@seams/wallet 0.6.1 → 0.7.1

package/dist/esm/core/signingEngine/routerAb/ecdsaDerivation/presignaturePool.js

@@ -1,14 +1,15 @@
 import { base64UrlDecode, base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
 import "../../../../shared-ts/src/utils/encoders.js";
-import { canonicalRouterAbMpcMaterialActivationRefBytes } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
-import { buildRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1, buildRouterAbEcdsaDerivationEvmDigestSigningRequestV1, parseRouterAbEcdsaDerivationNormalSigningScopeV1, routerAbEcdsaDerivationNormalSigningScopeCanonicalBytesV1, routerAbEcdsaRerandomizationClientCommitmentV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { secureRandomId } from "../../../../shared-ts/src/utils/secureRandomId.js";
-import { formatEcdsaKeyHandleForWire, parseEcdsaClientVerifyingShareB64u, parseEcdsaThresholdKeyId } from "../../session/keyMaterialBrands.js";
+import { canonicalRouterAbMpcMaterialActivationRefBytes } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
+import { formatEcdsaKeyHandleForWire, parseEcdsaClientVerifyingShareB64u } from "../../../../shared-ts/src/threshold/keyMaterialBrands.js";
+import { parseEcdsaThresholdKeyId } from "../../session/keyMaterialBrands.js";
+import { ROUTER_AB_ECDSA_PRESIGN_CEREMONY_MAX_LIFETIME_MS, buildRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1, buildRouterAbEcdsaDerivationEvmDigestSigningRequestV1, parseRouterAbEcdsaDerivationNormalSigningScopeV1, routerAbEcdsaDerivationNormalSigningScopeCanonicalBytesV1, routerAbEcdsaRerandomizationClientCommitmentV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { FIXED_ECDSA_PRESIGN_PROTOCOL_ID, ecdsaClientPresignPoolKey } from "../../workerManager/ecdsaPresignPoolIdentity.js";
 import { MAX_DURABLE_CLIENT_PRESIGNATURE_LIFETIME_MS } from "../../workerManager/ecdsaPresignLifecycle.js";
 import { DEFAULT_ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_POOL_POLICY } from "../../../config/defaultConfigs.js";
 import { emitEcdsaServerTiming, emitEcdsaSigningTiming, emitSigningSessionFlowTrace } from "../../session/operationState/trace.js";
-import { RouterAbSigningRequestError, finalizeRouterAbEcdsaDerivationEvmDigestSigningV1, prepareRouterAbEcdsaDerivationEvmDigestSigningV1, prepareRouterAbEcdsaFinalPresignBatchV1 } from "../../../rpcClients/relayer/routerAbNormalSigning.js";
+import { RouterAbSigningRequestError, finalizeRouterAbEcdsaDerivationEvmDigestSigningV1, prepareRouterAbEcdsaDerivationEvmDigestSigningV1 } from "../../../rpcClients/relayer/routerAbNormalSigning.js";
 import { addSecp256k1PublicKeys33Wasm, validateSecp256k1PublicKey33Wasm, verifySecp256k1RecoverableSignatureAgainstPublicKey33Wasm } from "../../chains/evm/evmCryptoWasm.js";
 import { routerAbEcdsaDerivationPresignaturePoolFillInit, routerAbEcdsaDerivationPresignaturePoolFillStep } from "./poolFillRoutes.js";
 import { PresignatureRefillProgressV1 } from "./presignatureRefillProgress.js";
@@ -43,6 +44,7 @@ function assertRouterAbEcdsaDerivationClientSigningMaterialSource(source) {
 }
 const MAX_HANDSHAKE_STEPS = 64;
 const ROUTER_AB_ECDSA_DERIVATION_SIGNING_TTL_MS = 6e4;
+const PRESIGN_CEREMONY_CLOCK_SKEW_MARGIN_MS = 3e4;
 const ROUTER_AB_ECDSA_DERIVATION_PRESIGNATURE_EXPIRY_SKEW_MS = 2e3;
 const MAX_CLIENT_PRESIGNATURE_CLAIM_RETRIES = 4;
 const clientPresignaturePool = /* @__PURE__ */ new Map();
@@ -551,8 +553,6 @@ async function runPresignHandshakeAttempt(args) {
 		scope: args.routerAbEcdsaDerivationPoolFill.scope,
 		materialActivation: args.materialActivation
 	});
-	let terminalCandidate = null;
-	let handoff = null;
 	let localPresignatureHandle = null;
 	let localBigR33 = null;
 	let serverPresignatureId = null;
@@ -611,7 +611,6 @@ async function runPresignHandshakeAttempt(args) {
 					incomingMessages: pendingServerOutgoing,
 					workerCtx: args.workerCtx
 				});
-				if (localStepped.event === "final_batch_ready") terminalCandidate = localStepped.candidateBigR33;
 				clientStage = localStepped.stage;
 				pendingServerOutgoing = [];
 				pendingClientOutgoing.push(...localStepped.outgoingMessages);
@@ -620,32 +619,6 @@ async function runPresignHandshakeAttempt(args) {
 					localBigR33 = localStepped.presignatureBigR33;
 				}
 			}
-			if (terminalCandidate && !serverDone) {
-				const waiting = finalBatchHandoffs.get(args.poolKey);
-				if (waiting?.state.kind === "waiting") {
-					handoff = waiting;
-					finalBatchHandoffs.delete(args.poolKey);
-					if (pendingClientOutgoing.length !== 2) throw new Error("Final batch must contain two messages");
-					const prepared = await handoff.prepare(terminalCandidate, {
-						kind: "final_presign_batch",
-						batch: {
-							scope: args.routerAbEcdsaDerivationPoolFill.scope,
-							presign_session_id: presignSessionId,
-							requested_stage: "presign",
-							outgoing_messages_b64u: [base64UrlEncode(pendingClientOutgoing[0]), base64UrlEncode(pendingClientOutgoing[1])],
-							ceremony_expires_at_ms: ceremonyExpiresAtMs,
-							material_expires_at_ms: materialExpiresAtMs
-						}
-					});
-					pendingClientOutgoing = [];
-					pendingServerOutgoing = fromB64uMessages(prepared.outgoingMessagesB64u);
-					serverStage = "presign";
-					serverPresignatureId = prepared.preparedResponse.server_presignature_id;
-					serverBigRB64u = prepared.preparedResponse.server_big_r33_b64u;
-					serverDone = true;
-				}
-				terminalCandidate = null;
-			}
 			if (!serverDone) {
 				const roundStartedAt = performance.now();
 				const requestTag = presignHandshakeRequestTag(args);
@@ -713,22 +686,6 @@ async function runPresignHandshakeAttempt(args) {
 				code: "presign_mismatch",
 				message: "Client/server presignature mismatch (bigR mismatch)"
 			};
-			if (handoff) {
-				handoff.complete({
-					presignatureId: serverPresignatureId,
-					bigRB64u: localBigRB64u,
-					materialHandle: localPresignatureHandle,
-					createdAtMs,
-					expiresAtMs: materialExpiresAtMs
-				});
-				keepLocalMaterial = true;
-				shouldAbortLocalSession = false;
-				return {
-					ok: true,
-					kind: "handed_off",
-					presignatureId: serverPresignatureId
-				};
-			}
 			const admission = await args.clientSigningMaterial.admitClientPresignature({
 				materialHandle: localPresignatureHandle,
 				expectedPresignatureId: serverPresignatureId,
@@ -763,10 +720,6 @@ async function runPresignHandshakeAttempt(args) {
 			zeroizeBytes(localBigR33);
 		}
 	} catch (e) {
-		if (handoff) handoff.state = {
-			kind: "failed",
-			error: e
-		};
 		return {
 			ok: false,
 			code: "presign_failed",
@@ -810,68 +763,7 @@ function resolveSigningRequestExpiresAtMs(input) {
 	const expiresAtMs = Math.min(materialExpiresAtMs, authorizationExpiresAtMs, input.nowMs + ROUTER_AB_ECDSA_DERIVATION_SIGNING_TTL_MS);
 	return Number.isSafeInteger(expiresAtMs) && expiresAtMs > input.nowMs ? expiresAtMs : null;
 }
-var EcdsaFinalBatchHandoff = class {
-	constructor(input, poolKey, generation) {
-		this.input = input;
-		this.poolKey = poolKey;
-		this.generation = generation;
-		this.state = { kind: "waiting" };
-		this.contribution = secureRerandomizationContribution32();
-	}
-	async prepare(candidateBigR33, source) {
-		if (this.state.kind !== "waiting" || getClientPresignaturePoolGeneration(this.poolKey) !== this.generation) throw new Error("Signing handoff was cancelled before prepare");
-		this.state = { kind: "submitted" };
-		const idDigest = await crypto.subtle.digest("SHA-256", new Uint8Array(candidateBigR33));
-		const expiresAtMs = resolveSigningRequestExpiresAtMs({
-			authorizationExpiresAtMs: this.input.expiresAtMs,
-			materialExpiresAtMs: source.batch.material_expires_at_ms,
-			nowMs: Date.now()
-		});
-		if (!expiresAtMs) throw new Error("Signing handoff expired before prepare");
-		const commitment = await routerAbEcdsaRerandomizationClientCommitmentV1(this.contribution);
-		const request = buildRouterAbEcdsaDerivationEvmDigestSigningRequestV1({
-			scope: this.input.scope,
-			requestId: secureRandomId("router-ab-ecdsa-sign", 32, "ECDSA signing request"),
-			operationId: this.input.operationId,
-			operationDigests: this.input.operationDigests,
-			authorization: this.input.authorization,
-			materialActivation: this.input.materialActivation,
-			clientPresignatureId: `presig-${base64UrlEncode(new Uint8Array(idDigest))}`,
-			expiresAtMs,
-			signingDigest32: this.input.signingDigest32,
-			clientRerandomizationCommitment32: commitment
-		});
-		zeroizeBytes(commitment);
-		if (getClientPresignaturePoolGeneration(this.poolKey) !== this.generation) throw new Error("Signing handoff was cancelled before submission");
-		const result = await prepareRouterAbEcdsaFinalPresignBatchV1({
-			relayServerUrl: this.input.relayerUrl,
-			credential: this.input.credential,
-			request,
-			source
-		});
-		if (getClientPresignaturePoolGeneration(this.poolKey) !== this.generation) throw new Error("Signing handoff was cancelled during prepare");
-		this.state = {
-			kind: "prepared",
-			prepared: {
-				request,
-				response: result.preparedResponse
-			}
-		};
-		return result;
-	}
-	complete(presignature) {
-		if (this.state.kind !== "prepared" || getClientPresignaturePoolGeneration(this.poolKey) !== this.generation) throw new Error("Signing handoff cannot claim completed material");
-		this.state = {
-			kind: "ready",
-			prepared: this.state.prepared,
-			presignature
-		};
-	}
-};
-const finalBatchHandoffs = /* @__PURE__ */ new Map();
 async function signRouterAbEcdsaDerivationDigestWithPoolHitAttempt(args, retryCount, supply) {
-	let handoff = null;
-	let handedOffPrepare = null;
 	let poolKey = null;
 	let poolIdentity = null;
 	let foregroundStarted = false;
@@ -949,10 +841,6 @@ async function signRouterAbEcdsaDerivationDigestWithPoolHitAttempt(args, retryCo
 			});
 		}
 		if (!presignature) {
-			if (!finalBatchHandoffs.has(poolKey)) {
-				handoff = new EcdsaFinalBatchHandoff(args, poolKey, poolGeneration);
-				finalBatchHandoffs.set(poolKey, handoff);
-			}
 			const refillWaitStartedAt = performance.now();
 			await waitForAvailablePresignatureFromInFlightRefill(poolKey, "foreground");
 			emitEcdsaSigningTiming(args.operationId, "refill_wait", refillWaitStartedAt);
@@ -964,16 +852,16 @@ async function signRouterAbEcdsaDerivationDigestWithPoolHitAttempt(args, retryCo
 				workerCtx: args.workerCtx
 			});
 		}
-		if (!presignature && handoff?.state.kind === "waiting" && supply.kind === "on_demand") {
+		if (!presignature && supply.kind === "on_demand") {
 			let refill = await refillRouterAbEcdsaDerivationClientPresignaturePool({
 				...supply.refill,
 				trafficClass: "foreground"
 			});
-			if (!refill.ok && refill.code === "invalidated" && handoff.state.kind === "waiting") refill = await refillRouterAbEcdsaDerivationClientPresignaturePool({
+			if (!refill.ok && refill.code === "invalidated") refill = await refillRouterAbEcdsaDerivationClientPresignaturePool({
 				...supply.refill,
 				trafficClass: "foreground"
 			});
-			if (!refill.ok && handoff.state.kind === "waiting" && refill.code !== "pool_full") return refill;
+			if (!refill.ok && refill.code !== "pool_full") return refill;
 			if (!refill.ok && refill.code === "pool_full") await hydrateClientPresignaturePool({
 				poolKey,
 				poolIdentity,
@@ -989,14 +877,6 @@ async function signRouterAbEcdsaDerivationDigestWithPoolHitAttempt(args, retryCo
 				workerCtx: args.workerCtx
 			});
 		}
-		if (handoff && handoff.state.kind !== "waiting") {
-			if (handoff.state.kind !== "ready") throw new Error("Terminal signing prepare did not complete; automatic replacement is prohibited");
-			if (presignature) pushClientPresignature(poolKey, poolIdentity, presignature);
-			presignature = handoff.state.presignature;
-			handedOffPrepare = handoff.state.prepared;
-			preparationState = { kind: "prepare_submitted" };
-			clientPresignatureCleanupState = { kind: "destroy" };
-		}
 		emitSigningSessionFlowTrace("evm-family", {
 			event: "ecdsa_presignature_selection",
 			operationId: args.operationId,
@@ -1026,9 +906,9 @@ async function signRouterAbEcdsaDerivationDigestWithPoolHitAttempt(args, retryCo
 			code: "pool_entry_unavailable",
 			message: "Router A/B ECDSA derivation client presignature pool was invalidated before prepare"
 		};
-		clientRerandomizationContribution32 = handedOffPrepare && handoff ? handoff.contribution : secureRerandomizationContribution32();
+		clientRerandomizationContribution32 = secureRerandomizationContribution32();
 		const clientRerandomizationCommitment32 = await routerAbEcdsaRerandomizationClientCommitmentV1(clientRerandomizationContribution32);
-		const prepareRequest = handedOffPrepare?.request ?? buildRouterAbEcdsaDerivationEvmDigestSigningRequestV1({
+		const prepareRequest = buildRouterAbEcdsaDerivationEvmDigestSigningRequestV1({
 			scope: args.scope,
 			requestId: secureRandomId("router-ab-ecdsa-sign", 32, "Router A/B ECDSA derivation sign request"),
 			operationId: args.operationId,
@@ -1056,7 +936,7 @@ async function signRouterAbEcdsaDerivationDigestWithPoolHitAttempt(args, retryCo
 		emitEcdsaSigningTiming(args.operationId, "presignature_reserve", reserveStartedAt);
 		if (reservation.kind === "unavailable") {
 			if (reservation.reason === "claimed_elsewhere") clientPresignatureCleanupState = { kind: "owned_elsewhere" };
-			if (!handedOffPrepare && retryCount < MAX_CLIENT_PRESIGNATURE_CLAIM_RETRIES) return await signRouterAbEcdsaDerivationDigestWithPoolHitAttempt(args, retryCount + 1, supply);
+			if (retryCount < MAX_CLIENT_PRESIGNATURE_CLAIM_RETRIES) return await signRouterAbEcdsaDerivationDigestWithPoolHitAttempt(args, retryCount + 1, supply);
 			return {
 				ok: false,
 				code: reservation.reason === "expired" ? "pool_entry_expired" : "pool_entry_unavailable",
@@ -1070,7 +950,7 @@ async function signRouterAbEcdsaDerivationDigestWithPoolHitAttempt(args, retryCo
 		};
 		preparationState = { kind: "prepare_submitted" };
 		const prepareStartedAt = performance.now();
-		const prepareResponse = handedOffPrepare?.response ?? await prepareRouterAbEcdsaDerivationEvmDigestSigningV1({
+		const prepareResponse = await prepareRouterAbEcdsaDerivationEvmDigestSigningV1({
 			relayServerUrl: relayerUrl,
 			credential: args.credential,
 			request: prepareRequest,
@@ -1181,11 +1061,6 @@ async function signRouterAbEcdsaDerivationDigestWithPoolHitAttempt(args, retryCo
 		};
 	} catch (e) {
 		const msg = String(e && typeof e === "object" && "message" in e ? e.message : e || "Router A/B ECDSA derivation signing failed");
-		if (handoff && handoff.state.kind !== "waiting" && handoff.state.kind !== "cancelled") return {
-			ok: false,
-			code: "router_ab_sign_failed",
-			message: msg
-		};
 		if (e instanceof RouterAbSigningRequestError && e.code === "expired_local_request") return {
 			ok: false,
 			code: "pool_entry_expired",
@@ -1210,11 +1085,6 @@ async function signRouterAbEcdsaDerivationDigestWithPoolHitAttempt(args, retryCo
 			message: msg
 		};
 	} finally {
-		if (handoff) {
-			if (finalBatchHandoffs.get(handoff.poolKey) === handoff) finalBatchHandoffs.delete(handoff.poolKey);
-			zeroizeBytes(handoff.contribution);
-			if (handoff.state.kind === "waiting") handoff.state = { kind: "cancelled" };
-		}
 		zeroizeBytes(clientSignatureShare32);
 		zeroizeBytes(clientRerandomizationContribution32);
 		if (presignature && poolIdentity && clientPresignatureCleanupState.kind !== "consumed" && clientPresignatureCleanupState.kind !== "owned_elsewhere") {
@@ -1261,7 +1131,7 @@ async function signRouterAbEcdsaDerivationDigestWithPool(args) {
 				routerAbEcdsaDerivationPoolFill: {
 					kind: "router_ab_ecdsa_derivation_signing_worker_pool",
 					scope: args.scope,
-					ceremonyExpiresAtMs: expiresAtMs,
+					ceremonyExpiresAtMs: Math.min(expiresAtMs, Date.now() + ROUTER_AB_ECDSA_PRESIGN_CEREMONY_MAX_LIFETIME_MS - PRESIGN_CEREMONY_CLOCK_SKEW_MARGIN_MS),
 					materialExpiresAtMs: args.authorization.kind === "operation_step_up" ? expiresAtMs : Date.now() + MAX_DURABLE_CLIENT_PRESIGNATURE_LIFETIME_MS
 				},
 				workerCtx: args.workerCtx,
@@ -1310,10 +1180,6 @@ async function refillRouterAbEcdsaDerivationClientPresignaturePool(args) {
 			...ecdsaPoolFillAuthorization(args)
 		});
 		if (!generated.ok) return generated;
-		if (generated.kind === "handed_off") return {
-			ok: true,
-			presignatureId: generated.presignatureId
-		};
 		if (getClientPresignaturePoolGeneration(poolKey) !== startedGeneration) {
 			await args.clientSigningMaterial.destroyClientPresignature({
 				materialHandle: generated.presignature.materialHandle,

package/dist/esm/core/signingEngine/routerAb/ecdsaDerivation/signingMaterialRef.js

@@ -1,5 +1,6 @@
+import { parseEcdsaClientVerifyingShareB64u } from "../../../../shared-ts/src/threshold/keyMaterialBrands.js";
+import { parseEcdsaThresholdKeyId } from "../../session/keyMaterialBrands.js";
 import { requireRouterAbEcdsaDerivationNormalSigningStateV1, routerAbEcdsaDerivationActiveStateId } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
-import { parseEcdsaClientVerifyingShareB64u, parseEcdsaThresholdKeyId } from "../../session/keyMaterialBrands.js";
 //#region src/core/signingEngine/routerAb/ecdsaDerivation/signingMaterialRef.ts
 function buildRouterAbEcdsaDerivationSigningMaterialRef(args) {
 	const routerAbState = requireRouterAbEcdsaDerivationNormalSigningStateV1(args.routerAbState);

package/dist/esm/core/signingEngine/session/availability/availableSigningLanes.js

@@ -1,11 +1,11 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { nearEd25519SigningKeyIdFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
-import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { toAccountId } from "../../../types/accountIds.js";
+import { nearEd25519SigningKeyIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { thresholdEcdsaChainTargetKey, toWalletId } from "../../interfaces/ecdsaChainTarget.js";
 import { signingLaneAuthBindingKey, signingLaneAuthMethod } from "../identity/signingLaneAuthBinding.js";
 import { deriveEvmFamilyKeyFingerprintFromPublicFacts, toRpId } from "../identity/evmFamilyEcdsaIdentity.js";
 import { parseSignerSlot } from "../../../../shared-ts/src/utils/signerSlot.js";
+import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { canonicalizeLaneFacts, serverIssuedGenerationFromNumber } from "./canonicalLaneInventory.js";
 import { nearEd25519SessionMatchesMaterialActivation } from "../material/nearEd25519YaoSigningPreparation.js";
 //#region src/core/signingEngine/session/availability/availableSigningLanes.ts
@@ -774,7 +774,7 @@ function canonicalEcdsaLaneSelectionForFacts(facts) {
 	}
 }
 /**
-* R109C: an added auth method holds its own access projection over the wallet's
+* An added auth method holds its own access projection over the wallet's
 * existing activation, so the same lane is reachable through two credentials.
 * For a wallet-level read that names no method, those are one lane, not two
 * competing ones - and they are indistinguishable to the canonical tie-break,
@@ -873,7 +873,7 @@ function suppressPublicEd25519CandidatesWithDurablePolicy(candidates) {
 	});
 }
 /**
-* R103C owner-scope matching. Ed25519 lanes bind an owner's credential AND
+* Owner-scope matching. Ed25519 lanes bind an owner's credential AND
 * signer slot; ECDSA lanes bind the credential alone. State stays untouched:
 * the scope decides whose lane it is, never whether it is usable.
 */

package/dist/esm/core/signingEngine/session/availability/persistedAvailableSigningLanes.js

@@ -1,9 +1,9 @@
-import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { WalletSessionStatusReadScope } from "../../../rpcClients/relayer/walletSessionAuthorizationStatus.js";
 import { SIGNER_AUTH_METHODS } from "../../../../shared-ts/src/utils/signerDomain.js";
 import { thresholdEcdsaChainTargetKey, toWalletId } from "../../interfaces/ecdsaChainTarget.js";
 import { signingLaneAuthMethod } from "../identity/signingLaneAuthBinding.js";
 import { buildBaseEvmFamilyEcdsaKeyIdentity, buildPasskeyEcdsaAuthBinding, buildResolvedEvmFamilyEcdsaKey, toRpId } from "../identity/evmFamilyEcdsaIdentity.js";
+import { isEmailOtpWalletAuthAuthority, isPasskeyWalletAuthAuthority } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { activeWalletAuthorityAvailableLaneFromProjection, ecdsaAvailableLaneIdentityKey, readAvailableSigningLanes } from "./availableSigningLanes.js";
 import { listEcdsaSealedSessionsForWallet, listExactSealedSessionsForWallet } from "../persistence/sealedSessionStore.js";
 import { resolveActiveWalletAuthorityEcdsaRuntimeV1 } from "../material/activeWalletAuthorityEcdsaRuntime.js";
@@ -85,7 +85,7 @@ async function readPersistedAvailableSigningLanes(deps, args, ecdsaChainTargets)
 	}, new WalletSessionStatusReadScope());
 }
 /**
-* R103C human operational read: lanes for one exact owner. The auth-method
+* Human operational read: lanes for one exact owner. The auth-method
 * narrowing and the owner filter both derive from the scope — callers supply
 * nothing the scope does not already carry.
 */

package/dist/esm/core/signingEngine/session/emailOtp/coordinatorRuntime.js

@@ -9,7 +9,6 @@ import { EmailOtpWarmSessionRuntime, createEmailOtpWarmSessionWorkerClient } fro
 //#region src/core/signingEngine/session/emailOtp/coordinatorRuntime.ts
 var EmailOtpWalletSessionRuntime = class {
 	constructor(deps) {
-		this.deps = deps;
 		this.sealedRefreshDiagnosticLogAtMsByKey = /* @__PURE__ */ new Map();
 		this.runtimeConfig = new EmailOtpRuntimeConfig({
 			configs: deps.configs,
@@ -56,7 +55,6 @@ var EmailOtpWalletSessionRuntime = class {
 		});
 		const warmSessionWorkerClient = createEmailOtpWarmSessionWorkerClient({ worker: deps.signerWorkerManager });
 		this.sealedRefreshPolicy = new EmailOtpSealedRefreshPolicy({
-			deleteDurableSealedSessionRecord: deps.deleteDurableSealedSessionRecord,
 			updateExactSealedSessionPolicy: deps.updateExactSealedSessionPolicy,
 			clearEcdsaRestoreCaches: () => this.clearEcdsaRestoreCaches()
 		});

package/dist/esm/core/signingEngine/session/emailOtp/ecdsaLogin.js

@@ -1,12 +1,12 @@
 import { mpcMaterialActivationRefsEqual, parseThresholdEcdsaSessionId, parseWalletAuthMethodId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
-import { buildEmailOtpWalletAuthAuthority, isEmailOtpWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION, WALLET_EMAIL_OTP_UNLOCK_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { thresholdEcdsaChainTargetsEqual, toWalletId } from "../../interfaces/ecdsaChainTarget.js";
 import { SigningSessionIds } from "../operationState/types.js";
 import { buildEvmFamilyEcdsaRecoveredMaterialLanePolicy, buildEvmFamilyEcdsaSessionLanePolicy, toEvmFamilyEcdsaKeyHandle } from "../identity/evmFamilyEcdsaIdentity.js";
 import { DEFAULT_THRESHOLD_SESSION_POLICY, DEFAULT_UNLOCK_REMAINING_USES, clampThresholdSessionPolicy, resolveWalletUnlockSessionUsesFromRequestedUses } from "../../threshold/sessionPolicy.js";
+import { buildEmailOtpWalletAuthAuthority, isEmailOtpWalletAuthAuthority, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { parseEmailOtpEcdsaExportWorkerIssuedSessionHandle, parseEmailOtpWorkerIssuedSessionHandle } from "../../../platform/secretSources.js";
 import { buildEmailOtpAuthContextForCanonicalWallet, buildEmailOtpAuthContextForWalletAuthMethod, emailOtpAuthContextProviderUserId, isEmailOtpPendingSingleUseAuthContext, isEmailOtpSessionAuthContext } from "../identity/laneIdentity.js";
 import { resolveExactWalletAuthAuthority } from "../identity/ownerLaneScope.js";

package/dist/esm/core/signingEngine/session/emailOtp/ecdsaPublication.js

@@ -1,11 +1,11 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
-import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
-import { routerAbEcdsaDerivationActiveStateId, sameRouterAbEcdsaDerivationPublicCapabilityV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { SIGNING_SESSION_SEAL_GROUP_ID } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 import { thresholdEcdsaChainTargetKey, thresholdEcdsaChainTargetsEqual } from "../../interfaces/ecdsaChainTarget.js";
+import { signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { SigningSessionIds } from "../operationState/types.js";
 import { buildEvmFamilyEcdsaWalletKey } from "../identity/evmFamilyEcdsaIdentity.js";
+import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
+import { routerAbEcdsaDerivationActiveStateId, sameRouterAbEcdsaDerivationPublicCapabilityV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { buildEcdsaRoleLocalPublicFacts } from "../persistence/ecdsaRoleLocalRecords.js";
 import { emailOtpAuthContextEmailHashHex, emailOtpAuthContextProvider, emailOtpAuthContextProviderUserId, emailOtpAuthContextRetention } from "../identity/laneIdentity.js";
 import { buildPersistedEcdsaRoleLocalMaterial } from "../material/ecdsaRoleLocalMaterialResolver.js";

package/dist/esm/core/signingEngine/session/emailOtp/ecdsaRecovery.js

@@ -1,9 +1,9 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { parseSdkEcdsaDerivationSigningRootId, parseSdkEcdsaDerivationSigningRootVersion, parseSdkEcdsaDerivationThresholdKeyId } from "../../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
-import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { thresholdEcdsaChainTargetsEqual, toWalletId } from "../../interfaces/ecdsaChainTarget.js";
+import { parseSdkEcdsaDerivationSigningRootId, parseSdkEcdsaDerivationSigningRootVersion, parseSdkEcdsaDerivationThresholdKeyId } from "../../../../shared-ts/src/threshold/ecdsaDerivationRoleLocalBootstrap.js";
 import { buildEvmFamilyEcdsaWalletKey } from "../identity/evmFamilyEcdsaIdentity.js";
-import { parseSigningSessionSealKeyVersion } from "../keyMaterialBrands.js";
+import { parseSigningSessionSealKeyVersion } from "../../../../shared-ts/src/threshold/keyMaterialBrands.js";
+import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseEmailOtpWorkerIssuedSessionHandle } from "../../../platform/secretSources.js";
 import { buildEcdsaRoleLocalPublicFacts } from "../persistence/ecdsaRoleLocalRecords.js";
 import { buildEmailOtpAuthContextForWalletAuthMethod, emailOtpAuthContextProviderUserId, emailOtpAuthContextRetention } from "../identity/laneIdentity.js";

package/dist/esm/core/signingEngine/session/emailOtp/ecdsaSigningSessionAuthority.js

@@ -1,6 +1,6 @@
 import { mpcMaterialActivationRefsEqual } from "../../../../shared-ts/src/utils/domainIds.js";
-import { walletAuthAuthoritiesMatch, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { thresholdEcdsaChainTargetsEqual } from "../../interfaces/ecdsaChainTarget.js";
+import { walletAuthAuthoritiesMatch, walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { buildCanonicalEvmFamilyEcdsaSigningCapability, buildExactEvmFamilyWalletSessionAuthorization } from "../material/ecdsaSigningCapability.js";
 import { buildPersistedEcdsaRoleLocalMaterial } from "../material/ecdsaRoleLocalMaterialResolver.js";
 import { resolveExactWalletAuthAuthority } from "../identity/ownerLaneScope.js";

package/dist/esm/core/signingEngine/session/emailOtp/ed25519ExportContext.js

@@ -1,10 +1,11 @@
 import { mpcMaterialActivationRefsEqual, parseThresholdEd25519SessionId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseMpcWalletSigningQuotaId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
+import { requireCanonicalString, requireRecord } from "../../../../shared-ts/src/utils/validation.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
-import { normalizeRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
-import { parseRouterAbEd25519NormalSigningState } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
 import { activeWalletSessionV1RecordsEqual } from "../../../../shared-ts/src/device-linking/activeWalletSession.js";
+import { parseRouterAbEd25519NormalSigningState } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
+import { normalizeRuntimePolicyScope, signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
+import { ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { parseEd25519YaoRecoveryCapabilityV1 } from "../passkey/ed25519YaoRecoveryCapability.js";
 //#region src/core/signingEngine/session/emailOtp/ed25519ExportContext.ts
 function isEd25519YaoClientRootEnvelopeV1(envelope) {
@@ -14,19 +15,11 @@ function requireEd25519YaoClientRootEnvelopeV1(envelope) {
 	if (!isEd25519YaoClientRootEnvelopeV1(envelope)) throw new Error("[SigningEngine][ed25519-export] export envelope has the wrong secret kind");
 	return envelope;
 }
-function requireRecord(value, label) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
-	return value;
-}
 function requireExactKeys(record, expected, label) {
 	const actual = Object.keys(record).sort();
 	const keys = [...expected].sort();
 	if (actual.length !== keys.length || actual.some((key, index) => key !== keys[index])) throw new Error(`${label} fields are invalid`);
 }
-function requireString(value, label) {
-	if (typeof value !== "string" || value.trim() !== value || value.length === 0) throw new Error(`${label} is invalid`);
-	return value;
-}
 function requirePositiveInteger(value, label) {
 	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 1) throw new Error(`${label} is invalid`);
 	return value;
@@ -84,9 +77,9 @@ async function readColdExportBootstrap(input) {
 		"capability"
 	], "Ed25519 export bootstrap");
 	if (record.kind !== "router_ab_ed25519_yao_v2_session_bootstrap_v1") throw new Error("Ed25519 export bootstrap kind is invalid");
-	const walletId = requireString(record.walletId, "bootstrap.walletId");
-	const nearAccountId = requireString(record.nearAccountId, "bootstrap.nearAccountId");
-	const nearEd25519SigningKeyId = requireString(record.nearEd25519SigningKeyId, "bootstrap.nearEd25519SigningKeyId");
+	const walletId = requireCanonicalString(record.walletId, "bootstrap.walletId");
+	const nearAccountId = requireCanonicalString(record.nearAccountId, "bootstrap.nearAccountId");
+	const nearEd25519SigningKeyId = requireCanonicalString(record.nearEd25519SigningKeyId, "bootstrap.nearEd25519SigningKeyId");
 	const thresholdSessionId = parseThresholdEd25519SessionId(record.thresholdSessionId);
 	const walletSessionId = parseWalletSessionId(record.walletSessionId);
 	const quotaId = parseMpcWalletSigningQuotaId(record.quotaId);
@@ -100,7 +93,7 @@ async function readColdExportBootstrap(input) {
 	};
 	const participantIds = requireParticipantIds(record.participantIds);
 	const registeredPublicKeyB64u = base64UrlEncode(Uint8Array.from(capability.registeredPublicKey));
-	if (!thresholdSessionId.ok || !walletSessionId.ok || !quotaId.ok || !signingRoot || !routerAbNormalSigning || walletId !== String(signer.account.wallet.walletId) || nearAccountId !== String(signer.account.nearAccountId) || nearEd25519SigningKeyId !== String(signer.nearEd25519SigningKeyId) || thresholdSessionId.value !== capability.lifecycle.thresholdSessionId || walletSessionId.value !== operationCredential.walletSessionId || quotaId.value !== input.authorization.record.quotaId || requirePositiveInteger(record.signerSlot, "bootstrap.signerSlot") !== signer.signerSlot || requireString(record.signingWorkerId, "bootstrap.signingWorkerId") !== binding.signingWorkerId || participantIds[0] !== binding.participantIds[0] || participantIds[1] !== binding.participantIds[1] || authority.factor.providerUserId !== input.subject.auth.providerSubjectId || registeredPublicKeyB64u !== binding.registeredPublicKeyB64u || !mpcMaterialActivationRefsEqual(capability.materialActivation, input.expectedMaterialActivation)) throw new Error("[SigningEngine][ed25519-export] capability bootstrap identity mismatch");
+	if (!thresholdSessionId.ok || !walletSessionId.ok || !quotaId.ok || !signingRoot || !routerAbNormalSigning || walletId !== String(signer.account.wallet.walletId) || nearAccountId !== String(signer.account.nearAccountId) || nearEd25519SigningKeyId !== String(signer.nearEd25519SigningKeyId) || thresholdSessionId.value !== capability.lifecycle.thresholdSessionId || walletSessionId.value !== operationCredential.walletSessionId || quotaId.value !== input.authorization.record.quotaId || requirePositiveInteger(record.signerSlot, "bootstrap.signerSlot") !== signer.signerSlot || requireCanonicalString(record.signingWorkerId, "bootstrap.signingWorkerId") !== binding.signingWorkerId || participantIds[0] !== binding.participantIds[0] || participantIds[1] !== binding.participantIds[1] || authority.factor.providerUserId !== input.subject.auth.providerSubjectId || registeredPublicKeyB64u !== binding.registeredPublicKeyB64u || !mpcMaterialActivationRefsEqual(capability.materialActivation, input.expectedMaterialActivation)) throw new Error("[SigningEngine][ed25519-export] capability bootstrap identity mismatch");
 	return {
 		emailHashHex: authority.verifier.emailHashHex,
 		bootstrap: {
@@ -202,7 +195,7 @@ async function readLinkedExportCapability(input) {
 	};
 	const participantIds = requireParticipantIds(record.participantIds);
 	const registeredPublicKeyB64u = base64UrlEncode(Uint8Array.from(capability.registeredPublicKey));
-	if (!thresholdSessionId.ok || !walletSessionId.ok || !quotaId.ok || !runtimePolicyScope || !routerAbNormalSigning || requireString(record.walletId, "bootstrap.walletId") !== String(signer.account.wallet.walletId) || requireString(record.nearAccountId, "bootstrap.nearAccountId") !== String(signer.account.nearAccountId) || requireString(record.nearEd25519SigningKeyId, "bootstrap.nearEd25519SigningKeyId") !== String(signer.nearEd25519SigningKeyId) || requirePositiveInteger(record.signerSlot, "bootstrap.signerSlot") !== signer.signerSlot || thresholdSessionId.value !== capability.lifecycle.thresholdSessionId || walletSessionId.value !== operationCredential.walletSessionId || quotaId.value !== input.authorization.record.quotaId || requireString(record.signingWorkerId, "bootstrap.signingWorkerId") !== input.source.signingWorkerId || participantIds[0] !== input.source.participantIds[0] || participantIds[1] !== input.source.participantIds[1] || registeredPublicKeyB64u !== input.source.registeredPublicKeyB64u || !mpcMaterialActivationRefsEqual(capability.materialActivation, input.expectedMaterialActivation)) throw new Error("[SigningEngine][ed25519-export] linked capability identity mismatch");
+	if (!thresholdSessionId.ok || !walletSessionId.ok || !quotaId.ok || !runtimePolicyScope || !routerAbNormalSigning || requireCanonicalString(record.walletId, "bootstrap.walletId") !== String(signer.account.wallet.walletId) || requireCanonicalString(record.nearAccountId, "bootstrap.nearAccountId") !== String(signer.account.nearAccountId) || requireCanonicalString(record.nearEd25519SigningKeyId, "bootstrap.nearEd25519SigningKeyId") !== String(signer.nearEd25519SigningKeyId) || requirePositiveInteger(record.signerSlot, "bootstrap.signerSlot") !== signer.signerSlot || thresholdSessionId.value !== capability.lifecycle.thresholdSessionId || walletSessionId.value !== operationCredential.walletSessionId || quotaId.value !== input.authorization.record.quotaId || requireCanonicalString(record.signingWorkerId, "bootstrap.signingWorkerId") !== input.source.signingWorkerId || participantIds[0] !== input.source.participantIds[0] || participantIds[1] !== input.source.participantIds[1] || registeredPublicKeyB64u !== input.source.registeredPublicKeyB64u || !mpcMaterialActivationRefsEqual(capability.materialActivation, input.expectedMaterialActivation)) throw new Error("[SigningEngine][ed25519-export] linked capability identity mismatch");
 	return capability;
 }
 function countExactEd25519ExportSubjects(subjects, expectedMaterialActivation) {

package/dist/esm/core/signingEngine/session/emailOtp/exportRecovery.js

@@ -1,5 +1,5 @@
-import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
+import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { buildEmailOtpRoutePlan } from "../../stepUpConfirmation/otpPrompt/authLane.js";
 import { throwEmailOtpSigningSessionAuthStateError } from "./routePlan.js";
 import { exportEcdsaDerivationKey } from "../../flows/recovery/ecdsaDerivationExport.js";
@@ -131,7 +131,7 @@ function buildExportChallengeRoutePlan(ports, args) {
 		});
 	}
 }
-function buildEcdsaExportVerificationRoutePlan(authorization) {
+function buildEcdsaExportVerificationRoutePlan(_authorization) {
 	return buildEmailOtpRoutePlan({
 		routeFamily: "login",
 		operation: WALLET_EMAIL_OTP_EXPORT_OPERATION

package/dist/esm/core/signingEngine/session/emailOtp/exportRecoveryRuntime.js

@@ -43,15 +43,6 @@ var EmailOtpExportRecoveryRuntime = class {
 			buildSigningSessionRoutePlan: buildEmailOtpSigningSessionRoutePlan
 		};
 	}
-	signingSessionWorkerPorts() {
-		return {
-			getSignerWorkerContext: this.ports.getSignerWorkerContext,
-			requireRelayUrl: this.ports.requireRelayUrl,
-			requireSigningSessionSealGroupId: this.ports.requireSigningSessionSealGroupId,
-			resolveSelectedWalletAuthority: this.ports.resolveSelectedWalletAuthority,
-			buildSigningSessionRoutePlan: buildEmailOtpSigningSessionRoutePlan
-		};
-	}
 };
 //#endregion
 export { EmailOtpExportRecoveryRuntime };

package/dist/esm/core/signingEngine/session/emailOtp/publicTypes.js

@@ -1,7 +1,6 @@
 import { parseMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/domainIds.js";
-import "../../../../shared-ts/src/authorization/walletAuthority.js";
-import "../../../../shared-ts/src/utils/registrationIntent.js";
 import { normalizeThresholdRuntimePolicyScope } from "../../threshold/sessionPolicy.js";
+import "../../../../shared-ts/src/authorization/walletAuthority.js";
 //#region src/core/signingEngine/session/emailOtp/publicTypes.ts
 function parseEmailOtpUnlockEd25519Identity(record) {
 	const materialActivation = parseMpcMaterialActivationRef(record.materialActivation);

package/dist/esm/core/signingEngine/session/emailOtp/sealedRefreshPolicy.js

@@ -1,4 +1,3 @@
-import { createDeleteDurableSealedSessionCommand } from "../persistence/durableSealedSessionCommands.js";
 //#region src/core/signingEngine/session/emailOtp/sealedRefreshPolicy.ts
 var EmailOtpSealedRefreshPolicy = class {
 	constructor(ports) {
@@ -11,33 +10,6 @@ var EmailOtpSealedRefreshPolicy = class {
 			chainTarget: purpose.chainTarget
 		};
 	}
-	/** Corrupt persisted state or explicit user removal only. Expiry and
-	* exhaustion never reach here. */
-	async deleteEmailOtpDurableSealedSessionRecord(args) {
-		const thresholdSessionId = String(args.purpose.thresholdSessionId || "").trim();
-		if (!thresholdSessionId) {
-			this.ports.clearEcdsaRestoreCaches();
-			return;
-		}
-		const command = createDeleteDurableSealedSessionCommand({
-			durableRecord: {
-				authMethod: "email_otp",
-				curve: "ecdsa",
-				thresholdSessionId,
-				chainTarget: args.purpose.chainTarget
-			},
-			deleteReason: args.deleteReason,
-			preserveResolvedIdentity: false
-		});
-		await this.ports.deleteDurableSealedSessionRecord(command).catch(() => void 0);
-		this.ports.clearEcdsaRestoreCaches();
-	}
-	async recordSessionMaterialClaimed(purpose, result) {
-		await this.recordSessionPolicyResult({
-			purpose,
-			result
-		});
-	}
 	async recordSessionUseConsumed(purpose, result) {
 		await this.recordSessionPolicyResult({
 			purpose,

package/dist/esm/core/signingEngine/session/emailOtp/sealedSessionRegistry.js

@@ -1,5 +1,5 @@
 import { SIGNING_SESSION_SEAL_GROUP_ID } from "../../../../shared-ts/src/utils/signingSessionSeal.js";
-import { buildCurrentSealedSessionRecord } from "../persistence/sealedSessionStore.js";
+import { buildCurrentSealedSessionRecord } from "../persistence/sealedSessionRecords.js";
 import { persistEmailOtpEcdsaSigningSessionForRefresh } from "./ecdsaPublication.js";
 //#region src/core/signingEngine/session/emailOtp/sealedSessionRegistry.ts
 var EmailOtpSealedSessionRegistry = class {

package/dist/esm/core/signingEngine/session/emailOtp/walletUnlock.js

@@ -1,5 +1,5 @@
-import { ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 import { EMAIL_OTP_CHANNEL } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
+import { ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1 } from "../../../../shared-ts/src/utils/routerAbEd25519Yao.js";
 //#region src/core/signingEngine/session/emailOtp/walletUnlock.ts
 async function unlockEmailOtpAuthorityWallet(args) {
 	return await args.workerCtx.requestWorkerOperation({

package/dist/esm/core/signingEngine/session/identity/evmFamilyEcdsaIdentity.js

@@ -1,11 +1,11 @@
 import { base64UrlDecode } from "../../../../shared-ts/src/utils/base64.js";
 import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
-import { deriveEvmFamilySigningKeySlotId as deriveEvmFamilySigningKeySlotId$1 } from "../../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
-import { signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { SIGNER_AUTH_METHODS } from "../../../../shared-ts/src/utils/signerDomain.js";
 import { toWalletId, walletIdFromWalletProfile } from "../../interfaces/ecdsaChainTarget.js";
 import { normalizeThresholdEd25519ParticipantIds } from "../../../../shared-ts/src/threshold/participants.js";
+import { signingRootScopeFromRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { deriveThresholdEcdsaKeyHandle } from "../../../../shared-ts/src/utils/thresholdEcdsaKeyHandle.js";
+import { deriveEvmFamilySigningKeySlotId as deriveEvmFamilySigningKeySlotId$1 } from "../../../../shared-ts/src/signing-lanes/evmFamilySigningKeySlotId.js";
 import "../../../../shared-ts/src/signing-lanes/index.js";
 import { SigningSessionIds } from "../operationState/types.js";
 //#region src/core/signingEngine/session/identity/evmFamilyEcdsaIdentity.ts