@seams/wallet 0.6.2 → 0.7.3

package/dist/public/sdk/{runtimeContext-CTt9ON27.js → runtimeContext-D3TBExQ6.js}

@@ -1,75 +1,79 @@
 import { r as __toESM } from "./chunk-BtrIJ4_z.js";
-import { r as reviewAdmissionForBinding } from "./transactionReviewAdmission-Cv9kTr4c.js";
-import { a as setEmbeddedBase, n as getEmbeddedBase, r as onEmbeddedBaseChange, t as getEmbeddedAssetVersion } from "./base-CMsoJcVv.js";
-import { A as parseSigningLaneId, C as parseMpcLifecycleBindingRef, F as parseWalletAuthMethodId, H as parseWebAuthnRpId, L as parseWalletAuthorityId, M as parseThresholdEd25519SessionId, N as parseThresholdSessionId, O as parsePasskeyEnvelopeId, P as parseVerifiedEmailAddress, R as parseWalletId, T as parseMpcMaterialActivationRef, V as parseWebAuthnCredentialIdB64u, b as parseLinkedDeviceEnrollmentId, c as normalizeTrimmedString, d as buildMpcMaterialActivationRef, f as hasWhitespaceOrControlCharacters, j as parseThresholdEcdsaSessionId, l as stripTrailingSlashes, p as mpcMaterialActivationRefsEqual, t as joinNormalizedUrl, v as parseLaneShareEpoch, w as parseMpcMaterialActivationId, x as parseLinkedDeviceId, y as parseLinkDeviceSessionId, z as parseWalletKeyId } from "./normalize-BephcEIF.js";
-import { t as walletIframeRequestIdFromBoundary } from "./walletIframeIdentity-UmQTJsHc.js";
-import { C as base58Encode, f as toOptionalTrimmedNonEmptyString, g as getNearShortErrorMessage, h as ensureEd25519Prefix, i as isBoolean, l as isString, m as deriveImplicitNearAccountIdFromEd25519PublicKey, o as isObject, s as isPlainObject, u as requireTrimmedString, y as parseNamedNearAccountId } from "./validation-BphUDXs7.js";
-import { b as parsePMRedeemHostedWalletSeamsSessionPayload } from "./messages-B3UbNZYc.js";
+import { B as normalizeTrimmedString, C as parseThresholdSessionId, D as parseWalletAuthorityId, M as parseWebAuthnRpId, N as joinNormalizedUrl, O as parseWalletId, S as parseThresholdEd25519SessionId, T as parseWalletAuthMethodId, V as stripTrailingSlashes, b as parseSigningLaneId, c as parseLaneShareEpoch, d as parseLinkedDeviceId, h as parseMpcMaterialActivationRef, j as parseWebAuthnCredentialIdB64u, k as parseWalletKeyId, l as parseLinkDeviceSessionId, m as parseMpcMaterialActivationId, n as hasWhitespaceOrControlCharacters, p as parseMpcLifecycleBindingRef, r as mpcMaterialActivationRefsEqual, t as buildMpcMaterialActivationRef, u as parseLinkedDeviceEnrollmentId, v as parsePasskeyEnvelopeId, w as parseVerifiedEmailAddress, x as parseThresholdEcdsaSessionId } from "./domainIds-lcrFg6Sa.js";
+import { C as deriveImplicitNearAccountIdFromEd25519PublicKey, M as base58Encode, O as parseNamedNearAccountId, T as getNearShortErrorMessage, _ as requireRecord$1, c as isBoolean, d as isPlainObject, h as requireCanonicalString, n as asRecordOrArray, p as isString, u as isObject, w as ensureEd25519Prefix, x as toOptionalTrimmedNonEmptyString, y as requireTrimmedString } from "./validation-gat4LEKm.js";
+import { r as reviewAdmissionForBinding } from "./transactionReviewAdmission-BCPvl8OZ.js";
+import { a as setEmbeddedBase, n as getEmbeddedBase, r as onEmbeddedBaseChange, t as getEmbeddedAssetVersion } from "./base-D1B5mGin.js";
+import { t as walletIframeRequestIdFromBoundary } from "./walletIframeIdentity-DB6Z2EC9.js";
+import { b as parsePMRedeemHostedWalletSeamsSessionPayload } from "./messages-C7Dbx9iN.js";
 import { i as isUserCancellationError, n as getUserFriendlyErrorMessage, o as toError, t as errorMessage } from "./errors-93h9uAW9.js";
 import { i as base64UrlEncode, n as base64Encode, r as base64UrlDecode } from "./base64-Clm8C-e9.js";
 import { n as secureRandomBase64Url, r as secureRandomId, t as secureRandomBase36 } from "./secureRandomId-BORsmdS4.js";
-import { $ as unlockEmailOtpEd25519YaoCapability, A as requestEmailOtpEnrollmentChallenge, At as listExactSealedSessionsForWallet, B as scheduleEcdsaSessionPresignaturePrefill, Bt as resolveExactWalletSessionOperationCredential, C as preparePasskeyEd25519YaoLocalMaterialRehydrationV1, Ct as resolveExactEd25519SealedSessionRuntimeForLane, D as persistPasskeyEd25519YaoSessionForRefresh, Dt as buildCurrentSealedSessionRecord, E as buildPasskeyEd25519RestoreMetadata, Et as acquireSigningSessionRestoreLease, F as buildRecoveredCustodyEnvelopeRecord, Ft as updateExactSealedSessionPolicy, G as requirePasskeyPrfFirstB64u, Gt as ROUTER_AB_ED25519_YAO_ACTIVE_CLIENT_KIND_V1, H as resumePendingNearRegistrations, Ht as openWalletCustodyEd25519ActiveClientV1, I as resolveManagedRuntimeScopeBootstrap, It as writeExactSealedSession, J as assertEd25519YaoWarmRecoveryDescriptorStableMaterialContinuity, Jt as parseEd25519YaoRecoveryCapabilityV1, K as verifyLinkedDevicePasskeyWalletSession, Kt as RouterAbEd25519YaoClientV1, L as awaitNearProvisioningInFlight, Lt as createDeleteDurableSealedSessionCommand, M as configurePasskeyCustodySessionCachePersistence, Mt as readExactSealedSession, N as readPasskeyCustodySessionEnvelope, Nt as releaseSigningSessionRestoreLease, O as collectEmailOtpRegistrationAuthority, Ot as deleteDurableSealedSessionRecord, P as rememberPasskeyCustodySessionEnvelope, Pt as updateExactEd25519SealedSessionPolicy, Q as unlockEmailOtpAuthorityWallet, R as readNearProvisioningState, Rt as buildRouterAbEd25519SigningWalletSession, S as persistPasskeyEd25519YaoSignerMaterialV1, St as parseExactEd25519SealedSessionRuntime, T as buildRestorableMpcMaterialRefInternal, Tt as resolveExactEd25519SealedSessionRuntimeForWalletSubject, U as passkeyCredentialIdB64uFromAuthentication, Ut as walletCustodyActivationFactsFromActiveClientMetadataV1, V as resumePendingEcdsaRegistrationFromStoredCommit, Vt as openOrRejoinWalletCustodyEd25519V1, W as passkeyPrfFirstB64uFromCredential, Wt as walletCustodyCacheEnvelopeFromRecordV1, X as parsePasskeyEd25519YaoSyncResponseV1, Xt as listThresholdEcdsaProvisionTargets, Y as buildRecoveredWalletSessionState, Yt as listConfiguredThresholdEcdsaPublicationTargets, Z as passkeyEd25519YaoLaneReferenceFromRecovery, Zt as isRegistrationBenchmarkDiagnosticsEnabled, _ as walletCustodyCeremonyTransportFromWorkerContextV1, _t as nearEd25519YaoOperationMaterialFacts, a as registerWallet, at as joinNearEd25519CustodyV1, b as ed25519YaoLocalMaterialIdentityFromWalletSession, bt as ed25519AuthorizationIdentityMatchesRuntime, c as exactWalletSessionAuthorityIdentity, ct as rejoinEvmFamilyCustodyV1, d as validateExactWalletSessionAuthorization, dt as createRelayerExactWalletSessionStatusPort, et as unlockEmailOtpWallet, f as destroyUnlockedWalletEd25519ExportRootCapabilitiesV1, ft as sameRuntimePolicyScope$1, g as setUnlockedCustodyEnvelopeUpgradeSinkV1, gt as buildPasskeyRouterAbEd25519WalletSessionState, h as readUnlockedWalletEd25519ExportRootCapabilityV1, ht as buildEmailOtpRouterAbEd25519WalletSessionState, it as joinEvmFamilyCustodyV1, j as resolveGoogleEmailOtpProvider, jt as readExactEd25519SealedSession, k as requestEmailOtpChallenge, kt as listEcdsaSealedSessionsForWallet, l as persistExactWalletSessionAuthorizationFromEcdsaBootstrap, lt as rejoinNearEd25519CustodyV1, m as establishUnlockedWalletEd25519ExportRootCapabilityV1, mt as WALLET_IFRAME_TRANSPORT_TIMING_LABEL, nt as establishEvmFamilyCustodyV1, ot as recoverEvmFamilyCustodyV1, p as dropUnlockedWalletEd25519ExportRootCapabilityReferenceV1, pt as joinCustodyWireFromEnvelopeRecord, q as verifyPasskeyWalletUnlock, qt as RouterAbEd25519YaoHttpActivationTransportV1, rt as establishNearEd25519CustodyV1, st as recoverNearEd25519CustodyV1, t as addWalletSigner, tt as unlockEmailOtpWalletCapabilities, u as validateExactWalletSessionAuthorityIdentity, ut as WalletSessionStatusReadScope, v as requestWalletCustodyCeremonyOperation, vt as rebindRouterAbEd25519WalletSessionStateFromExactRuntime, w as readPasskeyEd25519YaoLocalMaterialLocatorV1, wt as resolveExactEd25519SealedSessionRuntimeForWallet, x as hydratePasskeyEd25519YaoLocalMaterialV1, xt as ed25519SealedRuntimeAuthorityRef, y as walletCustodyCeremonyStepRunner, yt as resolveActiveAuthorizedRouterAbEd25519WalletSessionState, z as subscribeToNearProvisioning, zt as requiredSigningSubjectForExactSigningLane } from "./registration-PIBMSsQR.js";
-import { a as computeLinkedDeviceTargetPreparationDigestV1, c as assertNeverLinkSessionStateV1, i as computeLinkedDevicePublicKeyDigestV1, l as activeWalletSessionV1RecordsEqual, n as LINKED_DEVICE_REQUEST_PROOF_HEADER_V1, o as computeWalletSessionInstallationReceiptDigestB64u, r as LINKED_DEVICE_REQUEST_PROOF_MAX_TTL_MS_V1, s as computeWalletSessionOperationCredentialDigestB64u } from "./device-linking-DpVGjSeq.js";
-import { A as alphabetizeStringify, D as sameWalletAuthMethodRecordV2, I as parseDigestB64u, J as resolvePrimaryNearRpcUrl, M as sha256BytesUtf8, N as sha256HexUtf8, O as sponsoredNamedNearAccountProvisioning, R as chainFamilyFromNetwork, S as registrationNearEd25519BranchKey, a as computeAddAuthMethodIntentDigestB64u, b as parseWalletAuthMethodRecordV2, c as computeWalletAuthMethodRevokeOperationFingerprintV1, i as buildWalletAuthMethodRecordV2, j as sha256Bytes, k as walletIdFromString, m as nearEd25519SigningKeyIdFromString, p as implicitNearAccountProvisioning, q as resolvePrimaryExplorerUrl, t as NEAR_ED25519_YAO_KEY_VERSION_V1, u as createServerAllocatedWalletId, y as parseNearEd25519SigningKeyId, z as cloneChainConfig } from "./registrationIntent-DwAIMQYh.js";
-import { a as thresholdEcdsaChainTargetFromRequest, c as toWalletId, i as thresholdEcdsaChainTargetFromConfig, n as nearAccountRefFromAccountId, o as thresholdEcdsaChainTargetKey, s as thresholdEcdsaChainTargetsEqual, t as configuredThresholdEcdsaChainTargets, u as walletSessionRefFromSession } from "./ecdsaChainTarget-BOTPGIU_.js";
-import { a as WALLET_AUTH_METHODS, d as WALLET_EMAIL_OTP_REGISTRATION_OPERATION, f as WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION, i as SIGNER_SOURCES, l as WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, n as SIGNER_AUTH_METHODS, p as WALLET_EMAIL_OTP_UNLOCK_OPERATION, r as SIGNER_KINDS, s as EMAIL_OTP_CHANNEL, u as WALLET_EMAIL_OTP_EXPORT_OPERATION } from "./signerDomain-DDLiwuYS.js";
-import { a as toIndexedDbChainTargetKey, t as normalizeIndexedDbAccountAddress } from "./normalization-oJyXl3Vn.js";
-import { c as zeroizeIssuedWalletRecoveryCodes, d as deriveWalletRecoveryKeyLifecycleId, f as parseRecoveryCodeReservationId, i as walletRecoverySetRotationWireFromWorkerResultV1, o as deriveRecoveryCodeLocatorV1FromBytes, r as walletRecoveryEcdsaPossessionChallengeDigestB64uV1, s as issueWalletRecoveryCodes, t as parseWalletRecoveryEcdsaPossessionChallengeV1 } from "./wallet-recovery-CKqoHbxT.js";
-import { _ as parseUnixMs, c as deriveEvmFamilySigningKeySlotId, d as parseEd25519PublicKeyB64u, f as parseEnvelopeCiphertextB64u, g as parseSecp256k1CompressedPublicKeyB64u, h as parseKeyCreationSignerSlot, i as parseThresholdEd25519ParticipantsV1, l as requireEvmFamilySigningKeySlotId, m as parseEnvelopeRevision, n as buildThresholdEd25519Participants2pV1, o as normalizeRuntimePolicyScope, p as parseEnvelopeNonceB64u, r as normalizeThresholdEd25519ParticipantIds, s as signingRootScopeFromRuntimePolicyScope, t as THRESHOLD_ED25519_2P_PARTICIPANT_IDS, u as parseDigestField, v as rejectUnknownFields, y as requireRecord$4 } from "./participants-Bcnsa_ip.js";
-import { A as storeWalletMixedRegistrationData$1, C as storeWalletEcdsaSignerRecords$1, D as storeWalletEmailOtpEcdsaSignerRecords$1, E as storeWalletEmailOtpEcdsaRegistrationData$1, F as getLastSelectedNearAccount, I as getNearAccountProjection, M as WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND, O as storeWalletEmailOtpEd25519RegistrationData$1, S as storeWalletEcdsaRecoverySignerRecords$1, T as storeWalletEd25519RegistrationData$1, _ as rollbackWalletEd25519SignerRegistration$1, a as getLastUser$1, b as storeAuthenticator$1, c as hasPasskeyCredential$1, g as rollbackUserRegistration$1, i as getAllUsers$1, k as storeWalletEmailOtpMixedRegistrationData$1, l as nearAuthenticatorsByAccount$1, n as finalizeWalletEcdsaRegistration$1, o as getUserBySignerSlot$1, r as finalizeWalletEd25519SignerRegistration$1, s as getWalletNearProvisioningState$1, t as activateAuthenticatedWalletState$1, v as setLastUser$1, w as storeWalletEd25519RecoveryRegistrationData$1, x as storeUserData$1, y as setWalletNearProvisioningState$1 } from "./accountLifecycle-Ddavc_FC.js";
-import { t as toAccountId } from "./accountIds-Ck4GAQfm.js";
-import { C as buildFullOwnerDelegatedWalletAuthorityV1, S as parseExactAdministeredSignerManifestV1, T as hasDelegatedWalletPermissionV1, a as clampThresholdSessionPolicy, b as replaceActiveWalletAuthorityEd25519MaterialActivationV1, c as resolveWalletUnlockSessionUsesFromRequestedUses, d as computeWalletSignerActivationSetDigestB64u, f as encodeWalletSignerActivationSetV1, h as isActiveRecoveredWalletAuthorityV1, i as buildEd25519SessionPolicy, l as coerceThemeMode$1, o as normalizeThresholdRuntimePolicyScope, r as DEFAULT_UNLOCK_REMAINING_USES, t as DEFAULT_THRESHOLD_SESSION_POLICY, u as computeWalletAuthorityDigestB64u, y as parseWalletSignerActivationSetV1 } from "./sessionPolicy-B4FsPuk2.js";
-import { $ as parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1, $t as deriveRouterAbEd25519YaoApplicationBindingDigestV1, A as parseLinkedDeviceRevokeResultV1, An as LINKED_DEVICE_ED25519_EXPORT_ROOT_TRANSFER_ALG_V1, At as buildEmailOtpWalletAuthAuthority, B as parseCommittedAuthorityPackagesV1, Bt as parseWalletAuthAuthorityRef, C as parseLinkedDeviceEmailOtpVerificationGrantV1, Cn as routerAbMpcMaterialActivationRefToWire, D as parseLinkedDeviceOwnerAuthorizationRequestV1, Dn as parseLinkedDeviceWalletSessionCredentialDeliveryBindingV1, Dt as sameRouterAbEcdsaRegistrationActivationReceiptV1, E as parseLinkedDeviceListResultV1, En as assertLinkedDeviceWalletSessionCredentialDeliveryIntegrityV1, Et as sameRouterAbEcdsaDerivationPublicIdentityV1, F as parseLocalAuthorityActivationFinalAckV1, Fn as serializeLinkedDeviceEd25519ExportRootTransferBindingV1, Ft as isEmailOtpWalletAuthAuthority, G as ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, H as parseLinkedDeviceEd25519SourcePreservingReservationV1, Ht as walletAuthAuthorityRef, I as parseLocalAuthorityInstallationReceiptV1, It as isPasskeyWalletAuthAuthority, Kt as ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, L as parseQrLinkedDeviceSessionPayloadV5, Lt as parseEmailOtpWalletAuthAuthority, M as parseLinkedDeviceTargetCredentialRegistrationResultV1, Mn as parseLinkedDeviceEd25519ExportRootPackageV1, N as parseLinkedDeviceTargetPreparationRequestV1, Nn as parseLinkedDeviceEd25519ExportRootRecipientPublicKeyB64u, O as parseLinkedDeviceOwnerAuthorizationSourceV1, On as parseLinkedDeviceWalletSessionCredentialDeliveryV1, P as parseLinkedDeviceTargetPreparationV1, Pn as parseLinkedDeviceEd25519ExportRootRecipientV1, Qt as ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, R as parseWalletSessionOperationCredentialV1, S as parseLinkedDeviceEmailOtpFactorReleaseEnvelopeV1, Sn as routerAbMpcMaterialActivationRefFromWire, T as parseLinkedDeviceListRequestV1, Tt as sameRouterAbEcdsaDerivationPublicCapabilityV1, U as parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1, Ut as ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1, Vt as walletAuthAuthoritiesMatch, W as parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationV1, Yt as ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, Zt as ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, _ as parseLinkedDeviceEmailOtpBaseFactorResolutionResultV1, a as buildLinkedDeviceSessionCancelClaimedRequestV1, at as parseRouterAbEcdsaExplicitExportForwardedResponseV1, b as parseLinkedDeviceEmailOtpChallengeStartRequestV1, c as buildLinkedDeviceTargetCredentialRegistrationV1, cn as parseRouterAbEd25519YaoRecoveryActivationExecuteRequestV1, ct as parseRouterAbEcdsaOperationStepUpPreparationV1, dn as parseRouterAbEd25519YaoRecoveryAdmissionRequestV1, f as parseLinkDevicePublicKeyB64u, ft as parseRouterAbEcdsaRegistrationActivationReceiptV1, g as parseLinkedDeviceApprovalResultV1, gn as parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1, h as parseLinkedDeviceApprovalDeliveryV1, i as buildLinkedDeviceApprovalV1, it as parseRouterAbEcdsaDerivationPublicCapabilityV1, j as parseLinkedDeviceSessionClaimV1, jn as buildLinkedDeviceEd25519ExportRootTransferBindingV1, jt as buildPasskeyWalletAuthAuthority, k as parseLinkedDeviceRevokeRequestV1, kt as sameRouterAbServerIdentityV1, l as buildQrLinkedDeviceSessionPayloadV5, ln as parseRouterAbEd25519YaoRecoveryActivationReceiptV1, m as parseLinkSessionTransportEventV1, mn as parseRouterAbEd25519YaoRegistrationActivationResultV1, o as buildLinkedDeviceSessionCancelUnclaimedRequestV1, p as parseLinkSessionProjectionV1, qt as ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, r as cloneAuthenticatorOptions, rt as parseRouterAbEcdsaDerivationNormalSigningStateV1, s as buildLinkedDeviceSessionClaimRequestV1, sn as parseRouterAbEd25519YaoRecoveryActivationAdmissionReceiptV1, t as MAX_DURABLE_CLIENT_PRESIGNATURE_LIFETIME_MS, u as parseActivateInstalledAuthorityResultV1, un as parseRouterAbEd25519YaoRecoveryActivationResultV1, ut as parseRouterAbEcdsaPostRegistrationSessionActivationRequestV1, v as parseLinkedDeviceEmailOtpChallengeResendRequestV1, vt as routerAbEcdsaDerivationActiveStateId, w as parseLinkedDeviceEmailOtpVerificationResultV1, wn as sameRouterAbMpcMaterialActivationRef, wt as sameRouterAbEcdsaDerivationNormalSigningStateV1, x as parseLinkedDeviceEmailOtpChallengeVerifyRequestV1, y as parseLinkedDeviceEmailOtpChallengeResultV1, z as serializeQrLinkedDeviceSessionPayloadV5 } from "./ecdsaPresignLifecycle-CnSnzoRJ.js";
-import { a as buildNearEd25519MpcOperationRef, d as parseMpcWalletSigningQuotaId, g as parseWalletSessionMintId, h as parseWalletSessionId, i as buildEvmEcdsaMpcOperationRef, l as parseDeviceId, m as parseWalletSessionAuthorizationId, n as EVM_ECDSA_MPC_OPERATION_KINDS, o as buildVaultOperationRef, r as NEAR_ED25519_MPC_OPERATION_KINDS, t as CAPABILITY_KINDS } from "./capabilityKinds-jwCEaqBU.js";
-import { $ as buildEmailOtpWalletAuthMethodBinding, A as signingLaneAuthBindingKey, B as exactSigningLaneIdentityMatches, E as SigningSessionIds, F as exactEd25519ExportMaterialIdentity, G as parseExactEcdsaSigningLaneIdentity, I as exactEd25519SigningLaneIdentity, J as parseOwnerLaneParticipantContinuityV1, K as parseExactEd25519ExportMaterialIdentity, M as buildEvmFamilyEcdsaSignerBinding, N as exactEcdsaSigningLaneIdentity, St as parseSdkEcdsaDerivationThresholdKeyId, T as SigningOperationIntent, U as nearEd25519SignerBindingFromBoundaryFields, V as exactSigningLaneWalletId, W as nearProtocolProjectionFromExactLane, X as parseLaneParticipantBindingDigestB64u, Y as parseLaneHolderParticipantRecordV1, Z as parseSigningWorkerParticipantRecordV1, _ as resolveThresholdSigningRootBindingFromRecord, a as buildEvmFamilyEcdsaWalletKey, bt as parseSdkEcdsaDerivationSigningRootId, c as buildResolvedEvmFamilyEcdsaKey, d as deriveEvmFamilyKeyFingerprint, et as buildPasskeyAuthScope, f as deriveEvmFamilyKeyFingerprintFromPublicFacts, i as buildEvmFamilyEcdsaSessionLanePolicy, it as parseRpId, j as signingLaneAuthMethod, m as evmFamilyEcdsaWalletKeyToIdentity, n as buildBaseEvmFamilyEcdsaKeyIdentity, nt as buildWalletIdentity, p as deriveEvmFamilySigningKeySlotId$1, r as buildEvmFamilyEcdsaRecoveredMaterialLanePolicy, rt as nearAccountBindingFromRaw, s as buildPasskeyEcdsaAuthBinding, t as assertMatchingVerifiedEcdsaPublicFacts, tt as buildPasskeyWalletAuthMethodBinding, v as resolveThresholdSigningRootBindingFromRuntimePolicyScope, vt as computeEcdsaDerivationRoleLocalRelayerKeyId, x as toRpId, xt as parseSdkEcdsaDerivationSigningRootVersion, y as toEvmFamilyEcdsaKeyHandle, z as exactSigningLaneIdentityKey } from "./evmFamilyEcdsaIdentity-_kuKSW35.js";
-import { a as buildEmailOtpEnvelopeFactor, c as buildPasskeyEnvelopeFactor, d as parsePasskeyCustodyEnvelopeRecord, h as isWalletCustodySeedBinding, i as buildActiveEnvelopeLifecycle, l as custodyEnvelopeBindingJsonV1, m as buildEd25519YaoClientRootBinding, o as buildMethodBoundEnvelopeOwnership, s as buildPasskeyCustodyEnvelopeRecord } from "./passkey-custody-BaHyYMhj.js";
-import { a as parseEcdsaRelayerKeyId, c as parseEcdsaRoleLocalMaterialHandle, d as parseEcdsaThresholdKeyId, f as parseSigningSessionSealKeyVersion, i as parseEcdsaKeyHandle, l as parseEcdsaRoleLocalPersistedMaterialRef, o as parseEcdsaRoleLocalBindingDigest, r as parseEcdsaClientVerifyingShareB64u, s as parseEcdsaRoleLocalDurableMaterialRef } from "./keyMaterialBrands-BbjCfzXv.js";
-import { a as SIGNING_SESSION_EXPIRY_DETECTION_SOURCES, d as createLinkDeviceFlowEvent, f as createNearProvisioningStateChangedEvent, g as createUnlockFlowEvent, h as createSigningSessionExpiredEvent, i as RegistrationEventPhase, l as createAccountSyncFlowEvent, m as createSigningFlowEvent, n as KeyExportEventPhase, o as SigningEventPhase, p as createRegistrationFlowEvent, r as LinkDeviceEventPhase, s as UnlockEventPhase, t as AccountSyncEventPhase, u as createKeyExportFlowEvent } from "./sdkSentEvents-5Pi-hjHB.js";
-import { D as computeWalletEcdsaKeyFactsInventoryChallengeDigestB64u, O as openWalletAuthorityLinkedSignerMaterialV1, _ as WalletSessionAuthorizationUpgradeRequiredError, c as configureIndexedDB, d as publishEd25519YaoPublicCapabilityReferenceAndLane, f as readEmailOtpProviderSubjectForWalletV1, h as importWalletCustodyEcdsaContinuity, i as getAccountKeyMaterial, k as parseWalletAuthorityLinkedSignerMaterialRecordV1, l as createIndexedDBNonceLaneCoordinationStore, m as copyWalletCustodyEcdsaContinuityToAuthMethod, n as loadWalletCustodyEd25519MaterialV1, o as storeAccountKeyMaterial, p as IndexedDbEcdsaCapabilityManifestStore, r as persistWalletCustodyEd25519MaterialV1, s as IndexedDBManager, t as deleteWalletCustodyEd25519MaterialV1, u as IndexedDbEd25519YaoPublicCapabilityReferenceStore, v as walletSessionAuthorizations } from "./ed25519SeedMaterial-Cghz8-XB.js";
-import { t as parseSignerSlot } from "./signerSlot-DbNAs-kc.js";
-import "./keccak-DY5wDsym.js";
-import { a as SIGNING_SESSION_SEAL_ALG, l as parseRouterAbEd25519NormalSigningState, n as PASSKEY_PRF_SECOND_SALT_V1, o as SIGNING_SESSION_SEAL_GROUP_ID, r as ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND, t as PASSKEY_PRF_FIRST_SALT_V1 } from "./signingSessionSeal-CdtgXHSL.js";
-import { t as demoEmailOtpCodeFromDelivery } from "./challengeDelivery-BjLKoou3.js";
-import { _ as parseEmailOtpEcdsaExportWorkerIssuedSessionHandle, a as createSigningPlannerDecisionTraceEvent, c as nearImplicitAccountFundingPort, d as mintEd25519WalletSession, f as nearOperationStepUpPreparationPort, g as buildNearMessageDisplayModel, h as buildNearDisplayModel, i as withThresholdEd25519CommitQueue, l as buildThresholdEd25519WebAuthnPrfSecretSource, m as getLastLoggedInSignerSlot, o as planSigningSession, p as deriveThresholdEd25519ClientVerifyingShareWasm, r as resolveThresholdEd25519CommitQueueKey, s as parseAndValidateRegistrationCredentialConfirmationPayload, t as signNear, u as localPrfFirstForEd25519WalletSessionMintAuthorization, v as parseEmailOtpWorkerIssuedSessionHandle } from "./signNear-DVD9-IO5.js";
-import { t as executeWorkerOperation } from "./executeWorkerOperation-Bn8GEuT_.js";
-import { A as thresholdEcdsaRoleLocalComputeSignatureShareFromPresignatureHandleWasm, B as SignerWorkerOperationError, C as prepareLinkedDeviceEcdsaSourceContributionWasm, D as storeLinkedDeviceEcdsaHolderMaterialWasm, E as storeEcdsaRoleLocalSigningMaterialWasm, F as thresholdEcdsaRoleLocalPresignSessionStepWasm, H as getSignerWorkerOperationCoreCode, I as thresholdEcdsaRoleLocalReservePresignatureWasm, L as verifyRouterAbEcdsaRegistrationClientProofsWasm, M as thresholdEcdsaRoleLocalListAvailablePresignaturesWasm, N as thresholdEcdsaRoleLocalPresignSessionAbortWasm, O as thresholdEcdsaRoleLocalAdmitPresignatureWasm, P as thresholdEcdsaRoleLocalPresignSessionInitFromMaterialHandleWasm, R as EcdsaDerivationClientCustomRequestType, S as prepareEcdsaClientBootstrapCommandWasm, T as signWalletRecoveryEcdsaMaterialPossessionProofWasm, U as getSignerWorkerOperationErrorCode, V as WorkerControlMessage, _ as finalizeEcdsaHolderOrdinaryExportWasm, a as resolveRouterAbEcdsaDerivationPresignaturePoolPolicy, b as openEcdsaRoleLocalSigningMaterialWasm, c as clearLinkedDeviceEcdsaHolderMaterialsWasm, d as createEcdsaHolderOrdinaryExportRequestWasm, f as createRouterAbEcdsaPostRegistrationCeremonyWasm, g as finalizeEcdsaClientBootstrapCommandWasm, h as destroyLinkedDeviceEcdsaHolderMaterialsWasm, i as clearRouterAbEcdsaDerivationClientPresignaturesForWallet, j as thresholdEcdsaRoleLocalDestroyPresignatureWasm, k as thresholdEcdsaRoleLocalCommitPresignatureWasm, l as closeRouterAbEcdsaPostRegistrationCeremonyWasm, m as destroyLinkedDeviceEcdsaHolderMaterialWasm, o as scheduleRouterAbEcdsaDerivationClientPresignaturePoolRefill, p as createRouterAbEcdsaRegistrationCeremonyWasm, r as clearAllRouterAbEcdsaDerivationClientPresignatures, s as waitForRouterAbEcdsaDerivationClientPresignaturePoolReady, u as closeRouterAbEcdsaRegistrationCeremonyWasm, v as finalizeRouterAbEcdsaExplicitExportWasm, w as reconcileCanonicalEcdsaActivationWasm, x as persistInitialCanonicalEcdsaActivationWasm, y as finalizeRouterAbEcdsaRegistrationActivationWasm, z as EcdsaPresignClientRequestType } from "./secp256k1-CWDid9WH.js";
-import { c as serializeRegistrationCredentialWithPRF, i as normalizeAuthenticationCredential, l as getPrfFirstB64uFromCredential, n as getPrfSecondSaltV1, o as redactedPasskeyRegistrationCredential, r as isSerializedRegistrationCredential, s as serializeAuthenticationCredentialWithPRF, t as getPrfFirstSaltV1, u as redactCredentialExtensionOutputs } from "./helpers-DpRjHMBx.js";
-import { C as validateTempoFeeToken, D as requestParentDomainWebAuthn, E as executeWebAuthnWithParentFallbacksSafari, S as requireTempoFeeTokenPreferenceSigningRequest, T as WindowParentDomainWebAuthnClient, b as parseTempoEvmAddress, d as walletIframeUnlockRequestFromLoginHooks, f as needsExplicitActivation, p as OverlayController, r as parseWalletIframeExactSessionIdentity, x as readTempoFeeTokenPreference, y as buildTempoSetUserTokenRequest } from "./exactSessionState-Bt0HforB.js";
-import { C as ecdsaRoleLocalReadyRecordMatchesInput, E as parseEcdsaRoleLocalReadyRecord, O as serializeEcdsaRoleLocalReadyRecord, S as buildEcdsaRoleLocalPublicFacts, T as ecdsaRoleLocalReadyRecordStorageKeyFacts, b as buildEcdsaRoleLocalEmailOtpAuthMethod, w as ecdsaRoleLocalReadyRecordStorageKey, x as buildEcdsaRoleLocalPasskeyAuthMethod, y as routerAbEcdsaDerivationPublicCapabilitiesEqual } from "./ecdsaCapabilityManifest-C8itxV9S.js";
-import { i as buildNearAccountRefs } from "./profileAccountProjection-C9rVhbeJ.js";
-import { a as isWorkerError, o as isWorkerProgress, s as isWorkerSuccess, t as DEFAULT_CONFIRMATION_CONFIG } from "./signer-worker-DYRteieu.js";
-import { A as parseProfileContinuityEcdsaWarmKey, D as startWalletAddAuthMethod, S as requestAddAuthMethodEmailOtpChallenge, T as revokeWalletAuthMethod, _ as finalizeWalletAddAuthMethod, a as buildRehydrateMaterialActivationHydrationPlan, g as fetchWalletEcdsaKeyFactsInventoryWithWebAuthn, h as fetchWalletEcdsaKeyFactsInventoryWithOperationCredential, i as buildBlockedMpcCapabilityHydrationPlan, k as activateRouterAbEcdsaPostRegistrationSession, l as computeWalletCustodyAdminChallengeDigest, n as nearEd25519YaoRuntimeRef, o as buildUseLiveRuntimeHydrationPlan, p as createWalletAddAuthMethodIntent, r as resolveNearEd25519YaoCapabilityHydrationV1, t as nearEd25519YaoMaterialActivationFromMetadata, y as fundImplicitNearAccountForTesting } from "./nearEd25519YaoMaterialActivation-Cz5UJQ_7.js";
-import { n as buildRelayerJsonPostRequestInit, r as normalizeRelayerBaseUrl, t as buildBearerAuthorizationHeader } from "./relayerHttp-LsVTZCxA.js";
-import { _ as isEmailOtpPendingSingleUseAuthContext, a as nearEd25519SessionMatchesMaterialActivation, b as laneCandidateStateFromRuntimePolicy, d as buildEmailOtpAuthContextForWalletAuthMethod, f as emailOtpAuthContextConsumedAtMs, g as emailOtpAuthContextRetention, h as emailOtpAuthContextProviderUserId, i as classifyNearEd25519WalletSessionAuthorization, m as emailOtpAuthContextProvider, n as buildAuthorizationRequiredNearEd25519YaoSigningPreparation, p as emailOtpAuthContextEmailHashHex, r as buildAuthorizedNearEd25519YaoSigningPreparation, t as buildActiveNearEd25519WalletSessionAuthorization, u as buildEmailOtpAuthContextForCanonicalWallet, v as isEmailOtpSessionAuthContext, x as selectedEcdsaLane } from "./nearEd25519YaoSigningPreparation-DX6xG-IW.js";
-import { a as throwEmailOtpSigningSessionAuthStateError, i as emailOtpEcdsaBootstrapRouteAuthFromRoutePlan, n as buildEmailOtpSigningSessionRoutePlan, o as buildEmailOtpRoutePlan, r as buildFreshEmailOtpRoutePlan, t as assertEmailOtpSigningSessionAuthLane } from "./routePlan-nLpPFHB-.js";
-import "./operationFingerprint-CsYO6b0a.js";
-import { n as generateSessionId, t as cacheCredentialBoundarySetupExportPrfFirst } from "./prfCache-CgAr-VEU.js";
-import { l as emitSigningSessionFlowFailure, u as emitSigningSessionFlowTrace } from "./trace-08ayoiNp.js";
-import { t as webAuthnPromptCoordinator } from "./webauthnPromptCoordinator-CLeba8ru.js";
-import { a as toActionArgsWasm, t as ActionType } from "./actions-DsBQcjBn.js";
-import { t as MinimalNearClient } from "./NearClient-BQgcqAzG.js";
-import { A as UserConfirmMessageType, C as getSignIntentDigestSubject, E as getTxCount, M as normalizeConfirmationConfig, S as getNearAccountId, T as getSigningAuthMode, _ as sendConfirmProgress, a as formatNearAccountFundingProgressNotice, b as assertSigningRequestContext, c as collectAuthenticationCredentialForChallengeB64u, d as collectAuthenticationCredentialForWalletChallengeB64u, f as ERROR_MESSAGES, g as sanitizeForPostMessage, h as parseTransactionSummary, i as formatNearAccountFundingNotice, j as UserConfirmationType, m as isUserCancelledUserConfirm, n as createConfirmTxFlowAdapters, o as __isWalletIframeHostMode, p as createUserConfirmScopedWorker, r as mountConfirmUI, s as __setWalletIframeHostMode, t as createConfirmSession, v as sendConfirmResponse, w as getSignTransactionPayload, x as getIntentDigest, y as assertNoForbiddenMainThreadSigningSecrets } from "./adapters-m94YFj70.js";
-import { i as orderActionForDigest, n as computeUiIntentDigestFromNep413, r as computeUiIntentDigestFromTxs } from "./intentDigest-A1MbbJPu.js";
-import { r as showWalletRecoveryCodesUi, t as pendingWalletRecoveryCodeBackupRepository } from "./pendingWalletRecoveryCodeBackup-DyvRysWg.js";
-import { t as createEvmClient } from "./EvmClient-CHw6txjt.js";
-import { n as resolveAppearanceTheme, o as resolveThemePalette } from "./configHelpers-DB73zYvO.js";
-import { n as getDefaultCspNonce, t as createCspStylesheetManager } from "./csp-stylesheet-DLj_a6t_.js";
-import { r as buildConfigsFromEnv } from "./defaultConfigs-CyNOW4Sy.js";
-import { t as createNonceCoordinator } from "./NonceCoordinator-C7mqpJiU.js";
-import { i as resumePendingWalletRecoveries } from "./walletRecoveryCommit-G6w6N5RV.js";
-import { i as loadWebAuthnP256EngineCtor, n as loadSignEvmFamilyWithUiConfirmForTempo, r as loadSignEvmWithUiConfirm, t as loadSecp256k1EngineCtor } from "./signerLoader-D_w-SfR9.js";
-import { A as authorizeEvmFamilyEcdsaSigningCapability, B as listLinkedEcdsaHolderRuntimesV1, C as buildExactPasskeyOwnerLaneScope, D as buildPersistedEcdsaRoleLocalMaterial, E as resolveExactWalletAuthAuthority$1, F as signingAuthorizationFromPreprocessing, H as resolveLinkedEcdsaHolderRuntimeV1, I as ensureSealedRefreshStartupParityForThresholdEcdsaBootstrap, L as isRetryableSealedRefreshCapabilityFetchError, M as buildEcdsaPreprocessingCapability, N as buildExactEcdsaDirectCapabilityRuntime, O as ecdsaRoleLocalPersistedMaterialSource, P as buildExactEvmFamilyWalletSessionAuthorization, R as clearLinkedEcdsaHolderRuntimesV1, S as buildExactLinkedEmailOtpOwnerLaneScope, T as resolveExactOwnerLaneScope, V as removeLinkedEcdsaHolderRuntimeV1, _ as resolveEmailOtpEcdsaSigningSessionAuth, a as reportTempoFinalized, b as withThresholdEcdsaSigningQueue, c as resolveActiveWalletAuthorityEcdsaRuntimeV1, d as createActiveEcdsaCapabilityRuntimeForChainResolver, f as createActiveEcdsaCapabilityRuntimeResolver, g as requestEmailOtpSigningSessionChallenge$1, h as refreshEmailOtpSigningSession$1, i as reportTempoDroppedOrReplaced, j as buildCanonicalEvmFamilyEcdsaSigningCapability, k as resolveEcdsaRoleLocalMaterial, l as issueEcdsaOperationStepUpAuthorization, m as resolveExactEcdsaSealedRuntime, n as reportTempoBroadcastAccepted, o as signEvmFamily, p as resolveExactEcdsaCapabilityRuntime, r as reportTempoBroadcastRejected, t as reconcileTempoNonceLane, u as prepareEcdsaOperationStepUp, v as clearThresholdEcdsaSigningQueue, w as isOwnerRelinkRequiredError, x as buildExactEcdsaPasskeyOwnerLaneScope, y as resolveThresholdEcdsaSigningQueueKey, z as installLinkedEcdsaHolderRuntimeV1 } from "./signEvmFamily-pbMepepQ.js";
-import { n as SigningAuthPlanKind } from "./promptText-BEgOkGxB.js";
-import { C as isSigningOperationReviewApprovedStateKind, d as fullWalletLoginRequired, f as invalidWalletSigningMaterial, m as walletSigningMaterialBlockError, p as isWalletSigningStateFailure, v as SigningOperationInteractionEventKind } from "./operationFingerprint-DEPg9A3h.js";
-import { _ as WALLET_SESSION_FAILURE_CODES, g as walletSessionFailureFromError, h as walletSessionFailureFromCode, p as WalletSessionFailureError } from "./routerAbNormalSigning-DktZKnf1.js";
-import { _ as parseWalletSessionAuthorizationBoundary, d as availableEd25519SigningLaneAuthMethod, f as ecdsaAvailableLaneCandidatesForTarget, g as readAvailableSigningLanes, h as isConcreteAvailableSigningLane, l as activeWalletAuthorityAvailableLaneFromProjection, m as ecdsaAvailableLaneIdentityKey, p as ecdsaAvailableLaneForTarget, u as availableEcdsaSigningLaneAuthMethod, v as requireAuthoritativeExpiredWalletSessionAuthorizationBoundary } from "./transactionState-Bpm4GamO.js";
-import { t as bytesToHex } from "./bytes-CwytAKz8.js";
-import { a as PENDING_CHALLENGE_B64U, c as consumeIntentDigestPreparation, l as createEvmNonceBackend, n as EvmFamilyEcdsaMaterialSupersededError, s as clearIntentDigestPreparation } from "./signatureUses-BY1IY7uz.js";
-import { n as removeExportViewerHostIfPresent, t as isExportViewerSessionOpen } from "./export-viewer-host-CbqG8ZQV.js";
-import { i as observeTransactionLifecycleReport, n as failTransactionActivity, r as observeTransactionActivity, t as beginTransactionActivity } from "./transaction-activity-DKgIGpKG.js";
-import "./jsxRuntime.module-FAP0NE9p.js";
-import { t as handleRegistrationFlow } from "./registration-DtDICj-o.js";
-import { i as rotateWalletRecoverySet, n as readWalletRecoveryCodeStatus, r as requestWalletCustodyEmailOtpChallenge, t as acknowledgeWalletRecoveryBackup } from "./walletRecoveryRotate-BYOYJAyb.js";
+import { $ as unlockEmailOtpAuthorityWallet, $t as listThresholdEcdsaProvisionTargets, A as resolveGoogleEmailOtpProvider, At as readExactEd25519SealedSession, B as subscribeToNearProvisioning, Bt as resolveExactWalletSessionOperationCredential, C as persistPasskeyEd25519YaoSignerMaterialV1, Ct as resolveExactEd25519SealedSessionRuntimeForLane, D as collectEmailOtpRegistrationAuthority, Dt as deleteDurableSealedSessionRecord, E as buildRestorableMpcMaterialRefInternal, Et as acquireSigningSessionRestoreLease, F as exactPasskeyWalletAuthAuthorityRefForCredential, Ft as writeExactSealedSession, G as passkeyPrfFirstB64uFromCredential, Gt as openWalletCustodyEd25519ActiveClientV1, H as resumePendingEcdsaRegistrationFromStoredCommit, Ht as buildPasskeyEd25519RestoreMetadata, I as exactPasskeyWalletAuthMethodForCredential, It as buildCurrentSealedSessionRecord, J as verifyPasskeyWalletUnlock, Jt as ROUTER_AB_ED25519_YAO_ACTIVE_CLIENT_KIND_V1, K as requirePasskeyPrfFirstB64u, Kt as walletCustodyActivationFactsFromActiveClientMetadataV1, L as resolveManagedRuntimeScopeBootstrap, Lt as createDeleteDurableSealedSessionCommand, M as readPasskeyCustodySessionEnvelope, Mt as releaseSigningSessionRestoreLease, N as rememberPasskeyCustodySessionEnvelope, Nt as updateExactEd25519SealedSessionPolicy, O as requestEmailOtpChallenge, Ot as listEcdsaSealedSessionsForWallet, P as buildRecoveredCustodyEnvelopeRecord, Pt as updateExactSealedSessionPolicy, Q as passkeyEd25519YaoLaneReferenceFromRecovery, Qt as listConfiguredThresholdEcdsaPublicationTargets, R as awaitNearProvisioningInFlight, Rt as buildRouterAbEd25519SigningWalletSession, S as hydratePasskeyEd25519YaoLocalMaterialV1, St as parseExactEd25519SealedSessionRuntime, T as readPasskeyEd25519YaoLocalMaterialLocatorV1, Tt as resolveExactEd25519SealedSessionRuntimeForWalletSubject, U as resumePendingNearRegistrations, Ut as persistPasskeyEd25519YaoSessionForRefresh, V as scheduleEcdsaSessionPresignaturePrefill, Vt as WALLET_IFRAME_TRANSPORT_TIMING_LABEL, W as passkeyCredentialIdB64uFromAuthentication, Wt as openOrRejoinWalletCustodyEd25519V1, X as buildRecoveredWalletSessionState, Xt as RouterAbEd25519YaoHttpActivationTransportV1, Y as assertEd25519YaoWarmRecoveryDescriptorStableMaterialContinuity, Yt as RouterAbEd25519YaoClientV1, Z as parsePasskeyEd25519YaoSyncResponseV1, Zt as parseEd25519YaoRecoveryCapabilityV1, _ as setUnlockedCustodyEnvelopeUpgradeSinkV1, _t as nearEd25519YaoOperationMaterialFacts, a as registerWallet, at as joinEvmFamilyCustodyV1, b as walletCustodyCeremonyStepRunner, bt as ed25519AuthorizationIdentityMatchesRuntime, c as exactWalletSessionAuthorityIdentity, ct as recoverNearEd25519CustodyV1, d as validateExactWalletSessionAuthorization, dt as WalletSessionStatusReadScope, en as isRegistrationBenchmarkDiagnosticsEnabled, et as unlockEmailOtpEd25519YaoCapability, f as destroyUnlockedWalletEd25519ExportRootCapabilitiesV1, ft as createRelayerExactWalletSessionStatusPort, g as readUnlockedWalletEd25519ExportRootCapabilityV1, gt as buildPasskeyRouterAbEd25519WalletSessionState, h as readUnlockedEd25519ExportRootLinkingCapabilityV1, ht as buildEmailOtpRouterAbEd25519WalletSessionState, it as establishNearEd25519CustodyV1, j as configurePasskeyCustodySessionCachePersistence, jt as readExactSealedSession, k as requestEmailOtpEnrollmentChallenge, kt as listExactSealedSessionsForWallet, l as persistExactWalletSessionAuthorizationFromEcdsaBootstrap, lt as rejoinEvmFamilyCustodyV1, m as establishUnlockedWalletEd25519ExportRootCapabilityV1, mt as joinCustodyWireFromEnvelopeRecord, nt as unlockEmailOtpWalletCapabilities, ot as joinNearEd25519CustodyV1, p as dropUnlockedWalletEd25519ExportRootCapabilityReferenceV1, pt as sameRuntimePolicyScope, q as verifyLinkedDevicePasskeyWalletSession, qt as walletCustodyCacheEnvelopeFromRecordV1, rt as establishEvmFamilyCustodyV1, st as recoverEvmFamilyCustodyV1, t as addWalletSigner, tt as unlockEmailOtpWallet, u as validateExactWalletSessionAuthorityIdentity, ut as rejoinNearEd25519CustodyV1, v as walletCustodyCeremonyTransportFromWorkerContextV1, vt as rebindRouterAbEd25519WalletSessionStateFromExactRuntime, w as preparePasskeyEd25519YaoLocalMaterialRehydrationV1, wt as resolveExactEd25519SealedSessionRuntimeForWallet, x as ed25519YaoLocalMaterialIdentityFromWalletSession, xt as ed25519SealedRuntimeAuthorityRef, y as requestWalletCustodyCeremonyOperation, yt as resolveActiveAuthorizedRouterAbEd25519WalletSessionState, z as readNearProvisioningState, zt as requiredSigningSubjectForExactSigningLane } from "./registration-Ct_7LdGf.js";
+import { C as parseEnvelopeNonceB64u, D as parseUnixMs, E as parseSecp256k1CompressedPublicKeyB64u, I as rejectUnknownFields, O as requireParsed$1, S as parseEnvelopeCiphertextB64u, T as parseKeyCreationSignerSlot, _ as signingRootScopeFromRuntimePolicyScope, a as clampThresholdSessionPolicy, b as parseDigestField, c as resolveWalletUnlockSessionUsesFromRequestedUses, d as normalizeThresholdEd25519ParticipantIds, f as parseThresholdEd25519ParticipantsV1, g as sameRuntimePolicyScope$1, h as normalizeRuntimePolicyScope, i as buildEd25519SessionPolicy, j as hasDelegatedWalletPermissionV1, k as buildFullOwnerDelegatedWalletAuthorityV1, l as THRESHOLD_ED25519_2P_PARTICIPANT_IDS, o as normalizeThresholdRuntimePolicyScope, p as coerceThemeMode$1, r as DEFAULT_UNLOCK_REMAINING_USES, t as DEFAULT_THRESHOLD_SESSION_POLICY, u as buildThresholdEd25519Participants2pV1, v as deriveEvmFamilySigningKeySlotId, w as parseEnvelopeRevision, x as parseEd25519PublicKeyB64u, y as requireEvmFamilySigningKeySlotId } from "./sessionPolicy-DO-MkL65.js";
+import { $ as parseEmailOtpWalletAuthAuthority, B as sameRouterAbEcdsaDerivationNormalSigningStateV1, Dt as sameRouterAbMpcMaterialActivationRef, E as parseRouterAbEcdsaRegistrationActivationReceiptV1, Et as routerAbMpcMaterialActivationRefToWire, G as sameRouterAbServerIdentityV1, H as sameRouterAbEcdsaDerivationPublicIdentityV1, K as buildEmailOtpWalletAuthAuthority, M as routerAbEcdsaDerivationActiveStateId, Q as isPasskeyWalletAuthAuthority, S as parseRouterAbEcdsaOperationStepUpPreparationV1, Tt as routerAbMpcMaterialActivationRefFromWire, U as sameRouterAbEcdsaRegistrationActivationReceiptV1, V as sameRouterAbEcdsaDerivationPublicCapabilityV1, Z as isEmailOtpWalletAuthAuthority, _ as parseRouterAbEcdsaDerivationNormalSigningStateV1, _t as computeEcdsaDerivationRoleLocalRelayerKeyId, bt as parseSdkEcdsaDerivationSigningRootVersion, i as ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, it as walletAuthAuthorityRef, jt as parseWalletSessionOperationCredentialV1, kt as activeWalletSessionV1RecordsEqual, nt as parseWalletAuthAuthorityRef, p as parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1, q as buildPasskeyWalletAuthAuthority, r as cloneAuthenticatorOptions, rt as walletAuthAuthoritiesMatch, t as MAX_DURABLE_CLIENT_PRESIGNATURE_LIFETIME_MS, v as parseRouterAbEcdsaDerivationPublicCapabilityV1, w as parseRouterAbEcdsaPostRegistrationSessionActivationRequestV1, xt as parseSdkEcdsaDerivationThresholdKeyId, y as parseRouterAbEcdsaExplicitExportForwardedResponseV1, yt as parseSdkEcdsaDerivationSigningRootId } from "./ecdsaPresignLifecycle-Bfx2AQKb.js";
+import { a as buildNearEd25519MpcOperationRef, d as parseMpcWalletSigningQuotaId, g as parseWalletSessionMintId, h as parseWalletSessionId, i as buildEvmEcdsaMpcOperationRef, l as parseDeviceId, m as parseWalletSessionAuthorizationId, n as EVM_ECDSA_MPC_OPERATION_KINDS, o as buildVaultOperationRef, r as NEAR_ED25519_MPC_OPERATION_KINDS, t as CAPABILITY_KINDS } from "./capabilityKinds-hvYqa6S_.js";
+import { d as resolvePrimaryNearRpcUrl, f as alphabetizeStringify, h as sha256HexUtf8, m as sha256BytesUtf8, n as cloneChainConfig, t as chainFamilyFromNetwork, u as resolvePrimaryExplorerUrl } from "./chains-BMh3btVo.js";
+import { a as sha256DigestB64u, o as sha256Utf8DigestB64u, r as parseDigestB64u } from "./canonicalPrimitives-BTHWz80v.js";
+import { a as thresholdEcdsaChainTargetFromRequest, c as toWalletId, i as thresholdEcdsaChainTargetFromConfig, n as nearAccountRefFromAccountId, o as thresholdEcdsaChainTargetKey, s as thresholdEcdsaChainTargetsEqual, t as configuredThresholdEcdsaChainTargets, u as walletSessionRefFromSession } from "./ecdsaChainTarget-Bl-JWyuw.js";
+import { a as WALLET_AUTH_METHODS, d as WALLET_EMAIL_OTP_REGISTRATION_OPERATION, f as WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION, i as SIGNER_SOURCES, l as WALLET_EMAIL_OTP_DEVICE_LINK_OPERATION, n as SIGNER_AUTH_METHODS, p as WALLET_EMAIL_OTP_UNLOCK_OPERATION, r as SIGNER_KINDS, s as EMAIL_OTP_CHANNEL, u as WALLET_EMAIL_OTP_EXPORT_OPERATION } from "./signerDomain-IEAVrOrc.js";
+import { a as toIndexedDbChainTargetKey, t as normalizeIndexedDbAccountAddress } from "./normalization-CBt413-z.js";
+import { c as zeroizeIssuedWalletRecoveryCodes, d as deriveWalletRecoveryKeyLifecycleId, f as parseRecoveryCodeReservationId, i as walletRecoverySetRotationWireFromWorkerResultV1, o as deriveRecoveryCodeLocatorV1FromBytes, r as walletRecoveryEcdsaPossessionChallengeDigestB64uV1, s as issueWalletRecoveryCodes, t as parseWalletRecoveryEcdsaPossessionChallengeV1 } from "./wallet-recovery-BX61-79p.js";
+import { A as storeWalletMixedRegistrationData$1, C as storeWalletEcdsaSignerRecords$1, D as storeWalletEmailOtpEcdsaSignerRecords$1, E as storeWalletEmailOtpEcdsaRegistrationData$1, F as getLastSelectedNearAccount, I as getNearAccountProjection, M as WALLET_CUSTODY_ED25519_MATERIAL_KEY_KIND, O as storeWalletEmailOtpEd25519RegistrationData$1, S as storeWalletEcdsaRecoverySignerRecords$1, T as storeWalletEd25519RegistrationData$1, _ as rollbackWalletEd25519SignerRegistration$1, a as getLastUser$1, b as storeAuthenticator$1, c as hasPasskeyCredential$1, g as rollbackUserRegistration$1, i as getAllUsers$1, k as storeWalletEmailOtpMixedRegistrationData$1, l as nearAuthenticatorsByAccount$1, n as finalizeWalletEcdsaRegistration$1, o as getUserBySignerSlot$1, r as finalizeWalletEd25519SignerRegistration$1, s as getWalletNearProvisioningState$1, t as activateAuthenticatedWalletState$1, v as setLastUser$1, w as storeWalletEd25519RecoveryRegistrationData$1, x as storeUserData$1, y as setWalletNearProvisioningState$1 } from "./accountLifecycle-zthG08aC.js";
+import { t as toAccountId } from "./accountIds-DhIPGOSN.js";
+import { $ as parseLinkedDeviceListRequestV1, At as serializeQrLinkedDeviceSessionPayloadV5, Ct as parseLinkedDeviceOwnerAuthorizationRequestV1, D as parseSigningWorkerParticipantRecordV1, Dt as parseLinkedDeviceTargetPreparationRequestV1, E as parseLaneParticipantBindingDigestB64u, Et as parseLinkedDeviceTargetCredentialRegistrationResultV1, F as buildWalletIdentity, Ft as parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationV1, G as computeWalletSessionInstallationReceiptDigestB64u, H as LINKED_DEVICE_REQUEST_PROOF_MAX_TTL_MS_V1, Ht as ROUTER_AB_ED25519_YAO_RECOVERY_ADMISSION_PATH_V1, I as nearAccountBindingFromRaw, J as parseLocalAuthorityActivationFinalAckV1, K as computeWalletSessionOperationCredentialDigestB64u, Kt as ROUTER_AB_ED25519_YAO_REGISTRATION_EXECUTE_PATH_V1, N as buildPasskeyAuthScope, Nt as parseLinkedDeviceEd25519SourcePreservingReservationV1, Ot as parseLinkedDeviceTargetPreparationV1, P as buildPasskeyWalletAuthMethodBinding, Pt as parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationTupleV1, Q as parseLinkedDeviceWalletSessionCredentialDeliveryV1, R as parseRpId, Rt as ROUTER_AB_ED25519_YAO_EMAIL_OTP_RECOVERY_BOOTSTRAP_KIND_V1, St as parseLinkedDeviceEmailOtpVerificationResultV1, T as parseLaneHolderParticipantRecordV1, Tt as parseLinkedDeviceSessionClaimV1, U as computeLinkedDevicePublicKeyDigestV1, V as LINKED_DEVICE_REQUEST_PROOF_HEADER_V1, Vt as ROUTER_AB_ED25519_YAO_RECOVERY_ACTIVATE_PATH_V1, W as computeLinkedDeviceTargetPreparationDigestV1, Wt as ROUTER_AB_ED25519_YAO_RECOVERY_EXECUTE_PATH_V1, X as assertLinkedDeviceWalletSessionCredentialDeliveryIntegrityV1, Y as parseLocalAuthorityInstallationReceiptV1, Z as parseLinkedDeviceWalletSessionCredentialDeliveryBindingV1, _ as resolveThresholdSigningRootBindingFromRecord, _n as parseLinkedDeviceEd25519ExportRootPackageV1, _t as parseLinkedDeviceEmailOtpChallengeResultV1, a as buildEvmFamilyEcdsaWalletKey, an as parseRouterAbEd25519YaoRecoveryAdmissionRequestV1, at as buildLinkedDeviceSessionCancelClaimedRequestV1, bn as serializeLinkedDeviceEd25519ExportRootTransferBindingV1, bt as parseLinkedDeviceEmailOtpFactorReleaseEnvelopeV1, c as buildResolvedEvmFamilyEcdsaKey, cn as parseRouterAbEd25519YaoRegistrationActivationResultV1, ct as buildLinkedDeviceTargetCredentialRegistrationV1, d as deriveEvmFamilyKeyFingerprint, dt as parseLinkSessionProjectionV1, et as parseLinkedDeviceListResultV1, f as deriveEvmFamilyKeyFingerprintFromPublicFacts, ft as parseLinkSessionTransportEventV1, gn as buildLinkedDeviceEd25519ExportRootTransferBindingV1, gt as parseLinkedDeviceEmailOtpChallengeResendRequestV1, hn as LINKED_DEVICE_ED25519_EXPORT_ROOT_TRANSFER_ALG_V1, ht as parseLinkedDeviceEmailOtpBaseFactorResolutionResultV1, i as buildEvmFamilyEcdsaSessionLanePolicy, in as parseRouterAbEd25519YaoRecoveryActivationResultV1, it as buildLinkedDeviceApprovalV1, jt as parseCommittedAuthorityPackagesV1, k as buildEmailOtpWalletAuthMethodBinding, kt as parseQrLinkedDeviceSessionPayloadV5, lt as buildQrLinkedDeviceSessionPayloadV5, m as evmFamilyEcdsaWalletKeyToIdentity, mt as parseLinkedDeviceApprovalResultV1, n as buildBaseEvmFamilyEcdsaKeyIdentity, nn as parseRouterAbEd25519YaoRecoveryActivationExecuteRequestV1, nt as parseLinkedDeviceRevokeResultV1, ot as buildLinkedDeviceSessionCancelUnclaimedRequestV1, p as deriveEvmFamilySigningKeySlotId$1, pn as deriveRouterAbEd25519YaoApplicationBindingDigestV1, pt as parseLinkedDeviceApprovalDeliveryV1, q as parseActivateInstalledAuthorityResultV1, qt as ROUTER_AB_ED25519_YAO_WARM_RECOVERY_BOOTSTRAP_PATH_V1, r as buildEvmFamilyEcdsaRecoveredMaterialLanePolicy, rn as parseRouterAbEd25519YaoRecoveryActivationReceiptV1, s as buildPasskeyEcdsaAuthBinding, st as buildLinkedDeviceSessionClaimRequestV1, t as assertMatchingVerifiedEcdsaPublicFacts, tn as parseRouterAbEd25519YaoRecoveryActivationAdmissionReceiptV1, tt as parseLinkedDeviceRevokeRequestV1, u as deriveEvmFamilyEcdsaKeyHandle, un as parseRouterAbEd25519YaoWarmRecoveryBootstrapRequestV1, ut as parseLinkDevicePublicKeyB64u, v as resolveThresholdSigningRootBindingFromRuntimePolicyScope, vn as parseLinkedDeviceEd25519ExportRootRecipientPublicKeyB64u, vt as parseLinkedDeviceEmailOtpChallengeStartRequestV1, w as parseOwnerLaneParticipantContinuityV1, wt as parseLinkedDeviceOwnerAuthorizationSourceV1, x as toRpId, xn as assertNeverLinkSessionStateV1, xt as parseLinkedDeviceEmailOtpVerificationGrantV1, y as toEvmFamilyEcdsaKeyHandle, yn as parseLinkedDeviceEd25519ExportRootRecipientV1, yt as parseLinkedDeviceEmailOtpChallengeVerifyRequestV1 } from "./evmFamilyEcdsaIdentity-CqGafQsI.js";
+import { C as computeWalletAuthMethodRevokeOperationFingerprintV1, E as parseExactAdministeredSignerManifestV1, S as buildWalletAuthMethodRecordV2, T as sameWalletAuthMethodRecordV2, d as parseWalletSignerActivationSetV1, f as replaceActiveWalletAuthorityEd25519MaterialActivationV1, n as computeWalletSignerActivationSetDigestB64u, o as isActiveRecoveredWalletAuthorityV1, r as encodeWalletSignerActivationSetV1, t as computeWalletAuthorityDigestB64u, w as parseWalletAuthMethodRecordV2 } from "./walletAuthority-DD9T25F6.js";
+import "./encoders-D8d07vpx.js";
+import { a as parseNearEd25519SigningKeyId, i as nearEd25519SigningKeyIdFromString, o as walletIdFromString, r as createServerAllocatedWalletId } from "./registrationIds-DLSdEKSv.js";
+import { a as buildEmailOtpEnvelopeFactor, c as buildPasskeyEnvelopeFactor, d as parsePasskeyCustodyEnvelopeRecord, h as isWalletCustodySeedBinding, i as buildActiveEnvelopeLifecycle, l as custodyEnvelopeBindingJsonV1, m as buildEd25519YaoClientRootBinding, o as buildMethodBoundEnvelopeOwnership, s as buildPasskeyCustodyEnvelopeRecord } from "./passkey-custody-UUHbC0pk.js";
+import { a as parseEcdsaRoleLocalPersistedMaterialRef, d as parseEcdsaRelayerKeyId, f as parseSigningSessionSealKeyVersion, i as parseEcdsaRoleLocalMaterialHandle, l as parseEcdsaClientVerifyingShareB64u, n as parseEcdsaRoleLocalBindingDigest, r as parseEcdsaRoleLocalDurableMaterialRef, s as parseEcdsaThresholdKeyId, u as parseEcdsaKeyHandle } from "./keyMaterialBrands-CogGAAZn.js";
+import { a as SIGNING_SESSION_EXPIRY_DETECTION_SOURCES, d as createLinkDeviceFlowEvent, f as createNearProvisioningStateChangedEvent, g as createUnlockFlowEvent, h as createSigningSessionExpiredEvent, i as RegistrationEventPhase, l as createAccountSyncFlowEvent, m as createSigningFlowEvent, n as KeyExportEventPhase, o as SigningEventPhase, p as createRegistrationFlowEvent, r as LinkDeviceEventPhase, s as UnlockEventPhase, t as AccountSyncEventPhase, u as createKeyExportFlowEvent } from "./sdkSentEvents-MqDkbQg1.js";
+import { M as parseWalletAuthorityLinkedSignerMaterialRecordV1, a as loadWalletCustodyEd25519MaterialV1, b as walletSessionAuthorizations, d as configureIndexedDB, f as createIndexedDBNonceLaneCoordinationStore, g as IndexedDbEcdsaCapabilityManifestStore, h as readEmailOtpProviderSubjectForWalletV1, i as deleteWalletCustodyEd25519MaterialV1, j as openWalletAuthorityLinkedSignerMaterialV1, k as computeWalletEcdsaKeyFactsInventoryChallengeDigestB64u, l as storeAccountKeyMaterial, m as publishEd25519YaoPublicCapabilityReferenceAndLane, n as importWalletCustodyEcdsaContinuity, o as persistWalletCustodyEd25519MaterialV1, p as IndexedDbEd25519YaoPublicCapabilityReferenceStore, s as getAccountKeyMaterial, t as copyWalletCustodyEcdsaContinuityToAuthMethod, u as IndexedDBManager, y as WalletSessionAuthorizationUpgradeRequiredError } from "./walletCustodyEcdsaContinuity-CF4bv9OI.js";
+import { t as parseSignerSlot } from "./signerSlot-_ovonwVX.js";
+import "./keccak-DUL3d8SF.js";
+import { a as SIGNING_SESSION_SEAL_ALG, l as parseRouterAbEd25519NormalSigningState, n as PASSKEY_PRF_SECOND_SALT_V1, o as SIGNING_SESSION_SEAL_GROUP_ID, r as ROUTER_AB_ED25519_NORMAL_SIGNING_STATE_KIND, t as PASSKEY_PRF_FIRST_SALT_V1 } from "./signingSessionSeal-Cu-GHm6y.js";
+import { c as registrationNearEd25519BranchKey, d as sponsoredNamedNearAccountProvisioning, i as implicitNearAccountProvisioning, t as NEAR_ED25519_YAO_KEY_VERSION_V1 } from "./registrationSignerPlan-DhV8VAob.js";
+import { r as computeAddAuthMethodIntentDigestB64u } from "./registrationIntent-4zwk16zQ.js";
+import { c as signingLaneAuthMethod, n as SigningOperationIntent, r as SigningSessionIds, s as signingLaneAuthBindingKey } from "./types-Dx9fczU7.js";
+import { t as demoEmailOtpCodeFromDelivery } from "./challengeDelivery-DZtopOAG.js";
+import { _ as isWorkerError, a as planSigningSession, b as parseEmailOtpEcdsaExportWorkerIssuedSessionHandle, c as buildThresholdEd25519WebAuthnPrfSecretSource, d as nearOperationStepUpPreparationPort, f as deriveThresholdEd25519ClientVerifyingShareWasm, g as DEFAULT_CONFIRMATION_CONFIG, h as buildNearMessageDisplayModel, i as createSigningPlannerDecisionTraceEvent, l as localPrfFirstForEd25519WalletSessionMintAuthorization, m as buildNearDisplayModel, o as parseAndValidateRegistrationCredentialConfirmationPayload, p as getLastLoggedInSignerSlot, r as withThresholdEd25519CommitQueue, s as nearImplicitAccountFundingPort, t as signNear, u as mintEd25519WalletSession, v as isWorkerProgress, x as parseEmailOtpWorkerIssuedSessionHandle, y as isWorkerSuccess } from "./signNear-Bmb2fj_a.js";
+import { t as executeWorkerOperation } from "./executeWorkerOperation-Cl9whMK7.js";
+import { A as thresholdEcdsaRoleLocalAdmitPresignatureWasm, B as EcdsaPresignClientRequestType, C as prepareEcdsaClientBootstrapCommandWasm, D as storeEcdsaRoleLocalSigningMaterialWasm, E as signWalletRecoveryEcdsaMaterialPossessionProofWasm, F as thresholdEcdsaRoleLocalPresignSessionInitFromMaterialHandleWasm, H as WorkerControlMessage, I as thresholdEcdsaRoleLocalPresignSessionStepWasm, L as thresholdEcdsaRoleLocalReservePresignatureWasm, M as thresholdEcdsaRoleLocalComputeSignatureShareFromPresignatureHandleWasm, N as thresholdEcdsaRoleLocalDestroyPresignatureWasm, O as storeLinkedDeviceEcdsaHolderMaterialWasm, P as thresholdEcdsaRoleLocalPresignSessionAbortWasm, R as verifyRouterAbEcdsaRegistrationClientProofsWasm, S as persistInitialCanonicalEcdsaActivationWasm, T as reconcileCanonicalEcdsaActivationWasm, U as getSignerWorkerOperationCoreCode, V as SignerWorkerOperationError, W as getSignerWorkerOperationErrorCode, _ as finalizeEcdsaClientBootstrapCommandWasm, a as clearRouterAbEcdsaDerivationClientPresignaturesForWallet, b as finalizeRouterAbEcdsaRegistrationActivationWasm, c as waitForRouterAbEcdsaDerivationClientPresignaturePoolReady, d as closeRouterAbEcdsaRegistrationCeremonyWasm, f as createEcdsaHolderOrdinaryExportRequestWasm, g as destroyLinkedDeviceEcdsaHolderMaterialsWasm, h as destroyLinkedDeviceEcdsaHolderMaterialWasm, i as clearAllRouterAbEcdsaDerivationClientPresignatures, j as thresholdEcdsaRoleLocalCommitPresignatureWasm, k as thresholdEcdsaListAvailablePresignaturesWasm, l as clearLinkedDeviceEcdsaHolderMaterialsWasm, m as createRouterAbEcdsaRegistrationCeremonyWasm, o as resolveRouterAbEcdsaDerivationPresignaturePoolPolicy, p as createRouterAbEcdsaPostRegistrationCeremonyWasm, r as createLinkedHolderClientSigningMaterialSource, s as scheduleRouterAbEcdsaDerivationClientPresignaturePoolRefill, u as closeRouterAbEcdsaPostRegistrationCeremonyWasm, v as finalizeEcdsaHolderOrdinaryExportWasm, w as prepareLinkedDeviceEcdsaSourceContributionWasm, x as openEcdsaRoleLocalSigningMaterialWasm, y as finalizeRouterAbEcdsaExplicitExportWasm, z as EcdsaDerivationClientCustomRequestType } from "./secp256k1-D-I6Gh4D.js";
+import { c as serializeRegistrationCredentialWithPRF, i as normalizeAuthenticationCredential, l as getPrfFirstB64uFromCredential, n as getPrfSecondSaltV1, o as redactedPasskeyRegistrationCredential, r as isSerializedRegistrationCredential, s as serializeAuthenticationCredentialWithPRF, t as getPrfFirstSaltV1, u as redactCredentialExtensionOutputs } from "./helpers-ZrowMnev.js";
+import { C as validateTempoFeeToken, D as requestParentDomainWebAuthn, E as executeWebAuthnWithParentFallbacksSafari, S as requireTempoFeeTokenPreferenceSigningRequest, T as WindowParentDomainWebAuthnClient, b as parseTempoEvmAddress, d as walletIframeUnlockRequestFromLoginHooks, f as needsExplicitActivation, p as OverlayController, r as parseWalletIframeExactSessionIdentity, x as readTempoFeeTokenPreference, y as buildTempoSetUserTokenRequest } from "./exactSessionState-LWDUXydN.js";
+import { C as buildEcdsaRoleLocalPublicFacts, D as parseEcdsaRoleLocalReadyRecord, E as ecdsaRoleLocalReadyRecordStorageKeyFacts, S as buildEcdsaRoleLocalPasskeyAuthMethod, T as ecdsaRoleLocalReadyRecordStorageKey, k as serializeEcdsaRoleLocalReadyRecord, w as ecdsaRoleLocalReadyRecordMatchesInput, x as buildEcdsaRoleLocalEmailOtpAuthMethod, y as routerAbEcdsaDerivationPublicCapabilitiesEqual } from "./ecdsaCapabilityManifest-DuMs0VtU.js";
+import { i as buildNearAccountRefs } from "./profileAccountProjection-uZVJuBvS.js";
+import { A as activateRouterAbEcdsaPostRegistrationSession, C as requestAddAuthMethodEmailOtpChallenge, E as revokeWalletAuthMethod, O as startWalletAddAuthMethod, _ as fetchWalletEcdsaKeyFactsInventoryWithWebAuthn, a as buildRehydrateMaterialActivationHydrationPlan, b as fundImplicitNearAccountForTesting, g as fetchWalletEcdsaKeyFactsInventoryWithOperationCredential, i as buildBlockedMpcCapabilityHydrationPlan, j as parseProfileContinuityEcdsaWarmKey, l as hasExactKeys, m as createWalletAddAuthMethodIntent, n as nearEd25519YaoRuntimeRef, o as buildUseLiveRuntimeHydrationPlan, r as resolveNearEd25519YaoCapabilityHydrationV1, t as nearEd25519YaoMaterialActivationFromMetadata, u as computeWalletCustodyAdminChallengeDigest, v as finalizeWalletAddAuthMethod } from "./nearEd25519YaoMaterialActivation-B5GecIvq.js";
+import { n as buildRelayerJsonPostRequestInit, r as normalizeRelayerBaseUrl, t as buildBearerAuthorizationHeader } from "./relayerHttp-VC8Holz1.js";
+import { a as exactEd25519SigningLaneIdentity, c as exactSigningLaneIdentityKey, f as nearEd25519SignerBindingFromBoundaryFields, h as parseExactEd25519ExportMaterialIdentity, i as exactEd25519ExportMaterialIdentity, l as exactSigningLaneIdentityMatches, m as parseExactEcdsaSigningLaneIdentity, n as exactEcdsaSigningLaneIdentity, p as nearProtocolProjectionFromExactLane, t as buildEvmFamilyEcdsaSignerBinding, u as exactSigningLaneWalletId } from "./exactSigningLaneIdentity-m6uTXV_A.js";
+import { _ as isEmailOtpPendingSingleUseAuthContext, a as nearEd25519SessionMatchesMaterialActivation, b as laneCandidateStateFromRuntimePolicy, d as buildEmailOtpAuthContextForWalletAuthMethod, f as emailOtpAuthContextConsumedAtMs, g as emailOtpAuthContextRetention, h as emailOtpAuthContextProviderUserId, i as classifyNearEd25519WalletSessionAuthorization, m as emailOtpAuthContextProvider, n as buildAuthorizationRequiredNearEd25519YaoSigningPreparation, p as emailOtpAuthContextEmailHashHex, r as buildAuthorizedNearEd25519YaoSigningPreparation, t as buildActiveNearEd25519WalletSessionAuthorization, u as buildEmailOtpAuthContextForCanonicalWallet, v as isEmailOtpSessionAuthContext, x as selectedEcdsaLane } from "./nearEd25519YaoSigningPreparation-CdOT5RuC.js";
+import { a as throwEmailOtpSigningSessionAuthStateError, i as emailOtpEcdsaBootstrapRouteAuthFromRoutePlan, n as buildEmailOtpSigningSessionRoutePlan, o as buildEmailOtpRoutePlan, r as buildFreshEmailOtpRoutePlan, t as assertEmailOtpSigningSessionAuthLane } from "./routePlan-D59x5xzQ.js";
+import { n as generateSessionId, t as cacheCredentialBoundarySetupExportPrfFirst } from "./prfCache-wqQSjYLn.js";
+import { l as emitSigningSessionFlowFailure, u as emitSigningSessionFlowTrace } from "./trace-DKLQZvec.js";
+import { t as webAuthnPromptCoordinator } from "./webauthnPromptCoordinator-L96oVvLz.js";
+import { a as toActionArgsWasm, t as ActionType } from "./actions-CCvThiKe.js";
+import { A as UserConfirmMessageType, C as getSignIntentDigestSubject, E as getTxCount, M as normalizeConfirmationConfig, S as getNearAccountId, T as getSigningAuthMode, _ as sendConfirmProgress, a as formatNearAccountFundingProgressNotice, b as assertSigningRequestContext, c as collectAuthenticationCredentialForChallengeB64u, d as collectAuthenticationCredentialForWalletChallengeB64u, f as ERROR_MESSAGES, g as sanitizeForPostMessage, h as parseTransactionSummary, i as formatNearAccountFundingNotice, j as UserConfirmationType, m as isUserCancelledUserConfirm, n as createConfirmTxFlowAdapters, o as __isWalletIframeHostMode, p as createUserConfirmScopedWorker, r as mountConfirmUI, s as __setWalletIframeHostMode, t as createConfirmSession, v as sendConfirmResponse, w as getSignTransactionPayload, x as getIntentDigest, y as assertNoForbiddenMainThreadSigningSecrets } from "./adapters-Dli9XAZp.js";
+import { i as orderActionForDigest, n as computeUiIntentDigestFromNep413, r as computeUiIntentDigestFromTxs } from "./intentDigest-CvOSNlCH.js";
+import { r as showWalletRecoveryCodesUi, t as pendingWalletRecoveryCodeBackupRepository } from "./pendingWalletRecoveryCodeBackup-BWluQMbt.js";
+import { t as MinimalNearClient } from "./NearClient-DY4NfHeD.js";
+import { t as createEvmClient } from "./EvmClient-f3gUhS2L.js";
+import { n as resolveAppearanceTheme, o as resolveThemePalette } from "./configHelpers-D1EqxVxg.js";
+import { n as getDefaultCspNonce, t as createCspStylesheetManager } from "./csp-stylesheet-btENhsNp.js";
+import { r as buildConfigsFromEnv } from "./defaultConfigs-D_33pPT9.js";
+import { t as createNonceCoordinator } from "./NonceCoordinator-4XWPhYww.js";
+import { i as resumePendingWalletRecoveries } from "./walletRecoveryCommit-AI1AtIRP.js";
+import { i as loadWebAuthnP256EngineCtor, n as loadSignEvmFamilyWithUiConfirmForTempo, r as loadSignEvmWithUiConfirm, t as loadSecp256k1EngineCtor } from "./signerLoader-B7orgq5Z.js";
+import { A as buildCanonicalEvmFamilyEcdsaSigningCapability, B as removeLinkedEcdsaHolderRuntimeV1, C as isOwnerRelinkRequiredError, D as ecdsaRoleLocalPersistedMaterialSource, E as buildPersistedEcdsaRoleLocalMaterial, F as ensureSealedRefreshStartupParityForThresholdEcdsaBootstrap, I as isRetryableSealedRefreshCapabilityFetchError, L as clearLinkedEcdsaHolderRuntimesV1, M as buildExactEcdsaDirectCapabilityRuntime, N as buildExactEvmFamilyWalletSessionAuthorization, O as resolveEcdsaRoleLocalMaterial, P as signingAuthorizationFromPreprocessing, R as installLinkedEcdsaHolderRuntimeV1, S as buildExactPasskeyOwnerLaneScope, T as resolveExactWalletAuthAuthority$1, V as resolveLinkedEcdsaHolderRuntimeV1, _ as requestEmailOtpSigningSessionChallenge$1, a as reportTempoFinalized, b as buildExactEcdsaPasskeyOwnerLaneScope, c as resolveActiveWalletAuthorityEcdsaRuntimeV1, d as createActiveEcdsaCapabilityRuntimeForChainResolver, f as createActiveEcdsaCapabilityRuntimeResolver, g as refreshEmailOtpSigningSession$1, h as buildRouterAbEcdsaDerivationSigningMaterialRef, i as reportTempoDroppedOrReplaced, j as buildEcdsaPreprocessingCapability, k as authorizeEvmFamilyEcdsaSigningCapability, l as issueEcdsaOperationStepUpAuthorization, m as resolveExactEcdsaSealedRuntime, n as reportTempoBroadcastAccepted, o as signEvmFamily, p as resolveExactEcdsaCapabilityRuntime, r as reportTempoBroadcastRejected, t as reconcileTempoNonceLane, u as prepareEcdsaOperationStepUp, v as resolveEmailOtpEcdsaSigningSessionAuth, w as resolveExactOwnerLaneScope, x as buildExactLinkedEmailOtpOwnerLaneScope, y as withThresholdEcdsaSigningQueue, z as listLinkedEcdsaHolderRuntimesV1 } from "./signEvmFamily-C3C97Th-.js";
+import { n as SigningAuthPlanKind } from "./promptText-CuRa_ivd.js";
+import { C as isSigningOperationReviewApprovedStateKind, d as fullWalletLoginRequired, f as invalidWalletSigningMaterial, m as walletSigningMaterialBlockError, p as isWalletSigningStateFailure, v as SigningOperationInteractionEventKind } from "./operationFingerprint-C8Trar4R.js";
+import { f as WalletSessionFailureError, g as WALLET_SESSION_FAILURE_CODES, h as walletSessionFailureFromError, m as walletSessionFailureFromCode } from "./routerAbNormalSigning-CVFEOZ2m.js";
+import { S as resolveThresholdCommitQueueKey, _ as ed25519DurableMaterialLocator, b as requireAuthoritativeExpiredWalletSessionAuthorizationBoundary, d as availableEd25519SigningLaneAuthMethod, f as ecdsaAvailableLaneCandidatesForTarget, g as readAvailableSigningLanes, h as isConcreteAvailableSigningLane, l as activeWalletAuthorityAvailableLaneFromProjection, m as ecdsaAvailableLaneIdentityKey, p as ecdsaAvailableLaneForTarget, u as availableEcdsaSigningLaneAuthMethod, v as materialActivationKey, x as clearThresholdCommitQueue, y as parseWalletSessionAuthorizationBoundary } from "./transactionState-CJ4U8pcl.js";
+import { t as bytesToHex } from "./bytes-qKxKn4gg.js";
+import { c as createEvmNonceBackend, i as PENDING_CHALLENGE_B64U, o as clearIntentDigestPreparation, s as consumeIntentDigestPreparation, t as EvmFamilyEcdsaMaterialSupersededError } from "./signingFlow-SZ8t_lxv.js";
+import { n as removeExportViewerHostIfPresent, t as isExportViewerSessionOpen } from "./export-viewer-host-rWMSQQMP.js";
+import { i as observeTransactionLifecycleReport, n as failTransactionActivity, r as observeTransactionActivity, t as beginTransactionActivity } from "./transaction-activity-CSMCveBn.js";
+import "./jsxRuntime.module-CuH5ZEIA.js";
+import { t as handleRegistrationFlow } from "./registration-DHERU8R_.js";
+import { i as rotateWalletRecoverySet, n as readWalletRecoveryCodeStatus, r as requestWalletCustodyEmailOtpChallenge, t as acknowledgeWalletRecoveryBackup } from "./walletRecoveryRotate-BgLlW5ih.js";
 //#region src/core/walletRuntimePaths/workers.ts
 /**
 * Resolve the base origin for worker scripts.
@@ -160,7 +164,7 @@ function defaultWorkerPath$1(worker) {
 }
 //#endregion
 //#region src/core/platform/signerCoreCommandAdapters.ts
-function requireBase64UrlBytes$1(value, field, byteLength) {
+function requireBase64UrlBytes(value, field, byteLength) {
 	const normalized = String(value || "").trim();
 	if (!normalized) throw new Error(`[signer-core-command] ${field} is required`);
 	if (base64UrlDecode(normalized).length !== byteLength) throw new Error(`[signer-core-command] ${field} must decode to ${byteLength} bytes`);
@@ -182,15 +186,15 @@ function requireSignerCoreCommandString(value, field) {
 	return normalized;
 }
 function parseDerivationClientSharePublicKey33B64u(value) {
-	return requireBase64UrlBytes$1(value, "derivationClientSharePublicKey33B64u", 33);
+	return requireBase64UrlBytes(value, "derivationClientSharePublicKey33B64u", 33);
 }
-function parseRelayerEcdsaDerivationPublicKey33B64u$1(value) {
-	return requireBase64UrlBytes$1(value, "relayerPublicKey33B64u", 33);
+function parseRelayerEcdsaDerivationPublicKey33B64u(value) {
+	return requireBase64UrlBytes(value, "relayerPublicKey33B64u", 33);
 }
-function parsePublicKey33B64u$1(value, field) {
-	return requireBase64UrlBytes$1(value, field, 33);
+function parsePublicKey33B64u(value, field) {
+	return requireBase64UrlBytes(value, field, 33);
 }
-function parseEthereumAddress$1(value) {
+function parseEthereumAddress(value) {
 	const normalized = String(value || "").trim();
 	if (!/^0x[0-9a-fA-F]{40}$/.test(normalized)) throw new Error("[signer-core-command] ethereumAddress must be 0x-prefixed 20-byte hex");
 	return normalized;
@@ -229,7 +233,7 @@ function toGeneratedPrepareEcdsaClientBootstrapCommand(input) {
 		},
 		secretSource: {
 			kind: "threshold_prf_x_client_base",
-			xClientBaseB64u: requireBase64UrlBytes$1(input.secretSource.xClientBaseB64u, "secretSource.xClientBaseB64u", 32)
+			xClientBaseB64u: requireBase64UrlBytes(input.secretSource.xClientBaseB64u, "secretSource.xClientBaseB64u", 32)
 		}
 	};
 }
@@ -239,14 +243,14 @@ function parseGeneratedPrepareEcdsaClientBootstrapOutput(input) {
 	return {
 		pendingStateBlob: parsePendingStateBlob(input.pendingStateBlob),
 		clientBootstrap: {
-			contextBinding32B64u: requireBase64UrlBytes$1(input.clientBootstrap.contextBinding32B64u, "contextBinding32B64u", 32),
+			contextBinding32B64u: requireBase64UrlBytes(input.clientBootstrap.contextBinding32B64u, "contextBinding32B64u", 32),
 			derivationClientSharePublicKey33B64u,
 			clientShareRetryCounter: input.clientBootstrap.clientShareRetryCounter,
 			participantId: 1
 		},
 		publicFacts: {
 			derivationClientSharePublicKey33B64u: parseDerivationClientSharePublicKey33B64u(input.publicFacts.derivationClientSharePublicKey33B64u),
-			clientVerifyingShareB64u: parsePublicKey33B64u$1(input.publicFacts.clientVerifyingShareB64u, "clientVerifyingShareB64u")
+			clientVerifyingShareB64u: parsePublicKey33B64u(input.publicFacts.clientVerifyingShareB64u, "clientVerifyingShareB64u")
 		}
 	};
 }
@@ -267,12 +271,12 @@ function parseGeneratedFinalizeEcdsaClientBootstrapOutput(input) {
 	return {
 		stateBlob: parseReadyStateBlob(input.stateBlob),
 		publicFacts: {
-			contextBinding32B64u: requireBase64UrlBytes$1(input.publicFacts.contextBinding32B64u, "contextBinding32B64u", 32),
+			contextBinding32B64u: requireBase64UrlBytes(input.publicFacts.contextBinding32B64u, "contextBinding32B64u", 32),
 			derivationClientSharePublicKey33B64u: parseDerivationClientSharePublicKey33B64u(input.publicFacts.derivationClientSharePublicKey33B64u),
-			clientVerifyingShareB64u: parsePublicKey33B64u$1(input.publicFacts.clientVerifyingShareB64u, "clientVerifyingShareB64u"),
-			relayerPublicKey33B64u: parseRelayerEcdsaDerivationPublicKey33B64u$1(input.publicFacts.relayerPublicKey33B64u),
-			groupPublicKey33B64u: parsePublicKey33B64u$1(input.publicFacts.groupPublicKey33B64u, "groupPublicKey33B64u"),
-			ethereumAddress: parseEthereumAddress$1(input.publicFacts.ethereumAddress)
+			clientVerifyingShareB64u: parsePublicKey33B64u(input.publicFacts.clientVerifyingShareB64u, "clientVerifyingShareB64u"),
+			relayerPublicKey33B64u: parseRelayerEcdsaDerivationPublicKey33B64u(input.publicFacts.relayerPublicKey33B64u),
+			groupPublicKey33B64u: parsePublicKey33B64u(input.publicFacts.groupPublicKey33B64u, "groupPublicKey33B64u"),
+			ethereumAddress: parseEthereumAddress(input.publicFacts.ethereumAddress)
 		}
 	};
 }
@@ -301,22 +305,6 @@ function signerCryptoCommandFailure(code, message) {
 		message
 	};
 }
-function requiredString$1(value, field) {
-	if (typeof value !== "string") throw new Error(`ECDSA client bootstrap state is missing ${field}`);
-	const normalized = value.trim();
-	if (!normalized) throw new Error(`ECDSA client bootstrap state is missing ${field}`);
-	return normalized;
-}
-function requiredNonNegativeInteger(value, field) {
-	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw new Error(`${field} must be a non-negative safe integer`);
-	return value;
-}
-function requireBase64UrlBytes(value, field, byteLength) {
-	const normalized = String(value || "").trim();
-	if (!normalized) throw new Error(`${field} is required`);
-	if (base64UrlDecode(normalized).length !== byteLength) throw new Error(`${field} must decode to ${byteLength} bytes`);
-	return normalized;
-}
 function decodeBase64UrlArrayBuffer(value) {
 	const decoded = base64UrlDecode(value);
 	const out = new ArrayBuffer(decoded.byteLength);
@@ -352,17 +340,6 @@ function browserPasskeyCreationOptions(options) {
 		} } }
 	};
 }
-function parsePublicKey33B64u(value, field) {
-	return requireBase64UrlBytes(value, field, 33);
-}
-function parseRelayerEcdsaDerivationPublicKey33B64u(value) {
-	return parsePublicKey33B64u(value, "ECDSA relayer DERIVATION public key");
-}
-function parseEthereumAddress(value) {
-	const normalized = String(value || "").trim();
-	if (!/^0x[0-9a-fA-F]{40}$/.test(normalized)) throw new Error("ECDSA relayer public identity has invalid ethereumAddress");
-	return normalized;
-}
 function isNativeBindingFailureMessage(message) {
 	return /wasm (initialization|initialize|instantiation)|webassembly|module_or_path|failed to (load|compile|instantiate) wasm|derivation client wasm initialization failed/i.test(message);
 }
@@ -388,17 +365,6 @@ function mapFinalizeEcdsaCommandError(error) {
 	if (/relayer|public identity|group public key|ethereum address|threshold public key/i.test(message)) return signerCryptoCommandFailure("public_identity_mismatch", message);
 	return signerCryptoCommandFailure("invalid_pending_state", message);
 }
-function parseRelayerPublicIdentity(input) {
-	if (input === null || typeof input !== "object" || Array.isArray(input)) throw new Error("ECDSA relayer public identity must be an object");
-	if (Object.keys(input).sort().join(",") !== "ethereumAddress,groupPublicKey33B64u,relayerKeyId,relayerPublicKey33B64u,relayerShareRetryCounter") throw new Error("ECDSA relayer public identity fields are invalid");
-	return {
-		relayerKeyId: requiredString$1(Reflect.get(input, "relayerKeyId"), "relayerKeyId"),
-		relayerPublicKey33B64u: parseRelayerEcdsaDerivationPublicKey33B64u(requiredString$1(Reflect.get(input, "relayerPublicKey33B64u"), "relayerPublicKey33B64u")),
-		groupPublicKey33B64u: parsePublicKey33B64u(requiredString$1(Reflect.get(input, "groupPublicKey33B64u"), "groupPublicKey33B64u"), "groupPublicKey33B64u"),
-		ethereumAddress: parseEthereumAddress(Reflect.get(input, "ethereumAddress")),
-		relayerShareRetryCounter: requiredNonNegativeInteger(Reflect.get(input, "relayerShareRetryCounter"), "relayerShareRetryCounter")
-	};
-}
 function createBrowserDurableRecordStore(indexedDB) {
 	return {
 		kind: "durable_record_store",
@@ -745,11 +711,6 @@ function createBrowserSignerCryptoPort(workerCtx) {
 		},
 		async finalizeEcdsaClientBootstrap(input) {
 			if (input.pendingStateBlob.kind !== "ecdsa_role_local_pending_state_blob_v1" || input.pendingStateBlob.curve !== "secp256k1" || input.pendingStateBlob.encoding !== "base64url" || input.pendingStateBlob.producer !== "signer_core") return signerCryptoCommandFailure("invalid_pending_state", "ECDSA client bootstrap pending blob envelope is invalid");
-			try {
-				parseRelayerPublicIdentity(input.relayerPublicIdentity);
-			} catch (error) {
-				return signerCryptoCommandFailure("invalid_relayer_public_identity", errorMessage(error));
-			}
 			if (!workerCtx) return signerCryptoInvocationFailure("unavailable", "ECDSA client bootstrap worker context is unavailable");
 			try {
 				return {
@@ -891,9 +852,8 @@ let DeviceLinkingErrorCode = /* @__PURE__ */ function(DeviceLinkingErrorCode) {
 	DeviceLinkingErrorCode["INSUFFICIENT_BALANCE"] = "INSUFFICIENT_BALANCE";
 	DeviceLinkingErrorCode["REGISTRATION_FAILED"] = "REGISTRATION_FAILED";
 	/**
-	* R103 zero-prompt handoff: Device 1 is not unlocked with the custody
-	* capability linking needs. The QR flow never prompts; the user unlocks the
-	* wallet and scans again.
+	* Device 1 is not unlocked with the custody capability linking needs. The
+	* QR flow never prompts; the user unlocks the wallet and scans again.
 	*/
 	DeviceLinkingErrorCode["WALLET_UNLOCK_REQUIRED"] = "WALLET_UNLOCK_REQUIRED";
 	/**
@@ -950,10 +910,9 @@ var Ed25519YaoPageLifecycleOwner = class {
 * this run registered under, and the Router's activation result.
 *
 * **Every identity here comes from the Router's receipt, not from this side.**
-* That matters most for `materialActivation`: it is a Refactor 90 identity, and
-* the boundary that mints it is the Router, exactly as on the PRF path. Nothing
-* here invents one — a locally minted activation ref would be a second owner
-* for state Refactor 90 owns.
+* That matters most for `materialActivation`: the boundary that mints it is the
+* Router, exactly as on the PRF path. Nothing here invents one — a locally
+* minted activation ref would give that state a second owner.
 */
 function walletCustodyEd25519ActiveClientMetadataV1(input) {
 	let raw;
@@ -1385,35 +1344,7 @@ async function recoverWalletCustodyManifestV1(input) {
 	};
 }
 //#endregion
-//#region src/core/signingEngine/session/sealedRecovery/materialActivationKey.ts
-function ed25519DurableMaterialLocator(args) {
-	return {
-		kind: "ed25519_durable_material",
-		authMethod: args.authMethod,
-		materialActivation: args.materialActivation
-	};
-}
-function materialActivationKey(activation) {
-	return [
-		activation.activationId,
-		activation.capability,
-		activation.materialOwner,
-		activation.keyBinding,
-		activation.lifecycleBinding,
-		activation.signingWorker
-	].map((part) => encodeURIComponent(String(part))).join(":");
-}
-//#endregion
 //#region src/core/signingEngine/session/passkey/ed25519YaoWarmRecovery.ts
-function requireRecord$3(value, label) {
-	if (!isPlainObject(value)) throw new Error(`${label} must be an object`);
-	return value;
-}
-function requireString$3(value, label) {
-	const parsed = typeof value === "string" ? value.trim() : "";
-	if (!parsed) throw new Error(`${label} is required`);
-	return parsed;
-}
 function requirePositiveInteger$2(value, label) {
 	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 1) throw new Error(`${label} must be a positive integer`);
 	return value;
@@ -1565,31 +1496,28 @@ async function parseJsonResponseOrNull(response) {
 		return null;
 	}
 }
-function sameRuntimePolicyScope(left, right) {
-	return left.orgId === right.orgId && left.projectId === right.projectId && left.envId === right.envId && left.signingRootVersion === right.signingRootVersion;
-}
 async function parseWarmRecoveryDescriptor(args) {
 	const record = args.record;
 	const response = args.response;
 	exactResponseKeys(response, WARM_RECOVERY_RESPONSE_KEYS);
 	if (response.kind !== "router_ab_ed25519_yao_v2_session_bootstrap_v1") throw new Error("warm recovery bootstrap response kind is invalid");
 	const restore = record.ed25519Restore;
-	const walletId = requireString$3(response.walletId, "response.walletId");
-	const nearAccountId = requireString$3(response.nearAccountId, "response.nearAccountId");
-	const nearEd25519SigningKeyId = requireString$3(response.nearEd25519SigningKeyId, "response.nearEd25519SigningKeyId");
+	const walletId = requireTrimmedString(response.walletId, "response.walletId");
+	const nearAccountId = requireTrimmedString(response.nearAccountId, "response.nearAccountId");
+	const nearEd25519SigningKeyId = requireTrimmedString(response.nearEd25519SigningKeyId, "response.nearEd25519SigningKeyId");
 	const signerSlot = requirePositiveInteger$2(response.signerSlot, "response.signerSlot");
-	const thresholdSessionId = requireString$3(response.thresholdSessionId, "response.thresholdSessionId");
-	const signingWorkerId = requireString$3(response.signingWorkerId, "response.signingWorkerId");
+	const thresholdSessionId = requireTrimmedString(response.thresholdSessionId, "response.thresholdSessionId");
+	const signingWorkerId = requireTrimmedString(response.signingWorkerId, "response.signingWorkerId");
 	const thresholdExpiresAtMs = requirePositiveInteger$2(response.thresholdExpiresAtMs, "response.thresholdExpiresAtMs");
 	const participantIds = requireParticipantIds$1(response.participantIds);
-	const responseRuntimePolicyScope = normalizeRuntimePolicyScope(requireRecord$3(response.runtimePolicyScope, "response.runtimePolicyScope"));
-	const sealedRuntimePolicyScope = normalizeRuntimePolicyScope(requireRecord$3(restore.runtimePolicyScope, "ed25519Restore.runtimePolicyScope"));
+	const responseRuntimePolicyScope = normalizeRuntimePolicyScope(requireRecord$1(response.runtimePolicyScope, "response.runtimePolicyScope"));
+	const sealedRuntimePolicyScope = normalizeRuntimePolicyScope(requireRecord$1(restore.runtimePolicyScope, "ed25519Restore.runtimePolicyScope"));
 	const routerAbNormalSigning = parseRouterAbEd25519NormalSigningState(response.routerAbNormalSigning);
 	const walletSessionId = parseWalletSessionId(response.walletSessionId);
 	const quotaId = parseMpcWalletSigningQuotaId(response.quotaId);
 	const capability = parseEd25519YaoRecoveryCapabilityV1(response.capability);
 	const walletSessionToken = args.authorization.operationCredential.token;
-	if (!walletSessionId.ok || !quotaId.ok || args.expectedAuthorityRef.walletId !== record.walletId || String(walletSessionId.value) !== String(args.authorization.operationCredential.walletSessionId) || String(quotaId.value) !== String(args.authorization.record.quotaId) || !routerAbNormalSigning || walletId !== record.walletId || nearAccountId !== restore.nearAccountId || nearEd25519SigningKeyId !== restore.nearEd25519SigningKeyId || signerSlot !== restore.signerSlot || thresholdSessionId !== String(args.expectedThresholdSessionId) || !walletSessionToken || signingWorkerId !== restore.relayerKeyId || signingWorkerId !== restore.routerAbNormalSigning.signingWorkerId || routerAbNormalSigning.signingWorkerId !== signingWorkerId || record.expiresAtMs > thresholdExpiresAtMs || participantIds[0] !== restore.participantIds[0] || participantIds[1] !== restore.participantIds[1] || !sameRuntimePolicyScope(responseRuntimePolicyScope, sealedRuntimePolicyScope)) throw new Error("warm recovery bootstrap does not match the exact sealed Ed25519 lane");
+	if (!walletSessionId.ok || !quotaId.ok || args.expectedAuthorityRef.walletId !== record.walletId || String(walletSessionId.value) !== String(args.authorization.operationCredential.walletSessionId) || String(quotaId.value) !== String(args.authorization.record.quotaId) || !routerAbNormalSigning || walletId !== record.walletId || nearAccountId !== restore.nearAccountId || nearEd25519SigningKeyId !== restore.nearEd25519SigningKeyId || signerSlot !== restore.signerSlot || thresholdSessionId !== String(args.expectedThresholdSessionId) || !walletSessionToken || signingWorkerId !== restore.relayerKeyId || signingWorkerId !== restore.routerAbNormalSigning.signingWorkerId || routerAbNormalSigning.signingWorkerId !== signingWorkerId || record.expiresAtMs > thresholdExpiresAtMs || participantIds[0] !== restore.participantIds[0] || participantIds[1] !== restore.participantIds[1] || !sameRuntimePolicyScope$1(responseRuntimePolicyScope, sealedRuntimePolicyScope)) throw new Error("warm recovery bootstrap does not match the exact sealed Ed25519 lane");
 	if (!signingRootScopeFromRuntimePolicyScope(responseRuntimePolicyScope)) throw new Error("warm recovery bootstrap signing-root scope is invalid");
 	if (!walletSessionToken) throw new Error("[SigningEngine][near] active Wallet Session authorization is unavailable");
 	const descriptor = {
@@ -1600,7 +1528,7 @@ async function parseWarmRecoveryDescriptor(args) {
 		signerSlot,
 		operationalPublicKey: `ed25519:${base58Encode(Uint8Array.from(capability.registeredPublicKey))}`,
 		relayerKeyId: signingWorkerId,
-		credentialIdB64u: requireString$3(restore.credentialIdB64u, "ed25519Restore.credentialIdB64u"),
+		credentialIdB64u: requireTrimmedString(restore.credentialIdB64u, "ed25519Restore.credentialIdB64u"),
 		session: {
 			sessionKind: "opaque",
 			walletSessionToken,
@@ -1627,7 +1555,7 @@ async function resolvePasskeyEd25519YaoExportContextV1(input, runtime) {
 	};
 	const walletId = parseWalletId(exactRecord.record.walletId);
 	if (!walletId.ok) throw new Error("[SigningEngine][near] sealed Ed25519 wallet identity is invalid");
-	const credentialIdB64u = requireString$3(exactRecord.record.ed25519Restore.credentialIdB64u, "ed25519Restore.credentialIdB64u");
+	const credentialIdB64u = requireTrimmedString(exactRecord.record.ed25519Restore.credentialIdB64u, "ed25519Restore.credentialIdB64u");
 	let expectedAuthorityRef;
 	try {
 		expectedAuthorityRef = await runtime.resolveExactPasskeyWalletAuthAuthorityRef({
@@ -1812,7 +1740,7 @@ const WALLET_KEY_LIFECYCLE_FIELDS = [
 	"retiredAtMs",
 	"compromisedAtMs"
 ];
-const SIGNING_LANE_REFERENCE_FIELDS = [
+const SIGNING_LANE_RECORD_BASE_FIELDS = [...[
 	"kind",
 	"walletId",
 	"walletKeyId",
@@ -1820,9 +1748,7 @@ const SIGNING_LANE_REFERENCE_FIELDS = [
 	"laneKind",
 	"laneShareEpoch",
 	"participantBindingDigestB64u"
-];
-[...SIGNING_LANE_REFERENCE_FIELDS];
-const SIGNING_LANE_RECORD_BASE_FIELDS = [...SIGNING_LANE_REFERENCE_FIELDS, "lifecycle"];
+], "lifecycle"];
 const OWNER_AUTH_SIGNING_LANE_FIELDS = [
 	...SIGNING_LANE_RECORD_BASE_FIELDS,
 	"walletAuthMethodId",
@@ -1868,10 +1794,6 @@ function signingLaneRecordFields(laneKind) {
 		case "delegated_execution": return DELEGATED_SIGNING_LANE_FIELDS;
 	}
 }
-function requireResult(result, label) {
-	if (result.ok) return result.value;
-	throw new Error(`${label} ${result.error.message}`);
-}
 function parseRequiredDomainId(raw, label) {
 	if (raw === void 0 || raw === null) throw new Error(`${label} is required`);
 	if (typeof raw !== "string") throw new Error(`${label} must be a string`);
@@ -1915,7 +1837,7 @@ function parseSigningLaneKind(raw, label) {
 	}
 }
 function parseWalletKeyLifecycleState(raw, label) {
-	const record = requireRecord$4(raw, label);
+	const record = requireRecord$1(raw, label);
 	rejectUnknownFields(record, WALLET_KEY_LIFECYCLE_FIELDS, label, WALLET_KEY_LIFECYCLE_FIELDS);
 	switch (record.state) {
 		case "active":
@@ -1931,7 +1853,7 @@ function parseWalletKeyLifecycleState(raw, label) {
 	}
 }
 function parseSigningLaneLifecycleState(raw, label) {
-	const record = requireRecord$4(raw, label);
+	const record = requireRecord$1(raw, label);
 	rejectUnknownFields(record, ALL_SIGNING_LANE_LIFECYCLE_FIELDS, label);
 	const revocationEpoch = parseNonNegativeSafeInteger(record.revocationEpoch, `${label}.revocationEpoch`);
 	switch (record.state) {
@@ -1971,12 +1893,12 @@ function parseSigningLaneLifecycleState(raw, label) {
 function parseSigningLaneReferenceFields(record, label) {
 	if (record.kind !== "signing_lane_reference_v1") throw new Error(`${label}.kind must be signing_lane_reference_v1`);
 	return buildSigningLaneReference({
-		walletId: requireResult(parseWalletId(record.walletId), `${label}.walletId`),
-		walletKeyId: requireResult(parseWalletKeyId(record.walletKeyId), `${label}.walletKeyId`),
-		laneId: requireResult(parseSigningLaneId(record.laneId), `${label}.laneId`),
-		laneShareEpoch: requireResult(parseLaneShareEpoch(record.laneShareEpoch), `${label}.laneShareEpoch`),
+		walletId: requireParsed$1(parseWalletId(record.walletId), `${label}.walletId`),
+		walletKeyId: requireParsed$1(parseWalletKeyId(record.walletKeyId), `${label}.walletKeyId`),
+		laneId: requireParsed$1(parseSigningLaneId(record.laneId), `${label}.laneId`),
+		laneShareEpoch: requireParsed$1(parseLaneShareEpoch(record.laneShareEpoch), `${label}.laneShareEpoch`),
 		laneKind: parseSigningLaneKind(record.laneKind, `${label}.laneKind`),
-		participantBindingDigestB64u: requireResult(parseLaneParticipantBindingDigestB64u(record.participantBindingDigestB64u), `${label}.participantBindingDigestB64u`)
+		participantBindingDigestB64u: requireParsed$1(parseLaneParticipantBindingDigestB64u(record.participantBindingDigestB64u), `${label}.participantBindingDigestB64u`)
 	});
 }
 function parseSigningLaneRecordCommon(record, label) {
@@ -1995,7 +1917,7 @@ function parseOwnerAuthSigningLaneRecordBase(record, label) {
 	const walletAuthMethodId = parseWalletAuthMethodId(record.walletAuthMethodId);
 	return {
 		...common,
-		walletAuthMethodId: requireResult(walletAuthMethodId, `${label}.walletAuthMethodId`),
+		walletAuthMethodId: requireParsed$1(walletAuthMethodId, `${label}.walletAuthMethodId`),
 		ownerParticipantContinuity: parseOwnerLaneParticipantContinuityV1(record.ownerParticipantContinuity, `${label}.ownerParticipantContinuity`)
 	};
 }
@@ -2186,13 +2108,13 @@ function buildBreakGlassSigningLaneRecord(args) {
 	};
 }
 function parseWalletKeyRecord(raw, label = "walletKeyRecord") {
-	const record = requireRecord$4(raw, label);
+	const record = requireRecord$1(raw, label);
 	if (record.kind !== "wallet_key_record_v1") throw new Error(`${label}.kind must be wallet_key_record_v1`);
 	if (record.keyFamily === "ed25519") {
 		rejectUnknownFields(record, ED25519_WALLET_KEY_FIELDS, label, ALL_WALLET_KEY_FIELDS);
 		return buildEd25519WalletKeyRecord({
-			walletId: requireResult(parseWalletId(record.walletId), `${label}.walletId`),
-			walletKeyId: requireResult(parseWalletKeyId(record.walletKeyId), `${label}.walletKeyId`),
+			walletId: requireParsed$1(parseWalletId(record.walletId), `${label}.walletId`),
+			walletKeyId: requireParsed$1(parseWalletKeyId(record.walletKeyId), `${label}.walletKeyId`),
 			walletKeyVersion: parseWalletKeyVersion(record.walletKeyVersion, `${label}.walletKeyVersion`),
 			nearEd25519SigningKeyId: parseNearEd25519SigningKeyId(record.nearEd25519SigningKeyId),
 			keyCreationSignerSlot: parseKeyCreationSignerSlot(record.keyCreationSignerSlot, `${label}.keyCreationSignerSlot`),
@@ -2203,8 +2125,8 @@ function parseWalletKeyRecord(raw, label = "walletKeyRecord") {
 	if (record.keyFamily === "ecdsa_secp256k1") {
 		rejectUnknownFields(record, EVM_WALLET_KEY_FIELDS, label, ALL_WALLET_KEY_FIELDS);
 		return buildEvmFamilyWalletKeyRecord({
-			walletId: requireResult(parseWalletId(record.walletId), `${label}.walletId`),
-			walletKeyId: requireResult(parseWalletKeyId(record.walletKeyId), `${label}.walletKeyId`),
+			walletId: requireParsed$1(parseWalletId(record.walletId), `${label}.walletId`),
+			walletKeyId: requireParsed$1(parseWalletKeyId(record.walletKeyId), `${label}.walletKeyId`),
 			walletKeyVersion: parseWalletKeyVersion(record.walletKeyVersion, `${label}.walletKeyVersion`),
 			evmFamilySigningKeySlotId: requireEvmFamilySigningKeySlotId(record.evmFamilySigningKeySlotId, `${label}.evmFamilySigningKeySlotId`),
 			thresholdPublicKey33B64u: parseSecp256k1CompressedPublicKeyB64u(record.thresholdPublicKey33B64u, `${label}.thresholdPublicKey33B64u`),
@@ -2215,7 +2137,7 @@ function parseWalletKeyRecord(raw, label = "walletKeyRecord") {
 	throw new Error(`${label}.keyFamily must be ed25519 or ecdsa_secp256k1`);
 }
 function parseSigningLaneRecord(raw, label = "signingLaneRecord") {
-	const record = requireRecord$4(raw, label);
+	const record = requireRecord$1(raw, label);
 	if (record.kind !== "signing_lane_reference_v1") throw new Error(`${label}.kind must be signing_lane_reference_v1`);
 	const laneKind = parseSigningLaneKind(record.laneKind, `${label}.laneKind`);
 	rejectUnknownFields(record, signingLaneRecordFields(laneKind), label, ALL_SIGNING_LANE_RECORD_FIELDS);
@@ -2233,7 +2155,7 @@ function parseSigningLaneRecord(raw, label = "signingLaneRecord") {
 				holderParticipant: base.holderParticipant,
 				serverParticipant: base.serverParticipant,
 				lifecycle: base.lifecycle,
-				linkedDeviceId: requireResult(parseLinkedDeviceId(record.linkedDeviceId), `${label}.linkedDeviceId`)
+				linkedDeviceId: requireParsed$1(parseLinkedDeviceId(record.linkedDeviceId), `${label}.linkedDeviceId`)
 			});
 		}
 		case "delegated_execution": {
@@ -2773,26 +2695,42 @@ function exactEcdsaParticipantIds(value) {
 	if (!Number.isSafeInteger(first) || !Number.isSafeInteger(second) || first <= 0 || second <= 0 || first === second) throw new Error("[SigningEngine][ecdsa-export] ECDSA participant set is invalid");
 	return [first, second];
 }
-function resolveCanonicalEmailOtpEcdsaExportMaterialForLane(args) {
-	const { exportLane } = args;
+function requireCanonicalEcdsaExportLane(args) {
+	const { exportLane, label } = args;
 	const capability = exportLane.capability;
-	if (!isEmailOtpWalletAuthAuthority(capability.authority)) throw new Error("[SigningEngine][ecdsa-export] Email OTP capability authority mismatch");
 	const signer = capability.manifest.signer;
-	if (signer.walletId !== exportLane.key.walletId || !signer.scope.targetMemberships.some((target) => thresholdEcdsaChainTargetsEqual(target, exportLane.chainTarget))) throw new Error("[SigningEngine][ecdsa-export] Email OTP capability target mismatch");
-	if (exportLane.laneIdentity.auth.kind !== "email_otp" || exportLane.laneIdentity.auth.providerSubjectId !== capability.authority.factor.providerUserId) throw new Error("[SigningEngine][ecdsa-export] Email OTP capability auth mismatch");
-	if (!mpcMaterialActivationRefsEqual(capability.manifest.activation.materialActivation, exportLane.laneIdentity.signer.materialActivation)) throw new Error("[SigningEngine][ecdsa-export] Email OTP material activation mismatch");
+	if (signer.walletId !== exportLane.key.walletId || !signer.scope.targetMemberships.some((target) => thresholdEcdsaChainTargetsEqual(target, exportLane.chainTarget))) throw new Error(`[SigningEngine][ecdsa-export] ${label} capability target mismatch`);
+	if (!args.authMatches()) throw new Error(`[SigningEngine][ecdsa-export] ${label} capability auth mismatch`);
+	if (!mpcMaterialActivationRefsEqual(capability.manifest.activation.materialActivation, exportLane.laneIdentity.signer.materialActivation)) throw new Error(`[SigningEngine][ecdsa-export] ${label} material activation mismatch`);
 	assertMatchingVerifiedEcdsaPublicFacts({
 		expected: exportLane.publicFacts,
-		actual: capability.manifest.signer.registeredPublicFacts,
-		context: "canonical Email OTP export lane"
+		actual: signer.registeredPublicFacts,
+		context: `canonical ${label} export lane`
 	});
 	const materialFacts = capability.material.publicFacts;
-	if (materialFacts.walletId !== signer.walletId || String(materialFacts.keyHandle) !== String(exportLane.publicFacts.keyHandle) || String(materialFacts.groupPublicKey33B64u) !== String(exportLane.publicFacts.publicKeyB64u) || String(materialFacts.ethereumAddress) !== String(exportLane.publicFacts.thresholdOwnerAddress) || materialFacts.participantIds.length !== exportLane.publicFacts.participantIds.length || materialFacts.participantIds.some((participantId, index) => participantId !== exportLane.publicFacts.participantIds[index])) throw new Error("[SigningEngine][ecdsa-export] canonical Email OTP export material mismatch");
+	if (materialFacts.walletId !== signer.walletId || String(materialFacts.keyHandle) !== String(exportLane.publicFacts.keyHandle) || String(materialFacts.groupPublicKey33B64u) !== String(exportLane.publicFacts.publicKeyB64u) || String(materialFacts.ethereumAddress) !== String(exportLane.publicFacts.thresholdOwnerAddress) || materialFacts.participantIds.length !== exportLane.publicFacts.participantIds.length || materialFacts.participantIds.some((participantId, index) => participantId !== exportLane.publicFacts.participantIds[index])) throw new Error(`[SigningEngine][ecdsa-export] canonical ${label} export material mismatch`);
 	const durable = capability.manifest.durableMaterial;
 	const runtimePolicyScope = durable.runtimePolicyScope;
 	const relayerUrl = String(args.deps.relayerUrl).trim().replace(/\/+$/g, "");
-	if (!runtimePolicyScope) throw new Error("[SigningEngine][ecdsa-export] Email OTP runtime policy scope is missing");
-	if (!relayerUrl) throw new Error("[SigningEngine][ecdsa-export] Email OTP export relayer URL is missing");
+	if (!runtimePolicyScope) throw new Error(`[SigningEngine][ecdsa-export] ${label} runtime policy scope is missing`);
+	if (!relayerUrl) throw new Error(`[SigningEngine][ecdsa-export] ${label} export relayer URL is missing`);
+	return {
+		durable,
+		runtimePolicyScope,
+		relayerUrl
+	};
+}
+function resolveCanonicalEmailOtpEcdsaExportMaterialForLane(args) {
+	const { exportLane } = args;
+	const capability = exportLane.capability;
+	const authority = capability.authority;
+	if (!isEmailOtpWalletAuthAuthority(authority)) throw new Error("[SigningEngine][ecdsa-export] Email OTP capability authority mismatch");
+	const { durable, runtimePolicyScope, relayerUrl } = requireCanonicalEcdsaExportLane({
+		deps: args.deps,
+		exportLane,
+		label: "Email OTP",
+		authMatches: () => exportLane.laneIdentity.auth.kind === "email_otp" && exportLane.laneIdentity.auth.providerSubjectId === authority.factor.providerUserId
+	});
 	return {
 		source: "canonical_capability",
 		kind: "fresh_email_otp_route_auth_ready",
@@ -2806,30 +2744,21 @@ function resolveCanonicalEmailOtpEcdsaExportMaterialForLane(args) {
 		relayerUrl,
 		authorization: {
 			kind: "fresh_operation_authorization_required",
-			authority: capability.authority
+			authority
 		}
 	};
 }
 function resolveCanonicalPasskeyEcdsaExportMaterialForLane(args) {
 	const { exportLane } = args;
 	const capability = exportLane.capability;
-	if (!isPasskeyWalletAuthAuthority(capability.authority)) throw new Error("[SigningEngine][ecdsa-export] passkey capability authority mismatch");
-	const signer = capability.manifest.signer;
-	if (signer.walletId !== exportLane.key.walletId || !signer.scope.targetMemberships.some((target) => thresholdEcdsaChainTargetsEqual(target, exportLane.chainTarget))) throw new Error("[SigningEngine][ecdsa-export] passkey capability target mismatch");
-	if (exportLane.laneIdentity.auth.kind !== "passkey" || exportLane.laneIdentity.auth.credentialIdB64u !== capability.authority.factor.credentialIdB64u) throw new Error("[SigningEngine][ecdsa-export] passkey capability auth mismatch");
-	if (!mpcMaterialActivationRefsEqual(capability.manifest.activation.materialActivation, exportLane.laneIdentity.signer.materialActivation)) throw new Error("[SigningEngine][ecdsa-export] passkey material activation mismatch");
-	assertMatchingVerifiedEcdsaPublicFacts({
-		expected: exportLane.publicFacts,
-		actual: signer.registeredPublicFacts,
-		context: "canonical passkey export lane"
+	const authority = capability.authority;
+	if (!isPasskeyWalletAuthAuthority(authority)) throw new Error("[SigningEngine][ecdsa-export] passkey capability authority mismatch");
+	const { durable, runtimePolicyScope, relayerUrl } = requireCanonicalEcdsaExportLane({
+		deps: args.deps,
+		exportLane,
+		label: "passkey",
+		authMatches: () => exportLane.laneIdentity.auth.kind === "passkey" && exportLane.laneIdentity.auth.credentialIdB64u === authority.factor.credentialIdB64u
 	});
-	const materialFacts = capability.material.publicFacts;
-	if (materialFacts.walletId !== signer.walletId || String(materialFacts.keyHandle) !== String(exportLane.publicFacts.keyHandle) || String(materialFacts.groupPublicKey33B64u) !== String(exportLane.publicFacts.publicKeyB64u) || String(materialFacts.ethereumAddress) !== String(exportLane.publicFacts.thresholdOwnerAddress) || materialFacts.participantIds.length !== exportLane.publicFacts.participantIds.length || materialFacts.participantIds.some((participantId, index) => participantId !== exportLane.publicFacts.participantIds[index])) throw new Error("[SigningEngine][ecdsa-export] canonical passkey export material mismatch");
-	const durable = capability.manifest.durableMaterial;
-	const runtimePolicyScope = durable.runtimePolicyScope;
-	const relayerUrl = String(args.deps.relayerUrl).trim().replace(/\/+$/g, "");
-	if (!runtimePolicyScope) throw new Error("[SigningEngine][ecdsa-export] passkey runtime policy scope is missing");
-	if (!relayerUrl) throw new Error("[SigningEngine][ecdsa-export] passkey export relayer URL is missing");
 	return {
 		source: "canonical_capability",
 		kind: "fresh_passkey_needs_authorization",
@@ -2990,7 +2919,7 @@ async function resolveEcdsaExportMaterialForLane(deps, exportLane) {
 const ECDSA_DERIVATION_EXPORT_CONFIRMATION_DIGEST_VERSION = "ecdsa-derivation:role-local:product-export-confirmation:v5";
 const ECDSA_DERIVATION_EXPORT_AUTHORIZATION_DIGEST_VERSION = "ecdsa-derivation:role-local:product-export-authorization:v5";
 const ECDSA_DERIVATION_EXPORT_AUTH_TTL_MS = 6e4;
-function exportAuthorizationWire(authorization) {
+function exportAuthorizationWire(_authorization) {
 	return { kind: "operation_step_up" };
 }
 function exportAuthorizationDigestFields(authorization) {
@@ -5010,7 +4939,7 @@ async function prepareAndShowEcdsaExportArtifact(deps, args) {
 		});
 		const materialActivation = args.exportLane.laneIdentity.signer.materialActivation;
 		const artifact = await deps.withThresholdEcdsaSigningQueue({
-			queueKey: resolveThresholdEcdsaSigningQueueKey({ materialActivation }),
+			queueKey: resolveThresholdCommitQueueKey({ materialActivation }),
 			walletId: args.exportLane.key.walletId,
 			enabled: true,
 			task: async () => {
@@ -5065,7 +4994,7 @@ function requirePasskeyEcdsaExportAuth(exportLane) {
 	return auth;
 }
 async function exportOperationDigest(value) {
-	return parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(value))));
+	return sha256Utf8DigestB64u(alphabetizeStringify(value));
 }
 async function prepareExplicitEcdsaExportOperationWithRuntime(args) {
 	const chainTargetKey = thresholdEcdsaChainTargetKey(args.chainTarget);
@@ -6027,7 +5956,7 @@ async function exportEd25519YaoKeyWithFreshAuthorization(deps, args) {
 		}
 	});
 	const result = await deps.withThresholdEd25519CommitQueue({
-		queueKey: resolveThresholdEd25519CommitQueueKey({ materialActivation: passkeyEd25519ExportMaterialActivation(resolved) }),
+		queueKey: resolveThresholdCommitQueueKey({ materialActivation: passkeyEd25519ExportMaterialActivation(resolved) }),
 		nearAccountId: args.nearAccountId,
 		enabled: true,
 		task: () => deps.passkeyMpcExport.exportPrivateKeysWithUi(buildWorkerPayload({
@@ -6123,7 +6052,7 @@ async function exportEd25519YaoKeyWithFreshEmailOtp(deps, args) {
 			onEvent: args.onEvent
 		});
 		const artifact = await deps.withThresholdEd25519CommitQueue({
-			queueKey: resolveThresholdEd25519CommitQueueKey({ materialActivation: emailOtpEd25519ExportMaterialActivation(resolved.context) }),
+			queueKey: resolveThresholdCommitQueueKey({ materialActivation: emailOtpEd25519ExportMaterialActivation(resolved.context) }),
 			nearAccountId: args.nearAccountId,
 			enabled: resolved.context.material.kind === "active_capability",
 			task: () => deps.emailOtp.exportSeedWithFreshAuthorization({
@@ -6359,14 +6288,11 @@ async function exportEd25519KeypairWithFlowId(deps, args) {
 		onEvent: args.options.onEvent
 	});
 }
-async function exportEd25519KeypairWithSessionLifecycle(deps, args) {
-	return await exportEd25519KeypairWithFlowId(deps, args);
-}
 async function exportKeypairWithUI$1(deps, input) {
 	return await runKeyExportWithFlowEvents(input, async (args) => {
 		switch (args.kind) {
 			case "ecdsa": return await exportEcdsaKeypairWithSessionLifecycle(deps, args, { kind: "initial" });
-			case "ed25519": return await exportEd25519KeypairWithSessionLifecycle(deps, args);
+			case "ed25519": return await exportEd25519KeypairWithFlowId(deps, args);
 		}
 	});
 }
@@ -6836,7 +6762,6 @@ const BUILD_PATHS = {
 		WASM_SIGNER: "../../wasm/near_signer",
 		ED25519_YAO_CLIENT: "../../crates/router-ab-ed25519-yao-client",
 		WASM_ECDSA_CLIENT: "../../wasm/router_ab_ecdsa_client",
-		WASM_ECDSA_SIGNING_WORKER: "../../wasm/router_ab_ecdsa_signing_worker",
 		WASM_EVM_CRYPTO: "../../wasm/evm_crypto",
 		WASM_TEMPO_SIGNER: "../../wasm/tempo_signer",
 		WASM_SHAMIR3PASS_RUNTIME: "../../wasm/shamir3pass_runtime",
@@ -6852,7 +6777,6 @@ const BUILD_PATHS = {
 			"../../crates/router-ab-ed25519-yao-client",
 			"../../wasm/near_signer",
 			"../../wasm/router_ab_ecdsa_client",
-			"../../wasm/router_ab_ecdsa_signing_worker",
 			"../../wasm/evm_crypto",
 			"../../wasm/tempo_signer",
 			"../../wasm/shamir3pass_runtime",
@@ -7208,9 +7132,6 @@ async function handleTransactionSigningFlow(ctx, request, worker, opts) {
 		let nearContextFailed = false;
 		const confirmationReadiness = consumeConfirmationReadiness(request.requestId);
 		let confirmationReadinessPending = !!confirmationReadiness;
-		const originalBody = String(transactionSummary.body || "").trim();
-		const confirmationReadinessBody = String(confirmationReadiness?.body || "").trim();
-		const restoreOriginalBody = () => ({ body: originalBody });
 		const confirmationReadinessPromise = confirmationReadiness ? Promise.resolve(confirmationReadiness.promise) : void 0;
 		const walletSessionExpiryPromise = confirmationReadinessPromise ? waitForWalletSessionExpiry(confirmationReadinessPromise) : void 0;
 		const markPromptReady = () => {
@@ -7223,10 +7144,7 @@ async function handleTransactionSigningFlow(ctx, request, worker, opts) {
 			loading: false,
 			onMounted: () => {
 				markPromptReady();
-				if (confirmationReadinessPending && confirmationReadinessBody) session.updateUI({
-					loading: false,
-					body: confirmationReadinessBody
-				});
+				if (confirmationReadinessPending) session.updateUI({ preparing: true });
 			}
 		}) : Promise.resolve({ confirmed: true });
 		if (reviewPromptRequired) promptDecisionPromise.finally(markPromptReady);
@@ -7267,20 +7185,19 @@ async function handleTransactionSigningFlow(ctx, request, worker, opts) {
 		if (confirmationReadinessPromise) confirmationReadinessPromise.then(async () => {
 			confirmationReadinessPending = false;
 			await promptReady;
-			if (decisionResolved || nearContextFailed) return;
-			session.updateUI({
-				...restoreOriginalBody(),
-				loading: false,
-				errorMessage: ""
-			});
+			if (decisionResolved) return;
+			session.updateUI({ preparing: false });
 		}).catch(async (error) => {
 			confirmationReadinessPending = false;
 			await promptReady;
-			if (decisionResolved || nearContextFailed) return;
+			if (decisionResolved) return;
+			if (nearContextFailed) {
+				session.updateUI({ preparing: false });
+				return;
+			}
 			const message = String(toError(error)?.message || "NEAR signing session could not be finalized");
 			session.updateUI({
-				...restoreOriginalBody(),
-				loading: false,
+				preparing: false,
 				errorMessage: `NEAR signing session could not be finalized: ${message}`
 			});
 		});
@@ -7759,13 +7676,13 @@ async function handlePromptFromWorker(ctx, message, worker, options) {
 		switch (request.type) {
 			case UserConfirmationType.AUTHORIZE_KEY_EXPORT:
 			case UserConfirmationType.SHOW_SECURE_PRIVATE_KEY_UI: {
-				const { handleLocalOnlyFlow } = await import("./localOnly-CbLYTVbo.js");
+				const { handleLocalOnlyFlow } = await import("./localOnly-DTpa2jD5.js");
 				await handleLocalOnlyFlow(ctx, request, scopedWorker, flowOptions);
 				break;
 			}
 			case UserConfirmationType.REGISTER_ACCOUNT:
 			case UserConfirmationType.LINK_DEVICE: {
-				const { handleRegistrationFlow } = await import("./registration-DtDICj-o.js").then((n) => n.n);
+				const { handleRegistrationFlow } = await import("./registration-DHERU8R_.js").then((n) => n.n);
 				await handleRegistrationFlow(ctx, request, scopedWorker, flowOptions);
 				break;
 			}
@@ -9280,11 +9197,8 @@ function ecdsaSealedRuntimePurpose(purpose) {
 }
 //#endregion
 //#region src/core/signingEngine/session/warmCapabilities/volatileWarmMaterialCommands.ts
-function asRecord(value) {
-	return typeof value === "object" && value !== null ? value : null;
-}
 function parseVolatileWarmSessionScope(value) {
-	const raw = asRecord(value);
+	const raw = asRecordOrArray(value);
 	if (!raw) return null;
 	if (raw.kind === "all") return { kind: "all" };
 	if (raw.kind !== "session") return null;
@@ -9296,7 +9210,7 @@ function parseVolatileWarmSessionScope(value) {
 	};
 }
 function parseClearVolatileWarmMaterialCommand(value) {
-	const raw = asRecord(value);
+	const raw = asRecordOrArray(value);
 	if (!raw || raw.kind !== "clear_volatile_warm_material") return null;
 	if (raw.durableRecord != null || raw.resolvedIdentity != null || raw.deleteReason != null) return null;
 	const scope = parseVolatileWarmSessionScope(raw.scope);
@@ -10845,7 +10759,7 @@ var PasskeyMpcSessionManagerImpl = class {
 			if (inFlight) return requirePasskeyEcdsaRestoreOutcome(await inFlight, "ready");
 			const task = withThresholdEcdsaSigningQueue({
 				queueByKey: this.deps.thresholdEcdsaSigningQueueByKey,
-				queueKey: resolveThresholdEcdsaSigningQueueKey({ materialActivation: record.roleLocalMaterialRef.materialActivation }),
+				queueKey: resolveThresholdCommitQueueKey({ materialActivation: record.roleLocalMaterialRef.materialActivation }),
 				walletId: toWalletId(args.walletId),
 				enabled: true,
 				task: async () => await this.restorePasskeyEcdsaRecord({
@@ -11241,9 +11155,8 @@ function requireExpectedPasskeyRegistrationUser(input) {
 * and generates credentials, and PRF Outputs
 */
 var TouchIdPrompt = class TouchIdPrompt {
-	constructor(rpIdOverride, safariGetWebauthnRegistrationFallback = false) {
+	constructor(rpIdOverride, _safariGetWebauthnRegistrationFallback = false) {
 		this.rpIdOverride = rpIdOverride;
-		this.safariGetWebauthnRegistrationFallback = safariGetWebauthnRegistrationFallback === true;
 	}
 	getRpId() {
 		try {
@@ -11701,6 +11614,18 @@ const SIGNER_WORKER_KINDS = [
 	"walletCustodyCeremony"
 ];
 const MULTICHAIN_WORKER_DEFAULT_TIMEOUT_MS = 2e4;
+/**
+* A timed-out operation resets its worker, and resetting a presign or
+* derivation worker discards the state other ceremonies hold in it. Name the
+* operation that caused the reset.
+*/
+function warnWorkerOperationTimedOut(kind, type, timeoutMs) {
+	console.warn("[WorkerTransport] operation timed out; resetting worker", {
+		kind,
+		type: String(type),
+		timeoutMs
+	});
+}
 function makeId(prefix) {
 	return secureRandomId(prefix, 32, "signer worker request IDs");
 }
@@ -11805,11 +11730,11 @@ var WorkerTransport = class {
 		return readiness.promise;
 	}
 	/**
-	* Refactor 94C. Initializes the ECDSA derivation and registration WASM
-	* inside the derivation worker during the authentication prompt, so the
-	* first ceremony call after auth does not pay module init (measured 654 ms
-	* cold vs 88 ms warm on `ecdsaRegistrationClientCreateMs`). Fire-and-forget
-	* safe: failure leaves the lazy init path exactly as it was.
+	* Initializes the ECDSA derivation and registration WASM inside the
+	* derivation worker during the authentication prompt, so the first ceremony
+	* call after auth does not pay module init (measured 654 ms cold vs 88 ms
+	* warm on `ecdsaRegistrationClientCreateMs`). Fire-and-forget safe: failure
+	* leaves the lazy init path exactly as it was.
 	*/
 	async prewarmEcdsaRegistrationCrypto() {
 		const existing = this.ecdsaRegistrationCryptoPrewarmPromise;
@@ -11921,6 +11846,7 @@ var WorkerTransport = class {
 					code: "TIMEOUT",
 					workerKind: "nearSigner"
 				}));
+				warnWorkerOperationTimedOut("nearSigner", type, timeoutMs);
 				this.resetWorker("nearSigner");
 				try {
 					const seconds = Math.round(timeoutMs / 1e3);
@@ -11962,6 +11888,7 @@ var WorkerTransport = class {
 					code: "TIMEOUT",
 					workerKind: "ecdsaDerivationClient"
 				}));
+				warnWorkerOperationTimedOut("ecdsaDerivationClient", type, timeoutMs);
 				this.resetWorker("ecdsaDerivationClient");
 			}, timeoutMs);
 			this.getPendingMap("ecdsaDerivationClient").set(requestId, {
@@ -11996,6 +11923,7 @@ var WorkerTransport = class {
 					code: "TIMEOUT",
 					workerKind: kind
 				}));
+				warnWorkerOperationTimedOut(kind, request.type, timeoutMs);
 				this.resetWorker(kind);
 			}, timeoutMs);
 			this.getPendingMap(kind).set(requestId, {
@@ -12038,11 +11966,7 @@ var WorkerTransport = class {
 		return worker;
 	}
 	connectPresignAuthorityChannel(request) {
-		if (request.type === EcdsaPresignClientRequestType.ListAvailable && this.presignAuthorityKind === null) {
-			this.connectDerivationPresignChannel(this.getOrCreateWorker("ecdsaPresignClient"), "role_local_derivation_handle");
-			return;
-		}
-		if (request.type !== EcdsaPresignClientRequestType.SessionInit) return;
+		if (request.type !== EcdsaPresignClientRequestType.ListAvailable && request.type !== EcdsaPresignClientRequestType.SessionInit) return;
 		const presignWorker = this.getOrCreateWorker("ecdsaPresignClient");
 		const authorityKind = this.parsePresignAuthorityKind(request.payload);
 		switch (authorityKind) {
@@ -13174,19 +13098,11 @@ function requireEd25519YaoClientRootEnvelopeV1(envelope) {
 	if (!isEd25519YaoClientRootEnvelopeV1(envelope)) throw new Error("[SigningEngine][ed25519-export] export envelope has the wrong secret kind");
 	return envelope;
 }
-function requireRecord$2(value, label) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
-	return value;
-}
 function requireExactKeys(record, expected, label) {
 	const actual = Object.keys(record).sort();
 	const keys = [...expected].sort();
 	if (actual.length !== keys.length || actual.some((key, index) => key !== keys[index])) throw new Error(`${label} fields are invalid`);
 }
-function requireString$2(value, label) {
-	if (typeof value !== "string" || value.trim() !== value || value.length === 0) throw new Error(`${label} is invalid`);
-	return value;
-}
 function requirePositiveInteger(value, label) {
 	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 1) throw new Error(`${label} is invalid`);
 	return value;
@@ -13226,7 +13142,7 @@ async function readColdExportBootstrap(input) {
 		const failure = raw && typeof raw === "object" ? raw : null;
 		throw new Error(`[SigningEngine][ed25519-export] capability bootstrap failed (HTTP ${response.status}): ${String(failure?.message || "invalid response")}`);
 	}
-	const record = requireRecord$2(raw, "Ed25519 export bootstrap");
+	const record = requireRecord$1(raw, "Ed25519 export bootstrap");
 	requireExactKeys(record, [
 		"kind",
 		"walletId",
@@ -13244,9 +13160,9 @@ async function readColdExportBootstrap(input) {
 		"capability"
 	], "Ed25519 export bootstrap");
 	if (record.kind !== "router_ab_ed25519_yao_v2_session_bootstrap_v1") throw new Error("Ed25519 export bootstrap kind is invalid");
-	const walletId = requireString$2(record.walletId, "bootstrap.walletId");
-	const nearAccountId = requireString$2(record.nearAccountId, "bootstrap.nearAccountId");
-	const nearEd25519SigningKeyId = requireString$2(record.nearEd25519SigningKeyId, "bootstrap.nearEd25519SigningKeyId");
+	const walletId = requireCanonicalString(record.walletId, "bootstrap.walletId");
+	const nearAccountId = requireCanonicalString(record.nearAccountId, "bootstrap.nearAccountId");
+	const nearEd25519SigningKeyId = requireCanonicalString(record.nearEd25519SigningKeyId, "bootstrap.nearEd25519SigningKeyId");
 	const thresholdSessionId = parseThresholdEd25519SessionId(record.thresholdSessionId);
 	const walletSessionId = parseWalletSessionId(record.walletSessionId);
 	const quotaId = parseMpcWalletSigningQuotaId(record.quotaId);
@@ -13260,7 +13176,7 @@ async function readColdExportBootstrap(input) {
 	};
 	const participantIds = requireParticipantIds(record.participantIds);
 	const registeredPublicKeyB64u = base64UrlEncode(Uint8Array.from(capability.registeredPublicKey));
-	if (!thresholdSessionId.ok || !walletSessionId.ok || !quotaId.ok || !signingRoot || !routerAbNormalSigning || walletId !== String(signer.account.wallet.walletId) || nearAccountId !== String(signer.account.nearAccountId) || nearEd25519SigningKeyId !== String(signer.nearEd25519SigningKeyId) || thresholdSessionId.value !== capability.lifecycle.thresholdSessionId || walletSessionId.value !== operationCredential.walletSessionId || quotaId.value !== input.authorization.record.quotaId || requirePositiveInteger(record.signerSlot, "bootstrap.signerSlot") !== signer.signerSlot || requireString$2(record.signingWorkerId, "bootstrap.signingWorkerId") !== binding.signingWorkerId || participantIds[0] !== binding.participantIds[0] || participantIds[1] !== binding.participantIds[1] || authority.factor.providerUserId !== input.subject.auth.providerSubjectId || registeredPublicKeyB64u !== binding.registeredPublicKeyB64u || !mpcMaterialActivationRefsEqual(capability.materialActivation, input.expectedMaterialActivation)) throw new Error("[SigningEngine][ed25519-export] capability bootstrap identity mismatch");
+	if (!thresholdSessionId.ok || !walletSessionId.ok || !quotaId.ok || !signingRoot || !routerAbNormalSigning || walletId !== String(signer.account.wallet.walletId) || nearAccountId !== String(signer.account.nearAccountId) || nearEd25519SigningKeyId !== String(signer.nearEd25519SigningKeyId) || thresholdSessionId.value !== capability.lifecycle.thresholdSessionId || walletSessionId.value !== operationCredential.walletSessionId || quotaId.value !== input.authorization.record.quotaId || requirePositiveInteger(record.signerSlot, "bootstrap.signerSlot") !== signer.signerSlot || requireCanonicalString(record.signingWorkerId, "bootstrap.signingWorkerId") !== binding.signingWorkerId || participantIds[0] !== binding.participantIds[0] || participantIds[1] !== binding.participantIds[1] || authority.factor.providerUserId !== input.subject.auth.providerSubjectId || registeredPublicKeyB64u !== binding.registeredPublicKeyB64u || !mpcMaterialActivationRefsEqual(capability.materialActivation, input.expectedMaterialActivation)) throw new Error("[SigningEngine][ed25519-export] capability bootstrap identity mismatch");
 	return {
 		emailHashHex: authority.verifier.emailHashHex,
 		bootstrap: {
@@ -13333,7 +13249,7 @@ async function readLinkedExportCapability(input) {
 		const failure = raw && typeof raw === "object" ? raw : null;
 		throw new Error(`[SigningEngine][ed25519-export] linked capability bootstrap failed (HTTP ${response.status}): ${String(failure?.message || "invalid response")}`);
 	}
-	const record = requireRecord$2(raw, "linked Ed25519 export bootstrap");
+	const record = requireRecord$1(raw, "linked Ed25519 export bootstrap");
 	requireExactKeys(record, [
 		"kind",
 		"walletId",
@@ -13362,7 +13278,7 @@ async function readLinkedExportCapability(input) {
 	};
 	const participantIds = requireParticipantIds(record.participantIds);
 	const registeredPublicKeyB64u = base64UrlEncode(Uint8Array.from(capability.registeredPublicKey));
-	if (!thresholdSessionId.ok || !walletSessionId.ok || !quotaId.ok || !runtimePolicyScope || !routerAbNormalSigning || requireString$2(record.walletId, "bootstrap.walletId") !== String(signer.account.wallet.walletId) || requireString$2(record.nearAccountId, "bootstrap.nearAccountId") !== String(signer.account.nearAccountId) || requireString$2(record.nearEd25519SigningKeyId, "bootstrap.nearEd25519SigningKeyId") !== String(signer.nearEd25519SigningKeyId) || requirePositiveInteger(record.signerSlot, "bootstrap.signerSlot") !== signer.signerSlot || thresholdSessionId.value !== capability.lifecycle.thresholdSessionId || walletSessionId.value !== operationCredential.walletSessionId || quotaId.value !== input.authorization.record.quotaId || requireString$2(record.signingWorkerId, "bootstrap.signingWorkerId") !== input.source.signingWorkerId || participantIds[0] !== input.source.participantIds[0] || participantIds[1] !== input.source.participantIds[1] || registeredPublicKeyB64u !== input.source.registeredPublicKeyB64u || !mpcMaterialActivationRefsEqual(capability.materialActivation, input.expectedMaterialActivation)) throw new Error("[SigningEngine][ed25519-export] linked capability identity mismatch");
+	if (!thresholdSessionId.ok || !walletSessionId.ok || !quotaId.ok || !runtimePolicyScope || !routerAbNormalSigning || requireCanonicalString(record.walletId, "bootstrap.walletId") !== String(signer.account.wallet.walletId) || requireCanonicalString(record.nearAccountId, "bootstrap.nearAccountId") !== String(signer.account.nearAccountId) || requireCanonicalString(record.nearEd25519SigningKeyId, "bootstrap.nearEd25519SigningKeyId") !== String(signer.nearEd25519SigningKeyId) || requirePositiveInteger(record.signerSlot, "bootstrap.signerSlot") !== signer.signerSlot || thresholdSessionId.value !== capability.lifecycle.thresholdSessionId || walletSessionId.value !== operationCredential.walletSessionId || quotaId.value !== input.authorization.record.quotaId || requireCanonicalString(record.signingWorkerId, "bootstrap.signingWorkerId") !== input.source.signingWorkerId || participantIds[0] !== input.source.participantIds[0] || participantIds[1] !== input.source.participantIds[1] || registeredPublicKeyB64u !== input.source.registeredPublicKeyB64u || !mpcMaterialActivationRefsEqual(capability.materialActivation, input.expectedMaterialActivation)) throw new Error("[SigningEngine][ed25519-export] linked capability identity mismatch");
 	return capability;
 }
 function countExactEd25519ExportSubjects(subjects, expectedMaterialActivation) {
@@ -13694,10 +13610,10 @@ async function readPersistedAvailableSigningLanes$1(deps, args, ecdsaChainTarget
 		...args,
 		ecdsaChainTargets,
 		requiredEcdsaCapability: "sign"
-	}, new WalletSessionStatusReadScope());
+	}, new WalletSessionStatusReadScope(), "all");
 }
 /**
-* R103C human operational read: lanes for one exact owner. The auth-method
+* Human operational read: lanes for one exact owner. The auth-method
 * narrowing and the owner filter both derive from the scope — callers supply
 * nothing the scope does not already carry.
 */
@@ -13709,7 +13625,7 @@ async function readOwnerScopedAvailableSigningLanes(deps, args, statusReads) {
 		ecdsaChainTargets: args.ecdsaChainTargets,
 		requiredEcdsaCapability: args.requiredEcdsaCapability,
 		...args.nowMs !== void 0 ? { nowMs: args.nowMs } : {}
-	}, statusReads);
+	}, statusReads, "all");
 }
 async function readPersistedAvailableSigningLanesForSigning(deps, args, defaultEcdsaChainTargets) {
 	if (args.curve === "ecdsa") {
@@ -13720,7 +13636,7 @@ async function readPersistedAvailableSigningLanesForSigning(deps, args, defaultE
 			...availableLanesArgs,
 			ecdsaChainTargets: [...ecdsaChainTargetsByKey.values()],
 			requiredEcdsaCapability: "sign"
-		}, new WalletSessionStatusReadScope());
+		}, new WalletSessionStatusReadScope(), "ecdsa");
 	}
 	const { curve, ...availableLanesArgs } = args;
 	return await readPersistedAvailableSigningLanes$1(deps, availableLanesArgs, []);
@@ -13745,17 +13661,18 @@ function filterEmailOtpCompanionEcdsaRecords(records, chainTargets) {
 	}
 	return matchingRecords;
 }
-async function readPersistedAvailableSigningLanesForTargets(deps, args, statusReads) {
+async function readPersistedAvailableSigningLanesForTargets(deps, args, statusReads, curves) {
 	const walletId = String(toWalletId(args.walletId)).trim();
 	return await readAvailableSigningLanes({
 		...args,
 		walletId,
 		ecdsaChainTargets: args.ecdsaChainTargets
 	}, {
-		listPublicCapabilityReferences: deps.ed25519YaoPublicCapabilityLanes ? deps.ed25519YaoPublicCapabilityLanes.listLanes.bind(deps.ed25519YaoPublicCapabilityLanes) : void 0,
+		listPublicCapabilityReferences: curves === "all" && deps.ed25519YaoPublicCapabilityLanes ? deps.ed25519YaoPublicCapabilityLanes.listLanes.bind(deps.ed25519YaoPublicCapabilityLanes) : void 0,
 		isPublicCapabilityActive: deps.isEd25519YaoPublicCapabilityActive,
-		readActiveWalletSessionAuthorization: deps.readActiveWalletSessionAuthorization?.bind(null, statusReads),
+		readActiveWalletSessionAuthorization: curves === "all" ? deps.readActiveWalletSessionAuthorization?.bind(null, statusReads) : void 0,
 		listSealedRecordsForWallet: async ({ walletId: recordWalletId, filter }) => {
+			if (curves === "ecdsa") return [];
 			const listByAuthMethod = async (authMethod) => {
 				const ed25519Records = await listExactSealedSessionsForWallet({
 					walletId: recordWalletId,
@@ -14008,7 +13925,7 @@ async function discoverPersistedSessionsForWallet(deps, args) {
 async function readPersistedAvailableSigningLanes(deps, args) {
 	return await readPersistedAvailableSigningLanes$1(deps.availableLanes, args, deps.getConfiguredEcdsaChainTargets());
 }
-/** R103C human operational read: one exact owner, configured ECDSA targets. */
+/** Human operational read: one exact owner, configured ECDSA targets. */
 async function readOwnerScopedSigningLanes(deps, args, statusReads) {
 	return await readOwnerScopedAvailableSigningLanes(deps.availableLanes, {
 		walletId: args.walletId,
@@ -14890,7 +14807,7 @@ async function resolveEcdsaAuthorizationForResolution(args) {
 }
 /** The PRF claim for a resolved ECDSA capability. Correlation has already proved
 * the material, so the claim is the sealed runtime's own allowance and expiry --
-* the same facts the shared Refactor 92 rule classifies. A blocked resolution
+* the same facts the shared runtime-policy rule classifies. A blocked resolution
 * has no runtime and so no claim to report.
 *
 * The wallet-scoped relayer claim is not consulted here. It is read by lane, and
@@ -16020,7 +15937,7 @@ function createEcdsaLoginPrefillClientSigningMaterialSource(args) {
 		destroyClientPresignature: thresholdEcdsaRoleLocalDestroyPresignatureWasm,
 		reserveClientPresignature: thresholdEcdsaRoleLocalReservePresignatureWasm,
 		commitClientPresignature: thresholdEcdsaRoleLocalCommitPresignatureWasm,
-		listAvailableClientPresignatures: thresholdEcdsaRoleLocalListAvailablePresignaturesWasm,
+		listAvailableClientPresignatures: thresholdEcdsaListAvailablePresignaturesWasm.bind(void 0, "role_local_derivation_handle"),
 		computeSignatureShareFromPresignatureHandle: thresholdEcdsaRoleLocalComputeSignatureShareFromPresignatureHandleWasm
 	};
 }
@@ -16823,7 +16740,7 @@ function createRecoveryPublicDeps(args) {
 			}, {
 				...completeConfiguredEcdsaTargets(availableLanesArgs),
 				requiredEcdsaCapability: "export_keys"
-			}, new WalletSessionStatusReadScope()),
+			}, new WalletSessionStatusReadScope(), "all"),
 			readOwnerScopedAvailableSigningLanesForTargets: async (availableLanesArgs) => await readOwnerScopedAvailableSigningLanes({
 				activeWalletAuthorityEcdsaRuntimeReadPorts: browserExactWalletSessionReadPorts,
 				ed25519YaoPublicCapabilityLanes: args.ed25519YaoPublicCapabilityLanes,
@@ -17435,7 +17352,7 @@ async function noWalletPasskeyAuthenticator() {
 	return null;
 }
 /**
-* R103C: the active wallet auth-method store is the one source that resolves
+* The active wallet auth-method store is the one source that resolves
 * an authority reference to its full authority. Sealed-session restores and
 * loose authenticator lists are history and hints; matching against them let
 * a stale or sibling credential answer for the active authority.
@@ -17610,14 +17527,22 @@ async function readBrowserExactNearEd25519WalletSessionAuthorization(relayerUrlI
 	const authorizationNowMs = Date.now();
 	if (status.authorization.expiresAtMs <= authorizationNowMs) return { kind: "expired" };
 	if (status.walletSessionId !== exactRead.operationCredential.walletSessionId || status.quotaId !== exactRead.record.quotaId || status.expiresAtMs !== status.authorization.expiresAtMs || !walletSessionImmutableIdentityMatches(status.authorization, exactRead.record) || !walletSessionMatchesSelectedAuthority(status.authorization, currentSelected)) return { kind: "corrupt" };
+	let replaced;
 	try {
-		await walletSessionAuthorizations.replaceExactActive({
+		replaced = await IndexedDBManager.replaceExactActiveWalletSessionFromStatus({
 			active: status.authorization,
 			operationCredential: exactRead.operationCredential
 		});
 	} catch {
 		return { kind: "persistence_unavailable" };
 	}
+	if (replaced.kind === "superseded") {
+		emitSigningSessionFlowTrace("near", {
+			event: "wallet_session_status_superseded",
+			walletSessionId: exactRead.operationCredential.walletSessionId
+		});
+		return { kind: "unavailable" };
+	}
 	let selectedFactorAuthority;
 	try {
 		selectedFactorAuthority = await resolveBrowserSelectedFactorAuthority(currentSelected);
@@ -17804,8 +17729,9 @@ async function resolveBrowserEcdsaPreprocessingCapability(args, input, statusRea
 		kind: "inactive",
 		reason: "Exact Wallet Session authorization is expired"
 	};
+	let replaced;
 	try {
-		await walletSessionAuthorizations.replaceExactActive({
+		replaced = await IndexedDBManager.replaceExactActiveWalletSessionFromStatus({
 			active: status.authorization,
 			operationCredential: exactAuthorization.operationCredential
 		});
@@ -17815,6 +17741,16 @@ async function resolveBrowserEcdsaPreprocessingCapability(args, input, statusRea
 			reason: "Exact Wallet Session promotion reconciliation could not be persisted"
 		};
 	}
+	if (replaced.kind === "superseded") {
+		emitSigningSessionFlowTrace("evm-family", {
+			event: "wallet_session_status_superseded",
+			walletSessionId: exactAuthorization.operationCredential.walletSessionId
+		});
+		return {
+			kind: "inactive",
+			reason: "Exact Wallet Session status was superseded by a newer wallet authority"
+		};
+	}
 	const authorizationResolution = await buildBrowserEcdsaPreprocessingCapability({
 		context: args,
 		walletId,
@@ -17895,7 +17831,7 @@ async function resolveAmbiguousEcdsaActivationForSelectedAuthMethod(input) {
 		authority: chosen
 	});
 }
-async function resolveBrowserCanonicalEcdsaSigningCapability(args, input) {
+async function resolveBrowserCanonicalEcdsaSigningCapability(_args, input) {
 	const walletId = toWalletId(input.walletId);
 	const subjects = await ecdsaCapabilityManifestStore$2.listActiveWalletCapabilitySubjects(walletId);
 	if (subjects.kind !== "resolved") throw new Error(`ECDSA capability subjects are ${subjects.kind}`);
@@ -19045,12 +18981,9 @@ function requireEmailOtpEcdsaCustodySigner(continuity, walletId, keyHandle) {
 	const first = continuity.signers[0];
 	if (!first) throw new Error("Email OTP ECDSA custody continuity is empty");
 	if (first.walletKey.walletId !== walletId || first.walletKey.keyHandle !== keyHandle) throw new Error("Email OTP ECDSA custody continuity changed the requested wallet key");
-	for (const signer of continuity.signers) if (signer.walletKey.walletId !== first.walletKey.walletId || signer.walletKey.keyHandle !== first.walletKey.keyHandle || signer.walletKey.ecdsaThresholdKeyId !== first.walletKey.ecdsaThresholdKeyId || signer.walletKey.signingRootId !== first.walletKey.signingRootId || signer.walletKey.signingRootVersion !== first.walletKey.signingRootVersion || signer.walletKey.relayerKeyId !== first.walletKey.relayerKeyId || !sameRouterAbEcdsaDerivationPublicCapabilityV1(signer.walletKey.publicCapability, first.walletKey.publicCapability) || !sameRouterAbEcdsaRegistrationActivationReceiptV1(signer.activationReceipt, first.activationReceipt) || !sameEmailOtpRuntimePolicyScope(signer.runtimePolicyScope, first.runtimePolicyScope)) throw new Error("Email OTP ECDSA custody continuity conflicts across targets");
+	for (const signer of continuity.signers) if (signer.walletKey.walletId !== first.walletKey.walletId || signer.walletKey.keyHandle !== first.walletKey.keyHandle || signer.walletKey.ecdsaThresholdKeyId !== first.walletKey.ecdsaThresholdKeyId || signer.walletKey.signingRootId !== first.walletKey.signingRootId || signer.walletKey.signingRootVersion !== first.walletKey.signingRootVersion || signer.walletKey.relayerKeyId !== first.walletKey.relayerKeyId || !sameRouterAbEcdsaDerivationPublicCapabilityV1(signer.walletKey.publicCapability, first.walletKey.publicCapability) || !sameRouterAbEcdsaRegistrationActivationReceiptV1(signer.activationReceipt, first.activationReceipt) || !sameRuntimePolicyScope$1(signer.runtimePolicyScope, first.runtimePolicyScope)) throw new Error("Email OTP ECDSA custody continuity conflicts across targets");
 	return first;
 }
-function sameEmailOtpRuntimePolicyScope(left, right) {
-	return left.orgId === right.orgId && left.projectId === right.projectId && left.envId === right.envId && left.signingRootVersion === right.signingRootVersion;
-}
 function nonEmptyEmailOtpEcdsaChainTargets(continuity) {
 	const [first, ...rest] = continuity.signers;
 	if (!first) throw new Error("Email OTP ECDSA custody continuity is empty");
@@ -19261,7 +19194,7 @@ async function provisionEmailOtpExistingKeySessions(args) {
 		},
 		authorization: additionalAuthorization
 	};
-	const bootstraps = [primaryBootstrap, ...await Promise.all(args.publicationChainTargets.slice(1).map(provisionEmailOtpAdditionalExistingKeySessionForTarget.bind(null, additionalContext)))];
+	const bootstraps = [primaryBootstrap, ...await Promise.all(args.publicationChainTargets.slice(1).map(provisionEmailOtpExistingKeySessionForTarget.bind(null, additionalContext)))];
 	if (!primaryBootstrap) throw new Error("Email OTP ECDSA activation did not return a primary warm session");
 	return bootstraps;
 }
@@ -19283,9 +19216,6 @@ async function provisionEmailOtpExistingKeySessionForTarget(context, chainTarget
 		authorization: context.authorization
 	}));
 }
-async function provisionEmailOtpAdditionalExistingKeySessionForTarget(context, chainTarget) {
-	return await provisionEmailOtpExistingKeySessionForTarget(context, chainTarget);
-}
 async function provisionEmailOtpExplicitExportSession(args) {
 	return await args.ports.provisionEmailOtpEcdsaExplicitExportSession(buildEmailOtpExplicitExportEcdsaActivation({
 		relayerUrl: args.relayerUrl,
@@ -19827,7 +19757,7 @@ async function restoreEmailOtpEcdsaSigningSessionMaterialFromSealedRecord(args)
 	if (sealedRecord.authMethod !== "email_otp" || sealedRecord.curve !== "ecdsa") return null;
 	const materialActivation = sealedRecord.roleLocalMaterialRef.materialActivation;
 	return await args.withThresholdEcdsaSigningQueue({
-		queueKey: resolveThresholdEcdsaSigningQueueKey({ materialActivation }),
+		queueKey: resolveThresholdCommitQueueKey({ materialActivation }),
 		walletId: toWalletId(sealedRecord.walletId),
 		enabled: true,
 		task: async () => await restoreEmailOtpEcdsaSigningSessionMaterialFromSealedRecordInQueue(args)
@@ -20116,7 +20046,7 @@ function buildExportChallengeRoutePlan(ports, args) {
 		});
 	}
 }
-function buildEcdsaExportVerificationRoutePlan(authorization) {
+function buildEcdsaExportVerificationRoutePlan(_authorization) {
 	return buildEmailOtpRoutePlan({
 		routeFamily: "login",
 		operation: WALLET_EMAIL_OTP_EXPORT_OPERATION
@@ -20309,15 +20239,6 @@ var EmailOtpExportRecoveryRuntime = class {
 			buildSigningSessionRoutePlan: buildEmailOtpSigningSessionRoutePlan
 		};
 	}
-	signingSessionWorkerPorts() {
-		return {
-			getSignerWorkerContext: this.ports.getSignerWorkerContext,
-			requireRelayUrl: this.ports.requireRelayUrl,
-			requireSigningSessionSealGroupId: this.ports.requireSigningSessionSealGroupId,
-			resolveSelectedWalletAuthority: this.ports.resolveSelectedWalletAuthority,
-			buildSigningSessionRoutePlan: buildEmailOtpSigningSessionRoutePlan
-		};
-	}
 };
 //#endregion
 //#region src/core/signingEngine/session/emailOtp/runtimeConfig.ts
@@ -20386,33 +20307,6 @@ var EmailOtpSealedRefreshPolicy = class {
 			chainTarget: purpose.chainTarget
 		};
 	}
-	/** Corrupt persisted state or explicit user removal only. Expiry and
-	* exhaustion never reach here. */
-	async deleteEmailOtpDurableSealedSessionRecord(args) {
-		const thresholdSessionId = String(args.purpose.thresholdSessionId || "").trim();
-		if (!thresholdSessionId) {
-			this.ports.clearEcdsaRestoreCaches();
-			return;
-		}
-		const command = createDeleteDurableSealedSessionCommand({
-			durableRecord: {
-				authMethod: "email_otp",
-				curve: "ecdsa",
-				thresholdSessionId,
-				chainTarget: args.purpose.chainTarget
-			},
-			deleteReason: args.deleteReason,
-			preserveResolvedIdentity: false
-		});
-		await this.ports.deleteDurableSealedSessionRecord(command).catch(() => void 0);
-		this.ports.clearEcdsaRestoreCaches();
-	}
-	async recordSessionMaterialClaimed(purpose, result) {
-		await this.recordSessionPolicyResult({
-			purpose,
-			result
-		});
-	}
 	async recordSessionUseConsumed(purpose, result) {
 		await this.recordSessionPolicyResult({
 			purpose,
@@ -20806,10 +20700,9 @@ function warmSessionMaterialTarget(target) {
 	};
 }
 //#endregion
-//#region src/core/signingEngine/session/emailOtp/coordinatorRuntime.ts
-var EmailOtpWalletSessionRuntime = class {
+//#region src/core/signingEngine/session/emailOtp/EmailOtpWalletSessionCoordinator.ts
+var EmailOtpWalletSessionCoordinator = class {
 	constructor(deps) {
-		this.deps = deps;
 		this.sealedRefreshDiagnosticLogAtMsByKey = /* @__PURE__ */ new Map();
 		this.runtimeConfig = new EmailOtpRuntimeConfig({
 			configs: deps.configs,
@@ -20856,7 +20749,6 @@ var EmailOtpWalletSessionRuntime = class {
 		});
 		const warmSessionWorkerClient = createEmailOtpWarmSessionWorkerClient({ worker: deps.signerWorkerManager });
 		this.sealedRefreshPolicy = new EmailOtpSealedRefreshPolicy({
-			deleteDurableSealedSessionRecord: deps.deleteDurableSealedSessionRecord,
 			updateExactSealedSessionPolicy: deps.updateExactSealedSessionPolicy,
 			clearEcdsaRestoreCaches: () => this.clearEcdsaRestoreCaches()
 		});
@@ -20928,49 +20820,6 @@ var EmailOtpWalletSessionRuntime = class {
 	}
 };
 //#endregion
-//#region src/core/signingEngine/session/emailOtp/EmailOtpWalletSessionCoordinator.ts
-var EmailOtpWalletSessionCoordinator = class {
-	constructor(deps) {
-		this.runtime = new EmailOtpWalletSessionRuntime(deps);
-	}
-	persistEcdsaSessionForRefresh(args) {
-		return this.runtime.persistEcdsaSessionForRefresh(args);
-	}
-	discoverPersistedSessionsForWallet(args) {
-		return this.runtime.discoverPersistedSessionsForWallet(args);
-	}
-	restorePersistedSessionForSigning(args) {
-		return this.runtime.restorePersistedSessionForSigning(args);
-	}
-	readWarmSessionStatusOnly(target) {
-		return this.runtime.readWarmSessionStatusOnly(target);
-	}
-	consumeWarmSessionUses(args) {
-		return this.runtime.consumeWarmSessionUses(args);
-	}
-	clearVolatileWarmSessionMaterial(target) {
-		return this.runtime.clearVolatileWarmSessionMaterial(target);
-	}
-	async requestTransactionSigningChallenge(args) {
-		return await this.runtime.requestTransactionSigningChallenge(args);
-	}
-	async requestExportChallenge(args) {
-		return await this.runtime.requestExportChallenge(args);
-	}
-	exportEcdsaKeyWithDurableAuthorization(args) {
-		return this.runtime.exportEcdsaKeyWithDurableAuthorization(args);
-	}
-	exportEd25519YaoSeedWithFreshEmailOtpLane(args) {
-		return this.runtime.exportEd25519YaoSeedWithFreshEmailOtpLane(args);
-	}
-	loginWithEcdsaCapabilityForSigning(args) {
-		return this.runtime.loginWithEcdsaCapabilityForSigning(args);
-	}
-	loginWithEcdsaCapabilityInternal(args) {
-		return this.runtime.loginWithEcdsaCapabilityInternal(args);
-	}
-};
-//#endregion
 //#region src/core/signingEngine/assembly/ports/stepUpRuntime.ts
 function createStepUpRuntime(args) {
 	const emailOtpSessions = new EmailOtpWalletSessionCoordinator({
@@ -21006,7 +20855,6 @@ function createStepUpRuntime(args) {
 		listExactSealedSessionsForWallet: args.sealedSessionStore.listExactSealedSessionsForWallet,
 		acquireSigningSessionRestoreLease: args.sealedSessionStore.acquireSigningSessionRestoreLease,
 		releaseSigningSessionRestoreLease: args.sealedSessionStore.releaseSigningSessionRestoreLease,
-		deleteDurableSealedSessionRecord: args.sealedSessionStore.deleteDurableSealedSessionRecord,
 		updateExactSealedSessionPolicy: args.sealedSessionStore.updateExactSealedSessionPolicy
 	});
 	const passkeyMpcSession = createWarmSessionAwarePasskeyMpcSession({
@@ -22403,11 +22251,9 @@ var BrowserSigningSurface = class {
 			getNearSigningDeps: () => this.enginePorts.nearSigningDeps,
 			getEvmFamilySigningDeps: () => this.enginePorts.tempoSigningDeps
 		});
-		this.signingRuntime = signingRuntime;
 		runtimePortsForUiConfirm.current = signingRuntime.runtimePorts;
 		const ecdsaExportArtifactStore = signingRuntime.state.ecdsaSessions;
 		this.runtimePorts = signingRuntime.runtimePorts;
-		this.thresholdEcdsaExportArtifactByLane = signingRuntime.state.ecdsaSessions.exportArtifactsByLane;
 		const stepUpRuntime = createBrowserStepUpRuntime({
 			seamsWebConfigs: this.seamsWebConfigs,
 			touchIdPrompt: this.touchIdPrompt,
@@ -22858,9 +22704,6 @@ var BrowserSigningSurface = class {
 				throw new Error("Unsupported Ed25519 public capability auth method");
 		}
 	}
-	hasActiveNearEd25519YaoMaterial(args) {
-		return this.enginePorts.ed25519YaoActiveClients.resolve(args) !== null;
-	}
 	async readPersistedAvailableSigningLanes(args) {
 		return await readPersistedAvailableSigningLanes(this.sessionPublicDeps, args);
 	}
@@ -22993,15 +22836,16 @@ var BrowserSigningSurface = class {
 		return { requestOperation: requestWalletCustodyCeremonyOperation.bind(void 0, workerContext) };
 	}
 	/**
-	* Refactor 103 zero-prompt handoff: parks the wallet custody seed inside the
-	* ceremony worker for the lifetime of the just-activated owner Wallet
-	* Session, reusing the factor secret this registration or unlock already
-	* collected. Failure is absorbed: the wallet stays usable, and device
-	* linking fails closed with `wallet_unlock_required` until the next unlock.
+	* Parks the wallet custody seed inside the ceremony worker for the lifetime of
+	* the just-activated owner Wallet Session, reusing the factor secret this
+	* registration or unlock already collected. Failure is absorbed: the wallet
+	* stays usable, and device linking fails closed with `wallet_unlock_required`
+	* until the next unlock.
 	*/
 	async establishUnlockedWalletEd25519ExportRootCapabilityV1(input) {
 		try {
-			if (!isWalletCustodySeedBinding(input.existingEnvelope.binding)) return;
+			const binding = input.existingEnvelope.binding;
+			if (!isWalletCustodySeedBinding(binding) && binding.kind !== "ed25519_yao_client_root_v1") return;
 			if (input.existingEnvelope.factor.kind !== "passkey") throw new Error("unlocked export-root capability requires a passkey envelope factor");
 			const existingFactorSecret = base64UrlDecode(input.passkeyPrfFirstB64u);
 			try {
@@ -23021,7 +22865,7 @@ var BrowserSigningSurface = class {
 		}
 	}
 	/**
-	* Stores a resealed pre-109C envelope under the method that opened it.
+	* Stores the reseal of an unbound envelope under the method that opened it.
 	*
 	* Absorbed the same way establishment is, and for the same reason: the V2 row
 	* still opens the wallet, so a failure here costs a retry at the next unlock
@@ -23140,18 +22984,15 @@ var BrowserSigningSurface = class {
 		const rehydrationKey = nearEd25519CapabilityRehydrationKey(subject);
 		const existingRehydration = this.nearEd25519CapabilityRehydrationBySubject.get(rehydrationKey);
 		if (existingRehydration) {
-			const reboundSubject = await existingRehydration;
-			const rehydrated = await this.resolveActiveNearEd25519YaoSigningLane(reboundSubject);
+			const rebound = await existingRehydration;
+			const rehydrated = await this.resolveActiveNearEd25519YaoSigningLane(rebound.subject);
 			if (rehydrated) return rehydrated;
 			throw new Error("[SigningEngine][near] joined rehydration did not publish an active lane");
 		}
 		const rehydration = this.rehydrateNearEd25519YaoCapabilityForSigning(subject);
 		this.nearEd25519CapabilityRehydrationBySubject.set(rehydrationKey, rehydration);
 		try {
-			const reboundSubject = await rehydration;
-			const rehydrated = await this.resolveActiveNearEd25519YaoSigningLane(reboundSubject);
-			if (rehydrated) return rehydrated;
-			throw new Error("[SigningEngine][near] local material rehydration did not publish a lane");
+			return (await rehydration).material;
 		} finally {
 			if (this.nearEd25519CapabilityRehydrationBySubject.get(rehydrationKey) === rehydration) this.nearEd25519CapabilityRehydrationBySubject.delete(rehydrationKey);
 		}
@@ -24477,7 +24318,14 @@ var BrowserSigningSurface = class {
 				passkeyPrfFirstB64u: warmSessionClaim.prfFirstB64u
 			} : { kind: "unavailable" }
 		});
-		if (liveHydration.kind === "live") return subject;
+		if (liveHydration.kind === "live") {
+			const material = await this.resolveActiveNearEd25519YaoSigningLane(subject);
+			if (!material) throw new Error("[SigningEngine][near] local material rehydration did not publish a lane");
+			return {
+				subject,
+				material
+			};
+		}
 		if (liveHydration.kind === "rehydrated") {
 			if (!warmSessionClaim.ok) {
 				liveHydration.activeClient.dispose();
@@ -24510,8 +24358,12 @@ var BrowserSigningSurface = class {
 					subject,
 					walletSessionState
 				});
-				if (!await this.resolveActiveNearEd25519YaoSigningLane(reboundSubject)) throw new Error("[SigningEngine][near] local material rehydration did not publish an active lane");
-				return reboundSubject;
+				const published = await this.resolveActiveNearEd25519YaoSigningLane(reboundSubject);
+				if (!published) throw new Error("[SigningEngine][near] local material rehydration did not publish an active lane");
+				return {
+					subject: reboundSubject,
+					material: published
+				};
 			} catch (error) {
 				liveHydration.activeClient.dispose();
 				throw error;
@@ -24658,7 +24510,7 @@ var BrowserSigningSurface = class {
 	async withExactEd25519MaterialOwner(args) {
 		return await withThresholdEd25519CommitQueue({
 			queueByKey: this.thresholdEd25519CommitQueueByKey,
-			queueKey: resolveThresholdEd25519CommitQueueKey({ materialActivation: args.materialActivation }),
+			queueKey: resolveThresholdCommitQueueKey({ materialActivation: args.materialActivation }),
 			nearAccountId: args.nearAccountId,
 			enabled: true,
 			task: args.task
@@ -24811,8 +24663,8 @@ var BrowserSigningSurface = class {
 		}, args.walletSession, args.providerSubjectId, activation);
 	}
 	/**
-	* R109C: what an owner authority needs to have its Ed25519 runtime built
-	* inside the unlock that verifies its factor.
+	* What an owner authority needs to have its Ed25519 runtime built inside the
+	* unlock that verifies its factor.
 	*
 	* Assembled here rather than by the caller because every field is read off
 	* the exact authority projection - the identity, its runtime policy scope,
@@ -24854,7 +24706,7 @@ var BrowserSigningSurface = class {
 		};
 	}
 	/**
-	* R109C: activate the runtime an owner authority's unlock built.
+	* Activate the runtime an owner authority's unlock built.
 	*
 	* The identity it is checked against comes from the same authority projection
 	* that produced the unlock request, not from the bootstrap being checked -
@@ -24957,7 +24809,7 @@ var BrowserSigningSurface = class {
 		if (args.credentialExpectation.kind === "expect_exact_operation_credential" && (args.credentialExpectation.operationCredential.walletSessionId !== exactAuthorization.operationCredential.walletSessionId || args.credentialExpectation.operationCredential.token !== exactAuthorization.operationCredential.token)) throw new Error("[SigningEngine][near] expected Email OTP operation credential changed");
 		return await withThresholdEd25519CommitQueue({
 			queueByKey: this.thresholdEd25519CommitQueueByKey,
-			queueKey: resolveThresholdEd25519CommitQueueKey({ materialActivation: args.metadata.materialActivation }),
+			queueKey: resolveThresholdCommitQueueKey({ materialActivation: args.metadata.materialActivation }),
 			nearAccountId: toAccountId(args.bootstrap.session.nearAccountId),
 			enabled: args.commitQueue === "acquire",
 			task: async () => {
@@ -25177,7 +25029,7 @@ var BrowserSigningSurface = class {
 		this.ed25519YaoPageLifecycleOwner.dispose();
 	}
 	clearThresholdEcdsaSigningQueue() {
-		clearThresholdEcdsaSigningQueue(this.thresholdEcdsaSigningQueueByKey);
+		clearThresholdCommitQueue(this.thresholdEcdsaSigningQueueByKey);
 	}
 	async clearLinkedEcdsaHolderMaterials() {
 		await clearLinkedDeviceEcdsaHolderMaterialsWasm({ workerCtx: this.signerWorkerManager.getContext() });
@@ -25240,8 +25092,8 @@ async function persistFinalizedPasskeyAuthMethodV1(args) {
 	await IndexedDBManager.upsertWalletAuthMethod(localPasskeyAuthMethodFromFinalizeV1(args));
 }
 /**
-* Refactor 109C: the full local install for a passkey added to a wallet that
-* registered with another family.
+* The full local install for a passkey added to a wallet that registered with
+* another family.
 *
 * Three records, and unlock needs all of them. It reads the profile, then the
 * profile's authenticators, then keeps only those whose credential belongs to
@@ -25482,7 +25334,7 @@ async function linkWalletPasskeyCustody(input) {
 //#endregion
 //#region src/SeamsWeb/operations/authMethods/addAuthMethodSourceClaim.ts
 /**
-* Refactor 109C: the source claim a same-device addition puts in its intent.
+* The source claim a same-device addition puts in its intent.
 *
 * The intent digest is what the fresh source proof signs, so every identity the
 * proof is meant to bind has to be inside it. The server resolves the true
@@ -25675,7 +25527,7 @@ async function addPasskeyWalletAuthMethodInternal(args) {
 	}
 }
 /**
-* Refactor 109C's `email_otp_to_passkey` branch.
+* The `email_otp_to_passkey` addition branch.
 *
 * The Email OTP method that already unlocks this wallet authorizes adding a
 * passkey. Three things stay exactly as they are in the Passkey-source branch,
@@ -25797,7 +25649,7 @@ async function addPasskeyWalletAuthMethod(args) {
 //#endregion
 //#region src/SeamsWeb/operations/authMethods/revokeAuthMethod.ts
 /**
-* Refactor 109C: remove one auth method using a different active one.
+* Remove one auth method using a different active one.
 *
 * The inverse of the two addition branches, and the reason they are safe to
 * offer: a wallet that can gain a second way in must be able to lose one it no
@@ -25987,8 +25839,8 @@ async function revokeWalletAuthMethodOperation(args) {
 //#endregion
 //#region src/core/signingEngine/walletCustody/emailOtpLink.ts
 /**
-* Refactor 109C: sealing the wallet's existing custody seed under a newly
-* verified Email OTP factor.
+* Sealing the wallet's existing custody seed under a newly verified
+* Email OTP factor.
 *
 * The mirror of `passkeyLink`, and deliberately the same shape: open the source
 * envelope with the factor secret the caller already collected, reseal the same
@@ -26361,7 +26213,7 @@ function warnIfSameOriginWallet(walletOrigin) {
 }
 async function createWalletIframeRouter(args) {
 	warnIfSameOriginWallet(args.walletOrigin);
-	const { WalletIframeRouter } = await import("./router-CeFS9SgT.js");
+	const { WalletIframeRouter } = await import("./router-B4ZWFy9E.js");
 	const signingSessionPersistenceMode = args.configs.signing.sessionPersistenceMode;
 	return new WalletIframeRouter({
 		walletOrigin: args.walletOrigin,
@@ -26662,12 +26514,12 @@ function createSigningRuntimeStatePorts() {
 }
 function createSigningRuntime(deps) {
 	const getWarmSessions = memoizeService(async () => {
-		const { createWarmSessionHydrationService } = await import("./warmSessionHydration-DDNYdTCz.js");
+		const { createWarmSessionHydrationService } = await import("./warmSessionHydration-Os8niEm7.js");
 		return createWarmSessionHydrationService({ getWarmSessionMaterialWriter: deps.ui.warmSessions.getWarmSessionMaterialWriter });
 	});
 	const warmSessions = { hydrateSigningSession: async (input) => (await getWarmSessions()).hydrateSigningSession(input) };
 	const getRegistrationAccounts = memoizeService(async () => {
-		const { createRegistrationAccountsService } = await import("./registrationAccounts-AO3QHjas.js");
+		const { createRegistrationAccountsService } = await import("./registrationAccounts-DmWPzf3T.js");
 		return createRegistrationAccountsService(deps.registration.accountLifecycle);
 	});
 	const registrationAccounts = {
@@ -26691,7 +26543,7 @@ function createSigningRuntime(deps) {
 		rollbackWalletEd25519SignerRegistration: async (receipt) => (await getRegistrationAccounts()).rollbackWalletEd25519SignerRegistration(receipt)
 	};
 	const getEcdsaWalletRecords = memoizeService(async () => {
-		const { createEcdsaWalletRecordsService } = await import("./ecdsaWalletRecords-CAbbVhEY.js");
+		const { createEcdsaWalletRecordsService } = await import("./ecdsaWalletRecords-D42rtA9z.js");
 		return createEcdsaWalletRecordsService({ accountLifecycle: deps.registration.accountLifecycle });
 	});
 	const ecdsaWalletRecords = {
@@ -26702,32 +26554,32 @@ function createSigningRuntime(deps) {
 		storeWalletEmailOtpEcdsaRegistrationData: async (input) => (await getEcdsaWalletRecords()).storeWalletEmailOtpEcdsaRegistrationData(input)
 	};
 	const nearSigning = { signNear: async (request) => {
-		const { signNear } = await import("./signNear-DVD9-IO5.js").then((n) => n.n);
+		const { signNear } = await import("./signNear-Bmb2fj_a.js").then((n) => n.n);
 		return signNear(deps.signing.near.getDeps(), request);
 	} };
 	const evmFamilySigning = {
 		signEvmFamily: async (args) => {
-			const { signEvmFamily } = await import("./signEvmFamily-pbMepepQ.js").then((n) => n.s);
+			const { signEvmFamily } = await import("./signEvmFamily-C3C97Th-.js").then((n) => n.s);
 			return signEvmFamily(deps.signing.evmFamily.getDeps(), args);
 		},
 		reportTempoBroadcastAccepted: async (args) => {
-			const { reportTempoBroadcastAccepted } = await import("./signEvmFamily-pbMepepQ.js").then((n) => n.s);
+			const { reportTempoBroadcastAccepted } = await import("./signEvmFamily-C3C97Th-.js").then((n) => n.s);
 			return reportTempoBroadcastAccepted(deps.signing.evmFamily.getDeps(), args);
 		},
 		reportTempoBroadcastRejected: async (args) => {
-			const { reportTempoBroadcastRejected } = await import("./signEvmFamily-pbMepepQ.js").then((n) => n.s);
+			const { reportTempoBroadcastRejected } = await import("./signEvmFamily-C3C97Th-.js").then((n) => n.s);
 			return reportTempoBroadcastRejected(deps.signing.evmFamily.getDeps(), args);
 		},
 		reportTempoFinalized: async (args) => {
-			const { reportTempoFinalized } = await import("./signEvmFamily-pbMepepQ.js").then((n) => n.s);
+			const { reportTempoFinalized } = await import("./signEvmFamily-C3C97Th-.js").then((n) => n.s);
 			return reportTempoFinalized(deps.signing.evmFamily.getDeps(), args);
 		},
 		reportTempoDroppedOrReplaced: async (args) => {
-			const { reportTempoDroppedOrReplaced } = await import("./signEvmFamily-pbMepepQ.js").then((n) => n.s);
+			const { reportTempoDroppedOrReplaced } = await import("./signEvmFamily-C3C97Th-.js").then((n) => n.s);
 			return reportTempoDroppedOrReplaced(deps.signing.evmFamily.getDeps(), args);
 		},
 		reconcileTempoNonceLane: async (args) => {
-			const { reconcileTempoNonceLane } = await import("./signEvmFamily-pbMepepQ.js").then((n) => n.s);
+			const { reconcileTempoNonceLane } = await import("./signEvmFamily-C3C97Th-.js").then((n) => n.s);
 			return reconcileTempoNonceLane(deps.signing.evmFamily.getDeps(), args);
 		}
 	};
@@ -26779,6 +26631,30 @@ function createBrowserSigningRuntime(args) {
 	});
 }
 //#endregion
+//#region src/SeamsWeb/walletIframe/host/restoredSessionPresignaturePrefill.ts
+async function scheduleRestoredSessionPresignaturePrefills(args) {
+	switch (args.state.kind) {
+		case "active_session": break;
+		case "wallet_unlocked_without_signing_session":
+			if (args.state.reason !== "exhausted") return;
+			break;
+		case "wallet_locked":
+		case "wallet_authenticated_identity_unresolvable":
+		case "expired_session": return;
+		default:
+			args.state;
+			return;
+	}
+	const walletSession = walletSessionRefFromSession({ walletId: args.state.walletId });
+	const statusReads = new WalletSessionStatusReadScope();
+	const prefills = [];
+	for (const chainTarget of args.chainTargets) prefills.push(args.prefill({
+		walletSession,
+		chainTarget
+	}, statusReads));
+	await Promise.all(prefills);
+}
+//#endregion
 //#region src/SeamsWeb/assembly/createBrowserSigningStores.ts
 function createBrowserSigningStores(indexedDB) {
 	return {
@@ -26806,7 +26682,6 @@ function createBrowserSigningStores(indexedDB) {
 			listEcdsaSealedSessionsForWallet,
 			acquireSigningSessionRestoreLease,
 			releaseSigningSessionRestoreLease,
-			deleteDurableSealedSessionRecord,
 			updateExactSealedSessionPolicy
 		},
 		ed25519YaoPublicCapabilityReferences: new IndexedDbEd25519YaoPublicCapabilityReferenceStore(indexedDB)
@@ -26826,6 +26701,58 @@ function initializeBrowserSigningRuntime(args) {
 	if (!(args.config.wallet.mode === "iframe" && !__isWalletIframeHostMode())) args.userPreferencesManager.initFromIndexedDB().catch(() => void 0);
 }
 //#endregion
+//#region src/SeamsWeb/operations/auth/scheduleLinkedDevicePresignaturePrefill.ts
+async function scheduleLinkedDevicePresignaturePrefill(args) {
+	try {
+		const scope = args.runtime.activationReceipt.normalSigning.scope;
+		const material = buildRouterAbEcdsaDerivationSigningMaterialRef({ routerAbState: args.runtime.activationReceipt.normalSigning });
+		const keyHandle = await deriveEvmFamilyEcdsaKeyHandle({
+			ecdsaThresholdKeyId: scope.ecdsa_threshold_key_id,
+			signingRootId: scope.signing_root_id,
+			signingRootVersion: scope.signing_root_version
+		});
+		if (resolveLinkedEcdsaHolderRuntimeV1(args.runtime) !== args.runtime) return;
+		const result = scheduleRouterAbEcdsaDerivationClientPresignaturePoolRefill({
+			relayerUrl: args.relayerUrl,
+			keyHandle: parseEcdsaKeyHandle(keyHandle),
+			ecdsaThresholdKeyId: material.ecdsaThresholdKeyId,
+			clientVerifyingShareB64u: material.clientVerifier33B64u,
+			clientSigningMaterial: createLinkedHolderClientSigningMaterialSource(args.runtime.holderHandleId),
+			thresholdEcdsaPublicKeyB64u: material.thresholdVerifier33B64u,
+			relayerVerifyingShareB64u: material.serverVerifier33B64u,
+			credential: {
+				kind: "wallet_session_opaque",
+				walletSessionToken: args.operationCredential.token
+			},
+			authorization: {
+				kind: "reusable_wallet_session",
+				wallet_session_id: args.operationCredential.walletSessionId
+			},
+			materialActivation: routerAbMpcMaterialActivationRefToWire(args.runtime.materialActivation),
+			routerAbEcdsaDerivationPoolFill: {
+				kind: "router_ab_ecdsa_derivation_signing_worker_pool",
+				scope,
+				ceremonyExpiresAtMs: args.expiresAtMs,
+				materialExpiresAtMs: Date.now() + MAX_DURABLE_CLIENT_PRESIGNATURE_LIFETIME_MS
+			},
+			workerCtx: args.workerCtx
+		});
+		emitSigningSessionFlowTrace("evm-family", {
+			event: "ecdsa_linked_device_prefill",
+			scheduled: result.scheduled,
+			reason: result.reason,
+			depth: result.depth,
+			targetDepth: result.targetDepth
+		});
+	} catch {
+		emitSigningSessionFlowTrace("evm-family", {
+			event: "ecdsa_linked_device_prefill",
+			scheduled: false,
+			reason: "unexpected_error"
+		});
+	}
+}
+//#endregion
 //#region src/SeamsWeb/operations/session/thresholdWarmSessionBootstrap.ts
 function assertNeverNormalSigning(value) {
 	throw new Error(`Unexpected Router A/B normal-signing config branch: ${String(value)}`);
@@ -27276,7 +27203,7 @@ async function collectFreshLocalPasskeyUnlockCredential(args) {
 //#endregion
 //#region src/SeamsWeb/operations/auth/walletUnlockEcdsaSubject.ts
 const ecdsaCapabilityManifestStore$1 = new IndexedDbEcdsaCapabilityManifestStore();
-async function listEvmFamilyEcdsaWalletUnlockSubjects(walletId) {
+async function resolveEvmFamilyEcdsaWalletUnlockSubjects(walletId) {
 	const resolved = await ecdsaCapabilityManifestStore$1.listActiveWalletCapabilitySubjects(walletId);
 	if (resolved.kind === "persistence_unavailable") return {
 		kind: "failed",
@@ -27299,9 +27226,6 @@ async function listEvmFamilyEcdsaWalletUnlockSubjects(walletId) {
 		subjects
 	};
 }
-async function resolveEvmFamilyEcdsaWalletUnlockSubjects(walletId) {
-	return await listEvmFamilyEcdsaWalletUnlockSubjects(walletId);
-}
 async function resolveEcdsaActivationJournalSelectors(walletId) {
 	return await ecdsaCapabilityManifestStore$1.listWalletActivationJournalSelectors(walletId);
 }
@@ -27803,27 +27727,6 @@ function walletAuthMethodBindingFromRecord(record) {
 		default: return null;
 	}
 }
-async function exactPasskeyWalletAuthMethodForCredential(args) {
-	const matches = (await IndexedDBManager.listWalletAuthMethodsV2ForWallet(String(args.walletId))).filter((record) => record.kind === "passkey" && record.status === "active" && record.walletId === args.walletId && String(record.rpId) === args.rpId && String(record.credentialIdB64u) === args.credentialIdB64u);
-	const [record] = matches;
-	if (matches.length !== 1 || !record) throw new Error("[login] passkey authority requires one exact active V2 auth method");
-	return record;
-}
-async function exactPasskeyWalletAuthAuthorityRefForCredential(args) {
-	const record = await exactPasskeyWalletAuthMethodForCredential(args);
-	return await walletAuthAuthorityRef({ authority: {
-		walletId: record.walletId,
-		factor: {
-			kind: "passkey",
-			credentialIdB64u: record.credentialIdB64u
-		},
-		verifier: {
-			kind: "webauthn",
-			rpId: record.rpId
-		},
-		bindingId: record.walletAuthMethodId
-	} });
-}
 function walletAuthAuthorityForSelectedPasskeyMethod(record) {
 	return {
 		walletId: record.walletId,
@@ -28918,12 +28821,21 @@ async function activateLinkedDeviceSignerRuntimesAfterLink(args) {
 			...providerIdentity ? { providerIdentity } : {}
 		});
 		const ecdsaMaterial = linkedDeviceEcdsaMaterial(openedMaterials);
-		if (ecdsaMaterial) await activateLinkedDeviceEcdsaHolderRuntime({
-			context: args.context,
-			selection,
-			factorAuthority,
-			material: ecdsaMaterial
-		});
+		if (ecdsaMaterial) {
+			const { runtime } = await activateLinkedDeviceEcdsaHolderRuntime({
+				context: args.context,
+				selection,
+				factorAuthority,
+				material: ecdsaMaterial
+			});
+			scheduleLinkedDevicePresignaturePrefill({
+				runtime,
+				operationCredential: args.operationCredential,
+				expiresAtMs: args.walletSession.expiresAtMs,
+				relayerUrl,
+				workerCtx: args.context.signingEngine.getSignerWorkerContext()
+			});
+		}
 		const ed25519Material = linkedDeviceEd25519Material(openedMaterials);
 		if (ed25519Material) {
 			const session = await linkedDeviceEd25519SessionAfterLink({
@@ -28951,7 +28863,7 @@ async function activateLinkedDeviceSignerRuntimesAfterLink(args) {
 				walletSessionId: String(args.operationCredential.walletSessionId),
 				expiresAtMs: args.walletSession.expiresAtMs
 			});
-			else if (isWalletCustodySeedBinding(selection.exportRoot.envelope.binding)) await establishUnlockedWalletEd25519ExportRootCapabilityV1(walletCustodyCeremonyTransportFromWorkerContextV1(args.context.signingEngine.getSignerWorkerContext()), {
+			else if (isWalletCustodySeedBinding(selection.exportRoot.envelope.binding) || selection.exportRoot.envelope.binding.kind === "ed25519_yao_client_root_v1") await establishUnlockedWalletEd25519ExportRootCapabilityV1(walletCustodyCeremonyTransportFromWorkerContextV1(args.context.signingEngine.getSignerWorkerContext()), {
 				existingEnvelope: selection.exportRoot.envelope,
 				existingFactorSecret: args.factorSecret32,
 				walletId: String(selection.walletId),
@@ -29188,7 +29100,7 @@ function pendingNearRegistrationMatchesAuthority(selection, activation, pending)
 	return pending.operation === "near_provisioning" && pending.phase === "joined" && pending.signerPlanKind === "near_ed25519_and_evm_family_ecdsa" && pending.walletId === selection.walletId && pending.walletAuthMethodId === selection.authMethod.walletAuthMethodId && mpcMaterialActivationRefsEqual(pending.localMaterial.ed25519.metadata.materialActivation, activation);
 }
 /**
-* R109C: install the Ed25519 runtime an owner authority's unlock just built.
+* Install the Ed25519 runtime an owner authority's unlock just built.
 *
 * Everything is checked against the authority and method that were selected,
 * before the handle is used: a session naming a different method, or a
@@ -29574,7 +29486,7 @@ async function unlockLinkedDevicePasskey(context, walletIdInput, options) {
 		});
 	}
 }
-async function unlockInternal(context, subjectSet, options, completion) {
+async function unlockInternal(context, subjectSet, options, _completion) {
 	const { onEvent, onError, afterCall } = options || {};
 	const { signingEngine } = context;
 	const walletUnlockSelection = resolveLoginWalletUnlockSelectionForSubjectSet({
@@ -29723,10 +29635,6 @@ async function unlockInternal(context, subjectSet, options, completion) {
 				identity: walletIdentity,
 				context: storedCanonicalEcdsaContext
 			});
-			buildConfiguredTargetKeyCompletion({
-				context: storedCanonicalEcdsaContext,
-				configuredTargets: warmupInput.selectedEcdsaTargets
-			});
 			const canFirstBootstrapThresholdEcdsa = Boolean(managedRuntimeScopeBootstrap);
 			const warmupPlan = resolveThresholdLoginWarmupPlan({
 				selection: warmupInput.selection,
@@ -32217,7 +32125,7 @@ async function logout(context) {
 }
 async function resumeNearAfterSuccessfulUnlock(args) {
 	try {
-		await (await import("./registration-PIBMSsQR.js").then((n) => n.o)).resumeNearRegistrationAfterUnlock(args);
+		await (await import("./registration-Ct_7LdGf.js").then((n) => n.o)).resumeNearRegistrationAfterUnlock(args);
 	} catch (error) {
 		console.warn("[login] NEAR continuation could not start", error instanceof Error ? error.message : "module unavailable");
 	} finally {
@@ -32341,7 +32249,7 @@ async function getRecentUnlocksDomain(deps) {
 	}
 	return await getRecentUnlocks(deps.getContext());
 }
-async function prefillRouterAbEcdsaDerivationPresignaturePoolDomain(deps, args) {
+async function prefillRouterAbEcdsaDerivationPresignaturePoolDomain(deps, args, statusReads) {
 	if (deps.walletIframe.shouldUseWalletIframe()) return await (await deps.walletIframe.requireRouter(args.walletSession.walletId)).prefillRouterAbEcdsaDerivationPresignaturePool({
 		walletSession: args.walletSession,
 		options: {
@@ -32354,7 +32262,7 @@ async function prefillRouterAbEcdsaDerivationPresignaturePoolDomain(deps, args)
 		walletId,
 		chainTarget: args.chainTarget,
 		...typeof args.waitForPoolReady === "boolean" ? { waitForPoolReady: args.waitForPoolReady } : {}
-	}, new WalletSessionStatusReadScope());
+	}, statusReads);
 }
 //#endregion
 //#region src/SeamsWeb/publicApi/transactionReview.ts
@@ -32372,7 +32280,7 @@ function createAuthCapability(deps) {
 		getWalletSession: async (walletId) => await getWalletSessionDomain(deps.getWalletAuthDeps(), walletId),
 		getRecentUnlocks: async () => await getRecentUnlocksDomain(deps.getWalletAuthDeps()),
 		hasPasskeyCredential: async (walletId) => await hasPasskeyCredentialDomain(deps.getWalletAuthDeps(), walletId),
-		prefillRouterAbEcdsaDerivationPresignaturePool: async (args) => await prefillRouterAbEcdsaDerivationPresignaturePoolDomain(deps.getWalletAuthDeps(), args),
+		prefillRouterAbEcdsaDerivationPresignaturePool: async (args) => await prefillRouterAbEcdsaDerivationPresignaturePoolDomain(deps.getWalletAuthDeps(), args, new WalletSessionStatusReadScope()),
 		requestEmailOtpChallenge: deps.domain.requestEmailOtpChallenge,
 		requestEmailOtpSigningSessionChallenge: deps.domain.requestEmailOtpSigningSessionChallenge,
 		refreshEmailOtpSigningSession: deps.domain.refreshEmailOtpSigningSession,
@@ -32690,7 +32598,7 @@ async function requestDeviceV1(input) {
 	const publishableKey = input.options.publishableKey.trim();
 	const projectEnvironmentId = input.options.projectEnvironmentId.trim();
 	if (!publishableKey || !projectEnvironmentId) throw new Error("linked-device Passkey ceremony requires registration API credentials");
-	const bodyDigestB64u = parseDigestB64u(base64UrlEncode(await sha256Bytes(encodeRequestBodyV1(input.body))));
+	const bodyDigestB64u = await sha256DigestB64u(encodeRequestBodyV1(input.body));
 	const issuedAtMs = input.options.nowMs();
 	if (!Number.isSafeInteger(issuedAtMs) || issuedAtMs <= 0) throw new Error("linked-device request clock is invalid");
 	const expiresAtMs = issuedAtMs + LINKED_DEVICE_REQUEST_PROOF_MAX_TTL_MS_V1;
@@ -32798,7 +32706,7 @@ async function createPollingSubscriptionV1(input) {
 function parseSessionMutationEnvelopeV1(raw) {
 	const record = asPlainDeviceLinkingResponse(raw);
 	if (record === null) throw new Error("linked-device response must be an object");
-	if (!hasExactKeys$1(record, SESSION_MUTATION_RESPONSE_FIELDS)) throw new Error("linked-device response contains invalid fields");
+	if (!hasExactResponseKeys(record, SESSION_MUTATION_RESPONSE_FIELDS)) throw new Error("linked-device response contains invalid fields");
 	if (record.ok !== true) throw new Error("linked-device response outcome is invalid");
 	switch (record.outcome) {
 		case "applied": return {
@@ -32817,7 +32725,7 @@ function parseSessionMutationEnvelopeV1(raw) {
 function parseTargetCredentialRegistrationResponseV1(raw) {
 	const record = asPlainDeviceLinkingResponse(raw);
 	if (record === null) throw new Error("linked-device target credential response must be an object");
-	if (!hasExactKeys$1(record, TARGET_CREDENTIAL_RESPONSE_FIELDS)) throw new Error("linked-device target credential response contains invalid fields");
+	if (!hasExactResponseKeys(record, TARGET_CREDENTIAL_RESPONSE_FIELDS)) throw new Error("linked-device target credential response contains invalid fields");
 	if (record.ok !== true) throw new Error("linked-device target credential response outcome is invalid");
 	switch (record.outcome) {
 		case "applied": return parseTargetCredentialRegistrationResponseBranch(record, "applied");
@@ -32835,20 +32743,20 @@ function parseTargetCredentialRegistrationResponseBranch(record, outcome) {
 function parseHttpFailureMessageV1(response) {
 	const record = asPlainDeviceLinkingResponse(response.body);
 	if (record === null || record.ok !== false) return `linked-device request failed with HTTP ${response.status}`;
-	if (hasExactKeys$1(record, CODED_FAILURE_RESPONSE_FIELDS) && typeof record.code === "string" && typeof record.message === "string" && record.message.trim()) return `linked-device request failed: ${record.message}`;
-	if (hasExactKeys$1(record, OUTCOME_FAILURE_RESPONSE_FIELDS) && typeof record.outcome === "string" && typeof record.code === "string" && typeof record.message === "string" && record.message.trim()) return `linked-device request failed: ${record.message}`;
+	if (hasExactResponseKeys(record, CODED_FAILURE_RESPONSE_FIELDS) && typeof record.code === "string" && typeof record.message === "string" && record.message.trim()) return `linked-device request failed: ${record.message}`;
+	if (hasExactResponseKeys(record, OUTCOME_FAILURE_RESPONSE_FIELDS) && typeof record.outcome === "string" && typeof record.code === "string" && typeof record.message === "string" && record.message.trim()) return `linked-device request failed: ${record.message}`;
 	switch (record.outcome) {
 		case "conflict":
-			if (hasExactKeys$1(record, SESSION_CONFLICT_FAILURE_FIELDS)) return "linked-device request failed: conflict";
+			if (hasExactResponseKeys(record, SESSION_CONFLICT_FAILURE_FIELDS)) return "linked-device request failed: conflict";
 			break;
 		case "expired":
-			if (hasExactKeys$1(record, SESSION_EXPIRED_FAILURE_FIELDS)) return "linked-device request failed: expired";
+			if (hasExactResponseKeys(record, SESSION_EXPIRED_FAILURE_FIELDS)) return "linked-device request failed: expired";
 			break;
 		case "invalid_state":
-			if (hasExactKeys$1(record, SESSION_INVALID_STATE_FAILURE_FIELDS)) return "linked-device request failed: invalid_state";
+			if (hasExactResponseKeys(record, SESSION_INVALID_STATE_FAILURE_FIELDS)) return "linked-device request failed: invalid_state";
 			break;
 		case "integrity_error":
-			if (hasExactKeys$1(record, SESSION_INTEGRITY_FAILURE_FIELDS)) return "linked-device request failed: integrity_error";
+			if (hasExactResponseKeys(record, SESSION_INTEGRITY_FAILURE_FIELDS)) return "linked-device request failed: integrity_error";
 			break;
 		default: break;
 	}
@@ -32866,11 +32774,9 @@ function isPlainDeviceLinkingResponse(value) {
 		return false;
 	}
 }
-function hasExactKeys$1(record, expectedKeys) {
+function hasExactResponseKeys(record, expectedKeys) {
 	try {
-		const actualKeys = Object.keys(record).sort();
-		const expected = [...expectedKeys].sort();
-		return actualKeys.length === expected.length && actualKeys.every((key, index) => key === expected[index]);
+		return hasExactKeys(record, expectedKeys);
 	} catch {
 		return false;
 	}
@@ -33340,7 +33246,7 @@ function buildDeviceLinkingEd25519ExportRootReplacementEnvelopeV1(input) {
 function createDeviceLinkingEd25519ExportRootPortV1(worker) {
 	return {
 		async createRecipientV1(input) {
-			const created = requireRecord$1(await worker.requestOperation({
+			const created = requireRecord(await worker.requestOperation({
 				kind: "walletCustodyCeremony",
 				request: {
 					type: "createLinkedDeviceEd25519ExportRootRecipient",
@@ -33381,7 +33287,7 @@ function createDeviceLinkingEd25519ExportRootPortV1(worker) {
 				registeredPublicKeyB64u: recipient.registeredPublicKeyB64u,
 				recipientPublicKeyB64u: recipient.recipientPublicKeyB64u
 			});
-			const sealed = requireRecord$1(await worker.requestOperation({
+			const sealed = requireRecord(await worker.requestOperation({
 				kind: "walletCustodyCeremony",
 				request: {
 					type: "sealEd25519ExportRootForLinkedDevice",
@@ -33440,7 +33346,7 @@ function createDeviceLinkingEd25519ExportRootPortV1(worker) {
 			});
 			const replacementFactorSecret = input.replacementFactorSecret.slice();
 			try {
-				const resealed = requireRecord$1(await worker.requestOperation({
+				const resealed = requireRecord(await worker.requestOperation({
 					kind: "walletCustodyCeremony",
 					request: {
 						type: "acceptLinkedDeviceEd25519ExportRoot",
@@ -33501,7 +33407,7 @@ function replacementEnvelopeFactorMatchesTargetFactor(targetFactor, replacementF
 function assertNeverLinkedDeviceTargetFactor(value) {
 	throw new Error(`Unsupported linked-device target factor kind: ${String(value)}`);
 }
-function requireRecord$1(value, label) {
+function requireRecord(value, label) {
 	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} returned no result`);
 	return value;
 }
@@ -33546,7 +33452,7 @@ function buildDeviceLinkingPendingAcknowledgementV1(acknowledgement) {
 }
 function parseDeviceLinkingPendingAcknowledgementV1(raw) {
 	const record = asPlainDeviceLinkingResumeRecord(raw);
-	if (record === null || !hasExactKeys(record, PENDING_ACKNOWLEDGEMENT_FIELDS) || record.kind !== "linked_device_pending_ack_v1") return null;
+	if (record === null || !hasExactKeys(record, PENDING_ACKNOWLEDGEMENT_FIELDS) || record.kind !== LINKED_DEVICE_PENDING_ACK_KIND_V1) return null;
 	try {
 		return {
 			kind: LINKED_DEVICE_PENDING_ACK_KIND_V1,
@@ -33638,7 +33544,7 @@ function compareDeviceLinkingCommittedResumeV1(input) {
 }
 function parseDeviceLinkingCommittedResumeV1(raw) {
 	const record = asPlainDeviceLinkingResumeRecord(raw);
-	if (record === null || !hasExactKeys(record, COMMITTED_RESUME_FIELDS) || record.kind !== "linked_device_committed_resume_v1") return null;
+	if (record === null || !hasExactKeys(record, COMMITTED_RESUME_FIELDS) || record.kind !== LINKED_DEVICE_COMMITTED_RESUME_KIND_V1) return null;
 	const linkSessionId = parseLinkDeviceSessionId(record.linkSessionId);
 	const walletId = parseWalletId(record.walletId);
 	const enrollmentId = parseLinkedDeviceEnrollmentId(record.enrollmentId);
@@ -33710,11 +33616,6 @@ function isPlainDeviceLinkingResumeRecord(value) {
 		return false;
 	}
 }
-function hasExactKeys(record, expectedKeys) {
-	const actual = Object.keys(record).sort();
-	const expected = [...expectedKeys].sort();
-	return actual.length === expected.length && actual.every((key, index) => key === expected[index]);
-}
 function sameSignerActivations(left, right) {
 	const leftBytes = encodeWalletSignerActivationSetV1(left);
 	const rightBytes = encodeWalletSignerActivationSetV1(right);
@@ -34154,7 +34055,7 @@ function signerMaterialActivations(activations) {
 	throw new Error("committed signer activation families are invalid");
 }
 //#endregion
-//#region src/SeamsWeb/operations/devices/linkDevice.ts
+//#region src/SeamsWeb/operations/devices/linkDeviceFlowSupport.ts
 function linkedDeviceWalletAuthenticationState(walletSession, registration) {
 	switch (registration.targetFactor.kind) {
 		case "verified_passkey_target_v1": return {
@@ -34170,12 +34071,6 @@ function linkedDeviceWalletAuthenticationState(walletSession, registration) {
 		default: return registration.targetFactor;
 	}
 }
-function isPasskeyTargetPreparation(preparation) {
-	return preparation.targetFactor.kind === "passkey_prf";
-}
-function isEmailOtpTargetPreparation(preparation) {
-	return preparation.targetFactor.kind === "email_otp";
-}
 function createLinkSessionId() {
 	const parsed = parseLinkDeviceSessionId(secureRandomId("link-session", 32));
 	if (!parsed.ok) throw new Error(parsed.error.message);
@@ -34266,6 +34161,36 @@ async function generateQrCodeDataUrlV1(payload) {
 		margin: 2
 	});
 }
+function buildDevice2QrSessionPayloadV1(input) {
+	const requestedPermission = buildFullOwnerDelegatedWalletAuthorityV1();
+	if (input.target.targetFactor.kind === "email_otp") return buildQrLinkedDeviceSessionPayloadV5({
+		linkSessionId: input.linkSessionId,
+		linkPublicKeyB64u: input.linkPublicKeyB64u,
+		devicePublicKeyB64u: input.devicePublicKeyB64u,
+		requestedPermission,
+		targetFactor: { kind: "email_otp" },
+		targetEmail: normalizeLinkedDeviceTargetEmailAddressV1(input.target.targetEmail),
+		issuedAtMs: input.issuedAtMs,
+		expiresAtMs: input.expiresAtMs
+	});
+	return buildQrLinkedDeviceSessionPayloadV5({
+		linkSessionId: input.linkSessionId,
+		linkPublicKeyB64u: input.linkPublicKeyB64u,
+		devicePublicKeyB64u: input.devicePublicKeyB64u,
+		requestedPermission,
+		targetFactor: { kind: "passkey_prf" },
+		issuedAtMs: input.issuedAtMs,
+		expiresAtMs: input.expiresAtMs
+	});
+}
+//#endregion
+//#region src/SeamsWeb/operations/devices/linkDeviceTargetActivation.ts
+function isPasskeyTargetPreparation(preparation) {
+	return preparation.targetFactor.kind === "passkey_prf";
+}
+function isEmailOtpTargetPreparation(preparation) {
+	return preparation.targetFactor.kind === "email_otp";
+}
 function emailOtpTargetActivationBaseContextV1(context) {
 	return {
 		event: context.event,
@@ -34297,7 +34222,7 @@ function resolvePostLinkActivationV1(input) {
 	switch (input.targetFactor.kind) {
 		case "verified_passkey_target_v1": {
 			const activation = input.targetCredentialActivationState;
-			if (activation.kind !== "factor_ready" && activation.kind !== "consuming" || activation.runEpoch !== input.runEpoch) throw new Error("linked-device Passkey factor runtime is unavailable");
+			if (activation.kind !== "factor_ready" || activation.runEpoch !== input.runEpoch) throw new Error("linked-device Passkey factor runtime is unavailable");
 			return {
 				factor: {
 					kind: "passkey",
@@ -34368,32 +34293,12 @@ async function prepareNewEmailOtpEnrollmentMaterialV1(input) {
 		zeroizeLiveBytes$1(disposableSecret);
 	}
 }
-function buildDevice2QrSessionPayloadV1(input) {
-	const requestedPermission = buildFullOwnerDelegatedWalletAuthorityV1();
-	if (input.target.targetFactor.kind === "email_otp") return buildQrLinkedDeviceSessionPayloadV5({
-		linkSessionId: input.linkSessionId,
-		linkPublicKeyB64u: input.linkPublicKeyB64u,
-		devicePublicKeyB64u: input.devicePublicKeyB64u,
-		requestedPermission,
-		targetFactor: { kind: "email_otp" },
-		targetEmail: normalizeLinkedDeviceTargetEmailAddressV1(input.target.targetEmail),
-		issuedAtMs: input.issuedAtMs,
-		expiresAtMs: input.expiresAtMs
-	});
-	return buildQrLinkedDeviceSessionPayloadV5({
-		linkSessionId: input.linkSessionId,
-		linkPublicKeyB64u: input.linkPublicKeyB64u,
-		devicePublicKeyB64u: input.devicePublicKeyB64u,
-		requestedPermission,
-		targetFactor: { kind: "passkey_prf" },
-		issuedAtMs: input.issuedAtMs,
-		expiresAtMs: input.expiresAtMs
-	});
-}
 function requireNewEmailOtpEnrollmentMaterialV1(value) {
 	if (!value) throw new Error("new linked-device Email OTP enrollment material is unavailable");
 	return value;
 }
+//#endregion
+//#region src/SeamsWeb/operations/devices/linkDeviceFlow.ts
 var LinkDeviceFlow = class {
 	constructor(options, ports, getAuthenticationContext = null) {
 		this.session = null;
@@ -34562,15 +34467,8 @@ var LinkDeviceFlow = class {
 					case "claimed":
 					case "awaiting_target_factor":
 					case "awaiting_source_contribution":
-					case "provisioning": {
-						const identity = await this.resolveLinkIdentityV1(session.linkSessionId);
-						await authenticatedTransport.cancelSessionV1({ request: buildLinkedDeviceSessionCancelClaimedRequestV1({
-							linkSessionId: session.linkSessionId,
-							enrollmentId: identity.enrollmentId,
-							deviceId: identity.deviceId,
-							reason: "user_cancelled",
-							requestedAtMs: now
-						}) });
+					case "provisioning":
+						await this.cancelClaimedSessionV1(authenticatedTransport, session.linkSessionId, now);
 						this.session = {
 							...session,
 							state: {
@@ -34579,7 +34477,6 @@ var LinkDeviceFlow = class {
 							}
 						};
 						break;
-					}
 					case "authority_pending_local_install": break;
 					case "active":
 					case "expired":
@@ -34601,16 +34498,6 @@ var LinkDeviceFlow = class {
 			}
 		});
 	}
-	async reset() {
-		if (this.hasCommittedDeliveryState()) throw new Error("Device-link authority delivery is committed and must be resumed");
-		this.runEpoch += 1;
-		this.cancelled = true;
-		await this.cleanupLocalResources();
-		this.session = null;
-		this.error = void 0;
-		this.cancelled = false;
-		this.handledStates.clear();
-	}
 	async resolveLinkIdentityV1(linkSessionId) {
 		const cached = this.targetCredentialRegistrationResult;
 		if (cached && cached.linkSessionId === linkSessionId) return {
@@ -34628,6 +34515,16 @@ var LinkDeviceFlow = class {
 			deviceId: preparation.deviceId
 		};
 	}
+	async cancelClaimedSessionV1(transport, linkSessionId, requestedAtMs) {
+		const identity = await this.resolveLinkIdentityV1(linkSessionId);
+		await transport.cancelSessionV1({ request: buildLinkedDeviceSessionCancelClaimedRequestV1({
+			linkSessionId,
+			enrollmentId: identity.enrollmentId,
+			deviceId: identity.deviceId,
+			reason: "user_cancelled",
+			requestedAtMs
+		}) });
+	}
 	async handleSessionEvent(event) {
 		if (this.cancelled || this.deliveryRecoveryReason !== null || !this.session || event.linkSessionId !== this.session.linkSessionId) return;
 		logDevice2LinkingStageV1({
@@ -34682,14 +34579,9 @@ var LinkDeviceFlow = class {
 				await this.finishActiveAuthorityV1(event.state, result.session, result.operationCredential, runEpoch);
 				return;
 			}
-			case "active": {
-				const result = await this.activateAuthorityForStateV1(event.state, runEpoch);
-				if (result.kind === "pending_local_install") return;
-				if (result.kind === "integrity_error") throw new DeviceLinkingError(`Linked-device authority replay failed: ${result.reason}`, DeviceLinkingErrorCode.REGISTRATION_FAILED, "registration");
-				if (result.kind === "failed_before_commit" || result.kind === "relink_required") throw new DeviceLinkingError("Linked-device authority replay cannot continue", DeviceLinkingErrorCode.REGISTRATION_FAILED, "registration");
-				await this.finishActiveAuthorityV1(event.state, result.session, result.operationCredential, runEpoch);
+			case "active":
+				await this.replayCommittedAuthorityV1(event.state, runEpoch);
 				return;
-			}
 			case "expired": {
 				const error = new DeviceLinkingError("Device-link session expired", DeviceLinkingErrorCode.SESSION_EXPIRED, "registration");
 				this.error = error;
@@ -34852,25 +34744,7 @@ var LinkDeviceFlow = class {
 				workerEphemeralPublicKey65B64u
 			} });
 			this.assertCurrentRun(context.runEpoch);
-			this.emailOtpTargetActivationState = {
-				kind: "awaiting_code",
-				context: {
-					event: context.event,
-					state: context.state,
-					runEpoch: context.runEpoch,
-					deviceId: context.deviceId,
-					preparation: context.preparation,
-					ordinarySignerMaterialRecipientRequests: context.ordinarySignerMaterialRecipientRequests,
-					exportRoot: context.exportRoot,
-					challenge
-				}
-			};
-			this.notifyEmailOtpActivationV1({
-				kind: "code_input",
-				maskedEmailHint: challenge.maskedEmailHint,
-				expiresAtMs: challenge.expiresAtMs,
-				resendAvailableAtMs: challenge.resendAvailableAtMs
-			});
+			this.awaitTargetEmailOtpCodeV1(context, challenge);
 		} catch (error) {
 			if (this.isCurrentRun(context.runEpoch)) {
 				this.emailOtpTargetActivationState = {
@@ -34885,6 +34759,21 @@ var LinkDeviceFlow = class {
 			throw error;
 		}
 	}
+	awaitTargetEmailOtpCodeV1(context, challenge) {
+		this.emailOtpTargetActivationState = {
+			kind: "awaiting_code",
+			context: {
+				...emailOtpTargetActivationBaseContextV1(context),
+				challenge
+			}
+		};
+		this.notifyEmailOtpActivationV1({
+			kind: "code_input",
+			maskedEmailHint: challenge.maskedEmailHint,
+			expiresAtMs: challenge.expiresAtMs,
+			resendAvailableAtMs: challenge.resendAvailableAtMs
+		});
+	}
 	resendTargetEmailOtpCodeV1() {
 		const state = this.emailOtpTargetActivationState;
 		if (state.kind === "resending") return state.promise;
@@ -34914,25 +34803,7 @@ var LinkDeviceFlow = class {
 				challengeId: context.challenge.challengeId
 			} });
 			this.assertCurrentRun(context.runEpoch);
-			this.emailOtpTargetActivationState = {
-				kind: "awaiting_code",
-				context: {
-					event: context.event,
-					state: context.state,
-					runEpoch: context.runEpoch,
-					deviceId: context.deviceId,
-					preparation: context.preparation,
-					ordinarySignerMaterialRecipientRequests: context.ordinarySignerMaterialRecipientRequests,
-					exportRoot: context.exportRoot,
-					challenge
-				}
-			};
-			this.notifyEmailOtpActivationV1({
-				kind: "code_input",
-				maskedEmailHint: challenge.maskedEmailHint,
-				expiresAtMs: challenge.expiresAtMs,
-				resendAvailableAtMs: challenge.resendAvailableAtMs
-			});
+			this.awaitTargetEmailOtpCodeV1(context, challenge);
 		} catch (error) {
 			if (this.isCurrentRun(context.runEpoch)) {
 				const message = errorMessage(error) || "Email OTP resend is unavailable";
@@ -35063,32 +34934,14 @@ var LinkDeviceFlow = class {
 					enrollmentId: emailOtpEnrollmentId,
 					enrollmentSealKeyVersion: emailOtpEnrollmentSealKeyVersion
 				});
-				const binding = buildEd25519YaoClientRootBinding({
-					linkSessionId: preparation.linkSessionId,
-					walletKeyId: exportRoot.walletKeyId,
-					targetFactor: preparation.targetFactor,
-					applicationBindingDigestB64u: exportRoot.applicationBindingDigestB64u,
-					registeredPublicKeyB64u: exportRoot.registeredPublicKeyB64u,
-					enrollmentId: preparation.enrollmentId,
-					deviceId: preparation.deviceId,
-					revocationEpoch: exportRoot.revocationEpoch
-				});
-				this.resealedExportRoot = await acceptLinkedDeviceEd25519ExportRootV1({
-					ed25519ExportRoot: this.ports.ed25519ExportRoot,
-					transport: this.requireAuthenticatedTransport(),
+				this.resealedExportRoot = await this.acceptTargetExportRootV1({
+					preparation,
+					exportRoot,
 					recipient,
-					replacementEnvelope: buildDeviceLinkingEd25519ExportRootReplacementEnvelopeV1({
-						walletId: preparation.walletId,
-						ownership: buildMethodBoundEnvelopeOwnership(preparation.walletAuthMethodId),
-						envelopeId,
-						factor,
-						binding,
-						createdAtMs: Date.now()
-					}),
+					envelopeId,
+					factor,
 					replacementFactorSecret: new Uint8Array(factorSecret),
-					expiresAtMs: Math.min(preparation.expiresAtMs, this.requireSessionV1().qrData.expiresAtMs),
-					assertCurrentRun: () => this.assertCurrentRun(context.runEpoch),
-					waitForPollV1: waitForSessionStateRetry
+					runEpoch: context.runEpoch
 				});
 				recipient = null;
 			}
@@ -35180,9 +35033,6 @@ var LinkDeviceFlow = class {
 			case "factor_ready":
 				if (this.targetCredentialActivationState.runEpoch === input.runEpoch) return Promise.reject(/* @__PURE__ */ new Error("Device-link target passkey activation has already completed"));
 				return Promise.reject(new LinkDeviceFlowSupersededError());
-			case "consuming":
-				if (this.targetCredentialActivationState.runEpoch === input.runEpoch) return Promise.reject(/* @__PURE__ */ new Error("Device-link target passkey activation is already being consumed"));
-				return Promise.reject(new LinkDeviceFlowSupersededError());
 			default: return assertNeverTargetCredentialActivationState(this.targetCredentialActivationState);
 		}
 		const activation = this.runTargetCredentialActivation(input);
@@ -35231,27 +35081,9 @@ var LinkDeviceFlow = class {
 			default: throw new Error("linked-device target factor is unsupported");
 		}
 	}
-	claimTargetCredentialFactorSecret(runEpoch) {
-		switch (this.targetCredentialActivationState.kind) {
-			case "idle": return null;
-			case "in_progress": throw new Error("Device-link target passkey activation is still in progress");
-			case "factor_ready": {
-				if (this.targetCredentialActivationState.runEpoch !== runEpoch) throw new LinkDeviceFlowSupersededError();
-				const factorSecret = this.targetCredentialActivationState.factorSecret;
-				this.targetCredentialActivationState = {
-					kind: "consuming",
-					runEpoch,
-					factorSecret
-				};
-				return factorSecret;
-			}
-			case "consuming": throw new Error("Device-link target passkey activation is already being consumed");
-			default: return assertNeverTargetCredentialActivationState(this.targetCredentialActivationState);
-		}
-	}
 	clearTargetCredentialActivationState() {
 		const state = this.targetCredentialActivationState;
-		if (state.kind === "factor_ready" || state.kind === "consuming") zeroizeLiveBytes$1(state.factorSecret);
+		if (state.kind === "factor_ready") zeroizeLiveBytes$1(state.factorSecret);
 		this.targetCredentialActivationState = { kind: "idle" };
 	}
 	async createTargetCredential(input) {
@@ -35318,32 +35150,14 @@ var LinkDeviceFlow = class {
 					rpId: requireTargetRpIdV1(preparation),
 					credentialIdB64u: credential.webauthnRegistration.credentialIdB64u
 				});
-				const binding = buildEd25519YaoClientRootBinding({
-					linkSessionId: preparation.linkSessionId,
-					walletKeyId: exportRoot.walletKeyId,
-					targetFactor: preparation.targetFactor,
-					applicationBindingDigestB64u: exportRoot.applicationBindingDigestB64u,
-					registeredPublicKeyB64u: exportRoot.registeredPublicKeyB64u,
-					enrollmentId: preparation.enrollmentId,
-					deviceId: preparation.deviceId,
-					revocationEpoch: exportRoot.revocationEpoch
-				});
-				const resealed = await acceptLinkedDeviceEd25519ExportRootV1({
-					ed25519ExportRoot: this.ports.ed25519ExportRoot,
-					transport: authenticatedTransport,
+				const resealed = await this.acceptTargetExportRootV1({
+					preparation,
+					exportRoot,
 					recipient,
-					replacementEnvelope: buildDeviceLinkingEd25519ExportRootReplacementEnvelopeV1({
-						walletId: preparation.walletId,
-						ownership: buildMethodBoundEnvelopeOwnership(preparation.walletAuthMethodId),
-						envelopeId,
-						factor,
-						binding,
-						createdAtMs: Date.now()
-					}),
+					envelopeId,
+					factor,
 					replacementFactorSecret: credential.factorSecret,
-					expiresAtMs: Math.min(preparation.expiresAtMs, this.session.qrData.expiresAtMs),
-					assertCurrentRun: () => this.assertCurrentRun(runEpoch),
-					waitForPollV1: waitForSessionStateRetry
+					runEpoch
 				});
 				logDevice2LinkingStageV1({
 					flowId: this.flowId,
@@ -35394,6 +35208,36 @@ var LinkDeviceFlow = class {
 			throw error;
 		}
 	}
+	async acceptTargetExportRootV1(input) {
+		const { preparation, exportRoot } = input;
+		const binding = buildEd25519YaoClientRootBinding({
+			linkSessionId: preparation.linkSessionId,
+			walletKeyId: exportRoot.walletKeyId,
+			targetFactor: preparation.targetFactor,
+			applicationBindingDigestB64u: exportRoot.applicationBindingDigestB64u,
+			registeredPublicKeyB64u: exportRoot.registeredPublicKeyB64u,
+			enrollmentId: preparation.enrollmentId,
+			deviceId: preparation.deviceId,
+			revocationEpoch: exportRoot.revocationEpoch
+		});
+		return await acceptLinkedDeviceEd25519ExportRootV1({
+			ed25519ExportRoot: this.ports.ed25519ExportRoot,
+			transport: this.requireAuthenticatedTransport(),
+			recipient: input.recipient,
+			replacementEnvelope: buildDeviceLinkingEd25519ExportRootReplacementEnvelopeV1({
+				walletId: preparation.walletId,
+				ownership: buildMethodBoundEnvelopeOwnership(preparation.walletAuthMethodId),
+				envelopeId: input.envelopeId,
+				factor: input.factor,
+				binding,
+				createdAtMs: Date.now()
+			}),
+			replacementFactorSecret: input.replacementFactorSecret,
+			expiresAtMs: Math.min(preparation.expiresAtMs, this.requireSessionV1().qrData.expiresAtMs),
+			assertCurrentRun: () => this.assertCurrentRun(input.runEpoch),
+			waitForPollV1: waitForSessionStateRetry
+		});
+	}
 	assertTargetPreparationMatchesSession(input) {
 		const sessionTargetFactor = this.requireSessionTargetFactorV1();
 		const qrData = this.requireSessionV1().qrData;
@@ -35493,10 +35337,7 @@ var LinkDeviceFlow = class {
 			acknowledgedAtMs: Date.now()
 		};
 		await this.ports.authorityInstallation.persistPendingActivationAcknowledgementV1({ acknowledgement });
-		await this.closeSessionSubscriptionV1();
-		await this.requireAuthenticatedTransport().acknowledgeLocalAuthorityActivationV1({ acknowledgement });
-		await this.ports.authorityInstallation.clearPendingActivationAcknowledgementV1({ authorityId: acknowledgement.authorityId });
-		await this.ports.authorityInstallation.clearCommittedDeliveryResumeV1({ authorityId: acknowledgement.authorityId });
+		await this.sendActivationAcknowledgementV1(acknowledgement);
 		this.session = activeSession;
 		authenticationContext.signingEngine.setWalletAuthenticated(linkedDeviceWalletAuthenticationState(walletSession, registration));
 		await this.cleanupCompletedLocalResources();
@@ -35546,13 +35387,9 @@ var LinkDeviceFlow = class {
 		return preparation;
 	}
 	startRun() {
-		this.clearTargetCredentialActivationState();
-		this.clearEmailOtpTargetActivationState();
-		this.resealedExportRoot = null;
-		this.targetCredentialRegistrationResult = null;
+		this.clearRunActivationStateV1();
 		this.committedAuthorityPackages = null;
 		this.deliveryRecoveryReason = null;
-		this.ordinarySignerMaterialRecipientPreparation = null;
 		this.runEpoch += 1;
 		this.generationInProgress = true;
 		this.cancelled = false;
@@ -35640,12 +35477,8 @@ var LinkDeviceFlow = class {
 				error: cleanupError
 			});
 		}
-		this.clearTargetCredentialActivationState();
-		this.clearEmailOtpTargetActivationState();
-		this.resealedExportRoot = null;
-		this.targetCredentialRegistrationResult = null;
+		this.clearRunActivationStateV1();
 		this.committedAuthorityPackages = null;
-		this.ordinarySignerMaterialRecipientPreparation = null;
 		this.keyMaterialHandle = null;
 		this.deliveryRecipientPublicKey65B64u = null;
 		this.authenticatedTransport = null;
@@ -35658,18 +35491,19 @@ var LinkDeviceFlow = class {
 		switch (event.state.state) {
 			case "provisioning":
 			case "authority_pending_local_install":
-			case "active": {
-				const runEpoch = this.runEpoch;
-				const result = await this.activateAuthorityForStateV1(event.state, runEpoch);
-				if (result.kind === "pending_local_install") return;
-				if (result.kind === "integrity_error") throw new DeviceLinkingError(`Linked-device authority replay failed: ${result.reason}`, DeviceLinkingErrorCode.REGISTRATION_FAILED, "registration");
-				if (result.kind === "failed_before_commit" || result.kind === "relink_required") throw new DeviceLinkingError("Linked-device authority replay cannot continue", DeviceLinkingErrorCode.REGISTRATION_FAILED, "registration");
-				await this.finishActiveAuthorityV1(event.state, result.session, result.operationCredential, runEpoch);
+			case "active":
+				await this.replayCommittedAuthorityV1(event.state, this.runEpoch);
 				return;
-			}
 			default: throw new Error(`committed link delivery cannot resume from ${event.state.state}`);
 		}
 	}
+	async replayCommittedAuthorityV1(state, runEpoch) {
+		const result = await this.activateAuthorityForStateV1(state, runEpoch);
+		if (result.kind === "pending_local_install") return;
+		if (result.kind === "integrity_error") throw new DeviceLinkingError(`Linked-device authority replay failed: ${result.reason}`, DeviceLinkingErrorCode.REGISTRATION_FAILED, "registration");
+		if (result.kind === "failed_before_commit" || result.kind === "relink_required") throw new DeviceLinkingError("Linked-device authority replay cannot continue", DeviceLinkingErrorCode.REGISTRATION_FAILED, "registration");
+		await this.finishActiveAuthorityV1(state, result.session, result.operationCredential, runEpoch);
+	}
 	async replayPendingActivationAcknowledgementV1() {
 		const committed = this.committedAuthorityPackages;
 		if (!committed) return false;
@@ -35677,12 +35511,15 @@ var LinkDeviceFlow = class {
 		if (!pending) return false;
 		const session = this.requireSessionV1();
 		if (pending.linkSessionId !== session.qrData.linkSessionId || pending.authorityId !== committed.authority.authorityId || pending.packageSetDigestB64u !== committed.packageSetDigestB64u) throw new Error("pending linked-device acknowledgement identity is inconsistent");
-		await this.closeSessionSubscriptionV1();
-		await this.requireAuthenticatedTransport().acknowledgeLocalAuthorityActivationV1({ acknowledgement: pending });
-		await this.ports.authorityInstallation.clearPendingActivationAcknowledgementV1({ authorityId: pending.authorityId });
-		await this.ports.authorityInstallation.clearCommittedDeliveryResumeV1({ authorityId: pending.authorityId });
+		await this.sendActivationAcknowledgementV1(pending);
 		return true;
 	}
+	async sendActivationAcknowledgementV1(acknowledgement) {
+		await this.closeSessionSubscriptionV1();
+		await this.requireAuthenticatedTransport().acknowledgeLocalAuthorityActivationV1({ acknowledgement });
+		await this.ports.authorityInstallation.clearPendingActivationAcknowledgementV1({ authorityId: acknowledgement.authorityId });
+		await this.ports.authorityInstallation.clearCommittedDeliveryResumeV1({ authorityId: acknowledgement.authorityId });
+	}
 	async cancelFailedPrecommitSession(event) {
 		const transport = this.authenticatedTransport;
 		if (!transport) return;
@@ -35692,14 +35529,7 @@ var LinkDeviceFlow = class {
 			case "awaiting_source_contribution":
 			case "provisioning": {
 				const cancelledAtMs = Date.now();
-				const identity = await this.resolveLinkIdentityV1(event.linkSessionId);
-				await transport.cancelSessionV1({ request: buildLinkedDeviceSessionCancelClaimedRequestV1({
-					linkSessionId: event.linkSessionId,
-					enrollmentId: identity.enrollmentId,
-					deviceId: identity.deviceId,
-					reason: "user_cancelled",
-					requestedAtMs: cancelledAtMs
-				}) });
+				await this.cancelClaimedSessionV1(transport, event.linkSessionId, cancelledAtMs);
 				if (this.session?.linkSessionId === event.linkSessionId) this.session = {
 					...this.session,
 					state: {
@@ -35721,13 +35551,7 @@ var LinkDeviceFlow = class {
 	async cleanupLocalResources(force = false) {
 		if (!force && this.hasCommittedDeliveryState()) return;
 		const preserveCommittedState = force && this.hasCommittedDeliveryState();
-		if (!preserveCommittedState) {
-			this.clearTargetCredentialActivationState();
-			this.clearEmailOtpTargetActivationState();
-			this.resealedExportRoot = null;
-			this.targetCredentialRegistrationResult = null;
-			this.ordinarySignerMaterialRecipientPreparation = null;
-		}
+		if (!preserveCommittedState) this.clearRunActivationStateV1();
 		let failure;
 		const subscription = this.subscription;
 		if (subscription) try {
@@ -35743,14 +35567,17 @@ var LinkDeviceFlow = class {
 		}
 		if (failure) throw failure;
 		if (preserveCommittedState) {
-			this.clearTargetCredentialActivationState();
-			this.clearEmailOtpTargetActivationState();
-			this.resealedExportRoot = null;
-			this.targetCredentialRegistrationResult = null;
-			this.ordinarySignerMaterialRecipientPreparation = null;
+			this.clearRunActivationStateV1();
 			this.committedAuthorityPackages = null;
 		}
 	}
+	clearRunActivationStateV1() {
+		this.clearTargetCredentialActivationState();
+		this.clearEmailOtpTargetActivationState();
+		this.resealedExportRoot = null;
+		this.targetCredentialRegistrationResult = null;
+		this.ordinarySignerMaterialRecipientPreparation = null;
+	}
 	async closeSessionSubscriptionV1() {
 		const subscription = this.subscription;
 		if (!subscription) return;
@@ -35809,6 +35636,8 @@ var LinkDeviceFlow = class {
 		}));
 	}
 };
+//#endregion
+//#region src/SeamsWeb/operations/devices/linkDevice.ts
 function isFinishedDeviceLinkFlow(flow) {
 	const state = flow.getState();
 	if (state.cancelled || state.error || !state.session) return true;
@@ -37017,7 +36846,8 @@ async function signNEP413Message(args) {
 		};
 	}
 }
-Object.freeze({ kind: "threshold_secp256k1_ecdsa_2p_v1" });
+//#endregion
+//#region ../shared-ts/src/threshold/secp256k1.ts
 const THRESHOLD_SECP256K1_ECDSA_2P_PARTICIPANT_IDS_V1 = [1, 2];
 //#endregion
 //#region src/SeamsWeb/operations/registration/registrationSignerSet.ts
@@ -38109,7 +37939,7 @@ function assertOneEcdsaCustodyIdentity(continuity) {
 	if (continuity.state === "absent") return null;
 	const first = continuity.signers[0];
 	const chainTargets = /* @__PURE__ */ new Set();
-	for (const signer of continuity.signers.slice(1)) if (signer.walletKey.keyHandle !== first.walletKey.keyHandle || !sameRouterAbEcdsaDerivationPublicCapabilityV1(signer.walletKey.publicCapability, first.walletKey.publicCapability) || !sameRouterAbEcdsaRegistrationActivationReceiptV1(signer.activationReceipt, first.activationReceipt) || !sameRuntimePolicyScope$1(signer.runtimePolicyScope, first.runtimePolicyScope)) throw new Error("sync-account returned conflicting ECDSA custody identities");
+	for (const signer of continuity.signers.slice(1)) if (signer.walletKey.keyHandle !== first.walletKey.keyHandle || !sameRouterAbEcdsaDerivationPublicCapabilityV1(signer.walletKey.publicCapability, first.walletKey.publicCapability) || !sameRouterAbEcdsaRegistrationActivationReceiptV1(signer.activationReceipt, first.activationReceipt) || !sameRuntimePolicyScope(signer.runtimePolicyScope, first.runtimePolicyScope)) throw new Error("sync-account returned conflicting ECDSA custody identities");
 	for (const signer of continuity.signers) {
 		const key = thresholdEcdsaChainTargetKey(signer.chainTarget);
 		if (chainTargets.has(key)) throw new Error("sync-account returned duplicate ECDSA custody chain targets");
@@ -38930,7 +38760,10 @@ async function executeEvmFamilyTransactionLifecycle(args) {
 			}
 		});
 		const rawTxHex = assertRawTxHexOrThrow(signedResult.rawTxHex);
-		args.lifecycle.onBroadcastStarted?.(signedResult);
+		args.lifecycle.onBroadcastStarted({
+			walletSession: args.input.walletSession,
+			signedResult
+		});
 		txHash = normalizeTxHashOrThrow(await client.request({
 			method: "eth_sendRawTransaction",
 			params: [rawTxHex]
@@ -39276,6 +39109,11 @@ function createTempoSignerCapability(deps, transactionDispatch = { kind: "ordina
 		...args,
 		chainTarget: resolveTempoChainTarget(deps.configs.network.chains, args.chainTarget)
 	}));
+	const onBroadcastStarted = (args) => {
+		const walletIframe = deps.getWalletIframe();
+		if (!walletIframe.shouldUseWalletIframe()) return;
+		walletIframe.requireRouter(toWalletId(args.walletSession.walletId)).then((router) => router.notifyTransactionBroadcastStarted(args.signedResult)).catch(() => {});
+	};
 	const reportBroadcastAccepted = async (args) => {
 		const walletIframe = deps.getWalletIframe();
 		const walletId = toWalletId(args.walletSession.walletId);
@@ -39391,6 +39229,7 @@ function createTempoSignerCapability(deps, transactionDispatch = { kind: "ordina
 		}
 	};
 	const lifecycle = {
+		onBroadcastStarted,
 		signEvmFamily,
 		reportBroadcastAccepted,
 		reportBroadcastRejected,
@@ -39487,6 +39326,9 @@ function createCurrentWalletResolver(deps) {
 		}
 	};
 }
+//#endregion
+//#region src/SeamsWeb/publicApi/awaitNearReady.ts
+const DEFAULT_AWAIT_NEAR_READY_TIMEOUT_MS = 12e4;
 function outcomeFor(state) {
 	if (!state) return null;
 	if (state.status === "near_ready") return {
@@ -39510,7 +39352,7 @@ function outcomeFor(state) {
 async function awaitNearReady(deps, args) {
 	const walletId = String(args.walletId || "").trim();
 	if (!walletId) throw new Error("[seams] awaitNearReady requires a walletId");
-	const timeoutMs = Math.max(1, Math.floor(Number(args.timeoutMs) || 0)) || 12e4;
+	const timeoutMs = Math.max(1, Math.floor(Number(args.timeoutMs) || 0)) || DEFAULT_AWAIT_NEAR_READY_TIMEOUT_MS;
 	let unsubscribe = null;
 	let timer = null;
 	let onAbort = null;
@@ -39788,7 +39630,7 @@ function createDeviceLinkingOrdinaryMaterialWorkerPortV1(send) {
 			const transfer = [input.factorSecret, ...recipientInputTransferables(recipientInputs)];
 			return parsePreparationResult(await send({
 				kind: "device_linking_ordinary_signer_material_prepare_private_v1",
-				handleId: requireString$1(input.keyMaterial.handleId, "keyMaterial.handleId"),
+				handleId: requireCanonicalString(input.keyMaterial.handleId, "keyMaterial.handleId", "is required"),
 				targetFactor: targetFactorBindingV1(input.targetFactor),
 				preparations,
 				recipientRequests,
@@ -39799,7 +39641,7 @@ function createDeviceLinkingOrdinaryMaterialWorkerPortV1(send) {
 		async createOrdinarySignerMaterialRecipientRequestsV1(input) {
 			return parseRecipientPreparationResult(await send({
 				kind: "device_linking_ordinary_signer_material_recipient_prepare_v1",
-				handleId: requireString$1(input.keyMaterial.handleId, "keyMaterial.handleId"),
+				handleId: requireCanonicalString(input.keyMaterial.handleId, "keyMaterial.handleId", "is required"),
 				requirements: parseRecipientRequirementTuple(input.requirements)
 			}));
 		},
@@ -39807,7 +39649,7 @@ function createDeviceLinkingOrdinaryMaterialWorkerPortV1(send) {
 			const committed = parseCommittedAuthorityPackagesV1(input.committed);
 			return parseSealedLocalAuthorityMaterialSetV1(await send({
 				kind: "device_linking_ordinary_signer_material_seal_v1",
-				handleId: requireString$1(input.keyMaterial.handleId, "keyMaterial.handleId"),
+				handleId: requireCanonicalString(input.keyMaterial.handleId, "keyMaterial.handleId", "is required"),
 				committed,
 				targetFactor: targetFactorBindingV1(input.targetFactor),
 				resealedExportRoot: parseOrdinaryResealedExportRootRecordV1(input.resealedExportRoot)
@@ -39817,11 +39659,15 @@ function createDeviceLinkingOrdinaryMaterialWorkerPortV1(send) {
 }
 function parseOrdinaryResealedExportRootRecordV1(value) {
 	if (value === null) return null;
-	if (!isOrdinaryResealedExportRootRecordV1(value)) throw new Error("ordinary material resealed export root has unsupported fields");
+	if (!hasExactKeys(value, ["envelope"])) throw new Error("ordinary material resealed export root has unsupported fields");
 	return { envelope: parsePasskeyCustodyEnvelopeRecord(value.envelope) };
 }
 function parsePreparationResult(value) {
-	if (!isOrdinaryMaterialPreparationResultRecordV1(value)) throw new Error("ordinary material preparation result has invalid fields");
+	if (!hasExactKeys(value, [
+		"kind",
+		"targetFactor",
+		"preparations"
+	])) throw new Error("ordinary material preparation result has invalid fields");
 	if (value.kind !== "device_linking_ordinary_signer_material_preparation_v1") throw new Error("ordinary material preparation result kind is invalid");
 	return {
 		kind: "device_linking_ordinary_signer_material_preparation_v1",
@@ -39843,7 +39689,11 @@ function parsePreparationTuple(value) {
 function parseRecipientRequirementTuple(value) {
 	if (!Array.isArray(value) || value.length === 0 || value.length > 2) throw new Error("ordinary signer material recipient requirements must contain one or two entries");
 	const requirements = value.map((entry, index) => {
-		if (!isOrdinaryRecipientRequirementRecordV1(entry)) throw new Error(`ordinary recipient requirement ${index} has invalid fields`);
+		if (!hasExactKeys(entry, [
+			"kind",
+			"keyFamily",
+			"walletKeyId"
+		])) throw new Error(`ordinary recipient requirement ${index} has invalid fields`);
 		if (entry.kind !== "ordinary_signer_material_recipient_requirement_v1") throw new Error("ordinary recipient requirement kind is invalid");
 		if (entry.keyFamily !== "ed25519" && entry.keyFamily !== "ecdsa_secp256k1") throw new Error("ordinary recipient requirement key family is invalid");
 		const walletKeyId = parseWalletKey(entry.walletKeyId);
@@ -39860,8 +39710,13 @@ function parseRecipientRequirementTuple(value) {
 }
 function parseRecipientRequestTuple(value) {
 	if (!Array.isArray(value) || value.length === 0 || value.length > 2) throw new Error("ordinary signer material recipient requests must contain one or two entries");
-	const requests = value.map((entry, index) => {
-		if (isOrdinaryEd25519RecipientRequestRecordV1(entry)) {
+	const requests = value.map((entry) => {
+		if (hasExactKeys(entry, [
+			"kind",
+			"keyFamily",
+			"walletKeyId",
+			"recipientPublicKeyB64u"
+		])) {
 			if (entry.kind !== "ordinary_ed25519_signer_material_recipient_request_v1" || entry.keyFamily !== "ed25519") throw new Error("ordinary Ed25519 recipient request kind is invalid");
 			return {
 				kind: "ordinary_ed25519_signer_material_recipient_request_v1",
@@ -39870,13 +39725,18 @@ function parseRecipientRequestTuple(value) {
 				recipientPublicKeyB64u: parseB64u(entry.recipientPublicKeyB64u, "Ed25519 recipient public key")
 			};
 		}
-		if (isOrdinaryEcdsaRecipientRequestRecordV1(entry)) {
+		if (hasExactKeys(entry, [
+			"kind",
+			"keyFamily",
+			"walletKeyId",
+			"clientEphemeralPublicKey"
+		])) {
 			if (entry.kind !== "ordinary_ecdsa_signer_material_recipient_request_v1" || entry.keyFamily !== "ecdsa_secp256k1") throw new Error("ordinary ECDSA recipient request kind is invalid");
 			return {
 				kind: "ordinary_ecdsa_signer_material_recipient_request_v1",
 				keyFamily: "ecdsa_secp256k1",
 				walletKeyId: parseWalletKey(entry.walletKeyId),
-				clientEphemeralPublicKey: requireString$1(entry.clientEphemeralPublicKey, "ECDSA client ephemeral public key")
+				clientEphemeralPublicKey: requireCanonicalString(entry.clientEphemeralPublicKey, "ECDSA client ephemeral public key", "is required")
 			};
 		}
 		throw new Error("ordinary recipient request key family is invalid");
@@ -39887,7 +39747,11 @@ function parseRecipientRequestTuple(value) {
 	return [first, ...requests.slice(1)];
 }
 function parseRecipientPreparationResult(value) {
-	if (!isOrdinaryRecipientPreparationResultRecordV1(value)) throw new Error("ordinary recipient preparation result has invalid fields");
+	if (!hasExactKeys(value, [
+		"kind",
+		"recipientRequests",
+		"recipientInputs"
+	])) throw new Error("ordinary recipient preparation result has invalid fields");
 	if (value.kind !== "device_linking_ordinary_signer_material_recipient_preparation_v1") throw new Error("ordinary recipient preparation result kind is invalid");
 	const recipientRequests = parseRecipientRequestTuple(value.recipientRequests);
 	const recipientInputs = parseRecipientInputTuple(value.recipientInputs);
@@ -39899,8 +39763,13 @@ function parseRecipientPreparationResult(value) {
 }
 function parseRecipientInputTuple(value) {
 	if (!Array.isArray(value) || value.length === 0 || value.length > 2) throw new Error("ordinary signer material recipient inputs must contain one or two entries");
-	const inputs = value.map((entry, index) => {
-		if (isOrdinaryEd25519RecipientInputRecordV1(entry)) {
+	const inputs = value.map((entry) => {
+		if (hasExactKeys(entry, [
+			"kind",
+			"keyFamily",
+			"walletKeyId",
+			"recipientPrivateKey"
+		])) {
 			if (entry.kind !== "ordinary_ed25519_signer_material_recipient_input_v1" || entry.keyFamily !== "ed25519") throw new Error("ordinary Ed25519 recipient input kind is invalid");
 			return {
 				kind: "ordinary_ed25519_signer_material_recipient_input_v1",
@@ -39909,7 +39778,12 @@ function parseRecipientInputTuple(value) {
 				recipientPrivateKey: parsePrivateKeyBuffer(entry.recipientPrivateKey, "Ed25519 recipient private key")
 			};
 		}
-		if (isOrdinaryEcdsaRecipientInputRecordV1(entry)) {
+		if (hasExactKeys(entry, [
+			"kind",
+			"keyFamily",
+			"walletKeyId",
+			"clientEphemeralPrivateKey"
+		])) {
 			if (entry.kind !== "ordinary_ecdsa_signer_material_recipient_input_v1" || entry.keyFamily !== "ecdsa_secp256k1") throw new Error("ordinary ECDSA recipient input kind is invalid");
 			return {
 				kind: "ordinary_ecdsa_signer_material_recipient_input_v1",
@@ -39957,7 +39831,13 @@ function parsePreparation(value) {
 	return parseLinkedDeviceOrdinaryMaterialSourceContributionPreparationV1(value);
 }
 function parseTargetFactorBindingV1(value) {
-	if (isOrdinaryPasskeyTargetFactorRecordV1(value)) {
+	if (hasExactKeys(value, [
+		"kind",
+		"walletAuthMethodId",
+		"verificationDigestB64u",
+		"rpId",
+		"credentialIdB64u"
+	])) {
 		if (value.kind !== "passkey") throw new Error("ordinary material target factor kind is unsupported");
 		const authMethod = parseWalletAuthMethodId(value.walletAuthMethodId);
 		if (!authMethod.ok) throw new Error(authMethod.error.message);
@@ -39966,29 +39846,41 @@ function parseTargetFactorBindingV1(value) {
 			kind: "passkey",
 			walletAuthMethodId: authMethod.value,
 			verificationDigestB64u,
-			rpId: requireString$1(value.rpId, "ordinary target factor rpId"),
+			rpId: requireCanonicalString(value.rpId, "ordinary target factor rpId", "is required"),
 			credentialIdB64u: parseB64u(value.credentialIdB64u, "ordinary target factor credentialIdB64u")
 		};
 	}
-	if (isOrdinaryEmailOtpTargetFactorRecordV1(value)) {
+	if (hasExactKeys(value, [
+		"kind",
+		"walletAuthMethodId",
+		"verificationDigestB64u",
+		"emailHashHex",
+		"registrationAuthorityId"
+	])) {
 		if (value.kind !== "email_otp") throw new Error("ordinary material target factor kind is unsupported");
 		const authMethod = parseWalletAuthMethodId(value.walletAuthMethodId);
 		if (!authMethod.ok) throw new Error(authMethod.error.message);
 		const verificationDigestB64u = parseDigestB64u(value.verificationDigestB64u);
-		const emailHashHex = requireString$1(value.emailHashHex, "ordinary target factor emailHashHex");
+		const emailHashHex = requireCanonicalString(value.emailHashHex, "ordinary target factor emailHashHex", "is required");
 		if (!/^[0-9a-f]{64}$/.test(emailHashHex)) throw new Error("ordinary target factor emailHashHex is invalid");
 		return {
 			kind: "email_otp",
 			walletAuthMethodId: authMethod.value,
 			verificationDigestB64u,
 			emailHashHex,
-			registrationAuthorityId: requireString$1(value.registrationAuthorityId, "ordinary target factor registrationAuthorityId")
+			registrationAuthorityId: requireCanonicalString(value.registrationAuthorityId, "ordinary target factor registrationAuthorityId", "is required")
 		};
 	}
 	throw new Error("ordinary material target factor kind is unsupported");
 }
 function parseWalletAuthorityExportRootRecordV1(value) {
-	if (!isWalletAuthorityExportRootRecordV1(value)) throw new Error("ordinary material export-root record has invalid fields");
+	if (!hasExactKeys(value, [
+		"kind",
+		"authorityId",
+		"walletAuthMethodId",
+		"walletKeyId",
+		"envelope"
+	])) throw new Error("ordinary material export-root record has invalid fields");
 	if (value.kind !== "wallet_authority_export_root_v1") throw new Error("ordinary material export-root record kind is invalid");
 	const authorityId = parseWalletAuthorityId(value.authorityId);
 	if (!authorityId.ok) throw new Error(authorityId.error.message);
@@ -40005,7 +39897,11 @@ function parseWalletAuthorityExportRootRecordV1(value) {
 	};
 }
 function parseSealedLocalAuthorityMaterialSetV1(value) {
-	if (!isSealedLocalAuthorityMaterialSetRecordV1(value)) throw new Error("ordinary material worker returned an invalid sealed record set");
+	if (!hasExactKeys(value, [
+		"signerMaterials",
+		"exportRoot",
+		"installedRecordSetDigestB64u"
+	])) throw new Error("ordinary material worker returned an invalid sealed record set");
 	if (!Array.isArray(value.signerMaterials) || value.signerMaterials.length === 0) throw new Error("ordinary material worker returned an invalid sealed record set");
 	const signerMaterials = value.signerMaterials.map((entry) => parseWalletAuthorityLinkedSignerMaterialRecordV1(entry));
 	const firstSignerMaterial = signerMaterials[0];
@@ -40017,7 +39913,7 @@ function parseSealedLocalAuthorityMaterialSetV1(value) {
 	};
 }
 function parseB64u(value, label) {
-	const encoded = requireString$1(value, label);
+	const encoded = requireCanonicalString(value, label, "is required");
 	let decoded;
 	try {
 		decoded = base64UrlDecode(encoded);
@@ -40031,66 +39927,8 @@ function parseB64u(value, label) {
 	decoded.fill(0);
 	return encoded;
 }
-function isOrdinaryResealedExportRootRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "envelope";
-}
-function isOrdinaryMaterialPreparationResultRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "kind|preparations|targetFactor";
-}
-function isOrdinaryRecipientRequirementRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "keyFamily|kind|walletKeyId";
-}
-function isOrdinaryEd25519RecipientRequestRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "keyFamily|kind|recipientPublicKeyB64u|walletKeyId";
-}
-function isOrdinaryEcdsaRecipientRequestRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "clientEphemeralPublicKey|keyFamily|kind|walletKeyId";
-}
-function isOrdinaryRecipientPreparationResultRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "kind|recipientInputs|recipientRequests";
-}
-function isOrdinaryEd25519RecipientInputRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "keyFamily|kind|recipientPrivateKey|walletKeyId";
-}
-function isOrdinaryEcdsaRecipientInputRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "clientEphemeralPrivateKey|keyFamily|kind|walletKeyId";
-}
-function isOrdinaryPasskeyTargetFactorRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "credentialIdB64u|kind|rpId|verificationDigestB64u|walletAuthMethodId";
-}
-function isOrdinaryEmailOtpTargetFactorRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "emailHashHex|kind|registrationAuthorityId|verificationDigestB64u|walletAuthMethodId";
-}
-function isWalletAuthorityExportRootRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "authorityId|envelope|kind|walletAuthMethodId|walletKeyId";
-}
-function isSealedLocalAuthorityMaterialSetRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "exportRoot|installedRecordSetDigestB64u|signerMaterials";
-}
-function requireString$1(value, label) {
-	if (typeof value !== "string" || value.trim() !== value || value.length === 0) throw new Error(`${label} is required`);
-	return value;
-}
 //#endregion
 //#region src/SeamsWeb/operations/devices/deviceLinkingWorkerChannels.ts
-function isDeviceLinkingKeyHandleRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "handleId|kind";
-}
-function isDeviceLinkingKeyCreateResultRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "deliveryRecipientPublicKey65B64u|devicePublicKeyB64u|handleId|linkPublicKeyB64u";
-}
-function isDeviceLinkingEmailOtpFactorReleaseResultRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "factorSecret|kind|verificationGrant";
-}
-function isDeviceLinkingRequestSignatureResultRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "signatureB64u";
-}
-function isDeviceLinkingWorkerSuccessFrameRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "id|ok|result" && "ok" in value && value.ok === true;
-}
-function isDeviceLinkingWorkerFailureFrameRecordV1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).sort().join("|") === "error|id|ok" && "ok" in value && value.ok === false;
-}
 function nonEmpty(value, label) {
 	if (typeof value !== "string" || value.trim() !== value || value.length === 0) throw new Error(`${label} is required`);
 	return value;
@@ -40116,7 +39954,7 @@ function parseFixedB64u(value, length, label) {
 	return encoded;
 }
 function parseHandle(value) {
-	if (!isDeviceLinkingKeyHandleRecordV1(value)) throw new Error("device-linking key handle has invalid fields");
+	if (!hasExactKeys(value, ["kind", "handleId"])) throw new Error("device-linking key handle has invalid fields");
 	const record = value;
 	if (record.kind !== "device_linking_key_material_handle_v1") throw new Error("device-linking key handle kind is invalid");
 	return {
@@ -40125,7 +39963,12 @@ function parseHandle(value) {
 	};
 }
 function parseCreateResult(value) {
-	if (!isDeviceLinkingKeyCreateResultRecordV1(value)) throw new Error("device-linking key create response has invalid fields");
+	if (!hasExactKeys(value, [
+		"handleId",
+		"linkPublicKeyB64u",
+		"devicePublicKeyB64u",
+		"deliveryRecipientPublicKey65B64u"
+	])) throw new Error("device-linking key create response has invalid fields");
 	const record = value;
 	return {
 		handle: {
@@ -40138,7 +39981,11 @@ function parseCreateResult(value) {
 	};
 }
 function parseEmailOtpFactorReleaseResult(value) {
-	if (!isDeviceLinkingEmailOtpFactorReleaseResultRecordV1(value)) throw new Error("device-linking Email OTP factor release response has invalid fields");
+	if (!hasExactKeys(value, [
+		"kind",
+		"verificationGrant",
+		"factorSecret"
+	])) throw new Error("device-linking Email OTP factor release response has invalid fields");
 	const record = value;
 	if (record.kind !== "device_linking_email_otp_factor_release_result_v1") throw new Error("device-linking Email OTP factor release response kind is invalid");
 	if (!(record.factorSecret instanceof ArrayBuffer) || record.factorSecret.byteLength !== 32) throw new Error("device-linking Email OTP factor release secret is invalid");
@@ -40152,11 +39999,15 @@ function parseWalletSessionCredentialDeliveryResult(value) {
 	return parseWalletSessionOperationCredentialV1(value);
 }
 function parseSignatureResult(value) {
-	if (!isDeviceLinkingRequestSignatureResultRecordV1(value)) throw new Error("device-linking request signature response has invalid fields");
+	if (!hasExactKeys(value, ["signatureB64u"])) throw new Error("device-linking request signature response has invalid fields");
 	return { signatureB64u: parseFixedB64u(value.signatureB64u, 64, "signatureB64u") };
 }
 function parseResponseFrame(value) {
-	if (isDeviceLinkingWorkerSuccessFrameRecordV1(value)) {
+	if (hasExactKeys(value, [
+		"id",
+		"ok",
+		"result"
+	]) && value.ok === true) {
 		const id = value.id;
 		if (typeof id !== "string" || id.trim() !== id || id.length === 0) return null;
 		return {
@@ -40165,7 +40016,11 @@ function parseResponseFrame(value) {
 			result: value.result
 		};
 	}
-	if (isDeviceLinkingWorkerFailureFrameRecordV1(value)) {
+	if (hasExactKeys(value, [
+		"id",
+		"ok",
+		"error"
+	]) && value.ok === false) {
 		const id = value.id;
 		if (typeof id !== "string" || id.trim() !== id || id.length === 0) return null;
 		if (typeof value.error !== "string" || !value.error.trim()) return null;
@@ -40675,122 +40530,16 @@ function createDeviceLinkingFlowPortsV1(args) {
 	};
 }
 //#endregion
-//#region src/SeamsWeb/operations/devices/walletHostComposition.ts
-const LINKED_DEVICE_MANAGEMENT_HTTP_BASE_PATH_V1 = "/wallet/device-linking/v1/devices";
-const OWNER_WALLET_SESSION_REAUTH_REQUIRED = "owner_wallet_session_reauth_required";
-var OwnerWalletSessionReauthRequiredError = class extends Error {
-	constructor() {
-		super("The owner Wallet Session must be renewed");
-		this.code = OWNER_WALLET_SESSION_REAUTH_REQUIRED;
-		this.name = "OwnerWalletSessionReauthRequiredError";
-	}
-};
-function createWalletHostCompositionV1(args) {
-	const deviceLinkingPorts = createDeviceLinkingFlowPortsV1(args);
-	return {
-		linkedDeviceManagement: createWalletHostLinkedDeviceManagementPortV1({ request: args.managementRequest }),
-		deviceLinkingPorts,
-		dispose: deviceLinkingPorts.dispose
-	};
-}
-function createWalletHostLinkedDeviceManagementPortV1(args) {
-	return {
-		listLinkedDevices: async ({ walletId, limit, cursor }) => {
-			const request = parseLinkedDeviceListRequestV1({
-				kind: "linked_device_list_request_v1",
-				walletId,
-				limit,
-				cursor
-			});
-			const path = `${LINKED_DEVICE_MANAGEMENT_HTTP_BASE_PATH_V1}?walletId=${encodeURIComponent(String(request.walletId))}&limit=${encodeURIComponent(String(request.limit))}&cursor=${encodeURIComponent(request.cursor ?? "")}`;
-			const response = await args.request.request({
-				method: "GET",
-				canonicalPath: path,
-				walletId: request.walletId
-			});
-			assertManagementSuccess(response, "list linked devices");
-			return parseLinkedDeviceListResponseV1(response.body);
-		},
-		revokeLinkedDevice: async ({ walletId, walletAuthMethodId, requestedAtMs, sourceProof }) => {
-			const request = parseLinkedDeviceRevokeRequestV1({
-				kind: "linked_device_revoke_request_v1",
-				walletId,
-				walletAuthMethodId,
-				requestedAtMs
-			});
-			return parseManagementRevokeResult(await args.request.request({
-				method: "POST",
-				canonicalPath: `${LINKED_DEVICE_MANAGEMENT_HTTP_BASE_PATH_V1}/${encodeURIComponent(String(walletAuthMethodId))}/revoke`,
-				body: {
-					...request,
-					sourceProof
-				},
-				walletId
-			}));
-		}
-	};
-}
-function parseManagementRevokeResult(response) {
-	if (response.status === 404) return parseLinkedDeviceRevokeResultV1({ kind: "not_found" });
-	if (response.status === 409) return parseLinkedDeviceRevokeResultV1({ kind: "conflict" });
-	if (response.status === 401 || response.status === 403) return parseLinkedDeviceRevokeResultV1({ kind: "unauthorized" });
-	assertManagementSuccess(response, "revoke linked device");
-	return parseLinkedDeviceRevokeResponseV1(response.body);
-}
-function assertManagementSuccess(response, operation) {
-	if (response.status < 200 || response.status >= 300) {
-		if (response.status === 401 && isManagementUnauthorizedFailureRecordV1(response.body)) throw new OwnerWalletSessionReauthRequiredError();
-		const detail = managementFailureDetail(response.body);
-		throw new Error(detail ? `linked-device ${operation} failed with HTTP ${response.status}: ${detail}` : `linked-device ${operation} failed with HTTP ${response.status}`);
-	}
-}
-function managementFailureDetail(raw) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
-	if (isManagementFailureWithMessageRecordV1(raw)) return raw.message;
-	if (isManagementUnauthorizedFailureRecordV1(raw)) return raw.message;
-	return null;
-}
-function parseLinkedDeviceListResponseV1(raw) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("linked-device list response must be an object");
-	if (!isLinkedDeviceListResponseRecordV1(raw)) throw new Error("linked-device list response has unexpected fields");
-	if (raw.ok !== true) throw new Error("linked-device list response is not successful");
-	return parseLinkedDeviceListResultV1({
-		devices: raw.devices,
-		ownerDevices: raw.ownerDevices,
-		nextCursor: raw.nextCursor
-	});
-}
-function isLinkedDeviceListResponseRecordV1(value) {
-	return Object.keys(value).sort().join("|") === "devices|nextCursor|ok|ownerDevices";
-}
-function parseLinkedDeviceRevokeResponseV1(raw) {
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("linked-device revoke response must be an object");
-	if (!isLinkedDeviceRevokeResponseRecordV1(raw)) throw new Error("linked-device revoke response has unexpected fields");
-	if (raw.ok !== true) throw new Error("linked-device revoke response is not successful");
-	return parseLinkedDeviceRevokeResultV1({
-		kind: raw.kind,
-		walletAuthMethodId: raw.walletAuthMethodId,
-		authorityId: raw.authorityId,
-		revocationEpoch: raw.revocationEpoch
-	});
-}
-function isLinkedDeviceRevokeResponseRecordV1(value) {
-	return Object.keys(value).sort().join("|") === "authorityId|kind|ok|revocationEpoch|walletAuthMethodId";
-}
-function isManagementFailureWithMessageRecordV1(value) {
-	if (Object.keys(value).sort().join("|") !== "kind|message|ok") return false;
-	if (!("ok" in value) || !("kind" in value) || !("message" in value)) return false;
-	return value.ok === false && (value.kind === "invalid_input" || value.kind === "internal") && typeof value.message === "string" && value.message.trim().length > 0;
-}
-function isManagementUnauthorizedFailureRecordV1(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
-	if (Object.keys(value).sort().join("|") !== "code|kind|message|ok") return false;
-	if (!("ok" in value) || !("kind" in value) || !("code" in value) || !("message" in value)) return false;
-	return value.ok === false && value.kind === "unauthorized" && typeof value.code === "string" && typeof value.message === "string" && value.message.trim().length > 0;
-}
-//#endregion
 //#region src/SeamsWeb/operations/devices/walletHostOwnerAuthority.ts
 const OWNER_AUTHORIZATION_PATH = "/wallet/device-linking/v1/owner-authorization";
+/** An owner request that received no answer: the network failed, or it timed out. */
+var WalletHostOwnerRequestTransportError = class extends Error {
+	constructor(code, message) {
+		super(`Owner Router request failed: ${message}`);
+		this.code = code;
+		this.name = "WalletHostOwnerRequestTransportError";
+	}
+};
 function createWalletHostOwnerAuthoritiesV1(input) {
 	const context = normalizeContext(input);
 	return {
@@ -40808,7 +40557,7 @@ function normalizeContext(input) {
 	};
 }
 /**
-* The R103 fail-closed preflight, exact result `wallet_unlock_required`.
+* The fail-closed preflight, exact result `wallet_unlock_required`.
 *
 * The locked and missing-session arms run before any network I/O. The
 * export-root arm runs after the stateless owner-authorization read, because
@@ -40892,7 +40641,7 @@ async function requestWithCredentialV1(context, walletSessionToken, input) {
 		headers: { authorization: `Bearer ${walletSessionToken}` },
 		...input.body === void 0 ? {} : { body: input.body }
 	});
-	if (!response.ok) throw new Error(`Owner Router request failed: ${response.message}`);
+	if (!response.ok) throw new WalletHostOwnerRequestTransportError(response.code, response.message);
 	return response.value;
 }
 function parseOwnerAuthorizationResponseV1(raw, session) {
@@ -40961,6 +40710,129 @@ function positiveSafeInteger(raw, label) {
 	return Number(raw);
 }
 //#endregion
+//#region src/SeamsWeb/operations/devices/walletHostComposition.ts
+const LINKED_DEVICE_MANAGEMENT_HTTP_BASE_PATH_V1 = "/wallet/device-linking/v1/devices";
+const OWNER_WALLET_SESSION_REAUTH_REQUIRED = "owner_wallet_session_reauth_required";
+var OwnerWalletSessionReauthRequiredError = class extends Error {
+	constructor() {
+		super("The owner Wallet Session must be renewed");
+		this.code = OWNER_WALLET_SESSION_REAUTH_REQUIRED;
+		this.name = "OwnerWalletSessionReauthRequiredError";
+	}
+};
+function createWalletHostCompositionV1(args) {
+	const deviceLinkingPorts = createDeviceLinkingFlowPortsV1(args);
+	return {
+		linkedDeviceManagement: createWalletHostLinkedDeviceManagementPortV1({ request: args.managementRequest }),
+		deviceLinkingPorts,
+		dispose: deviceLinkingPorts.dispose
+	};
+}
+function createWalletHostLinkedDeviceManagementPortV1(args) {
+	return {
+		listLinkedDevices: async ({ walletId, limit, cursor }) => {
+			const request = parseLinkedDeviceListRequestV1({
+				kind: "linked_device_list_request_v1",
+				walletId,
+				limit,
+				cursor
+			});
+			const path = `${LINKED_DEVICE_MANAGEMENT_HTTP_BASE_PATH_V1}?walletId=${encodeURIComponent(String(request.walletId))}&limit=${encodeURIComponent(String(request.limit))}&cursor=${encodeURIComponent(request.cursor ?? "")}`;
+			const response = await args.request.request({
+				method: "GET",
+				canonicalPath: path,
+				walletId: request.walletId
+			});
+			assertManagementSuccess(response, "list linked devices");
+			return parseLinkedDeviceListResponseV1(response.body);
+		},
+		revokeLinkedDevice: async ({ walletId, walletAuthMethodId, requestedAtMs, sourceProof }) => {
+			const request = parseLinkedDeviceRevokeRequestV1({
+				kind: "linked_device_revoke_request_v1",
+				walletId,
+				walletAuthMethodId,
+				requestedAtMs
+			});
+			const send = async () => await args.request.request({
+				method: "POST",
+				canonicalPath: `${LINKED_DEVICE_MANAGEMENT_HTTP_BASE_PATH_V1}/${encodeURIComponent(String(walletAuthMethodId))}/revoke`,
+				body: {
+					...request,
+					sourceProof
+				},
+				walletId
+			});
+			let response;
+			try {
+				response = await send();
+			} catch (error) {
+				if (!(error instanceof WalletHostOwnerRequestTransportError)) throw error;
+				if (error.code !== "network_error") throw error;
+				response = await send();
+			}
+			return parseManagementRevokeResult(response);
+		}
+	};
+}
+function parseManagementRevokeResult(response) {
+	if (response.status === 404) return parseLinkedDeviceRevokeResultV1({ kind: "not_found" });
+	if (response.status === 409) return parseLinkedDeviceRevokeResultV1({ kind: "conflict" });
+	if (response.status === 401 || response.status === 403) return parseLinkedDeviceRevokeResultV1({ kind: "unauthorized" });
+	assertManagementSuccess(response, "revoke linked device");
+	return parseLinkedDeviceRevokeResponseV1(response.body);
+}
+function assertManagementSuccess(response, operation) {
+	if (response.status < 200 || response.status >= 300) {
+		if (response.status === 401 && isManagementUnauthorizedFailureRecordV1(response.body)) throw new OwnerWalletSessionReauthRequiredError();
+		const detail = managementFailureDetail(response.body);
+		throw new Error(detail ? `linked-device ${operation} failed with HTTP ${response.status}: ${detail}` : `linked-device ${operation} failed with HTTP ${response.status}`);
+	}
+}
+function managementFailureDetail(raw) {
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
+	if (isManagementFailureWithMessageRecordV1(raw)) return raw.message;
+	if (isManagementUnauthorizedFailureRecordV1(raw)) return raw.message;
+	return null;
+}
+function parseLinkedDeviceListResponseV1(raw) {
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("linked-device list response must be an object");
+	if (!isLinkedDeviceListResponseRecordV1(raw)) throw new Error("linked-device list response has unexpected fields");
+	if (raw.ok !== true) throw new Error("linked-device list response is not successful");
+	return parseLinkedDeviceListResultV1({
+		devices: raw.devices,
+		ownerDevices: raw.ownerDevices,
+		nextCursor: raw.nextCursor
+	});
+}
+function isLinkedDeviceListResponseRecordV1(value) {
+	return Object.keys(value).sort().join("|") === "devices|nextCursor|ok|ownerDevices";
+}
+function parseLinkedDeviceRevokeResponseV1(raw) {
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new Error("linked-device revoke response must be an object");
+	if (!isLinkedDeviceRevokeResponseRecordV1(raw)) throw new Error("linked-device revoke response has unexpected fields");
+	if (raw.ok !== true) throw new Error("linked-device revoke response is not successful");
+	return parseLinkedDeviceRevokeResultV1({
+		kind: raw.kind,
+		walletAuthMethodId: raw.walletAuthMethodId,
+		authorityId: raw.authorityId,
+		revocationEpoch: raw.revocationEpoch
+	});
+}
+function isLinkedDeviceRevokeResponseRecordV1(value) {
+	return Object.keys(value).sort().join("|") === "authorityId|kind|ok|revocationEpoch|walletAuthMethodId";
+}
+function isManagementFailureWithMessageRecordV1(value) {
+	if (Object.keys(value).sort().join("|") !== "kind|message|ok") return false;
+	if (!("ok" in value) || !("kind" in value) || !("message" in value)) return false;
+	return value.ok === false && (value.kind === "invalid_input" || value.kind === "internal") && typeof value.message === "string" && value.message.trim().length > 0;
+}
+function isManagementUnauthorizedFailureRecordV1(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	if (Object.keys(value).sort().join("|") !== "code|kind|message|ok") return false;
+	if (!("ok" in value) || !("kind" in value) || !("code" in value) || !("message" in value)) return false;
+	return value.ok === false && value.kind === "unauthorized" && typeof value.code === "string" && typeof value.message === "string" && value.message.trim().length > 0;
+}
+//#endregion
 //#region src/core/signingEngine/threshold/crypto/ed25519YaoLaneWasm.ts
 function requestJson(value) {
 	if (typeof value !== "string" || !value.trim()) throw new Error("Yao lane request JSON is required");
@@ -41028,6 +40900,8 @@ var Ed25519YaoLaneWorkerSource = class {
 function createDeviceLinkingEcdsaSourceContributionMetadataReaderV1(context) {
 	return async ({ preparation }) => {
 		const sourceActivation = preparation.source.activation;
+		const linked = context.readLinkedEcdsaHolderV1({ materialActivation: sourceActivation });
+		if (linked) return linkedEcdsaSourceMetadataV1(linked, sourceActivation);
 		const manifest = await context.readActiveEcdsaCapabilityManifestV1({ materialActivation: sourceActivation });
 		assertExactEcdsaSourceMetadataContextV1({
 			sourceActivation,
@@ -41044,6 +40918,28 @@ function createDeviceLinkingEcdsaSourceContributionMetadataReaderV1(context) {
 		};
 	};
 }
+function linkedEcdsaSourceMetadataV1(holder, sourceActivation) {
+	if (!mpcMaterialActivationRefsEqual(holder.materialActivation, sourceActivation)) throw new Error("linked ECDSA holder activation does not match preparation");
+	const normalSigning = holder.activationReceipt.normalSigning;
+	const scope = normalSigning.scope;
+	const signingKeySlotId = deriveEvmFamilySigningKeySlotId({
+		walletId: holder.walletId,
+		signingRootId: scope.signing_root_id,
+		signingRootVersion: scope.signing_root_version
+	});
+	const walletKeyId = parseWalletKeyId(`wallet-key:ecdsa:${holder.walletId}:${signingKeySlotId}`);
+	if (!walletKeyId.ok) throw new Error(`linked ECDSA source wallet key identity: ${walletKeyId.error.message}`);
+	return {
+		walletKeyId: walletKeyId.value,
+		sourceDerivation: {
+			applicationBindingDigestB64u: parseDigestB64u(scope.context.application_binding_digest_b64u),
+			clientShareRetryCounter: scope.public_identity.client_share_retry_counter,
+			ecdsaThresholdKeyId: parseEcdsaThresholdKeyId(holder.ecdsaThresholdKeyId),
+			sourceNormalSigning: normalSigning
+		},
+		linkedHolderHandleId: holder.holderHandleId
+	};
+}
 function assertExactEcdsaSourceMetadataContextV1(input) {
 	if (!mpcMaterialActivationRefsEqual(input.manifest.activation.materialActivation, input.sourceActivation)) throw new Error("ECDSA capability manifest activation does not match preparation");
 }
@@ -41123,7 +41019,8 @@ async function produceEcdsaSourceContributionV1(input) {
 	const metadata = await input.readMetadataV1({ preparation: input.preparation });
 	const prepared = await prepareLinkedDeviceEcdsaSourceContributionWasm({
 		preparation: input.preparation,
-		workerCtx: input.workerContext
+		workerCtx: input.workerContext,
+		...metadata.linkedHolderHandleId === void 0 ? {} : { linkedHolderHandleId: metadata.linkedHolderHandleId }
 	});
 	return {
 		kind: "linked_device_ecdsa_source_contribution_v1",
@@ -41165,15 +41062,6 @@ const SECRET_MATERIAL_FIELDS = [
 	"bootstrapMaterial",
 	"clientSecret32"
 ];
-function requireRecord(value, label) {
-	if (!isPlainObject(value)) throw new Error(`${label} must be an object`);
-	return value;
-}
-function requireString(value, label) {
-	const normalized = typeof value === "string" ? value.trim() : "";
-	if (!normalized) throw new Error(`${label} is required`);
-	return normalized;
-}
 function requireTimestampMs(value, label) {
 	if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive integer timestamp`);
 	return value;
@@ -41183,22 +41071,22 @@ function rejectFields(record, fields, label) {
 	if (forbiddenField) throw new Error(`${label} must not include ${forbiddenField}`);
 }
 function parseOfferId(value) {
-	return requireString(value, "offerId");
+	return requireTrimmedString(value, "offerId");
 }
 function parseCandidateId(value, label = "candidateId") {
-	return requireString(value, label);
+	return requireTrimmedString(value, label);
 }
 function parseCandidate(value) {
-	const record = requireRecord(value, "registration candidate");
+	const record = requireRecord$1(value, "registration candidate");
 	rejectFields(record, OTP_ONLY_FORBIDDEN_FIELDS, "registration candidate");
 	rejectFields(record, SECRET_MATERIAL_FIELDS, "registration candidate");
 	return {
 		candidateId: parseCandidateId(record.candidateId),
-		walletId: walletIdFromString(requireString(record.walletId, "candidate.walletId"))
+		walletId: walletIdFromString(requireTrimmedString(record.walletId, "candidate.walletId"))
 	};
 }
 function parseGoogleEmailOtpRegistrationOffer(value) {
-	const record = requireRecord(value, "Google Email OTP registration offer");
+	const record = requireRecord$1(value, "Google Email OTP registration offer");
 	rejectFields(record, OTP_ONLY_FORBIDDEN_FIELDS, "Google Email OTP registration offer");
 	rejectFields(record, SECRET_MATERIAL_FIELDS, "Google Email OTP registration offer");
 	if (record.kind !== "google_email_otp_registration_offer_v1") throw new Error("registration offer kind must be google_email_otp_registration_offer_v1");
@@ -41211,7 +41099,7 @@ function parseGoogleEmailOtpRegistrationOffer(value) {
 		kind: "google_email_otp_registration_offer_v1",
 		offerId: parseOfferId(record.offerId),
 		expiresAtMs: requireTimestampMs(record.expiresAtMs, "expiresAtMs"),
-		emailHint: requireString(record.emailHint, "emailHint"),
+		emailHint: requireTrimmedString(record.emailHint, "emailHint"),
 		candidates: [firstCandidate, ...remainingCandidates],
 		selectedCandidateId
 	};
@@ -41791,50 +41679,15 @@ async function rotateWalletRecoverySetWithActiveFactorV1(input) {
 	let issued = issueWalletRecoveryCodes();
 	const factorSecret = new Uint8Array(input.factorSecret.slice(0));
 	try {
-		const current = await readWalletRecoveryCodeStatus({
-			relayUrl: input.relayUrl,
-			walletId: input.walletId,
-			...input.fetchImpl ? { fetchImpl: input.fetchImpl } : {}
-		});
-		if (current.kind !== "ready") return current.kind === "unauthorized" ? {
-			kind: "transport_failed",
-			message: current.message
-		} : current;
-		const custody = joinCustodyWireFromEnvelopeRecord(input.custodyEnvelope);
-		if (!custody.ok) throw new Error(custody.reason);
-		const replacement = walletRecoverySetRotationWireFromWorkerResultV1(await input.worker.rotateRecoverySet({
-			custodyJson: custody.custodyJson,
-			factorSecret: factorSecret.buffer.slice(0),
-			recoveryCodesJson: JSON.stringify(issued.codeBytes.map((bytes) => ({ codeBytesB64u: base64UrlEncode(bytes) })))
-		}));
-		if (replacement.walletId !== input.walletId) throw new Error("Recovery rotation worker returned a different wallet");
-		const recoveryCodeLocators = await deriveRecoveryCodeLocators(issued.codeBytes, replacement.manifestKekWraps);
-		const rotated = await rotateWalletRecoverySet({
-			relayUrl: input.relayUrl,
-			walletId: input.walletId,
-			factorProof: await input.factorProof({
-				operation: "recovery_rotate",
-				payload: {
-					walletId: input.walletId,
-					expectedStoreVersion: current.storeVersion,
-					manifestKekWraps: replacement.manifestKekWraps,
-					entries: [replacement.entry],
-					recoveryCodeLocators
-				}
-			}),
-			expectedStoreVersion: current.storeVersion,
-			replacement,
-			recoveryCodeLocators,
-			...input.fetchImpl ? { fetchImpl: input.fetchImpl } : {}
+		return await rotateWithIssuedCodes(input, issued, (codeBytes) => {
+			const custody = joinCustodyWireFromEnvelopeRecord(input.custodyEnvelope);
+			if (!custody.ok) throw new Error(custody.reason);
+			return input.worker.rotateRecoverySet({
+				custodyJson: custody.custodyJson,
+				factorSecret: factorSecret.buffer.slice(0),
+				recoveryCodesJson: recoveryCodesJson(codeBytes)
+			});
 		});
-		if (rotated.kind !== "rotated") return rotated;
-		return {
-			kind: "rotated",
-			walletId: input.walletId,
-			recoveryCodes: issued.codes,
-			issuedAtMs: rotated.issuedAtMs,
-			storeVersion: rotated.storeVersion
-		};
 	} finally {
 		factorSecret.fill(0);
 		if (issued) zeroizeIssuedWalletRecoveryCodes(issued);
@@ -41844,49 +41697,55 @@ async function rotateWalletRecoverySetWithActiveFactorV1(input) {
 async function rotateWalletRecoverySetWithEmailOtpV1(input) {
 	let issued = issueWalletRecoveryCodes();
 	try {
-		const current = await readWalletRecoveryCodeStatus({
-			relayUrl: input.relayUrl,
-			walletId: input.walletId,
-			...input.fetchImpl ? { fetchImpl: input.fetchImpl } : {}
-		});
-		if (current.kind !== "ready") return current.kind === "unauthorized" ? {
-			kind: "transport_failed",
-			message: current.message
-		} : current;
-		const replacement = walletRecoverySetRotationWireFromWorkerResultV1(await input.worker.rotateRecoverySet({ recoveryCodesJson: JSON.stringify(issued.codeBytes.map((bytes) => ({ codeBytesB64u: base64UrlEncode(bytes) }))) }));
-		if (replacement.walletId !== input.walletId) throw new Error("Recovery rotation worker returned a different wallet");
-		const recoveryCodeLocators = await deriveRecoveryCodeLocators(issued.codeBytes, replacement.manifestKekWraps);
-		const rotated = await rotateWalletRecoverySet({
-			relayUrl: input.relayUrl,
-			walletId: input.walletId,
-			factorProof: await input.factorProof({
-				operation: "recovery_rotate",
-				payload: {
-					walletId: input.walletId,
-					expectedStoreVersion: current.storeVersion,
-					manifestKekWraps: replacement.manifestKekWraps,
-					entries: [replacement.entry],
-					recoveryCodeLocators
-				}
-			}),
-			expectedStoreVersion: current.storeVersion,
-			replacement,
-			recoveryCodeLocators,
-			...input.fetchImpl ? { fetchImpl: input.fetchImpl } : {}
-		});
-		if (rotated.kind !== "rotated") return rotated;
-		return {
-			kind: "rotated",
-			walletId: input.walletId,
-			recoveryCodes: issued.codes,
-			issuedAtMs: rotated.issuedAtMs,
-			storeVersion: rotated.storeVersion
-		};
+		return await rotateWithIssuedCodes(input, issued, (codeBytes) => input.worker.rotateRecoverySet({ recoveryCodesJson: recoveryCodesJson(codeBytes) }));
 	} finally {
 		if (issued) zeroizeIssuedWalletRecoveryCodes(issued);
 		issued = null;
 	}
 }
+async function rotateWithIssuedCodes(input, issued, rotateInWorker) {
+	const current = await readWalletRecoveryCodeStatus({
+		relayUrl: input.relayUrl,
+		walletId: input.walletId,
+		...input.fetchImpl ? { fetchImpl: input.fetchImpl } : {}
+	});
+	if (current.kind !== "ready") return current.kind === "unauthorized" ? {
+		kind: "transport_failed",
+		message: current.message
+	} : current;
+	const replacement = walletRecoverySetRotationWireFromWorkerResultV1(await rotateInWorker(issued.codeBytes));
+	if (replacement.walletId !== input.walletId) throw new Error("Recovery rotation worker returned a different wallet");
+	const recoveryCodeLocators = await deriveRecoveryCodeLocators(issued.codeBytes, replacement.manifestKekWraps);
+	const rotated = await rotateWalletRecoverySet({
+		relayUrl: input.relayUrl,
+		walletId: input.walletId,
+		factorProof: await input.factorProof({
+			operation: "recovery_rotate",
+			payload: {
+				walletId: input.walletId,
+				expectedStoreVersion: current.storeVersion,
+				manifestKekWraps: replacement.manifestKekWraps,
+				entries: [replacement.entry],
+				recoveryCodeLocators
+			}
+		}),
+		expectedStoreVersion: current.storeVersion,
+		replacement,
+		recoveryCodeLocators,
+		...input.fetchImpl ? { fetchImpl: input.fetchImpl } : {}
+	});
+	if (rotated.kind !== "rotated") return rotated;
+	return {
+		kind: "rotated",
+		walletId: input.walletId,
+		recoveryCodes: issued.codes,
+		issuedAtMs: rotated.issuedAtMs,
+		storeVersion: rotated.storeVersion
+	};
+}
+function recoveryCodesJson(codeBytes) {
+	return JSON.stringify(codeBytes.map((bytes) => ({ codeBytesB64u: base64UrlEncode(bytes) })));
+}
 async function deriveRecoveryCodeLocators(codeBytes, wraps) {
 	if (codeBytes.length !== wraps.length) throw new Error("Recovery code locators do not match the replacement wraps");
 	const recoveryCodeLocators = await Promise.all(codeBytes.map(async (bytes, index) => {
@@ -42445,21 +42304,31 @@ function createWalletHostOwnerApprovalUpdatesV1(args) {
 	};
 }
 function createWalletHostEcdsaSourceContributionMetadataReaderV1(args) {
-	return createDeviceLinkingEcdsaSourceContributionMetadataReaderV1({ readActiveEcdsaCapabilityManifestV1: async ({ materialActivation }) => {
-		const authentication = args.signingEngine.readWalletAuthenticationState();
-		if (authentication.kind !== "authenticated") throw new Error("ECDSA source metadata requires an authenticated wallet");
-		let lookup = await ecdsaCapabilityManifestStore.lookupByMaterialActivation({
-			walletId: authentication.walletId,
-			materialActivation
-		});
-		if (lookup.kind === "ambiguous_authority") lookup = await resolveAmbiguousEcdsaActivationForSelectedAuthMethod({
-			walletId: authentication.walletId,
-			materialActivation,
-			authorities: lookup.authorities
-		});
-		if (lookup.kind !== "active") throw new Error(`ECDSA source metadata manifest is ${lookup.kind}`);
-		return lookup.manifest;
-	} });
+	return createDeviceLinkingEcdsaSourceContributionMetadataReaderV1({
+		readActiveEcdsaCapabilityManifestV1: async ({ materialActivation }) => {
+			const authentication = args.signingEngine.readWalletAuthenticationState();
+			if (authentication.kind !== "authenticated") throw new Error("ECDSA source metadata requires an authenticated wallet");
+			let lookup = await ecdsaCapabilityManifestStore.lookupByMaterialActivation({
+				walletId: authentication.walletId,
+				materialActivation
+			});
+			if (lookup.kind === "ambiguous_authority") lookup = await resolveAmbiguousEcdsaActivationForSelectedAuthMethod({
+				walletId: authentication.walletId,
+				materialActivation,
+				authorities: lookup.authorities
+			});
+			if (lookup.kind !== "active") throw new Error(`ECDSA source metadata manifest is ${lookup.kind}`);
+			return lookup.manifest;
+		},
+		readLinkedEcdsaHolderV1: ({ materialActivation }) => {
+			const authentication = args.signingEngine.readWalletAuthenticationState();
+			if (authentication.kind !== "authenticated") return null;
+			return resolveLinkedEcdsaHolderRuntimeV1({
+				walletId: authentication.walletId,
+				materialActivation
+			});
+		}
+	});
 }
 function createWalletHostDeviceDomainConstructionV1(args) {
 	const relayerUrl = String(args.configs.network.relayer?.url || "").trim();
@@ -42470,7 +42339,7 @@ function createWalletHostDeviceDomainConstructionV1(args) {
 		walletSessions: walletSessionAuthorizations,
 		resolveSelectedWalletAuthority: IndexedDBManager.resolveSelectedWalletAuthority.bind(IndexedDBManager),
 		readWalletAuthenticationState: args.signingEngine.readWalletAuthenticationState.bind(args.signingEngine),
-		readUnlockedEd25519ExportRootCapabilityV1: readUnlockedWalletEd25519ExportRootCapabilityV1
+		readUnlockedEd25519ExportRootCapabilityV1: readUnlockedEd25519ExportRootLinkingCapabilityV1
 	});
 	return {
 		platform,
@@ -42650,6 +42519,14 @@ var SeamsWeb = class {
 	async getWalletIframeExactSessionState() {
 		return await this.walletIframe.getExactSessionState();
 	}
+	/** @internal One wallet-host restore owns all configured-chain prefills. */
+	async prefillRestoredWalletSession(state) {
+		await scheduleRestoredSessionPresignaturePrefills({
+			state,
+			chainTargets: this.configuredChainTargets(),
+			prefill: prefillRouterAbEcdsaDerivationPresignaturePoolDomain.bind(null, this.getWalletAuthDeps())
+		});
+	}
 	async openHostedAuthMenu(request, anchorElement) {
 		return await this.walletIframe.openHostedAuthMenu(request, anchorElement);
 	}
@@ -42998,76 +42875,6 @@ var SeamsWeb = class {
 			error: { message: input.error.message }
 		});
 	}
-	emitEmailOtpRegistrationWorkerProgress(onEvent, args) {
-		const base = {
-			flowId: args.flowId,
-			walletId: args.walletId,
-			authMethod: "email_otp",
-			...args.challengeId ? { requestId: args.challengeId } : {}
-		};
-		switch (args.progress.code) {
-			case "otp.verify.succeeded":
-				this.emitEmailOtpRegistrationEvent(onEvent, {
-					...base,
-					phase: RegistrationEventPhase.STEP_04_OTP_VERIFY_SUCCEEDED,
-					status: "succeeded",
-					interaction: {
-						kind: "otp_input",
-						overlay: "hide"
-					}
-				});
-				return RegistrationEventPhase.STEP_04_OTP_VERIFY_SUCCEEDED;
-			case "signer.email_otp.enroll.started":
-				this.emitEmailOtpRegistrationEvent(onEvent, {
-					...base,
-					phase: RegistrationEventPhase.STEP_09_EMAIL_OTP_SIGNER_ENROLL_STARTED,
-					status: "running"
-				});
-				return RegistrationEventPhase.STEP_09_EMAIL_OTP_SIGNER_ENROLL_STARTED;
-			case "signer.email_otp.enroll.succeeded":
-				this.emitEmailOtpRegistrationEvent(onEvent, {
-					...base,
-					phase: RegistrationEventPhase.STEP_09_EMAIL_OTP_SIGNER_ENROLL_SUCCEEDED,
-					status: "succeeded"
-				});
-				return RegistrationEventPhase.STEP_09_EMAIL_OTP_SIGNER_ENROLL_SUCCEEDED;
-			case "signer.ecdsa.bootstrap.started":
-				this.emitEmailOtpRegistrationEvent(onEvent, {
-					...base,
-					phase: RegistrationEventPhase.STEP_10_ECDSA_SIGNER_PROVISION_STARTED,
-					status: "running",
-					data: { chainTarget: args.chainTarget }
-				});
-				return RegistrationEventPhase.STEP_10_ECDSA_SIGNER_PROVISION_STARTED;
-			case "signer.ecdsa.bootstrap.prepared":
-				this.emitEmailOtpRegistrationEvent(onEvent, {
-					...base,
-					phase: RegistrationEventPhase.STEP_10_ECDSA_SIGNER_PROVISION_STARTED,
-					status: "running",
-					message: "Coordinating EVM signing session",
-					data: { chainTarget: args.chainTarget }
-				});
-				return RegistrationEventPhase.STEP_10_ECDSA_SIGNER_PROVISION_STARTED;
-			case "signer.ecdsa.bootstrap.responded":
-				this.emitEmailOtpRegistrationEvent(onEvent, {
-					...base,
-					phase: RegistrationEventPhase.STEP_10_ECDSA_SIGNER_PROVISION_STARTED,
-					status: "running",
-					message: "Finalizing EVM signing session",
-					data: { chainTarget: args.chainTarget }
-				});
-				return RegistrationEventPhase.STEP_10_ECDSA_SIGNER_PROVISION_STARTED;
-			case "signer.ecdsa.bootstrap.succeeded":
-				this.emitEmailOtpRegistrationEvent(onEvent, {
-					...base,
-					phase: RegistrationEventPhase.STEP_10_ECDSA_SIGNER_PROVISION_SUCCEEDED,
-					status: "succeeded",
-					data: { chainTarget: args.chainTarget }
-				});
-				return RegistrationEventPhase.STEP_10_ECDSA_SIGNER_PROVISION_SUCCEEDED;
-			default: return null;
-		}
-	}
 	emitEmailOtpUnlockWorkerProgress(onEvent, args) {
 		const chainLabel = args.chainTarget.kind === "tempo" ? "Tempo" : "EVM";
 		const base = {
@@ -43704,7 +43511,6 @@ var SeamsWeb = class {
 				this.emitEmailOtpUnlockEvent(args.onEvent, input);
 			};
 			let timingStartedAtMs = nowMs();
-			String(args.relayUrl || this.configs.network.relayer.url).trim();
 			const emailHashHex = await this.emailOtpEmailHashHex(args.emailOtpAuthorityEmail || "");
 			recordEmailOtpUnlockTiming(unlockTiming.timings, "emailHashLookupMs", timingStartedAtMs);
 			timingStartedAtMs = nowMs();