			request: {
-				operation: "near_provisioning",
-				registrationCeremonyId: setup.registrationCeremonyId,
-				idempotencyKey: nearProvisioningIdempotencyKey,
-				walletId: finalized.walletId,
-				walletAuthMethodId: finalized.foundingAuthMethod.walletAuthMethodId
-			},
-			walletSessionPublication: {
-				kind: "issued",
-				walletSession: registrationSession.walletSession,
-				operationCredential: registrationSession.operationCredential
-			},
-			registration
-		})).signerActivations[1];
-		if (!storedNearActivation || storedNearActivation.signerSlot !== finalized.ed25519.signerSlot) throw new Error("Ed25519 Yao registration persisted a different signer slot");
-		await context.signingEngine.activateAuthenticatedWalletState({
-			walletId: finalized.walletId,
-			nearAccountId,
-			signerSlot: finalized.ed25519.signerSlot,
-			nearClient: context.nearClient
-		});
-		await context.signingEngine.upsertEd25519YaoPublicCapabilityLaneReference({
-			walletId: finalized.walletId,
-			nearAccountId,
-			thresholdSessionId: materialFacts.identity.thresholdSessionId,
-			runtimePolicyScope: materialFacts.stableServerScope.runtimePolicyScope,
-			materialActivation: nearEd25519YaoMaterialActivationFromMetadata(metadata),
-			auth: {
-				kind: "email_otp",
-				providerSubjectId: emailAuthority.providerSubject
-			},
-			nearEd25519SigningKeyId: parseNearEd25519SigningKeyId(finalized.ed25519.nearEd25519SigningKeyId),
-			signerSlot: finalized.ed25519.signerSlot,
-			remainingUses: registrationSession.remainingUses,
-			expiresAtMs: registrationSession.expiresAtMs
-		});
-		if (!emailOtpCustodyCapabilityFactorSecret32) throw new Error("Email OTP registration has no custody capability material");
-		await establishEmailOtpRegistrationEd25519ExportRootCapability({
-			context,
-			commit: walletCustodyCommit,
-			factorSecret32: emailOtpCustodyCapabilityFactorSecret32,
-			emailOtpAuthContext: persistenceAuth.emailOtpAuthContext,
-			walletId: String(finalized.walletId),
-			walletSessionId: String(registrationSession.walletSessionId),
-			expiresAtMs: registrationSession.expiresAtMs
-		});
-		emitRegistrationEvent(options.onEvent, eventAccountId, {
-			authMethod: "email_otp",
-			phase: RegistrationEventPhase.STEP_08_STORAGE_PERSIST_SUCCEEDED,
-			status: "succeeded"
-		});
-		emitRegistrationEvent(options.onEvent, eventAccountId, {
-			authMethod: "email_otp",
-			phase: RegistrationEventPhase.STEP_11_COMPLETED,
-			status: "succeeded"
-		});
-		const result = {
-			success: true,
-			kind: "wallet_registered",
-			walletId: finalized.walletId,
-			capabilities: [{
-				kind: "near_ed25519",
-				accountProvisioning: finalized.accountProvisioning,
-				resolvedAccount: finalized.resolvedAccount,
-				nearEd25519SigningKeyId: parseNearEd25519SigningKeyId(finalized.ed25519.nearEd25519SigningKeyId),
-				operationalPublicKey: clientPublicKey,
-				nearAccountId: toAccountId(finalized.ed25519.nearAccountId),
-				transactionId: finalized.resolvedAccount.kind === "sponsored_named_account" ? finalized.resolvedAccount.transactionHash : null
-			}]
-		};
-		emitRegistrationTimingSummary(createSucceededRegistrationTimingSummary({
-			recorder: registrationTiming,
-			authMethod: "email_otp",
-			signerSet: registrationTimingSignerSetFromPlan(args.signerPlan)
-		}));
-		commitSuccessfulWalletAuthentication(context, result, "email_otp");
-		options.afterCall?.(true, result);
-		return result;
-	} catch (error) {
-		const errorCode = registrationErrorCodeFromUnknown(error);
-		const message = getUserFriendlyErrorMessage(error, "registration", initialEventAccountId);
-		options.onError?.(registrationErrorWithCode(message, errorCode));
-		emitRegistrationEvent(options.onEvent, initialEventAccountId, {
-			authMethod: "email_otp",
-			phase: RegistrationEventPhase.FAILED,
-			status: "failed",
-			message,
-			error: {
-				...errorCode ? { code: errorCode } : {},
-				message
-			}
-		});
-		const result = {
-			success: false,
-			error: message,
-			...errorCode ? { errorCode } : {}
-		};
-		emitRegistrationTimingSummary(createFailedRegistrationTimingSummary({
-			recorder: registrationTiming,
-			authMethod: "email_otp",
-			signerSet: registrationTimingSignerSetFromPlan(args.signerPlan),
-			errorCode: errorCode || null
-		}));
-		options.afterCall?.(false);
-		return result;
-	} finally {
-		emailOtpCustodyCapabilityFactorSecret32?.fill(0);
-	}
-}
-async function registerPasskeyEd25519YaoWalletOnly(args) {
-	const { context, options } = args;
-	const initialEventAccountId = registrationEventAccountId(args.wallet.kind === "provided" ? String(args.wallet.walletId) : "wallet-registration");
-	const traceContext = createRouterAbTraceContextV1();
-	let postTouchIdCompletedAt = null;
-	emitRegistrationEvent(options.onEvent, initialEventAccountId, {
-		authMethod: "passkey",
-		phase: RegistrationEventPhase.STEP_01_STARTED,
-		status: "started"
-	});
-	try {
-		const finalizeIdempotencyKey = createRegistrationOperationIdempotencyKey("wallet-registration-finalize");
-		const registrationTiming = new RegistrationTimingRecorder(performance.now());
-		const { relayerUrl, setup } = await setupRegistrationForPasskeyExecution({
-			context,
-			authMethod: args.authMethod,
-			wallet: args.wallet,
-			signerSelection: args.signerSelection,
-			recorder: registrationTiming,
-			passkeyExecution: args.passkeyExecution
-		});
-		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.setup");
-		const intent = requirePasskeyRegistrationIntent(setup.intent);
-		const eventAccountId = registrationEventAccountId(String(intent.walletId));
-		emitRegistrationEvent(options.onEvent, eventAccountId, {
-			authMethod: "passkey",
-			phase: RegistrationEventPhase.STEP_04_PASSKEY_CREATE_STARTED,
-			status: "waiting_for_user",
-			interaction: {
-				kind: "passkey_create",
-				overlay: "show"
-			}
-		});
-		const passkeyAuthority = await resolvePasskeyRegistrationAuthority({
-			context,
-			walletId: intent.walletId,
-			signerSlot: args.ed25519Selection.signerSlot,
-			registrationIntentDigestB64u: setup.registrationIntentDigestB64u,
-			options,
-			confirmationConfigOverride: {
-				uiMode: "modal",
-				behavior: "requireClick",
-				...args.confirmationConfigOverride ?? options.confirmationConfig ?? {}
-			},
-			passkeyExecution: args.passkeyExecution
-		});
-		postTouchIdCompletedAt = performance.now();
-		registrationTiming.capturePasskeyAuthDiagnostics(passkeyAuthority.diagnostics);
-		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.authentication");
-		emitRegistrationEvent(options.onEvent, eventAccountId, {
-			authMethod: "passkey",
-			phase: RegistrationEventPhase.STEP_04_PASSKEY_CREATE_SUCCEEDED,
-			status: "succeeded",
-			interaction: {
-				kind: "passkey_create",
-				overlay: "hide"
-			}
-		});
-		const responded = await respondWalletRegistration({
-			relayerUrl,
-			registrationCeremonyId: setup.registrationCeremonyId,
-			signerPlanKind: "near_ed25519",
-			signedSetup: setup.signedSetup,
-			headers: registrationRouteHeaders(traceContext),
-			kind: "passkey",
-			webauthnRegistration: passkeyAuthority.webauthnRegistration
-		});
-		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.respond");
-		if (responded.kind !== "near_ed25519") throw new Error("Ed25519-only registration respond returned a different signer branch");
-		const parsedCredentialId = parseWebAuthnCredentialIdB64u(String(passkeyAuthority.credential.rawId || passkeyAuthority.credential.id || "").trim());
-		if (!parsedCredentialId.ok) throw new Error(`passkey credential id ${parsedCredentialId.error.message}`);
-		const walletCustodyFactorSecret = base64UrlDecode(passkeyAuthority.prfFirstB64u).buffer;
-		let established;
-		try {
-			established = await context.signingEngine.establishWalletCustodyNearEd25519KeySet({
-				walletId: String(intent.walletId),
-				factorJson: JSON.stringify({
-					envelopeId: `wallet-custody-envelope:${crypto.randomUUID()}`,
-					factor: buildPasskeyEnvelopeFactor({
-						rpId: requireWebAuthnRpId(args.authMethod.rpId),
-						credentialIdB64u: parsedCredentialId.value
-					}),
-					walletAuthMethodId: setup.intent.foundingWalletAuthMethodId
-				}),
-				factorSecret: walletCustodyFactorSecret,
-				nearEd25519SigningKeyId: responded.ed25519.admissionRequest.application_binding.near_ed25519_signing_key_id,
-				registrationCeremonyId: setup.registrationCeremonyId,
-				admissionRequest: responded.ed25519.admissionRequest,
-				admissionReceipt: await admitDeferredNearRegistration(responded.ed25519, {
-					routerOrigin: new URL(relayerUrl).origin,
-					authorization: {
-						kind: "bearer",
-						value: `Bearer ${String(setup.signedSetup)}`
-					},
-					fetch: globalThis.fetch
-				}),
-				participantIds: responded.ed25519.admissionRequest.participant_ids,
-				routerOrigin: new URL(relayerUrl).origin,
-				authorization: `Bearer ${String(setup.signedSetup)}`,
-				traceContext
-			});
-		} finally {
-			zeroizeArrayBuffer(walletCustodyFactorSecret);
-		}
-		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.custody");
-		await confirmWalletRecoveryCodesBackedUp(context, String(intent.walletId), options.recoveryCodeBackup, established.recoveryCodes);
-		const walletCustodyCommit = walletCustodyCommitPayloadWithRecoveryBackupAcknowledgement(established.commitPayload);
-		if (!established.localMaterial) throw new Error("Passkey registration produced no sealed local custody material");
-		await persistPendingRegistrationCommit({
-			operation: "registration_activate",
-			signerPlanKind: "near_ed25519",
-			registrationCeremonyId: setup.registrationCeremonyId,
-			idempotencyKey: finalizeIdempotencyKey,
-			walletId: String(intent.walletId),
-			walletAuthMethodId: String(setup.intent.foundingWalletAuthMethodId),
-			signedSetup: String(setup.signedSetup),
-			auth: {
-				kind: "passkey",
-				rpId: args.authMethod.rpId,
-				credentialIdB64u: parsedCredentialId.value,
-				transports: [...passkeyAuthority.webauthnRegistration.response.transports]
-			},
-			localMaterial: {
-				keyFamilies: ["ed25519"],
-				custodyCommit: walletCustodyCommit,
-				ed25519: {
-					activationReference: established.activationReference,
-					localMaterial: established.localMaterial,
-					metadata: pendingRegistrationEd25519MetadataFromJoined(established)
-				}
-			}
-		});
-		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.backup_and_checkpoint");
-		const activated = await activateWalletRegistration({
-			relayerUrl,
-			registrationCeremonyId: setup.registrationCeremonyId,
-			signerPlanKind: "near_ed25519",
-			signedSetup: setup.signedSetup,
-			headers: registrationRouteHeaders(traceContext),
-			idempotencyKey: finalizeIdempotencyKey
-		});
-		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.activate");
-		if (activated.kind !== "near_ed25519" || activated.nearProvisioning?.status !== "near_pending") throw new Error("Ed25519-only activate did not return a wallet pending NEAR provisioning");
-		const nearProvisioningIdempotencyKey = await deriveNearProvisioningIdempotencyKey({
-			registrationCeremonyId: setup.registrationCeremonyId,
-			activationReference: established.activationReference
-		});
-		const nearProvisioningPending = await persistPendingRegistrationCommit({
-			operation: "near_provisioning",
-			completion: { kind: "sealed_material" },
-			signerPlanKind: "near_ed25519",
-			registrationCeremonyId: setup.registrationCeremonyId,
-			idempotencyKey: nearProvisioningIdempotencyKey,
-			walletId: String(intent.walletId),
-			walletAuthMethodId: String(setup.intent.foundingWalletAuthMethodId),
-			signedSetup: String(setup.signedSetup),
-			auth: {
-				kind: "passkey",
-				rpId: args.authMethod.rpId,
-				credentialIdB64u: parsedCredentialId.value,
-				transports: [...passkeyAuthority.webauthnRegistration.response.transports]
-			},
-			localMaterial: {
-				keyFamilies: ["ed25519"],
-				custodyCommit: walletCustodyCommit,
-				ed25519: {
-					activationReference: established.activationReference,
-					localMaterial: established.localMaterial,
-					metadata: pendingRegistrationEd25519MetadataFromJoined(established)
-				}
-			}
-		});
-		await IndexedDBManager.deletePendingWalletRegistrationCommit({
-			registrationCeremonyId: setup.registrationCeremonyId,
-			operation: "registration_activate"
-		});
-		const clientPublicKey = `ed25519:${base58Encode(established.metadata.registeredPublicKey)}`;
-		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.provision_checkpoint");
-		const finalized = await completeWalletRegistrationNearProvisioning({
-			relayerUrl,
-			registrationCeremonyId: setup.registrationCeremonyId,
-			signedSetup: setup.signedSetup,
-			headers: registrationRouteHeaders(traceContext),
-			idempotencyKey: nearProvisioningIdempotencyKey,
-			ed25519: { activationReference: established.activationReference },
-			auth: { kind: "passkey" },
-			walletCustodyCommit
-		});
-		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.finalize");
-		if (!finalized.ok || finalized.kind !== "near_ed25519") throw new Error("Deferred NEAR provisioning returned a different signer branch");
-		if (established.commitPayload && finalized.walletCustody?.status !== "committed") {
-			const status = finalized.walletCustody?.status ?? "not_reported";
-			const reason = finalized.walletCustody?.status === "rejected" ? `: ${finalized.walletCustody.reason}` : "";
-			throw new Error(`Wallet custody did not commit (${status})${reason}. The recovery codes shown are not usable.`);
-		}
-		const registrationSession = requireIssuedRegistrationEstablishedSession(finalized.registrationEstablishedSession);
-		const finalizedPasskey = requireEd25519YaoRegistrationPublicResultMatches({
-			clientPublicKey,
-			finalized,
-			expectedRpId: args.authMethod.rpId,
-			expectedWalletId: intent.walletId
-		});
-		const nearAccountId = toAccountId(finalized.ed25519.nearAccountId);
-		const credentialPublicKeyB64u = requireFinalizedPasskeyCredentialPublicKeyB64u({
-			finalized,
-			credential: passkeyAuthority.credential
-		});
-		const materialFacts = registrationEd25519MaterialFacts({
-			deferredNear: responded.ed25519,
-			finalized: finalized.ed25519,
-			walletId: intent.walletId,
-			expectedRuntimePolicyScope: normalizeRuntimePolicyScope(intent.runtimePolicyScope)
-		});
-		const metadata = established.metadata;
-		const custodyMaterial = walletCustodyRegistrationMaterial({
-			established,
-			walletId: String(finalized.walletId),
-			nearAccountId: String(nearAccountId),
-			nearEd25519SigningKeyId: finalized.ed25519.nearEd25519SigningKeyId,
-			signerSlot: finalized.ed25519.signerSlot
-		});
-		await rememberPasskeyRegistrationCustodyEnvelope({
-			commit: established.commitPayload,
-			walletId: String(finalized.walletId),
-			activatedAtMs: Date.now()
-		});
-		await context.signingEngine.upsertEd25519YaoPublicCapabilityLaneReference({
-			walletId: finalized.walletId,
-			nearAccountId: toAccountId(finalized.ed25519.nearAccountId),
-			thresholdSessionId: materialFacts.identity.thresholdSessionId,
-			runtimePolicyScope: materialFacts.stableServerScope.runtimePolicyScope,
-			materialActivation: nearEd25519YaoMaterialActivationFromMetadata(metadata),
-			auth: {
-				kind: "passkey",
-				rpId: toRpId(finalizedPasskey.rpId),
-				credentialIdB64u: finalizedPasskey.credentialIdB64u
-			},
-			nearEd25519SigningKeyId: parseNearEd25519SigningKeyId(finalized.ed25519.nearEd25519SigningKeyId),
-			signerSlot: finalized.ed25519.signerSlot
-		});
-		const registration = prepareWalletEd25519RegistrationPublication({
-			walletId: finalized.walletId,
-			nearAccountId,
-			nearEd25519SigningKeyId: finalized.ed25519.nearEd25519SigningKeyId,
-			rpId: requireWebAuthnRpId(finalizedPasskey.rpId),
-			credential: passkeyAuthority.credential,
-			credentialPublicKeyB64u,
-			signerSlot: finalized.ed25519.signerSlot,
-			operationalPublicKey: clientPublicKey,
-			relayerKeyId: finalized.ed25519.relayerKeyId,
-			keyVersion: finalized.ed25519.keyVersion,
-			participantIds: [...finalized.ed25519.participantIds],
-			custodyMaterial
-		});
-		const storedNearActivation = (await IndexedDBManager.publishPendingWalletRegistrationCommit({
-			pending: nearProvisioningPending,
-			ecdsaContinuity: [],
-			authority: finalized.authority,
-			foundingAuthority: {
-				authority: finalized.foundingAuthority,
-				authMethod: finalized.foundingAuthMethod
-			},
-			request: {
-				operation: "near_provisioning",
-				registrationCeremonyId: setup.registrationCeremonyId,
-				idempotencyKey: nearProvisioningIdempotencyKey,
-				walletId: finalized.walletId,
-				walletAuthMethodId: finalized.foundingAuthMethod.walletAuthMethodId
-			},
-			walletSessionPublication: {
-				kind: "issued",
-				walletSession: registrationSession.walletSession,
-				operationCredential: registrationSession.operationCredential
-			},
-			registration
-		})).signerActivations[1];
-		if (!storedNearActivation || storedNearActivation.signerSlot !== finalized.ed25519.signerSlot) throw new Error("Ed25519 Yao registration persisted a different signer slot");
-		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.publication");
-		const hydration = await hydrateDeferredNearRegistrationSession({
-			signingEngine: context.signingEngine,
-			ceremonyId: setup.registrationCeremonyId,
-			input: buildRegistrationPasskeyEd25519SessionHydration({
-				session: registrationSession,
-				ceremonyId: setup.registrationCeremonyId,
-				walletId: String(finalized.walletId),
-				relayerUrl,
-				prfFirstB64u: passkeyAuthority.prfFirstB64u,
-				preparedServerSeal: null,
-				restore: {
-					rpId: finalizedPasskey.rpId,
-					nearAccountId: String(nearAccountId),
-					nearEd25519SigningKeyId: finalized.ed25519.nearEd25519SigningKeyId,
-					relayerKeyId: finalized.ed25519.relayerKeyId,
-					participantIds: finalized.ed25519.participantIds,
-					signerSlot: finalized.ed25519.signerSlot,
-					credentialIdB64u: finalizedPasskey.credentialIdB64u,
-					materialActivation: nearEd25519YaoMaterialActivationFromMetadata(metadata)
-				}
-			})
-		});
-		if (hydration.kind === "failed") throw hydration.error;
-		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.session_hydration");
-		await activatePasskeyRegistrationEd25519Material({
-			signingEngine: context.signingEngine,
-			sessionAuthority: {
-				record: registrationSession.walletSession,
-				operationCredential: registrationSession.operationCredential
-			},
-			metadata,
-			material: custodyMaterial,
-			materialFacts,
-			envelope: walletCustodyCacheEnvelopeFromRegistrationCommit(established.commitPayload),
-			ownedFactorSecret: base64UrlDecode(passkeyAuthority.prfFirstB64u),
-			rpId: finalizedPasskey.rpId,
-			credentialIdB64u: finalizedPasskey.credentialIdB64u,
-			passkeyPrfFirstB64u: passkeyAuthority.prfFirstB64u,
-			relayerUrl
-		});
-		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.material_activation");
-		await establishPasskeyRegistrationEd25519ExportRootCapability({
-			signingEngine: context.signingEngine,
-			commit: established.commitPayload,
-			passkeyPrfFirstB64u: passkeyAuthority.prfFirstB64u,
-			walletId: String(finalized.walletId),
-			walletAuthMethodId: String(finalized.foundingAuthMethod.walletAuthMethodId),
-			walletSessionId: String(registrationSession.walletSessionId),
-			expiresAtMs: registrationSession.expiresAtMs
-		});
-		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.export_capability");
-		await context.signingEngine.activateAuthenticatedWalletState({
-			walletId: finalized.walletId,
-			nearAccountId,
-			signerSlot: finalized.ed25519.signerSlot,
-			nearClient: context.nearClient
-		});
-		emitRegistrationEvent(options.onEvent, eventAccountId, {
-			authMethod: "passkey",
-			phase: RegistrationEventPhase.STEP_11_COMPLETED,
-			status: "succeeded"
-		});
-		if (postTouchIdCompletedAt !== null) {
-			const walletReadyAt = performance.now();
-			emitRegistrationTimingSpan({
-				callback: options.onTimingSpan,
-				span: "registration.post_touch_id",
-				outcome: "success",
-				durationMs: walletReadyAt - postTouchIdCompletedAt,
-				traceContext
-			});
-			emitRegistrationTimingSpan({
-				callback: options.onTimingSpan,
-				span: "frontend.wallet_ready",
-				outcome: "success",
-				durationMs: 0,
-				traceContext
-			});
-		}
-		registrationTiming.markNearStage(setup.registrationCeremonyId, "near_only.wallet_ready");
-		emitRegistrationTimingSummary(createSucceededRegistrationTimingSummary({
-			recorder: registrationTiming,
-			authMethod: "passkey",
-			signerSet: registrationTimingSignerSetFromPlan(args.signerPlan)
-		}));
-		const result = {
-			success: true,
-			kind: "wallet_registered",
-			walletId: finalized.walletId,
-			capabilities: [{
-				kind: "near_ed25519",
-				accountProvisioning: finalized.accountProvisioning,
-				resolvedAccount: finalized.resolvedAccount,
-				nearEd25519SigningKeyId: parseNearEd25519SigningKeyId(finalized.ed25519.nearEd25519SigningKeyId),
-				operationalPublicKey: clientPublicKey,
-				nearAccountId: toAccountId(finalized.ed25519.nearAccountId),
-				transactionId: finalized.resolvedAccount.kind === "sponsored_named_account" ? finalized.resolvedAccount.transactionHash : null
-			}]
-		};
-		commitSuccessfulWalletAuthentication(context, result, "passkey");
-		options.afterCall?.(true, result);
-		return result;
-	} catch (error) {
-		const errorCode = registrationErrorCodeFromUnknown(error);
-		const message = getUserFriendlyErrorMessage(error, "registration", initialEventAccountId);
-		if (postTouchIdCompletedAt !== null) emitRegistrationTimingSpan({
-			callback: options.onTimingSpan,
-			span: "registration.post_touch_id",
-			outcome: "failure",
-			durationMs: performance.now() - postTouchIdCompletedAt,
-			traceContext
-		});
-		options.onError?.(registrationErrorWithCode(message, errorCode));
-		emitRegistrationEvent(options.onEvent, initialEventAccountId, {
-			authMethod: "passkey",
-			phase: RegistrationEventPhase.FAILED,
-			status: "failed",
-			message,
-			interaction: {
-				kind: "passkey_create",
-				overlay: "hide"
-			},
-			error: {
-				...errorCode ? { code: errorCode } : {},
-				message
-			}
-		});
-		const result = {
-			success: false,
-			error: message,
-			...errorCode ? { errorCode } : {}
-		};
-		options.afterCall?.(false);
-		return result;
-	}
-}
-async function registerWalletInternal(args) {
-	const signerPlan = registrationSignerPlanFromSignerSet(args.signerSelection);
-	const ed25519Branch = findRegistrationSignerPlanNearEd25519Branch(signerPlan);
-	if (ed25519Branch) {
-		const ecdsaBranch = findRegistrationSignerPlanEvmFamilyEcdsaBranch(signerPlan);
-		if (ecdsaBranch) return await registerEcdsaOrMixedWallet({
-			kind: "near_ed25519_and_evm_family_ecdsa",
-			context: args.context,
-			authMethod: args.authMethod,
-			wallet: args.wallet,
-			signerSelection: args.signerSelection,
-			signerPlan,
-			ed25519Selection: ed25519Branch,
-			ecdsaSelection: ecdsaBranch,
-			options: args.options,
-			passkeyExecution: args.passkeyExecution,
-			...args.confirmationConfigOverride ? { confirmationConfigOverride: args.confirmationConfigOverride } : {}
-		});
-		if (args.authMethod.kind === "email_otp") {
-			if (args.passkeyExecution.kind !== "collect_during_registration") throw new Error("Prepared registration authority requires passkey authentication");
-			return await registerEmailOtpEd25519YaoWalletOnly({
-				context: args.context,
-				authMethod: args.authMethod,
-				wallet: args.wallet,
-				signerSelection: args.signerSelection,
-				signerPlan,
-				ed25519Selection: ed25519Branch,
-				options: args.options,
-				passkeyExecution: args.passkeyExecution
-			});
-		}
-		return await registerPasskeyEd25519YaoWalletOnly({
-			context: args.context,
-			authMethod: args.authMethod,
-			wallet: args.wallet,
-			signerSelection: args.signerSelection,
-			signerPlan,
-			ed25519Selection: ed25519Branch,
-			options: args.options,
-			passkeyExecution: args.passkeyExecution,
-			...args.confirmationConfigOverride ? { confirmationConfigOverride: args.confirmationConfigOverride } : {}
-		});
-	}
-	const ecdsaBranch = findRegistrationSignerPlanEvmFamilyEcdsaBranch(signerPlan);
-	if (!ecdsaBranch) throw new Error("Wallet registration requires an ECDSA signer branch");
-	return await registerEcdsaOrMixedWallet({
-		kind: "evm_family_ecdsa",
-		context: args.context,
-		authMethod: args.authMethod,
-		wallet: args.wallet,
-		signerSelection: args.signerSelection,
-		signerPlan,
-		ecdsaSelection: ecdsaBranch,
-		options: args.options,
-		passkeyExecution: args.passkeyExecution,
-		...args.confirmationConfigOverride ? { confirmationConfigOverride: args.confirmationConfigOverride } : {}
-	});
-}
-function commitSuccessfulWalletAuthentication(context, result, authMethod) {
-	context.signingEngine.setWalletAuthenticated({
-		kind: "authenticated",
-		walletId: result.walletId,
-		authMethod
-	});
-}
-async function registerWallet(args) {
-	try {
-		return await registerWalletInternal({
-			context: args.context,
-			authMethod: args.authMethod,
-			wallet: args.wallet,
-			signerSelection: args.signerSelection,
-			options: args.options,
-			authenticatorOptions: args.authenticatorOptions,
-			...args.confirmationConfigOverride ? { confirmationConfigOverride: args.confirmationConfigOverride } : {},
-			passkeyExecution: { kind: "collect_during_registration" }
-		});
-	} finally {
-		args.context.signingEngine.closeRegistrationPreparationModal();
-	}
-}
-function emitAddSignerEventSafely(onEvent, accountId, event) {
-	try {
-		emitRegistrationEvent(onEvent, accountId, event);
-	} catch {}
-}
-function notifyAddSignerErrorSafely(onError, error) {
-	try {
-		onError?.(error);
-	} catch {}
-}
-function notifyAddSignerAfterCallSafely(afterCall, success, result) {
-	try {
-		if (success && result) afterCall?.(true, result);
-		else afterCall?.(false);
-	} catch {}
-}
-function addSignerAllowCredentials(authenticators) {
-	const credentials = [];
-	for (const authenticator of authenticators) {
-		const credentialId = String(authenticator.credentialId || "").trim();
-		if (!credentialId) continue;
-		credentials.push({
-			id: credentialId,
-			type: "public-key",
-			transports: webAuthnTransportsFromRaw(authenticator.transports)
-		});
-	}
-	if (credentials.length === 0) throw new Error("Wallet add-signer requires an existing passkey credential");
-	return credentials;
-}
-function requireSelectedAddSignerCredentialId(credential, allowCredentials) {
-	const id = String(credential.id || "").trim();
-	const rawId = String(credential.rawId || "").trim();
-	if (!id || !rawId || id !== rawId) throw new Error("Wallet add-signer selected an invalid passkey credential identity");
-	for (const allowed of allowCredentials) if (allowed.id === rawId) return rawId;
-	throw new Error("Wallet add-signer selected a passkey outside the authorized wallet");
-}
-async function requireMatchingStartedAddSignerIntent(args) {
-	if (args.started.intent.walletId !== args.walletId) throw new Error("Wallet add-signer start returned a different wallet");
-	if (await computeAddSignerIntentDigest(args.started.intent) !== args.expectedDigestB64u) throw new Error("Wallet add-signer start returned a different intent");
-	if (!String(args.started.addSignerCeremonyId || "").trim()) throw new Error("Wallet add-signer start returned an invalid ceremony ID");
-}
-function sameParticipantIds(left, right) {
-	return left.length === 2 && right.length === 2 && left[0] === right[0] && left[1] === right[1];
-}
-function requireVerifiedEd25519AddSignerFinalize(args) {
-	const selection = args.started.intent.signerSelection;
-	if (selection.mode !== "ed25519") throw new Error("Wallet add-signer start intent changed signer branch");
-	const requested = selection.ed25519;
-	const admission = args.started.ed25519.admissionRequest;
-	const finalized = args.finalized;
-	const signer = finalized.ed25519;
-	const expectedNearAccountId = deriveImplicitNearAccountIdFromEd25519PublicKey(args.clientPublicKey);
-	if (finalized.walletId !== args.walletId || finalized.rpId !== args.rpId || finalized.credentialIdB64u !== args.credentialIdB64u || signer.publicKey !== args.clientPublicKey || signer.nearAccountId !== expectedNearAccountId || signer.signerSlot !== requested.signerSlot || signer.keyVersion !== requested.keyVersion || signer.recoveryExportCapable !== true || !sameParticipantIds(signer.participantIds, requested.participantIds) || signer.nearEd25519SigningKeyId !== admission.application_binding.near_ed25519_signing_key_id || signer.relayerKeyId !== admission.scope.signing_worker_id || admission.application_binding.wallet_id !== args.walletId || admission.application_binding.key_creation_signer_slot !== requested.signerSlot) throw new Error("Wallet add-signer finalize returned mismatched Ed25519 Yao identity");
-	return finalized;
-}
-function verifiedEd25519AddSignerIntent(started) {
-	const selection = started.intent.signerSelection;
-	if (selection.mode !== "ed25519") throw new Error("Wallet add-signer start intent changed signer branch");
-	return {
-		version: started.intent.version,
-		walletId: started.intent.walletId,
-		signerSelection: selection,
-		...started.intent.runtimePolicyScope ? { runtimePolicyScope: started.intent.runtimePolicyScope } : {},
-		nonceB64u: started.intent.nonceB64u
-	};
-}
-async function addPasskeyEd25519YaoWalletSigner(input) {
-	if (input.started.intent.signerSelection.mode !== "ed25519") throw new Error("Wallet add-signer start returned a different signer branch");
-	let persistedSignerRollbackReceipt = null;
-	let persistedMaterialTarget = null;
-	let factorSecret = null;
-	try {
-		if (input.started.authorizationKind !== "webauthn_assertion") throw new Error("Wallet custody Ed25519 add-signer requires WebAuthn authorization");
-		const admitted = await admitVerifiedPasskeyEd25519YaoAddSignerV1({
-			kind: "verified_passkey_ed25519_yao_add_signer_input_v1",
-			verifiedIntent: {
-				kind: "verified_passkey_ed25519_add_signer_intent_v1",
-				intent: verifiedEd25519AddSignerIntent(input.started),
-				addSignerIntentDigestB64u: input.intentResponse.addSignerIntentDigestB64u,
-				addSignerIntentGrant: input.intentResponse.addSignerIntentGrant,
-				addSignerCeremonyId: input.started.addSignerCeremonyId
-			},
-			verifiedAuthority: {
-				kind: "verified_passkey_ed25519_add_signer_authority_v1",
-				walletId: input.walletId,
-				addSignerIntentDigestB64u: input.intentResponse.addSignerIntentDigestB64u,
-				credentialIdB64u: input.credentialIdB64u
-			},
-			admissionRequest: input.started.ed25519.admissionRequest,
-			httpTransport: {
-				kind: "passkey_ed25519_yao_http_transport_v1",
-				routerOrigin: new URL(input.relayerUrl).origin,
-				fetch: globalThis.fetch
-			}
-		});
-		const custodyWire = joinCustodyWireFromEnvelopeRecord(input.started.ed25519.custodyEnvelope);
-		if (!custodyWire.ok) throw new Error(custodyWire.reason);
-		factorSecret = Uint8Array.from(base64UrlDecode(input.passkeyPrfFirstB64u)).buffer;
-		const joined = await input.context.signingEngine.joinWalletCustodyNearEd25519KeySet({
-			preparation: { kind: "fresh" },
-			custodyJson: custodyWire.custodyJson,
-			factorSecret,
-			nearEd25519SigningKeyId: admitted.request.application_binding.near_ed25519_signing_key_id,
-			registrationCeremonyId: input.started.addSignerCeremonyId,
-			admissionRequest: admitted.request,
-			admissionReceipt: admitted.receipt,
-			participantIds: admitted.request.participant_ids,
-			routerOrigin: new URL(input.relayerUrl).origin,
-			authorization: `Bearer ${String(input.intentResponse.addSignerIntentGrant)}`
-		});
-		const clientPublicKey = `ed25519:${base58Encode(joined.metadata.registeredPublicKey)}`;
-		const finalizedRaw = await finalizeWalletAddSigner({
-			relayerUrl: input.relayerUrl,
-			walletId: input.walletId,
-			addSignerCeremonyId: input.started.addSignerCeremonyId,
-			idempotencyKey: createRegistrationOperationIdempotencyKey("wallet-ed25519-add-signer-finalize"),
-			kind: "near_ed25519",
-			ed25519: { activationReference: joined.activationReference },
-			custodyKeySet: {
-				kind: "near_ed25519_v1",
-				keyManifestDigestB64u: joined.commitPayload.keyManifestDigestB64u,
-				registeredPublicKeyB64u: base64UrlEncode(joined.metadata.registeredPublicKey)
-			}
-		});
-		if (finalizedRaw.kind !== "near_ed25519") throw new Error("Wallet add-signer finalize returned a different signer branch");
-		const finalized = requireVerifiedEd25519AddSignerFinalize({
-			finalized: finalizedRaw,
-			started: input.started,
-			walletId: input.walletId,
-			rpId: input.rpId,
-			credentialIdB64u: input.credentialIdB64u,
-			clientPublicKey
-		});
-		emitAddSignerEventSafely(input.onEvent, input.eventAccountId, {
-			authMethod: "passkey",
-			phase: RegistrationEventPhase.STEP_08_STORAGE_PERSIST_STARTED,
-			status: "running"
-		});
-		const stored = await input.context.signingEngine.finalizeWalletEd25519SignerRegistration({
-			walletId: input.walletId,
-			nearAccountId: toAccountId(finalized.ed25519.nearAccountId),
-			nearEd25519SigningKeyId: finalized.ed25519.nearEd25519SigningKeyId,
-			auth: {
-				kind: "passkey",
-				credential: input.credential
-			},
-			signerSlot: finalized.ed25519.signerSlot,
-			operationalPublicKey: clientPublicKey,
-			relayerKeyId: finalized.ed25519.relayerKeyId,
-			keyVersion: finalized.ed25519.keyVersion,
-			participantIds: [...finalized.ed25519.participantIds]
-		});
-		if (stored.signerSlot !== finalized.ed25519.signerSlot) throw new Error("Wallet add-signer persisted a different Ed25519 signer slot");
-		persistedSignerRollbackReceipt = stored.rollbackReceipt;
-		const admission = input.started.ed25519.admissionRequest;
-		const thresholdSessionId = parseThresholdEd25519SessionId(admission.scope.threshold_session_id);
-		if (!thresholdSessionId.ok) throw new Error("Wallet add-signer threshold-session identity is invalid");
-		const metadata = joined.metadata;
-		await input.context.signingEngine.persistWalletCustodyEd25519Material({
-			binding: {
-				kind: WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND,
-				applicationBindingDigestB64u: joined.localMaterial.applicationBindingDigestB64u,
-				registeredPublicKeyB64u: base64UrlEncode(metadata.registeredPublicKey),
-				participantIds: metadata.participantIds,
-				stateEpoch: String(metadata.stateEpoch),
-				walletId: String(finalized.walletId),
-				nearAccountId: String(finalized.ed25519.nearAccountId),
-				nearEd25519SigningKeyId: finalized.ed25519.nearEd25519SigningKeyId,
-				signerSlot: finalized.ed25519.signerSlot,
-				signingWorkerId: metadata.scope.signing_worker_id,
-				signingWorkerVerifyingShareB64u: base64UrlEncode(metadata.signingWorkerVerifyingShare)
-			},
-			sealed: {
-				ciphertextB64u: joined.localMaterial.b64u,
-				nonceB64u: joined.localMaterial.nonceB64u
-			}
-		});
-		persistedMaterialTarget = {
-			nearAccountId: finalized.ed25519.nearAccountId,
-			signerSlot: finalized.ed25519.signerSlot
-		};
-		await input.context.signingEngine.upsertEd25519YaoPublicCapabilityLaneReference({
-			walletId: finalized.walletId,
-			nearAccountId: toAccountId(finalized.ed25519.nearAccountId),
-			thresholdSessionId: thresholdSessionId.value,
-			runtimePolicyScope: normalizeRuntimePolicyScope(input.started.intent.runtimePolicyScope),
-			materialActivation: nearEd25519YaoMaterialActivationFromMetadata(metadata),
-			auth: {
-				kind: "passkey",
-				rpId: toRpId(input.rpId),
-				credentialIdB64u: input.credentialIdB64u
-			},
-			nearEd25519SigningKeyId: parseNearEd25519SigningKeyId(finalized.ed25519.nearEd25519SigningKeyId),
-			signerSlot: finalized.ed25519.signerSlot
-		});
-		persistedSignerRollbackReceipt = null;
-		emitAddSignerEventSafely(input.onEvent, input.eventAccountId, {
-			authMethod: "passkey",
-			phase: RegistrationEventPhase.STEP_08_STORAGE_PERSIST_SUCCEEDED,
-			status: "succeeded"
-		});
-		return {
-			success: true,
-			kind: "wallet_signer_added",
-			walletId: finalized.walletId,
-			capabilities: [{
-				kind: "near_ed25519",
-				nearEd25519SigningKeyId: parseNearEd25519SigningKeyId(finalized.ed25519.nearEd25519SigningKeyId),
-				operationalPublicKey: clientPublicKey,
-				nearAccountId: toAccountId(finalized.ed25519.nearAccountId)
-			}]
-		};
-	} catch (error) {
-		const cleanupErrors = [];
-		if (persistedMaterialTarget) try {
-			await input.context.signingEngine.deleteWalletCustodyEd25519Material({
-				nearAccountId: persistedMaterialTarget.nearAccountId,
-				signerSlot: persistedMaterialTarget.signerSlot
-			});
-		} catch (cleanupError) {
-			cleanupErrors.push(cleanupError instanceof Error ? cleanupError.message : String(cleanupError));
-		}
-		if (persistedSignerRollbackReceipt) try {
-			await input.context.signingEngine.rollbackWalletEd25519SignerRegistration(persistedSignerRollbackReceipt);
-		} catch (cleanupError) {
-			cleanupErrors.push(cleanupError instanceof Error ? cleanupError.message : String(cleanupError));
-		}
-		if (cleanupErrors.length > 0) {
-			const primary = error instanceof Error ? error.message : String(error);
-			throw new Error(`${primary}; add-signer cleanup failed: ${cleanupErrors.join("; ")}`);
-		}
-		throw error;
-	} finally {
-		if (factorSecret) zeroizeArrayBuffer(factorSecret);
-	}
-}
-async function addPasskeyEcdsaWalletSigner(input) {
-	if (input.started.authorizationKind !== "webauthn_assertion") throw new Error("Wallet custody ECDSA add-signer requires WebAuthn authorization");
-	const authority = await exactPasskeyWalletAuthAuthorityRefForCredential({
-		walletId: input.walletId,
-		rpId: input.rpId,
-		credentialIdB64u: input.credentialIdB64u
-	});
-	const factorSecret = Uint8Array.from(base64UrlDecode(input.passkeyPrfFirstB64u)).buffer;
-	let pendingLocalFinalization;
-	try {
-		pendingLocalFinalization = await runStrictEcdsaFamilyCeremony({
-			context: input.context,
-			relayerUrl: input.relayerUrl,
-			walletId: input.walletId,
-			addSignerCeremonyId: input.started.addSignerCeremonyId,
-			started: input.started.ecdsa,
-			custodyEnvelope: input.started.ecdsa.custodyEnvelope,
-			factorSecret,
-			authority,
-			registrationTiming: null
-		});
-	} finally {
-		zeroizeArrayBuffer(factorSecret);
-	}
-	const finalizeRequest = {
-		relayerUrl: input.relayerUrl,
-		walletId: input.walletId,
-		addSignerCeremonyId: input.started.addSignerCeremonyId,
-		idempotencyKey: createRegistrationOperationIdempotencyKey("wallet-add-signer-finalize"),
-		kind: "evm_family_ecdsa",
-		ecdsa: { expectedKeyHandles: [pendingLocalFinalization.bootstrap.keyHandle] },
-		custodyKeySet: pendingLocalFinalization.custodyKeySet
-	};
-	let finalized;
-	try {
-		finalized = await finalizeWalletAddSigner(finalizeRequest);
-	} catch (error) {
-		if (!(error instanceof TypeError)) throw error;
-		finalized = await finalizeWalletAddSigner(finalizeRequest);
-	}
-	if (finalized.kind !== "evm_family_ecdsa" || finalized.walletId !== input.walletId || finalized.rpId !== input.rpId) throw new Error("Wallet add-signer finalize returned a different ECDSA identity");
-	const walletKeys = finalized.ecdsa.walletKeys;
-	const primaryKey = walletKeys[0];
-	if (!primaryKey) throw new Error("Wallet add-signer finalize did not return ECDSA wallet keys");
-	const session = await finalizeStrictEcdsaFamilyLocalActivation({
-		context: input.context,
-		pending: pendingLocalFinalization
-	});
-	emitAddSignerEventSafely(input.onEvent, input.eventAccountId, {
-		authMethod: "passkey",
-		phase: RegistrationEventPhase.STEP_08_STORAGE_PERSIST_STARTED,
-		status: "running"
-	});
-	const localEcdsaWalletKeys = await input.context.signingEngine.finalizeWalletRegistrationEcdsaSessions({
-		walletId: toWalletId(input.walletId),
-		session,
-		walletKeys: [primaryKey, ...walletKeys.slice(1)]
-	});
-	await input.context.signingEngine.storeWalletEcdsaSignerRecords({
-		walletId: input.walletId,
-		walletKeys: localEcdsaWalletKeys
-	});
-	await IndexedDBManager.adoptAddedEcdsaSignerAuthority({
-		authority: finalized.authority,
-		materialActivation: session.materialActivation
-	});
-	emitAddSignerEventSafely(input.onEvent, input.eventAccountId, {
-		authMethod: "passkey",
-		phase: RegistrationEventPhase.STEP_08_STORAGE_PERSIST_SUCCEEDED,
-		status: "succeeded"
-	});
-	return {
-		success: true,
-		kind: "wallet_signer_added",
-		walletId: input.walletId,
-		capabilities: [{
-			kind: "evm_family_ecdsa",
-			thresholdEcdsaEthereumAddress: primaryKey.thresholdOwnerAddress,
-			thresholdEcdsaPublicKeyB64u: primaryKey.thresholdEcdsaPublicKeyB64u
-		}]
-	};
-}
-async function dispatchPasskeyWalletAddSigner(args) {
-	switch (args.signerSelection.mode) {
-		case "ed25519":
-			if (args.started.kind !== "near_ed25519") throw new Error("Wallet add-signer start returned a different signer branch");
-			return await addPasskeyEd25519YaoWalletSigner({
-				context: args.input.context,
-				walletId: args.input.walletId,
-				rpId: args.input.rpId,
-				relayerUrl: args.input.relayerUrl,
-				intentResponse: args.input.intentResponse,
-				credential: args.input.credential,
-				credentialIdB64u: args.input.credentialIdB64u,
-				passkeyPrfFirstB64u: args.input.passkeyPrfFirstB64u,
-				eventAccountId: args.input.eventAccountId,
-				onEvent: args.input.onEvent,
-				started: args.started
-			});
-		case "ecdsa":
-			if (args.started.kind !== "evm_family_ecdsa") throw new Error("Wallet add-signer start returned a different signer branch");
-			return await addPasskeyEcdsaWalletSigner({
-				context: args.input.context,
-				walletId: args.input.walletId,
-				rpId: args.input.rpId,
-				relayerUrl: args.input.relayerUrl,
-				intentResponse: args.input.intentResponse,
-				credential: args.input.credential,
-				credentialIdB64u: args.input.credentialIdB64u,
-				passkeyPrfFirstB64u: args.input.passkeyPrfFirstB64u,
-				eventAccountId: args.input.eventAccountId,
-				onEvent: args.input.onEvent,
-				started: args.started
-			});
-		default: return assertNever(args.signerSelection);
-	}
-}
-async function addWalletSigner(args) {
-	const { context, signerSelection } = args;
-	const options = args.options || {};
-	const walletId = walletIdFromString(String(args.walletId || "").trim());
-	const eventAccountId = registrationEventAccountId(String(walletId));
-	const rpId = requireWebAuthnRpId(String(args.rpId || "").trim());
-	emitAddSignerEventSafely(options.onEvent, eventAccountId, {
-		authMethod: "passkey",
-		phase: RegistrationEventPhase.STEP_01_STARTED,
-		status: "started"
-	});
-	try {
-		const relayerUrl = String(context.configs.network.relayer.url || "").trim();
-		if (!relayerUrl) throw new Error("addWalletSigner requires relayer.url");
-		const managedRuntimeScope = resolveManagedRuntimeScopeBootstrap(context.configs);
-		if (!managedRuntimeScope) throw new Error("addWalletSigner requires registration.publishableKey and registration.projectEnvironmentId");
-		const intentResponse = await createWalletAddSignerIntent({
-			relayerUrl,
-			walletId,
-			request: {
-				walletId,
-				rpId,
-				signerSelection
-			},
-			auth: {
-				publishableKey: managedRuntimeScope.publishableKey,
-				environmentId: managedRuntimeScope.projectEnvironmentId
-			}
-		});
-		if (await computeAddSignerIntentDigest(intentResponse.intent) !== intentResponse.addSignerIntentDigestB64u) throw new Error("Add-signer intent digest mismatch");
-		emitAddSignerEventSafely(options.onEvent, eventAccountId, {
-			authMethod: "passkey",
-			phase: RegistrationEventPhase.STEP_04_PASSKEY_CREATE_STARTED,
-			status: "waiting_for_user",
-			interaction: {
-				kind: "passkey_assert",
-				overlay: "show"
-			}
-		});
-		const allowCredentials = addSignerAllowCredentials(await IndexedDBManager.listProfileAuthenticators(String(walletId)));
-		const credential = await context.signingEngine.getAuthenticationCredentialsSerialized({
-			subjectId: String(walletId),
-			challengeB64u: intentResponse.addSignerIntentDigestB64u,
-			allowCredentials,
-			includeSecondPrfOutput: false
-		});
-		const credentialIdB64u = requireSelectedAddSignerCredentialId(credential, allowCredentials);
-		const passkeyPrfFirstB64u = requirePasskeyPrfFirstB64u(credential, "Wallet add-signer authorization");
-		emitAddSignerEventSafely(options.onEvent, eventAccountId, {
-			authMethod: "passkey",
-			phase: RegistrationEventPhase.STEP_04_PASSKEY_CREATE_SUCCEEDED,
-			status: "succeeded",
-			interaction: {
-				kind: "passkey_assert",
-				overlay: "hide"
-			}
-		});
-		const started = await startWalletAddSigner({
-			relayerUrl,
-			walletId,
-			addSignerIntentGrant: intentResponse.addSignerIntentGrant,
-			addSignerIntentDigestB64u: intentResponse.addSignerIntentDigestB64u,
-			intent: intentResponse.intent,
-			auth: {
-				kind: "webauthn_assertion",
-				rpId,
-				credential: redactCredentialExtensionOutputs(credential),
-				expectedChallengeDigestB64u: intentResponse.addSignerIntentDigestB64u
-			}
-		});
-		await requireMatchingStartedAddSignerIntent({
-			started,
-			walletId,
-			expectedDigestB64u: intentResponse.addSignerIntentDigestB64u
-		});
-		const result = await dispatchPasskeyWalletAddSigner({
-			input: {
-				context,
-				walletId,
-				rpId,
-				relayerUrl,
-				intentResponse,
-				credential,
-				credentialIdB64u,
-				passkeyPrfFirstB64u,
-				eventAccountId,
-				onEvent: options.onEvent
-			},
-			signerSelection,
-			started
-		});
-		emitAddSignerEventSafely(options.onEvent, eventAccountId, {
-			authMethod: "passkey",
-			phase: RegistrationEventPhase.STEP_11_COMPLETED,
-			status: "succeeded"
-		});
-		notifyAddSignerAfterCallSafely(options.afterCall, true, result);
-		return result;
-	} catch (error) {
-		const errorCode = registrationErrorCodeFromUnknown(error);
-		const errorMessage = getUserFriendlyErrorMessage(error, "registration", eventAccountId);
-		notifyAddSignerErrorSafely(options.onError, registrationErrorWithCode(errorMessage, errorCode));
-		emitAddSignerEventSafely(options.onEvent, eventAccountId, {
-			authMethod: "passkey",
-			phase: RegistrationEventPhase.FAILED,
-			status: "failed",
-			message: errorMessage,
-			interaction: {
-				kind: "passkey_assert",
-				overlay: "hide"
-			},
-			error: {
-				...errorCode ? { code: errorCode } : {},
-				message: errorMessage
-			}
-		});
-		const result = {
-			success: false,
-			error: errorMessage,
-			...errorCode ? { errorCode } : {}
-		};
-		notifyAddSignerAfterCallSafely(options.afterCall, false);
-		return result;
-	}
-}
-//#endregion
-export { addWalletSigner, registerWallet, resumeNearRegistrationAfterUnlock };
-
-//# sourceMappingURL=registration.js.map