@seams/wallet 0.6.1 → 0.7.1

package/dist/public/sdk/{runtimeContext-CH97jPZ0.js → runtimeContext-iLXnxVlZ.js}

@@ -1,75 +1,79 @@
 import { r as __toESM } from "./chunk-BtrIJ4_z.js";
-import { r as reviewAdmissionForBinding } from "./transactionReviewAdmission-Cv9kTr4c.js";
-import { a as setEmbeddedBase, n as getEmbeddedBase, r as onEmbeddedBaseChange, t as getEmbeddedAssetVersion } from "./base-CMsoJcVv.js";
-import { A as parseSigningLaneId, C as parseMpcLifecycleBindingRef, F as parseWalletAuthMethodId, H as parseWebAuthnRpId, L as parseWalletAuthorityId, M as parseThresholdEd25519SessionId, N as parseThresholdSessionId, O as parsePasskeyEnvelopeId, P as parseVerifiedEmailAddress, R as parseWalletId, T as parseMpcMaterialActivationRef, V as parseWebAuthnCredentialIdB64u, b as parseLinkedDeviceEnrollmentId, c as normalizeTrimmedString, d as buildMpcMaterialActivationRef, f as hasWhitespaceOrControlCharacters, j as parseThresholdEcdsaSessionId, l as stripTrailingSlashes, p as mpcMaterialActivationRefsEqual, t as joinNormalizedUrl, v as parseLaneShareEpoch, w as parseMpcMaterialActivationId, x as parseLinkedDeviceId, y as parseLinkDeviceSessionId, z as parseWalletKeyId } from "./normalize-BephcEIF.js";
-import { t as walletIframeRequestIdFromBoundary } from "./walletIframeIdentity-UmQTJsHc.js";
-import { C as base58Encode, f as toOptionalTrimmedNonEmptyString, g as getNearShortErrorMessage, h as ensureEd25519Prefix, i as isBoolean, l as isString, m as deriveImplicitNearAccountIdFromEd25519PublicKey, o as isObject, s as isPlainObject, u as requireTrimmedString, y as parseNamedNearAccountId } from "./validation-BphUDXs7.js";
-import { b as parsePMRedeemHostedWalletSeamsSessionPayload } from "./messages-B3UbNZYc.js";
+import { B as normalizeTrimmedString, C as parseThresholdSessionId, D as parseWalletAuthorityId, M as parseWebAuthnRpId, N as joinNormalizedUrl, O as parseWalletId, S as parseThresholdEd25519SessionId, T as parseWalletAuthMethodId, V as stripTrailingSlashes, b as parseSigningLaneId, c as parseLaneShareEpoch, d as parseLinkedDeviceId, h as parseMpcMaterialActivationRef, j as parseWebAuthnCredentialIdB64u, k as parseWalletKeyId, l as parseLinkDeviceSessionId, m as parseMpcMaterialActivationId, n as hasWhitespaceOrControlCharacters, p as parseMpcLifecycleBindingRef, r as mpcMaterialActivationRefsEqual, t as buildMpcMaterialActivationRef, u as parseLinkedDeviceEnrollmentId, v as parsePasskeyEnvelopeId, w as parseVerifiedEmailAddress, x as parseThresholdEcdsaSessionId } from "./domainIds-lcrFg6Sa.js";
+import { C as deriveImplicitNearAccountIdFromEd25519PublicKey, M as base58Encode, O as parseNamedNearAccountId, T as getNearShortErrorMessage, _ as requireRecord$1, c as isBoolean, d as isPlainObject, h as requireCanonicalString, n as asRecordOrArray, p as isString, u as isObject, w as ensureEd25519Prefix, x as toOptionalTrimmedNonEmptyString, y as requireTrimmedString } from "./validation-gat4LEKm.js";
+import { r as reviewAdmissionForBinding } from "./transactionReviewAdmission-BCPvl8OZ.js";
+import { a as setEmbeddedBase, n as getEmbeddedBase, r as onEmbeddedBaseChange, t as getEmbeddedAssetVersion } from "./base-D1B5mGin.js";
+import { t as walletIframeRequestIdFromBoundary } from "./walletIframeIdentity-DB6Z2EC9.js";
+import { b as parsePMRedeemHostedWalletSeamsSessionPayload } from "./messages-C7Dbx9iN.js";
 import { i as isUserCancellationError, n as getUserFriendlyErrorMessage, o as toError, t as errorMessage } from "./errors-93h9uAW9.js";
 import { i as base64UrlEncode, n as base64Encode, r as base64UrlDecode } from "./base64-Clm8C-e9.js";
 import { n as secureRandomBase64Url, r as secureRandomId, t as secureRandomBase36 } from "./secureRandomId-BORsmdS4.js";
-import { $ as unlockEmailOtpEd25519YaoCapability, A as requestEmailOtpEnrollmentChallenge, At as listExactSealedSessionsForWallet, B as scheduleEcdsaSessionPresignaturePrefill, Bt as resolveExactWalletSessionOperationCredential, C as preparePasskeyEd25519YaoLocalMaterialRehydrationV1, Ct as resolveExactEd25519SealedSessionRuntimeForLane, D as persistPasskeyEd25519YaoSessionForRefresh, Dt as buildCurrentSealedSessionRecord, E as buildPasskeyEd25519RestoreMetadata, Et as acquireSigningSessionRestoreLease, F as buildRecoveredCustodyEnvelopeRecord, Ft as updateExactSealedSessionPolicy, G as requirePasskeyPrfFirstB64u, Gt as ROUTER_AB_ED25519_YAO_ACTIVE_CLIENT_KIND_V1, H as resumePendingNearRegistrations, Ht as openWalletCustodyEd25519ActiveClientV1, I as resolveManagedRuntimeScopeBootstrap, It as writeExactSealedSession, J as assertEd25519YaoWarmRecoveryDescriptorStableMaterialContinuity, Jt as parseEd25519YaoRecoveryCapabilityV1, K as verifyLinkedDevicePasskeyWalletSession, Kt as RouterAbEd25519YaoClientV1, L as awaitNearProvisioningInFlight, Lt as createDeleteDurableSealedSessionCommand, M as configurePasskeyCustodySessionCachePersistence, Mt as readExactSealedSession, N as readPasskeyCustodySessionEnvelope, Nt as releaseSigningSessionRestoreLease, O as collectEmailOtpRegistrationAuthority, Ot as deleteDurableSealedSessionRecord, P as rememberPasskeyCustodySessionEnvelope, Pt as updateExactEd25519SealedSessionPolicy, Q as unlockEmailOtpAuthorityWallet, R as readNearProvisioningState, Rt as buildRouterAbEd25519SigningWalletSession, S as persistPasskeyEd25519YaoSignerMaterialV1, St as parseExactEd25519SealedSessionRuntime, T as buildRestorableMpcMaterialRefInternal, Tt as resolveExactEd25519SealedSessionRuntimeForWalletSubject, U as passkeyCredentialIdB64uFromAuthentication, Ut as walletCustodyActivationFactsFromActiveClientMetadataV1, V as resumePendingEcdsaRegistrationFromStoredCommit, Vt as openOrRejoinWalletCustodyEd25519V1, W as passkeyPrfFirstB64uFromCredential, Wt as walletCustodyCacheEnvelopeFromRecordV1, X as parsePasskeyEd25519YaoSyncResponseV1, Xt as listThresholdEcdsaProvisionTargets, Y as buildRecoveredWalletSessionState, Yt as listConfiguredThresholdEcdsaPublicationTargets, Z as passkeyEd25519YaoLaneReferenceFromRecovery, Zt as isRegistrationBenchmarkDiagnosticsEnabled, _ as walletCustodyCeremonyTransportFromWorkerContextV1, _t as nearEd25519YaoOperationMaterialFacts, a as registerWallet, at as joinNearEd25519CustodyV1, b as ed25519YaoLocalMaterialIdentityFromWalletSession, bt as ed25519AuthorizationIdentityMatchesRuntime, c as exactWalletSessionAuthorityIdentity, ct as rejoinEvmFamilyCustodyV1, d as validateExactWalletSessionAuthorization, dt as createRelayerExactWalletSessionStatusPort, et as unlockEmailOtpWallet, f as destroyUnlockedWalletEd25519ExportRootCapabilitiesV1, ft as sameRuntimePolicyScope$1, g as setUnlockedCustodyEnvelopeUpgradeSinkV1, gt as buildPasskeyRouterAbEd25519WalletSessionState, h as readUnlockedWalletEd25519ExportRootCapabilityV1, ht as buildEmailOtpRouterAbEd25519WalletSessionState, it as joinEvmFamilyCustodyV1, j as resolveGoogleEmailOtpProvider, jt as readExactEd25519SealedSession, k as requestEmailOtpChallenge, kt as listEcdsaSealedSessionsForWallet, l as persistExactWalletSessionAuthorizationFromEcdsaBootstrap, lt as rejoinNearEd25519CustodyV1, m as establishUnlockedWalletEd25519ExportRootCapabilityV1, mt as WALLET_IFRAME_TRANSPORT_TIMING_LABEL, nt as establishEvmFamilyCustodyV1, ot as recoverEvmFamilyCustodyV1, p as dropUnlockedWalletEd25519ExportRootCapabilityReferenceV1, pt as joinCustodyWireFromEnvelopeRecord, q as verifyPasskeyWalletUnlock, qt as RouterAbEd25519YaoHttpActivationTransportV1, rt as establishNearEd25519CustodyV1, st as recoverNearEd25519CustodyV1, t as addWalletSigner, tt as unlockEmailOtpWalletCapabilities, u as validateExactWalletSessionAuthorityIdentity, ut as WalletSessionStatusReadScope, v as requestWalletCustodyCeremonyOperation, vt as rebindRouterAbEd25519WalletSessionStateFromExactRuntime, w as readPasskeyEd25519YaoLocalMaterialLocatorV1, wt as resolveExactEd25519SealedSessionRuntimeForWallet, x as hydratePasskeyEd25519YaoLocalMaterialV1, xt as ed25519SealedRuntimeAuthorityRef, y as walletCustodyCeremonyStepRunner, yt as resolveActiveAuthorizedRouterAbEd25519WalletSessionState, z as subscribeToNearProvisioning, zt as requiredSigningSubjectForExactSigningLane } from "./registration-D-istkMZ.js";
-import { a as computeLinkedDeviceTargetPreparationDigestV1, c as assertNeverLinkSessionStateV1, i as computeLinkedDevicePublicKeyDigestV1, l as activeWalletSessionV1RecordsEqual, n as LINKED_DEVICE_REQUEST_PROOF_HEADER_V1, o as computeWalletSessionInstallationReceiptDigestB64u, r as LINKED_DEVICE_REQUEST_PROOF_MAX_TTL_MS_V1, s as computeWalletSessionOperationCredentialDigestB64u } from "./device-linking-DpVGjSeq.js";
-import { A as alphabetizeStringify, D as sameWalletAuthMethodRecordV2, I as parseDigestB64u, J as resolvePrimaryNearRpcUrl, M as sha256BytesUtf8, N as sha256HexUtf8, O as sponsoredNamedNearAccountProvisioning, R as chainFamilyFromNetwork, S as registrationNearEd25519BranchKey, a as computeAddAuthMethodIntentDigestB64u, b as parseWalletAuthMethodRecordV2, c as computeWalletAuthMethodRevokeOperationFingerprintV1, i as buildWalletAuthMethodRecordV2, j as sha256Bytes, k as walletIdFromString, m as nearEd25519SigningKeyIdFromString, p as implicitNearAccountProvisioning, q as resolvePrimaryExplorerUrl, t as NEAR_ED25519_YAO_KEY_VERSION_V1, u as createServerAllocatedWalletId, y as parseNearEd25519SigningKeyId, z as cloneChainConfig } from "./registrationIntent-DwAIMQYh.js";
-import { a as thresholdEcdsaChainTargetFromRequest, c as toWalletId, i as thresholdEcdsaChainTargetFromConfig, n as nearAccountRefFromAccountId, o as thresholdEcdsaChainTargetKey, s as thresholdEcdsaChainTargetsEqual, t as configuredThresholdEcdsaChainTargets, u as walletSessionRefFromSession } from "./ecdsaChainTarget-BOTPGIU_.js";
-import { a as WALLET_AUTH_METHODS, d as WALLET_EMAIL_OTP_REGISTRATION_OPERATION, f as WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION, i as SIGNER_SOURCES, l as WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, n as SIGNER_AUTH_METHODS, p as WALLET_EMAIL_OTP_UNLOCK_OPERATION, r as SIGNER_KINDS, s as EMAIL_OTP_CHANNEL, u as WALLET_EMAIL_OTP_EXPORT_OPERATION } from "./signerDomain-DDLiwuYS.js";
-import { a as toIndexedDbChainTargetKey, t as normalizeIndexedDbAccountAddress } from "./normalization-oJyXl3Vn.js";
-import { c as zeroizeIssuedWalletRecoveryCodes, d as deriveWalletRecoveryKeyLifecycleId, f as parseRecoveryCodeReservationId, i as walletRecoverySetRotationWireFromWorkerResultV1, o as deriveRecoveryCodeLocatorV1FromBytes, r as walletRecoveryEcdsaPossessionChallengeDigestB64uV1, s as issueWalletRecoveryCodes, t as parseWalletRecoveryEcdsaPossessionChallengeV1 } from "./wallet-recovery-CKqoHbxT.js";
-import { _ as parseUnixMs, c as deriveEvmFamilySigningKeySlotId, d as parseEd25519PublicKeyB64u, f as parseEnvelopeCiphertextB64u, g as parseSecp256k1CompressedPublicKeyB64u, h as parseKeyCreationSignerSlot, i as parseThresholdEd25519ParticipantsV1, l as requireEvmFamilySigningKeySlotId, m as parseEnvelopeRevision, n as buildThresholdEd25519Participants2pV1, o as normalizeRuntimePolicyScope, p as parseEnvelopeNonceB64u, r as normalizeThresholdEd25519ParticipantIds, s as signingRootScopeFromRuntimePolicyScope, t as THRESHOLD_ED25519_2P_PARTICIPANT_IDS, u as parseDigestField, v as rejectUnknownFields, y as requireRecord$4 } from "./participants-Bcnsa_ip.js";
-import { A as storeWalletMixedRegistrationData$1, C as storeWalletEcdsaSignerRecords$1, D as storeWalletEmailOtpEcdsaSignerRecords$1, E as storeWalletEmailOtpEcdsaRegistrationData$1, F as getLastSelectedNearAccount, I as getNearAccountProjection, M as WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND, O as storeWalletEmailOtpEd25519RegistrationData$1, S as storeWalletEcdsaRecoverySignerRecords$1, T as storeWalletEd25519RegistrationData$1, _ as rollbackWalletEd25519SignerRegistration$1, a as getLastUser$1, b as storeAuthenticator$1, c as hasPasskeyCredential$1, g as rollbackUserRegistration$1, i as getAllUsers$1, k as storeWalletEmailOtpMixedRegistrationData$1, l as nearAuthenticatorsByAccount$1, n as finalizeWalletEcdsaRegistration$1, o as getUserBySignerSlot$1, r as finalizeWalletEd25519SignerRegistration$1, s as getWalletNearProvisioningState$1, t as activateAuthenticatedWalletState$1, v as setLastUser$1, w as storeWalletEd25519RecoveryRegistrationData$1, x as storeUserData$1, y as setWalletNearProvisioningState$1 } from "./accountLifecycle-Ddavc_FC.js";
-import { t as toAccountId } from "./accountIds-Ck4GAQfm.js";
-import { C as buildFullOwnerDelegatedWalletAuthorityV1, S as parseExactAdministeredSignerManifestV1, T as hasDelegatedWalletPermissionV1, a as clampThresholdSessionPolicy, b as replaceActiveWalletAuthorityEd25519MaterialActivationV1, c as resolveWalletUnlockSessionUsesFromRequestedUses, d as computeWalletSignerActivationSetDigestB64u, f as encodeWalletSignerActivationSetV1, h as isActiveRecoveredWalletAuthorityV1, i as buildEd25519SessionPolicy, l as coerceThemeMode$1, o as normalizeThresholdRuntimePolicyScope, r as DEFAULT_UNLOCK_REMAINING_USES, t as DEFAULT_THRESHOLD_SESSION_POLICY, u as computeWalletAuthorityDigestB64u, y as parseWalletSignerActivationSetV1 } from "./sessionPolicy-B4FsPuk2.js";
-import { $ as parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1, $t as deriveRouterAbEd25519YaoApplicationBindingDigestV1, A as parseLinkedDeviceRevokeResultV1, An as LINKED_DEVICE_ED25519_EXPORT_ROOT_TRANSFER_ALG_V1, At as buildEmailOtpWalletAuthAuthority, B as parseCommittedAuthorityPackagesV1, Bt as parseWalletAuthAuthorityRef, C as parseLinkedDeviceEmailOtpVerificationGrantV1, Cn as routerAbMpcMaterialActivationRefToWire, D as parseLinkedDeviceOwnerAuthorizationRequestV1, Dn as parseLinkedDeviceWalletSessionCredentialDeliveryBindingV1, Dt as sameRouterAbEcdsaRegistrationActivationReceiptV1, E as parseLinkedDeviceListResultV1, En as assertLinkedDeviceWalletSessionCredentialDeliveryIntegrityV1, Et as sameRouterAbEcdsaDerivationPublicIdentityV1, F as parseLocalAuthorityActivationFinalAckV1, Fn as serializeLinkedDeviceEd25519ExportRootTransferBindingV1, Ft as isEmailOtpWalletAuthAuthority, G as ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, H as parseLinkedDeviceEd25519SourcePreservingReservationV1, Ht as walletAuthAuthorityRef, I as parseLocalAuthorityInstallationReceiptV1, It as isPasskeyWalletAuthAuthority, Kt as ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, L as parseQrLinkedDeviceSessionPayloadV5, Lt as parseEmailOtpWalletAuthAuthority, M as parseLinkedDeviceTargetCredentialRegistrationResultV1, Mn as parseLinkedDeviceEd25519ExportRootPackageV1, N as parseLinkedDeviceTargetPreparationRequestV1, Nn as parseLinkedDeviceEd25519ExportRootRecipientPublicKeyB64u, O as parseLinkedDeviceOwnerAuthorizationSourceV1, On as parseLinkedDeviceWalletSessionCredentialDeliveryV1, P as parseLinkedDeviceTargetPreparationV1, Pn as parseLinkedDeviceEd25519ExportRootRecipientV1, Qt as ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, R as parseWalletSessionOperationCredentialV1, S as parseLinkedDeviceEmailOtpFactorReleaseEnvelopeV1, Sn as routerAbMpcMaterialActivationRefFromWire, T as parseLinkedDeviceListRequestV1, Tt as sameRouterAbEcdsaDerivationPublicCapabilityV1, U as parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1, Ut as ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1, Vt as walletAuthAuthoritiesMatch, W as parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationV1, Yt as ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, Zt as ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, _ as parseLinkedDeviceEmailOtpBaseFactorResolutionResultV1, a as buildLinkedDeviceSessionCancelClaimedRequestV1, at as parseRouterAbEcdsaExplicitExportForwardedResponseV1, b as parseLinkedDeviceEmailOtpChallengeStartRequestV1, c as buildLinkedDeviceTargetCredentialRegistrationV1, cn as parseRouterAbEd25519YaoRecoveryActivationExecuteRequestV1, ct as parseRouterAbEcdsaOperationStepUpPreparationV1, dn as parseRouterAbEd25519YaoRecoveryAdmissionRequestV1, f as parseLinkDevicePublicKeyB64u, ft as parseRouterAbEcdsaRegistrationActivationReceiptV1, g as parseLinkedDeviceApprovalResultV1, gn as parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1, h as parseLinkedDeviceApprovalDeliveryV1, i as buildLinkedDeviceApprovalV1, it as parseRouterAbEcdsaDerivationPublicCapabilityV1, j as parseLinkedDeviceSessionClaimV1, jn as buildLinkedDeviceEd25519ExportRootTransferBindingV1, jt as buildPasskeyWalletAuthAuthority, k as parseLinkedDeviceRevokeRequestV1, kt as sameRouterAbServerIdentityV1, l as buildQrLinkedDeviceSessionPayloadV5, ln as parseRouterAbEd25519YaoRecoveryActivationReceiptV1, m as parseLinkSessionTransportEventV1, mn as parseRouterAbEd25519YaoRegistrationActivationResultV1, o as buildLinkedDeviceSessionCancelUnclaimedRequestV1, p as parseLinkSessionProjectionV1, qt as ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, r as cloneAuthenticatorOptions, rt as parseRouterAbEcdsaDerivationNormalSigningStateV1, s as buildLinkedDeviceSessionClaimRequestV1, sn as parseRouterAbEd25519YaoRecoveryActivationAdmissionReceiptV1, t as MAX_DURABLE_CLIENT_PRESIGNATURE_LIFETIME_MS, u as parseActivateInstalledAuthorityResultV1, un as parseRouterAbEd25519YaoRecoveryActivationResultV1, ut as parseRouterAbEcdsaPostRegistrationSessionActivationRequestV1, v as parseLinkedDeviceEmailOtpChallengeResendRequestV1, vt as routerAbEcdsaDerivationActiveStateId, w as parseLinkedDeviceEmailOtpVerificationResultV1, wn as sameRouterAbMpcMaterialActivationRef, wt as sameRouterAbEcdsaDerivationNormalSigningStateV1, x as parseLinkedDeviceEmailOtpChallengeVerifyRequestV1, y as parseLinkedDeviceEmailOtpChallengeResultV1, z as serializeQrLinkedDeviceSessionPayloadV5 } from "./ecdsaPresignLifecycle-CnSnzoRJ.js";
-import { a as buildNearEd25519MpcOperationRef, d as parseMpcWalletSigningQuotaId, g as parseWalletSessionMintId, h as parseWalletSessionId, i as buildEvmEcdsaMpcOperationRef, l as parseDeviceId, m as parseWalletSessionAuthorizationId, n as EVM_ECDSA_MPC_OPERATION_KINDS, o as buildVaultOperationRef, r as NEAR_ED25519_MPC_OPERATION_KINDS, t as CAPABILITY_KINDS } from "./capabilityKinds-jwCEaqBU.js";
-import { $ as buildEmailOtpWalletAuthMethodBinding, A as signingLaneAuthBindingKey, B as exactSigningLaneIdentityMatches, E as SigningSessionIds, F as exactEd25519ExportMaterialIdentity, G as parseExactEcdsaSigningLaneIdentity, I as exactEd25519SigningLaneIdentity, J as parseOwnerLaneParticipantContinuityV1, K as parseExactEd25519ExportMaterialIdentity, M as buildEvmFamilyEcdsaSignerBinding, N as exactEcdsaSigningLaneIdentity, St as parseSdkEcdsaDerivationThresholdKeyId, T as SigningOperationIntent, U as nearEd25519SignerBindingFromBoundaryFields, V as exactSigningLaneWalletId, W as nearProtocolProjectionFromExactLane, X as parseLaneParticipantBindingDigestB64u, Y as parseLaneHolderParticipantRecordV1, Z as parseSigningWorkerParticipantRecordV1, _ as resolveThresholdSigningRootBindingFromRecord, a as buildEvmFamilyEcdsaWalletKey, bt as parseSdkEcdsaDerivationSigningRootId, c as buildResolvedEvmFamilyEcdsaKey, d as deriveEvmFamilyKeyFingerprint, et as buildPasskeyAuthScope, f as deriveEvmFamilyKeyFingerprintFromPublicFacts, i as buildEvmFamilyEcdsaSessionLanePolicy, it as parseRpId, j as signingLaneAuthMethod, m as evmFamilyEcdsaWalletKeyToIdentity, n as buildBaseEvmFamilyEcdsaKeyIdentity, nt as buildWalletIdentity, p as deriveEvmFamilySigningKeySlotId$1, r as buildEvmFamilyEcdsaRecoveredMaterialLanePolicy, rt as nearAccountBindingFromRaw, s as buildPasskeyEcdsaAuthBinding, t as assertMatchingVerifiedEcdsaPublicFacts, tt as buildPasskeyWalletAuthMethodBinding, v as resolveThresholdSigningRootBindingFromRuntimePolicyScope, vt as computeEcdsaDerivationRoleLocalRelayerKeyId, x as toRpId, xt as parseSdkEcdsaDerivationSigningRootVersion, y as toEvmFamilyEcdsaKeyHandle, z as exactSigningLaneIdentityKey } from "./evmFamilyEcdsaIdentity-_kuKSW35.js";
-import { a as buildEmailOtpEnvelopeFactor, c as buildPasskeyEnvelopeFactor, d as parsePasskeyCustodyEnvelopeRecord, h as isWalletCustodySeedBinding, i as buildActiveEnvelopeLifecycle, l as custodyEnvelopeBindingJsonV1, m as buildEd25519YaoClientRootBinding, o as buildMethodBoundEnvelopeOwnership, s as buildPasskeyCustodyEnvelopeRecord } from "./passkey-custody-BaHyYMhj.js";
-import { a as parseEcdsaRelayerKeyId, c as parseEcdsaRoleLocalMaterialHandle, d as parseEcdsaThresholdKeyId, f as parseSigningSessionSealKeyVersion, i as parseEcdsaKeyHandle, l as parseEcdsaRoleLocalPersistedMaterialRef, o as parseEcdsaRoleLocalBindingDigest, r as parseEcdsaClientVerifyingShareB64u, s as parseEcdsaRoleLocalDurableMaterialRef } from "./keyMaterialBrands-BbjCfzXv.js";
-import { a as SIGNING_SESSION_EXPIRY_DETECTION_SOURCES, d as createLinkDeviceFlowEvent, f as createNearProvisioningStateChangedEvent, g as createUnlockFlowEvent, h as createSigningSessionExpiredEvent, i as RegistrationEventPhase, l as createAccountSyncFlowEvent, m as createSigningFlowEvent, n as KeyExportEventPhase, o as SigningEventPhase, p as createRegistrationFlowEvent, r as LinkDeviceEventPhase, s as UnlockEventPhase, t as AccountSyncEventPhase, u as createKeyExportFlowEvent } from "./sdkSentEvents-5Pi-hjHB.js";
-import { D as computeWalletEcdsaKeyFactsInventoryChallengeDigestB64u, O as openWalletAuthorityLinkedSignerMaterialV1, _ as WalletSessionAuthorizationUpgradeRequiredError, c as configureIndexedDB, d as publishEd25519YaoPublicCapabilityReferenceAndLane, f as readEmailOtpProviderSubjectForWalletV1, h as importWalletCustodyEcdsaContinuity, i as getAccountKeyMaterial, k as parseWalletAuthorityLinkedSignerMaterialRecordV1, l as createIndexedDBNonceLaneCoordinationStore, m as copyWalletCustodyEcdsaContinuityToAuthMethod, n as loadWalletCustodyEd25519MaterialV1, o as storeAccountKeyMaterial, p as IndexedDbEcdsaCapabilityManifestStore, r as persistWalletCustodyEd25519MaterialV1, s as IndexedDBManager, t as deleteWalletCustodyEd25519MaterialV1, u as IndexedDbEd25519YaoPublicCapabilityReferenceStore, v as walletSessionAuthorizations } from "./ed25519SeedMaterial-Cghz8-XB.js";
-import { t as parseSignerSlot } from "./signerSlot-DbNAs-kc.js";
-import "./keccak-DY5wDsym.js";
-import { a as SIGNING_SESSION_SEAL_ALG, l as parseRouterAbEd25519NormalSigningState, n as PASSKEY_PRF_SECOND_SALT_V1, o as SIGNING_SESSION_SEAL_GROUP_ID, r as ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND, t as PASSKEY_PRF_FIRST_SALT_V1 } from "./signingSessionSeal-CdtgXHSL.js";
-import { t as demoEmailOtpCodeFromDelivery } from "./challengeDelivery-BjLKoou3.js";
-import { _ as parseEmailOtpEcdsaExportWorkerIssuedSessionHandle, a as createSigningPlannerDecisionTraceEvent, c as nearImplicitAccountFundingPort, d as mintEd25519WalletSession, f as nearOperationStepUpPreparationPort, g as buildNearMessageDisplayModel, h as buildNearDisplayModel, i as withThresholdEd25519CommitQueue, l as buildThresholdEd25519WebAuthnPrfSecretSource, m as getLastLoggedInSignerSlot, o as planSigningSession, p as deriveThresholdEd25519ClientVerifyingShareWasm, r as resolveThresholdEd25519CommitQueueKey, s as parseAndValidateRegistrationCredentialConfirmationPayload, t as signNear, u as localPrfFirstForEd25519WalletSessionMintAuthorization, v as parseEmailOtpWorkerIssuedSessionHandle } from "./signNear-B0OCVKoH.js";
-import { t as executeWorkerOperation } from "./executeWorkerOperation-Bn8GEuT_.js";
-import { A as thresholdEcdsaRoleLocalComputeSignatureShareFromPresignatureHandleWasm, B as SignerWorkerOperationError, C as prepareLinkedDeviceEcdsaSourceContributionWasm, D as storeLinkedDeviceEcdsaHolderMaterialWasm, E as storeEcdsaRoleLocalSigningMaterialWasm, F as thresholdEcdsaRoleLocalPresignSessionStepWasm, H as getSignerWorkerOperationCoreCode, I as thresholdEcdsaRoleLocalReservePresignatureWasm, L as verifyRouterAbEcdsaRegistrationClientProofsWasm, M as thresholdEcdsaRoleLocalListAvailablePresignaturesWasm, N as thresholdEcdsaRoleLocalPresignSessionAbortWasm, O as thresholdEcdsaRoleLocalAdmitPresignatureWasm, P as thresholdEcdsaRoleLocalPresignSessionInitFromMaterialHandleWasm, R as EcdsaDerivationClientCustomRequestType, S as prepareEcdsaClientBootstrapCommandWasm, T as signWalletRecoveryEcdsaMaterialPossessionProofWasm, U as getSignerWorkerOperationErrorCode, V as WorkerControlMessage, _ as finalizeEcdsaHolderOrdinaryExportWasm, a as resolveRouterAbEcdsaDerivationPresignaturePoolPolicy, b as openEcdsaRoleLocalSigningMaterialWasm, c as clearLinkedDeviceEcdsaHolderMaterialsWasm, d as createEcdsaHolderOrdinaryExportRequestWasm, f as createRouterAbEcdsaPostRegistrationCeremonyWasm, g as finalizeEcdsaClientBootstrapCommandWasm, h as destroyLinkedDeviceEcdsaHolderMaterialsWasm, i as clearRouterAbEcdsaDerivationClientPresignaturesForWallet, j as thresholdEcdsaRoleLocalDestroyPresignatureWasm, k as thresholdEcdsaRoleLocalCommitPresignatureWasm, l as closeRouterAbEcdsaPostRegistrationCeremonyWasm, m as destroyLinkedDeviceEcdsaHolderMaterialWasm, o as scheduleRouterAbEcdsaDerivationClientPresignaturePoolRefill, p as createRouterAbEcdsaRegistrationCeremonyWasm, r as clearAllRouterAbEcdsaDerivationClientPresignatures, s as waitForRouterAbEcdsaDerivationClientPresignaturePoolReady, u as closeRouterAbEcdsaRegistrationCeremonyWasm, v as finalizeRouterAbEcdsaExplicitExportWasm, w as reconcileCanonicalEcdsaActivationWasm, x as persistInitialCanonicalEcdsaActivationWasm, y as finalizeRouterAbEcdsaRegistrationActivationWasm, z as EcdsaPresignClientRequestType } from "./secp256k1-Cr1jBW1n.js";
-import { c as serializeRegistrationCredentialWithPRF, i as normalizeAuthenticationCredential, l as getPrfFirstB64uFromCredential, n as getPrfSecondSaltV1, o as redactedPasskeyRegistrationCredential, r as isSerializedRegistrationCredential, s as serializeAuthenticationCredentialWithPRF, t as getPrfFirstSaltV1, u as redactCredentialExtensionOutputs } from "./helpers-DpRjHMBx.js";
-import { C as validateTempoFeeToken, D as requestParentDomainWebAuthn, E as executeWebAuthnWithParentFallbacksSafari, S as requireTempoFeeTokenPreferenceSigningRequest, T as WindowParentDomainWebAuthnClient, b as parseTempoEvmAddress, d as walletIframeUnlockRequestFromLoginHooks, f as needsExplicitActivation, p as OverlayController, r as parseWalletIframeExactSessionIdentity, x as readTempoFeeTokenPreference, y as buildTempoSetUserTokenRequest } from "./exactSessionState-Bt0HforB.js";
-import { C as ecdsaRoleLocalReadyRecordMatchesInput, E as parseEcdsaRoleLocalReadyRecord, O as serializeEcdsaRoleLocalReadyRecord, S as buildEcdsaRoleLocalPublicFacts, T as ecdsaRoleLocalReadyRecordStorageKeyFacts, b as buildEcdsaRoleLocalEmailOtpAuthMethod, w as ecdsaRoleLocalReadyRecordStorageKey, x as buildEcdsaRoleLocalPasskeyAuthMethod, y as routerAbEcdsaDerivationPublicCapabilitiesEqual } from "./ecdsaCapabilityManifest-C8itxV9S.js";
-import { i as buildNearAccountRefs } from "./profileAccountProjection-C9rVhbeJ.js";
-import { a as isWorkerError, o as isWorkerProgress, s as isWorkerSuccess, t as DEFAULT_CONFIRMATION_CONFIG } from "./signer-worker-DYRteieu.js";
-import { A as activateRouterAbEcdsaPostRegistrationSession, C as requestAddAuthMethodEmailOtpChallenge, E as revokeWalletAuthMethod, O as startWalletAddAuthMethod, _ as fetchWalletEcdsaKeyFactsInventoryWithWebAuthn, a as buildRehydrateMaterialActivationHydrationPlan, b as fundImplicitNearAccountForTesting, g as fetchWalletEcdsaKeyFactsInventoryWithOperationCredential, i as buildBlockedMpcCapabilityHydrationPlan, j as parseProfileContinuityEcdsaWarmKey, l as computeWalletCustodyAdminChallengeDigest, m as createWalletAddAuthMethodIntent, n as nearEd25519YaoRuntimeRef, o as buildUseLiveRuntimeHydrationPlan, r as resolveNearEd25519YaoCapabilityHydrationV1, t as nearEd25519YaoMaterialActivationFromMetadata, v as finalizeWalletAddAuthMethod } from "./nearEd25519YaoMaterialActivation-BLxVE6E5.js";
-import { n as buildRelayerJsonPostRequestInit, r as normalizeRelayerBaseUrl, t as buildBearerAuthorizationHeader } from "./relayerHttp-LsVTZCxA.js";
-import { _ as isEmailOtpPendingSingleUseAuthContext, a as nearEd25519SessionMatchesMaterialActivation, b as laneCandidateStateFromRuntimePolicy, d as buildEmailOtpAuthContextForWalletAuthMethod, f as emailOtpAuthContextConsumedAtMs, g as emailOtpAuthContextRetention, h as emailOtpAuthContextProviderUserId, i as classifyNearEd25519WalletSessionAuthorization, m as emailOtpAuthContextProvider, n as buildAuthorizationRequiredNearEd25519YaoSigningPreparation, p as emailOtpAuthContextEmailHashHex, r as buildAuthorizedNearEd25519YaoSigningPreparation, t as buildActiveNearEd25519WalletSessionAuthorization, u as buildEmailOtpAuthContextForCanonicalWallet, v as isEmailOtpSessionAuthContext, x as selectedEcdsaLane } from "./nearEd25519YaoSigningPreparation-DX6xG-IW.js";
-import { a as throwEmailOtpSigningSessionAuthStateError, i as emailOtpEcdsaBootstrapRouteAuthFromRoutePlan, n as buildEmailOtpSigningSessionRoutePlan, o as buildEmailOtpRoutePlan, r as buildFreshEmailOtpRoutePlan, t as assertEmailOtpSigningSessionAuthLane } from "./routePlan-nLpPFHB-.js";
-import "./operationFingerprint-CsYO6b0a.js";
-import { n as generateSessionId, t as cacheCredentialBoundarySetupExportPrfFirst } from "./prfCache-CgAr-VEU.js";
-import { c as emitSigningSessionFlowFailure, l as emitSigningSessionFlowTrace } from "./trace-DWnDLSuV.js";
-import { t as webAuthnPromptCoordinator } from "./webauthnPromptCoordinator-CLeba8ru.js";
-import { a as toActionArgsWasm, t as ActionType } from "./actions-DsBQcjBn.js";
-import { t as MinimalNearClient } from "./NearClient-BQgcqAzG.js";
-import { A as UserConfirmMessageType, C as getSignIntentDigestSubject, E as getTxCount, M as normalizeConfirmationConfig, S as getNearAccountId, T as getSigningAuthMode, _ as sendConfirmProgress, a as formatNearAccountFundingProgressNotice, b as assertSigningRequestContext, c as collectAuthenticationCredentialForChallengeB64u, d as collectAuthenticationCredentialForWalletChallengeB64u, f as ERROR_MESSAGES, g as sanitizeForPostMessage, h as parseTransactionSummary, i as formatNearAccountFundingNotice, j as UserConfirmationType, m as isUserCancelledUserConfirm, n as createConfirmTxFlowAdapters, o as __isWalletIframeHostMode, p as createUserConfirmScopedWorker, r as mountConfirmUI, s as __setWalletIframeHostMode, t as createConfirmSession, v as sendConfirmResponse, w as getSignTransactionPayload, x as getIntentDigest, y as assertNoForbiddenMainThreadSigningSecrets } from "./adapters-LgE4nnos.js";
-import { i as orderActionForDigest, n as computeUiIntentDigestFromNep413, r as computeUiIntentDigestFromTxs } from "./intentDigest-A1MbbJPu.js";
-import { r as showWalletRecoveryCodesUi, t as pendingWalletRecoveryCodeBackupRepository } from "./pendingWalletRecoveryCodeBackup-DyvRysWg.js";
-import { t as createEvmClient } from "./EvmClient-CHw6txjt.js";
-import { n as resolveAppearanceTheme, o as resolveThemePalette } from "./configHelpers-DB73zYvO.js";
-import { n as getDefaultCspNonce, t as createCspStylesheetManager } from "./csp-stylesheet-DLj_a6t_.js";
-import { r as buildConfigsFromEnv } from "./defaultConfigs-CyNOW4Sy.js";
-import { t as createNonceCoordinator } from "./NonceCoordinator-C7QltTDC.js";
-import { i as resumePendingWalletRecoveries } from "./walletRecoveryCommit-G6w6N5RV.js";
-import { i as loadWebAuthnP256EngineCtor, n as loadSignEvmFamilyWithUiConfirmForTempo, r as loadSignEvmWithUiConfirm, t as loadSecp256k1EngineCtor } from "./signerLoader-D0WU1jq_.js";
-import { A as authorizeEvmFamilyEcdsaSigningCapability, B as listLinkedEcdsaHolderRuntimesV1, C as buildExactPasskeyOwnerLaneScope, D as buildPersistedEcdsaRoleLocalMaterial, E as resolveExactWalletAuthAuthority$1, F as signingAuthorizationFromPreprocessing, H as resolveLinkedEcdsaHolderRuntimeV1, I as ensureSealedRefreshStartupParityForThresholdEcdsaBootstrap, L as isRetryableSealedRefreshCapabilityFetchError, M as buildEcdsaPreprocessingCapability, N as buildExactEcdsaDirectCapabilityRuntime, O as ecdsaRoleLocalPersistedMaterialSource, P as buildExactEvmFamilyWalletSessionAuthorization, R as clearLinkedEcdsaHolderRuntimesV1, S as buildExactLinkedEmailOtpOwnerLaneScope, T as resolveExactOwnerLaneScope, V as removeLinkedEcdsaHolderRuntimeV1, _ as resolveEmailOtpEcdsaSigningSessionAuth, a as reportTempoFinalized, b as withThresholdEcdsaSigningQueue, c as resolveActiveWalletAuthorityEcdsaRuntimeV1, d as createActiveEcdsaCapabilityRuntimeForChainResolver, f as createActiveEcdsaCapabilityRuntimeResolver, g as requestEmailOtpSigningSessionChallenge$1, h as refreshEmailOtpSigningSession$1, i as reportTempoDroppedOrReplaced, j as buildCanonicalEvmFamilyEcdsaSigningCapability, k as resolveEcdsaRoleLocalMaterial, l as issueEcdsaOperationStepUpAuthorization, m as resolveExactEcdsaSealedRuntime, n as reportTempoBroadcastAccepted, o as signEvmFamily, p as resolveExactEcdsaCapabilityRuntime, r as reportTempoBroadcastRejected, t as reconcileTempoNonceLane, u as prepareEcdsaOperationStepUp, v as clearThresholdEcdsaSigningQueue, w as isOwnerRelinkRequiredError, x as buildExactEcdsaPasskeyOwnerLaneScope, y as resolveThresholdEcdsaSigningQueueKey, z as installLinkedEcdsaHolderRuntimeV1 } from "./signEvmFamily-Dxk4sBPY.js";
-import { n as SigningAuthPlanKind } from "./promptText-BEgOkGxB.js";
-import { C as isSigningOperationReviewApprovedStateKind, d as fullWalletLoginRequired, f as invalidWalletSigningMaterial, m as walletSigningMaterialBlockError, p as isWalletSigningStateFailure, v as SigningOperationInteractionEventKind } from "./operationFingerprint-DEPg9A3h.js";
-import { _ as WALLET_SESSION_FAILURE_CODES, g as walletSessionFailureFromError, h as walletSessionFailureFromCode, p as WalletSessionFailureError } from "./routerAbNormalSigning-DktZKnf1.js";
-import { _ as parseWalletSessionAuthorizationBoundary, d as availableEd25519SigningLaneAuthMethod, f as ecdsaAvailableLaneCandidatesForTarget, g as readAvailableSigningLanes, h as isConcreteAvailableSigningLane, l as activeWalletAuthorityAvailableLaneFromProjection, m as ecdsaAvailableLaneIdentityKey, p as ecdsaAvailableLaneForTarget, u as availableEcdsaSigningLaneAuthMethod, v as requireAuthoritativeExpiredWalletSessionAuthorizationBoundary } from "./transactionState-Bpm4GamO.js";
-import { t as bytesToHex } from "./bytes-CwytAKz8.js";
-import { a as PENDING_CHALLENGE_B64U, c as consumeIntentDigestPreparation, l as createEvmNonceBackend, n as EvmFamilyEcdsaMaterialSupersededError, s as clearIntentDigestPreparation } from "./signatureUses-C1o1pDql.js";
-import { n as removeExportViewerHostIfPresent, t as isExportViewerSessionOpen } from "./export-viewer-host-B3K81QGA.js";
-import { i as observeTransactionLifecycleReport, n as failTransactionActivity, r as observeTransactionActivity, t as beginTransactionActivity } from "./transaction-activity-DKgIGpKG.js";
-import "./jsxRuntime.module-FAP0NE9p.js";
-import { t as handleRegistrationFlow } from "./registration-BtPLgKHk.js";
-import { i as rotateWalletRecoverySet, n as readWalletRecoveryCodeStatus, r as requestWalletCustodyEmailOtpChallenge, t as acknowledgeWalletRecoveryBackup } from "./walletRecoveryRotate-BYOYJAyb.js";
+import { $ as unlockEmailOtpAuthorityWallet, $t as listThresholdEcdsaProvisionTargets, A as resolveGoogleEmailOtpProvider, At as readExactEd25519SealedSession, B as subscribeToNearProvisioning, Bt as resolveExactWalletSessionOperationCredential, C as persistPasskeyEd25519YaoSignerMaterialV1, Ct as resolveExactEd25519SealedSessionRuntimeForLane, D as collectEmailOtpRegistrationAuthority, Dt as deleteDurableSealedSessionRecord, E as buildRestorableMpcMaterialRefInternal, Et as acquireSigningSessionRestoreLease, F as exactPasskeyWalletAuthAuthorityRefForCredential, Ft as writeExactSealedSession, G as passkeyPrfFirstB64uFromCredential, Gt as openWalletCustodyEd25519ActiveClientV1, H as resumePendingEcdsaRegistrationFromStoredCommit, Ht as buildPasskeyEd25519RestoreMetadata, I as exactPasskeyWalletAuthMethodForCredential, It as buildCurrentSealedSessionRecord, J as verifyPasskeyWalletUnlock, Jt as ROUTER_AB_ED25519_YAO_ACTIVE_CLIENT_KIND_V1, K as requirePasskeyPrfFirstB64u, Kt as walletCustodyActivationFactsFromActiveClientMetadataV1, L as resolveManagedRuntimeScopeBootstrap, Lt as createDeleteDurableSealedSessionCommand, M as readPasskeyCustodySessionEnvelope, Mt as releaseSigningSessionRestoreLease, N as rememberPasskeyCustodySessionEnvelope, Nt as updateExactEd25519SealedSessionPolicy, O as requestEmailOtpChallenge, Ot as listEcdsaSealedSessionsForWallet, P as buildRecoveredCustodyEnvelopeRecord, Pt as updateExactSealedSessionPolicy, Q as passkeyEd25519YaoLaneReferenceFromRecovery, Qt as listConfiguredThresholdEcdsaPublicationTargets, R as awaitNearProvisioningInFlight, Rt as buildRouterAbEd25519SigningWalletSession, S as hydratePasskeyEd25519YaoLocalMaterialV1, St as parseExactEd25519SealedSessionRuntime, T as readPasskeyEd25519YaoLocalMaterialLocatorV1, Tt as resolveExactEd25519SealedSessionRuntimeForWalletSubject, U as resumePendingNearRegistrations, Ut as persistPasskeyEd25519YaoSessionForRefresh, V as scheduleEcdsaSessionPresignaturePrefill, Vt as WALLET_IFRAME_TRANSPORT_TIMING_LABEL, W as passkeyCredentialIdB64uFromAuthentication, Wt as openOrRejoinWalletCustodyEd25519V1, X as buildRecoveredWalletSessionState, Xt as RouterAbEd25519YaoHttpActivationTransportV1, Y as assertEd25519YaoWarmRecoveryDescriptorStableMaterialContinuity, Yt as RouterAbEd25519YaoClientV1, Z as parsePasskeyEd25519YaoSyncResponseV1, Zt as parseEd25519YaoRecoveryCapabilityV1, _ as setUnlockedCustodyEnvelopeUpgradeSinkV1, _t as nearEd25519YaoOperationMaterialFacts, a as registerWallet, at as joinEvmFamilyCustodyV1, b as walletCustodyCeremonyStepRunner, bt as ed25519AuthorizationIdentityMatchesRuntime, c as exactWalletSessionAuthorityIdentity, ct as recoverNearEd25519CustodyV1, d as validateExactWalletSessionAuthorization, dt as WalletSessionStatusReadScope, en as isRegistrationBenchmarkDiagnosticsEnabled, et as unlockEmailOtpEd25519YaoCapability, f as destroyUnlockedWalletEd25519ExportRootCapabilitiesV1, ft as createRelayerExactWalletSessionStatusPort, g as readUnlockedWalletEd25519ExportRootCapabilityV1, gt as buildPasskeyRouterAbEd25519WalletSessionState, h as readUnlockedEd25519ExportRootLinkingCapabilityV1, ht as buildEmailOtpRouterAbEd25519WalletSessionState, it as establishNearEd25519CustodyV1, j as configurePasskeyCustodySessionCachePersistence, jt as readExactSealedSession, k as requestEmailOtpEnrollmentChallenge, kt as listExactSealedSessionsForWallet, l as persistExactWalletSessionAuthorizationFromEcdsaBootstrap, lt as rejoinEvmFamilyCustodyV1, m as establishUnlockedWalletEd25519ExportRootCapabilityV1, mt as joinCustodyWireFromEnvelopeRecord, nt as unlockEmailOtpWalletCapabilities, ot as joinNearEd25519CustodyV1, p as dropUnlockedWalletEd25519ExportRootCapabilityReferenceV1, pt as sameRuntimePolicyScope$1, q as verifyLinkedDevicePasskeyWalletSession, qt as walletCustodyCacheEnvelopeFromRecordV1, rt as establishEvmFamilyCustodyV1, st as recoverEvmFamilyCustodyV1, t as addWalletSigner, tt as unlockEmailOtpWallet, u as validateExactWalletSessionAuthorityIdentity, ut as rejoinNearEd25519CustodyV1, v as walletCustodyCeremonyTransportFromWorkerContextV1, vt as rebindRouterAbEd25519WalletSessionStateFromExactRuntime, w as preparePasskeyEd25519YaoLocalMaterialRehydrationV1, wt as resolveExactEd25519SealedSessionRuntimeForWallet, x as ed25519YaoLocalMaterialIdentityFromWalletSession, xt as ed25519SealedRuntimeAuthorityRef, y as requestWalletCustodyCeremonyOperation, yt as resolveActiveAuthorizedRouterAbEd25519WalletSessionState, z as readNearProvisioningState, zt as requiredSigningSubjectForExactSigningLane } from "./registration-BZDzDv91.js";
+import { C as parseEnvelopeRevision, D as buildFullOwnerDelegatedWalletAuthorityV1, E as parseUnixMs, P as rejectUnknownFields, S as parseEnvelopeNonceB64u, T as parseSecp256k1CompressedPublicKeyB64u, _ as deriveEvmFamilySigningKeySlotId, a as clampThresholdSessionPolicy, b as parseEd25519PublicKeyB64u, c as resolveWalletUnlockSessionUsesFromRequestedUses, d as normalizeThresholdEd25519ParticipantIds, f as parseThresholdEd25519ParticipantsV1, g as signingRootScopeFromRuntimePolicyScope, h as normalizeRuntimePolicyScope, i as buildEd25519SessionPolicy, k as hasDelegatedWalletPermissionV1, l as THRESHOLD_ED25519_2P_PARTICIPANT_IDS, o as normalizeThresholdRuntimePolicyScope, p as coerceThemeMode$1, r as DEFAULT_UNLOCK_REMAINING_USES, t as DEFAULT_THRESHOLD_SESSION_POLICY, u as buildThresholdEd25519Participants2pV1, v as requireEvmFamilySigningKeySlotId, w as parseKeyCreationSignerSlot, x as parseEnvelopeCiphertextB64u, y as parseDigestField } from "./sessionPolicy-CHiilOAB.js";
+import { B as sameRouterAbEcdsaDerivationPublicIdentityV1, Ct as routerAbMpcMaterialActivationRefFromWire, Dt as activeWalletSessionV1RecordsEqual, E as parseRouterAbEcdsaRegistrationActivationReceiptV1, G as buildPasskeyWalletAuthAuthority, M as routerAbEcdsaDerivationActiveStateId, R as sameRouterAbEcdsaDerivationNormalSigningStateV1, S as parseRouterAbEcdsaOperationStepUpPreparationV1, Tt as sameRouterAbMpcMaterialActivationRef, U as sameRouterAbServerIdentityV1, V as sameRouterAbEcdsaRegistrationActivationReceiptV1, W as buildEmailOtpWalletAuthAuthority, X as isPasskeyWalletAuthAuthority, Y as isEmailOtpWalletAuthAuthority, Z as parseEmailOtpWalletAuthAuthority, _ as parseRouterAbEcdsaDerivationNormalSigningStateV1, _t as parseSdkEcdsaDerivationSigningRootId, et as parseWalletAuthAuthorityRef, ht as computeEcdsaDerivationRoleLocalRelayerKeyId, i as ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, kt as parseWalletSessionOperationCredentialV1, nt as walletAuthAuthorityRef, p as parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1, r as cloneAuthenticatorOptions, t as MAX_DURABLE_CLIENT_PRESIGNATURE_LIFETIME_MS, tt as walletAuthAuthoritiesMatch, v as parseRouterAbEcdsaDerivationPublicCapabilityV1, vt as parseSdkEcdsaDerivationSigningRootVersion, w as parseRouterAbEcdsaPostRegistrationSessionActivationRequestV1, wt as routerAbMpcMaterialActivationRefToWire, y as parseRouterAbEcdsaExplicitExportForwardedResponseV1, yt as parseSdkEcdsaDerivationThresholdKeyId, z as sameRouterAbEcdsaDerivationPublicCapabilityV1 } from "./ecdsaPresignLifecycle-BFOTNYCK.js";
+import { a as buildNearEd25519MpcOperationRef, d as parseMpcWalletSigningQuotaId, g as parseWalletSessionMintId, h as parseWalletSessionId, i as buildEvmEcdsaMpcOperationRef, l as parseDeviceId, m as parseWalletSessionAuthorizationId, n as EVM_ECDSA_MPC_OPERATION_KINDS, o as buildVaultOperationRef, r as NEAR_ED25519_MPC_OPERATION_KINDS, t as CAPABILITY_KINDS } from "./capabilityKinds-hvYqa6S_.js";
+import { d as resolvePrimaryNearRpcUrl, f as alphabetizeStringify, h as sha256HexUtf8, m as sha256BytesUtf8, n as cloneChainConfig, t as chainFamilyFromNetwork, u as resolvePrimaryExplorerUrl } from "./chains-BMh3btVo.js";
+import { a as sha256DigestB64u, o as sha256Utf8DigestB64u, r as parseDigestB64u } from "./canonicalPrimitives-BTHWz80v.js";
+import { a as thresholdEcdsaChainTargetFromRequest, c as toWalletId, i as thresholdEcdsaChainTargetFromConfig, n as nearAccountRefFromAccountId, o as thresholdEcdsaChainTargetKey, s as thresholdEcdsaChainTargetsEqual, t as configuredThresholdEcdsaChainTargets, u as walletSessionRefFromSession } from "./ecdsaChainTarget-Bl-JWyuw.js";
+import { a as WALLET_AUTH_METHODS, d as WALLET_EMAIL_OTP_REGISTRATION_OPERATION, f as WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION, i as SIGNER_SOURCES, l as WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, n as SIGNER_AUTH_METHODS, p as WALLET_EMAIL_OTP_UNLOCK_OPERATION, r as SIGNER_KINDS, s as EMAIL_OTP_CHANNEL, u as WALLET_EMAIL_OTP_EXPORT_OPERATION } from "./signerDomain-IEAVrOrc.js";
+import { a as toIndexedDbChainTargetKey, t as normalizeIndexedDbAccountAddress } from "./normalization-CBt413-z.js";
+import { c as zeroizeIssuedWalletRecoveryCodes, d as deriveWalletRecoveryKeyLifecycleId, f as parseRecoveryCodeReservationId, i as walletRecoverySetRotationWireFromWorkerResultV1, o as deriveRecoveryCodeLocatorV1FromBytes, r as walletRecoveryEcdsaPossessionChallengeDigestB64uV1, s as issueWalletRecoveryCodes, t as parseWalletRecoveryEcdsaPossessionChallengeV1 } from "./wallet-recovery-Bz9qKgaL.js";
+import { A as storeWalletMixedRegistrationData$1, C as storeWalletEcdsaSignerRecords$1, D as storeWalletEmailOtpEcdsaSignerRecords$1, E as storeWalletEmailOtpEcdsaRegistrationData$1, F as getLastSelectedNearAccount, I as getNearAccountProjection, M as WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND, O as storeWalletEmailOtpEd25519RegistrationData$1, S as storeWalletEcdsaRecoverySignerRecords$1, T as storeWalletEd25519RegistrationData$1, _ as rollbackWalletEd25519SignerRegistration$1, a as getLastUser$1, b as storeAuthenticator$1, c as hasPasskeyCredential$1, g as rollbackUserRegistration$1, i as getAllUsers$1, k as storeWalletEmailOtpMixedRegistrationData$1, l as nearAuthenticatorsByAccount$1, n as finalizeWalletEcdsaRegistration$1, o as getUserBySignerSlot$1, r as finalizeWalletEd25519SignerRegistration$1, s as getWalletNearProvisioningState$1, t as activateAuthenticatedWalletState$1, v as setLastUser$1, w as storeWalletEd25519RecoveryRegistrationData$1, x as storeUserData$1, y as setWalletNearProvisioningState$1 } from "./accountLifecycle-BAGG_rbk.js";
+import { t as toAccountId } from "./accountIds-DhIPGOSN.js";
+import { $ as parseLinkedDeviceListRequestV1, $t as parseRouterAbEd25519YaoRecoveryActivationAdmissionReceiptV1, At as serializeQrLinkedDeviceSessionPayloadV5, Bt as ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, Ct as parseLinkedDeviceOwnerAuthorizationRequestV1, D as parseSigningWorkerParticipantRecordV1, Dt as parseLinkedDeviceTargetPreparationRequestV1, E as parseLaneParticipantBindingDigestB64u, Et as parseLinkedDeviceTargetCredentialRegistrationResultV1, F as buildWalletIdentity, Ft as parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationV1, G as computeWalletSessionInstallationReceiptDigestB64u, Gt as ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, H as LINKED_DEVICE_REQUEST_PROOF_MAX_TTL_MS_V1, Ht as ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, I as nearAccountBindingFromRaw, It as ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1, J as parseLocalAuthorityActivationFinalAckV1, K as computeWalletSessionOperationCredentialDigestB64u, N as buildPasskeyAuthScope, Nt as parseLinkedDeviceEd25519SourcePreservingReservationV1, Ot as parseLinkedDeviceTargetPreparationV1, P as buildPasskeyWalletAuthMethodBinding, Pt as parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1, Q as parseLinkedDeviceWalletSessionCredentialDeliveryV1, R as parseRpId, St as parseLinkedDeviceEmailOtpVerificationResultV1, T as parseLaneHolderParticipantRecordV1, Tt as parseLinkedDeviceSessionClaimV1, U as computeLinkedDevicePublicKeyDigestV1, V as LINKED_DEVICE_REQUEST_PROOF_HEADER_V1, W as computeLinkedDeviceTargetPreparationDigestV1, Wt as ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, X as assertLinkedDeviceWalletSessionCredentialDeliveryIntegrityV1, Y as parseLocalAuthorityInstallationReceiptV1, Z as parseLinkedDeviceWalletSessionCredentialDeliveryBindingV1, _ as resolveThresholdSigningRootBindingFromRecord, _n as parseLinkedDeviceEd25519ExportRootRecipientV1, _t as parseLinkedDeviceEmailOtpChallengeResultV1, a as buildEvmFamilyEcdsaWalletKey, at as buildLinkedDeviceSessionCancelClaimedRequestV1, bt as parseLinkedDeviceEmailOtpFactorReleaseEnvelopeV1, c as buildResolvedEvmFamilyEcdsaKey, cn as parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1, ct as buildLinkedDeviceTargetCredentialRegistrationV1, d as deriveEvmFamilyKeyFingerprint, dn as deriveRouterAbEd25519YaoApplicationBindingDigestV1, dt as parseLinkSessionProjectionV1, en as parseRouterAbEd25519YaoRecoveryActivationExecuteRequestV1, et as parseLinkedDeviceListResultV1, f as deriveEvmFamilyKeyFingerprintFromPublicFacts, ft as parseLinkSessionTransportEventV1, gn as parseLinkedDeviceEd25519ExportRootRecipientPublicKeyB64u, gt as parseLinkedDeviceEmailOtpChallengeResendRequestV1, hn as parseLinkedDeviceEd25519ExportRootPackageV1, ht as parseLinkedDeviceEmailOtpBaseFactorResolutionResultV1, i as buildEvmFamilyEcdsaSessionLanePolicy, it as buildLinkedDeviceApprovalV1, jt as parseCommittedAuthorityPackagesV1, k as buildEmailOtpWalletAuthMethodBinding, kt as parseQrLinkedDeviceSessionPayloadV5, lt as buildQrLinkedDeviceSessionPayloadV5, m as evmFamilyEcdsaWalletKeyToIdentity, mn as buildLinkedDeviceEd25519ExportRootTransferBindingV1, mt as parseLinkedDeviceApprovalResultV1, n as buildBaseEvmFamilyEcdsaKeyIdentity, nn as parseRouterAbEd25519YaoRecoveryActivationResultV1, nt as parseLinkedDeviceRevokeResultV1, on as parseRouterAbEd25519YaoRegistrationActivationResultV1, ot as buildLinkedDeviceSessionCancelUnclaimedRequestV1, p as deriveEvmFamilySigningKeySlotId$1, pn as LINKED_DEVICE_ED25519_EXPORT_ROOT_TRANSFER_ALG_V1, pt as parseLinkedDeviceApprovalDeliveryV1, q as parseActivateInstalledAuthorityResultV1, r as buildEvmFamilyEcdsaRecoveredMaterialLanePolicy, rn as parseRouterAbEd25519YaoRecoveryAdmissionRequestV1, s as buildPasskeyEcdsaAuthBinding, st as buildLinkedDeviceSessionClaimRequestV1, t as assertMatchingVerifiedEcdsaPublicFacts, tn as parseRouterAbEd25519YaoRecoveryActivationReceiptV1, tt as parseLinkedDeviceRevokeRequestV1, ut as parseLinkDevicePublicKeyB64u, v as resolveThresholdSigningRootBindingFromRuntimePolicyScope, vn as serializeLinkedDeviceEd25519ExportRootTransferBindingV1, vt as parseLinkedDeviceEmailOtpChallengeStartRequestV1, w as parseOwnerLaneParticipantContinuityV1, wt as parseLinkedDeviceOwnerAuthorizationSourceV1, x as toRpId, xt as parseLinkedDeviceEmailOtpVerificationGrantV1, y as toEvmFamilyEcdsaKeyHandle, yn as assertNeverLinkSessionStateV1, yt as parseLinkedDeviceEmailOtpChallengeVerifyRequestV1, zt as ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1 } from "./evmFamilyEcdsaIdentity-Co5XDcEA.js";
+import { C as computeWalletAuthMethodRevokeOperationFingerprintV1, E as parseExactAdministeredSignerManifestV1, S as buildWalletAuthMethodRecordV2, T as sameWalletAuthMethodRecordV2, d as parseWalletSignerActivationSetV1, f as replaceActiveWalletAuthorityEd25519MaterialActivationV1, n as computeWalletSignerActivationSetDigestB64u, o as isActiveRecoveredWalletAuthorityV1, r as encodeWalletSignerActivationSetV1, t as computeWalletAuthorityDigestB64u, w as parseWalletAuthMethodRecordV2 } from "./walletAuthority-BQBxgUBn.js";
+import "./encoders-D8d07vpx.js";
+import { a as parseNearEd25519SigningKeyId, i as nearEd25519SigningKeyIdFromString, o as walletIdFromString, r as createServerAllocatedWalletId } from "./registrationIds-DLSdEKSv.js";
+import { a as buildEmailOtpEnvelopeFactor, c as buildPasskeyEnvelopeFactor, d as parsePasskeyCustodyEnvelopeRecord, h as isWalletCustodySeedBinding, i as buildActiveEnvelopeLifecycle, l as custodyEnvelopeBindingJsonV1, m as buildEd25519YaoClientRootBinding, o as buildMethodBoundEnvelopeOwnership, s as buildPasskeyCustodyEnvelopeRecord } from "./passkey-custody-Bk1jAknm.js";
+import { a as parseEcdsaRoleLocalPersistedMaterialRef, d as parseEcdsaRelayerKeyId, f as parseSigningSessionSealKeyVersion, i as parseEcdsaRoleLocalMaterialHandle, l as parseEcdsaClientVerifyingShareB64u, n as parseEcdsaRoleLocalBindingDigest, r as parseEcdsaRoleLocalDurableMaterialRef, s as parseEcdsaThresholdKeyId, u as parseEcdsaKeyHandle } from "./keyMaterialBrands-CX41hur6.js";
+import { a as SIGNING_SESSION_EXPIRY_DETECTION_SOURCES, d as createLinkDeviceFlowEvent, f as createNearProvisioningStateChangedEvent, g as createUnlockFlowEvent, h as createSigningSessionExpiredEvent, i as RegistrationEventPhase, l as createAccountSyncFlowEvent, m as createSigningFlowEvent, n as KeyExportEventPhase, o as SigningEventPhase, p as createRegistrationFlowEvent, r as LinkDeviceEventPhase, s as UnlockEventPhase, t as AccountSyncEventPhase, u as createKeyExportFlowEvent } from "./sdkSentEvents-MqDkbQg1.js";
+import { A as openWalletAuthorityLinkedSignerMaterialV1, a as loadWalletCustodyEd25519MaterialV1, b as walletSessionAuthorizations, d as configureIndexedDB, f as createIndexedDBNonceLaneCoordinationStore, g as IndexedDbEcdsaCapabilityManifestStore, h as readEmailOtpProviderSubjectForWalletV1, i as deleteWalletCustodyEd25519MaterialV1, j as parseWalletAuthorityLinkedSignerMaterialRecordV1, k as computeWalletEcdsaKeyFactsInventoryChallengeDigestB64u, l as storeAccountKeyMaterial, m as publishEd25519YaoPublicCapabilityReferenceAndLane, n as importWalletCustodyEcdsaContinuity, o as persistWalletCustodyEd25519MaterialV1, p as IndexedDbEd25519YaoPublicCapabilityReferenceStore, s as getAccountKeyMaterial, t as copyWalletCustodyEcdsaContinuityToAuthMethod, u as IndexedDBManager, y as WalletSessionAuthorizationUpgradeRequiredError } from "./walletCustodyEcdsaContinuity-Hn4ORIbf.js";
+import { t as parseSignerSlot } from "./signerSlot-_ovonwVX.js";
+import "./keccak-DUL3d8SF.js";
+import { a as SIGNING_SESSION_SEAL_ALG, l as parseRouterAbEd25519NormalSigningState, n as PASSKEY_PRF_SECOND_SALT_V1, o as SIGNING_SESSION_SEAL_GROUP_ID, r as ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND, t as PASSKEY_PRF_FIRST_SALT_V1 } from "./signingSessionSeal-Cu-GHm6y.js";
+import { c as registrationNearEd25519BranchKey, d as sponsoredNamedNearAccountProvisioning, i as implicitNearAccountProvisioning, t as NEAR_ED25519_YAO_KEY_VERSION_V1 } from "./registrationSignerPlan-CAikVZZQ.js";
+import { r as computeAddAuthMethodIntentDigestB64u } from "./registrationIntent-D0PxwEY4.js";
+import { c as signingLaneAuthMethod, n as SigningOperationIntent, r as SigningSessionIds, s as signingLaneAuthBindingKey } from "./types-Dx9fczU7.js";
+import { t as demoEmailOtpCodeFromDelivery } from "./challengeDelivery-Dd0586fo.js";
+import { S as parseEmailOtpWorkerIssuedSessionHandle, _ as DEFAULT_CONFIRMATION_CONFIG, a as createSigningPlannerDecisionTraceEvent, b as isWorkerSuccess, c as nearImplicitAccountFundingPort, d as mintEd25519WalletSession, f as nearOperationStepUpPreparationPort, g as buildNearMessageDisplayModel, h as buildNearDisplayModel, i as withThresholdEd25519CommitQueue, l as buildThresholdEd25519WebAuthnPrfSecretSource, m as getLastLoggedInSignerSlot, o as planSigningSession, p as deriveThresholdEd25519ClientVerifyingShareWasm, r as resolveThresholdEd25519CommitQueueKey, s as parseAndValidateRegistrationCredentialConfirmationPayload, t as signNear, u as localPrfFirstForEd25519WalletSessionMintAuthorization, v as isWorkerError, x as parseEmailOtpEcdsaExportWorkerIssuedSessionHandle, y as isWorkerProgress } from "./signNear-Bblwn2kT.js";
+import { t as executeWorkerOperation } from "./executeWorkerOperation-Cl9whMK7.js";
+import { A as thresholdEcdsaRoleLocalComputeSignatureShareFromPresignatureHandleWasm, B as SignerWorkerOperationError, C as prepareLinkedDeviceEcdsaSourceContributionWasm, D as storeLinkedDeviceEcdsaHolderMaterialWasm, E as storeEcdsaRoleLocalSigningMaterialWasm, F as thresholdEcdsaRoleLocalPresignSessionStepWasm, H as getSignerWorkerOperationCoreCode, I as thresholdEcdsaRoleLocalReservePresignatureWasm, L as verifyRouterAbEcdsaRegistrationClientProofsWasm, M as thresholdEcdsaRoleLocalListAvailablePresignaturesWasm, N as thresholdEcdsaRoleLocalPresignSessionAbortWasm, O as thresholdEcdsaRoleLocalAdmitPresignatureWasm, P as thresholdEcdsaRoleLocalPresignSessionInitFromMaterialHandleWasm, R as EcdsaDerivationClientCustomRequestType, S as prepareEcdsaClientBootstrapCommandWasm, T as signWalletRecoveryEcdsaMaterialPossessionProofWasm, U as getSignerWorkerOperationErrorCode, V as WorkerControlMessage, _ as finalizeEcdsaHolderOrdinaryExportWasm, a as resolveRouterAbEcdsaDerivationPresignaturePoolPolicy, b as openEcdsaRoleLocalSigningMaterialWasm, c as clearLinkedDeviceEcdsaHolderMaterialsWasm, d as createEcdsaHolderOrdinaryExportRequestWasm, f as createRouterAbEcdsaPostRegistrationCeremonyWasm, g as finalizeEcdsaClientBootstrapCommandWasm, h as destroyLinkedDeviceEcdsaHolderMaterialsWasm, i as clearRouterAbEcdsaDerivationClientPresignaturesForWallet, j as thresholdEcdsaRoleLocalDestroyPresignatureWasm, k as thresholdEcdsaRoleLocalCommitPresignatureWasm, l as closeRouterAbEcdsaPostRegistrationCeremonyWasm, m as destroyLinkedDeviceEcdsaHolderMaterialWasm, o as scheduleRouterAbEcdsaDerivationClientPresignaturePoolRefill, p as createRouterAbEcdsaRegistrationCeremonyWasm, r as clearAllRouterAbEcdsaDerivationClientPresignatures, s as waitForRouterAbEcdsaDerivationClientPresignaturePoolReady, u as closeRouterAbEcdsaRegistrationCeremonyWasm, v as finalizeRouterAbEcdsaExplicitExportWasm, w as reconcileCanonicalEcdsaActivationWasm, x as persistInitialCanonicalEcdsaActivationWasm, y as finalizeRouterAbEcdsaRegistrationActivationWasm, z as EcdsaPresignClientRequestType } from "./secp256k1-el9aE4Sv.js";
+import { c as serializeRegistrationCredentialWithPRF, i as normalizeAuthenticationCredential, l as getPrfFirstB64uFromCredential, n as getPrfSecondSaltV1, o as redactedPasskeyRegistrationCredential, r as isSerializedRegistrationCredential, s as serializeAuthenticationCredentialWithPRF, t as getPrfFirstSaltV1, u as redactCredentialExtensionOutputs } from "./helpers-ZrowMnev.js";
+import { C as validateTempoFeeToken, D as requestParentDomainWebAuthn, E as executeWebAuthnWithParentFallbacksSafari, S as requireTempoFeeTokenPreferenceSigningRequest, T as WindowParentDomainWebAuthnClient, b as parseTempoEvmAddress, d as walletIframeUnlockRequestFromLoginHooks, f as needsExplicitActivation, p as OverlayController, r as parseWalletIframeExactSessionIdentity, x as readTempoFeeTokenPreference, y as buildTempoSetUserTokenRequest } from "./exactSessionState-CiD5fBEs.js";
+import { C as buildEcdsaRoleLocalPublicFacts, D as parseEcdsaRoleLocalReadyRecord, E as ecdsaRoleLocalReadyRecordStorageKeyFacts, S as buildEcdsaRoleLocalPasskeyAuthMethod, T as ecdsaRoleLocalReadyRecordStorageKey, k as serializeEcdsaRoleLocalReadyRecord, w as ecdsaRoleLocalReadyRecordMatchesInput, x as buildEcdsaRoleLocalEmailOtpAuthMethod, y as routerAbEcdsaDerivationPublicCapabilitiesEqual } from "./ecdsaCapabilityManifest-kzO_fW09.js";
+import { i as buildNearAccountRefs } from "./profileAccountProjection-uZVJuBvS.js";
+import { A as parseProfileContinuityEcdsaWarmKey, D as startWalletAddAuthMethod, S as requestAddAuthMethodEmailOtpChallenge, T as revokeWalletAuthMethod, _ as finalizeWalletAddAuthMethod, a as buildRehydrateMaterialActivationHydrationPlan, g as fetchWalletEcdsaKeyFactsInventoryWithWebAuthn, h as fetchWalletEcdsaKeyFactsInventoryWithOperationCredential, i as buildBlockedMpcCapabilityHydrationPlan, k as activateRouterAbEcdsaPostRegistrationSession, l as computeWalletCustodyAdminChallengeDigest, n as nearEd25519YaoRuntimeRef, o as buildUseLiveRuntimeHydrationPlan, p as createWalletAddAuthMethodIntent, r as resolveNearEd25519YaoCapabilityHydrationV1, t as nearEd25519YaoMaterialActivationFromMetadata, y as fundImplicitNearAccountForTesting } from "./nearEd25519YaoMaterialActivation-DPb0s3hQ.js";
+import { n as buildRelayerJsonPostRequestInit, r as normalizeRelayerBaseUrl, t as buildBearerAuthorizationHeader } from "./relayerHttp-VC8Holz1.js";
+import { a as exactEd25519SigningLaneIdentity, c as exactSigningLaneIdentityKey, f as nearEd25519SignerBindingFromBoundaryFields, h as parseExactEd25519ExportMaterialIdentity, i as exactEd25519ExportMaterialIdentity, l as exactSigningLaneIdentityMatches, m as parseExactEcdsaSigningLaneIdentity, n as exactEcdsaSigningLaneIdentity, p as nearProtocolProjectionFromExactLane, t as buildEvmFamilyEcdsaSignerBinding, u as exactSigningLaneWalletId } from "./exactSigningLaneIdentity-DQeqPMST.js";
+import { _ as isEmailOtpPendingSingleUseAuthContext, a as nearEd25519SessionMatchesMaterialActivation, b as laneCandidateStateFromRuntimePolicy, d as buildEmailOtpAuthContextForWalletAuthMethod, f as emailOtpAuthContextConsumedAtMs, g as emailOtpAuthContextRetention, h as emailOtpAuthContextProviderUserId, i as classifyNearEd25519WalletSessionAuthorization, m as emailOtpAuthContextProvider, n as buildAuthorizationRequiredNearEd25519YaoSigningPreparation, p as emailOtpAuthContextEmailHashHex, r as buildAuthorizedNearEd25519YaoSigningPreparation, t as buildActiveNearEd25519WalletSessionAuthorization, u as buildEmailOtpAuthContextForCanonicalWallet, v as isEmailOtpSessionAuthContext, x as selectedEcdsaLane } from "./nearEd25519YaoSigningPreparation-BeD-SmbK.js";
+import { a as throwEmailOtpSigningSessionAuthStateError, i as emailOtpEcdsaBootstrapRouteAuthFromRoutePlan, n as buildEmailOtpSigningSessionRoutePlan, o as buildEmailOtpRoutePlan, r as buildFreshEmailOtpRoutePlan, t as assertEmailOtpSigningSessionAuthLane } from "./routePlan-D59x5xzQ.js";
+import { n as generateSessionId, t as cacheCredentialBoundarySetupExportPrfFirst } from "./prfCache-wqQSjYLn.js";
+import { l as emitSigningSessionFlowFailure, u as emitSigningSessionFlowTrace } from "./trace-rHe0wz7q.js";
+import { t as webAuthnPromptCoordinator } from "./webauthnPromptCoordinator-L96oVvLz.js";
+import { a as toActionArgsWasm, t as ActionType } from "./actions-CCvThiKe.js";
+import { A as UserConfirmMessageType, C as getSignIntentDigestSubject, E as getTxCount, M as normalizeConfirmationConfig, S as getNearAccountId, T as getSigningAuthMode, _ as sendConfirmProgress, a as formatNearAccountFundingProgressNotice, b as assertSigningRequestContext, c as collectAuthenticationCredentialForChallengeB64u, d as collectAuthenticationCredentialForWalletChallengeB64u, f as ERROR_MESSAGES, g as sanitizeForPostMessage, h as parseTransactionSummary, i as formatNearAccountFundingNotice, j as UserConfirmationType, m as isUserCancelledUserConfirm, n as createConfirmTxFlowAdapters, o as __isWalletIframeHostMode, p as createUserConfirmScopedWorker, r as mountConfirmUI, s as __setWalletIframeHostMode, t as createConfirmSession, v as sendConfirmResponse, w as getSignTransactionPayload, x as getIntentDigest, y as assertNoForbiddenMainThreadSigningSecrets } from "./adapters-B4JeK1nJ.js";
+import { i as orderActionForDigest, n as computeUiIntentDigestFromNep413, r as computeUiIntentDigestFromTxs } from "./intentDigest-CvOSNlCH.js";
+import { r as showWalletRecoveryCodesUi, t as pendingWalletRecoveryCodeBackupRepository } from "./pendingWalletRecoveryCodeBackup-DLzBb3WQ.js";
+import { t as MinimalNearClient } from "./NearClient-DY4NfHeD.js";
+import { t as createEvmClient } from "./EvmClient-f3gUhS2L.js";
+import { n as resolveAppearanceTheme, o as resolveThemePalette } from "./configHelpers-vAQCzUD0.js";
+import { n as getDefaultCspNonce, t as createCspStylesheetManager } from "./csp-stylesheet-btENhsNp.js";
+import { r as buildConfigsFromEnv } from "./defaultConfigs-B3c16M_8.js";
+import { t as createNonceCoordinator } from "./NonceCoordinator-4XWPhYww.js";
+import { i as resumePendingWalletRecoveries } from "./walletRecoveryCommit-sjGNTHUj.js";
+import { i as loadWebAuthnP256EngineCtor, n as loadSignEvmFamilyWithUiConfirmForTempo, r as loadSignEvmWithUiConfirm, t as loadSecp256k1EngineCtor } from "./signerLoader-D7Aey0FD.js";
+import { A as authorizeEvmFamilyEcdsaSigningCapability, B as listLinkedEcdsaHolderRuntimesV1, C as buildExactPasskeyOwnerLaneScope, D as buildPersistedEcdsaRoleLocalMaterial, E as resolveExactWalletAuthAuthority$1, F as signingAuthorizationFromPreprocessing, H as resolveLinkedEcdsaHolderRuntimeV1, I as ensureSealedRefreshStartupParityForThresholdEcdsaBootstrap, L as isRetryableSealedRefreshCapabilityFetchError, M as buildEcdsaPreprocessingCapability, N as buildExactEcdsaDirectCapabilityRuntime, O as ecdsaRoleLocalPersistedMaterialSource, P as buildExactEvmFamilyWalletSessionAuthorization, R as clearLinkedEcdsaHolderRuntimesV1, S as buildExactLinkedEmailOtpOwnerLaneScope, T as resolveExactOwnerLaneScope, V as removeLinkedEcdsaHolderRuntimeV1, _ as resolveEmailOtpEcdsaSigningSessionAuth, a as reportTempoFinalized, b as withThresholdEcdsaSigningQueue, c as resolveActiveWalletAuthorityEcdsaRuntimeV1, d as createActiveEcdsaCapabilityRuntimeForChainResolver, f as createActiveEcdsaCapabilityRuntimeResolver, g as requestEmailOtpSigningSessionChallenge$1, h as refreshEmailOtpSigningSession$1, i as reportTempoDroppedOrReplaced, j as buildCanonicalEvmFamilyEcdsaSigningCapability, k as resolveEcdsaRoleLocalMaterial, l as issueEcdsaOperationStepUpAuthorization, m as resolveExactEcdsaSealedRuntime, n as reportTempoBroadcastAccepted, o as signEvmFamily, p as resolveExactEcdsaCapabilityRuntime, r as reportTempoBroadcastRejected, t as reconcileTempoNonceLane, u as prepareEcdsaOperationStepUp, v as clearThresholdEcdsaSigningQueue, w as isOwnerRelinkRequiredError, x as buildExactEcdsaPasskeyOwnerLaneScope, y as resolveThresholdEcdsaSigningQueueKey, z as installLinkedEcdsaHolderRuntimeV1 } from "./signEvmFamily-e4IWWsZs.js";
+import { n as SigningAuthPlanKind } from "./promptText-CuRa_ivd.js";
+import { C as isSigningOperationReviewApprovedStateKind, d as fullWalletLoginRequired, f as invalidWalletSigningMaterial, m as walletSigningMaterialBlockError, p as isWalletSigningStateFailure, v as SigningOperationInteractionEventKind } from "./operationFingerprint-C8Trar4R.js";
+import { f as WalletSessionFailureError, g as WALLET_SESSION_FAILURE_CODES, h as walletSessionFailureFromError, m as walletSessionFailureFromCode } from "./routerAbNormalSigning-fhvpDtmY.js";
+import { _ as parseWalletSessionAuthorizationBoundary, d as availableEd25519SigningLaneAuthMethod, f as ecdsaAvailableLaneCandidatesForTarget, g as readAvailableSigningLanes, h as isConcreteAvailableSigningLane, l as activeWalletAuthorityAvailableLaneFromProjection, m as ecdsaAvailableLaneIdentityKey, p as ecdsaAvailableLaneForTarget, u as availableEcdsaSigningLaneAuthMethod, v as requireAuthoritativeExpiredWalletSessionAuthorizationBoundary } from "./transactionState-DP9O8F6f.js";
+import { t as bytesToHex } from "./bytes-qKxKn4gg.js";
+import { c as createEvmNonceBackend, i as PENDING_CHALLENGE_B64U, o as clearIntentDigestPreparation, s as consumeIntentDigestPreparation, t as EvmFamilyEcdsaMaterialSupersededError } from "./signingFlow-rZfPegH9.js";
+import { n as removeExportViewerHostIfPresent, t as isExportViewerSessionOpen } from "./export-viewer-host-ZqA2Yz3H.js";
+import { i as observeTransactionLifecycleReport, n as failTransactionActivity, r as observeTransactionActivity, t as beginTransactionActivity } from "./transaction-activity-CSMCveBn.js";
+import "./jsxRuntime.module-CuH5ZEIA.js";
+import { t as handleRegistrationFlow } from "./registration-BzVHODuD.js";
+import { i as rotateWalletRecoverySet, n as readWalletRecoveryCodeStatus, r as requestWalletCustodyEmailOtpChallenge, t as acknowledgeWalletRecoveryBackup } from "./walletRecoveryRotate-BgLlW5ih.js";
 //#region src/core/walletRuntimePaths/workers.ts
 /**
 * Resolve the base origin for worker scripts.
@@ -160,7 +164,7 @@ function defaultWorkerPath$1(worker) {
 }
 //#endregion
 //#region src/core/platform/signerCoreCommandAdapters.ts
-function requireBase64UrlBytes$1(value, field, byteLength) {
+function requireBase64UrlBytes(value, field, byteLength) {
 	const normalized = String(value || "").trim();
 	if (!normalized) throw new Error(`[signer-core-command] ${field} is required`);
 	if (base64UrlDecode(normalized).length !== byteLength) throw new Error(`[signer-core-command] ${field} must decode to ${byteLength} bytes`);
@@ -182,15 +186,15 @@ function requireSignerCoreCommandString(value, field) {
 	return normalized;
 }
 function parseDerivationClientSharePublicKey33B64u(value) {
-	return requireBase64UrlBytes$1(value, "derivationClientSharePublicKey33B64u", 33);
+	return requireBase64UrlBytes(value, "derivationClientSharePublicKey33B64u", 33);
 }
-function parseRelayerEcdsaDerivationPublicKey33B64u$1(value) {
-	return requireBase64UrlBytes$1(value, "relayerPublicKey33B64u", 33);
+function parseRelayerEcdsaDerivationPublicKey33B64u(value) {
+	return requireBase64UrlBytes(value, "relayerPublicKey33B64u", 33);
 }
-function parsePublicKey33B64u$1(value, field) {
-	return requireBase64UrlBytes$1(value, field, 33);
+function parsePublicKey33B64u(value, field) {
+	return requireBase64UrlBytes(value, field, 33);
 }
-function parseEthereumAddress$1(value) {
+function parseEthereumAddress(value) {
 	const normalized = String(value || "").trim();
 	if (!/^0x[0-9a-fA-F]{40}$/.test(normalized)) throw new Error("[signer-core-command] ethereumAddress must be 0x-prefixed 20-byte hex");
 	return normalized;
@@ -229,7 +233,7 @@ function toGeneratedPrepareEcdsaClientBootstrapCommand(input) {
 		},
 		secretSource: {
 			kind: "threshold_prf_x_client_base",
-			xClientBaseB64u: requireBase64UrlBytes$1(input.secretSource.xClientBaseB64u, "secretSource.xClientBaseB64u", 32)
+			xClientBaseB64u: requireBase64UrlBytes(input.secretSource.xClientBaseB64u, "secretSource.xClientBaseB64u", 32)
 		}
 	};
 }
@@ -239,14 +243,14 @@ function parseGeneratedPrepareEcdsaClientBootstrapOutput(input) {
 	return {
 		pendingStateBlob: parsePendingStateBlob(input.pendingStateBlob),
 		clientBootstrap: {
-			contextBinding32B64u: requireBase64UrlBytes$1(input.clientBootstrap.contextBinding32B64u, "contextBinding32B64u", 32),
+			contextBinding32B64u: requireBase64UrlBytes(input.clientBootstrap.contextBinding32B64u, "contextBinding32B64u", 32),
 			derivationClientSharePublicKey33B64u,
 			clientShareRetryCounter: input.clientBootstrap.clientShareRetryCounter,
 			participantId: 1
 		},
 		publicFacts: {
 			derivationClientSharePublicKey33B64u: parseDerivationClientSharePublicKey33B64u(input.publicFacts.derivationClientSharePublicKey33B64u),
-			clientVerifyingShareB64u: parsePublicKey33B64u$1(input.publicFacts.clientVerifyingShareB64u, "clientVerifyingShareB64u")
+			clientVerifyingShareB64u: parsePublicKey33B64u(input.publicFacts.clientVerifyingShareB64u, "clientVerifyingShareB64u")
 		}
 	};
 }
@@ -267,12 +271,12 @@ function parseGeneratedFinalizeEcdsaClientBootstrapOutput(input) {
 	return {
 		stateBlob: parseReadyStateBlob(input.stateBlob),
 		publicFacts: {
-			contextBinding32B64u: requireBase64UrlBytes$1(input.publicFacts.contextBinding32B64u, "contextBinding32B64u", 32),
+			contextBinding32B64u: requireBase64UrlBytes(input.publicFacts.contextBinding32B64u, "contextBinding32B64u", 32),
 			derivationClientSharePublicKey33B64u: parseDerivationClientSharePublicKey33B64u(input.publicFacts.derivationClientSharePublicKey33B64u),
-			clientVerifyingShareB64u: parsePublicKey33B64u$1(input.publicFacts.clientVerifyingShareB64u, "clientVerifyingShareB64u"),
-			relayerPublicKey33B64u: parseRelayerEcdsaDerivationPublicKey33B64u$1(input.publicFacts.relayerPublicKey33B64u),
-			groupPublicKey33B64u: parsePublicKey33B64u$1(input.publicFacts.groupPublicKey33B64u, "groupPublicKey33B64u"),
-			ethereumAddress: parseEthereumAddress$1(input.publicFacts.ethereumAddress)
+			clientVerifyingShareB64u: parsePublicKey33B64u(input.publicFacts.clientVerifyingShareB64u, "clientVerifyingShareB64u"),
+			relayerPublicKey33B64u: parseRelayerEcdsaDerivationPublicKey33B64u(input.publicFacts.relayerPublicKey33B64u),
+			groupPublicKey33B64u: parsePublicKey33B64u(input.publicFacts.groupPublicKey33B64u, "groupPublicKey33B64u"),
+			ethereumAddress: parseEthereumAddress(input.publicFacts.ethereumAddress)
 		}
 	};
 }
@@ -301,22 +305,6 @@ function signerCryptoCommandFailure(code, message) {
 		message
 	};
 }
-function requiredString$1(value, field) {
-	if (typeof value !== "string") throw new Error(`ECDSA client bootstrap state is missing ${field}`);
-	const normalized = value.trim();
-	if (!normalized) throw new Error(`ECDSA client bootstrap state is missing ${field}`);
-	return normalized;
-}
-function requiredNonNegativeInteger(value, field) {
-	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw new Error(`${field} must be a non-negative safe integer`);
-	return value;
-}
-function requireBase64UrlBytes(value, field, byteLength) {
-	const normalized = String(value || "").trim();
-	if (!normalized) throw new Error(`${field} is required`);
-	if (base64UrlDecode(normalized).length !== byteLength) throw new Error(`${field} must decode to ${byteLength} bytes`);
-	return normalized;
-}
 function decodeBase64UrlArrayBuffer(value) {
 	const decoded = base64UrlDecode(value);
 	const out = new ArrayBuffer(decoded.byteLength);
@@ -352,17 +340,6 @@ function browserPasskeyCreationOptions(options) {
 		} } }
 	};
 }
-function parsePublicKey33B64u(value, field) {
-	return requireBase64UrlBytes(value, field, 33);
-}
-function parseRelayerEcdsaDerivationPublicKey33B64u(value) {
-	return parsePublicKey33B64u(value, "ECDSA relayer DERIVATION public key");
-}
-function parseEthereumAddress(value) {
-	const normalized = String(value || "").trim();
-	if (!/^0x[0-9a-fA-F]{40}$/.test(normalized)) throw new Error("ECDSA relayer public identity has invalid ethereumAddress");
-	return normalized;
-}
 function isNativeBindingFailureMessage(message) {
 	return /wasm (initialization|initialize|instantiation)|webassembly|module_or_path|failed to (load|compile|instantiate) wasm|derivation client wasm initialization failed/i.test(message);
 }
@@ -388,17 +365,6 @@ function mapFinalizeEcdsaCommandError(error) {
 	if (/relayer|public identity|group public key|ethereum address|threshold public key/i.test(message)) return signerCryptoCommandFailure("public_identity_mismatch", message);
 	return signerCryptoCommandFailure("invalid_pending_state", message);
 }
-function parseRelayerPublicIdentity(input) {
-	if (input === null || typeof input !== "object" || Array.isArray(input)) throw new Error("ECDSA relayer public identity must be an object");
-	if (Object.keys(input).sort().join(",") !== "ethereumAddress,groupPublicKey33B64u,relayerKeyId,relayerPublicKey33B64u,relayerShareRetryCounter") throw new Error("ECDSA relayer public identity fields are invalid");
-	return {
-		relayerKeyId: requiredString$1(Reflect.get(input, "relayerKeyId"), "relayerKeyId"),
-		relayerPublicKey33B64u: parseRelayerEcdsaDerivationPublicKey33B64u(requiredString$1(Reflect.get(input, "relayerPublicKey33B64u"), "relayerPublicKey33B64u")),
-		groupPublicKey33B64u: parsePublicKey33B64u(requiredString$1(Reflect.get(input, "groupPublicKey33B64u"), "groupPublicKey33B64u"), "groupPublicKey33B64u"),
-		ethereumAddress: parseEthereumAddress(Reflect.get(input, "ethereumAddress")),
-		relayerShareRetryCounter: requiredNonNegativeInteger(Reflect.get(input, "relayerShareRetryCounter"), "relayerShareRetryCounter")
-	};
-}
 function createBrowserDurableRecordStore(indexedDB) {
 	return {
 		kind: "durable_record_store",
@@ -745,11 +711,6 @@ function createBrowserSignerCryptoPort(workerCtx) {
 		},
 		async finalizeEcdsaClientBootstrap(input) {
 			if (input.pendingStateBlob.kind !== "ecdsa_role_local_pending_state_blob_v1" || input.pendingStateBlob.curve !== "secp256k1" || input.pendingStateBlob.encoding !== "base64url" || input.pendingStateBlob.producer !== "signer_core") return signerCryptoCommandFailure("invalid_pending_state", "ECDSA client bootstrap pending blob envelope is invalid");
-			try {
-				parseRelayerPublicIdentity(input.relayerPublicIdentity);
-			} catch (error) {
-				return signerCryptoCommandFailure("invalid_relayer_public_identity", errorMessage(error));
-			}
 			if (!workerCtx) return signerCryptoInvocationFailure("unavailable", "ECDSA client bootstrap worker context is unavailable");
 			try {
 				return {
@@ -891,9 +852,8 @@ let DeviceLinkingErrorCode = /* @__PURE__ */ function(DeviceLinkingErrorCode) {
 	DeviceLinkingErrorCode["INSUFFICIENT_BALANCE"] = "INSUFFICIENT_BALANCE";
 	DeviceLinkingErrorCode["REGISTRATION_FAILED"] = "REGISTRATION_FAILED";
 	/**
-	* R103 zero-prompt handoff: Device 1 is not unlocked with the custody
-	* capability linking needs. The QR flow never prompts; the user unlocks the
-	* wallet and scans again.
+	* Device 1 is not unlocked with the custody capability linking needs. The
+	* QR flow never prompts; the user unlocks the wallet and scans again.
 	*/
 	DeviceLinkingErrorCode["WALLET_UNLOCK_REQUIRED"] = "WALLET_UNLOCK_REQUIRED";
 	/**
@@ -950,10 +910,9 @@ var Ed25519YaoPageLifecycleOwner = class {
 * this run registered under, and the Router's activation result.
 *
 * **Every identity here comes from the Router's receipt, not from this side.**
-* That matters most for `materialActivation`: it is a Refactor 90 identity, and
-* the boundary that mints it is the Router, exactly as on the PRF path. Nothing
-* here invents one — a locally minted activation ref would be a second owner
-* for state Refactor 90 owns.
+* That matters most for `materialActivation`: the boundary that mints it is the
+* Router, exactly as on the PRF path. Nothing here invents one — a locally
+* minted activation ref would give that state a second owner.
 */
 function walletCustodyEd25519ActiveClientMetadataV1(input) {
 	let raw;
@@ -1405,15 +1364,6 @@ function materialActivationKey(activation) {
 }
 //#endregion
 //#region src/core/signingEngine/session/passkey/ed25519YaoWarmRecovery.ts
-function requireRecord$3(value, label) {
-	if (!isPlainObject(value)) throw new Error(`${label} must be an object`);
-	return value;
-}
-function requireString$3(value, label) {
-	const parsed = typeof value === "string" ? value.trim() : "";
-	if (!parsed) throw new Error(`${label} is required`);
-	return parsed;
-}
 function requirePositiveInteger$2(value, label) {
 	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 1) throw new Error(`${label} must be a positive integer`);
 	return value;
@@ -1574,16 +1524,16 @@ async function parseWarmRecoveryDescriptor(args) {
 	exactResponseKeys(response, WARM_RECOVERY_RESPONSE_KEYS);
 	if (response.kind !== "router_ab_ed25519_yao_v2_session_bootstrap_v1") throw new Error("warm recovery bootstrap response kind is invalid");
 	const restore = record.ed25519Restore;
-	const walletId = requireString$3(response.walletId, "response.walletId");
-	const nearAccountId = requireString$3(response.nearAccountId, "response.nearAccountId");
-	const nearEd25519SigningKeyId = requireString$3(response.nearEd25519SigningKeyId, "response.nearEd25519SigningKeyId");
+	const walletId = requireTrimmedString(response.walletId, "response.walletId");
+	const nearAccountId = requireTrimmedString(response.nearAccountId, "response.nearAccountId");
+	const nearEd25519SigningKeyId = requireTrimmedString(response.nearEd25519SigningKeyId, "response.nearEd25519SigningKeyId");
 	const signerSlot = requirePositiveInteger$2(response.signerSlot, "response.signerSlot");
-	const thresholdSessionId = requireString$3(response.thresholdSessionId, "response.thresholdSessionId");
-	const signingWorkerId = requireString$3(response.signingWorkerId, "response.signingWorkerId");
+	const thresholdSessionId = requireTrimmedString(response.thresholdSessionId, "response.thresholdSessionId");
+	const signingWorkerId = requireTrimmedString(response.signingWorkerId, "response.signingWorkerId");
 	const thresholdExpiresAtMs = requirePositiveInteger$2(response.thresholdExpiresAtMs, "response.thresholdExpiresAtMs");
 	const participantIds = requireParticipantIds$1(response.participantIds);
-	const responseRuntimePolicyScope = normalizeRuntimePolicyScope(requireRecord$3(response.runtimePolicyScope, "response.runtimePolicyScope"));
-	const sealedRuntimePolicyScope = normalizeRuntimePolicyScope(requireRecord$3(restore.runtimePolicyScope, "ed25519Restore.runtimePolicyScope"));
+	const responseRuntimePolicyScope = normalizeRuntimePolicyScope(requireRecord$1(response.runtimePolicyScope, "response.runtimePolicyScope"));
+	const sealedRuntimePolicyScope = normalizeRuntimePolicyScope(requireRecord$1(restore.runtimePolicyScope, "ed25519Restore.runtimePolicyScope"));
 	const routerAbNormalSigning = parseRouterAbEd25519NormalSigningState(response.routerAbNormalSigning);
 	const walletSessionId = parseWalletSessionId(response.walletSessionId);
 	const quotaId = parseMpcWalletSigningQuotaId(response.quotaId);
@@ -1600,7 +1550,7 @@ async function parseWarmRecoveryDescriptor(args) {
 		signerSlot,
 		operationalPublicKey: `ed25519:${base58Encode(Uint8Array.from(capability.registeredPublicKey))}`,
 		relayerKeyId: signingWorkerId,
-		credentialIdB64u: requireString$3(restore.credentialIdB64u, "ed25519Restore.credentialIdB64u"),
+		credentialIdB64u: requireTrimmedString(restore.credentialIdB64u, "ed25519Restore.credentialIdB64u"),
 		session: {
 			sessionKind: "opaque",
 			walletSessionToken,
@@ -1627,7 +1577,7 @@ async function resolvePasskeyEd25519YaoExportContextV1(input, runtime) {
 	};
 	const walletId = parseWalletId(exactRecord.record.walletId);
 	if (!walletId.ok) throw new Error("[SigningEngine][near] sealed Ed25519 wallet identity is invalid");
-	const credentialIdB64u = requireString$3(exactRecord.record.ed25519Restore.credentialIdB64u, "ed25519Restore.credentialIdB64u");
+	const credentialIdB64u = requireTrimmedString(exactRecord.record.ed25519Restore.credentialIdB64u, "ed25519Restore.credentialIdB64u");
 	let expectedAuthorityRef;
 	try {
 		expectedAuthorityRef = await runtime.resolveExactPasskeyWalletAuthAuthorityRef({
@@ -1812,7 +1762,7 @@ const WALLET_KEY_LIFECYCLE_FIELDS = [
 	"retiredAtMs",
 	"compromisedAtMs"
 ];
-const SIGNING_LANE_REFERENCE_FIELDS = [
+const SIGNING_LANE_RECORD_BASE_FIELDS = [...[
 	"kind",
 	"walletId",
 	"walletKeyId",
@@ -1820,9 +1770,7 @@ const SIGNING_LANE_REFERENCE_FIELDS = [
 	"laneKind",
 	"laneShareEpoch",
 	"participantBindingDigestB64u"
-];
-[...SIGNING_LANE_REFERENCE_FIELDS];
-const SIGNING_LANE_RECORD_BASE_FIELDS = [...SIGNING_LANE_REFERENCE_FIELDS, "lifecycle"];
+], "lifecycle"];
 const OWNER_AUTH_SIGNING_LANE_FIELDS = [
 	...SIGNING_LANE_RECORD_BASE_FIELDS,
 	"walletAuthMethodId",
@@ -1915,7 +1863,7 @@ function parseSigningLaneKind(raw, label) {
 	}
 }
 function parseWalletKeyLifecycleState(raw, label) {
-	const record = requireRecord$4(raw, label);
+	const record = requireRecord$1(raw, label);
 	rejectUnknownFields(record, WALLET_KEY_LIFECYCLE_FIELDS, label, WALLET_KEY_LIFECYCLE_FIELDS);
 	switch (record.state) {
 		case "active":
@@ -1931,7 +1879,7 @@ function parseWalletKeyLifecycleState(raw, label) {
 	}
 }
 function parseSigningLaneLifecycleState(raw, label) {
-	const record = requireRecord$4(raw, label);
+	const record = requireRecord$1(raw, label);
 	rejectUnknownFields(record, ALL_SIGNING_LANE_LIFECYCLE_FIELDS, label);
 	const revocationEpoch = parseNonNegativeSafeInteger(record.revocationEpoch, `${label}.revocationEpoch`);
 	switch (record.state) {
@@ -2186,7 +2134,7 @@ function buildBreakGlassSigningLaneRecord(args) {
 	};
 }
 function parseWalletKeyRecord(raw, label = "walletKeyRecord") {
-	const record = requireRecord$4(raw, label);
+	const record = requireRecord$1(raw, label);
 	if (record.kind !== "wallet_key_record_v1") throw new Error(`${label}.kind must be wallet_key_record_v1`);
 	if (record.keyFamily === "ed25519") {
 		rejectUnknownFields(record, ED25519_WALLET_KEY_FIELDS, label, ALL_WALLET_KEY_FIELDS);
@@ -2215,7 +2163,7 @@ function parseWalletKeyRecord(raw, label = "walletKeyRecord") {
 	throw new Error(`${label}.keyFamily must be ed25519 or ecdsa_secp256k1`);
 }
 function parseSigningLaneRecord(raw, label = "signingLaneRecord") {
-	const record = requireRecord$4(raw, label);
+	const record = requireRecord$1(raw, label);
 	if (record.kind !== "signing_lane_reference_v1") throw new Error(`${label}.kind must be signing_lane_reference_v1`);
 	const laneKind = parseSigningLaneKind(record.laneKind, `${label}.laneKind`);
 	rejectUnknownFields(record, signingLaneRecordFields(laneKind), label, ALL_SIGNING_LANE_RECORD_FIELDS);
@@ -2990,7 +2938,7 @@ async function resolveEcdsaExportMaterialForLane(deps, exportLane) {
 const ECDSA_DERIVATION_EXPORT_CONFIRMATION_DIGEST_VERSION = "ecdsa-derivation:role-local:product-export-confirmation:v5";
 const ECDSA_DERIVATION_EXPORT_AUTHORIZATION_DIGEST_VERSION = "ecdsa-derivation:role-local:product-export-authorization:v5";
 const ECDSA_DERIVATION_EXPORT_AUTH_TTL_MS = 6e4;
-function exportAuthorizationWire(authorization) {
+function exportAuthorizationWire(_authorization) {
 	return { kind: "operation_step_up" };
 }
 function exportAuthorizationDigestFields(authorization) {
@@ -5065,7 +5013,7 @@ function requirePasskeyEcdsaExportAuth(exportLane) {
 	return auth;
 }
 async function exportOperationDigest(value) {
-	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(value))));
+	return sha256Utf8DigestB64u(alphabetizeStringify(value));
 }
 async function prepareExplicitEcdsaExportOperationWithRuntime(args) {
 	const chainTargetKey = thresholdEcdsaChainTargetKey(args.chainTarget);
@@ -7208,9 +7156,6 @@ async function handleTransactionSigningFlow(ctx, request, worker, opts) {
 		let nearContextFailed = false;
 		const confirmationReadiness = consumeConfirmationReadiness(request.requestId);
 		let confirmationReadinessPending = !!confirmationReadiness;
-		const originalBody = String(transactionSummary.body || "").trim();
-		const confirmationReadinessBody = String(confirmationReadiness?.body || "").trim();
-		const restoreOriginalBody = () => ({ body: originalBody });
 		const confirmationReadinessPromise = confirmationReadiness ? Promise.resolve(confirmationReadiness.promise) : void 0;
 		const walletSessionExpiryPromise = confirmationReadinessPromise ? waitForWalletSessionExpiry(confirmationReadinessPromise) : void 0;
 		const markPromptReady = () => {
@@ -7223,10 +7168,7 @@ async function handleTransactionSigningFlow(ctx, request, worker, opts) {
 			loading: false,
 			onMounted: () => {
 				markPromptReady();
-				if (confirmationReadinessPending && confirmationReadinessBody) session.updateUI({
-					loading: false,
-					body: confirmationReadinessBody
-				});
+				if (confirmationReadinessPending) session.updateUI({ preparing: true });
 			}
 		}) : Promise.resolve({ confirmed: true });
 		if (reviewPromptRequired) promptDecisionPromise.finally(markPromptReady);
@@ -7267,20 +7209,19 @@ async function handleTransactionSigningFlow(ctx, request, worker, opts) {
 		if (confirmationReadinessPromise) confirmationReadinessPromise.then(async () => {
 			confirmationReadinessPending = false;
 			await promptReady;
-			if (decisionResolved || nearContextFailed) return;
-			session.updateUI({
-				...restoreOriginalBody(),
-				loading: false,
-				errorMessage: ""
-			});
+			if (decisionResolved) return;
+			session.updateUI({ preparing: false });
 		}).catch(async (error) => {
 			confirmationReadinessPending = false;
 			await promptReady;
-			if (decisionResolved || nearContextFailed) return;
+			if (decisionResolved) return;
+			if (nearContextFailed) {
+				session.updateUI({ preparing: false });
+				return;
+			}
 			const message = String(toError(error)?.message || "NEAR signing session could not be finalized");
 			session.updateUI({
-				...restoreOriginalBody(),
-				loading: false,
+				preparing: false,
 				errorMessage: `NEAR signing session could not be finalized: ${message}`
 			});
 		});
@@ -7759,13 +7700,13 @@ async function handlePromptFromWorker(ctx, message, worker, options) {
 		switch (request.type) {
 			case UserConfirmationType.AUTHORIZE_KEY_EXPORT:
 			case UserConfirmationType.SHOW_SECURE_PRIVATE_KEY_UI: {
-				const { handleLocalOnlyFlow } = await import("./localOnly-B5TYHJiq.js");
+				const { handleLocalOnlyFlow } = await import("./localOnly-Bg8UuLZ5.js");
 				await handleLocalOnlyFlow(ctx, request, scopedWorker, flowOptions);
 				break;
 			}
 			case UserConfirmationType.REGISTER_ACCOUNT:
 			case UserConfirmationType.LINK_DEVICE: {
-				const { handleRegistrationFlow } = await import("./registration-BtPLgKHk.js").then((n) => n.n);
+				const { handleRegistrationFlow } = await import("./registration-BzVHODuD.js").then((n) => n.n);
 				await handleRegistrationFlow(ctx, request, scopedWorker, flowOptions);
 				break;
 			}
@@ -9280,11 +9221,8 @@ function ecdsaSealedRuntimePurpose(purpose) {
 }
 //#endregion
 //#region src/core/signingEngine/session/warmCapabilities/volatileWarmMaterialCommands.ts
-function asRecord(value) {
-	return typeof value === "object" && value !== null ? value : null;
-}
 function parseVolatileWarmSessionScope(value) {
-	const raw = asRecord(value);
+	const raw = asRecordOrArray(value);
 	if (!raw) return null;
 	if (raw.kind === "all") return { kind: "all" };
 	if (raw.kind !== "session") return null;
@@ -9296,7 +9234,7 @@ function parseVolatileWarmSessionScope(value) {
 	};
 }
 function parseClearVolatileWarmMaterialCommand(value) {
-	const raw = asRecord(value);
+	const raw = asRecordOrArray(value);
 	if (!raw || raw.kind !== "clear_volatile_warm_material") return null;
 	if (raw.durableRecord != null || raw.resolvedIdentity != null || raw.deleteReason != null) return null;
 	const scope = parseVolatileWarmSessionScope(raw.scope);
@@ -11241,9 +11179,8 @@ function requireExpectedPasskeyRegistrationUser(input) {
 * and generates credentials, and PRF Outputs
 */
 var TouchIdPrompt = class TouchIdPrompt {
-	constructor(rpIdOverride, safariGetWebauthnRegistrationFallback = false) {
+	constructor(rpIdOverride, _safariGetWebauthnRegistrationFallback = false) {
 		this.rpIdOverride = rpIdOverride;
-		this.safariGetWebauthnRegistrationFallback = safariGetWebauthnRegistrationFallback === true;
 	}
 	getRpId() {
 		try {
@@ -11701,6 +11638,18 @@ const SIGNER_WORKER_KINDS = [
 	"walletCustodyCeremony"
 ];
 const MULTICHAIN_WORKER_DEFAULT_TIMEOUT_MS = 2e4;
+/**
+* A timed-out operation resets its worker, and resetting a presign or
+* derivation worker discards the state other ceremonies hold in it. Name the
+* operation that caused the reset.
+*/
+function warnWorkerOperationTimedOut(kind, type, timeoutMs) {
+	console.warn("[WorkerTransport] operation timed out; resetting worker", {
+		kind,
+		type: String(type),
+		timeoutMs
+	});
+}
 function makeId(prefix) {
 	return secureRandomId(prefix, 32, "signer worker request IDs");
 }
@@ -11805,11 +11754,11 @@ var WorkerTransport = class {
 		return readiness.promise;
 	}
 	/**
-	* Refactor 94C. Initializes the ECDSA derivation and registration WASM
-	* inside the derivation worker during the authentication prompt, so the
-	* first ceremony call after auth does not pay module init (measured 654 ms
-	* cold vs 88 ms warm on `ecdsaRegistrationClientCreateMs`). Fire-and-forget
-	* safe: failure leaves the lazy init path exactly as it was.
+	* Initializes the ECDSA derivation and registration WASM inside the
+	* derivation worker during the authentication prompt, so the first ceremony
+	* call after auth does not pay module init (measured 654 ms cold vs 88 ms
+	* warm on `ecdsaRegistrationClientCreateMs`). Fire-and-forget safe: failure
+	* leaves the lazy init path exactly as it was.
 	*/
 	async prewarmEcdsaRegistrationCrypto() {
 		const existing = this.ecdsaRegistrationCryptoPrewarmPromise;
@@ -11921,6 +11870,7 @@ var WorkerTransport = class {
 					code: "TIMEOUT",
 					workerKind: "nearSigner"
 				}));
+				warnWorkerOperationTimedOut("nearSigner", type, timeoutMs);
 				this.resetWorker("nearSigner");
 				try {
 					const seconds = Math.round(timeoutMs / 1e3);
@@ -11962,6 +11912,7 @@ var WorkerTransport = class {
 					code: "TIMEOUT",
 					workerKind: "ecdsaDerivationClient"
 				}));
+				warnWorkerOperationTimedOut("ecdsaDerivationClient", type, timeoutMs);
 				this.resetWorker("ecdsaDerivationClient");
 			}, timeoutMs);
 			this.getPendingMap("ecdsaDerivationClient").set(requestId, {
@@ -11996,6 +11947,7 @@ var WorkerTransport = class {
 					code: "TIMEOUT",
 					workerKind: kind
 				}));
+				warnWorkerOperationTimedOut(kind, request.type, timeoutMs);
 				this.resetWorker(kind);
 			}, timeoutMs);
 			this.getPendingMap(kind).set(requestId, {
@@ -13174,19 +13126,11 @@ function requireEd25519YaoClientRootEnvelopeV1(envelope) {
 	if (!isEd25519YaoClientRootEnvelopeV1(envelope)) throw new Error("[SigningEngine][ed25519-export] export envelope has the wrong secret kind");
 	return envelope;
 }
-function requireRecord$2(value, label) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
-	return value;
-}
 function requireExactKeys(record, expected, label) {
 	const actual = Object.keys(record).sort();
 	const keys = [...expected].sort();
 	if (actual.length !== keys.length || actual.some((key, index) => key !== keys[index])) throw new Error(`${label} fields are invalid`);
 }
-function requireString$2(value, label) {
-	if (typeof value !== "string" || value.trim() !== value || value.length === 0) throw new Error(`${label} is invalid`);
-	return value;
-}
 function requirePositiveInteger(value, label) {
 	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 1) throw new Error(`${label} is invalid`);
 	return value;
@@ -13226,7 +13170,7 @@ async function readColdExportBootstrap(input) {
 		const failure = raw && typeof raw === "object" ? raw : null;
 		throw new Error(`[SigningEngine][ed25519-export] capability bootstrap failed (HTTP ${response.status}): ${String(failure?.message || "invalid response")}`);
 	}
-	const record = requireRecord$2(raw, "Ed25519 export bootstrap");
+	const record = requireRecord$1(raw, "Ed25519 export bootstrap");
 	requireExactKeys(record, [
 		"kind",
 		"walletId",
@@ -13244,9 +13188,9 @@ async function readColdExportBootstrap(input) {
 		"capability"
 	], "Ed25519 export bootstrap");
 	if (record.kind !== "router_ab_ed25519_yao_v2_session_bootstrap_v1") throw new Error("Ed25519 export bootstrap kind is invalid");
-	const walletId = requireString$2(record.walletId, "bootstrap.walletId");
-	const nearAccountId = requireString$2(record.nearAccountId, "bootstrap.nearAccountId");
-	const nearEd25519SigningKeyId = requireString$2(record.nearEd25519SigningKeyId, "bootstrap.nearEd25519SigningKeyId");
+	const walletId = requireCanonicalString(record.walletId, "bootstrap.walletId");
+	const nearAccountId = requireCanonicalString(record.nearAccountId, "bootstrap.nearAccountId");
+	const nearEd25519SigningKeyId = requireCanonicalString(record.nearEd25519SigningKeyId, "bootstrap.nearEd25519SigningKeyId");
 	const thresholdSessionId = parseThresholdEd25519SessionId(record.thresholdSessionId);
 	const walletSessionId = parseWalletSessionId(record.walletSessionId);
 	const quotaId = parseMpcWalletSigningQuotaId(record.quotaId);
@@ -13260,7 +13204,7 @@ async function readColdExportBootstrap(input) {
 	};
 	const participantIds = requireParticipantIds(record.participantIds);
 	const registeredPublicKeyB64u = base64UrlEncode(Uint8Array.from(capability.registeredPublicKey));
-	if (!thresholdSessionId.ok || !walletSessionId.ok || !quotaId.ok || !signingRoot || !routerAbNormalSigning || walletId !== String(signer.account.wallet.walletId) || nearAccountId !== String(signer.account.nearAccountId) || nearEd25519SigningKeyId !== String(signer.nearEd25519SigningKeyId) || thresholdSessionId.value !== capability.lifecycle.thresholdSessionId || walletSessionId.value !== operationCredential.walletSessionId || quotaId.value !== input.authorization.record.quotaId || requirePositiveInteger(record.signerSlot, "bootstrap.signerSlot") !== signer.signerSlot || requireString$2(record.signingWorkerId, "bootstrap.signingWorkerId") !== binding.signingWorkerId || participantIds[0] !== binding.participantIds[0] || participantIds[1] !== binding.participantIds[1] || authority.factor.providerUserId !== input.subject.auth.providerSubjectId || registeredPublicKeyB64u !== binding.registeredPublicKeyB64u || !mpcMaterialActivationRefsEqual(capability.materialActivation, input.expectedMaterialActivation)) throw new Error("[SigningEngine][ed25519-export] capability bootstrap identity mismatch");
+	if (!thresholdSessionId.ok || !walletSessionId.ok || !quotaId.ok || !signingRoot || !routerAbNormalSigning || walletId !== String(signer.account.wallet.walletId) || nearAccountId !== String(signer.account.nearAccountId) || nearEd25519SigningKeyId !== String(signer.nearEd25519SigningKeyId) || thresholdSessionId.value !== capability.lifecycle.thresholdSessionId || walletSessionId.value !== operationCredential.walletSessionId || quotaId.value !== input.authorization.record.quotaId || requirePositiveInteger(record.signerSlot, "bootstrap.signerSlot") !== signer.signerSlot || requireCanonicalString(record.signingWorkerId, "bootstrap.signingWorkerId") !== binding.signingWorkerId || participantIds[0] !== binding.participantIds[0] || participantIds[1] !== binding.participantIds[1] || authority.factor.providerUserId !== input.subject.auth.providerSubjectId || registeredPublicKeyB64u !== binding.registeredPublicKeyB64u || !mpcMaterialActivationRefsEqual(capability.materialActivation, input.expectedMaterialActivation)) throw new Error("[SigningEngine][ed25519-export] capability bootstrap identity mismatch");
 	return {
 		emailHashHex: authority.verifier.emailHashHex,
 		bootstrap: {
@@ -13333,7 +13277,7 @@ async function readLinkedExportCapability(input) {
 		const failure = raw && typeof raw === "object" ? raw : null;
 		throw new Error(`[SigningEngine][ed25519-export] linked capability bootstrap failed (HTTP ${response.status}): ${String(failure?.message || "invalid response")}`);
 	}
-	const record = requireRecord$2(raw, "linked Ed25519 export bootstrap");
+	const record = requireRecord$1(raw, "linked Ed25519 export bootstrap");
 	requireExactKeys(record, [
 		"kind",
 		"walletId",
@@ -13362,7 +13306,7 @@ async function readLinkedExportCapability(input) {
 	};
 	const participantIds = requireParticipantIds(record.participantIds);
 	const registeredPublicKeyB64u = base64UrlEncode(Uint8Array.from(capability.registeredPublicKey));
-	if (!thresholdSessionId.ok || !walletSessionId.ok || !quotaId.ok || !runtimePolicyScope || !routerAbNormalSigning || requireString$2(record.walletId, "bootstrap.walletId") !== String(signer.account.wallet.walletId) || requireString$2(record.nearAccountId, "bootstrap.nearAccountId") !== String(signer.account.nearAccountId) || requireString$2(record.nearEd25519SigningKeyId, "bootstrap.nearEd25519SigningKeyId") !== String(signer.nearEd25519SigningKeyId) || requirePositiveInteger(record.signerSlot, "bootstrap.signerSlot") !== signer.signerSlot || thresholdSessionId.value !== capability.lifecycle.thresholdSessionId || walletSessionId.value !== operationCredential.walletSessionId || quotaId.value !== input.authorization.record.quotaId || requireString$2(record.signingWorkerId, "bootstrap.signingWorkerId") !== input.source.signingWorkerId || participantIds[0] !== input.source.participantIds[0] || participantIds[1] !== input.source.participantIds[1] || registeredPublicKeyB64u !== input.source.registeredPublicKeyB64u || !mpcMaterialActivationRefsEqual(capability.materialActivation, input.expectedMaterialActivation)) throw new Error("[SigningEngine][ed25519-export] linked capability identity mismatch");
+	if (!thresholdSessionId.ok || !walletSessionId.ok || !quotaId.ok || !runtimePolicyScope || !routerAbNormalSigning || requireCanonicalString(record.walletId, "bootstrap.walletId") !== String(signer.account.wallet.walletId) || requireCanonicalString(record.nearAccountId, "bootstrap.nearAccountId") !== String(signer.account.nearAccountId) || requireCanonicalString(record.nearEd25519SigningKeyId, "bootstrap.nearEd25519SigningKeyId") !== String(signer.nearEd25519SigningKeyId) || requirePositiveInteger(record.signerSlot, "bootstrap.signerSlot") !== signer.signerSlot || thresholdSessionId.value !== capability.lifecycle.thresholdSessionId || walletSessionId.value !== operationCredential.walletSessionId || quotaId.value !== input.authorization.record.quotaId || requireCanonicalString(record.signingWorkerId, "bootstrap.signingWorkerId") !== input.source.signingWorkerId || participantIds[0] !== input.source.participantIds[0] || participantIds[1] !== input.source.participantIds[1] || registeredPublicKeyB64u !== input.source.registeredPublicKeyB64u || !mpcMaterialActivationRefsEqual(capability.materialActivation, input.expectedMaterialActivation)) throw new Error("[SigningEngine][ed25519-export] linked capability identity mismatch");
 	return capability;
 }
 function countExactEd25519ExportSubjects(subjects, expectedMaterialActivation) {
@@ -13697,7 +13641,7 @@ async function readPersistedAvailableSigningLanes$1(deps, args, ecdsaChainTarget
 	}, new WalletSessionStatusReadScope());
 }
 /**
-* R103C human operational read: lanes for one exact owner. The auth-method
+* Human operational read: lanes for one exact owner. The auth-method
 * narrowing and the owner filter both derive from the scope — callers supply
 * nothing the scope does not already carry.
 */
@@ -14008,7 +13952,7 @@ async function discoverPersistedSessionsForWallet(deps, args) {
 async function readPersistedAvailableSigningLanes(deps, args) {
 	return await readPersistedAvailableSigningLanes$1(deps.availableLanes, args, deps.getConfiguredEcdsaChainTargets());
 }
-/** R103C human operational read: one exact owner, configured ECDSA targets. */
+/** Human operational read: one exact owner, configured ECDSA targets. */
 async function readOwnerScopedSigningLanes(deps, args, statusReads) {
 	return await readOwnerScopedAvailableSigningLanes(deps.availableLanes, {
 		walletId: args.walletId,
@@ -14890,7 +14834,7 @@ async function resolveEcdsaAuthorizationForResolution(args) {
 }
 /** The PRF claim for a resolved ECDSA capability. Correlation has already proved
 * the material, so the claim is the sealed runtime's own allowance and expiry --
-* the same facts the shared Refactor 92 rule classifies. A blocked resolution
+* the same facts the shared runtime-policy rule classifies. A blocked resolution
 * has no runtime and so no claim to report.
 *
 * The wallet-scoped relayer claim is not consulted here. It is read by lane, and
@@ -17435,7 +17379,7 @@ async function noWalletPasskeyAuthenticator() {
 	return null;
 }
 /**
-* R103C: the active wallet auth-method store is the one source that resolves
+* The active wallet auth-method store is the one source that resolves
 * an authority reference to its full authority. Sealed-session restores and
 * loose authenticator lists are history and hints; matching against them let
 * a stale or sibling credential answer for the active authority.
@@ -17610,14 +17554,22 @@ async function readBrowserExactNearEd25519WalletSessionAuthorization(relayerUrlI
 	const authorizationNowMs = Date.now();
 	if (status.authorization.expiresAtMs <= authorizationNowMs) return { kind: "expired" };
 	if (status.walletSessionId !== exactRead.operationCredential.walletSessionId || status.quotaId !== exactRead.record.quotaId || status.expiresAtMs !== status.authorization.expiresAtMs || !walletSessionImmutableIdentityMatches(status.authorization, exactRead.record) || !walletSessionMatchesSelectedAuthority(status.authorization, currentSelected)) return { kind: "corrupt" };
+	let replaced;
 	try {
-		await walletSessionAuthorizations.replaceExactActive({
+		replaced = await IndexedDBManager.replaceExactActiveWalletSessionFromStatus({
 			active: status.authorization,
 			operationCredential: exactRead.operationCredential
 		});
 	} catch {
 		return { kind: "persistence_unavailable" };
 	}
+	if (replaced.kind === "superseded") {
+		emitSigningSessionFlowTrace("near", {
+			event: "wallet_session_status_superseded",
+			walletSessionId: exactRead.operationCredential.walletSessionId
+		});
+		return { kind: "unavailable" };
+	}
 	let selectedFactorAuthority;
 	try {
 		selectedFactorAuthority = await resolveBrowserSelectedFactorAuthority(currentSelected);
@@ -17804,8 +17756,9 @@ async function resolveBrowserEcdsaPreprocessingCapability(args, input, statusRea
 		kind: "inactive",
 		reason: "Exact Wallet Session authorization is expired"
 	};
+	let replaced;
 	try {
-		await walletSessionAuthorizations.replaceExactActive({
+		replaced = await IndexedDBManager.replaceExactActiveWalletSessionFromStatus({
 			active: status.authorization,
 			operationCredential: exactAuthorization.operationCredential
 		});
@@ -17815,6 +17768,16 @@ async function resolveBrowserEcdsaPreprocessingCapability(args, input, statusRea
 			reason: "Exact Wallet Session promotion reconciliation could not be persisted"
 		};
 	}
+	if (replaced.kind === "superseded") {
+		emitSigningSessionFlowTrace("evm-family", {
+			event: "wallet_session_status_superseded",
+			walletSessionId: exactAuthorization.operationCredential.walletSessionId
+		});
+		return {
+			kind: "inactive",
+			reason: "Exact Wallet Session status was superseded by a newer wallet authority"
+		};
+	}
 	const authorizationResolution = await buildBrowserEcdsaPreprocessingCapability({
 		context: args,
 		walletId,
@@ -17895,7 +17858,7 @@ async function resolveAmbiguousEcdsaActivationForSelectedAuthMethod(input) {
 		authority: chosen
 	});
 }
-async function resolveBrowserCanonicalEcdsaSigningCapability(args, input) {
+async function resolveBrowserCanonicalEcdsaSigningCapability(_args, input) {
 	const walletId = toWalletId(input.walletId);
 	const subjects = await ecdsaCapabilityManifestStore$2.listActiveWalletCapabilitySubjects(walletId);
 	if (subjects.kind !== "resolved") throw new Error(`ECDSA capability subjects are ${subjects.kind}`);
@@ -20116,7 +20079,7 @@ function buildExportChallengeRoutePlan(ports, args) {
 		});
 	}
 }
-function buildEcdsaExportVerificationRoutePlan(authorization) {
+function buildEcdsaExportVerificationRoutePlan(_authorization) {
 	return buildEmailOtpRoutePlan({
 		routeFamily: "login",
 		operation: WALLET_EMAIL_OTP_EXPORT_OPERATION
@@ -20309,15 +20272,6 @@ var EmailOtpExportRecoveryRuntime = class {
 			buildSigningSessionRoutePlan: buildEmailOtpSigningSessionRoutePlan
 		};
 	}
-	signingSessionWorkerPorts() {
-		return {
-			getSignerWorkerContext: this.ports.getSignerWorkerContext,
-			requireRelayUrl: this.ports.requireRelayUrl,
-			requireSigningSessionSealGroupId: this.ports.requireSigningSessionSealGroupId,
-			resolveSelectedWalletAuthority: this.ports.resolveSelectedWalletAuthority,
-			buildSigningSessionRoutePlan: buildEmailOtpSigningSessionRoutePlan
-		};
-	}
 };
 //#endregion
 //#region src/core/signingEngine/session/emailOtp/runtimeConfig.ts
@@ -20386,33 +20340,6 @@ var EmailOtpSealedRefreshPolicy = class {
 			chainTarget: purpose.chainTarget
 		};
 	}
-	/** Corrupt persisted state or explicit user removal only. Expiry and
-	* exhaustion never reach here. */
-	async deleteEmailOtpDurableSealedSessionRecord(args) {
-		const thresholdSessionId = String(args.purpose.thresholdSessionId || "").trim();
-		if (!thresholdSessionId) {
-			this.ports.clearEcdsaRestoreCaches();
-			return;
-		}
-		const command = createDeleteDurableSealedSessionCommand({
-			durableRecord: {
-				authMethod: "email_otp",
-				curve: "ecdsa",
-				thresholdSessionId,
-				chainTarget: args.purpose.chainTarget
-			},
-			deleteReason: args.deleteReason,
-			preserveResolvedIdentity: false
-		});
-		await this.ports.deleteDurableSealedSessionRecord(command).catch(() => void 0);
-		this.ports.clearEcdsaRestoreCaches();
-	}
-	async recordSessionMaterialClaimed(purpose, result) {
-		await this.recordSessionPolicyResult({
-			purpose,
-			result
-		});
-	}
 	async recordSessionUseConsumed(purpose, result) {
 		await this.recordSessionPolicyResult({
 			purpose,
@@ -20809,7 +20736,6 @@ function warmSessionMaterialTarget(target) {
 //#region src/core/signingEngine/session/emailOtp/coordinatorRuntime.ts
 var EmailOtpWalletSessionRuntime = class {
 	constructor(deps) {
-		this.deps = deps;
 		this.sealedRefreshDiagnosticLogAtMsByKey = /* @__PURE__ */ new Map();
 		this.runtimeConfig = new EmailOtpRuntimeConfig({
 			configs: deps.configs,
@@ -20856,7 +20782,6 @@ var EmailOtpWalletSessionRuntime = class {
 		});
 		const warmSessionWorkerClient = createEmailOtpWarmSessionWorkerClient({ worker: deps.signerWorkerManager });
 		this.sealedRefreshPolicy = new EmailOtpSealedRefreshPolicy({
-			deleteDurableSealedSessionRecord: deps.deleteDurableSealedSessionRecord,
 			updateExactSealedSessionPolicy: deps.updateExactSealedSessionPolicy,
 			clearEcdsaRestoreCaches: () => this.clearEcdsaRestoreCaches()
 		});
@@ -21006,7 +20931,6 @@ function createStepUpRuntime(args) {
 		listExactSealedSessionsForWallet: args.sealedSessionStore.listExactSealedSessionsForWallet,
 		acquireSigningSessionRestoreLease: args.sealedSessionStore.acquireSigningSessionRestoreLease,
 		releaseSigningSessionRestoreLease: args.sealedSessionStore.releaseSigningSessionRestoreLease,
-		deleteDurableSealedSessionRecord: args.sealedSessionStore.deleteDurableSealedSessionRecord,
 		updateExactSealedSessionPolicy: args.sealedSessionStore.updateExactSealedSessionPolicy
 	});
 	const passkeyMpcSession = createWarmSessionAwarePasskeyMpcSession({
@@ -22403,11 +22327,9 @@ var BrowserSigningSurface = class {
 			getNearSigningDeps: () => this.enginePorts.nearSigningDeps,
 			getEvmFamilySigningDeps: () => this.enginePorts.tempoSigningDeps
 		});
-		this.signingRuntime = signingRuntime;
 		runtimePortsForUiConfirm.current = signingRuntime.runtimePorts;
 		const ecdsaExportArtifactStore = signingRuntime.state.ecdsaSessions;
 		this.runtimePorts = signingRuntime.runtimePorts;
-		this.thresholdEcdsaExportArtifactByLane = signingRuntime.state.ecdsaSessions.exportArtifactsByLane;
 		const stepUpRuntime = createBrowserStepUpRuntime({
 			seamsWebConfigs: this.seamsWebConfigs,
 			touchIdPrompt: this.touchIdPrompt,
@@ -22858,9 +22780,6 @@ var BrowserSigningSurface = class {
 				throw new Error("Unsupported Ed25519 public capability auth method");
 		}
 	}
-	hasActiveNearEd25519YaoMaterial(args) {
-		return this.enginePorts.ed25519YaoActiveClients.resolve(args) !== null;
-	}
 	async readPersistedAvailableSigningLanes(args) {
 		return await readPersistedAvailableSigningLanes(this.sessionPublicDeps, args);
 	}
@@ -22993,15 +22912,16 @@ var BrowserSigningSurface = class {
 		return { requestOperation: requestWalletCustodyCeremonyOperation.bind(void 0, workerContext) };
 	}
 	/**
-	* Refactor 103 zero-prompt handoff: parks the wallet custody seed inside the
-	* ceremony worker for the lifetime of the just-activated owner Wallet
-	* Session, reusing the factor secret this registration or unlock already
-	* collected. Failure is absorbed: the wallet stays usable, and device
-	* linking fails closed with `wallet_unlock_required` until the next unlock.
+	* Parks the wallet custody seed inside the ceremony worker for the lifetime of
+	* the just-activated owner Wallet Session, reusing the factor secret this
+	* registration or unlock already collected. Failure is absorbed: the wallet
+	* stays usable, and device linking fails closed with `wallet_unlock_required`
+	* until the next unlock.
 	*/
 	async establishUnlockedWalletEd25519ExportRootCapabilityV1(input) {
 		try {
-			if (!isWalletCustodySeedBinding(input.existingEnvelope.binding)) return;
+			const binding = input.existingEnvelope.binding;
+			if (!isWalletCustodySeedBinding(binding) && binding.kind !== "ed25519_yao_client_root_v1") return;
 			if (input.existingEnvelope.factor.kind !== "passkey") throw new Error("unlocked export-root capability requires a passkey envelope factor");
 			const existingFactorSecret = base64UrlDecode(input.passkeyPrfFirstB64u);
 			try {
@@ -23021,7 +22941,7 @@ var BrowserSigningSurface = class {
 		}
 	}
 	/**
-	* Stores a resealed pre-109C envelope under the method that opened it.
+	* Stores the reseal of an unbound envelope under the method that opened it.
 	*
 	* Absorbed the same way establishment is, and for the same reason: the V2 row
 	* still opens the wallet, so a failure here costs a retry at the next unlock
@@ -24811,8 +24731,8 @@ var BrowserSigningSurface = class {
 		}, args.walletSession, args.providerSubjectId, activation);
 	}
 	/**
-	* R109C: what an owner authority needs to have its Ed25519 runtime built
-	* inside the unlock that verifies its factor.
+	* What an owner authority needs to have its Ed25519 runtime built inside the
+	* unlock that verifies its factor.
 	*
 	* Assembled here rather than by the caller because every field is read off
 	* the exact authority projection - the identity, its runtime policy scope,
@@ -24854,7 +24774,7 @@ var BrowserSigningSurface = class {
 		};
 	}
 	/**
-	* R109C: activate the runtime an owner authority's unlock built.
+	* Activate the runtime an owner authority's unlock built.
 	*
 	* The identity it is checked against comes from the same authority projection
 	* that produced the unlock request, not from the bootstrap being checked -
@@ -25240,8 +25160,8 @@ async function persistFinalizedPasskeyAuthMethodV1(args) {
 	await IndexedDBManager.upsertWalletAuthMethod(localPasskeyAuthMethodFromFinalizeV1(args));
 }
 /**
-* Refactor 109C: the full local install for a passkey added to a wallet that
-* registered with another family.
+* The full local install for a passkey added to a wallet that registered with
+* another family.
 *
 * Three records, and unlock needs all of them. It reads the profile, then the
 * profile's authenticators, then keeps only those whose credential belongs to
@@ -25482,7 +25402,7 @@ async function linkWalletPasskeyCustody(input) {
 //#endregion
 //#region src/SeamsWeb/operations/authMethods/addAuthMethodSourceClaim.ts
 /**
-* Refactor 109C: the source claim a same-device addition puts in its intent.
+* The source claim a same-device addition puts in its intent.
 *
 * The intent digest is what the fresh source proof signs, so every identity the
 * proof is meant to bind has to be inside it. The server resolves the true
@@ -25675,7 +25595,7 @@ async function addPasskeyWalletAuthMethodInternal(args) {
 	}
 }
 /**
-* Refactor 109C's `email_otp_to_passkey` branch.
+* The `email_otp_to_passkey` addition branch.
 *
 * The Email OTP method that already unlocks this wallet authorizes adding a
 * passkey. Three things stay exactly as they are in the Passkey-source branch,
@@ -25797,7 +25717,7 @@ async function addPasskeyWalletAuthMethod(args) {
 //#endregion
 //#region src/SeamsWeb/operations/authMethods/revokeAuthMethod.ts
 /**
-* Refactor 109C: remove one auth method using a different active one.
+* Remove one auth method using a different active one.
 *
 * The inverse of the two addition branches, and the reason they are safe to
 * offer: a wallet that can gain a second way in must be able to lose one it no
@@ -25987,8 +25907,8 @@ async function revokeWalletAuthMethodOperation(args) {
 //#endregion
 //#region src/core/signingEngine/walletCustody/emailOtpLink.ts
 /**
-* Refactor 109C: sealing the wallet's existing custody seed under a newly
-* verified Email OTP factor.
+* Sealing the wallet's existing custody seed under a newly verified
+* Email OTP factor.
 *
 * The mirror of `passkeyLink`, and deliberately the same shape: open the source
 * envelope with the factor secret the caller already collected, reseal the same
@@ -26361,7 +26281,7 @@ function warnIfSameOriginWallet(walletOrigin) {
 }
 async function createWalletIframeRouter(args) {
 	warnIfSameOriginWallet(args.walletOrigin);
-	const { WalletIframeRouter } = await import("./router-CeFS9SgT.js");
+	const { WalletIframeRouter } = await import("./router-C5lF_J_u.js");
 	const signingSessionPersistenceMode = args.configs.signing.sessionPersistenceMode;
 	return new WalletIframeRouter({
 		walletOrigin: args.walletOrigin,
@@ -26662,12 +26582,12 @@ function createSigningRuntimeStatePorts() {
 }
 function createSigningRuntime(deps) {
 	const getWarmSessions = memoizeService(async () => {
-		const { createWarmSessionHydrationService } = await import("./warmSessionHydration-DDNYdTCz.js");
+		const { createWarmSessionHydrationService } = await import("./warmSessionHydration-Os8niEm7.js");
 		return createWarmSessionHydrationService({ getWarmSessionMaterialWriter: deps.ui.warmSessions.getWarmSessionMaterialWriter });
 	});
 	const warmSessions = { hydrateSigningSession: async (input) => (await getWarmSessions()).hydrateSigningSession(input) };
 	const getRegistrationAccounts = memoizeService(async () => {
-		const { createRegistrationAccountsService } = await import("./registrationAccounts-AO3QHjas.js");
+		const { createRegistrationAccountsService } = await import("./registrationAccounts-CKku_Sgy.js");
 		return createRegistrationAccountsService(deps.registration.accountLifecycle);
 	});
 	const registrationAccounts = {
@@ -26691,7 +26611,7 @@ function createSigningRuntime(deps) {
 		rollbackWalletEd25519SignerRegistration: async (receipt) => (await getRegistrationAccounts()).rollbackWalletEd25519SignerRegistration(receipt)
 	};
 	const getEcdsaWalletRecords = memoizeService(async () => {
-		const { createEcdsaWalletRecordsService } = await import("./ecdsaWalletRecords-CAbbVhEY.js");
+		const { createEcdsaWalletRecordsService } = await import("./ecdsaWalletRecords-Cz4m6bIz.js");
 		return createEcdsaWalletRecordsService({ accountLifecycle: deps.registration.accountLifecycle });
 	});
 	const ecdsaWalletRecords = {
@@ -26702,32 +26622,32 @@ function createSigningRuntime(deps) {
 		storeWalletEmailOtpEcdsaRegistrationData: async (input) => (await getEcdsaWalletRecords()).storeWalletEmailOtpEcdsaRegistrationData(input)
 	};
 	const nearSigning = { signNear: async (request) => {
-		const { signNear } = await import("./signNear-B0OCVKoH.js").then((n) => n.n);
+		const { signNear } = await import("./signNear-Bblwn2kT.js").then((n) => n.n);
 		return signNear(deps.signing.near.getDeps(), request);
 	} };
 	const evmFamilySigning = {
 		signEvmFamily: async (args) => {
-			const { signEvmFamily } = await import("./signEvmFamily-Dxk4sBPY.js").then((n) => n.s);
+			const { signEvmFamily } = await import("./signEvmFamily-e4IWWsZs.js").then((n) => n.s);
 			return signEvmFamily(deps.signing.evmFamily.getDeps(), args);
 		},
 		reportTempoBroadcastAccepted: async (args) => {
-			const { reportTempoBroadcastAccepted } = await import("./signEvmFamily-Dxk4sBPY.js").then((n) => n.s);
+			const { reportTempoBroadcastAccepted } = await import("./signEvmFamily-e4IWWsZs.js").then((n) => n.s);
 			return reportTempoBroadcastAccepted(deps.signing.evmFamily.getDeps(), args);
 		},
 		reportTempoBroadcastRejected: async (args) => {
-			const { reportTempoBroadcastRejected } = await import("./signEvmFamily-Dxk4sBPY.js").then((n) => n.s);
+			const { reportTempoBroadcastRejected } = await import("./signEvmFamily-e4IWWsZs.js").then((n) => n.s);
 			return reportTempoBroadcastRejected(deps.signing.evmFamily.getDeps(), args);
 		},
 		reportTempoFinalized: async (args) => {
-			const { reportTempoFinalized } = await import("./signEvmFamily-Dxk4sBPY.js").then((n) => n.s);
+			const { reportTempoFinalized } = await import("./signEvmFamily-e4IWWsZs.js").then((n) => n.s);
 			return reportTempoFinalized(deps.signing.evmFamily.getDeps(), args);
 		},
 		reportTempoDroppedOrReplaced: async (args) => {
-			const { reportTempoDroppedOrReplaced } = await import("./signEvmFamily-Dxk4sBPY.js").then((n) => n.s);
+			const { reportTempoDroppedOrReplaced } = await import("./signEvmFamily-e4IWWsZs.js").then((n) => n.s);
 			return reportTempoDroppedOrReplaced(deps.signing.evmFamily.getDeps(), args);
 		},
 		reconcileTempoNonceLane: async (args) => {
-			const { reconcileTempoNonceLane } = await import("./signEvmFamily-Dxk4sBPY.js").then((n) => n.s);
+			const { reconcileTempoNonceLane } = await import("./signEvmFamily-e4IWWsZs.js").then((n) => n.s);
 			return reconcileTempoNonceLane(deps.signing.evmFamily.getDeps(), args);
 		}
 	};
@@ -26806,7 +26726,6 @@ function createBrowserSigningStores(indexedDB) {
 			listEcdsaSealedSessionsForWallet,
 			acquireSigningSessionRestoreLease,
 			releaseSigningSessionRestoreLease,
-			deleteDurableSealedSessionRecord,
 			updateExactSealedSessionPolicy
 		},
 		ed25519YaoPublicCapabilityReferences: new IndexedDbEd25519YaoPublicCapabilityReferenceStore(indexedDB)
@@ -27803,27 +27722,6 @@ function walletAuthMethodBindingFromRecord(record) {
 		default: return null;
 	}
 }
-async function exactPasskeyWalletAuthMethodForCredential(args) {
-	const matches = (await IndexedDBManager.listWalletAuthMethodsV2ForWallet(String(args.walletId))).filter((record) => record.kind === "passkey" && record.status === "active" && record.walletId === args.walletId && String(record.rpId) === args.rpId && String(record.credentialIdB64u) === args.credentialIdB64u);
-	const [record] = matches;
-	if (matches.length !== 1 || !record) throw new Error("[login] passkey authority requires one exact active V2 auth method");
-	return record;
-}
-async function exactPasskeyWalletAuthAuthorityRefForCredential(args) {
-	const record = await exactPasskeyWalletAuthMethodForCredential(args);
-	return await walletAuthAuthorityRef({ authority: {
-		walletId: record.walletId,
-		factor: {
-			kind: "passkey",
-			credentialIdB64u: record.credentialIdB64u
-		},
-		verifier: {
-			kind: "webauthn",
-			rpId: record.rpId
-		},
-		bindingId: record.walletAuthMethodId
-	} });
-}
 function walletAuthAuthorityForSelectedPasskeyMethod(record) {
 	return {
 		walletId: record.walletId,
@@ -28951,7 +28849,7 @@ async function activateLinkedDeviceSignerRuntimesAfterLink(args) {
 				walletSessionId: String(args.operationCredential.walletSessionId),
 				expiresAtMs: args.walletSession.expiresAtMs
 			});
-			else if (isWalletCustodySeedBinding(selection.exportRoot.envelope.binding)) await establishUnlockedWalletEd25519ExportRootCapabilityV1(walletCustodyCeremonyTransportFromWorkerContextV1(args.context.signingEngine.getSignerWorkerContext()), {
+			else if (isWalletCustodySeedBinding(selection.exportRoot.envelope.binding) || selection.exportRoot.envelope.binding.kind === "ed25519_yao_client_root_v1") await establishUnlockedWalletEd25519ExportRootCapabilityV1(walletCustodyCeremonyTransportFromWorkerContextV1(args.context.signingEngine.getSignerWorkerContext()), {
 				existingEnvelope: selection.exportRoot.envelope,
 				existingFactorSecret: args.factorSecret32,
 				walletId: String(selection.walletId),
@@ -29188,7 +29086,7 @@ function pendingNearRegistrationMatchesAuthority(selection, activation, pending)
 	return pending.operation === "near_provisioning" && pending.phase === "joined" && pending.signerPlanKind === "near_ed25519_and_evm_family_ecdsa" && pending.walletId === selection.walletId && pending.walletAuthMethodId === selection.authMethod.walletAuthMethodId && mpcMaterialActivationRefsEqual(pending.localMaterial.ed25519.metadata.materialActivation, activation);
 }
 /**
-* R109C: install the Ed25519 runtime an owner authority's unlock just built.
+* Install the Ed25519 runtime an owner authority's unlock just built.
 *
 * Everything is checked against the authority and method that were selected,
 * before the handle is used: a session naming a different method, or a
@@ -29574,7 +29472,7 @@ async function unlockLinkedDevicePasskey(context, walletIdInput, options) {
 		});
 	}
 }
-async function unlockInternal(context, subjectSet, options, completion) {
+async function unlockInternal(context, subjectSet, options, _completion) {
 	const { onEvent, onError, afterCall } = options || {};
 	const { signingEngine } = context;
 	const walletUnlockSelection = resolveLoginWalletUnlockSelectionForSubjectSet({
@@ -29723,10 +29621,6 @@ async function unlockInternal(context, subjectSet, options, completion) {
 				identity: walletIdentity,
 				context: storedCanonicalEcdsaContext
 			});
-			buildConfiguredTargetKeyCompletion({
-				context: storedCanonicalEcdsaContext,
-				configuredTargets: warmupInput.selectedEcdsaTargets
-			});
 			const canFirstBootstrapThresholdEcdsa = Boolean(managedRuntimeScopeBootstrap);
 			const warmupPlan = resolveThresholdLoginWarmupPlan({
 				selection: warmupInput.selection,
@@ -32217,7 +32111,7 @@ async function logout(context) {
 }
 async function resumeNearAfterSuccessfulUnlock(args) {
 	try {
-		await (await import("./registration-D-istkMZ.js").then((n) => n.o)).resumeNearRegistrationAfterUnlock(args);
+		await (await import("./registration-BZDzDv91.js").then((n) => n.o)).resumeNearRegistrationAfterUnlock(args);
 	} catch (error) {
 		console.warn("[login] NEAR continuation could not start", error instanceof Error ? error.message : "module unavailable");
 	} finally {
@@ -32690,7 +32584,7 @@ async function requestDeviceV1(input) {
 	const publishableKey = input.options.publishableKey.trim();
 	const projectEnvironmentId = input.options.projectEnvironmentId.trim();
 	if (!publishableKey || !projectEnvironmentId) throw new Error("linked-device Passkey ceremony requires registration API credentials");
-	const bodyDigestB64u = parseDigestB64u(base64UrlEncode(await sha256Bytes(encodeRequestBodyV1(input.body))));
+	const bodyDigestB64u = await sha256DigestB64u(encodeRequestBodyV1(input.body));
 	const issuedAtMs = input.options.nowMs();
 	if (!Number.isSafeInteger(issuedAtMs) || issuedAtMs <= 0) throw new Error("linked-device request clock is invalid");
 	const expiresAtMs = issuedAtMs + LINKED_DEVICE_REQUEST_PROOF_MAX_TTL_MS_V1;
@@ -33340,7 +33234,7 @@ function buildDeviceLinkingEd25519ExportRootReplacementEnvelopeV1(input) {
 function createDeviceLinkingEd25519ExportRootPortV1(worker) {
 	return {
 		async createRecipientV1(input) {
-			const created = requireRecord$1(await worker.requestOperation({
+			const created = requireRecord(await worker.requestOperation({
 				kind: "walletCustodyCeremony",
 				request: {
 					type: "createLinkedDeviceEd25519ExportRootRecipient",
@@ -33381,7 +33275,7 @@ function createDeviceLinkingEd25519ExportRootPortV1(worker) {
 				registeredPublicKeyB64u: recipient.registeredPublicKeyB64u,
 				recipientPublicKeyB64u: recipient.recipientPublicKeyB64u
 			});
-			const sealed = requireRecord$1(await worker.requestOperation({
+			const sealed = requireRecord(await worker.requestOperation({
 				kind: "walletCustodyCeremony",
 				request: {
 					type: "sealEd25519ExportRootForLinkedDevice",
@@ -33440,7 +33334,7 @@ function createDeviceLinkingEd25519ExportRootPortV1(worker) {
 			});
 			const replacementFactorSecret = input.replacementFactorSecret.slice();
 			try {
-				const resealed = requireRecord$1(await worker.requestOperation({
+				const resealed = requireRecord(await worker.requestOperation({
 					kind: "walletCustodyCeremony",
 					request: {
 						type: "acceptLinkedDeviceEd25519ExportRoot",
@@ -33501,7 +33395,7 @@ function replacementEnvelopeFactorMatchesTargetFactor(targetFactor, replacementF
 function assertNeverLinkedDeviceTargetFactor(value) {
 	throw new Error(`Unsupported linked-device target factor kind: ${String(value)}`);
 }
-function requireRecord$1(value, label) {
+function requireRecord(value, label) {
 	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} returned no result`);
 	return value;
 }
@@ -33546,7 +33440,7 @@ function buildDeviceLinkingPendingAcknowledgementV1(acknowledgement) {
 }
 function parseDeviceLinkingPendingAcknowledgementV1(raw) {
 	const record = asPlainDeviceLinkingResumeRecord(raw);
-	if (record === null || !hasExactKeys(record, PENDING_ACKNOWLEDGEMENT_FIELDS) || record.kind !== "linked_device_pending_ack_v1") return null;
+	if (record === null || !hasExactKeys(record, PENDING_ACKNOWLEDGEMENT_FIELDS) || record.kind !== LINKED_DEVICE_PENDING_ACK_KIND_V1) return null;
 	try {
 		return {
 			kind: LINKED_DEVICE_PENDING_ACK_KIND_V1,
@@ -33638,7 +33532,7 @@ function compareDeviceLinkingCommittedResumeV1(input) {
 }
 function parseDeviceLinkingCommittedResumeV1(raw) {
 	const record = asPlainDeviceLinkingResumeRecord(raw);
-	if (record === null || !hasExactKeys(record, COMMITTED_RESUME_FIELDS) || record.kind !== "linked_device_committed_resume_v1") return null;
+	if (record === null || !hasExactKeys(record, COMMITTED_RESUME_FIELDS) || record.kind !== LINKED_DEVICE_COMMITTED_RESUME_KIND_V1) return null;
 	const linkSessionId = parseLinkDeviceSessionId(record.linkSessionId);
 	const walletId = parseWalletId(record.walletId);
 	const enrollmentId = parseLinkedDeviceEnrollmentId(record.enrollmentId);
@@ -34154,7 +34048,7 @@ function signerMaterialActivations(activations) {
 	throw new Error("committed signer activation families are invalid");
 }
 //#endregion
-//#region src/SeamsWeb/operations/devices/linkDevice.ts
+//#region src/SeamsWeb/operations/devices/linkDeviceFlowSupport.ts
 function linkedDeviceWalletAuthenticationState(walletSession, registration) {
 	switch (registration.targetFactor.kind) {
 		case "verified_passkey_target_v1": return {
@@ -34170,12 +34064,6 @@ function linkedDeviceWalletAuthenticationState(walletSession, registration) {
 		default: return registration.targetFactor;
 	}
 }
-function isPasskeyTargetPreparation(preparation) {
-	return preparation.targetFactor.kind === "passkey_prf";
-}
-function isEmailOtpTargetPreparation(preparation) {
-	return preparation.targetFactor.kind === "email_otp";
-}
 function createLinkSessionId() {
 	const parsed = parseLinkDeviceSessionId(secureRandomId("link-session", 32));
 	if (!parsed.ok) throw new Error(parsed.error.message);
@@ -34266,6 +34154,36 @@ async function generateQrCodeDataUrlV1(payload) {
 		margin: 2
 	});
 }
+function buildDevice2QrSessionPayloadV1(input) {
+	const requestedPermission = buildFullOwnerDelegatedWalletAuthorityV1();
+	if (input.target.targetFactor.kind === "email_otp") return buildQrLinkedDeviceSessionPayloadV5({
+		linkSessionId: input.linkSessionId,
+		linkPublicKeyB64u: input.linkPublicKeyB64u,
+		devicePublicKeyB64u: input.devicePublicKeyB64u,
+		requestedPermission,
+		targetFactor: { kind: "email_otp" },
+		targetEmail: normalizeLinkedDeviceTargetEmailAddressV1(input.target.targetEmail),
+		issuedAtMs: input.issuedAtMs,
+		expiresAtMs: input.expiresAtMs
+	});
+	return buildQrLinkedDeviceSessionPayloadV5({
+		linkSessionId: input.linkSessionId,
+		linkPublicKeyB64u: input.linkPublicKeyB64u,
+		devicePublicKeyB64u: input.devicePublicKeyB64u,
+		requestedPermission,
+		targetFactor: { kind: "passkey_prf" },
+		issuedAtMs: input.issuedAtMs,
+		expiresAtMs: input.expiresAtMs
+	});
+}
+//#endregion
+//#region src/SeamsWeb/operations/devices/linkDeviceTargetActivation.ts
+function isPasskeyTargetPreparation(preparation) {
+	return preparation.targetFactor.kind === "passkey_prf";
+}
+function isEmailOtpTargetPreparation(preparation) {
+	return preparation.targetFactor.kind === "email_otp";
+}
 function emailOtpTargetActivationBaseContextV1(context) {
 	return {
 		event: context.event,
@@ -34297,7 +34215,7 @@ function resolvePostLinkActivationV1(input) {
 	switch (input.targetFactor.kind) {
 		case "verified_passkey_target_v1": {
 			const activation = input.targetCredentialActivationState;
-			if (activation.kind !== "factor_ready" && activation.kind !== "consuming" || activation.runEpoch !== input.runEpoch) throw new Error("linked-device Passkey factor runtime is unavailable");
+			if (activation.kind !== "factor_ready" || activation.runEpoch !== input.runEpoch) throw new Error("linked-device Passkey factor runtime is unavailable");
 			return {
 				factor: {
 					kind: "passkey",
@@ -34368,32 +34286,12 @@ async function prepareNewEmailOtpEnrollmentMaterialV1(input) {
 		zeroizeLiveBytes$1(disposableSecret);
 	}
 }
-function buildDevice2QrSessionPayloadV1(input) {
-	const requestedPermission = buildFullOwnerDelegatedWalletAuthorityV1();
-	if (input.target.targetFactor.kind === "email_otp") return buildQrLinkedDeviceSessionPayloadV5({
-		linkSessionId: input.linkSessionId,
-		linkPublicKeyB64u: input.linkPublicKeyB64u,
-		devicePublicKeyB64u: input.devicePublicKeyB64u,
-		requestedPermission,
-		targetFactor: { kind: "email_otp" },
-		targetEmail: normalizeLinkedDeviceTargetEmailAddressV1(input.target.targetEmail),
-		issuedAtMs: input.issuedAtMs,
-		expiresAtMs: input.expiresAtMs
-	});
-	return buildQrLinkedDeviceSessionPayloadV5({
-		linkSessionId: input.linkSessionId,
-		linkPublicKeyB64u: input.linkPublicKeyB64u,
-		devicePublicKeyB64u: input.devicePublicKeyB64u,
-		requestedPermission,
-		targetFactor: { kind: "passkey_prf" },
-		issuedAtMs: input.issuedAtMs,
-		expiresAtMs: input.expiresAtMs
-	});
-}
 function requireNewEmailOtpEnrollmentMaterialV1(value) {
 	if (!value) throw new Error("new linked-device Email OTP enrollment material is unavailable");
 	return value;
 }
+//#endregion
+//#region src/SeamsWeb/operations/devices/linkDeviceFlow.ts
 var LinkDeviceFlow = class {
 	constructor(options, ports, getAuthenticationContext = null) {
 		this.session = null;
@@ -34562,15 +34460,8 @@ var LinkDeviceFlow = class {
 					case "claimed":
 					case "awaiting_target_factor":
 					case "awaiting_source_contribution":
-					case "provisioning": {
-						const identity = await this.resolveLinkIdentityV1(session.linkSessionId);
-						await authenticatedTransport.cancelSessionV1({ request: buildLinkedDeviceSessionCancelClaimedRequestV1({
-							linkSessionId: session.linkSessionId,
-							enrollmentId: identity.enrollmentId,
-							deviceId: identity.deviceId,
-							reason: "user_cancelled",
-							requestedAtMs: now
-						}) });
+					case "provisioning":
+						await this.cancelClaimedSessionV1(authenticatedTransport, session.linkSessionId, now);
 						this.session = {
 							...session,
 							state: {
@@ -34579,7 +34470,6 @@ var LinkDeviceFlow = class {
 							}
 						};
 						break;
-					}
 					case "authority_pending_local_install": break;
 					case "active":
 					case "expired":
@@ -34601,16 +34491,6 @@ var LinkDeviceFlow = class {
 			}
 		});
 	}
-	async reset() {
-		if (this.hasCommittedDeliveryState()) throw new Error("Device-link authority delivery is committed and must be resumed");
-		this.runEpoch += 1;
-		this.cancelled = true;
-		await this.cleanupLocalResources();
-		this.session = null;
-		this.error = void 0;
-		this.cancelled = false;
-		this.handledStates.clear();
-	}
 	async resolveLinkIdentityV1(linkSessionId) {
 		const cached = this.targetCredentialRegistrationResult;
 		if (cached && cached.linkSessionId === linkSessionId) return {
@@ -34628,6 +34508,16 @@ var LinkDeviceFlow = class {
 			deviceId: preparation.deviceId
 		};
 	}
+	async cancelClaimedSessionV1(transport, linkSessionId, requestedAtMs) {
+		const identity = await this.resolveLinkIdentityV1(linkSessionId);
+		await transport.cancelSessionV1({ request: buildLinkedDeviceSessionCancelClaimedRequestV1({
+			linkSessionId,
+			enrollmentId: identity.enrollmentId,
+			deviceId: identity.deviceId,
+			reason: "user_cancelled",
+			requestedAtMs
+		}) });
+	}
 	async handleSessionEvent(event) {
 		if (this.cancelled || this.deliveryRecoveryReason !== null || !this.session || event.linkSessionId !== this.session.linkSessionId) return;
 		logDevice2LinkingStageV1({
@@ -34682,14 +34572,9 @@ var LinkDeviceFlow = class {
 				await this.finishActiveAuthorityV1(event.state, result.session, result.operationCredential, runEpoch);
 				return;
 			}
-			case "active": {
-				const result = await this.activateAuthorityForStateV1(event.state, runEpoch);
-				if (result.kind === "pending_local_install") return;
-				if (result.kind === "integrity_error") throw new DeviceLinkingError(`Linked-device authority replay failed: ${result.reason}`, DeviceLinkingErrorCode.REGISTRATION_FAILED, "registration");
-				if (result.kind === "failed_before_commit" || result.kind === "relink_required") throw new DeviceLinkingError("Linked-device authority replay cannot continue", DeviceLinkingErrorCode.REGISTRATION_FAILED, "registration");
-				await this.finishActiveAuthorityV1(event.state, result.session, result.operationCredential, runEpoch);
+			case "active":
+				await this.replayCommittedAuthorityV1(event.state, runEpoch);
 				return;
-			}
 			case "expired": {
 				const error = new DeviceLinkingError("Device-link session expired", DeviceLinkingErrorCode.SESSION_EXPIRED, "registration");
 				this.error = error;
@@ -34852,25 +34737,7 @@ var LinkDeviceFlow = class {
 				workerEphemeralPublicKey65B64u
 			} });
 			this.assertCurrentRun(context.runEpoch);
-			this.emailOtpTargetActivationState = {
-				kind: "awaiting_code",
-				context: {
-					event: context.event,
-					state: context.state,
-					runEpoch: context.runEpoch,
-					deviceId: context.deviceId,
-					preparation: context.preparation,
-					ordinarySignerMaterialRecipientRequests: context.ordinarySignerMaterialRecipientRequests,
-					exportRoot: context.exportRoot,
-					challenge
-				}
-			};
-			this.notifyEmailOtpActivationV1({
-				kind: "code_input",
-				maskedEmailHint: challenge.maskedEmailHint,
-				expiresAtMs: challenge.expiresAtMs,
-				resendAvailableAtMs: challenge.resendAvailableAtMs
-			});
+			this.awaitTargetEmailOtpCodeV1(context, challenge);
 		} catch (error) {
 			if (this.isCurrentRun(context.runEpoch)) {
 				this.emailOtpTargetActivationState = {
@@ -34885,6 +34752,21 @@ var LinkDeviceFlow = class {
 			throw error;
 		}
 	}
+	awaitTargetEmailOtpCodeV1(context, challenge) {
+		this.emailOtpTargetActivationState = {
+			kind: "awaiting_code",
+			context: {
+				...emailOtpTargetActivationBaseContextV1(context),
+				challenge
+			}
+		};
+		this.notifyEmailOtpActivationV1({
+			kind: "code_input",
+			maskedEmailHint: challenge.maskedEmailHint,
+			expiresAtMs: challenge.expiresAtMs,
+			resendAvailableAtMs: challenge.resendAvailableAtMs
+		});
+	}
 	resendTargetEmailOtpCodeV1() {
 		const state = this.emailOtpTargetActivationState;
 		if (state.kind === "resending") return state.promise;
@@ -34914,25 +34796,7 @@ var LinkDeviceFlow = class {
 				challengeId: context.challenge.challengeId
 			} });
 			this.assertCurrentRun(context.runEpoch);
-			this.emailOtpTargetActivationState = {
-				kind: "awaiting_code",
-				context: {
-					event: context.event,
-					state: context.state,
-					runEpoch: context.runEpoch,
-					deviceId: context.deviceId,
-					preparation: context.preparation,
-					ordinarySignerMaterialRecipientRequests: context.ordinarySignerMaterialRecipientRequests,
-					exportRoot: context.exportRoot,
-					challenge
-				}
-			};
-			this.notifyEmailOtpActivationV1({
-				kind: "code_input",
-				maskedEmailHint: challenge.maskedEmailHint,
-				expiresAtMs: challenge.expiresAtMs,
-				resendAvailableAtMs: challenge.resendAvailableAtMs
-			});
+			this.awaitTargetEmailOtpCodeV1(context, challenge);
 		} catch (error) {
 			if (this.isCurrentRun(context.runEpoch)) {
 				const message = errorMessage(error) || "Email OTP resend is unavailable";
@@ -35063,32 +34927,14 @@ var LinkDeviceFlow = class {
 					enrollmentId: emailOtpEnrollmentId,
 					enrollmentSealKeyVersion: emailOtpEnrollmentSealKeyVersion
 				});
-				const binding = buildEd25519YaoClientRootBinding({
-					linkSessionId: preparation.linkSessionId,
-					walletKeyId: exportRoot.walletKeyId,
-					targetFactor: preparation.targetFactor,
-					applicationBindingDigestB64u: exportRoot.applicationBindingDigestB64u,
-					registeredPublicKeyB64u: exportRoot.registeredPublicKeyB64u,
-					enrollmentId: preparation.enrollmentId,
-					deviceId: preparation.deviceId,
-					revocationEpoch: exportRoot.revocationEpoch
-				});
-				this.resealedExportRoot = await acceptLinkedDeviceEd25519ExportRootV1({
-					ed25519ExportRoot: this.ports.ed25519ExportRoot,
-					transport: this.requireAuthenticatedTransport(),
+				this.resealedExportRoot = await this.acceptTargetExportRootV1({
+					preparation,
+					exportRoot,
 					recipient,
-					replacementEnvelope: buildDeviceLinkingEd25519ExportRootReplacementEnvelopeV1({
-						walletId: preparation.walletId,
-						ownership: buildMethodBoundEnvelopeOwnership(preparation.walletAuthMethodId),
-						envelopeId,
-						factor,
-						binding,
-						createdAtMs: Date.now()
-					}),
+					envelopeId,
+					factor,
 					replacementFactorSecret: new Uint8Array(factorSecret),
-					expiresAtMs: Math.min(preparation.expiresAtMs, this.requireSessionV1().qrData.expiresAtMs),
-					assertCurrentRun: () => this.assertCurrentRun(context.runEpoch),
-					waitForPollV1: waitForSessionStateRetry
+					runEpoch: context.runEpoch
 				});
 				recipient = null;
 			}
@@ -35180,9 +35026,6 @@ var LinkDeviceFlow = class {
 			case "factor_ready":
 				if (this.targetCredentialActivationState.runEpoch === input.runEpoch) return Promise.reject(/* @__PURE__ */ new Error("Device-link target passkey activation has already completed"));
 				return Promise.reject(new LinkDeviceFlowSupersededError());
-			case "consuming":
-				if (this.targetCredentialActivationState.runEpoch === input.runEpoch) return Promise.reject(/* @__PURE__ */ new Error("Device-link target passkey activation is already being consumed"));
-				return Promise.reject(new LinkDeviceFlowSupersededError());
 			default: return assertNeverTargetCredentialActivationState(this.targetCredentialActivationState);
 		}
 		const activation = this.runTargetCredentialActivation(input);
@@ -35231,27 +35074,9 @@ var LinkDeviceFlow = class {
 			default: throw new Error("linked-device target factor is unsupported");
 		}
 	}
-	claimTargetCredentialFactorSecret(runEpoch) {
-		switch (this.targetCredentialActivationState.kind) {
-			case "idle": return null;
-			case "in_progress": throw new Error("Device-link target passkey activation is still in progress");
-			case "factor_ready": {
-				if (this.targetCredentialActivationState.runEpoch !== runEpoch) throw new LinkDeviceFlowSupersededError();
-				const factorSecret = this.targetCredentialActivationState.factorSecret;
-				this.targetCredentialActivationState = {
-					kind: "consuming",
-					runEpoch,
-					factorSecret
-				};
-				return factorSecret;
-			}
-			case "consuming": throw new Error("Device-link target passkey activation is already being consumed");
-			default: return assertNeverTargetCredentialActivationState(this.targetCredentialActivationState);
-		}
-	}
 	clearTargetCredentialActivationState() {
 		const state = this.targetCredentialActivationState;
-		if (state.kind === "factor_ready" || state.kind === "consuming") zeroizeLiveBytes$1(state.factorSecret);
+		if (state.kind === "factor_ready") zeroizeLiveBytes$1(state.factorSecret);
 		this.targetCredentialActivationState = { kind: "idle" };
 	}
 	async createTargetCredential(input) {
@@ -35318,32 +35143,14 @@ var LinkDeviceFlow = class {
 					rpId: requireTargetRpIdV1(preparation),
 					credentialIdB64u: credential.webauthnRegistration.credentialIdB64u
 				});
-				const binding = buildEd25519YaoClientRootBinding({
-					linkSessionId: preparation.linkSessionId,
-					walletKeyId: exportRoot.walletKeyId,
-					targetFactor: preparation.targetFactor,
-					applicationBindingDigestB64u: exportRoot.applicationBindingDigestB64u,
-					registeredPublicKeyB64u: exportRoot.registeredPublicKeyB64u,
-					enrollmentId: preparation.enrollmentId,
-					deviceId: preparation.deviceId,
-					revocationEpoch: exportRoot.revocationEpoch
-				});
-				const resealed = await acceptLinkedDeviceEd25519ExportRootV1({
-					ed25519ExportRoot: this.ports.ed25519ExportRoot,
-					transport: authenticatedTransport,
+				const resealed = await this.acceptTargetExportRootV1({
+					preparation,
+					exportRoot,
 					recipient,
-					replacementEnvelope: buildDeviceLinkingEd25519ExportRootReplacementEnvelopeV1({
-						walletId: preparation.walletId,
-						ownership: buildMethodBoundEnvelopeOwnership(preparation.walletAuthMethodId),
-						envelopeId,
-						factor,
-						binding,
-						createdAtMs: Date.now()
-					}),
+					envelopeId,
+					factor,
 					replacementFactorSecret: credential.factorSecret,
-					expiresAtMs: Math.min(preparation.expiresAtMs, this.session.qrData.expiresAtMs),
-					assertCurrentRun: () => this.assertCurrentRun(runEpoch),
-					waitForPollV1: waitForSessionStateRetry
+					runEpoch
 				});
 				logDevice2LinkingStageV1({
 					flowId: this.flowId,
@@ -35394,6 +35201,36 @@ var LinkDeviceFlow = class {
 			throw error;
 		}
 	}
+	async acceptTargetExportRootV1(input) {
+		const { preparation, exportRoot } = input;
+		const binding = buildEd25519YaoClientRootBinding({
+			linkSessionId: preparation.linkSessionId,
+			walletKeyId: exportRoot.walletKeyId,
+			targetFactor: preparation.targetFactor,
+			applicationBindingDigestB64u: exportRoot.applicationBindingDigestB64u,
+			registeredPublicKeyB64u: exportRoot.registeredPublicKeyB64u,
+			enrollmentId: preparation.enrollmentId,
+			deviceId: preparation.deviceId,
+			revocationEpoch: exportRoot.revocationEpoch
+		});
+		return await acceptLinkedDeviceEd25519ExportRootV1({
+			ed25519ExportRoot: this.ports.ed25519ExportRoot,
+			transport: this.requireAuthenticatedTransport(),
+			recipient: input.recipient,
+			replacementEnvelope: buildDeviceLinkingEd25519ExportRootReplacementEnvelopeV1({
+				walletId: preparation.walletId,
+				ownership: buildMethodBoundEnvelopeOwnership(preparation.walletAuthMethodId),
+				envelopeId: input.envelopeId,
+				factor: input.factor,
+				binding,
+				createdAtMs: Date.now()
+			}),
+			replacementFactorSecret: input.replacementFactorSecret,
+			expiresAtMs: Math.min(preparation.expiresAtMs, this.requireSessionV1().qrData.expiresAtMs),
+			assertCurrentRun: () => this.assertCurrentRun(input.runEpoch),
+			waitForPollV1: waitForSessionStateRetry
+		});
+	}
 	assertTargetPreparationMatchesSession(input) {
 		const sessionTargetFactor = this.requireSessionTargetFactorV1();
 		const qrData = this.requireSessionV1().qrData;
@@ -35493,10 +35330,7 @@ var LinkDeviceFlow = class {
 			acknowledgedAtMs: Date.now()
 		};
 		await this.ports.authorityInstallation.persistPendingActivationAcknowledgementV1({ acknowledgement });
-		await this.closeSessionSubscriptionV1();
-		await this.requireAuthenticatedTransport().acknowledgeLocalAuthorityActivationV1({ acknowledgement });
-		await this.ports.authorityInstallation.clearPendingActivationAcknowledgementV1({ authorityId: acknowledgement.authorityId });
-		await this.ports.authorityInstallation.clearCommittedDeliveryResumeV1({ authorityId: acknowledgement.authorityId });
+		await this.sendActivationAcknowledgementV1(acknowledgement);
 		this.session = activeSession;
 		authenticationContext.signingEngine.setWalletAuthenticated(linkedDeviceWalletAuthenticationState(walletSession, registration));
 		await this.cleanupCompletedLocalResources();
@@ -35546,13 +35380,9 @@ var LinkDeviceFlow = class {
 		return preparation;
 	}
 	startRun() {
-		this.clearTargetCredentialActivationState();
-		this.clearEmailOtpTargetActivationState();
-		this.resealedExportRoot = null;
-		this.targetCredentialRegistrationResult = null;
+		this.clearRunActivationStateV1();
 		this.committedAuthorityPackages = null;
 		this.deliveryRecoveryReason = null;
-		this.ordinarySignerMaterialRecipientPreparation = null;
 		this.runEpoch += 1;
 		this.generationInProgress = true;
 		this.cancelled = false;
@@ -35640,12 +35470,8 @@ var LinkDeviceFlow = class {
 				error: cleanupError
 			});
 		}
-		this.clearTargetCredentialActivationState();
-		this.clearEmailOtpTargetActivationState();
-		this.resealedExportRoot = null;
-		this.targetCredentialRegistrationResult = null;
+		this.clearRunActivationStateV1();
 		this.committedAuthorityPackages = null;
-		this.ordinarySignerMaterialRecipientPreparation = null;
 		this.keyMaterialHandle = null;
 		this.deliveryRecipientPublicKey65B64u = null;
 		this.authenticatedTransport = null;
@@ -35658,18 +35484,19 @@ var LinkDeviceFlow = class {
 		switch (event.state.state) {
 			case "provisioning":
 			case "authority_pending_local_install":
-			case "active": {
-				const runEpoch = this.runEpoch;
-				const result = await this.activateAuthorityForStateV1(event.state, runEpoch);
-				if (result.kind === "pending_local_install") return;
-				if (result.kind === "integrity_error") throw new DeviceLinkingError(`Linked-device authority replay failed: ${result.reason}`, DeviceLinkingErrorCode.REGISTRATION_FAILED, "registration");
-				if (result.kind === "failed_before_commit" || result.kind === "relink_required") throw new DeviceLinkingError("Linked-device authority replay cannot continue", DeviceLinkingErrorCode.REGISTRATION_FAILED, "registration");
-				await this.finishActiveAuthorityV1(event.state, result.session, result.operationCredential, runEpoch);
+			case "active":
+				await this.replayCommittedAuthorityV1(event.state, this.runEpoch);
 				return;
-			}
 			default: throw new Error(`committed link delivery cannot resume from ${event.state.state}`);
 		}
 	}
+	async replayCommittedAuthorityV1(state, runEpoch) {
+		const result = await this.activateAuthorityForStateV1(state, runEpoch);
+		if (result.kind === "pending_local_install") return;
+		if (result.kind === "integrity_error") throw new DeviceLinkingError(`Linked-device authority replay failed: ${result.reason}`, DeviceLinkingErrorCode.REGISTRATION_FAILED, "registration");
+		if (result.kind === "failed_before_commit" || result.kind === "relink_required") throw new DeviceLinkingError("Linked-device authority replay cannot continue", DeviceLinkingErrorCode.REGISTRATION_FAILED, "registration");
+		await this.finishActiveAuthorityV1(state, result.session, result.operationCredential, runEpoch);
+	}
 	async replayPendingActivationAcknowledgementV1() {
 		const committed = this.committedAuthorityPackages;
 		if (!committed) return false;
@@ -35677,12 +35504,15 @@ var LinkDeviceFlow = class {
 		if (!pending) return false;
 		const session = this.requireSessionV1();
 		if (pending.linkSessionId !== session.qrData.linkSessionId || pending.authorityId !== committed.authority.authorityId || pending.packageSetDigestB64u !== committed.packageSetDigestB64u) throw new Error("pending linked-device acknowledgement identity is inconsistent");
-		await this.closeSessionSubscriptionV1();
-		await this.requireAuthenticatedTransport().acknowledgeLocalAuthorityActivationV1({ acknowledgement: pending });
-		await this.ports.authorityInstallation.clearPendingActivationAcknowledgementV1({ authorityId: pending.authorityId });
-		await this.ports.authorityInstallation.clearCommittedDeliveryResumeV1({ authorityId: pending.authorityId });
+		await this.sendActivationAcknowledgementV1(pending);
 		return true;
 	}
+	async sendActivationAcknowledgementV1(acknowledgement) {
+		await this.closeSessionSubscriptionV1();
+		await this.requireAuthenticatedTransport().acknowledgeLocalAuthorityActivationV1({ acknowledgement });
+		await this.ports.authorityInstallation.clearPendingActivationAcknowledgementV1({ authorityId: acknowledgement.authorityId });
+		await this.ports.authorityInstallation.clearCommittedDeliveryResumeV1({ authorityId: acknowledgement.authorityId });
+	}
 	async cancelFailedPrecommitSession(event) {
 		const transport = this.authenticatedTransport;
 		if (!transport) return;
@@ -35692,14 +35522,7 @@ var LinkDeviceFlow = class {
 			case "awaiting_source_contribution":
 			case "provisioning": {
 				const cancelledAtMs = Date.now();
-				const identity = await this.resolveLinkIdentityV1(event.linkSessionId);
-				await transport.cancelSessionV1({ request: buildLinkedDeviceSessionCancelClaimedRequestV1({
-					linkSessionId: event.linkSessionId,
-					enrollmentId: identity.enrollmentId,
-					deviceId: identity.deviceId,
-					reason: "user_cancelled",
-					requestedAtMs: cancelledAtMs
-				}) });
+				await this.cancelClaimedSessionV1(transport, event.linkSessionId, cancelledAtMs);
 				if (this.session?.linkSessionId === event.linkSessionId) this.session = {
 					...this.session,
 					state: {
@@ -35721,13 +35544,7 @@ var LinkDeviceFlow = class {
 	async cleanupLocalResources(force = false) {
 		if (!force && this.hasCommittedDeliveryState()) return;
 		const preserveCommittedState = force && this.hasCommittedDeliveryState();
-		if (!preserveCommittedState) {
-			this.clearTargetCredentialActivationState();
-			this.clearEmailOtpTargetActivationState();
-			this.resealedExportRoot = null;
-			this.targetCredentialRegistrationResult = null;
-			this.ordinarySignerMaterialRecipientPreparation = null;
-		}
+		if (!preserveCommittedState) this.clearRunActivationStateV1();
 		let failure;
 		const subscription = this.subscription;
 		if (subscription) try {
@@ -35743,14 +35560,17 @@ var LinkDeviceFlow = class {
 		}
 		if (failure) throw failure;
 		if (preserveCommittedState) {
-			this.clearTargetCredentialActivationState();
-			this.clearEmailOtpTargetActivationState();
-			this.resealedExportRoot = null;
-			this.targetCredentialRegistrationResult = null;
-			this.ordinarySignerMaterialRecipientPreparation = null;
+			this.clearRunActivationStateV1();
 			this.committedAuthorityPackages = null;
 		}
 	}
+	clearRunActivationStateV1() {
+		this.clearTargetCredentialActivationState();
+		this.clearEmailOtpTargetActivationState();
+		this.resealedExportRoot = null;
+		this.targetCredentialRegistrationResult = null;
+		this.ordinarySignerMaterialRecipientPreparation = null;
+	}
 	async closeSessionSubscriptionV1() {
 		const subscription = this.subscription;
 		if (!subscription) return;
@@ -35809,6 +35629,8 @@ var LinkDeviceFlow = class {
 		}));
 	}
 };
+//#endregion
+//#region src/SeamsWeb/operations/devices/linkDevice.ts
 function isFinishedDeviceLinkFlow(flow) {
 	const state = flow.getState();
 	if (state.cancelled || state.error || !state.session) return true;
@@ -37017,7 +36839,8 @@ async function signNEP413Message(args) {
 		};
 	}
 }
-Object.freeze({ kind: "threshold_secp256k1_ecdsa_2p_v1" });
+//#endregion
+//#region ../shared-ts/src/threshold/secp256k1.ts
 const THRESHOLD_SECP256K1_ECDSA_2P_PARTICIPANT_IDS_V1 = [1, 2];
 //#endregion
 //#region src/SeamsWeb/operations/registration/registrationSignerSet.ts
@@ -39487,6 +39310,9 @@ function createCurrentWalletResolver(deps) {
 		}
 	};
 }
+//#endregion
+//#region src/SeamsWeb/publicApi/awaitNearReady.ts
+const DEFAULT_AWAIT_NEAR_READY_TIMEOUT_MS = 12e4;
 function outcomeFor(state) {
 	if (!state) return null;
 	if (state.status === "near_ready") return {
@@ -39510,7 +39336,7 @@ function outcomeFor(state) {
 async function awaitNearReady(deps, args) {
 	const walletId = String(args.walletId || "").trim();
 	if (!walletId) throw new Error("[seams] awaitNearReady requires a walletId");
-	const timeoutMs = Math.max(1, Math.floor(Number(args.timeoutMs) || 0)) || 12e4;
+	const timeoutMs = Math.max(1, Math.floor(Number(args.timeoutMs) || 0)) || DEFAULT_AWAIT_NEAR_READY_TIMEOUT_MS;
 	let unsubscribe = null;
 	let timer = null;
 	let onAbort = null;
@@ -39788,7 +39614,7 @@ function createDeviceLinkingOrdinaryMaterialWorkerPortV1(send) {
 			const transfer = [input.factorSecret, ...recipientInputTransferables(recipientInputs)];
 			return parsePreparationResult(await send({
 				kind: "device_linking_ordinary_signer_material_prepare_private_v1",
-				handleId: requireString$1(input.keyMaterial.handleId, "keyMaterial.handleId"),
+				handleId: requireCanonicalString(input.keyMaterial.handleId, "keyMaterial.handleId", "is required"),
 				targetFactor: targetFactorBindingV1(input.targetFactor),
 				preparations,
 				recipientRequests,
@@ -39799,7 +39625,7 @@ function createDeviceLinkingOrdinaryMaterialWorkerPortV1(send) {
 		async createOrdinarySignerMaterialRecipientRequestsV1(input) {
 			return parseRecipientPreparationResult(await send({
 				kind: "device_linking_ordinary_signer_material_recipient_prepare_v1",
-				handleId: requireString$1(input.keyMaterial.handleId, "keyMaterial.handleId"),
+				handleId: requireCanonicalString(input.keyMaterial.handleId, "keyMaterial.handleId", "is required"),
 				requirements: parseRecipientRequirementTuple(input.requirements)
 			}));
 		},
@@ -39807,7 +39633,7 @@ function createDeviceLinkingOrdinaryMaterialWorkerPortV1(send) {
 			const committed = parseCommittedAuthorityPackagesV1(input.committed);
 			return parseSealedLocalAuthorityMaterialSetV1(await send({
 				kind: "device_linking_ordinary_signer_material_seal_v1",
-				handleId: requireString$1(input.keyMaterial.handleId, "keyMaterial.handleId"),
+				handleId: requireCanonicalString(input.keyMaterial.handleId, "keyMaterial.handleId", "is required"),
 				committed,
 				targetFactor: targetFactorBindingV1(input.targetFactor),
 				resealedExportRoot: parseOrdinaryResealedExportRootRecordV1(input.resealedExportRoot)
@@ -39860,7 +39686,7 @@ function parseRecipientRequirementTuple(value) {
 }
 function parseRecipientRequestTuple(value) {
 	if (!Array.isArray(value) || value.length === 0 || value.length > 2) throw new Error("ordinary signer material recipient requests must contain one or two entries");
-	const requests = value.map((entry, index) => {
+	const requests = value.map((entry) => {
 		if (isOrdinaryEd25519RecipientRequestRecordV1(entry)) {
 			if (entry.kind !== "ordinary_ed25519_signer_material_recipient_request_v1" || entry.keyFamily !== "ed25519") throw new Error("ordinary Ed25519 recipient request kind is invalid");
 			return {
@@ -39876,7 +39702,7 @@ function parseRecipientRequestTuple(value) {
 				kind: "ordinary_ecdsa_signer_material_recipient_request_v1",
 				keyFamily: "ecdsa_secp256k1",
 				walletKeyId: parseWalletKey(entry.walletKeyId),
-				clientEphemeralPublicKey: requireString$1(entry.clientEphemeralPublicKey, "ECDSA client ephemeral public key")
+				clientEphemeralPublicKey: requireCanonicalString(entry.clientEphemeralPublicKey, "ECDSA client ephemeral public key", "is required")
 			};
 		}
 		throw new Error("ordinary recipient request key family is invalid");
@@ -39899,7 +39725,7 @@ function parseRecipientPreparationResult(value) {
 }
 function parseRecipientInputTuple(value) {
 	if (!Array.isArray(value) || value.length === 0 || value.length > 2) throw new Error("ordinary signer material recipient inputs must contain one or two entries");
-	const inputs = value.map((entry, index) => {
+	const inputs = value.map((entry) => {
 		if (isOrdinaryEd25519RecipientInputRecordV1(entry)) {
 			if (entry.kind !== "ordinary_ed25519_signer_material_recipient_input_v1" || entry.keyFamily !== "ed25519") throw new Error("ordinary Ed25519 recipient input kind is invalid");
 			return {
@@ -39966,7 +39792,7 @@ function parseTargetFactorBindingV1(value) {
 			kind: "passkey",
 			walletAuthMethodId: authMethod.value,
 			verificationDigestB64u,
-			rpId: requireString$1(value.rpId, "ordinary target factor rpId"),
+			rpId: requireCanonicalString(value.rpId, "ordinary target factor rpId", "is required"),
 			credentialIdB64u: parseB64u(value.credentialIdB64u, "ordinary target factor credentialIdB64u")
 		};
 	}
@@ -39975,14 +39801,14 @@ function parseTargetFactorBindingV1(value) {
 		const authMethod = parseWalletAuthMethodId(value.walletAuthMethodId);
 		if (!authMethod.ok) throw new Error(authMethod.error.message);
 		const verificationDigestB64u = parseDigestB64u(value.verificationDigestB64u);
-		const emailHashHex = requireString$1(value.emailHashHex, "ordinary target factor emailHashHex");
+		const emailHashHex = requireCanonicalString(value.emailHashHex, "ordinary target factor emailHashHex", "is required");
 		if (!/^[0-9a-f]{64}$/.test(emailHashHex)) throw new Error("ordinary target factor emailHashHex is invalid");
 		return {
 			kind: "email_otp",
 			walletAuthMethodId: authMethod.value,
 			verificationDigestB64u,
 			emailHashHex,
-			registrationAuthorityId: requireString$1(value.registrationAuthorityId, "ordinary target factor registrationAuthorityId")
+			registrationAuthorityId: requireCanonicalString(value.registrationAuthorityId, "ordinary target factor registrationAuthorityId", "is required")
 		};
 	}
 	throw new Error("ordinary material target factor kind is unsupported");
@@ -40017,7 +39843,7 @@ function parseSealedLocalAuthorityMaterialSetV1(value) {
 	};
 }
 function parseB64u(value, label) {
-	const encoded = requireString$1(value, label);
+	const encoded = requireCanonicalString(value, label, "is required");
 	let decoded;
 	try {
 		decoded = base64UrlDecode(encoded);
@@ -40067,10 +39893,6 @@ function isWalletAuthorityExportRootRecordV1(value) {
 function isSealedLocalAuthorityMaterialSetRecordV1(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "exportRoot|installedRecordSetDigestB64u|signerMaterials";
 }
-function requireString$1(value, label) {
-	if (typeof value !== "string" || value.trim() !== value || value.length === 0) throw new Error(`${label} is required`);
-	return value;
-}
 //#endregion
 //#region src/SeamsWeb/operations/devices/deviceLinkingWorkerChannels.ts
 function isDeviceLinkingKeyHandleRecordV1(value) {
@@ -40675,122 +40497,16 @@ function createDeviceLinkingFlowPortsV1(args) {
 	};
 }
 //#endregion
-//#region src/SeamsWeb/operations/devices/walletHostComposition.ts
-const LINKED_DEVICE_MANAGEMENT_HTTP_BASE_PATH_V1 = "/wallet/device-linking/v1/devices";
-const OWNER_WALLET_SESSION_REAUTH_REQUIRED = "owner_wallet_session_reauth_required";
-var OwnerWalletSessionReauthRequiredError = class extends Error {
-	constructor() {
-		super("The owner Wallet Session must be renewed");
-		this.code = OWNER_WALLET_SESSION_REAUTH_REQUIRED;
-		this.name = "OwnerWalletSessionReauthRequiredError";
-	}
-};
-function createWalletHostCompositionV1(args) {
-	const deviceLinkingPorts = createDeviceLinkingFlowPortsV1(args);
-	return {
-		linkedDeviceManagement: createWalletHostLinkedDeviceManagementPortV1({ request: args.managementRequest }),
-		deviceLinkingPorts,
-		dispose: deviceLinkingPorts.dispose
-	};
-}
-function createWalletHostLinkedDeviceManagementPortV1(args) {
-	return {
-		listLinkedDevices: async ({ walletId, limit, cursor }) => {
-			const request = parseLinkedDeviceListRequestV1({
-				kind: "linked_device_list_request_v1",
-				walletId,
-				limit,
-				cursor
-			});
-			const path = `${LINKED_DEVICE_MANAGEMENT_HTTP_BASE_PATH_V1}?walletId=${encodeURIComponent(String(request.walletId))}&limit=${encodeURIComponent(String(request.limit))}&cursor=${encodeURIComponent(request.cursor ?? "")}`;
-			const response = await args.request.request({
-				method: "GET",
-				canonicalPath: path,
-				walletId: request.walletId
-			});
-			assertManagementSuccess(response, "list linked devices");
-			return parseLinkedDeviceListResponseV1(response.body);
-		},
-		revokeLinkedDevice: async ({ walletId, walletAuthMethodId, requestedAtMs, sourceProof }) => {
-			const request = parseLinkedDeviceRevokeRequestV1({
-				kind: "linked_device_revoke_request_v1",
-				walletId,
-				walletAuthMethodId,
-				requestedAtMs
-			});
-			return parseManagementRevokeResult(await args.request.request({
-				method: "POST",
-				canonicalPath: `${LINKED_DEVICE_MANAGEMENT_HTTP_BASE_PATH_V1}/${encodeURIComponent(String(walletAuthMethodId))}/revoke`,
-				body: {
-					...request,
-					sourceProof
-				},
-				walletId
-			}));
-		}
-	};
-}
-function parseManagementRevokeResult(response) {
-	if (response.status === 404) return parseLinkedDeviceRevokeResultV1({ kind: "not_found" });
-	if (response.status === 409) return parseLinkedDeviceRevokeResultV1({ kind: "conflict" });
-	if (response.status === 401 || response.status === 403) return parseLinkedDeviceRevokeResultV1({ kind: "unauthorized" });
-	assertManagementSuccess(response, "revoke linked device");
-	return parseLinkedDeviceRevokeResponseV1(response.body);
-}
-function assertManagementSuccess(response, operation) {
-	if (response.status < 200 || response.status >= 300) {
-		if (response.status === 401 && isManagementUnauthorizedFailureRecordV1(response.body)) throw new OwnerWalletSessionReauthRequiredError();
-		const detail = managementFailureDetail(response.body);
-		throw new Error(detail ? `linked-device ${operation} failed with HTTP ${response.status}: ${detail}` : `linked-device ${operation} failed with HTTP ${response.status}`);
-	}
-}
-function managementFailureDetail(raw) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
-	if (isManagementFailureWithMessageRecordV1(raw)) return raw.message;
-	if (isManagementUnauthorizedFailureRecordV1(raw)) return raw.message;
-	return null;
-}
-function parseLinkedDeviceListResponseV1(raw) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("linked-device list response must be an object");
-	if (!isLinkedDeviceListResponseRecordV1(raw)) throw new Error("linked-device list response has unexpected fields");
-	if (raw.ok !== true) throw new Error("linked-device list response is not successful");
-	return parseLinkedDeviceListResultV1({
-		devices: raw.devices,
-		ownerDevices: raw.ownerDevices,
-		nextCursor: raw.nextCursor
-	});
-}
-function isLinkedDeviceListResponseRecordV1(value) {
-	return Object.keys(value).sort().join("|") === "devices|nextCursor|ok|ownerDevices";
-}
-function parseLinkedDeviceRevokeResponseV1(raw) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("linked-device revoke response must be an object");
-	if (!isLinkedDeviceRevokeResponseRecordV1(raw)) throw new Error("linked-device revoke response has unexpected fields");
-	if (raw.ok !== true) throw new Error("linked-device revoke response is not successful");
-	return parseLinkedDeviceRevokeResultV1({
-		kind: raw.kind,
-		walletAuthMethodId: raw.walletAuthMethodId,
-		authorityId: raw.authorityId,
-		revocationEpoch: raw.revocationEpoch
-	});
-}
-function isLinkedDeviceRevokeResponseRecordV1(value) {
-	return Object.keys(value).sort().join("|") === "authorityId|kind|ok|revocationEpoch|walletAuthMethodId";
-}
-function isManagementFailureWithMessageRecordV1(value) {
-	if (Object.keys(value).sort().join("|") !== "kind|message|ok") return false;
-	if (!("ok" in value) || !("kind" in value) || !("message" in value)) return false;
-	return value.ok === false && (value.kind === "invalid_input" || value.kind === "internal") && typeof value.message === "string" && value.message.trim().length > 0;
-}
-function isManagementUnauthorizedFailureRecordV1(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
-	if (Object.keys(value).sort().join("|") !== "code|kind|message|ok") return false;
-	if (!("ok" in value) || !("kind" in value) || !("code" in value) || !("message" in value)) return false;
-	return value.ok === false && value.kind === "unauthorized" && typeof value.code === "string" && typeof value.message === "string" && value.message.trim().length > 0;
-}
-//#endregion
 //#region src/SeamsWeb/operations/devices/walletHostOwnerAuthority.ts
 const OWNER_AUTHORIZATION_PATH = "/wallet/device-linking/v1/owner-authorization";
+/** An owner request that received no answer: the network failed, or it timed out. */
+var WalletHostOwnerRequestTransportError = class extends Error {
+	constructor(code, message) {
+		super(`Owner Router request failed: ${message}`);
+		this.code = code;
+		this.name = "WalletHostOwnerRequestTransportError";
+	}
+};
 function createWalletHostOwnerAuthoritiesV1(input) {
 	const context = normalizeContext(input);
 	return {
@@ -40808,7 +40524,7 @@ function normalizeContext(input) {
 	};
 }
 /**
-* The R103 fail-closed preflight, exact result `wallet_unlock_required`.
+* The fail-closed preflight, exact result `wallet_unlock_required`.
 *
 * The locked and missing-session arms run before any network I/O. The
 * export-root arm runs after the stateless owner-authorization read, because
@@ -40892,7 +40608,7 @@ async function requestWithCredentialV1(context, walletSessionToken, input) {
 		headers: { authorization: `Bearer ${walletSessionToken}` },
 		...input.body === void 0 ? {} : { body: input.body }
 	});
-	if (!response.ok) throw new Error(`Owner Router request failed: ${response.message}`);
+	if (!response.ok) throw new WalletHostOwnerRequestTransportError(response.code, response.message);
 	return response.value;
 }
 function parseOwnerAuthorizationResponseV1(raw, session) {
@@ -40961,6 +40677,129 @@ function positiveSafeInteger(raw, label) {
 	return Number(raw);
 }
 //#endregion
+//#region src/SeamsWeb/operations/devices/walletHostComposition.ts
+const LINKED_DEVICE_MANAGEMENT_HTTP_BASE_PATH_V1 = "/wallet/device-linking/v1/devices";
+const OWNER_WALLET_SESSION_REAUTH_REQUIRED = "owner_wallet_session_reauth_required";
+var OwnerWalletSessionReauthRequiredError = class extends Error {
+	constructor() {
+		super("The owner Wallet Session must be renewed");
+		this.code = OWNER_WALLET_SESSION_REAUTH_REQUIRED;
+		this.name = "OwnerWalletSessionReauthRequiredError";
+	}
+};
+function createWalletHostCompositionV1(args) {
+	const deviceLinkingPorts = createDeviceLinkingFlowPortsV1(args);
+	return {
+		linkedDeviceManagement: createWalletHostLinkedDeviceManagementPortV1({ request: args.managementRequest }),
+		deviceLinkingPorts,
+		dispose: deviceLinkingPorts.dispose
+	};
+}
+function createWalletHostLinkedDeviceManagementPortV1(args) {
+	return {
+		listLinkedDevices: async ({ walletId, limit, cursor }) => {
+			const request = parseLinkedDeviceListRequestV1({
+				kind: "linked_device_list_request_v1",
+				walletId,
+				limit,
+				cursor
+			});
+			const path = `${LINKED_DEVICE_MANAGEMENT_HTTP_BASE_PATH_V1}?walletId=${encodeURIComponent(String(request.walletId))}&limit=${encodeURIComponent(String(request.limit))}&cursor=${encodeURIComponent(request.cursor ?? "")}`;
+			const response = await args.request.request({
+				method: "GET",
+				canonicalPath: path,
+				walletId: request.walletId
+			});
+			assertManagementSuccess(response, "list linked devices");
+			return parseLinkedDeviceListResponseV1(response.body);
+		},
+		revokeLinkedDevice: async ({ walletId, walletAuthMethodId, requestedAtMs, sourceProof }) => {
+			const request = parseLinkedDeviceRevokeRequestV1({
+				kind: "linked_device_revoke_request_v1",
+				walletId,
+				walletAuthMethodId,
+				requestedAtMs
+			});
+			const send = async () => await args.request.request({
+				method: "POST",
+				canonicalPath: `${LINKED_DEVICE_MANAGEMENT_HTTP_BASE_PATH_V1}/${encodeURIComponent(String(walletAuthMethodId))}/revoke`,
+				body: {
+					...request,
+					sourceProof
+				},
+				walletId
+			});
+			let response;
+			try {
+				response = await send();
+			} catch (error) {
+				if (!(error instanceof WalletHostOwnerRequestTransportError)) throw error;
+				if (error.code !== "network_error") throw error;
+				response = await send();
+			}
+			return parseManagementRevokeResult(response);
+		}
+	};
+}
+function parseManagementRevokeResult(response) {
+	if (response.status === 404) return parseLinkedDeviceRevokeResultV1({ kind: "not_found" });
+	if (response.status === 409) return parseLinkedDeviceRevokeResultV1({ kind: "conflict" });
+	if (response.status === 401 || response.status === 403) return parseLinkedDeviceRevokeResultV1({ kind: "unauthorized" });
+	assertManagementSuccess(response, "revoke linked device");
+	return parseLinkedDeviceRevokeResponseV1(response.body);
+}
+function assertManagementSuccess(response, operation) {
+	if (response.status < 200 || response.status >= 300) {
+		if (response.status === 401 && isManagementUnauthorizedFailureRecordV1(response.body)) throw new OwnerWalletSessionReauthRequiredError();
+		const detail = managementFailureDetail(response.body);
+		throw new Error(detail ? `linked-device ${operation} failed with HTTP ${response.status}: ${detail}` : `linked-device ${operation} failed with HTTP ${response.status}`);
+	}
+}
+function managementFailureDetail(raw) {
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
+	if (isManagementFailureWithMessageRecordV1(raw)) return raw.message;
+	if (isManagementUnauthorizedFailureRecordV1(raw)) return raw.message;
+	return null;
+}
+function parseLinkedDeviceListResponseV1(raw) {
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("linked-device list response must be an object");
+	if (!isLinkedDeviceListResponseRecordV1(raw)) throw new Error("linked-device list response has unexpected fields");
+	if (raw.ok !== true) throw new Error("linked-device list response is not successful");
+	return parseLinkedDeviceListResultV1({
+		devices: raw.devices,
+		ownerDevices: raw.ownerDevices,
+		nextCursor: raw.nextCursor
+	});
+}
+function isLinkedDeviceListResponseRecordV1(value) {
+	return Object.keys(value).sort().join("|") === "devices|nextCursor|ok|ownerDevices";
+}
+function parseLinkedDeviceRevokeResponseV1(raw) {
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("linked-device revoke response must be an object");
+	if (!isLinkedDeviceRevokeResponseRecordV1(raw)) throw new Error("linked-device revoke response has unexpected fields");
+	if (raw.ok !== true) throw new Error("linked-device revoke response is not successful");
+	return parseLinkedDeviceRevokeResultV1({
+		kind: raw.kind,
+		walletAuthMethodId: raw.walletAuthMethodId,
+		authorityId: raw.authorityId,
+		revocationEpoch: raw.revocationEpoch
+	});
+}
+function isLinkedDeviceRevokeResponseRecordV1(value) {
+	return Object.keys(value).sort().join("|") === "authorityId|kind|ok|revocationEpoch|walletAuthMethodId";
+}
+function isManagementFailureWithMessageRecordV1(value) {
+	if (Object.keys(value).sort().join("|") !== "kind|message|ok") return false;
+	if (!("ok" in value) || !("kind" in value) || !("message" in value)) return false;
+	return value.ok === false && (value.kind === "invalid_input" || value.kind === "internal") && typeof value.message === "string" && value.message.trim().length > 0;
+}
+function isManagementUnauthorizedFailureRecordV1(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	if (Object.keys(value).sort().join("|") !== "code|kind|message|ok") return false;
+	if (!("ok" in value) || !("kind" in value) || !("code" in value) || !("message" in value)) return false;
+	return value.ok === false && value.kind === "unauthorized" && typeof value.code === "string" && typeof value.message === "string" && value.message.trim().length > 0;
+}
+//#endregion
 //#region src/core/signingEngine/threshold/crypto/ed25519YaoLaneWasm.ts
 function requestJson(value) {
 	if (typeof value !== "string" || !value.trim()) throw new Error("Yao lane request JSON is required");
@@ -41028,6 +40867,8 @@ var Ed25519YaoLaneWorkerSource = class {
 function createDeviceLinkingEcdsaSourceContributionMetadataReaderV1(context) {
 	return async ({ preparation }) => {
 		const sourceActivation = preparation.source.activation;
+		const linked = context.readLinkedEcdsaHolderV1({ materialActivation: sourceActivation });
+		if (linked) return linkedEcdsaSourceMetadataV1(linked, sourceActivation);
 		const manifest = await context.readActiveEcdsaCapabilityManifestV1({ materialActivation: sourceActivation });
 		assertExactEcdsaSourceMetadataContextV1({
 			sourceActivation,
@@ -41044,6 +40885,28 @@ function createDeviceLinkingEcdsaSourceContributionMetadataReaderV1(context) {
 		};
 	};
 }
+function linkedEcdsaSourceMetadataV1(holder, sourceActivation) {
+	if (!mpcMaterialActivationRefsEqual(holder.materialActivation, sourceActivation)) throw new Error("linked ECDSA holder activation does not match preparation");
+	const normalSigning = holder.activationReceipt.normalSigning;
+	const scope = normalSigning.scope;
+	const signingKeySlotId = deriveEvmFamilySigningKeySlotId({
+		walletId: holder.walletId,
+		signingRootId: scope.signing_root_id,
+		signingRootVersion: scope.signing_root_version
+	});
+	const walletKeyId = parseWalletKeyId(`wallet-key:ecdsa:${holder.walletId}:${signingKeySlotId}`);
+	if (!walletKeyId.ok) throw new Error(`linked ECDSA source wallet key identity: ${walletKeyId.error.message}`);
+	return {
+		walletKeyId: walletKeyId.value,
+		sourceDerivation: {
+			applicationBindingDigestB64u: parseDigestB64u(scope.context.application_binding_digest_b64u),
+			clientShareRetryCounter: scope.public_identity.client_share_retry_counter,
+			ecdsaThresholdKeyId: parseEcdsaThresholdKeyId(holder.ecdsaThresholdKeyId),
+			sourceNormalSigning: normalSigning
+		},
+		linkedHolderHandleId: holder.holderHandleId
+	};
+}
 function assertExactEcdsaSourceMetadataContextV1(input) {
 	if (!mpcMaterialActivationRefsEqual(input.manifest.activation.materialActivation, input.sourceActivation)) throw new Error("ECDSA capability manifest activation does not match preparation");
 }
@@ -41123,7 +40986,8 @@ async function produceEcdsaSourceContributionV1(input) {
 	const metadata = await input.readMetadataV1({ preparation: input.preparation });
 	const prepared = await prepareLinkedDeviceEcdsaSourceContributionWasm({
 		preparation: input.preparation,
-		workerCtx: input.workerContext
+		workerCtx: input.workerContext,
+		...metadata.linkedHolderHandleId === void 0 ? {} : { linkedHolderHandleId: metadata.linkedHolderHandleId }
 	});
 	return {
 		kind: "linked_device_ecdsa_source_contribution_v1",
@@ -41165,15 +41029,6 @@ const SECRET_MATERIAL_FIELDS = [
 	"bootstrapMaterial",
 	"clientSecret32"
 ];
-function requireRecord(value, label) {
-	if (!isPlainObject(value)) throw new Error(`${label} must be an object`);
-	return value;
-}
-function requireString(value, label) {
-	const normalized = typeof value === "string" ? value.trim() : "";
-	if (!normalized) throw new Error(`${label} is required`);
-	return normalized;
-}
 function requireTimestampMs(value, label) {
 	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive integer timestamp`);
 	return value;
@@ -41183,22 +41038,22 @@ function rejectFields(record, fields, label) {
 	if (forbiddenField) throw new Error(`${label} must not include ${forbiddenField}`);
 }
 function parseOfferId(value) {
-	return requireString(value, "offerId");
+	return requireTrimmedString(value, "offerId");
 }
 function parseCandidateId(value, label = "candidateId") {
-	return requireString(value, label);
+	return requireTrimmedString(value, label);
 }
 function parseCandidate(value) {
-	const record = requireRecord(value, "registration candidate");
+	const record = requireRecord$1(value, "registration candidate");
 	rejectFields(record, OTP_ONLY_FORBIDDEN_FIELDS, "registration candidate");
 	rejectFields(record, SECRET_MATERIAL_FIELDS, "registration candidate");
 	return {
 		candidateId: parseCandidateId(record.candidateId),
-		walletId: walletIdFromString(requireString(record.walletId, "candidate.walletId"))
+		walletId: walletIdFromString(requireTrimmedString(record.walletId, "candidate.walletId"))
 	};
 }
 function parseGoogleEmailOtpRegistrationOffer(value) {
-	const record = requireRecord(value, "Google Email OTP registration offer");
+	const record = requireRecord$1(value, "Google Email OTP registration offer");
 	rejectFields(record, OTP_ONLY_FORBIDDEN_FIELDS, "Google Email OTP registration offer");
 	rejectFields(record, SECRET_MATERIAL_FIELDS, "Google Email OTP registration offer");
 	if (record.kind !== "google_email_otp_registration_offer_v1") throw new Error("registration offer kind must be google_email_otp_registration_offer_v1");
@@ -41211,7 +41066,7 @@ function parseGoogleEmailOtpRegistrationOffer(value) {
 		kind: "google_email_otp_registration_offer_v1",
 		offerId: parseOfferId(record.offerId),
 		expiresAtMs: requireTimestampMs(record.expiresAtMs, "expiresAtMs"),
-		emailHint: requireString(record.emailHint, "emailHint"),
+		emailHint: requireTrimmedString(record.emailHint, "emailHint"),
 		candidates: [firstCandidate, ...remainingCandidates],
 		selectedCandidateId
 	};
@@ -41791,50 +41646,15 @@ async function rotateWalletRecoverySetWithActiveFactorV1(input) {
 	let issued = issueWalletRecoveryCodes();
 	const factorSecret = new Uint8Array(input.factorSecret.slice(0));
 	try {
-		const current = await readWalletRecoveryCodeStatus({
-			relayUrl: input.relayUrl,
-			walletId: input.walletId,
-			...input.fetchImpl ? { fetchImpl: input.fetchImpl } : {}
-		});
-		if (current.kind !== "ready") return current.kind === "unauthorized" ? {
-			kind: "transport_failed",
-			message: current.message
-		} : current;
-		const custody = joinCustodyWireFromEnvelopeRecord(input.custodyEnvelope);
-		if (!custody.ok) throw new Error(custody.reason);
-		const replacement = walletRecoverySetRotationWireFromWorkerResultV1(await input.worker.rotateRecoverySet({
-			custodyJson: custody.custodyJson,
-			factorSecret: factorSecret.buffer.slice(0),
-			recoveryCodesJson: JSON.stringify(issued.codeBytes.map((bytes) => ({ codeBytesB64u: base64UrlEncode(bytes) })))
-		}));
-		if (replacement.walletId !== input.walletId) throw new Error("Recovery rotation worker returned a different wallet");
-		const recoveryCodeLocators = await deriveRecoveryCodeLocators(issued.codeBytes, replacement.manifestKekWraps);
-		const rotated = await rotateWalletRecoverySet({
-			relayUrl: input.relayUrl,
-			walletId: input.walletId,
-			factorProof: await input.factorProof({
-				operation: "recovery_rotate",
-				payload: {
-					walletId: input.walletId,
-					expectedStoreVersion: current.storeVersion,
-					manifestKekWraps: replacement.manifestKekWraps,
-					entries: [replacement.entry],
-					recoveryCodeLocators
-				}
-			}),
-			expectedStoreVersion: current.storeVersion,
-			replacement,
-			recoveryCodeLocators,
-			...input.fetchImpl ? { fetchImpl: input.fetchImpl } : {}
+		return await rotateWithIssuedCodes(input, issued, (codeBytes) => {
+			const custody = joinCustodyWireFromEnvelopeRecord(input.custodyEnvelope);
+			if (!custody.ok) throw new Error(custody.reason);
+			return input.worker.rotateRecoverySet({
+				custodyJson: custody.custodyJson,
+				factorSecret: factorSecret.buffer.slice(0),
+				recoveryCodesJson: recoveryCodesJson(codeBytes)
+			});
 		});
-		if (rotated.kind !== "rotated") return rotated;
-		return {
-			kind: "rotated",
-			walletId: input.walletId,
-			recoveryCodes: issued.codes,
-			issuedAtMs: rotated.issuedAtMs,
-			storeVersion: rotated.storeVersion
-		};
 	} finally {
 		factorSecret.fill(0);
 		if (issued) zeroizeIssuedWalletRecoveryCodes(issued);
@@ -41844,49 +41664,55 @@ async function rotateWalletRecoverySetWithActiveFactorV1(input) {
 async function rotateWalletRecoverySetWithEmailOtpV1(input) {
 	let issued = issueWalletRecoveryCodes();
 	try {
-		const current = await readWalletRecoveryCodeStatus({
-			relayUrl: input.relayUrl,
-			walletId: input.walletId,
-			...input.fetchImpl ? { fetchImpl: input.fetchImpl } : {}
-		});
-		if (current.kind !== "ready") return current.kind === "unauthorized" ? {
-			kind: "transport_failed",
-			message: current.message
-		} : current;
-		const replacement = walletRecoverySetRotationWireFromWorkerResultV1(await input.worker.rotateRecoverySet({ recoveryCodesJson: JSON.stringify(issued.codeBytes.map((bytes) => ({ codeBytesB64u: base64UrlEncode(bytes) }))) }));
-		if (replacement.walletId !== input.walletId) throw new Error("Recovery rotation worker returned a different wallet");
-		const recoveryCodeLocators = await deriveRecoveryCodeLocators(issued.codeBytes, replacement.manifestKekWraps);
-		const rotated = await rotateWalletRecoverySet({
-			relayUrl: input.relayUrl,
-			walletId: input.walletId,
-			factorProof: await input.factorProof({
-				operation: "recovery_rotate",
-				payload: {
-					walletId: input.walletId,
-					expectedStoreVersion: current.storeVersion,
-					manifestKekWraps: replacement.manifestKekWraps,
-					entries: [replacement.entry],
-					recoveryCodeLocators
-				}
-			}),
-			expectedStoreVersion: current.storeVersion,
-			replacement,
-			recoveryCodeLocators,
-			...input.fetchImpl ? { fetchImpl: input.fetchImpl } : {}
-		});
-		if (rotated.kind !== "rotated") return rotated;
-		return {
-			kind: "rotated",
-			walletId: input.walletId,
-			recoveryCodes: issued.codes,
-			issuedAtMs: rotated.issuedAtMs,
-			storeVersion: rotated.storeVersion
-		};
+		return await rotateWithIssuedCodes(input, issued, (codeBytes) => input.worker.rotateRecoverySet({ recoveryCodesJson: recoveryCodesJson(codeBytes) }));
 	} finally {
 		if (issued) zeroizeIssuedWalletRecoveryCodes(issued);
 		issued = null;
 	}
 }
+async function rotateWithIssuedCodes(input, issued, rotateInWorker) {
+	const current = await readWalletRecoveryCodeStatus({
+		relayUrl: input.relayUrl,
+		walletId: input.walletId,
+		...input.fetchImpl ? { fetchImpl: input.fetchImpl } : {}
+	});
+	if (current.kind !== "ready") return current.kind === "unauthorized" ? {
+		kind: "transport_failed",
+		message: current.message
+	} : current;
+	const replacement = walletRecoverySetRotationWireFromWorkerResultV1(await rotateInWorker(issued.codeBytes));
+	if (replacement.walletId !== input.walletId) throw new Error("Recovery rotation worker returned a different wallet");
+	const recoveryCodeLocators = await deriveRecoveryCodeLocators(issued.codeBytes, replacement.manifestKekWraps);
+	const rotated = await rotateWalletRecoverySet({
+		relayUrl: input.relayUrl,
+		walletId: input.walletId,
+		factorProof: await input.factorProof({
+			operation: "recovery_rotate",
+			payload: {
+				walletId: input.walletId,
+				expectedStoreVersion: current.storeVersion,
+				manifestKekWraps: replacement.manifestKekWraps,
+				entries: [replacement.entry],
+				recoveryCodeLocators
+			}
+		}),
+		expectedStoreVersion: current.storeVersion,
+		replacement,
+		recoveryCodeLocators,
+		...input.fetchImpl ? { fetchImpl: input.fetchImpl } : {}
+	});
+	if (rotated.kind !== "rotated") return rotated;
+	return {
+		kind: "rotated",
+		walletId: input.walletId,
+		recoveryCodes: issued.codes,
+		issuedAtMs: rotated.issuedAtMs,
+		storeVersion: rotated.storeVersion
+	};
+}
+function recoveryCodesJson(codeBytes) {
+	return JSON.stringify(codeBytes.map((bytes) => ({ codeBytesB64u: base64UrlEncode(bytes) })));
+}
 async function deriveRecoveryCodeLocators(codeBytes, wraps) {
 	if (codeBytes.length !== wraps.length) throw new Error("Recovery code locators do not match the replacement wraps");
 	const recoveryCodeLocators = await Promise.all(codeBytes.map(async (bytes, index) => {
@@ -42445,21 +42271,31 @@ function createWalletHostOwnerApprovalUpdatesV1(args) {
 	};
 }
 function createWalletHostEcdsaSourceContributionMetadataReaderV1(args) {
-	return createDeviceLinkingEcdsaSourceContributionMetadataReaderV1({ readActiveEcdsaCapabilityManifestV1: async ({ materialActivation }) => {
-		const authentication = args.signingEngine.readWalletAuthenticationState();
-		if (authentication.kind !== "authenticated") throw new Error("ECDSA source metadata requires an authenticated wallet");
-		let lookup = await ecdsaCapabilityManifestStore.lookupByMaterialActivation({
-			walletId: authentication.walletId,
-			materialActivation
-		});
-		if (lookup.kind === "ambiguous_authority") lookup = await resolveAmbiguousEcdsaActivationForSelectedAuthMethod({
-			walletId: authentication.walletId,
-			materialActivation,
-			authorities: lookup.authorities
-		});
-		if (lookup.kind !== "active") throw new Error(`ECDSA source metadata manifest is ${lookup.kind}`);
-		return lookup.manifest;
-	} });
+	return createDeviceLinkingEcdsaSourceContributionMetadataReaderV1({
+		readActiveEcdsaCapabilityManifestV1: async ({ materialActivation }) => {
+			const authentication = args.signingEngine.readWalletAuthenticationState();
+			if (authentication.kind !== "authenticated") throw new Error("ECDSA source metadata requires an authenticated wallet");
+			let lookup = await ecdsaCapabilityManifestStore.lookupByMaterialActivation({
+				walletId: authentication.walletId,
+				materialActivation
+			});
+			if (lookup.kind === "ambiguous_authority") lookup = await resolveAmbiguousEcdsaActivationForSelectedAuthMethod({
+				walletId: authentication.walletId,
+				materialActivation,
+				authorities: lookup.authorities
+			});
+			if (lookup.kind !== "active") throw new Error(`ECDSA source metadata manifest is ${lookup.kind}`);
+			return lookup.manifest;
+		},
+		readLinkedEcdsaHolderV1: ({ materialActivation }) => {
+			const authentication = args.signingEngine.readWalletAuthenticationState();
+			if (authentication.kind !== "authenticated") return null;
+			return resolveLinkedEcdsaHolderRuntimeV1({
+				walletId: authentication.walletId,
+				materialActivation
+			});
+		}
+	});
 }
 function createWalletHostDeviceDomainConstructionV1(args) {
 	const relayerUrl = String(args.configs.network.relayer?.url || "").trim();
@@ -42470,7 +42306,7 @@ function createWalletHostDeviceDomainConstructionV1(args) {
 		walletSessions: walletSessionAuthorizations,
 		resolveSelectedWalletAuthority: IndexedDBManager.resolveSelectedWalletAuthority.bind(IndexedDBManager),
 		readWalletAuthenticationState: args.signingEngine.readWalletAuthenticationState.bind(args.signingEngine),
-		readUnlockedEd25519ExportRootCapabilityV1: readUnlockedWalletEd25519ExportRootCapabilityV1
+		readUnlockedEd25519ExportRootCapabilityV1: readUnlockedEd25519ExportRootLinkingCapabilityV1
 	});
 	return {
 		platform,
@@ -42998,76 +42834,6 @@ var SeamsWeb = class {
 			error: { message: input.error.message }
 		});
 	}
-	emitEmailOtpRegistrationWorkerProgress(onEvent, args) {
-		const base = {
-			flowId: args.flowId,
-			walletId: args.walletId,
-			authMethod: "email_otp",
-			...args.challengeId ? { requestId: args.challengeId } : {}
-		};
-		switch (args.progress.code) {
-			case "otp.verify.succeeded":
-				this.emitEmailOtpRegistrationEvent(onEvent, {
-					...base,
-					phase: RegistrationEventPhase.STEP_04_OTP_VERIFY_SUCCEEDED,
-					status: "succeeded",
-					interaction: {
-						kind: "otp_input",
-						overlay: "hide"
-					}
-				});
-				return RegistrationEventPhase.STEP_04_OTP_VERIFY_SUCCEEDED;
-			case "signer.email_otp.enroll.started":
-				this.emitEmailOtpRegistrationEvent(onEvent, {
-					...base,
-					phase: RegistrationEventPhase.STEP_09_EMAIL_OTP_SIGNER_ENROLL_STARTED,
-					status: "running"
-				});
-				return RegistrationEventPhase.STEP_09_EMAIL_OTP_SIGNER_ENROLL_STARTED;
-			case "signer.email_otp.enroll.succeeded":
-				this.emitEmailOtpRegistrationEvent(onEvent, {
-					...base,
-					phase: RegistrationEventPhase.STEP_09_EMAIL_OTP_SIGNER_ENROLL_SUCCEEDED,
-					status: "succeeded"
-				});
-				return RegistrationEventPhase.STEP_09_EMAIL_OTP_SIGNER_ENROLL_SUCCEEDED;
-			case "signer.ecdsa.bootstrap.started":
-				this.emitEmailOtpRegistrationEvent(onEvent, {
-					...base,
-					phase: RegistrationEventPhase.STEP_10_ECDSA_SIGNER_PROVISION_STARTED,
-					status: "running",
-					data: { chainTarget: args.chainTarget }
-				});
-				return RegistrationEventPhase.STEP_10_ECDSA_SIGNER_PROVISION_STARTED;
-			case "signer.ecdsa.bootstrap.prepared":
-				this.emitEmailOtpRegistrationEvent(onEvent, {
-					...base,
-					phase: RegistrationEventPhase.STEP_10_ECDSA_SIGNER_PROVISION_STARTED,
-					status: "running",
-					message: "Coordinating EVM signing session",
-					data: { chainTarget: args.chainTarget }
-				});
-				return RegistrationEventPhase.STEP_10_ECDSA_SIGNER_PROVISION_STARTED;
-			case "signer.ecdsa.bootstrap.responded":
-				this.emitEmailOtpRegistrationEvent(onEvent, {
-					...base,
-					phase: RegistrationEventPhase.STEP_10_ECDSA_SIGNER_PROVISION_STARTED,
-					status: "running",
-					message: "Finalizing EVM signing session",
-					data: { chainTarget: args.chainTarget }
-				});
-				return RegistrationEventPhase.STEP_10_ECDSA_SIGNER_PROVISION_STARTED;
-			case "signer.ecdsa.bootstrap.succeeded":
-				this.emitEmailOtpRegistrationEvent(onEvent, {
-					...base,
-					phase: RegistrationEventPhase.STEP_10_ECDSA_SIGNER_PROVISION_SUCCEEDED,
-					status: "succeeded",
-					data: { chainTarget: args.chainTarget }
-				});
-				return RegistrationEventPhase.STEP_10_ECDSA_SIGNER_PROVISION_SUCCEEDED;
-			default: return null;
-		}
-	}
 	emitEmailOtpUnlockWorkerProgress(onEvent, args) {
 		const chainLabel = args.chainTarget.kind === "tempo" ? "Tempo" : "EVM";
 		const base = {
@@ -43704,7 +43470,6 @@ var SeamsWeb = class {
 				this.emitEmailOtpUnlockEvent(args.onEvent, input);
 			};
 			let timingStartedAtMs = nowMs();
-			String(args.relayUrl || this.configs.network.relayer.url).trim();
 			const emailHashHex = await this.emailOtpEmailHashHex(args.emailOtpAuthorityEmail || "");
 			recordEmailOtpUnlockTiming(unlockTiming.timings, "emailHashLookupMs", timingStartedAtMs);
 			timingStartedAtMs = nowMs();