@seams/wallet 0.7.3 → 0.8.0

package/dist/esm/sdk/signEvmFamily-C3C97Th-.js

@@ -1,4607 +0,0 @@
-import { n as __exportAll } from "./chunk-BtrIJ4_z.js";
-import { h as parseMpcMaterialActivationRef, r as mpcMaterialActivationRefsEqual } from "./domainIds-lcrFg6Sa.js";
-import { r as reviewAdmissionForBinding } from "./transactionReviewAdmission-BCPvl8OZ.js";
-import { r as base64UrlDecode } from "./base64-Clm8C-e9.js";
-import { n as secureRandomBase64Url } from "./secureRandomId-BORsmdS4.js";
-import { h as normalizeRuntimePolicyScope } from "./sessionPolicy-DO-MkL65.js";
-import { $ as parseEmailOtpWalletAuthAuthority, Et as routerAbMpcMaterialActivationRefToWire, M as routerAbEcdsaDerivationActiveStateId, Mt as walletSessionPreservesCapabilities, Q as isPasskeyWalletAuthAuthority, Tt as routerAbMpcMaterialActivationRefFromWire, Z as isEmailOtpWalletAuthAuthority, _t as computeEcdsaDerivationRoleLocalRelayerKeyId, a as ROUTER_AB_ECDSA_DERIVATION_OPERATION_STEP_UP_PATH, b as parseRouterAbEcdsaOperationStepUpAuthorizationRequestV1, f as computeRouterAbEcdsaOperationStepUpChallengeB64u, g as parseRouterAbEcdsaDerivationNormalSigningScopeV1, it as walletAuthAuthorityRef, j as requireRouterAbEcdsaDerivationNormalSigningStateV1, nt as parseWalletAuthAuthorityRef, rt as walletAuthAuthoritiesMatch, x as parseRouterAbEcdsaOperationStepUpAuthorizationResponseV1, z as sameRouterAbEcdsaDerivationNormalSigningScopeV1 } from "./ecdsaPresignLifecycle-Bfx2AQKb.js";
-import { t as chainFamilyFromNetwork } from "./chains-BMh3btVo.js";
-import { c as toWalletId, o as thresholdEcdsaChainTargetKey, s as thresholdEcdsaChainTargetsEqual } from "./ecdsaChainTarget-Bl-JWyuw.js";
-import { f as WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION, n as SIGNER_AUTH_METHODS } from "./signerDomain-IEAVrOrc.js";
-import { a as toIndexedDbChainTargetKey } from "./normalization-CBt413-z.js";
-import { C as toThresholdOwnerAddress, It as sameEcdsaSourceSigner, Lt as sameEcdsaTarget, c as buildResolvedEvmFamilyEcdsaKey, f as deriveEvmFamilyKeyFingerprintFromPublicFacts, l as buildVerifiedEcdsaPublicFacts, n as buildBaseEvmFamilyEcdsaKeyIdentity, o as buildHydratedEcdsaSignerMaterial, s as buildPasskeyEcdsaAuthBinding, u as deriveEvmFamilyEcdsaKeyHandle, x as toRpId, y as toEvmFamilyEcdsaKeyHandle } from "./evmFamilyEcdsaIdentity-CqGafQsI.js";
-import { a as isActiveEcdsaWalletAuthorityV1, l as isEd25519ExtensionOfEcdsaWalletAuthority, s as isCombinedWalletSignerActivationSetV1 } from "./walletAuthority-DD9T25F6.js";
-import { a as parseEcdsaRoleLocalPersistedMaterialRef, l as parseEcdsaClientVerifyingShareB64u, s as parseEcdsaThresholdKeyId } from "./keyMaterialBrands-CogGAAZn.js";
-import { a as SIGNING_SESSION_EXPIRY_DETECTION_SOURCES, m as createSigningFlowEvent, o as SigningEventPhase } from "./sdkSentEvents-MqDkbQg1.js";
-import { t as parseSignerSlot } from "./signerSlot-_ovonwVX.js";
-import { c as signingLaneAuthMethod, i as SigningSessionPlanKind, n as SigningOperationIntent, r as SigningSessionIds, s as signingLaneAuthBindingKey } from "./types-Dx9fczU7.js";
-import { t as demoEmailOtpCodeFromDelivery } from "./challengeDelivery-DZtopOAG.js";
-import { t as buildReadySecp256k1SigningMaterial, x as openEcdsaRoleLocalSigningMaterialWasm } from "./secp256k1-D-I6Gh4D.js";
-import { O as projectEcdsaRoleLocalPublicFactsToChainTarget, y as routerAbEcdsaDerivationPublicCapabilitiesEqual } from "./ecdsaCapabilityManifest-DuMs0VtU.js";
-import { c as evmNonceLeaseToManagedReservation, l as evmReserveNonceInputToLane, s as evmManagedReservationToLane } from "./nonceLaneKeys-C3c9lG6u.js";
-import { c as exactSigningLaneIdentityKey, g as requireEvmFamilyEcdsaSigner, n as exactEcdsaSigningLaneIdentity, r as exactEcdsaSigningLaneIdentityFromSelectedLane, s as exactSigningLaneIdentityFromSelectedLane, t as buildEvmFamilyEcdsaSignerBinding } from "./exactSigningLaneIdentity-m6uTXV_A.js";
-import { c as buildTempoTransactionSigningLane, o as buildEvmTransactionSigningLane, x as selectedEcdsaLane, y as laneCandidateAuthMethod } from "./nearEd25519YaoSigningPreparation-CdOT5RuC.js";
-import { a as throwEmailOtpSigningSessionAuthStateError, o as buildEmailOtpRoutePlan } from "./routePlan-D59x5xzQ.js";
-import { r as parseSigningOperationFingerprintDigest } from "./operationFingerprint-CGZui5dR.js";
-import { c as emitSigningPlannerDecisionTrace, l as emitSigningSessionFlowFailure, o as emitSigningBoundaryTrace, s as emitSigningLaneResolutionTrace, t as createSigningBoundaryTraceEvent, u as emitSigningSessionFlowTrace } from "./trace-DKLQZvec.js";
-import { i as loadWebAuthnP256EngineCtor, n as loadSignEvmFamilyWithUiConfirmForTempo, r as loadSignEvmWithUiConfirm, t as loadSecp256k1EngineCtor } from "./signerLoader-B7orgq5Z.js";
-import { a as isPasskeySigningAuthPlan, i as isEmailOtpSigningAuthPlan, n as SigningAuthPlanKind } from "./promptText-CuRa_ivd.js";
-import { t as computeSigningOperationFingerprint, u as signingAuthPlanFromSigningSessionPlan } from "./operationFingerprint-C8Trar4R.js";
-import { _ as WalletSessionQuotaAdmissionError, b as classifyWalletSessionQuotaAdmissionFailure, g as WALLET_SESSION_FAILURE_CODES, h as walletSessionFailureFromError, p as walletSessionFailureErrorFromPayload, v as buildOperationAuthorizationQueueKey, x as decideWalletSessionQuotaAdmissionFailure } from "./routerAbNormalSigning-CVFEOZ2m.js";
-import { C as withThresholdCommitQueue, S as resolveThresholdCommitQueueKey, b as requireAuthoritativeExpiredWalletSessionAuthorizationBoundary, f as ecdsaAvailableLaneCandidatesForTarget, h as isConcreteAvailableSigningLane, o as selectEvmFamilyEcdsaMaterialCandidate, r as prepareTransactionSigningOperation, u as availableEcdsaSigningLaneAuthMethod } from "./transactionState-CJ4U8pcl.js";
-import { t as bytesToHex } from "./bytes-qKxKn4gg.js";
-import { d as buildEvmDisplayModel, l as fromManagedNonceReservationSnapshot, n as isEvmFamilyEcdsaMaterialSupersededError, u as reserveNonceInputFromBoundary } from "./signingFlow-SZ8t_lxv.js";
-import { t as buildTempoDisplayModel } from "./display-P4nQF-yc.js";
-//#region src/core/signingEngine/session/material/linkedEcdsaHolderRuntime.ts
-const linkedHolderRuntimes = /* @__PURE__ */ new Map();
-function runtimeKey(input) {
-	return `${String(input.walletId)}\0${input.materialActivation.activationId}`;
-}
-function installLinkedEcdsaHolderRuntimeV1(runtime) {
-	const key = runtimeKey(runtime);
-	const existing = linkedHolderRuntimes.get(key);
-	if (existing && (existing.authorityId !== runtime.authorityId || existing.walletAuthMethodId !== runtime.walletAuthMethodId || existing.factorAuthority.walletId !== runtime.factorAuthority.walletId || existing.factorAuthority.bindingId !== runtime.factorAuthority.bindingId || existing.holderHandleId !== runtime.holderHandleId || !mpcMaterialActivationRefsEqual(existing.materialActivation, runtime.materialActivation))) throw new Error("linked ECDSA holder runtime conflicts with the active authority");
-	linkedHolderRuntimes.set(key, runtime);
-}
-function resolveLinkedEcdsaHolderRuntimeV1(input) {
-	return linkedHolderRuntimes.get(runtimeKey(input)) ?? null;
-}
-function listLinkedEcdsaHolderRuntimesV1(walletId) {
-	return [...linkedHolderRuntimes.values()].filter((runtime) => walletId === void 0 || runtime.walletId === walletId);
-}
-function removeLinkedEcdsaHolderRuntimeV1(input) {
-	const key = runtimeKey(input);
-	const runtime = linkedHolderRuntimes.get(key);
-	if (!runtime) return;
-	if (runtime.holderHandleId !== input.holderHandleId) throw new Error("linked ECDSA holder runtime changed before removal");
-	linkedHolderRuntimes.delete(key);
-}
-function clearLinkedEcdsaHolderRuntimesV1(walletId) {
-	if (!walletId) {
-		linkedHolderRuntimes.clear();
-		return;
-	}
-	for (const [key, runtime] of linkedHolderRuntimes) if (runtime.walletId === walletId) linkedHolderRuntimes.delete(key);
-}
-//#endregion
-//#region src/core/signingEngine/session/warmCapabilities/sealedRefreshParity.ts
-function isRetryableSealedRefreshCapabilityFetchError(error) {
-	const code = error && typeof error === "object" && "code" in error ? String(error.code || "").trim() : "";
-	if (code === "sealed_refresh_parity_fetch_failed" || code === "sealed_refresh_parity_http_error" || code === "sealed_refresh_parity_aborted") return true;
-	const message = String(error instanceof Error ? error.message : error || "");
-	return message.includes("Failed to fetch relayer well-known capabilities") || /Well-known endpoint returned HTTP 5\d\d/.test(message);
-}
-function parityErrorMessage(error) {
-	return error instanceof Error ? error.message : String(error || "unknown error");
-}
-async function ensureSealedRefreshStartupParityForThresholdEcdsaBootstrap(ensureParity, args) {
-	try {
-		await ensureParity();
-	} catch (error) {
-		if (args.kind === "key_enrollment_bootstrap_parity") {
-			console.warn("[threshold-ecdsa] key enrollment bootstrap skipped sealed-refresh startup parity enforcement", {
-				walletId: String(args.walletId || "").trim(),
-				chainTarget: thresholdEcdsaChainTargetKey(args.chainTarget),
-				error: parityErrorMessage(error)
-			});
-			return;
-		}
-		if (args.kind === "transaction_bootstrap_parity" && isRetryableSealedRefreshCapabilityFetchError(error)) {
-			console.warn("[threshold-ecdsa] transaction bootstrap skipped retryable sealed-refresh capability fetch failure", {
-				walletId: String(args.walletId || "").trim(),
-				chainTarget: thresholdEcdsaChainTargetKey(args.chainTarget),
-				error: parityErrorMessage(error)
-			});
-			return;
-		}
-		if (args.kind === "email_otp_bootstrap_parity" && args.authMethod === SIGNER_AUTH_METHODS.emailOtp && isRetryableSealedRefreshCapabilityFetchError(error)) {
-			console.warn("[threshold-ecdsa] Email OTP bootstrap skipped retryable sealed-refresh capability fetch failure", {
-				walletId: String(args.walletId || "").trim(),
-				chainTarget: thresholdEcdsaChainTargetKey(args.chainTarget),
-				error: parityErrorMessage(error)
-			});
-			return;
-		}
-		if (args.kind === "default_bootstrap_parity" && isRetryableSealedRefreshCapabilityFetchError(error)) {
-			console.warn("[threshold-ecdsa] default bootstrap skipped retryable sealed-refresh capability fetch failure", {
-				walletId: String(args.walletId || "").trim(),
-				chainTarget: thresholdEcdsaChainTargetKey(args.chainTarget),
-				error: parityErrorMessage(error)
-			});
-			return;
-		}
-		throw error;
-	}
-}
-async function ensureSealedRefreshStartupParityForTransactionSigning(ensureParity, args) {
-	try {
-		await ensureParity();
-	} catch (error) {
-		if (!isRetryableSealedRefreshCapabilityFetchError(error)) throw error;
-		console.warn("[threshold-ecdsa] transaction signing skipped retryable sealed-refresh capability fetch failure", {
-			walletId: String(args.walletId || "").trim(),
-			chainTarget: thresholdEcdsaChainTargetKey(args.chainTarget),
-			error: parityErrorMessage(error)
-		});
-	}
-}
-//#endregion
-//#region src/core/signingEngine/flows/signEvmFamily/types.ts
-function evmFamilyRequestChainKind(request) {
-	if (request.kind === "tempoTransaction") return "tempo";
-	if (request.kind === "eip1559") return "evm_compatible";
-	const requestChain = String(request.chain || "").trim();
-	if (requestChain === "tempo" || requestChain === "evm") return requestChain;
-	throw new Error("[SigningEngine][ecdsa] transaction request requires a concrete chain family");
-}
-function evmFamilySigningTargetFromExplicitTarget(args) {
-	const requestChainId = Number(args.request.tx.chainId);
-	if (!Number.isSafeInteger(requestChainId) || requestChainId <= 0) throw new Error("[SigningEngine][ecdsa] transaction request requires a concrete chainId");
-	if (requestChainId !== args.chainTarget.chainId) throw new Error("[SigningEngine][ecdsa] transaction request chainId does not match chainTarget");
-	const requestChainKind = evmFamilyRequestChainKind(args.request);
-	if (requestChainKind !== "evm_compatible" && requestChainKind !== args.chainTarget.kind) throw new Error("[SigningEngine][ecdsa] transaction request chain does not match chainTarget");
-	return args.chainTarget;
-}
-//#endregion
-//#region src/core/signingEngine/flows/signEvmFamily/errors.ts
-function createEvmFamilySigningCancelledError() {
-	const err = /* @__PURE__ */ new Error("Request cancelled");
-	err.code = "cancelled";
-	return err;
-}
-function throwIfEvmFamilySigningCancelled(shouldAbort) {
-	if (typeof shouldAbort === "function" && shouldAbort()) throw createEvmFamilySigningCancelledError();
-}
-function normalizeToken(value) {
-	return String(value || "").trim().toLowerCase().replace(/[\s-]+/g, "_");
-}
-function extractErrorCode(error) {
-	if (!error || typeof error !== "object" || !("code" in error)) return "";
-	return normalizeToken(error.code);
-}
-function extractErrorMessage(error) {
-	if (!error) return "";
-	if (typeof error === "string") return error.trim();
-	if (error instanceof Error) return String(error.message || "").trim();
-	if (typeof error === "object" && "message" in error) return String(error.message || "").trim();
-	return String(error).trim();
-}
-function inferNonceConflictReason(args) {
-	const haystack = `${args.code} ${args.message}`.toLowerCase();
-	if (!haystack.trim()) return null;
-	if (haystack.includes("nonce_too_low") || haystack.includes("nonce too low")) return "nonce_too_low";
-	if (haystack.includes("nonce_too_high") || haystack.includes("nonce too high")) return "nonce_too_high";
-	if (haystack.includes("already_known") || haystack.includes("already known")) return "already_known";
-	if (haystack.includes("replacement_transaction_underpriced") || haystack.includes("replacement transaction underpriced")) return "replacement_underpriced";
-	if (haystack.includes("nonce_conflict") || haystack.includes("nonce") && haystack.includes("conflict") || haystack.includes("invalid nonce") || haystack.includes("nonce has already been used")) return "nonce_conflict";
-	return null;
-}
-function createEvmFamilySigningNonceConflictError(args) {
-	const chainLabel = args.chain === "tempo" ? "Tempo" : "EVM";
-	const err = /* @__PURE__ */ new Error(`[SigningEngine] ${chainLabel} nonce conflict (${args.reason}) on ${args.networkKey}. Refresh nonce context and retry.`);
-	err.code = "nonce_conflict_retryable";
-	err.retryable = true;
-	err.details = {
-		chain: args.chain,
-		reason: args.reason,
-		networkKey: args.networkKey,
-		chainId: args.chainId
-	};
-	if (args.cause !== void 0) try {
-		err.cause = args.cause;
-	} catch {}
-	return err;
-}
-function createEvmFamilySigningNonceLaneBlockedError(args) {
-	const chainLabel = args.chain === "tempo" ? "Tempo" : "EVM";
-	const err = /* @__PURE__ */ new Error(`[SigningEngine] ${chainLabel} nonce lane blocked on ${args.networkKey} (nonce=${args.blockedNonce}). Reconcile lane and retry.`);
-	err.code = "nonce_lane_blocked";
-	err.retryable = true;
-	err.details = {
-		chain: args.chain,
-		networkKey: args.networkKey,
-		chainId: args.chainId,
-		blockedNonce: args.blockedNonce,
-		...typeof args.ageMs === "number" ? { ageMs: args.ageMs } : {}
-	};
-	if (args.cause !== void 0) try {
-		err.cause = args.cause;
-	} catch {}
-	return err;
-}
-function mapToRetryableNonceConflictError(args) {
-	if (!args.error || typeof args.error !== "object") return args.error;
-	const existingCode = extractErrorCode(args.error);
-	if (existingCode === "nonce_conflict_retryable") return args.error;
-	const reason = inferNonceConflictReason({
-		code: existingCode,
-		message: extractErrorMessage(args.error)
-	});
-	if (!reason) return args.error;
-	return createEvmFamilySigningNonceConflictError({
-		chain: args.chain,
-		networkKey: args.networkKey,
-		chainId: args.chainId,
-		reason,
-		cause: args.error
-	});
-}
-function mapToRetryableNonceLaneBlockedError(args) {
-	if (!args.error || typeof args.error !== "object") return args.error;
-	if (extractErrorCode(args.error) === "nonce_lane_blocked") {
-		const details = typeof args.error.details === "object" ? args.error.details || {} : {};
-		const blockedNonceRaw = String(details?.blockedNonce || "").trim();
-		const ageRaw = Number(details?.ageMs);
-		return createEvmFamilySigningNonceLaneBlockedError({
-			chain: args.chain,
-			networkKey: args.networkKey,
-			chainId: args.chainId,
-			blockedNonce: blockedNonceRaw || "unknown",
-			...Number.isFinite(ageRaw) ? { ageMs: ageRaw } : {},
-			cause: args.error
-		});
-	}
-	const message = extractErrorMessage(args.error).toLowerCase();
-	if (message.includes("nonce lane blocked") || message.includes("nonce") && message.includes("blocked")) return createEvmFamilySigningNonceLaneBlockedError({
-		chain: args.chain,
-		networkKey: args.networkKey,
-		chainId: args.chainId,
-		blockedNonce: "unknown",
-		cause: args.error
-	});
-	return args.error;
-}
-function mapToRetryableNonceStateError(args) {
-	const mappedConflict = mapToRetryableNonceConflictError(args);
-	return mapToRetryableNonceLaneBlockedError({
-		...args,
-		error: mappedConflict
-	});
-}
-function isNonceConflictRetryableError(error) {
-	if (!error || typeof error !== "object") return false;
-	return extractErrorCode(error) === "nonce_conflict_retryable";
-}
-function isNonceLaneBlockedRetryableError(error) {
-	if (!error || typeof error !== "object") return false;
-	return extractErrorCode(error) === "nonce_lane_blocked";
-}
-//#endregion
-//#region src/core/signingEngine/flows/signEvmFamily/ecdsaLanes.ts
-function summarizeEvmFamilyEcdsaLane(lane) {
-	if (!lane) return { present: false };
-	const signer = requireEvmFamilyEcdsaSigner(lane.identity, "ECDSA lane summary");
-	return {
-		present: true,
-		walletId: signer.walletId,
-		authMethod: signingLaneAuthMethod(lane.auth),
-		curve: lane.curve,
-		chain: lane.chain,
-		chainFamily: "chainFamily" in lane ? lane.chainFamily : lane.chain,
-		keyKind: "keyKind" in lane ? lane.keyKind : "threshold_ecdsa_secp256k1",
-		sessionOrigin: "sessionOrigin" in lane ? lane.sessionOrigin : void 0,
-		storageSource: "storageSource" in lane ? lane.storageSource : void 0,
-		retention: "retention" in lane ? lane.retention : void 0,
-		walletSessionId: lane.authorization.operationCredential.walletSessionId,
-		materialActivationId: lane.materialActivation.activationId,
-		chainTarget: signer.chainTarget,
-		evmFamilyKeyPresent: Boolean(signer.key)
-	};
-}
-function logEvmFamilyEcdsaLaneDiagnostic(message, details) {
-	try {
-		console.warn(`[SigningEngine][ecdsa] ${message}`, JSON.stringify(details, null, 2));
-	} catch {}
-}
-function requireResolvedEvmFamilyEcdsaSigningLane(args) {
-	const lane = args.lane;
-	if (!lane) {
-		logEvmFamilyEcdsaLaneDiagnostic("missing selected signing lane", {
-			context: args.context,
-			chain: args.chain,
-			...args.diagnostics
-		});
-		throw new Error(`[SigningEngine][ecdsa] missing selected signing lane for ${args.context}`);
-	}
-	if (lane.curve !== "ecdsa" || lane.keyKind !== "threshold_ecdsa_secp256k1") {
-		logEvmFamilyEcdsaLaneDiagnostic("selected signing lane is not ECDSA", {
-			context: args.context,
-			expectedChain: args.chain,
-			lane: summarizeEvmFamilyEcdsaLane(lane),
-			...args.diagnostics
-		});
-		throw new Error(`[SigningEngine][ecdsa] ${args.context} requires an ECDSA signing lane`);
-	}
-	const identity = lane.identity;
-	const signer = requireEvmFamilyEcdsaSigner(identity, `${args.context} resolved ECDSA lane`);
-	const chainTarget = signer.chainTarget;
-	if (chainTarget.kind !== args.chain) {
-		logEvmFamilyEcdsaLaneDiagnostic("selected signing lane chain mismatch", {
-			context: args.context,
-			expectedChain: args.chain,
-			lane: summarizeEvmFamilyEcdsaLane(lane),
-			...args.diagnostics
-		});
-		throw new Error(`[SigningEngine][ecdsa] ${args.context} chain does not match selected lane`);
-	}
-	const key = signer.key;
-	if (!key?.ecdsaThresholdKeyId || !key.signingRootId || !key.signingRootVersion) {
-		logEvmFamilyEcdsaLaneDiagnostic("selected signing lane missing full ECDSA identity", {
-			context: args.context,
-			expectedChain: args.chain,
-			lane: summarizeEvmFamilyEcdsaLane(lane),
-			...args.diagnostics
-		});
-		throw new Error(`[SigningEngine][ecdsa] incomplete ECDSA lane identity for ${args.context}`);
-	}
-	if (!key || String(key.walletId) !== String(signer.walletId) || String(signer.keyHandle || "").trim() === "") {
-		logEvmFamilyEcdsaLaneDiagnostic("selected signing lane missing matching shared key identity", {
-			context: args.context,
-			expectedChain: args.chain,
-			lane: summarizeEvmFamilyEcdsaLane(lane),
-			...args.diagnostics
-		});
-		throw new Error(`[SigningEngine][ecdsa] missing shared key identity for ${args.context}`);
-	}
-	const selectedLane = selectedEcdsaLane({
-		key,
-		materialActivation: signer.materialActivation,
-		keyHandle: signer.keyHandle,
-		walletId: signer.walletId,
-		auth: identity.auth,
-		authorization: lane.authorization,
-		chainTarget
-	});
-	return {
-		...lane,
-		...selectedLane,
-		key,
-		keyHandle: signer.keyHandle,
-		chainTarget,
-		keyKind: "threshold_ecdsa_secp256k1",
-		chainFamily: signer.chainTarget.kind
-	};
-}
-//#endregion
-//#region src/core/signingEngine/interfaces/accountAuthMetadata.ts
-function resolveAccountAuthMetadataForSignerAuthMethod(args) {
-	const primaryAuthMethod = args.authMethod;
-	return {
-		primaryAuthMethod,
-		linkedAuthMethods: [primaryAuthMethod],
-		...args.email ? { email: args.email } : {},
-		...args.passkeyCredentialIds?.length ? { passkeyCredentialIds: args.passkeyCredentialIds } : {}
-	};
-}
-//#endregion
-//#region src/core/signingEngine/flows/signEvmFamily/accountAuth.ts
-async function resolveEvmFamilyTransactionWalletAuth(args) {
-	if (args.senderSignatureAlgorithm === "webauthnP256") return resolveAccountAuthMetadataForSignerAuthMethod({ authMethod: SIGNER_AUTH_METHODS.passkey });
-	if (args.signerAuthMethod !== void 0) return resolveAccountAuthMetadataForSignerAuthMethod({ authMethod: args.signerAuthMethod });
-	throw new Error("[SigningEngine][ecdsa] signer auth method is unavailable");
-}
-//#endregion
-//#region src/core/signingEngine/session/material/ecdsaSigningCapability.ts
-function exactEcdsaSubjectMatches(args) {
-	return args.session.capabilitySubjects.filter((subject) => subject.kind === "sign" && subject.keyFamily === "ecdsa_secp256k1" && mpcMaterialActivationRefsEqual(subject.materialActivation, args.materialActivation)).length === 1;
-}
-function targetMatchesCapability(args) {
-	return args.capability.manifest.signer.scope.targetMemberships.some((target) => thresholdEcdsaChainTargetsEqual(target, args.chainTarget));
-}
-function participantIdsMatch(left, right) {
-	return left.length === right.length && left.every((value, index) => value === right[index]);
-}
-function selectedAuthorityComponentsAreExact(args) {
-	const { selectedAuthority, selectedAuthMethod } = args;
-	return selectedAuthMethod.walletId === args.walletId && selectedAuthMethod.status === "active" && selectedAuthMethod.walletAuthorityId === selectedAuthority.authorityId && selectedAuthority.walletId === args.walletId && selectedAuthority.state === "active";
-}
-function capabilityAuthorityMatchesRuntime(args) {
-	const capabilityAuthority = args.capability.authority;
-	const runtimeBinding = args.runtime.authBinding;
-	switch (runtimeBinding.kind) {
-		case "email_otp": return isEmailOtpWalletAuthAuthority(capabilityAuthority) && walletAuthAuthoritiesMatch(capabilityAuthority, runtimeBinding.emailOtpAuthority);
-		case "passkey": return isPasskeyWalletAuthAuthority(capabilityAuthority) && capabilityAuthority.verifier.rpId === runtimeBinding.rpId && capabilityAuthority.factor.credentialIdB64u === runtimeBinding.credentialIdB64u;
-		default: return runtimeBinding;
-	}
-}
-function selectedAuthMethodMatchesRuntime(args) {
-	switch (args.runtime.authBinding.kind) {
-		case "email_otp": return args.selectedAuthMethod.kind === "email_otp" && args.selectedAuthMethod.emailHashHex === args.runtime.authBinding.emailHashHex;
-		case "passkey": return args.selectedAuthMethod.kind === "passkey" && String(args.selectedAuthMethod.rpId) === String(args.runtime.authBinding.rpId) && args.selectedAuthMethod.credentialIdB64u === args.runtime.authBinding.credentialIdB64u;
-		default: return args.runtime.authBinding;
-	}
-}
-function exactAuthorizationMatchesCapability(args) {
-	if (!Number.isSafeInteger(args.nowMs) || args.nowMs < 0) return false;
-	const { capability, authorization } = args;
-	const session = authorization.session;
-	const operationCredential = authorization.operationCredential;
-	const runtime = authorization.runtime;
-	const signer = capability.manifest.signer;
-	const activation = authorization.selectedAuthority.signerActivations.ecdsa;
-	if (!activation) return false;
-	if (!selectedAuthorityComponentsAreExact({
-		selectedAuthority: authorization.selectedAuthority,
-		selectedAuthMethod: authorization.selectedAuthMethod,
-		walletId: session.walletId
-	})) return false;
-	if (session.walletId !== signer.walletId || session.authorityId !== authorization.selectedAuthority.authorityId || session.authMethodId !== authorization.selectedAuthMethod.walletAuthMethodId || session.authorityDigestB64u !== authorization.selectedAuthority.authorityDigestB64u || session.authorityRevocationEpoch !== authorization.selectedAuthority.revocationEpoch || signer.authority.walletId !== authorization.selectedAuthority.walletId || signer.authority.walletAuthMethodId !== authorization.selectedAuthMethod.walletAuthMethodId || session.authorizationId.trim().length === 0 || session.quotaId.trim().length === 0 || operationCredential.walletSessionId.trim().length === 0 || operationCredential.token.trim().length === 0 || runtime.walletId !== session.walletId || !selectedAuthMethodMatchesRuntime({
-		selectedAuthMethod: authorization.selectedAuthMethod,
-		runtime
-	}) || !mpcMaterialActivationRefsEqual(runtime.materialActivation, capability.manifest.activation.materialActivation) || !mpcMaterialActivationRefsEqual(runtime.roleLocalMaterialRef.materialActivation, runtime.materialActivation) || !targetMatchesCapability({
-		capability,
-		chainTarget: runtime.chainTarget
-	}) || !capabilityAuthorityMatchesRuntime({
-		capability,
-		runtime
-	}) || !exactEcdsaSubjectMatches({
-		session,
-		materialActivation: capability.manifest.activation.materialActivation
-	}) || !mpcMaterialActivationRefsEqual(activation.materialActivation, capability.manifest.activation.materialActivation) || activation.signer.walletId !== session.walletId || runtime.expiresAtMs <= 0 || !Number.isSafeInteger(runtime.remainingUses) || runtime.remainingUses < 0) return false;
-	switch (runtime.kind) {
-		case "exact_ecdsa_direct_capability_runtime_v1": break;
-		case "exact_ecdsa_sealed_runtime_v1":
-			if (runtime.sealedRecord.authMethod !== authorization.selectedAuthMethod.kind || runtime.sealedRecord.storeKey.trim().length === 0 || runtime.sealedRecord.thresholdSessionId.trim().length === 0) return false;
-			break;
-		default: return runtime;
-	}
-	if (session.expiresAtMs <= args.nowMs || runtime.expiresAtMs <= args.nowMs) return false;
-	if (runtime.keyHandle !== String(capability.material.publicFacts.keyHandle) || runtime.ecdsaThresholdKeyId !== String(capability.material.publicFacts.ecdsaThresholdKeyId) || runtime.thresholdEcdsaPublicKeyB64u !== String(capability.material.publicFacts.groupPublicKey33B64u) || !participantIdsMatch(runtime.participantIds, capability.material.publicFacts.participantIds)) return false;
-	return true;
-}
-function isExactPasskeyWalletSessionRuntime(runtime) {
-	return runtime.authBinding.kind === "passkey";
-}
-function isExactEmailOtpWalletSessionRuntime(runtime) {
-	return runtime.authBinding.kind === "email_otp";
-}
-function buildPreprocessingSessionBinding(input) {
-	if (isExactPasskeyWalletSessionRuntime(input.runtime) && input.selected.authMethod.kind === "passkey") return {
-		kind: "ecdsa_preprocessing_session",
-		selectedAuthority: input.selected.authority,
-		selectedAuthMethod: input.selected.authMethod,
-		session: input.session,
-		operationCredential: input.operationCredential,
-		runtime: input.runtime
-	};
-	if (isExactEmailOtpWalletSessionRuntime(input.runtime) && input.selected.authMethod.kind === "email_otp") return {
-		kind: "ecdsa_preprocessing_session",
-		selectedAuthority: input.selected.authority,
-		selectedAuthMethod: input.selected.authMethod,
-		session: input.session,
-		operationCredential: input.operationCredential,
-		runtime: input.runtime
-	};
-	throw new Error("ECDSA preprocessing session auth method is inconsistent");
-}
-function directRuntimeAuthBinding(authority) {
-	if (isPasskeyWalletAuthAuthority(authority)) return {
-		kind: "passkey",
-		rpId: String(authority.verifier.rpId),
-		credentialIdB64u: String(authority.factor.credentialIdB64u)
-	};
-	if (isEmailOtpWalletAuthAuthority(authority)) return {
-		kind: "email_otp",
-		providerSubjectId: String(authority.factor.providerUserId),
-		emailHashHex: String(authority.verifier.emailHashHex),
-		emailOtpAuthority: authority
-	};
-	return authority;
-}
-function buildExactEcdsaDirectCapabilityRuntime(args) {
-	if (!Number.isSafeInteger(args.status.expiresAtMs) || args.status.expiresAtMs <= 0 || !Number.isSafeInteger(args.status.remainingUses) || args.status.remainingUses < 0) throw new Error("Exact ECDSA direct capability requires valid session facts");
-	return {
-		kind: "exact_ecdsa_direct_capability_runtime_v1",
-		walletId: args.runtime.walletId,
-		chainTarget: args.runtime.chainTarget,
-		materialActivation: args.runtime.materialActivation,
-		normalSigning: args.runtime.normalSigning,
-		relayerUrl: args.runtime.relayerUrl,
-		relayerKeyId: args.runtime.relayerKeyId,
-		clientVerifyingPublicKey33B64u: args.runtime.clientVerifyingPublicKey33B64u,
-		participantIds: args.runtime.participantIds,
-		ecdsaThresholdKeyId: args.runtime.ecdsaThresholdKeyId,
-		thresholdEcdsaPublicKeyB64u: args.runtime.thresholdEcdsaPublicKeyB64u,
-		keyHandle: args.runtime.keyHandle,
-		runtimePolicyScope: args.runtime.runtimePolicyScope,
-		roleLocalMaterialRef: args.runtime.roleLocalMaterialRef,
-		authBinding: directRuntimeAuthBinding(args.authority),
-		expiresAtMs: args.status.expiresAtMs,
-		remainingUses: args.status.remainingUses
-	};
-}
-function exactEcdsaAuthBindingsMatch(left, right) {
-	if (left.kind !== right.kind) return false;
-	switch (left.kind) {
-		case "email_otp": return right.kind === "email_otp" && left.providerSubjectId === right.providerSubjectId && left.emailHashHex === right.emailHashHex && walletAuthAuthoritiesMatch(left.emailOtpAuthority, right.emailOtpAuthority);
-		case "passkey": return right.kind === "passkey" && left.rpId === right.rpId && left.credentialIdB64u === right.credentialIdB64u;
-		default: return left;
-	}
-}
-function exactEcdsaWalletSessionRuntimesMatch(left, right) {
-	if (left.kind !== right.kind || left.walletId !== right.walletId || !thresholdEcdsaChainTargetsEqual(left.chainTarget, right.chainTarget) || !mpcMaterialActivationRefsEqual(left.materialActivation, right.materialActivation) || left.keyHandle !== right.keyHandle || left.ecdsaThresholdKeyId !== right.ecdsaThresholdKeyId || !exactEcdsaAuthBindingsMatch(left.authBinding, right.authBinding)) return false;
-	switch (left.kind) {
-		case "exact_ecdsa_direct_capability_runtime_v1": return right.kind === "exact_ecdsa_direct_capability_runtime_v1";
-		case "exact_ecdsa_sealed_runtime_v1": return right.kind === "exact_ecdsa_sealed_runtime_v1" && left.sealedRecord.authMethod === right.sealedRecord.authMethod && left.sealedRecord.storeKey === right.sealedRecord.storeKey && left.sealedRecord.thresholdSessionId === right.sealedRecord.thresholdSessionId;
-		default: return left;
-	}
-}
-function validateExactSessionAuthorization(input) {
-	const walletId = input.session.walletId;
-	if (!Number.isSafeInteger(input.nowMs) || input.nowMs < 0) throw new Error("Exact EVM-family Wallet Session authorization requires a valid timestamp");
-	if (!selectedAuthorityComponentsAreExact({
-		selectedAuthority: input.selected.authority,
-		selectedAuthMethod: input.selected.authMethod,
-		walletId
-	}) || input.selected.selection.walletId !== walletId || input.selected.selection.walletAuthMethodId !== input.selected.authMethod.walletAuthMethodId || input.selected.selection.lockState !== "unlocked") throw new Error("Exact EVM-family Wallet Session authorization selected authority is invalid");
-	const authorization = buildPreprocessingSessionBinding(input);
-	if (!exactAuthorizationMatchesCapability({
-		capability: input.capability,
-		authorization,
-		nowMs: input.nowMs
-	})) throw new Error("Exact EVM-family Wallet Session authorization identity is inconsistent");
-	return authorization;
-}
-function buildExactEvmFamilyWalletSessionAuthorization(input) {
-	const authorization = signingAuthorizationFromPreprocessing(buildEcdsaPreprocessingCapability(input), input.nowMs);
-	if (!authorization) throw new Error("Exact ECDSA signing authorization requires remaining signing uses");
-	return authorization;
-}
-function buildEcdsaPreprocessingCapability(input) {
-	return {
-		kind: "authorized_ecdsa_preprocessing_capability",
-		capability: input.capability,
-		authorization: validateExactSessionAuthorization(input)
-	};
-}
-function signingAuthorizationFromPreprocessing(input, nowMs) {
-	const authorization = input.authorization;
-	const runtime = authorization.runtime;
-	if (runtime.remainingUses <= 0 || !exactAuthorizationMatchesCapability({
-		capability: input.capability,
-		authorization,
-		nowMs
-	})) return null;
-	if (isExactPasskeyWalletSessionRuntime(runtime) && authorization.selectedAuthMethod.kind === "passkey") return {
-		kind: "exact_evm_family_wallet_session_authorization_v1",
-		selectedAuthority: authorization.selectedAuthority,
-		selectedAuthMethod: authorization.selectedAuthMethod,
-		session: authorization.session,
-		operationCredential: authorization.operationCredential,
-		runtime
-	};
-	if (isExactEmailOtpWalletSessionRuntime(runtime) && authorization.selectedAuthMethod.kind === "email_otp") return {
-		kind: "exact_evm_family_wallet_session_authorization_v1",
-		selectedAuthority: authorization.selectedAuthority,
-		selectedAuthMethod: authorization.selectedAuthMethod,
-		session: authorization.session,
-		operationCredential: authorization.operationCredential,
-		runtime
-	};
-	return null;
-}
-function authorizeEvmFamilyEcdsaSigningCapability(input) {
-	if (input.authorization.runtime.remainingUses <= 0 || !exactAuthorizationMatchesCapability({
-		capability: input.capability,
-		authorization: input.authorization,
-		nowMs: input.nowMs
-	})) throw new Error("Exact Wallet Session authorization does not bind the ECDSA signing capability");
-	return {
-		kind: "authorized_evm_family_ecdsa_signing_capability",
-		capability: input.capability,
-		authorization: input.authorization
-	};
-}
-async function buildCanonicalEvmFamilyEcdsaSigningCapability(input) {
-	const signer = input.manifest.signer;
-	const registeredPublicFacts = signer.registeredPublicFacts;
-	const materialPublicFacts = input.material.publicFacts;
-	const authorityRef = await walletAuthAuthorityRef({ authority: input.authority });
-	if (authorityRef.authorityDigest !== signer.authority.authorityDigest || authorityRef.walletId !== signer.walletId || input.material.authority.walletId !== signer.walletId || input.material.authority.authorityDigest !== signer.authority.authorityDigest || !mpcMaterialActivationRefsEqual(input.material.materialActivation, input.manifest.activation.materialActivation) || materialPublicFacts.walletId !== signer.walletId || materialPublicFacts.keyHandle !== registeredPublicFacts.keyHandle || String(materialPublicFacts.groupPublicKey33B64u) !== String(registeredPublicFacts.publicKeyB64u) || materialPublicFacts.ethereumAddress !== registeredPublicFacts.thresholdOwnerAddress || materialPublicFacts.participantIds.length !== registeredPublicFacts.participantIds.length || materialPublicFacts.participantIds.some((participantId, index) => participantId !== registeredPublicFacts.participantIds[index])) throw new Error("Canonical EVM-family ECDSA signing capability identity is inconsistent");
-	return {
-		kind: "canonical_evm_family_ecdsa_signing_capability",
-		authority: input.authority,
-		manifest: input.manifest,
-		material: input.material
-	};
-}
-//#endregion
-//#region src/core/signingEngine/session/material/ecdsaRoleLocalMaterialResolver.ts
-const persistedMaterialBrand = Symbol("persisted-ecdsa-role-local-material");
-function materialRefMatchesPublicFacts(materialRef, publicFacts) {
-	return materialRef.bindingDigest === publicFacts.contextBinding32B64u;
-}
-function liveHandleMatchesMaterialRef(liveHandle, materialRef) {
-	return liveHandle.durableMaterialRef === materialRef.durableMaterialRef && liveHandle.bindingDigest === materialRef.bindingDigest;
-}
-function errorMessage(error) {
-	return error instanceof Error ? error.message : String(error);
-}
-function corruptResolution(args) {
-	return {
-		kind: "corrupt",
-		purpose: args.purpose,
-		reason: args.reason,
-		message: args.message
-	};
-}
-function resolutionFromRehydrationFailure(args) {
-	switch (args.failure.reason) {
-		case "missing": return {
-			kind: "device_link_required",
-			purpose: args.purpose,
-			reason: "missing_local_material"
-		};
-		case "expired": return corruptResolution({
-			purpose: args.purpose,
-			reason: "expired",
-			message: "ECDSA role-local persisted material has expired"
-		});
-		case "binding_mismatch": return corruptResolution({
-			purpose: args.purpose,
-			reason: "binding_mismatch",
-			message: "ECDSA role-local persisted material binding does not match its public facts"
-		});
-		case "corrupt": return corruptResolution({
-			purpose: args.purpose,
-			reason: "corrupt_persistence",
-			message: "ECDSA role-local persisted material is corrupt"
-		});
-		default: {
-			const exhaustive = args.failure.reason;
-			throw new Error(`Unsupported ECDSA role-local restoration failure: ${String(exhaustive)}`);
-		}
-	}
-}
-function buildPersistedEcdsaRoleLocalMaterial(input) {
-	const authority = parseWalletAuthAuthorityRef(input.authority);
-	if (!authority) throw new Error("ECDSA role-local persisted material authority is invalid");
-	const materialActivationResult = parseMpcMaterialActivationRef(input.materialActivation);
-	if (!materialActivationResult.ok) throw new Error(materialActivationResult.error.message);
-	if (authority.walletId !== input.publicFacts.walletId) throw new Error("ECDSA role-local persisted material authority does not match its wallet");
-	return {
-		[persistedMaterialBrand]: true,
-		kind: "persisted_ecdsa_role_local_material_v1",
-		authority,
-		materialActivation: materialActivationResult.value,
-		publicFacts: input.publicFacts
-	};
-}
-function ecdsaRoleLocalPersistedMaterialSource(persistedMaterial) {
-	return {
-		kind: "persisted",
-		authority: persistedMaterial.authority,
-		materialActivation: persistedMaterial.materialActivation,
-		publicFacts: persistedMaterial.publicFacts
-	};
-}
-async function resolveEcdsaRoleLocalMaterial(input) {
-	switch (input.source.kind) {
-		case "unavailable": return {
-			kind: "device_link_required",
-			purpose: input.purpose,
-			reason: input.source.reason
-		};
-		case "persisted": try {
-			const rehydrated = await openEcdsaRoleLocalSigningMaterialWasm({
-				authority: input.source.authority,
-				materialActivation: input.source.materialActivation,
-				workerCtx: input.workerCtx
-			});
-			if (!rehydrated.ok) return resolutionFromRehydrationFailure({
-				purpose: input.purpose,
-				failure: rehydrated
-			});
-			if (!mpcMaterialActivationRefsEqual(rehydrated.materialRef.materialActivation, input.source.materialActivation) || !materialRefMatchesPublicFacts(rehydrated.materialRef, input.source.publicFacts)) return corruptResolution({
-				purpose: input.purpose,
-				reason: "worker_identity_mismatch",
-				message: "ECDSA role-local worker restored a different material identity"
-			});
-			if (!liveHandleMatchesMaterialRef(rehydrated.liveHandle, rehydrated.materialRef)) return corruptResolution({
-				purpose: input.purpose,
-				reason: "worker_identity_mismatch",
-				message: "ECDSA role-local worker restored a different durable material"
-			});
-			return {
-				kind: "rehydrated",
-				purpose: input.purpose,
-				liveHandle: rehydrated.liveHandle,
-				materialRef: rehydrated.materialRef
-			};
-		} catch (error) {
-			return corruptResolution({
-				purpose: input.purpose,
-				reason: "persistence_unavailable",
-				message: errorMessage(error)
-			});
-		}
-		default: {
-			const exhaustive = input.source;
-			throw new Error(`Unsupported ECDSA role-local material source: ${String(exhaustive)}`);
-		}
-	}
-}
-//#endregion
-//#region src/core/signingEngine/session/identity/ownerLaneScope.ts
-var OwnerLaneScopeIntegrityError = class extends Error {
-	constructor(message) {
-		super(`[OwnerLaneScope] ${message}`);
-		this.name = "OwnerLaneScopeIntegrityError";
-	}
-};
-/**
-* The active authority names a credential this device holds no active
-* canonical wallet auth method for: a pre-Phase-8 enrollment (or a device
-* whose canonical state was removed). It cannot act as a human owner until it
-* links again. Distinct from OwnerLaneScopeIntegrityError so request
-* boundaries and the UI can surface "link this device again" instead of a
-* generic integrity failure.
-*/
-var OwnerRelinkRequiredError = class extends Error {
-	constructor(walletAuthMethodId) {
-		super(`[OwnerLaneScope] relink_required: no active canonical wallet auth method (${walletAuthMethodId})`);
-		this.code = "relink_required";
-		this.reason = "missing_canonical_owner_binding";
-		this.name = "OwnerRelinkRequiredError";
-	}
-};
-function isOwnerRelinkRequiredError(error) {
-	return error instanceof OwnerRelinkRequiredError && error.name === "OwnerRelinkRequiredError" && error.code === "relink_required";
-}
-function passkeyWalletAuthAuthorityFromV2Record(record) {
-	return {
-		walletId: record.walletId,
-		factor: {
-			kind: "passkey",
-			credentialIdB64u: record.credentialIdB64u
-		},
-		verifier: {
-			kind: "webauthn",
-			rpId: record.rpId
-		},
-		bindingId: record.walletAuthMethodId
-	};
-}
-/**
-* The exact Email OTP authority for an installation that holds no local factor
-* record — a linked device, whose factor record belongs to registration. The
-* V2 record carries every field but the provider identity, which the caller
-* supplies from this installation's verified lanes.
-*/
-function emailOtpWalletAuthAuthorityFromProviderSubject(args) {
-	const providerUserId = String(args.providerSubjectId || "").trim();
-	if (!providerUserId) throw new OwnerLaneScopeIntegrityError("active Email OTP method has no exact local factor");
-	const authority = parseEmailOtpWalletAuthAuthority({
-		walletId: args.authMethod.walletId,
-		factor: {
-			kind: "email_otp",
-			provider: providerUserId.startsWith("google:") ? "google" : "email",
-			providerUserId
-		},
-		verifier: {
-			kind: "email_otp_wallet_auth_method",
-			emailHashHex: args.authMethod.emailHashHex
-		},
-		bindingId: args.authMethod.walletAuthMethodId
-	});
-	if (!authority) throw new OwnerLaneScopeIntegrityError("active Email OTP method has no exact local factor");
-	return authority;
-}
-function emailOtpWalletAuthAuthorityFromLocalFactor(args) {
-	const matches = args.localMethods.filter((record) => record.kind === "email_otp" && record.status === "active" && record.walletId === args.authMethod.walletId && record.emailHashHex === args.authMethod.emailHashHex);
-	const localMethod = matches[0];
-	const authority = localMethod ? parseEmailOtpWalletAuthAuthority(localMethod.authority) : null;
-	if (matches.length !== 1 || !authority || authority.walletId !== args.authMethod.walletId || authority.bindingId !== args.authMethod.walletAuthMethodId || authority.verifier.emailHashHex !== args.authMethod.emailHashHex) throw new OwnerLaneScopeIntegrityError("active Email OTP method has no exact local factor");
-	return authority;
-}
-/**
-* Registration's local factor record first, because it is the authoritative
-* one where it exists; a linked installation falls back to the provider
-* subject its own lanes carry.
-*/
-async function resolveEmailOtpWalletAuthAuthority(args) {
-	const walletId = String(args.authMethod.walletId);
-	try {
-		return emailOtpWalletAuthAuthorityFromLocalFactor({
-			authMethod: args.authMethod,
-			localMethods: await args.stores.listWalletAuthMethodsForWallet(walletId)
-		});
-	} catch (error) {
-		if (!args.stores.readEmailOtpProviderSubjectForWallet) throw error;
-		const providerSubjectId = await args.stores.readEmailOtpProviderSubjectForWallet(walletId);
-		if (!providerSubjectId) throw error;
-		return emailOtpWalletAuthAuthorityFromProviderSubject({
-			authMethod: args.authMethod,
-			providerSubjectId
-		});
-	}
-}
-function assertExactFactorAuthorityBinding(args) {
-	if (args.authority.walletId !== args.authMethod.walletId || args.authority.bindingId !== args.authMethod.walletAuthMethodId) throw new OwnerLaneScopeIntegrityError("active wallet auth method does not have an exact factor authority binding");
-	return args.authority;
-}
-async function resolveExactWalletAuthAuthority(args) {
-	if (args.authMethod.kind === "passkey") return assertExactFactorAuthorityBinding({
-		authMethod: args.authMethod,
-		authority: passkeyWalletAuthAuthorityFromV2Record(args.authMethod)
-	});
-	return assertExactFactorAuthorityBinding({
-		authMethod: args.authMethod,
-		authority: await resolveEmailOtpWalletAuthAuthority({
-			authMethod: args.authMethod,
-			stores: args.stores
-		})
-	});
-}
-function buildExactPasskeyOwnerLaneScope(args) {
-	return {
-		auth: {
-			kind: "passkey",
-			rpId: toRpId(args.authMethod.rpId),
-			credentialIdB64u: args.authMethod.credentialIdB64u
-		},
-		signerSlot: args.signerSlot
-	};
-}
-function buildExactEcdsaPasskeyOwnerLaneScope(args) {
-	return {
-		auth: {
-			kind: "passkey",
-			rpId: toRpId(args.authMethod.rpId),
-			credentialIdB64u: args.authMethod.credentialIdB64u
-		},
-		keyFamily: "ecdsa"
-	};
-}
-function buildExactLinkedEmailOtpOwnerLaneScope(args) {
-	if (args.factorAuthority.walletId !== args.authMethod.walletId || args.factorAuthority.bindingId !== args.authMethod.walletAuthMethodId || args.factorAuthority.verifier.emailHashHex !== args.authMethod.emailHashHex || args.authorityRef.walletId !== args.authMethod.walletId || args.authorityRef.walletAuthMethodId !== args.authMethod.walletAuthMethodId) throw new OwnerLaneScopeIntegrityError("linked Email OTP authority does not match the selected V2 method");
-	return {
-		auth: {
-			kind: "email_otp",
-			providerSubjectId: String(args.factorAuthority.factor.providerUserId)
-		},
-		ownerAuthority: {
-			walletAuthMethodId: args.authorityRef.walletAuthMethodId,
-			authorityDigest: args.authorityRef.authorityDigest
-		}
-	};
-}
-async function passkeyOwnerLaneScope(args) {
-	const authenticator = await args.stores.getWalletPasskeyAuthenticator({
-		walletId: String(args.authMethod.walletId),
-		credentialId: args.authMethod.credentialIdB64u
-	});
-	if (!authenticator || authenticator.credentialId !== args.authMethod.credentialIdB64u) throw new OwnerLaneScopeIntegrityError("active Passkey auth method has no exact local authenticator");
-	const signerSlot = parseSignerSlot(authenticator.signerSlot, { min: 1 });
-	if (signerSlot === null) throw new OwnerLaneScopeIntegrityError("local authenticator signer slot is invalid");
-	return buildExactPasskeyOwnerLaneScope({
-		authMethod: args.authMethod,
-		signerSlot
-	});
-}
-async function resolveExactOwnerLaneScope(args) {
-	if (args.authMethod.kind === "passkey") return await passkeyOwnerLaneScope({
-		authMethod: args.authMethod,
-		stores: args.stores
-	});
-	const authority = await resolveEmailOtpWalletAuthAuthority({
-		authMethod: args.authMethod,
-		stores: args.stores
-	});
-	const authorityRef = await walletAuthAuthorityRef({ authority });
-	return {
-		auth: {
-			kind: "email_otp",
-			providerSubjectId: String(authority.factor.providerUserId)
-		},
-		ownerAuthority: {
-			walletAuthMethodId: authorityRef.walletAuthMethodId,
-			authorityDigest: authorityRef.authorityDigest
-		}
-	};
-}
-//#endregion
-//#region src/core/signingEngine/session/emailOtp/ecdsaSigningSessionAuthority.ts
-function isExactSelectedWalletAuthority(selected) {
-	return selected.kind === "resolved" && selected.authMethod.status === "active" && selected.authority.state === "active";
-}
-function emailOtpEcdsaSigningSessionAuthLane(authorization) {
-	if (authorization.selectedAuthMethod.kind !== "email_otp" || authorization.runtime.kind !== "exact_ecdsa_sealed_runtime_v1" || authorization.runtime.authBinding.kind !== "email_otp" || authorization.operationCredential.token.trim().length === 0 || authorization.runtime.sealedRecord.thresholdSessionId.trim().length === 0) throw new Error("Exact Email OTP ECDSA signing-session authorization is incomplete");
-	return {
-		kind: "signing_session",
-		operationCredential: authorization.operationCredential,
-		thresholdSessionId: authorization.runtime.sealedRecord.thresholdSessionId,
-		curve: "ecdsa",
-		chainTarget: authorization.runtime.chainTarget
-	};
-}
-/**
-* The sealed runtime and capability manifest identify the material and Email
-* OTP authority. The selected authority and exact Wallet Session record must
-* reproduce that tuple before the signing-session lane can be built.
-*/
-async function resolveExactEmailOtpEcdsaSigningSessionAuthority(ports, args) {
-	if (args.runtime.kind !== "exact_ecdsa_sealed_runtime_v1" || args.runtime.walletId !== args.walletId || !thresholdEcdsaChainTargetsEqual(args.runtime.chainTarget, args.chainTarget) || !mpcMaterialActivationRefsEqual(args.runtime.materialActivation, args.manifest.activation.materialActivation) || args.manifest.signer.walletId !== args.walletId) return null;
-	if (args.runtime.authBinding.kind !== "email_otp") return null;
-	let runtimeAuthorityRef;
-	try {
-		runtimeAuthorityRef = await walletAuthAuthorityRef({ authority: args.runtime.authBinding.emailOtpAuthority });
-	} catch {
-		return null;
-	}
-	const manifestAuthorityRef = args.manifest.signer.authority;
-	if (runtimeAuthorityRef.walletId !== args.walletId || runtimeAuthorityRef.walletAuthMethodId !== manifestAuthorityRef.walletAuthMethodId || runtimeAuthorityRef.authorityDigest !== manifestAuthorityRef.authorityDigest || manifestAuthorityRef.walletId !== args.walletId) return null;
-	let selected;
-	try {
-		selected = await ports.resolveSelectedWalletAuthority(String(args.walletId));
-	} catch {
-		return null;
-	}
-	if (!isExactSelectedWalletAuthority(selected)) return null;
-	const { selection, authMethod, authority } = selected;
-	const ecdsaActivation = authority.signerActivations.ecdsa;
-	if (selection.lockState !== "unlocked" || selection.walletId !== args.walletId || authMethod.kind !== "email_otp" || authMethod.status !== "active" || authMethod.walletId !== args.walletId || authority.state !== "active" || authority.walletId !== args.walletId || selection.walletAuthMethodId !== authMethod.walletAuthMethodId || authMethod.walletAuthorityId !== authority.authorityId || authMethod.walletAuthMethodId !== runtimeAuthorityRef.walletAuthMethodId || !ecdsaActivation || ecdsaActivation.signer.walletId !== args.walletId || !mpcMaterialActivationRefsEqual(ecdsaActivation.materialActivation, args.runtime.materialActivation)) return null;
-	let selectedFactorAuthority;
-	try {
-		selectedFactorAuthority = await resolveExactWalletAuthAuthority({
-			authMethod,
-			stores: ports.factorStores
-		});
-	} catch {
-		return null;
-	}
-	if (!walletAuthAuthoritiesMatch(selectedFactorAuthority, args.runtime.authBinding.emailOtpAuthority)) return null;
-	let authorizationRead;
-	try {
-		authorizationRead = await ports.readExactWalletSessionAuthorization({
-			walletId: args.walletId,
-			authorityId: authority.authorityId,
-			authMethodId: authMethod.walletAuthMethodId
-		});
-	} catch {
-		return null;
-	}
-	if (authorizationRead.kind !== "found") return null;
-	const { record, operationCredential } = authorizationRead;
-	if (record.walletId !== args.walletId || record.authorityId !== authority.authorityId || record.authMethodId !== authMethod.walletAuthMethodId || record.authorityDigestB64u !== authority.authorityDigestB64u || record.authorityRevocationEpoch !== authority.revocationEpoch || record.expiresAtMs <= Date.now() || operationCredential.walletSessionId.trim().length === 0 || operationCredential.token.trim().length === 0) return null;
-	if (record.capabilitySubjects.filter((subject) => subject.kind === "sign" && subject.keyFamily === "ecdsa_secp256k1" && mpcMaterialActivationRefsEqual(subject.materialActivation, args.runtime.materialActivation)).length !== 1) return null;
-	try {
-		return buildExactEvmFamilyWalletSessionAuthorization({
-			capability: await buildCanonicalEvmFamilyEcdsaSigningCapability({
-				authority: args.runtime.authBinding.emailOtpAuthority,
-				manifest: args.manifest,
-				material: buildPersistedEcdsaRoleLocalMaterial({
-					authority: args.manifest.signer.authority,
-					materialActivation: args.manifest.activation.materialActivation,
-					publicFacts: args.manifest.durableMaterial.roleLocalPublicFacts
-				})
-			}),
-			selected,
-			session: record,
-			operationCredential,
-			runtime: args.runtime,
-			nowMs: Date.now()
-		});
-	} catch {
-		return null;
-	}
-}
-//#endregion
-//#region src/core/signingEngine/flows/signEvmFamily/events.ts
-function emitEvmFamilyBroadcastEvent(onEvent, event) {
-	try {
-		onEvent?.(createSigningFlowEvent({
-			...event,
-			flowId: event.flowId ?? createEvmFamilySigningFlowId(event)
-		}));
-	} catch {}
-}
-function createEvmFamilySigningFlowId(event) {
-	const data = event.data || {};
-	return [
-		"signing",
-		String(data.chain || "evm_family"),
-		String(data.networkKey || "unknown_network"),
-		String(data.nonce || "") || String(event.phase)
-	].join(":");
-}
-function emitEvmFamilySigningEvent(onEvent, event) {
-	emitEvmFamilyBroadcastEvent(onEvent, event);
-}
-function emitEvmFamilySigningOperationTrace(event) {
-	if (!isEvmFamilySigningOperationTraceEnabled()) return;
-	try {
-		console.debug("[SigningOperationMachine][evm-family]", event);
-	} catch {}
-}
-function isEvmFamilySigningOperationTraceEnabled() {
-	try {
-		return globalThis.localStorage?.getItem("seams:debug:signing-operation") === "1";
-	} catch {
-		return false;
-	}
-}
-//#endregion
-//#region src/core/signingEngine/threshold/ecdsa/signingQueue.ts
-async function withThresholdEcdsaSigningQueue(args) {
-	return await withThresholdCommitQueue({
-		...args,
-		labels: {
-			queue: "threshold ECDSA signing queue",
-			queuedOperation: "threshold ECDSA queued signing operation"
-		},
-		owner: String(args.walletId).trim()
-	});
-}
-//#endregion
-//#region src/core/signingEngine/flows/signEvmFamily/emailOtpSigningSession.ts
-/** The capability is the authority. Anything the caller or the confirmation
-* plan supplies must agree with it exactly, or the OTP would be sent to a
-* different mailbox than the one bound to the material being signed with. */
-function emailOtpEcdsaCapabilityStepUpAuthority(args) {
-	const capabilityAuthority = args.capability.authority;
-	if (!isEmailOtpWalletAuthAuthority(capabilityAuthority)) throw new Error("[SigningEngine] Email OTP operation step-up requires an Email OTP capability authority");
-	if (args.claimedAuthority && !walletAuthAuthoritiesMatch(capabilityAuthority, args.claimedAuthority)) throw new Error("[SigningEngine] Email OTP step-up authority does not match the selected capability");
-	if (!mpcMaterialActivationRefsEqual(args.capability.manifest.activation.materialActivation, args.materialActivation)) throw new Error("[SigningEngine] Email OTP step-up material activation does not match the selected capability");
-	const operationFingerprint = String(args.operationFingerprint || "").trim();
-	if (!operationFingerprint) throw new Error("[SigningEngine] Email OTP operation step-up requires an operation fingerprint");
-	return {
-		kind: "capability_step_up",
-		capabilityAuthority,
-		materialActivation: args.materialActivation,
-		operationFingerprint
-	};
-}
-function emailOtpEcdsaChallengeAuthority(authority) {
-	switch (authority.kind) {
-		case "live_session":
-			if (authority.committedLane.authority.factor.kind !== "email_otp") throw new Error("[SigningEngine][ecdsa] Email OTP challenge requires Email OTP authority");
-			return {
-				kind: "live_session",
-				authLane: authority.committedLane.authLane
-			};
-		case "capability_step_up": return {
-			kind: "capability_step_up",
-			capabilityAuthority: authority.capabilityAuthority,
-			materialActivation: authority.materialActivation,
-			operationFingerprint: authority.operationFingerprint
-		};
-	}
-}
-function createEmailOtpEcdsaTransactionSigningBridge(args) {
-	let mintedForOperationFingerprint = null;
-	return { challenge: async () => {
-		if (typeof args.requestEmailOtpTransactionSigningChallenge !== "function") throw new Error("[SigningEngine] Email OTP ECDSA signing step-up is not configured");
-		if (args.authority.kind === "capability_step_up") {
-			if (mintedForOperationFingerprint !== null && mintedForOperationFingerprint !== args.authority.operationFingerprint) throw new Error("[SigningEngine] Email OTP step-up challenge is bound to a different operation");
-			mintedForOperationFingerprint = args.authority.operationFingerprint;
-		}
-		emitEvmFamilySigningEvent(args.onEvent, {
-			phase: SigningEventPhase.STEP_06_AUTH_EMAIL_OTP_CHALLENGE_STARTED,
-			status: "running",
-			walletId: args.walletId,
-			interaction: {
-				kind: "none",
-				overlay: "none"
-			}
-		});
-		emitSigningBoundaryTrace("evm-family", createSigningBoundaryTraceEvent({
-			event: "auth_side_effect_started",
-			lane: args.selectedLane,
-			sideEffect: "email_otp_challenge",
-			phase: "confirmed"
-		}));
-		const challenge = await args.requestEmailOtpTransactionSigningChallenge({
-			walletSession: args.walletSession,
-			chain: args.chain,
-			authority: emailOtpEcdsaChallengeAuthority(args.authority),
-			operationFingerprintDigest: args.operationFingerprintDigest
-		});
-		const challengeId = String(challenge.challengeId || "").trim();
-		if (!challengeId) throw new Error("[SigningEngine] Email OTP challenge response did not include challengeId");
-		emitEvmFamilySigningEvent(args.onEvent, {
-			phase: SigningEventPhase.STEP_06_AUTH_EMAIL_OTP_INPUT_REQUIRED,
-			status: "waiting_for_user",
-			walletId: args.walletId,
-			interaction: {
-				kind: "otp_input",
-				overlay: "show"
-			},
-			data: {
-				emailHint: challenge.emailHint,
-				demoOtpCode: demoEmailOtpCodeFromDelivery(challenge.delivery)
-			}
-		});
-		return {
-			challengeId,
-			email: String(challenge.emailHint || "").trim()
-		};
-	} };
-}
-/** Canonical Email OTP signing-session resolution: the manifest proves exact
-* material, the sealed runtime supplies session-scoped facts and the Email OTP
-* binding, and the reusable Wallet Session is resolved independently. Refresh
-* must land on the same material activation it started from, so the caller
-* checks that before and after; nothing here invokes Yao recovery or device
-* linking. */
-async function resolveEmailOtpEcdsaSigningSessionAuth(args, authorityPorts) {
-	const resolved = await authorityPorts.resolveActiveEcdsaCapabilityRuntime({
-		walletId: args.walletId,
-		chainTarget: args.chainTarget
-	});
-	if (resolved.kind !== "resolved") throwEmailOtpSigningSessionAuthStateError({
-		kind: "auth_lane_missing",
-		source: "evm_signing_refresh",
-		expectedCurve: "ecdsa"
-	});
-	const authority = await resolveExactEmailOtpEcdsaSigningSessionAuthority(authorityPorts, {
-		walletId: args.walletId,
-		chainTarget: args.chainTarget,
-		manifest: resolved.manifest,
-		runtime: resolved.runtime
-	});
-	if (!authority) throwEmailOtpSigningSessionAuthStateError({
-		kind: "auth_lane_missing",
-		source: "evm_signing_refresh",
-		expectedCurve: "ecdsa"
-	});
-	return {
-		manifest: resolved.manifest,
-		runtime: resolved.runtime,
-		authority
-	};
-}
-async function requestEmailOtpSigningSessionChallenge(deps, args) {
-	const { authority } = await deps.resolveSigningSessionAuth({
-		walletId: args.walletSession.walletId,
-		chainTarget: args.chainTarget
-	});
-	return await deps.emailOtpSessions.requestTransactionSigningChallenge({
-		kind: "wallet_session_challenge",
-		walletSession: args.walletSession,
-		chain: args.chainTarget.kind,
-		authLane: emailOtpEcdsaSigningSessionAuthLane(authority)
-	});
-}
-async function resolveFencedEmailOtpSigningSessionAuth(input) {
-	let current;
-	try {
-		current = await input.deps.resolveSigningSessionAuth({
-			walletId: input.args.walletSession.walletId,
-			chainTarget: input.args.chainTarget
-		});
-	} catch {
-		throw new Error(`[SigningEngine][ecdsa] Email OTP signing-session refresh material was superseded ${input.phase}`);
-	}
-	if (!mpcMaterialActivationRefsEqual(current.runtime.materialActivation, input.activationBeforeRefresh)) throw new Error(`[SigningEngine][ecdsa] Email OTP signing-session refresh material was superseded ${input.phase}`);
-	return current;
-}
-async function runFencedEmailOtpSigningSessionRefresh(input) {
-	const { manifest, runtime, authority } = await resolveFencedEmailOtpSigningSessionAuth({
-		deps: input.deps,
-		args: input.args,
-		activationBeforeRefresh: input.activationBeforeRefresh,
-		phase: "before use"
-	});
-	const routePlan = buildEmailOtpRoutePlan({
-		routeFamily: "signing_session",
-		authLane: emailOtpEcdsaSigningSessionAuthLane(authority),
-		operation: WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION
-	});
-	const publicFacts = buildVerifiedEcdsaPublicFacts({
-		keyHandle: toEvmFamilyEcdsaKeyHandle(String(manifest.durableMaterial.roleLocalPublicFacts.keyHandle)),
-		publicKeyB64u: runtime.thresholdEcdsaPublicKeyB64u,
-		participantIds: [...runtime.participantIds],
-		thresholdOwnerAddress: manifest.durableMaterial.roleLocalPublicFacts.ethereumAddress
-	});
-	const emailOtpBinding = runtime.authBinding;
-	if (emailOtpBinding.kind !== "email_otp") throw new Error("Email OTP signing-session refresh requires an Email OTP sealed runtime");
-	const refreshed = await input.deps.emailOtpSessions.loginWithEcdsaCapabilityInternal({
-		walletSession: input.args.walletSession,
-		authoritySelector: {
-			kind: "wallet_auth_method",
-			walletAuthMethodId: String((await walletAuthAuthorityRef({ authority: emailOtpBinding.emailOtpAuthority })).walletAuthMethodId)
-		},
-		chainTarget: input.args.chainTarget,
-		emailOtpAuthPolicy: "session",
-		emailOtpAuthReason: "sign",
-		challengeId: input.args.challengeId,
-		otpCode: input.args.otpCode,
-		operation: WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION,
-		routePlan,
-		publicFacts,
-		ecdsaBootstrapAuthorization: { kind: "route_plan_auth" },
-		providerIdentity: {
-			kind: "explicit_provider_user",
-			provider: emailOtpBinding.emailOtpAuthority.factor.provider,
-			providerUserId: emailOtpBinding.providerSubjectId
-		},
-		emailHashHex: emailOtpBinding.emailHashHex,
-		...typeof input.args.ttlMs === "number" ? { ttlMs: input.args.ttlMs } : {},
-		...typeof input.args.remainingUses === "number" ? { remainingUses: input.args.remainingUses } : {},
-		...runtime.runtimePolicyScope ? { runtimePolicyScope: runtime.runtimePolicyScope } : {}
-	});
-	await resolveFencedEmailOtpSigningSessionAuth({
-		deps: input.deps,
-		args: input.args,
-		activationBeforeRefresh: input.activationBeforeRefresh,
-		phase: "during refresh"
-	});
-	return refreshed;
-}
-async function refreshEmailOtpSigningSession(deps, args) {
-	const activationBeforeRefresh = (await deps.resolveSigningSessionAuth({
-		walletId: args.walletSession.walletId,
-		chainTarget: args.chainTarget
-	})).runtime.materialActivation;
-	return await deps.withThresholdEcdsaSigningQueue({
-		queueKey: resolveThresholdCommitQueueKey({ materialActivation: activationBeforeRefresh }),
-		walletId: args.walletSession.walletId,
-		enabled: true,
-		task: runFencedEmailOtpSigningSessionRefresh.bind(void 0, {
-			deps,
-			args,
-			activationBeforeRefresh
-		})
-	});
-}
-//#endregion
-//#region src/core/signingEngine/flows/signEvmFamily/authPlanning.ts
-function isEmailOtpEcdsaCommittedLane(committedLane) {
-	return isEmailOtpWalletAuthAuthority(committedLane.authority);
-}
-function emailOtpStepUpAuthority(args) {
-	const committedLane = args.selection.committedLane;
-	if (!isEmailOtpEcdsaCommittedLane(committedLane)) throw new Error("[SigningEngine][ecdsa] Email OTP step-up requires Email OTP authority");
-	if (committedLane.authLane) return {
-		kind: "live_session",
-		committedLane
-	};
-	return {
-		kind: "capability_step_up",
-		capabilityAuthority: committedLane.authority,
-		materialActivation: committedLane.authorization.runtime.materialActivation,
-		operationFingerprint: `sha256:${String(args.operationFingerprintDigest)}`
-	};
-}
-function emailOtpStepUpAuthorityForSelection(args) {
-	if (!args.selection) return void 0;
-	return isEmailOtpWalletAuthAuthority(args.selection.committedLane.authority) ? emailOtpStepUpAuthority({
-		selection: args.selection,
-		operationFingerprintDigest: args.operationFingerprintDigest
-	}) : void 0;
-}
-async function resolveEvmFamilyTransactionStepUp(args) {
-	const walletId = toWalletId(args.walletSession.walletId);
-	const reusableSessionEcdsaOperation = args.senderSignatureAlgorithm === "secp256k1" && args.ecdsaAuthorization === "reusable_wallet_session" ? args.preparedOperation : null;
-	const preparedEcdsaMetadata = reusableSessionEcdsaOperation ? reusableSessionEcdsaOperation.metadata : null;
-	const preparedEcdsaLane = reusableSessionEcdsaOperation?.lane;
-	const preparedSelection = preparedEcdsaMetadata?.selection;
-	const confirmedEmailOtpDeps = args.confirmedDeps;
-	const emailOtpAuthority = (args.ecdsaAuthorization === "operation_step_up" && isEmailOtpWalletAuthAuthority(args.capability.authority) ? emailOtpEcdsaCapabilityStepUpAuthority({
-		capability: args.capability,
-		materialActivation: args.materialActivation,
-		operationFingerprint: args.operationFingerprint
-	}) : void 0) ?? (preparedEcdsaLane && signingLaneAuthMethod(preparedEcdsaLane.auth) === SIGNER_AUTH_METHODS.emailOtp ? emailOtpStepUpAuthorityForSelection({
-		selection: preparedSelection,
-		operationFingerprintDigest: args.operationFingerprintDigest
-	}) : void 0);
-	const emailOtpAuthBridge = emailOtpAuthority ? createEmailOtpEcdsaTransactionSigningBridge({
-		walletId,
-		walletSession: args.walletSession,
-		chain: args.chain,
-		...preparedEcdsaLane ? { selectedLane: preparedEcdsaLane } : {},
-		authority: emailOtpAuthority,
-		operationFingerprintDigest: args.operationFingerprintDigest,
-		onEvent: args.onEvent,
-		requestEmailOtpTransactionSigningChallenge: confirmedEmailOtpDeps.requestEmailOtpTransactionSigningChallenge
-	}) : null;
-	const signingIntent = SigningOperationIntent.TransactionSign;
-	let plannedEcdsaSigningAuthPlan = null;
-	let plannedSigningSessionPlan;
-	if (reusableSessionEcdsaOperation) {
-		const preparedOperation = reusableSessionEcdsaOperation;
-		const signingSessionPlan = preparedOperation.signingSessionPlan;
-		plannedSigningSessionPlan = signingSessionPlan;
-		if (signingSessionPlan.kind === SigningSessionPlanKind.NotReady) throw new Error(`[SigningEngine] ECDSA signing session is not ready: ${signingSessionPlan.reason}`);
-		plannedEcdsaSigningAuthPlan = signingAuthPlanFromSigningSessionPlan({
-			plan: signingSessionPlan,
-			accountId: String(walletId),
-			intent: signingIntent,
-			curve: "ecdsa",
-			expiresAtMs: preparedOperation.expiresAtMs,
-			remainingUses: preparedOperation.remainingUses
-		});
-	}
-	const directAuthPlan = plannedEcdsaSigningAuthPlan ? null : await resolveDirectSigningAuthPlan();
-	const signingAuthPlan = plannedEcdsaSigningAuthPlan || directAuthPlan.signingAuthPlan;
-	const activeEmailOtpAuthBridge = directAuthPlan?.emailOtpAuthBridge || emailOtpAuthBridge;
-	if (signingAuthPlan.kind !== SigningAuthPlanKind.EmailOtpReauth || !activeEmailOtpAuthBridge) return {
-		signingAuthPlan,
-		...plannedSigningSessionPlan ? { signingSessionPlan: plannedSigningSessionPlan } : {}
-	};
-	const prepareChallenge = async () => {
-		const activeChallenge = await activeEmailOtpAuthBridge.challenge();
-		return {
-			challengeId: activeChallenge.challengeId,
-			...activeChallenge.email ? { emailHint: activeChallenge.email } : {}
-		};
-	};
-	return {
-		signingAuthPlan,
-		...plannedSigningSessionPlan ? { signingSessionPlan: plannedSigningSessionPlan } : {},
-		emailOtpSigning: {
-			prepare: prepareChallenge,
-			resend: async () => {
-				return await prepareChallenge();
-			}
-		}
-	};
-	async function resolveDirectSigningAuthPlan() {
-		if (args.ecdsaAuthorization === "operation_step_up") {
-			if (isPasskeyWalletAuthAuthority(args.capability.authority)) return { signingAuthPlan: {
-				kind: SigningAuthPlanKind.PasskeyReauth,
-				method: "passkey"
-			} };
-			if (isEmailOtpWalletAuthAuthority(args.capability.authority)) {
-				if (!emailOtpAuthBridge) throw new Error("[SigningEngine] Email OTP step-up authority is unavailable for the selected capability");
-				return {
-					signingAuthPlan: {
-						kind: SigningAuthPlanKind.EmailOtpReauth,
-						method: "email_otp"
-					},
-					emailOtpAuthBridge
-				};
-			}
-			args.capability.authority;
-		}
-		if (!(Array.isArray(args.accountAuth.linkedAuthMethods) ? args.accountAuth.linkedAuthMethods : []).includes(args.accountAuth.primaryAuthMethod)) throw new Error(`[SigningEngine] primary auth method is not linked: ${String(args.accountAuth.primaryAuthMethod || "")}`);
-		if (args.accountAuth.primaryAuthMethod === SIGNER_AUTH_METHODS.passkey) return { signingAuthPlan: {
-			kind: SigningAuthPlanKind.PasskeyReauth,
-			method: "passkey"
-		} };
-		if (args.accountAuth.primaryAuthMethod === SIGNER_AUTH_METHODS.emailOtp) {
-			if (!emailOtpAuthBridge) throw new Error("[SigningEngine] Email OTP transaction signing requires ECDSA lane state");
-			return {
-				signingAuthPlan: {
-					kind: SigningAuthPlanKind.EmailOtpReauth,
-					method: "email_otp"
-				},
-				emailOtpAuthBridge
-			};
-		}
-		throw new Error(`[SigningEngine] unsupported primary auth method: ${String(args.accountAuth.primaryAuthMethod || "")}`);
-	}
-}
-//#endregion
-//#region src/core/signingEngine/flows/signEvmFamily/ecdsaSelection.ts
-function ecdsaLaneCandidateAuthMethod(candidate) {
-	switch (laneCandidateAuthMethod(candidate)) {
-		case SIGNER_AUTH_METHODS.emailOtp: return SIGNER_AUTH_METHODS.emailOtp;
-		case SIGNER_AUTH_METHODS.passkey: return SIGNER_AUTH_METHODS.passkey;
-	}
-	throw new Error("[SigningEngine][ecdsa] unsupported ECDSA lane auth method");
-}
-function walletAuthWithSelectedPrimary(accountAuth, authMethod) {
-	return {
-		...accountAuth,
-		primaryAuthMethod: authMethod,
-		linkedAuthMethods: Array.from(new Set([...accountAuth.linkedAuthMethods, authMethod]))
-	};
-}
-function resolvedEvmFamilyEcdsaSigningLaneFromCandidate(candidate) {
-	const buildLane = candidate.chainTarget.kind === "tempo" ? buildTempoTransactionSigningLane : buildEvmTransactionSigningLane;
-	const base = {
-		key: candidate.key,
-		materialActivation: candidate.materialActivation,
-		keyHandle: candidate.keyHandle,
-		walletId: candidate.walletId,
-		chainTarget: candidate.chainTarget,
-		authorization: candidate.authorization
-	};
-	return requireResolvedEvmFamilyEcdsaSigningLane({
-		lane: buildLane(candidate.auth.kind === "email_otp" ? {
-			...base,
-			auth: candidate.auth,
-			retention: "session",
-			sessionOrigin: "per_operation"
-		} : {
-			...base,
-			auth: candidate.auth,
-			storageSource: "manual-bootstrap"
-		}),
-		chain: candidate.chain,
-		context: "build exact ECDSA candidate signing lane"
-	});
-}
-function laneCandidateDiagnosticsBase(candidate) {
-	return {
-		authMethod: ecdsaLaneCandidateAuthMethod(candidate),
-		chain: candidate.chain,
-		chainTarget: candidate.chainTarget,
-		state: candidate.state,
-		walletSessionId: candidate.authorization.operationCredential.walletSessionId,
-		materialActivationId: candidate.materialActivation.activationId,
-		remainingUses: candidate.authorization.runtime.remainingUses,
-		expiresAtMs: candidate.authorization.runtime.expiresAtMs
-	};
-}
-function summarizeLaneCandidate(candidate) {
-	return {
-		...laneCandidateDiagnosticsBase(candidate),
-		source: "canonical_capability"
-	};
-}
-function isExactEmailOtpAuthorization(authorization) {
-	return authorization.selectedAuthMethod.kind === "email_otp" && authorization.runtime.authBinding.kind === "email_otp";
-}
-function isExactDirectEmailOtpAuthorization(authorization) {
-	return authorization.runtime.kind === "exact_ecdsa_direct_capability_runtime_v1";
-}
-function isExactSealedEmailOtpAuthorization(authorization) {
-	return authorization.runtime.kind === "exact_ecdsa_sealed_runtime_v1";
-}
-function requirePasskeyEcdsaLaneCandidate(candidate) {
-	if (candidate.auth.kind !== "passkey") throw new Error("[SigningEngine][ecdsa] passkey committed lane requires passkey candidate");
-	return {
-		...candidate,
-		auth: candidate.auth
-	};
-}
-function assertEcdsaCommittedLaneAuthorityMatchesWallet(args) {
-	const authorityWalletId = String(args.authority.walletId);
-	if (String(args.lane.key.walletId) === authorityWalletId && String(args.candidate.walletId) === authorityWalletId) return;
-	throw new Error(`[SigningEngine][ecdsa] ${args.context} committed lane authority wallet mismatch`);
-}
-function buildEcdsaSelectionDiagnostics(args) {
-	return { selectedLaneCandidate: summarizeLaneCandidate(args.candidate) };
-}
-async function commitPasskeyEcdsaLaneForSelection(args) {
-	const candidate = requirePasskeyEcdsaLaneCandidate(args.candidate);
-	const authority = (await args.deps.resolveCanonicalEcdsaSigningCapability({
-		walletId: candidate.walletId,
-		chainTarget: candidate.chainTarget,
-		materialActivation: candidate.materialActivation
-	})).authority;
-	if (!isPasskeyWalletAuthAuthority(authority) || String(authority.verifier.rpId) !== String(candidate.auth.rpId) || authority.factor.credentialIdB64u !== candidate.auth.credentialIdB64u) throw new Error("[SigningEngine][ecdsa] exact Passkey capability authority changed");
-	assertEcdsaCommittedLaneAuthorityMatchesWallet({
-		authority,
-		lane: args.lane,
-		candidate,
-		context: "Passkey"
-	});
-	return {
-		lane: args.lane,
-		authority,
-		authorization: args.lane.authorization
-	};
-}
-async function resolveEmailOtpAuthorityForSelection(args) {
-	const exactLane = exactEcdsaSigningLaneIdentityFromSelectedLane(args.lane);
-	const laneAuthority = await args.deps.resolveDurableEmailOtpEcdsaSigningSessionAuthority({
-		lane: exactLane,
-		chain: args.lane.chainTarget.kind
-	});
-	if (laneAuthority) {
-		if (!isExactEmailOtpAuthorization(laneAuthority)) return null;
-		return {
-			kind: "durable_authority_backed",
-			authorization: laneAuthority
-		};
-	}
-	logEvmFamilyEcdsaLaneDiagnostic("Email OTP exact ECDSA authority not found", {
-		lane: summarizeEvmFamilyEcdsaLane(args.lane),
-		candidate: summarizeLaneCandidate(args.candidate)
-	});
-	return null;
-}
-function requireEmailOtpSelectionAuthority(args) {
-	if (args.authority) return args.authority;
-	logEvmFamilyEcdsaLaneDiagnostic("Email OTP exact ECDSA signing-session authority missing", {
-		lane: summarizeEvmFamilyEcdsaLane(args.lane),
-		candidate: summarizeLaneCandidate(args.candidate)
-	});
-	throw new Error("Email OTP ECDSA committed lane is missing wallet-session authority; unlock wallet again");
-}
-function requireEmailOtpEcdsaSigningSessionAuthLane(args) {
-	const authLane = emailOtpEcdsaSigningSessionAuthLane(args.authority.authorization);
-	if (authLane.kind === "signing_session" && authLane.curve === "ecdsa" && thresholdEcdsaChainTargetsEqual(authLane.chainTarget, args.lane.chainTarget)) return authLane;
-	logEvmFamilyEcdsaLaneDiagnostic("Email OTP ECDSA committed lane rejected for authority shape", {
-		authorityKind: authLane.kind,
-		authorityCurve: authLane.kind === "signing_session" ? authLane.curve : null,
-		lane: summarizeEvmFamilyEcdsaLane(args.lane),
-		candidate: summarizeLaneCandidate(args.candidate)
-	});
-	throw new Error("Email OTP ECDSA committed lane authority is not an ECDSA signing session; unlock wallet again");
-}
-function requireCommittedLaneForReady(args) {
-	if (args.committedLane && args.committedLane.authority.factor.kind === args.expectedFactor) return args.committedLane;
-	logEvmFamilyEcdsaLaneDiagnostic("ECDSA committed lane missing for ready signing", {
-		expectedFactor: args.expectedFactor,
-		lane: summarizeEvmFamilyEcdsaLane(args.lane),
-		candidate: summarizeLaneCandidate(args.candidate)
-	});
-	throw new Error("[SigningEngine][ecdsa] committed lane is unavailable for ready signing");
-}
-function commitEmailOtpEcdsaLaneForSelection(args) {
-	const authorization = args.authority.authorization;
-	if (authorization.runtime.authBinding.kind !== "email_otp") throw new Error("[SigningEngine][ecdsa] Email OTP authority runtime binding is invalid");
-	const authority = authorization.runtime.authBinding.emailOtpAuthority;
-	assertEcdsaCommittedLaneAuthorityMatchesWallet({
-		authority,
-		lane: args.lane,
-		candidate: args.candidate,
-		context: "Email OTP"
-	});
-	if (isExactDirectEmailOtpAuthorization(authorization)) return {
-		lane: args.lane,
-		authority,
-		authorization
-	};
-	if (isExactSealedEmailOtpAuthorization(authorization)) return {
-		lane: args.lane,
-		authority,
-		authorization,
-		authLane: requireEmailOtpEcdsaSigningSessionAuthLane({
-			authority: args.authority,
-			lane: args.lane,
-			candidate: args.candidate
-		})
-	};
-	throw new Error("[SigningEngine][ecdsa] Email OTP authorization runtime is unsupported");
-}
-async function resolveEvmFamilyEcdsaSigningSelection(args) {
-	const lane = resolvedEvmFamilyEcdsaSigningLaneFromCandidate(args.laneCandidate);
-	const emailOtpAuthorityLane = lane;
-	const candidateAuthMethod = ecdsaLaneCandidateAuthMethod(args.laneCandidate);
-	const emailOtpAuthority = candidateAuthMethod === SIGNER_AUTH_METHODS.emailOtp ? await resolveEmailOtpAuthorityForSelection({
-		deps: args.deps,
-		lane: emailOtpAuthorityLane,
-		candidate: args.laneCandidate
-	}) : null;
-	const requiredEmailOtpAuthority = candidateAuthMethod === SIGNER_AUTH_METHODS.emailOtp ? requireEmailOtpSelectionAuthority({
-		authority: emailOtpAuthority,
-		lane: emailOtpAuthorityLane,
-		candidate: args.laneCandidate
-	}) : null;
-	const committedEmailOtpLane = candidateAuthMethod === SIGNER_AUTH_METHODS.emailOtp && requiredEmailOtpAuthority ? commitEmailOtpEcdsaLaneForSelection({
-		authority: requiredEmailOtpAuthority,
-		lane: emailOtpAuthorityLane,
-		candidate: args.laneCandidate
-	}) : null;
-	const committedPasskeyLane = candidateAuthMethod === SIGNER_AUTH_METHODS.passkey ? await commitPasskeyEcdsaLaneForSelection({
-		deps: args.deps,
-		lane,
-		candidate: args.laneCandidate
-	}) : null;
-	const committedLane = committedEmailOtpLane ?? committedPasskeyLane;
-	const committedFactor = committedLane?.authority.factor.kind;
-	const selectedAccountAuth = walletAuthWithSelectedPrimary(await resolveEvmFamilyTransactionWalletAuth({
-		senderSignatureAlgorithm: args.senderSignatureAlgorithm,
-		signerAuthMethod: committedFactor ?? candidateAuthMethod
-	}), candidateAuthMethod);
-	const diagnostics = buildEcdsaSelectionDiagnostics({ candidate: args.laneCandidate });
-	return {
-		kind: "ready",
-		accountAuth: selectedAccountAuth,
-		lane,
-		committedLane: requireCommittedLaneForReady({
-			committedLane,
-			expectedFactor: candidateAuthMethod,
-			lane,
-			candidate: args.laneCandidate
-		}),
-		diagnostics
-	};
-}
-//#endregion
-//#region src/core/signingEngine/flows/signEvmFamily/preparedSigning.ts
-function buildEvmFamilyTransactionSigningIntent(args) {
-	const base = {
-		walletId: args.walletId,
-		curve: "ecdsa",
-		authSelectionPolicy: args.authSelectionPolicy,
-		operationUsesNeeded: args.operationUsesNeeded,
-		...args.operationId ? { operationId: args.operationId } : {}
-	};
-	return args.signingTarget.kind === "tempo" ? {
-		...base,
-		chain: "tempo",
-		chainTarget: args.signingTarget
-	} : {
-		...base,
-		chain: "evm",
-		chainTarget: args.signingTarget
-	};
-}
-function resolveEvmFamilyTransactionAuthSelectionPolicy(args) {
-	return {
-		kind: "account_class",
-		authMethod: args.candidateAuthMethod
-	};
-}
-function requireSingleConcreteAuthMethodForEcdsaTarget(args) {
-	const authMethods = /* @__PURE__ */ new Set();
-	for (const lane of ecdsaAvailableLaneCandidatesForTarget(args.availableLanes, args.signingTarget)) {
-		if (!isConcreteAvailableSigningLane(lane)) continue;
-		if (!thresholdEcdsaChainTargetsEqual(lane.chainTarget, args.signingTarget)) continue;
-		authMethods.add(availableEcdsaSigningLaneAuthMethod(lane));
-	}
-	if (authMethods.size !== 1) throw new Error("[SigningEngine][ecdsa] exact capability authority is unavailable or ambiguous");
-	return Array.from(authMethods)[0];
-}
-function summarizeEcdsaAvailableLane(lane) {
-	if (!lane) return { present: false };
-	if (!isConcreteAvailableSigningLane(lane)) return {
-		present: true,
-		curve: lane.curve,
-		chain: lane.chainTarget.kind,
-		chainTarget: lane.chainTarget,
-		state: lane.state
-	};
-	const evmFamilyKeyFingerprint = deriveEvmFamilyKeyFingerprintFromPublicFacts({
-		walletId: lane.key.walletId,
-		publicFacts: lane.publicFacts
-	});
-	return {
-		present: true,
-		authMethod: availableEcdsaSigningLaneAuthMethod(lane),
-		curve: lane.curve,
-		chain: lane.chainTarget?.kind,
-		chainTarget: lane.chainTarget,
-		...evmFamilyKeyFingerprint ? { evmFamilyKeyFingerprint } : {},
-		state: lane.state,
-		source: lane.source,
-		walletSessionId: lane.authorization?.operationCredential.walletSessionId,
-		materialActivationId: lane.materialActivation.activationId,
-		remainingUses: lane.remainingUses,
-		expiresAtMs: lane.expiresAtMs
-	};
-}
-function summarizeEcdsaAvailableCandidatesByTarget(availableLanes) {
-	return Object.fromEntries(Object.entries(availableLanes.ecdsa.candidatesByTarget).map(([targetKey, candidates]) => [targetKey, candidates.map((candidate) => summarizeEcdsaAvailableLane(candidate))]));
-}
-function emitVisibleEcdsaLaneDiagnostic(label, payload) {
-	try {
-		console.warn(label, JSON.stringify(payload, null, 2));
-	} catch {
-		try {
-			console.warn(label, payload);
-		} catch {}
-	}
-}
-function summarizeEcdsaSelectedLanesByTarget(availableLanes) {
-	return Object.fromEntries(Object.entries(availableLanes.ecdsa.lanesByTarget).map(([targetKey, lane]) => [targetKey, summarizeEcdsaAvailableLane(lane)]));
-}
-function summarizeEcdsaLaneCandidate(candidate) {
-	if (!candidate) return { present: false };
-	return {
-		present: true,
-		authMethod: laneCandidateAuthMethod(candidate),
-		curve: candidate.curve,
-		chain: candidate.chainTarget.kind,
-		chainTarget: candidate.chainTarget,
-		state: candidate.state,
-		source: candidate.source,
-		materialActivationId: candidate.materialActivation.activationId,
-		authorizationState: candidate.authorizationState,
-		...candidate.authorizationState === "authorized" ? {
-			walletSessionId: candidate.authorization.operationCredential.walletSessionId,
-			remainingUses: candidate.authorization.runtime.remainingUses,
-			expiresAtMs: candidate.authorization.runtime.expiresAtMs
-		} : {}
-	};
-}
-function exactEcdsaAuthorizationIdentityMatches(left, right) {
-	const leftSession = left.session;
-	const rightSession = right.session;
-	return left.selectedAuthority.authorityId === right.selectedAuthority.authorityId && left.selectedAuthMethod.kind === right.selectedAuthMethod.kind && left.selectedAuthMethod.walletAuthMethodId === right.selectedAuthMethod.walletAuthMethodId && leftSession.walletId === rightSession.walletId && leftSession.authorityId === rightSession.authorityId && leftSession.authMethodId === rightSession.authMethodId && leftSession.authorizationId === rightSession.authorizationId && leftSession.quotaId === rightSession.quotaId && leftSession.authorityDigestB64u === rightSession.authorityDigestB64u && leftSession.authorityRevocationEpoch === rightSession.authorityRevocationEpoch && left.operationCredential.walletSessionId === right.operationCredential.walletSessionId && left.operationCredential.token === right.operationCredential.token && exactEcdsaWalletSessionRuntimesMatch(left.runtime, right.runtime);
-}
-function assertSelectionMatchesLaneCandidate(args) {
-	const candidate = args.candidate;
-	const candidateAuthMethod = laneCandidateAuthMethod(candidate);
-	const committedAuthMethod = args.selection.committedLane.authority.factor.kind;
-	if (candidateAuthMethod !== committedAuthMethod) throw new Error(`[SigningEngine][ecdsa] prepared auth method ${candidateAuthMethod} did not match committed lane auth method ${committedAuthMethod}`);
-	const selectionLaneAuthMethod = signingLaneAuthMethod(args.selection.lane.auth);
-	if (selectionLaneAuthMethod !== committedAuthMethod) throw new Error(`[SigningEngine][ecdsa] selected lane auth method ${selectionLaneAuthMethod} did not match committed lane auth method ${committedAuthMethod}`);
-	if (!exactEcdsaAuthorizationIdentityMatches(candidate.authorization, args.selection.lane.authorization)) throw new Error("[SigningEngine][ecdsa] prepared authorization did not match lane");
-	if (exactSigningLaneIdentityKey(exactEcdsaSigningLaneIdentityFromSelectedLane(args.selection.committedLane.lane)) !== exactSigningLaneIdentityKey(exactEcdsaSigningLaneIdentityFromSelectedLane(args.selection.lane))) throw new Error("[SigningEngine][ecdsa] committed lane did not match selected lane");
-}
-function readinessFromSelection(selection) {
-	const candidateState = selection.diagnostics.selectedLaneCandidate.state;
-	const { expiresAtMs, remainingUses } = selection.lane.authorization.runtime;
-	if (candidateState === "expired") return {
-		readiness: {
-			status: "expired",
-			curve: "ecdsa",
-			materialActivation: selection.lane.materialActivation,
-			authorization: selection.lane.authorization,
-			expiresAtMs
-		},
-		expiresAtMs,
-		remainingUses
-	};
-	if (candidateState === "exhausted") return {
-		readiness: {
-			status: "exhausted",
-			curve: "ecdsa",
-			materialActivation: selection.lane.materialActivation,
-			authorization: selection.lane.authorization,
-			expiresAtMs,
-			remainingUses
-		},
-		expiresAtMs,
-		remainingUses
-	};
-	return {
-		readiness: {
-			status: "ready",
-			curve: "ecdsa",
-			materialActivation: selection.lane.materialActivation,
-			authorization: selection.lane.authorization,
-			expiresAtMs,
-			remainingUses
-		},
-		expiresAtMs,
-		remainingUses
-	};
-}
-function assertPreparedMaterialBindingMatchesOperation(args) {
-	const operation = args.preparedOperation.operation;
-	if (!operation) throw new Error("[SigningEngine][ecdsa] prepared material requires an operation identity");
-	if (args.metadata.materialBinding.operationId !== operation.operationId) throw new Error("[SigningEngine][ecdsa] prepared material operation identity mismatch");
-	if (args.metadata.materialBinding.operationFingerprint && operation.operationFingerprint && args.metadata.materialBinding.operationFingerprint !== operation.operationFingerprint) throw new Error("[SigningEngine][ecdsa] prepared material fingerprint mismatch");
-	const laneIdentityKey = exactSigningLaneIdentityKey(exactSigningLaneIdentityFromSelectedLane(args.preparedOperation.lane));
-	if (args.metadata.materialBinding.laneIdentityKey !== laneIdentityKey) throw new Error("[SigningEngine][ecdsa] prepared material lane identity mismatch");
-}
-async function prepareEvmFamilyEcdsaSigningSession(args) {
-	const chainTarget = args.signingTarget;
-	const chain = chainTarget.kind;
-	const walletId = toWalletId(args.walletSession.walletId);
-	const ownerScope = await args.deps.resolveOwnerLaneScope(walletId);
-	const candidateAvailableLanes = await args.deps.readAvailableSigningLanesForSigning({
-		walletId,
-		curve: "ecdsa",
-		ecdsaChainTargets: [chainTarget],
-		ownerScope
-	});
-	const laneReadDiagnostic = {
-		walletId,
-		chain,
-		chainTarget,
-		targetKey: thresholdEcdsaChainTargetKey(chainTarget),
-		candidateCount: ecdsaAvailableLaneCandidatesForTarget(candidateAvailableLanes, chainTarget).length,
-		selectedLanesByTarget: summarizeEcdsaSelectedLanesByTarget(candidateAvailableLanes),
-		candidatesByTarget: summarizeEcdsaAvailableCandidatesByTarget(candidateAvailableLanes)
-	};
-	if (laneReadDiagnostic.candidateCount === 0) emitVisibleEcdsaLaneDiagnostic("[ECDSA_LANE_READ_DIAGNOSTIC][no-candidates]", laneReadDiagnostic);
-	emitSigningSessionFlowTrace("evm-family", {
-		stage: "ecdsa_prepare.available_lanes_read",
-		...laneReadDiagnostic
-	});
-	const candidateAuthMethod = requireSingleConcreteAuthMethodForEcdsaTarget({
-		availableLanes: candidateAvailableLanes,
-		signingTarget: args.signingTarget
-	});
-	const transactionIntent = buildEvmFamilyTransactionSigningIntent({
-		walletId,
-		authSelectionPolicy: resolveEvmFamilyTransactionAuthSelectionPolicy({ candidateAuthMethod }),
-		operationUsesNeeded: 1,
-		signingTarget: args.signingTarget,
-		...args.signingOperation.operationId ? { operationId: args.signingOperation.operationId } : {}
-	});
-	const materialSelection = selectEvmFamilyEcdsaMaterialCandidate({
-		intent: transactionIntent,
-		availableLanes: candidateAvailableLanes
-	});
-	emitSigningSessionFlowTrace("evm-family", {
-		stage: "ecdsa_prepare.material_candidate_selected",
-		walletId,
-		chain,
-		chainTarget,
-		primaryAuthMethod: materialSelection.ok ? laneCandidateAuthMethod(materialSelection.candidate) : candidateAuthMethod,
-		selectionOk: materialSelection.ok,
-		...materialSelection.ok ? {
-			authorizationState: materialSelection.kind,
-			selectedAvailableLane: summarizeEcdsaAvailableLane(materialSelection.availableLane),
-			selectedLaneCandidate: summarizeEcdsaLaneCandidate(materialSelection.candidate),
-			...materialSelection.kind === "authorized" ? { transactionLane: materialSelection.lane } : {}
-		} : { failure: materialSelection.failure }
-	});
-	if (!materialSelection.ok) {
-		const noMaterialDiagnostic = {
-			stage: "ecdsa_prepare.exact_material_candidate_missing",
-			walletId,
-			chain,
-			chainTarget,
-			targetKey: thresholdEcdsaChainTargetKey(chainTarget),
-			primaryAuthMethod: candidateAuthMethod,
-			candidateCount: laneReadDiagnostic.candidateCount,
-			ecdsaTargets: candidateAvailableLanes.ecdsa.targets,
-			selectedLanesByTarget: laneReadDiagnostic.selectedLanesByTarget,
-			candidatesByTarget: laneReadDiagnostic.candidatesByTarget,
-			selectionFailure: materialSelection.failure
-		};
-		emitVisibleEcdsaLaneDiagnostic("[ECDSA_NO_LANE_DIAGNOSTIC]", noMaterialDiagnostic);
-		emitSigningSessionFlowFailure("evm-family", noMaterialDiagnostic);
-		throw new Error(`[SigningEngine][ecdsa] transaction signing requires exact ECDSA material for ${chain}`);
-	}
-	if (materialSelection.kind === "authorization_required") {
-		const candidate = materialSelection.candidate;
-		args.diagnostics.selection = {
-			kind: "authorization_required",
-			authMethod: availableEcdsaSigningLaneAuthMethod(materialSelection.availableLane),
-			candidate: summarizeEcdsaLaneCandidate(candidate)
-		};
-		return {
-			kind: "authorization_required",
-			authMethod: availableEcdsaSigningLaneAuthMethod(materialSelection.availableLane),
-			availableLanesGeneration: candidateAvailableLanes.generation,
-			identity: exactEcdsaSigningLaneIdentity({
-				signer: buildEvmFamilyEcdsaSignerBinding({
-					walletId: candidate.walletId,
-					chainTarget: candidate.chainTarget,
-					keyHandle: candidate.keyHandle,
-					key: candidate.key,
-					materialActivation: candidate.materialActivation
-				}),
-				auth: candidate.auth
-			}),
-			candidate,
-			intent: transactionIntent
-		};
-	}
-	const laneCandidate = materialSelection.candidate;
-	const transactionLane = materialSelection.lane;
-	const preparedTransaction = await prepareTransactionSigningOperation({
-		intent: transactionIntent,
-		coordinator: args.signingSessionCoordinator,
-		operation: args.signingOperation,
-		forceFreshAuth: args.forceFreshAuth === true,
-		missingWhenExpiresAtMissing: true,
-		onPlannerTrace: (event) => emitSigningPlannerDecisionTrace("evm-family", event),
-		lifecycleAdapter: { prepare: async () => {
-			const selection = await resolveEvmFamilyEcdsaSigningSelection({
-				deps: args.deps,
-				walletId,
-				chainTarget,
-				senderSignatureAlgorithm: "secp256k1",
-				laneCandidate
-			});
-			emitSigningSessionFlowTrace("evm-family", {
-				stage: "ecdsa_prepare.material_selected",
-				walletId,
-				chain,
-				chainTarget,
-				selectionKind: selection.kind,
-				authMethod: selection.committedLane.authority.factor.kind,
-				lane: summarizeEvmFamilyEcdsaLane(selection.lane),
-				diagnostics: selection.diagnostics
-			});
-			const committedSelectionAuthMethod = selection.committedLane.authority.factor.kind;
-			emitSigningLaneResolutionTrace("evm-family", selection.lane, { reason: "evm_family_ecdsa_selection" });
-			args.diagnostics.selection = {
-				kind: selection.kind,
-				authMethod: committedSelectionAuthMethod,
-				lane: summarizeEvmFamilyEcdsaLane(selection.lane),
-				diagnostics: selection.diagnostics
-			};
-			const resolvedLane = requireResolvedEvmFamilyEcdsaSigningLane({
-				lane: selection.lane,
-				chain,
-				context: "EVM-family signing preparation",
-				diagnostics: args.diagnostics
-			});
-			assertSelectionMatchesLaneCandidate({
-				candidate: laneCandidate,
-				selection
-			});
-			const readiness = readinessFromSelection(selection);
-			emitSigningSessionFlowTrace("evm-family", {
-				stage: "ecdsa_prepare.readiness",
-				walletId,
-				chain,
-				chainTarget,
-				authMethod: committedSelectionAuthMethod,
-				lane: summarizeEvmFamilyEcdsaLane(resolvedLane),
-				readinessStatus: readiness.readiness.status
-			});
-			emitSigningBoundaryTrace("evm-family", createSigningBoundaryTraceEvent({
-				event: "pre_confirm_readiness_checked",
-				lane: resolvedLane,
-				readinessStatus: readiness.readiness.status,
-				phase: "pre_confirm"
-			}));
-			return {
-				lane: resolvedLane,
-				transactionLane,
-				transactionIntent,
-				readiness: {
-					readiness: readiness.readiness,
-					expiresAtMs: readiness.expiresAtMs,
-					remainingUses: readiness.remainingUses
-				},
-				availableLanesGeneration: candidateAvailableLanes.generation,
-				metadata: {
-					accountAuth: selection.accountAuth,
-					authMethod: committedSelectionAuthMethod,
-					source: selection.diagnostics.selectedLaneCandidate.source,
-					selection,
-					materialBinding: {
-						operationId: args.signingOperation.operationId,
-						...args.signingOperation.operationFingerprint ? { operationFingerprint: args.signingOperation.operationFingerprint } : {},
-						laneIdentityKey: exactSigningLaneIdentityKey(exactSigningLaneIdentityFromSelectedLane(resolvedLane))
-					},
-					availableLanesGeneration: candidateAvailableLanes.generation
-				}
-			};
-		} }
-	});
-	const preparedOperation = preparedTransaction.thresholdOperation;
-	const metadata = preparedOperation.metadata;
-	assertPreparedMaterialBindingMatchesOperation({
-		metadata,
-		preparedOperation
-	});
-	return {
-		kind: "authorized",
-		accountAuth: metadata.accountAuth,
-		authMethod: metadata.authMethod,
-		source: metadata.source,
-		selection: metadata.selection,
-		availableLanesGeneration: metadata.availableLanesGeneration,
-		signingLane: preparedOperation.lane,
-		preparedOperation,
-		transactionOperation: preparedTransaction.transactionOperation
-	};
-}
-//#endregion
-//#region src/core/signingEngine/flows/signEvmFamily/nonceLifecycleAdapter.ts
-function toEvmFamilyManagedNonceReservationFromSignedResult(args) {
-	const snapshot = args.signedResult.managedNonce;
-	if (!snapshot || typeof snapshot !== "object") throw new Error("[SigningEngine][evm-family] managedNonce is required for nonce lifecycle");
-	try {
-		const parsed = fromManagedNonceReservationSnapshot(snapshot);
-		args.walletId;
-		return parsed;
-	} catch (error) {
-		throw new Error(`[SigningEngine][evm-family] invalid managedNonce: ${error instanceof Error ? error.message : String(error || "unknown error")}`);
-	}
-}
-async function releaseEvmFamilyNonceReservation(deps, reservation) {
-	const leaseRef = requireManagedNonceLeaseRef(reservation);
-	await deps.nonceCoordinator.release({
-		...leaseRef,
-		reason: "signing_failed"
-	});
-}
-function formatNonceLaneStatus(status) {
-	return {
-		chainNextNonce: status.chainNextNonce.toString(),
-		unresolvedInFlightNonces: status.unresolvedInFlightNonces.map((value) => value.toString()),
-		blocked: status.blocked,
-		...status.blockedNonce != null ? { blockedNonce: status.blockedNonce.toString() } : {}
-	};
-}
-async function reportEvmFamilyBroadcastAccepted(deps, args) {
-	const reservation = toEvmFamilyManagedNonceReservationFromSignedResult({
-		signedResult: args.signedResult,
-		walletId: args.walletId
-	});
-	emitEvmFamilyBroadcastEvent(args.onEvent, {
-		walletId: args.walletId,
-		phase: SigningEventPhase.STEP_12_BROADCAST_ACCEPTED,
-		status: "running",
-		message: "Marking managed nonce lane as in-flight",
-		data: {
-			chain: reservation.chainTarget.kind,
-			networkKey: reservation.chainTarget.networkSlug,
-			chainId: reservation.chainTarget.chainId.toString(),
-			nonce: reservation.nonce.toString()
-		}
-	});
-	const txHash = requireEvmFamilyBroadcastTxHash(args.txHash || (args.signedResult.chain === "evm" ? args.signedResult.txHashHex : void 0));
-	await deps.nonceCoordinator.markBroadcastAccepted({
-		...requireManagedNonceLeaseRef(reservation),
-		txHash
-	});
-	emitEvmFamilyBroadcastEvent(args.onEvent, {
-		walletId: args.walletId,
-		phase: SigningEventPhase.STEP_12_BROADCAST_ACCEPTED,
-		status: "succeeded",
-		message: "Managed nonce lane marked in-flight",
-		data: {
-			chain: reservation.chainTarget.kind,
-			networkKey: reservation.chainTarget.networkSlug,
-			chainId: reservation.chainTarget.chainId.toString(),
-			nonce: reservation.nonce.toString(),
-			txHash
-		}
-	});
-}
-function requireEvmFamilyBroadcastTxHash(value) {
-	const normalized = String(value || "").trim().toLowerCase();
-	if (!/^0x[0-9a-f]{64}$/.test(normalized)) throw new Error("[SigningEngine][evm-family] broadcast acceptance requires txHash");
-	return normalized;
-}
-async function reportEvmFamilyBroadcastRejected(deps, args) {
-	const reservation = toEvmFamilyManagedNonceReservationFromSignedResult({
-		signedResult: args.signedResult,
-		walletId: args.walletId
-	});
-	emitEvmFamilyBroadcastEvent(args.onEvent, {
-		walletId: args.walletId,
-		phase: SigningEventPhase.STEP_12_BROADCAST_REJECTED,
-		status: "running",
-		message: "Marking managed nonce reservation rejected",
-		data: {
-			chain: reservation.chainTarget.kind,
-			networkKey: reservation.chainTarget.networkSlug,
-			chainId: reservation.chainTarget.chainId.toString(),
-			nonce: reservation.nonce.toString()
-		}
-	});
-	await deps.nonceCoordinator.markBroadcastRejected({
-		...requireManagedNonceLeaseRef(reservation),
-		error: args.error
-	});
-	const mappedError = mapToRetryableNonceStateError({
-		error: args.error,
-		chain: reservation.chainTarget.kind,
-		networkKey: reservation.chainTarget.networkSlug,
-		chainId: reservation.chainTarget.chainId
-	});
-	emitEvmFamilyBroadcastEvent(args.onEvent, {
-		walletId: args.walletId,
-		phase: SigningEventPhase.STEP_12_BROADCAST_REJECTED,
-		status: "failed",
-		message: "Managed nonce reservation marked rejected",
-		data: {
-			chain: reservation.chainTarget.kind,
-			networkKey: reservation.chainTarget.networkSlug,
-			chainId: reservation.chainTarget.chainId.toString(),
-			nonce: reservation.nonce.toString()
-		}
-	});
-	if (!isNonceConflictRetryableError(mappedError) && !isNonceLaneBlockedRetryableError(mappedError)) return;
-	emitEvmFamilyBroadcastEvent(args.onEvent, {
-		walletId: args.walletId,
-		phase: SigningEventPhase.STEP_13_NONCE_RECONCILE_STARTED,
-		status: "running",
-		message: "Reconciling managed nonce lane after broadcast error",
-		data: {
-			chain: reservation.chainTarget.kind,
-			networkKey: reservation.chainTarget.networkSlug,
-			chainId: reservation.chainTarget.chainId.toString(),
-			nonce: reservation.nonce.toString(),
-			errorCode: extractErrorCode(mappedError)
-		}
-	});
-	const laneStatus = await deps.nonceCoordinator.reconcile({ lane: evmManagedReservationToLane(reservation) }).catch(() => null);
-	emitEvmFamilyBroadcastEvent(args.onEvent, {
-		walletId: args.walletId,
-		phase: SigningEventPhase.STEP_13_NONCE_RECONCILE_SUCCEEDED,
-		status: "succeeded",
-		message: "Managed nonce lane reconciled",
-		data: {
-			chain: reservation.chainTarget.kind,
-			networkKey: reservation.chainTarget.networkSlug,
-			chainId: reservation.chainTarget.chainId.toString(),
-			...laneStatus ? { laneStatus: formatNonceLaneStatus(laneStatus) } : {}
-		}
-	});
-	throw mappedError;
-}
-async function reportEvmFamilyFinalized(deps, args) {
-	args.receiptStatus;
-	const reservation = toEvmFamilyManagedNonceReservationFromSignedResult({
-		signedResult: args.signedResult,
-		walletId: args.walletId
-	});
-	const txHash = args.txHash || (args.signedResult.chain === "evm" ? args.signedResult.txHashHex : void 0);
-	await deps.nonceCoordinator.markFinalized({
-		...requireManagedNonceLeaseRef(reservation),
-		...txHash ? { txHash } : {}
-	});
-}
-async function reportEvmFamilyDroppedOrReplaced(deps, args) {
-	const reservation = toEvmFamilyManagedNonceReservationFromSignedResult({
-		signedResult: args.signedResult,
-		walletId: args.walletId
-	});
-	emitEvmFamilyBroadcastEvent(args.onEvent, {
-		walletId: args.walletId,
-		phase: args.reason === "replaced" ? SigningEventPhase.STEP_13_TRANSACTION_REPLACED : SigningEventPhase.STEP_13_TRANSACTION_DROPPED,
-		status: "running",
-		message: args.reason === "replaced" ? "Marking managed nonce lane replaced" : "Marking managed nonce lane dropped",
-		data: {
-			chain: reservation.chainTarget.kind,
-			networkKey: reservation.chainTarget.networkSlug,
-			chainId: reservation.chainTarget.chainId.toString(),
-			nonce: reservation.nonce.toString(),
-			reason: args.reason,
-			...args.txHash ? { txHash: args.txHash } : {}
-		}
-	});
-	await deps.nonceCoordinator.markDroppedOrReplaced({
-		...requireManagedNonceLeaseRef(reservation),
-		reason: args.reason,
-		...args.txHash ? { txHash: args.txHash } : {}
-	});
-	emitEvmFamilyBroadcastEvent(args.onEvent, {
-		walletId: args.walletId,
-		phase: args.reason === "replaced" ? SigningEventPhase.STEP_13_TRANSACTION_REPLACED : SigningEventPhase.STEP_13_TRANSACTION_DROPPED,
-		status: args.reason === "replaced" ? "succeeded" : "failed",
-		message: args.reason === "replaced" ? "Managed nonce lane marked replaced" : "Managed nonce lane marked dropped",
-		data: {
-			chain: reservation.chainTarget.kind,
-			networkKey: reservation.chainTarget.networkSlug,
-			chainId: reservation.chainTarget.chainId.toString(),
-			nonce: reservation.nonce.toString(),
-			reason: args.reason,
-			...args.txHash ? { txHash: args.txHash } : {}
-		}
-	});
-}
-async function reconcileEvmFamilyNonceLane(deps, args) {
-	const reservation = toEvmFamilyManagedNonceReservationFromSignedResult({
-		signedResult: args.signedResult,
-		walletId: args.walletId
-	});
-	emitEvmFamilyBroadcastEvent(args.onEvent, {
-		walletId: args.walletId,
-		phase: SigningEventPhase.STEP_13_NONCE_RECONCILE_STARTED,
-		status: "running",
-		message: "Reconciling managed nonce lane",
-		data: {
-			chain: reservation.chainTarget.kind,
-			networkKey: reservation.chainTarget.networkSlug,
-			chainId: reservation.chainTarget.chainId.toString()
-		}
-	});
-	const laneStatus = await deps.nonceCoordinator.reconcile({ lane: evmManagedReservationToLane(reservation) });
-	const formatted = formatNonceLaneStatus(laneStatus);
-	emitEvmFamilyBroadcastEvent(args.onEvent, {
-		walletId: args.walletId,
-		phase: SigningEventPhase.STEP_13_NONCE_RECONCILE_SUCCEEDED,
-		status: "succeeded",
-		message: "Managed nonce lane reconciled",
-		data: {
-			chain: reservation.chainTarget.kind,
-			networkKey: reservation.chainTarget.networkSlug,
-			chainId: reservation.chainTarget.chainId.toString(),
-			laneStatus: formatted
-		}
-	});
-	if (laneStatus.blocked) throw createEvmFamilySigningNonceLaneBlockedError({
-		chain: reservation.chainTarget.kind,
-		networkKey: reservation.chainTarget.networkSlug,
-		chainId: reservation.chainTarget.chainId,
-		blockedNonce: String(formatted.blockedNonce || "unknown")
-	});
-	return formatted;
-}
-function requireManagedNonceLeaseRef(reservation) {
-	const leaseId = String(reservation.leaseId || "").trim();
-	const operationId = String(reservation.operationId || "").trim();
-	const operationFingerprint = String(reservation.operationFingerprint || "").trim();
-	if (!leaseId || !operationId || !operationFingerprint) throw new Error("[SigningEngine][evm-family] managedNonce lease metadata is required");
-	return {
-		leaseId,
-		operationId,
-		operationFingerprint
-	};
-}
-//#endregion
-//#region src/core/signingEngine/flows/signEvmFamily/addresses.ts
-function toOptionalEvmAddress(value) {
-	const normalized = String(value || "").trim().toLowerCase();
-	if (!/^0x[0-9a-f]{40}$/.test(normalized)) return void 0;
-	return normalized;
-}
-//#endregion
-//#region src/core/signingEngine/flows/signEvmFamily/nonceResolution.ts
-function readOptionalChainId(chain) {
-	if (!("chainId" in chain)) return void 0;
-	return typeof chain.chainId === "number" ? chain.chainId : void 0;
-}
-function isEvmFamilyNetwork(chain) {
-	return String(chainFamilyFromNetwork(chain.network)) === "evm";
-}
-function isTempoFamilyNetwork(chain) {
-	return String(chainFamilyFromNetwork(chain.network)) === "tempo";
-}
-function resolveNonceNetworkKey(args) {
-	const resolved = tryResolveNonceNetworkKey(args);
-	if (resolved) return resolved;
-	const chainId = args.request.tx.chainId;
-	throw new Error(`[SigningEngine] unable to resolve nonce network for ${args.request.chain} chainId=${String(chainId)} from configured chains`);
-}
-function resolveNonceNetworkKeyForError(args) {
-	return tryResolveNonceNetworkKey(args) || `${args.request.chain}:${String(args.request.tx.chainId)}`;
-}
-function tryResolveNonceNetworkKey(args) {
-	const chainId = args.request.tx.chainId;
-	const matchesByChainId = args.configs.network.chains.filter((chain) => {
-		const configured = readOptionalChainId(chain);
-		return typeof configured === "number" && configured === chainId;
-	});
-	if (!matchesByChainId.length) return null;
-	if (args.request.chain === "tempo") {
-		const tempoMatches = matchesByChainId.filter((chain) => isTempoFamilyNetwork(chain));
-		if (tempoMatches.length === 1) return tempoMatches[0].network;
-		if (tempoMatches.length > 1) {
-			const candidates = tempoMatches.map((chain) => chain.network).join(", ");
-			throw new Error(`[SigningEngine] ambiguous nonce network for tempo chainId=${String(args.request.tx.chainId)} across [${candidates}]`);
-		}
-		return null;
-	}
-	const evmMatches = matchesByChainId.filter((chain) => isEvmFamilyNetwork(chain));
-	if (evmMatches.length === 1) return evmMatches[0].network;
-	if (evmMatches.length > 1) {
-		const candidates = evmMatches.map((chain) => chain.network).join(", ");
-		throw new Error(`[SigningEngine] ambiguous nonce network for evm chainId=${String(args.request.tx.chainId)} across [${candidates}]`);
-	}
-	const tempoMatches = matchesByChainId.filter((chain) => isTempoFamilyNetwork(chain));
-	if (tempoMatches.length === 1) return tempoMatches[0].network;
-	if (tempoMatches.length > 1) {
-		const candidates = tempoMatches.map((chain) => chain.network).join(", ");
-		throw new Error(`[SigningEngine] ambiguous nonce network for evm->tempo chainId=${String(args.request.tx.chainId)} across [${candidates}]`);
-	}
-	return null;
-}
-function thresholdOwnerNonceSenderIdentity(thresholdOwnerAddress) {
-	return {
-		kind: "threshold_owner",
-		thresholdOwnerAddress
-	};
-}
-function chainAccountNonceSenderIdentity(chainAccountAddress) {
-	return {
-		kind: "chain_account",
-		chainAccountAddress
-	};
-}
-function senderAddressFromIdentity(senderIdentity) {
-	switch (senderIdentity.kind) {
-		case "threshold_owner": return senderIdentity.thresholdOwnerAddress;
-		case "chain_account": return senderIdentity.chainAccountAddress;
-		default: return senderIdentity;
-	}
-}
-async function resolveWalletChainNonceSenderIdentity(args) {
-	const metadata = (await args.deps.walletSignerStore.getActiveWalletSignerForChainTarget({
-		walletId: args.walletId,
-		chainTarget: args.chainTarget
-	}))?.metadata || {};
-	const thresholdOwnerAddress = toOptionalEvmAddress(metadata.thresholdOwnerAddress);
-	if (thresholdOwnerAddress) return thresholdOwnerNonceSenderIdentity(thresholdOwnerAddress);
-	const chainAccountAddress = toOptionalEvmAddress(metadata.accountAddress);
-	if (chainAccountAddress) return chainAccountNonceSenderIdentity(chainAccountAddress);
-	const chainIdKey = toIndexedDbChainTargetKey(args.chainTarget);
-	throw new Error(`[SigningEngine] unable to resolve managed nonce wallet signer for ${args.walletId} (${chainIdKey})`);
-}
-async function resolveManagedNonceSender(args) {
-	return senderAddressFromIdentity(args.senderIdentity);
-}
-//#endregion
-//#region src/core/signingEngine/flows/signEvmFamily/evmNonceLifecycle.ts
-async function resolveManagedEvmNonceReservationInput(args) {
-	const sender = await resolveManagedNonceSender({ senderIdentity: args.senderIdentity });
-	return reserveNonceInputFromBoundary({
-		chain: "evm",
-		networkKey: resolveNonceNetworkKey({
-			configs: args.deps.seamsWebConfigs,
-			request: args.request
-		}),
-		chainId: args.request.tx.chainId,
-		sender,
-		walletId: args.walletId
-	});
-}
-async function reserveManagedEvmNonceForRequest(args) {
-	const reservationInput = args.reservationInput;
-	let reservation;
-	try {
-		reservation = evmNonceLeaseToManagedReservation(await args.deps.nonceCoordinator.reserve({
-			lane: evmReserveNonceInputToLane(reservationInput),
-			operation: args.operation
-		}));
-	} catch (error) {
-		throw mapToRetryableNonceStateError({
-			error,
-			chain: "evm",
-			networkKey: reservationInput.chainTarget.networkSlug,
-			chainId: reservationInput.chainTarget.chainId
-		});
-	}
-	return {
-		request: {
-			...args.request,
-			tx: {
-				...args.request.tx,
-				nonce: reservation.nonce
-			}
-		},
-		reservation
-	};
-}
-//#endregion
-//#region src/core/signingEngine/flows/signEvmFamily/tempoNonceLifecycle.ts
-async function reserveManagedTempoNonceForRequest(args) {
-	const sender = await resolveManagedNonceSender({ senderIdentity: args.senderIdentity });
-	const reservationInput = reserveNonceInputFromBoundary({
-		chain: "tempo",
-		networkKey: resolveNonceNetworkKey({
-			configs: args.deps.seamsWebConfigs,
-			request: args.request
-		}),
-		chainId: args.request.tx.chainId,
-		sender,
-		nonceKey: args.request.tx.nonceKey,
-		walletId: args.walletId
-	});
-	let reservation;
-	try {
-		reservation = evmNonceLeaseToManagedReservation(await args.deps.nonceCoordinator.reserve({
-			lane: evmReserveNonceInputToLane(reservationInput),
-			operation: args.operation
-		}));
-	} catch (error) {
-		throw mapToRetryableNonceStateError({
-			error,
-			chain: "tempo",
-			networkKey: reservationInput.chainTarget.networkSlug,
-			chainId: reservationInput.chainTarget.chainId
-		});
-	}
-	return {
-		request: {
-			...args.request,
-			tx: {
-				...args.request.tx,
-				nonce: reservation.nonce
-			}
-		},
-		reservation
-	};
-}
-//#endregion
-//#region src/core/signingEngine/flows/signEvmFamily/transactionExecutor.ts
-function resolveThresholdOwnerNonceSenderIdentity(args) {
-	if (args.state.kind === "not_required") return void 0;
-	return thresholdOwnerNonceSenderIdentity(args.state.thresholdOwnerAddress);
-}
-function requireRawEip1559ThresholdOwnerNonceSenderIdentity(args) {
-	if (args.state.kind === "not_required") throw new Error(`[SigningEngine][evm-family] raw EIP-1559 signing requires prepared threshold ECDSA owner address for ${args.walletId}`);
-	return thresholdOwnerNonceSenderIdentity(args.state.thresholdOwnerAddress);
-}
-function resolveFallbackChainAccountNonceSenderIdentity(args) {
-	return resolveWalletChainNonceSenderIdentity({
-		deps: args.deps,
-		walletId: args.walletId,
-		chainTarget: args.chainTarget
-	});
-}
-async function executeConfiguredEvmFamilyTransactionSigning(args, config) {
-	const recoverDurableLeasesTask = args.deps.nonceCoordinator.recoverDurableLeases({ walletId: args.walletId });
-	recoverDurableLeasesTask.catch(() => {});
-	const signWithUiConfirm = await config.loadSigner();
-	try {
-		return await signWithUiConfirm({
-			...args.flowArgs,
-			authorization: args.flowArgs.authorization ?? { kind: "owner" },
-			request: args.request,
-			onConfirmationDisplayed: args.onConfirmationDisplayed,
-			thresholdEcdsaStepUp: args.thresholdEcdsaStepUp,
-			prepareRequestWithManagedNonce: async () => {
-				await recoverDurableLeasesTask;
-				return await config.prepareRequestWithManagedNonce({
-					deps: args.deps,
-					walletId: args.walletId,
-					request: args.request,
-					nonceOperation: args.nonceOperation
-				});
-			},
-			releaseNonceReservation: async (reservation) => {
-				await releaseEvmFamilyNonceReservation(args.deps, reservation);
-			}
-		});
-	} catch (error) {
-		const retried = await args.retryWithFreshEmailOtpAuth(error);
-		if (retried) return retried;
-		throw mapToRetryableNonceStateError({
-			error,
-			chain: config.targetKind,
-			networkKey: resolveNonceNetworkKeyForError({
-				configs: args.deps.seamsWebConfigs,
-				request: args.request
-			}),
-			chainId: args.chainTarget.chainId
-		});
-	}
-}
-async function executeEvmFamilyTransactionSigning(args) {
-	if (args.chainTarget.kind === "evm" || args.request.kind === "eip1559") {
-		let reservationInputPromise = null;
-		let fallbackSenderIdentityPromise = null;
-		const rawEip1559SenderIdentity = args.request.kind === "eip1559" ? requireRawEip1559ThresholdOwnerNonceSenderIdentity({
-			state: args.thresholdEcdsaState,
-			walletId: args.walletId,
-			chainTarget: args.chainTarget
-		}) : void 0;
-		const preparedSenderIdentity = resolveThresholdOwnerNonceSenderIdentity({ state: args.thresholdEcdsaState });
-		const getSenderIdentity = (nonceArgs) => {
-			const exactSenderIdentity = rawEip1559SenderIdentity || preparedSenderIdentity;
-			if (exactSenderIdentity) return Promise.resolve(exactSenderIdentity);
-			if (!fallbackSenderIdentityPromise) fallbackSenderIdentityPromise = resolveFallbackChainAccountNonceSenderIdentity({
-				deps: nonceArgs.deps,
-				walletId: nonceArgs.walletId,
-				chainTarget: args.chainTarget
-			});
-			return fallbackSenderIdentityPromise;
-		};
-		const getReservationInput = (nonceArgs) => {
-			if (!reservationInputPromise) reservationInputPromise = getSenderIdentity(nonceArgs).then((senderIdentity) => resolveManagedEvmNonceReservationInput({
-				deps: nonceArgs.deps,
-				walletId: nonceArgs.walletId,
-				request: nonceArgs.request,
-				senderIdentity
-			}));
-			return reservationInputPromise;
-		};
-		const targetKind = args.chainTarget.kind;
-		return await executeConfiguredEvmFamilyTransactionSigning({
-			...args,
-			request: args.request
-		}, {
-			targetKind,
-			loadSigner: targetKind === "tempo" ? loadSignEvmFamilyWithUiConfirmForTempo : loadSignEvmWithUiConfirm,
-			prepareRequestWithManagedNonce: async (nonceArgs) => {
-				const reservationInput = await getReservationInput(nonceArgs);
-				return await reserveManagedEvmNonceForRequest({
-					deps: nonceArgs.deps,
-					request: nonceArgs.request,
-					reservationInput,
-					operation: nonceArgs.nonceOperation
-				});
-			}
-		});
-	}
-	let tempoFallbackSenderIdentityPromise = null;
-	const tempoPreparedSenderIdentity = resolveThresholdOwnerNonceSenderIdentity({ state: args.thresholdEcdsaState });
-	const getTempoSenderIdentity = (nonceArgs) => {
-		if (tempoPreparedSenderIdentity) return Promise.resolve(tempoPreparedSenderIdentity);
-		if (!tempoFallbackSenderIdentityPromise) tempoFallbackSenderIdentityPromise = resolveFallbackChainAccountNonceSenderIdentity({
-			deps: nonceArgs.deps,
-			walletId: nonceArgs.walletId,
-			chainTarget: args.chainTarget
-		});
-		return tempoFallbackSenderIdentityPromise;
-	};
-	return await executeConfiguredEvmFamilyTransactionSigning({
-		...args,
-		request: args.request
-	}, {
-		targetKind: "tempo",
-		loadSigner: loadSignEvmFamilyWithUiConfirmForTempo,
-		prepareRequestWithManagedNonce: async (nonceArgs) => {
-			const senderIdentity = await getTempoSenderIdentity(nonceArgs);
-			return await reserveManagedTempoNonceForRequest({
-				deps: nonceArgs.deps,
-				walletId: nonceArgs.walletId,
-				request: nonceArgs.request,
-				operation: nonceArgs.nonceOperation,
-				senderIdentity
-			});
-		}
-	});
-}
-//#endregion
-//#region src/core/signingEngine/routerAb/ecdsaDerivation/signingMaterialRef.ts
-function buildRouterAbEcdsaDerivationSigningMaterialRef(args) {
-	const routerAbState = requireRouterAbEcdsaDerivationNormalSigningStateV1(args.routerAbState);
-	return {
-		kind: "router_ab_ecdsa_derivation_signing_material_ref_v1",
-		activeStateId: routerAbEcdsaDerivationActiveStateId(routerAbState),
-		ecdsaThresholdKeyId: parseEcdsaThresholdKeyId(routerAbState.scope.ecdsa_threshold_key_id),
-		signingRootId: routerAbState.scope.signing_root_id,
-		signingRootVersion: routerAbState.scope.signing_root_version,
-		signingWorkerId: routerAbState.scope.signing_worker.server_id,
-		clientVerifier33B64u: parseEcdsaClientVerifyingShareB64u(routerAbState.scope.public_identity.derivation_client_share_public_key33_b64u),
-		serverVerifier33B64u: routerAbState.scope.public_identity.server_public_key33_b64u,
-		thresholdVerifier33B64u: routerAbState.scope.public_identity.threshold_public_key33_b64u
-	};
-}
-//#endregion
-//#region src/core/signingEngine/flows/signEvmFamily/readySecp256k1Material.ts
-async function hydrateEcdsaRoleLocalMaterialForSigning(args) {
-	return resolveEcdsaRoleLocalMaterial({
-		purpose: "transaction_signing",
-		source: ecdsaRoleLocalPersistedMaterialSource(args.persistedMaterial),
-		workerCtx: args.workerCtx
-	});
-}
-/** Ready ECDSA signing material, assembled from each fact's canonical owner:
-* the manifest names the material and its public facts, the exact durable
-* runtime supplies normal-signing state, policy scope, and transport, and the
-* exact Wallet Session remains a separate authorization input.
-*
-* Nothing is decoded out of the opaque Wallet Session token. The facts it authorizes are owned by
-* the manifest and durable material record, which are correlated before this
-* function receives the runtime. */
-async function resolveHydratedSecp256k1SigningMaterial(args) {
-	const capability = args.capability;
-	const manifest = capability.manifest;
-	const persistedMaterial = capability.material;
-	const runtime = args.runtime;
-	const sourceRoleLocalFacts = persistedMaterial.publicFacts;
-	if (!mpcMaterialActivationRefsEqual(args.materialActivation, manifest.activation.materialActivation)) return {
-		kind: "unavailable",
-		reason: "material_activation_mismatch"
-	};
-	if (!mpcMaterialActivationRefsEqual(runtime.materialActivation, manifest.activation.materialActivation)) return {
-		kind: "unavailable",
-		reason: "runtime_correlation_mismatch"
-	};
-	const sourceTargetIsPublished = manifest.signer.scope.targetMemberships.some((target) => thresholdEcdsaChainTargetsEqual(target, sourceRoleLocalFacts.chainTarget));
-	const requestedTarget = manifest.signer.scope.targetMemberships.find((target) => thresholdEcdsaChainTargetsEqual(target, args.chainTarget));
-	if (!sourceTargetIsPublished || !requestedTarget) return {
-		kind: "unavailable",
-		reason: "chain_mismatch"
-	};
-	if (!thresholdEcdsaChainTargetsEqual(runtime.chainTarget, requestedTarget)) return {
-		kind: "unavailable",
-		reason: "chain_mismatch"
-	};
-	const roleLocalFacts = projectEcdsaRoleLocalPublicFactsToChainTarget({
-		publicFacts: sourceRoleLocalFacts,
-		chainTarget: requestedTarget
-	});
-	if (!runtime.runtimePolicyScope) return {
-		kind: "unavailable",
-		reason: "runtime_policy_scope_missing"
-	};
-	const roleLocalMaterialResolution = await hydrateEcdsaRoleLocalMaterialForSigning({
-		persistedMaterial,
-		workerCtx: args.workerCtx
-	});
-	let resolvedRoleLocalMaterial;
-	switch (roleLocalMaterialResolution.kind) {
-		case "rehydrated":
-			resolvedRoleLocalMaterial = roleLocalMaterialResolution;
-			break;
-		case "device_link_required": return {
-			kind: "unavailable",
-			reason: "device_link_required"
-		};
-		case "corrupt": return {
-			kind: "unavailable",
-			reason: "material_corrupt"
-		};
-		default: return roleLocalMaterialResolution;
-	}
-	const normalSigningState = runtime.normalSigning;
-	const signingMaterial = buildRouterAbEcdsaDerivationSigningMaterialRef({ routerAbState: normalSigningState });
-	return {
-		kind: "ready",
-		material: buildHydratedEcdsaSignerMaterial({
-			walletId: manifest.signer.walletId,
-			materialActivation: manifest.activation.materialActivation,
-			publicFacts: manifest.signer.registeredPublicFacts,
-			chainTarget: roleLocalFacts.chainTarget,
-			transport: {
-				kind: "threshold_ecdsa_signer_transport",
-				relayerUrl: runtime.relayerUrl,
-				relayerKeyId: manifest.durableMaterial.roleLocalBinding.relayerKeyId,
-				signingMaterial,
-				relayerVerifyingShareB64u: roleLocalFacts.relayerPublicKey33B64u
-			},
-			clientShare: {
-				kind: "role_local_worker_share",
-				handle: resolvedRoleLocalMaterial.liveHandle,
-				material: {
-					kind: "worker_loaded",
-					materialRef: resolvedRoleLocalMaterial.materialRef
-				}
-			},
-			routerAbEcdsaDerivationNormalSigning: {
-				kind: "router_ab_ecdsa_derivation_normal_signing_hydrated_v1",
-				state: normalSigningState,
-				activeStateId: routerAbEcdsaDerivationActiveStateId(normalSigningState)
-			}
-		})
-	};
-}
-function attachExactEcdsaWalletSessionAuthorization(args) {
-	const authorized = authorizeEvmFamilyEcdsaSigningCapability({
-		capability: args.capability,
-		authorization: args.authorization,
-		nowMs: args.nowMs
-	});
-	const session = authorized.authorization.session;
-	const operationCredential = authorized.authorization.operationCredential;
-	if (session.walletId !== args.material.walletId || !mpcMaterialActivationRefsEqual(args.material.materialActivation, args.capability.manifest.activation.materialActivation)) throw new Error("Exact Wallet Session authorization wallet does not match hydrated material");
-	if (operationCredential.token.trim().length === 0) throw new Error("Exact Wallet Session authorization is unavailable");
-	return buildReadySecp256k1SigningMaterial({
-		walletId: args.material.walletId,
-		signerSession: args.material,
-		authorization: {
-			kind: "reusable_wallet_session",
-			wallet_session_id: operationCredential.walletSessionId
-		},
-		credential: {
-			kind: "reusable_wallet_session",
-			walletSessionToken: operationCredential.token
-		},
-		expiresAtMs: session.expiresAtMs,
-		singleUseEmailOtpSession: false
-	});
-}
-function exactSessionAuthorizesEcdsaSigning(args) {
-	return args.session.capabilitySubjects.some((subject) => subject.kind === "sign" && subject.keyFamily === "ecdsa_secp256k1" && mpcMaterialActivationRefsEqual(subject.materialActivation, args.materialActivation));
-}
-function buildActiveWalletAuthorityReadySecp256k1Material(args) {
-	const authorityRuntime = args.authorityRuntime;
-	const runtime = authorityRuntime.holderRuntime;
-	const session = authorityRuntime.session;
-	const operationCredential = authorityRuntime.operationCredential;
-	const normalSigning = runtime.activationReceipt.normalSigning;
-	const normalScope = normalSigning.scope;
-	if (session.walletId !== runtime.walletId || session.authorityId !== runtime.authorityId || session.authMethodId !== runtime.walletAuthMethodId || operationCredential.walletSessionId !== authorityRuntime.walletSessionId || session.expiresAtMs <= Date.now() || !exactSessionAuthorizesEcdsaSigning({
-		session,
-		materialActivation: runtime.materialActivation
-	}) || normalScope.wallet_id !== runtime.walletId || normalScope.ecdsa_threshold_key_id !== runtime.ecdsaThresholdKeyId || !mpcMaterialActivationRefsEqual(routerAbMpcMaterialActivationRefFromWire(normalScope.material_activation), runtime.materialActivation)) throw new Error("[SigningEngine] active Wallet Authority session does not bind the ECDSA holder runtime");
-	const relayerUrl = String(args.relayerUrl || "").trim();
-	if (!relayerUrl) throw new Error("[SigningEngine] active Wallet Authority ECDSA signing requires relayerUrl");
-	const signerSession = buildHydratedEcdsaSignerMaterial({
-		walletId: toWalletId(runtime.walletId),
-		materialActivation: runtime.materialActivation,
-		publicFacts: authorityRuntime.publicFacts,
-		chainTarget: args.chainTarget,
-		transport: {
-			kind: "threshold_ecdsa_signer_transport",
-			relayerUrl,
-			relayerKeyId: authorityRuntime.relayerKeyId,
-			signingMaterial: buildRouterAbEcdsaDerivationSigningMaterialRef({ routerAbState: normalSigning }),
-			relayerVerifyingShareB64u: normalScope.public_identity.server_public_key33_b64u
-		},
-		clientShare: {
-			kind: "linked_holder_worker_share",
-			holderHandleId: runtime.holderHandleId
-		},
-		routerAbEcdsaDerivationNormalSigning: {
-			kind: "router_ab_ecdsa_derivation_normal_signing_hydrated_v1",
-			state: normalSigning,
-			activeStateId: routerAbEcdsaDerivationActiveStateId(normalSigning)
-		}
-	});
-	return buildReadySecp256k1SigningMaterial({
-		walletId: runtime.walletId,
-		signerSession,
-		authorization: {
-			kind: "reusable_wallet_session",
-			wallet_session_id: operationCredential.walletSessionId
-		},
-		credential: {
-			kind: "reusable_wallet_session",
-			walletSessionToken: operationCredential.token
-		},
-		expiresAtMs: session.expiresAtMs,
-		singleUseEmailOtpSession: false
-	});
-}
-//#endregion
-//#region src/core/signingEngine/session/material/ecdsaSealedRuntime.ts
-function blocked$1(reason) {
-	return {
-		kind: "blocked",
-		reason
-	};
-}
-function authMethodForEcdsaSealedSource(source) {
-	switch (source) {
-		case "email_otp": return "email_otp";
-		case "login":
-		case "registration":
-		case "manual-bootstrap": return "passkey";
-		default: throw new Error("[SigningEngine] unsupported sealed ECDSA source");
-	}
-}
-function normalizedNonEmpty(value) {
-	return String(value ?? "").trim();
-}
-/** Exact match on stable material identity. Rotating session and grant
-* identifiers deliberately take no part: they change under a reusable Wallet
-* Session without changing which material this record describes. */
-function sealedRecordNamesManifestMaterial(args) {
-	const restore = args.record.ecdsaRestore;
-	const durable = args.manifest.durableMaterial;
-	if (normalizedNonEmpty(args.record.walletId) !== String(args.walletId)) return false;
-	if (!thresholdEcdsaChainTargetsEqual(restore.chainTarget, args.chainTarget)) return false;
-	if (!mpcMaterialActivationRefsEqual(restore.roleLocalMaterialRef.materialActivation, durable.materialActivation)) return false;
-	if (!mpcMaterialActivationRefsEqual(durable.materialActivation, args.manifest.activation.materialActivation)) return false;
-	return normalizedNonEmpty(restore.roleLocalMaterialRef.durableMaterialRef) === normalizedNonEmpty(durable.durableMaterialRef);
-}
-function participantIdsEqual(left, right) {
-	return left.length === right.length && left.every((value, index) => value === right[index]);
-}
-function authorityRefsEqual(left, right) {
-	return left.kind === right.kind && String(left.walletId) === String(right.walletId) && String(left.authorityDigest) === String(right.authorityDigest);
-}
-function manifestIncludesTarget(args) {
-	return args.manifest.signer.scope.targetMemberships.some((target) => thresholdEcdsaChainTargetsEqual(target, args.chainTarget));
-}
-function sealedRecordBindsManifestFacts(args) {
-	const restore = args.record.ecdsaRestore;
-	const durable = args.manifest.durableMaterial;
-	const binding = durable.roleLocalBinding;
-	const publicFacts = durable.roleLocalPublicFacts;
-	const normalScope = restore.routerAbEcdsaDerivationNormalSigning.scope;
-	const expectedAuthMethod = authMethodForEcdsaSealedSource(restore.source);
-	const resolvedThresholdKeyId = normalizedNonEmpty(restore.ecdsaThresholdKeyId) || normalizedNonEmpty(normalScope.ecdsa_threshold_key_id);
-	const resolvedClientVerifyingShare = "recordKind" in args.record ? normalizedNonEmpty(binding.clientVerifyingPublicKey33B64u) : normalizedNonEmpty(restore.clientVerifyingShareB64u) || normalizedNonEmpty(normalScope.public_identity.derivation_client_share_public_key33_b64u);
-	const resolvedThresholdPublicKey = normalizedNonEmpty(restore.thresholdEcdsaPublicKeyB64u) || normalizedNonEmpty(normalScope.public_identity.threshold_public_key33_b64u);
-	return String(args.manifest.signer.walletId) === String(args.walletId) && String(publicFacts.walletId) === String(args.walletId) && manifestIncludesTarget(args) && args.record.authMethod === expectedAuthMethod && authorityRefsEqual(restore.authority, args.manifest.signer.authority) && normalizedNonEmpty(restore.roleLocalMaterialRef.bindingDigest) === normalizedNonEmpty(durable.bindingDigest) && normalizedNonEmpty(restore.keyHandle) === normalizedNonEmpty(binding.keyHandle) && normalizedNonEmpty(restore.keyHandle) === normalizedNonEmpty(publicFacts.keyHandle) && resolvedThresholdKeyId === normalizedNonEmpty(binding.ecdsaThresholdKeyId) && resolvedThresholdKeyId === normalizedNonEmpty(publicFacts.ecdsaThresholdKeyId) && resolvedClientVerifyingShare === normalizedNonEmpty(binding.clientVerifyingPublicKey33B64u) && resolvedClientVerifyingShare === normalizedNonEmpty(publicFacts.derivationClientSharePublicKey33B64u) && resolvedThresholdPublicKey === normalizedNonEmpty(publicFacts.groupPublicKey33B64u) && normalizedNonEmpty(restore.relayerKeyId) === normalizedNonEmpty(binding.relayerKeyId) && participantIdsEqual(restore.participantIds, binding.participantIds) && participantIdsEqual(restore.participantIds, publicFacts.participantIds) && normalizedNonEmpty(restore.signingRootId) === normalizedNonEmpty(args.manifest.signer.signingRootId) && normalizedNonEmpty(restore.signingRootId) === normalizedNonEmpty(publicFacts.signingRootId) && normalizedNonEmpty(restore.signingRootVersion) === normalizedNonEmpty(args.manifest.signer.signingRootVersion) && normalizedNonEmpty(restore.signingRootVersion) === normalizedNonEmpty(publicFacts.signingRootVersion) && normalizedNonEmpty(restore.ethereumAddress).toLowerCase() === normalizedNonEmpty(publicFacts.ethereumAddress).toLowerCase() && routerAbEcdsaDerivationPublicCapabilitiesEqual(restore.publicCapability, publicFacts.publicCapability) && sameRouterAbEcdsaDerivationNormalSigningScopeV1(normalScope, {
-		wallet_id: String(args.walletId),
-		ecdsa_threshold_key_id: String(publicFacts.ecdsaThresholdKeyId),
-		signing_root_id: String(publicFacts.signingRootId),
-		signing_root_version: String(publicFacts.signingRootVersion),
-		context: publicFacts.publicCapability.context,
-		public_identity: publicFacts.publicCapability.public_identity,
-		signing_worker: publicFacts.publicCapability.signer_set.selected_server,
-		activation_epoch: publicFacts.publicCapability.activation_epoch,
-		material_activation: routerAbMpcMaterialActivationRefToWire(durable.materialActivation)
-	});
-}
-function authBindingFromRestore(args) {
-	const restore = args.restore;
-	if (restore.source === "email_otp") {
-		const providerSubjectId = normalizedNonEmpty(restore.providerSubjectId);
-		const emailHashHex = normalizedNonEmpty(restore.emailHashHex);
-		const sealedAuthority = restore.emailOtpAuthority;
-		const manifestAuthority = args.manifest.signer.authority;
-		if (!providerSubjectId || !emailHashHex || !sealedAuthority || String(sealedAuthority.walletId) !== String(manifestAuthority.walletId) || String(sealedAuthority.factor.providerUserId) !== providerSubjectId || String(sealedAuthority.verifier.emailHashHex) !== emailHashHex) return null;
-		return {
-			kind: "email_otp",
-			providerSubjectId,
-			emailHashHex,
-			emailOtpAuthority: {
-				walletId: sealedAuthority.walletId,
-				factor: sealedAuthority.factor,
-				verifier: sealedAuthority.verifier,
-				bindingId: manifestAuthority.walletAuthMethodId
-			}
-		};
-	}
-	const rpId = normalizedNonEmpty(restore.rpId);
-	const credentialIdB64u = normalizedNonEmpty(restore.credentialIdB64u);
-	return rpId && credentialIdB64u ? {
-		kind: "passkey",
-		rpId,
-		credentialIdB64u
-	} : null;
-}
-function exactTwoPartyParticipantIds$1(value) {
-	if (value.length !== 2) return null;
-	const first = value[0];
-	const second = value[1];
-	if (!Number.isSafeInteger(first) || !Number.isSafeInteger(second) || first <= 0 || second <= 0 || first === second) return null;
-	return [first, second];
-}
-function materialRuntimeFromRecord(args) {
-	const restore = args.record.ecdsaRestore;
-	const authBinding = authBindingFromRestore({
-		manifest: args.manifest,
-		restore
-	});
-	const relayerUrl = normalizedNonEmpty(args.record.relayerUrl).replace(/\/+$/g, "");
-	const relayerKeyId = normalizedNonEmpty(restore.relayerKeyId);
-	const clientVerifyingPublicKey33B64u = args.manifest.durableMaterial.roleLocalBinding.clientVerifyingPublicKey33B64u;
-	const ecdsaThresholdKeyId = normalizedNonEmpty(restore.ecdsaThresholdKeyId) || normalizedNonEmpty(restore.routerAbEcdsaDerivationNormalSigning.scope.ecdsa_threshold_key_id);
-	const thresholdEcdsaPublicKeyB64u = normalizedNonEmpty(restore.thresholdEcdsaPublicKeyB64u) || normalizedNonEmpty(restore.routerAbEcdsaDerivationNormalSigning.scope.public_identity.threshold_public_key33_b64u);
-	const keyHandle = normalizedNonEmpty(restore.keyHandle);
-	const participantIds = Array.isArray(restore.participantIds) ? exactTwoPartyParticipantIds$1(restore.participantIds) : null;
-	let roleLocalMaterialRef;
-	try {
-		roleLocalMaterialRef = parseEcdsaRoleLocalPersistedMaterialRef(restore.roleLocalMaterialRef);
-	} catch {
-		return null;
-	}
-	let runtimePolicyScope = null;
-	try {
-		runtimePolicyScope = normalizeRuntimePolicyScope(restore.runtimePolicyScope);
-	} catch {
-		runtimePolicyScope = null;
-	}
-	if (!authBinding || !relayerUrl || !relayerKeyId || !clientVerifyingPublicKey33B64u || !ecdsaThresholdKeyId || !thresholdEcdsaPublicKeyB64u || !keyHandle || !participantIds) return null;
-	return {
-		walletId: args.walletId,
-		chainTarget: args.chainTarget,
-		materialActivation: restore.roleLocalMaterialRef.materialActivation,
-		normalSigning: restore.routerAbEcdsaDerivationNormalSigning,
-		relayerUrl,
-		relayerKeyId,
-		clientVerifyingPublicKey33B64u,
-		participantIds,
-		ecdsaThresholdKeyId,
-		thresholdEcdsaPublicKeyB64u,
-		keyHandle,
-		runtimePolicyScope,
-		roleLocalMaterialRef,
-		authBinding
-	};
-}
-function runtimeFromSealedRecord(args) {
-	const materialRuntime = materialRuntimeFromRecord(args);
-	const expiresAtMs = Number(args.record.expiresAtMs);
-	const remainingUses = Number(args.record.remainingUses);
-	const thresholdSessionId = normalizedNonEmpty(args.record.thresholdSessionIds.ecdsa);
-	const storeKey = normalizedNonEmpty(args.record.storeKey);
-	if (!materialRuntime || !storeKey || !thresholdSessionId || !Number.isSafeInteger(expiresAtMs) || expiresAtMs <= 0 || !Number.isSafeInteger(remainingUses) || remainingUses < 0) return null;
-	return {
-		...materialRuntime,
-		kind: "exact_ecdsa_sealed_runtime_v1",
-		expiresAtMs,
-		remainingUses,
-		sealedRecord: {
-			storeKey,
-			thresholdSessionId,
-			authMethod: args.record.authMethod
-		}
-	};
-}
-function resolveExactEcdsaSealedRuntime(input) {
-	const matches = input.sealedRecords.filter((record) => sealedRecordNamesManifestMaterial({
-		manifest: input.manifest,
-		walletId: input.walletId,
-		chainTarget: input.chainTarget,
-		record
-	}));
-	if (matches.length === 0) return blocked$1("missing_material");
-	if (matches.length > 1) return blocked$1("exact_record_conflict");
-	const runtime = runtimeFromSealedRecord({
-		manifest: input.manifest,
-		walletId: input.walletId,
-		chainTarget: input.chainTarget,
-		record: matches[0]
-	});
-	if (!runtime) return blocked$1("corrupt");
-	if (!sealedRecordBindsManifestFacts({
-		manifest: input.manifest,
-		walletId: input.walletId,
-		chainTarget: input.chainTarget,
-		record: matches[0]
-	})) return blocked$1("binding_mismatch");
-	return {
-		kind: "resolved",
-		runtime
-	};
-}
-//#endregion
-//#region src/core/signingEngine/session/material/activeEcdsaCapabilityRuntime.ts
-function manifestCoversTarget(args) {
-	return args.manifest.signer.scope.targetMemberships.some((membership) => thresholdEcdsaChainTargetsEqual(membership, args.chainTarget));
-}
-async function listActiveManifestsForTarget(args) {
-	return (await args.ports.listActiveEcdsaCapabilityManifestsForWallet(args.walletId)).filter((manifest) => manifestCoversTarget({
-		manifest,
-		chainTarget: args.chainTarget
-	}));
-}
-async function listSealedEcdsaRecordsForWallet(args) {
-	const records = [];
-	const authMethods = args.authMethod ? [args.authMethod] : ["passkey", "email_otp"];
-	for (const authMethod of authMethods) {
-		const found = await args.ports.listExactSealedSessionsForWallet({
-			walletId: String(args.walletId),
-			filter: {
-				authMethod,
-				curve: "ecdsa",
-				chainTarget: args.chainTarget
-			}
-		}).catch(() => []);
-		for (const record of found) if (record.curve === "ecdsa") records.push(record);
-	}
-	return records;
-}
-async function resolveExactEcdsaCapabilityRuntime(args) {
-	if (!manifestCoversTarget({
-		manifest: args.manifest,
-		chainTarget: args.chainTarget
-	})) return {
-		kind: "blocked",
-		reason: "chain_mismatch"
-	};
-	const durable = args.manifest.durableMaterial;
-	const facts = durable.roleLocalPublicFacts;
-	const participantIds = exactTwoPartyParticipantIds(facts.participantIds);
-	const relayerUrl = String(args.relayerUrl).trim().replace(/\/+$/g, "");
-	if (!participantIds || !relayerUrl) return {
-		kind: "blocked",
-		reason: "corrupt"
-	};
-	return {
-		kind: "resolved",
-		manifest: args.manifest,
-		runtime: {
-			kind: "exact_ecdsa_capability_runtime_v1",
-			walletId: args.manifest.signer.walletId,
-			chainTarget: args.chainTarget,
-			materialActivation: durable.materialActivation,
-			normalSigning: durable.routerAbEcdsaDerivationNormalSigning,
-			relayerUrl,
-			relayerKeyId: String(durable.roleLocalBinding.relayerKeyId),
-			clientVerifyingPublicKey33B64u: durable.roleLocalBinding.clientVerifyingPublicKey33B64u,
-			participantIds,
-			ecdsaThresholdKeyId: String(facts.ecdsaThresholdKeyId),
-			thresholdEcdsaPublicKeyB64u: facts.groupPublicKey33B64u,
-			keyHandle: String(facts.keyHandle),
-			runtimePolicyScope: durable.runtimePolicyScope,
-			roleLocalMaterialRef: {
-				kind: "ecdsa_role_local_persisted_material_ref_v1",
-				durableMaterialRef: durable.durableMaterialRef,
-				bindingDigest: durable.bindingDigest,
-				materialActivation: durable.materialActivation
-			}
-		}
-	};
-}
-function exactTwoPartyParticipantIds(value) {
-	if (value.length !== 2) return null;
-	const first = value[0];
-	const second = value[1];
-	if (!Number.isSafeInteger(first) || !Number.isSafeInteger(second) || first <= 0 || second <= 0 || first === second) return null;
-	return [first, second];
-}
-async function narrowToSelectedMethod(ports, walletId, manifests) {
-	const selected = await ports.resolveSelectedWalletAuthority(String(walletId));
-	if (selected.kind !== "resolved") return manifests;
-	const selectedMethodId = String(selected.authMethod.walletAuthMethodId);
-	const matching = manifests.filter((manifest) => String(manifest.signer.authority.walletAuthMethodId) === selectedMethodId);
-	return matching.length > 0 ? matching : manifests;
-}
-async function resolveActiveEcdsaCapabilityRuntime(ports, args) {
-	const all = await listActiveManifestsForTarget({
-		ports,
-		...args
-	});
-	if (all.length === 0) return {
-		kind: "blocked",
-		reason: "missing_capability"
-	};
-	const manifests = all.length > 1 ? await narrowToSelectedMethod(ports, args.walletId, all) : all;
-	if (manifests.length !== 1) return {
-		kind: "blocked",
-		reason: "exact_record_conflict"
-	};
-	const manifest = manifests[0];
-	const sealedRecords = await listSealedEcdsaRecordsForWallet({
-		ports,
-		...args
-	});
-	const resolution = resolveExactEcdsaSealedRuntime({
-		manifest,
-		walletId: args.walletId,
-		chainTarget: args.chainTarget,
-		sealedRecords
-	});
-	return resolution.kind === "resolved" ? {
-		kind: "resolved",
-		manifest,
-		runtime: resolution.runtime
-	} : {
-		kind: "blocked",
-		reason: resolution.reason
-	};
-}
-function createActiveEcdsaCapabilityRuntimeResolver(ports) {
-	return resolveActiveEcdsaCapabilityRuntime.bind(null, ports);
-}
-/** Resolve by chain kind, taking the exact chain target from the manifest's own
-* target memberships. The warm-session envelope is keyed by kind (evm/tempo)
-* while correlation needs a full target, and the manifest is the authority on
-* which targets its capability covers. */
-async function resolveActiveEcdsaCapabilityRuntimeForChain(ports, args) {
-	const manifests = await ports.listActiveEcdsaCapabilityManifestsForWallet(args.walletId);
-	const matches = [];
-	for (const manifest of manifests) for (const membership of manifest.signer.scope.targetMemberships) {
-		if (membership.kind !== args.chain) continue;
-		matches.push({
-			manifest,
-			chainTarget: membership
-		});
-	}
-	if (matches.length === 0) return {
-		kind: "blocked",
-		reason: "missing_capability"
-	};
-	if (matches.length > 1) return {
-		kind: "blocked",
-		reason: "exact_record_conflict"
-	};
-	const match = matches[0];
-	const sealedRecords = await listSealedEcdsaRecordsForWallet({
-		ports,
-		walletId: args.walletId,
-		chainTarget: match.chainTarget
-	});
-	const resolution = resolveExactEcdsaSealedRuntime({
-		manifest: match.manifest,
-		walletId: args.walletId,
-		chainTarget: match.chainTarget,
-		sealedRecords
-	});
-	return resolution.kind === "resolved" ? {
-		kind: "resolved",
-		manifest: match.manifest,
-		runtime: resolution.runtime
-	} : {
-		kind: "blocked",
-		reason: resolution.reason
-	};
-}
-function createActiveEcdsaCapabilityRuntimeForChainResolver(ports) {
-	return resolveActiveEcdsaCapabilityRuntimeForChain.bind(null, ports);
-}
-//#endregion
-//#region src/core/signingEngine/threshold/ecdsa/operationStepUp.ts
-function requireResponseRecord(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("ECDSA operation step-up response must be an object");
-	return value;
-}
-function parseEcdsaOperationStepUpAuthorizationResponse(value) {
-	try {
-		return parseRouterAbEcdsaOperationStepUpAuthorizationResponseV1(value);
-	} catch (error) {
-		throw new Error(error instanceof Error ? error.message : "ECDSA operation step-up response is invalid");
-	}
-}
-function operationStepUpEndpoint(relayerUrl) {
-	const baseUrl = String(relayerUrl || "").trim().replace(/\/+$/g, "");
-	if (!baseUrl) throw new Error("ECDSA operation step-up relayerUrl is required");
-	return `${baseUrl}${ROUTER_AB_ECDSA_DERIVATION_OPERATION_STEP_UP_PATH}`;
-}
-function buildEcdsaOperationStepUpPreparation(args) {
-	const walletId = String(args.walletId || "").trim();
-	const operationId = String(args.operationId || "").trim();
-	const expiresAtMs = Math.floor(Number(args.expiresAtMs));
-	if (!walletId || !operationId) throw new Error("ECDSA operation step-up identity is required");
-	if (!Number.isSafeInteger(expiresAtMs) || expiresAtMs <= Date.now()) throw new Error("ECDSA operation step-up expiry is invalid");
-	const materialActivation = routerAbMpcMaterialActivationRefToWire(args.materialActivation);
-	const normalSigningScope = parseRouterAbEcdsaDerivationNormalSigningScopeV1(args.normalSigningScope);
-	const keyHandle = String(args.keyHandle || "").trim();
-	const relayerKeyId = String(args.relayerKeyId || "").trim();
-	const participantIds = args.participantIds;
-	if (normalSigningScope.wallet_id !== walletId || normalSigningScope.signing_worker.server_id !== materialActivation.signing_worker || !keyHandle || !relayerKeyId || participantIds.length !== 2 || participantIds.some((participantId) => !Number.isSafeInteger(participantId) || participantId <= 0)) throw new Error("ECDSA operation step-up signing identity is inconsistent");
-	return {
-		wallet_id: walletId,
-		operation_kind: args.operationKind,
-		operation_id: operationId,
-		operation_digests: {
-			lane_digest_b64u: args.operationDigests.laneDigest,
-			intent_digest_b64u: args.operationDigests.intentDigest,
-			display_digest_b64u: args.operationDigests.displayDigest
-		},
-		material_activation: materialActivation,
-		normal_signing_scope: normalSigningScope,
-		signing_worker_id: materialActivation.signing_worker,
-		key_handle: keyHandle,
-		relayer_key_id: relayerKeyId,
-		participant_ids: [participantIds[0], participantIds[1]],
-		expires_at_ms: expiresAtMs
-	};
-}
-async function prepareEcdsaOperationStepUp(args) {
-	const operation = buildEcdsaOperationStepUpPreparation(args);
-	return {
-		operation,
-		challengeB64u: await computeRouterAbEcdsaOperationStepUpChallengeB64u(operation)
-	};
-}
-/**
-* User-facing copy for a step-up that failed because the wallet session is no
-* longer usable. These are the states signing in again resolves, so the message
-* says that rather than restating the transport failure. Anything else keeps the
-* server's own wording, which is aimed at the developer.
-*/
-function ecdsaOperationStepUpSessionMessage(code, serverMessage) {
-	switch (code) {
-		case WALLET_SESSION_FAILURE_CODES.expired:
-		case WALLET_SESSION_FAILURE_CODES.missing: return "Signing session expired. Sign in again to continue.";
-		case WALLET_SESSION_FAILURE_CODES.budgetExhausted: return "Signing session budget is used up. Sign in again to continue.";
-		default: return `ECDSA operation step-up failed: ${serverMessage}`;
-	}
-}
-async function issueEcdsaOperationStepUpAuthorization(args) {
-	const request = parseRouterAbEcdsaOperationStepUpAuthorizationRequestV1(args.request);
-	const fetchImpl = args.fetchImpl ?? globalThis.fetch;
-	if (typeof fetchImpl !== "function") throw new Error("fetch is unavailable for ECDSA operation step-up");
-	if (args.transport?.kind === "wallet_session_bearer" && args.transport.token.trim().length === 0) throw new Error("Wallet Session operation credential is required for ECDSA operation step-up");
-	const response = await (args.transport?.kind === "wallet_session_bearer" ? fetchWithWalletSessionBearer(fetchImpl, args.transport.token) : fetchImpl)(operationStepUpEndpoint(args.relayerUrl), {
-		method: "POST",
-		headers: { "Content-Type": "application/json" },
-		credentials: "omit",
-		body: JSON.stringify(request)
-	});
-	const body = await response.json().catch(() => null);
-	if (!response.ok) {
-		const error = requireResponseRecord(body);
-		const message = String(error.message || `HTTP ${response.status}`);
-		const walletSessionError = walletSessionFailureErrorFromPayload({
-			code: error.code,
-			message: ecdsaOperationStepUpSessionMessage(error.code, message)
-		});
-		if (walletSessionError) throw walletSessionError;
-		throw new Error(`ECDSA operation step-up failed: ${message}`);
-	}
-	return parseEcdsaOperationStepUpAuthorizationResponse(body);
-}
-function fetchWithWalletSessionBearer(fetchImpl, token) {
-	return async (input, init) => {
-		const headers = new Headers(init?.headers);
-		headers.set("Authorization", `Bearer ${token}`);
-		return await fetchImpl(input, {
-			...init,
-			headers
-		});
-	};
-}
-//#endregion
-//#region src/core/signingEngine/flows/signEvmFamily/thresholdAdmission.ts
-async function prepareEvmFamilyEcdsaOperationStepUp(args) {
-	const signerSession = args.material;
-	const participantIds = signerSession.publicFacts.participantIds;
-	if (participantIds.length !== 2) throw new Error("[chains] ECDSA operation step-up requires exactly two participants");
-	const operationId = String(args.operation.intent.operationId || "").trim();
-	const expiresAtMs = Math.min(Date.now() + 5 * 6e4, args.sessionExpiresAtMs);
-	return await prepareEcdsaOperationStepUp({
-		walletId: signerSession.walletId,
-		operationKind: "evm.sign_transaction",
-		operationId,
-		operationDigests: args.operationDigests,
-		materialActivation: signerSession.materialActivation,
-		normalSigningScope: signerSession.routerAbEcdsaDerivationNormalSigning.state.scope,
-		keyHandle: signerSession.publicFacts.keyHandle,
-		relayerKeyId: signerSession.transport.relayerKeyId,
-		participantIds: [Number(participantIds[0]), Number(participantIds[1])],
-		expiresAtMs
-	});
-}
-async function authorizeEvmFamilyEcdsaOperationStepUp(args) {
-	const proof = operationStepUpProof({
-		authority: args.authority,
-		authorization: args.authorization
-	});
-	const authorization = await issueEcdsaOperationStepUpAuthorization({
-		relayerUrl: args.relayerUrl,
-		request: {
-			kind: "router_ab_ecdsa_operation_step_up_v1",
-			operation: args.prepared.operation,
-			proof
-		}
-	});
-	const credential = {
-		kind: "operation_step_up",
-		walletSessionToken: args.walletSessionToken
-	};
-	return buildReadySecp256k1SigningMaterial({
-		walletId: args.material.walletId,
-		signerSession: args.material,
-		authorization: { kind: "operation_step_up" },
-		credential,
-		expiresAtMs: authorization.expires_at_ms,
-		singleUseEmailOtpSession: false,
-		operationStepUpPreparation: args.prepared.operation
-	});
-}
-function operationStepUpProof(args) {
-	switch (args.authorization.kind) {
-		case "passkey": {
-			if (!isPasskeyWalletAuthAuthority(args.authority)) throw new Error("[chains] passkey step-up requires the exact passkey authority");
-			const credential = args.authorization.credential;
-			return {
-				kind: "passkey",
-				authority: args.authority,
-				webauthn_authentication: {
-					id: credential.id,
-					rawId: credential.rawId,
-					type: credential.type,
-					authenticatorAttachment: credential.authenticatorAttachment ?? null,
-					response: {
-						clientDataJSON: credential.response.clientDataJSON,
-						authenticatorData: credential.response.authenticatorData,
-						signature: credential.response.signature,
-						userHandle: credential.response.userHandle ?? null
-					},
-					clientExtensionResults: credential.clientExtensionResults ?? null
-				}
-			};
-		}
-		case "email_otp":
-			if (!isEmailOtpWalletAuthAuthority(args.authority)) throw new Error("[chains] Email OTP step-up requires the exact Email OTP authority");
-			return {
-				kind: "email_otp",
-				authority: args.authority,
-				challenge_id: args.authorization.challengeId,
-				otp_code: args.authorization.otpCode
-			};
-	}
-}
-//#endregion
-//#region src/core/signingEngine/session/material/activeWalletAuthorityEcdsaRuntime.ts
-function blocked(reason, message) {
-	return message ? {
-		kind: "blocked",
-		reason,
-		message
-	} : {
-		kind: "blocked",
-		reason
-	};
-}
-function activeAuthorityEcdsaActivation(authority) {
-	if (isActiveEcdsaWalletAuthorityV1(authority)) return authority.signerActivations;
-	if (isCombinedWalletSignerActivationSetV1(authority.signerActivations)) return authority.signerActivations;
-	return null;
-}
-function exactAuthorityResolution(value) {
-	if (value.kind !== "resolved") switch (value.kind) {
-		case "missing_selection": return blocked("missing_selected_authority");
-		case "missing_auth_method":
-		case "missing_authority":
-		case "integrity_error": return blocked("invalid_selected_authority");
-		default: return value;
-	}
-	if (value.selection.walletId !== value.authMethod.walletId || value.selection.walletAuthMethodId !== value.authMethod.walletAuthMethodId || value.authMethod.walletAuthorityId !== value.authority.authorityId || value.authority.walletId !== value.selection.walletId) return blocked("authority_identity_mismatch");
-	if (value.selection.lockState !== "unlocked") return blocked("wallet_locked");
-	if (value.authMethod.status !== "active") return blocked("auth_method_inactive");
-	if (value.authority.state !== "active") return blocked("authority_inactive");
-	return {
-		selection: value.selection,
-		authMethod: value.authMethod,
-		authority: value.authority,
-		signerMaterials: value.signerMaterials
-	};
-}
-function exactEcdsaSignerMaterial(args) {
-	const matches = args.materials.filter((material) => material.kind === "wallet_authority_linked_signer_material_v1" && material.keyFamily === "ecdsa_secp256k1" && material.authorityId === args.authority.authorityId && material.walletAuthMethodId === args.authMethod.walletAuthMethodId && material.activationId === args.materialActivation.activationId && mpcMaterialActivationRefsEqual(material.materialActivation, args.materialActivation));
-	const [match] = matches;
-	return matches.length === 1 && match ? match : null;
-}
-function linkedMaterialTargetFactorMatches(args) {
-	const target = args.material.targetFactor;
-	if (target.walletAuthMethodId !== args.authMethod.walletAuthMethodId) return false;
-	if (args.authMethod.kind === "passkey") return target.kind === "passkey" && target.rpId === args.authMethod.rpId && target.credentialIdB64u === args.authMethod.credentialIdB64u;
-	return target.kind === "email_otp" && target.emailHashHex === args.authMethod.emailHashHex && target.registrationAuthorityId === args.authMethod.registrationAuthorityId;
-}
-function exactSessionCapability(args) {
-	return args.session.capabilitySubjects.filter((subject) => subject.kind === args.capability && subject.keyFamily === "ecdsa_secp256k1" && mpcMaterialActivationRefsEqual(subject.materialActivation, args.materialActivation)).length === 1;
-}
-function exactNormalSigningMaterialActivation(normalSigning) {
-	try {
-		return routerAbMpcMaterialActivationRefFromWire(normalSigning.scope.material_activation);
-	} catch {
-		return null;
-	}
-}
-function normalSigningAddress(normalSigning) {
-	try {
-		return bytesToHex(base64UrlDecode(normalSigning.scope.public_identity.ethereum_address20_b64u));
-	} catch {
-		return null;
-	}
-}
-function linkedEcdsaSourceContributionBindingsEqual(left, right) {
-	return left.linkSessionId === right.linkSessionId && left.enrollmentId === right.enrollmentId && left.sourceAuthorityId === right.sourceAuthorityId && sameEcdsaSourceSigner(left.source, right.source) && sameEcdsaTarget(left.target, right.target) && left.targetClientPublicKey33B64u === right.targetClientPublicKey33B64u;
-}
-function linkedEcdsaNormalSigningStatesEqual(left, right) {
-	return left.kind === right.kind && sameRouterAbEcdsaDerivationNormalSigningScopeV1(left.scope, right.scope);
-}
-function linkedEcdsaSourceDerivationsEqual(left, right) {
-	return left.applicationBindingDigestB64u === right.applicationBindingDigestB64u && left.clientShareRetryCounter === right.clientShareRetryCounter && left.ecdsaThresholdKeyId === right.ecdsaThresholdKeyId && linkedEcdsaNormalSigningStatesEqual(left.sourceNormalSigning, right.sourceNormalSigning);
-}
-function linkedEcdsaActivationReceiptsEqual(left, right) {
-	return left.state === right.state && linkedEcdsaSourceContributionBindingsEqual(left.binding, right.binding) && linkedEcdsaSourceDerivationsEqual(left.sourceDerivation, right.sourceDerivation) && left.targetRelayerPublicKey33B64u === right.targetRelayerPublicKey33B64u && left.thresholdPublicKey33B64u === right.thresholdPublicKey33B64u && left.thresholdEthereumAddress20B64u === right.thresholdEthereumAddress20B64u && linkedEcdsaNormalSigningStatesEqual(left.normalSigning, right.normalSigning);
-}
-function exactHolderRuntime(args) {
-	const runtime = resolveLinkedEcdsaHolderRuntimeV1({
-		walletId: args.walletId,
-		materialActivation: args.materialActivation
-	});
-	if (!runtime) return null;
-	if (runtime.walletId !== args.walletId || runtime.authorityId !== args.authority.authorityId || runtime.walletAuthMethodId !== args.authMethod.walletAuthMethodId || runtime.factorAuthority.walletId !== args.walletId || runtime.factorAuthority.bindingId !== args.authMethod.walletAuthMethodId || runtime.ecdsaThresholdKeyId !== args.ecdsaThresholdKeyId || !mpcMaterialActivationRefsEqual(runtime.materialActivation, args.materialActivation) || !linkedMaterialTargetFactorMatches({
-		material: args.material,
-		authMethod: args.authMethod
-	}) || !linkedEcdsaActivationReceiptsEqual(runtime.activationReceipt, args.material.publicFacts.activationReceipt)) return null;
-	return runtime;
-}
-async function buildActiveRuntime(args) {
-	const normalSigning = args.holderRuntime.activationReceipt.normalSigning;
-	const normalScope = normalSigning.scope;
-	const normalActivation = exactNormalSigningMaterialActivation(normalSigning);
-	const normalAddress = normalSigningAddress(normalSigning);
-	if (!normalActivation || !normalAddress || !mpcMaterialActivationRefsEqual(normalActivation, args.materialActivation) || args.signer.walletId !== args.selected.authority.walletId || normalScope.wallet_id !== String(args.selected.authority.walletId) || normalScope.ecdsa_threshold_key_id !== String(args.holderRuntime.ecdsaThresholdKeyId) || normalScope.public_identity.threshold_public_key33_b64u !== String(args.signer.thresholdPublicKey33B64u) || normalAddress.toLowerCase() !== String(args.signer.evmAddress).trim().toLowerCase() || String(args.holderRuntime.activationReceipt.thresholdPublicKey33B64u) !== String(normalScope.public_identity.threshold_public_key33_b64u) || String(args.holderRuntime.activationReceipt.thresholdEthereumAddress20B64u) !== String(normalScope.public_identity.ethereum_address20_b64u)) return blocked("normal_signing_identity_mismatch");
-	let key;
-	let publicFacts;
-	let relayerKeyId;
-	let keyHandle;
-	try {
-		keyHandle = await deriveEvmFamilyEcdsaKeyHandle({
-			ecdsaThresholdKeyId: normalScope.ecdsa_threshold_key_id,
-			signingRootId: normalScope.signing_root_id,
-			signingRootVersion: normalScope.signing_root_version
-		});
-		const thresholdOwnerAddress = toThresholdOwnerAddress(args.signer.evmAddress);
-		key = buildBaseEvmFamilyEcdsaKeyIdentity({
-			walletId: args.selected.authority.walletId,
-			ecdsaThresholdKeyId: normalScope.ecdsa_threshold_key_id,
-			signingRootId: normalScope.signing_root_id,
-			signingRootVersion: normalScope.signing_root_version,
-			participantIds: [1, 2],
-			thresholdOwnerAddress
-		});
-		publicFacts = buildVerifiedEcdsaPublicFacts({
-			keyHandle,
-			publicKeyB64u: normalScope.public_identity.threshold_public_key33_b64u,
-			participantIds: [1, 2],
-			thresholdOwnerAddress
-		});
-		relayerKeyId = await computeEcdsaDerivationRoleLocalRelayerKeyId({
-			walletId: String(key.walletId),
-			signingRootId: String(key.signingRootId),
-			signingRootVersion: String(key.signingRootVersion)
-		});
-	} catch (error) {
-		return blocked("invalid_public_facts", error instanceof Error ? error.message : String(error));
-	}
-	if (key.ecdsaThresholdKeyId !== args.holderRuntime.ecdsaThresholdKeyId) return blocked("normal_signing_identity_mismatch");
-	let factorAuthorityRef;
-	try {
-		factorAuthorityRef = await walletAuthAuthorityRef({ authority: args.factorAuthority });
-	} catch (error) {
-		return blocked("authority_identity_mismatch", error instanceof Error ? error.message : String(error));
-	}
-	const runtime = {
-		kind: "active_wallet_authority_ecdsa_runtime_v1",
-		walletId: args.selected.authority.walletId,
-		authorityId: args.selected.authority.authorityId,
-		walletAuthMethodId: args.selected.authMethod.walletAuthMethodId,
-		authorityDigestB64u: args.selected.authority.authorityDigestB64u,
-		factorAuthorityRef,
-		authorityRevocationEpoch: args.selected.authority.revocationEpoch,
-		walletSessionId: args.operationCredential.walletSessionId,
-		operationCredential: args.operationCredential,
-		session: args.session,
-		requiredCapability: args.requiredCapability,
-		materialActivation: args.materialActivation,
-		ecdsaThresholdKeyId: key.ecdsaThresholdKeyId,
-		relayerKeyId,
-		authority: args.selected.authority,
-		authMethod: args.selected.authMethod,
-		holderRuntime: args.holderRuntime,
-		normalSigning,
-		key,
-		publicFacts
-	};
-	if (args.selected.authMethod.kind === "passkey") {
-		const auth = {
-			kind: "passkey",
-			rpId: toRpId(args.selected.authMethod.rpId),
-			credentialIdB64u: args.selected.authMethod.credentialIdB64u
-		};
-		if (!isPasskeyWalletAuthAuthority(args.factorAuthority) || args.factorAuthority.walletId !== key.walletId || args.factorAuthority.bindingId !== args.selected.authMethod.walletAuthMethodId || args.factorAuthority.factor.credentialIdB64u !== auth.credentialIdB64u || String(args.factorAuthority.verifier.rpId) !== String(auth.rpId)) return blocked("authority_identity_mismatch");
-		const resolvedKey = buildResolvedEvmFamilyEcdsaKey({
-			walletId: key.walletId,
-			publicFacts,
-			authBinding: buildPasskeyEcdsaAuthBinding({
-				rpId: auth.rpId,
-				credentialIdB64u: auth.credentialIdB64u
-			})
-		});
-		return {
-			...runtime,
-			auth,
-			factorAuthority: args.factorAuthority,
-			resolvedKey
-		};
-	}
-	if (!isEmailOtpWalletAuthAuthority(args.factorAuthority) || args.factorAuthority.walletId !== key.walletId || args.factorAuthority.bindingId !== args.selected.authMethod.walletAuthMethodId || args.factorAuthority.verifier.emailHashHex !== args.selected.authMethod.emailHashHex) return blocked("authority_identity_mismatch");
-	const auth = {
-		kind: "email_otp",
-		providerSubjectId: String(args.factorAuthority.factor.providerUserId)
-	};
-	return {
-		...runtime,
-		auth,
-		factorAuthority: args.factorAuthority
-	};
-}
-function projectActiveRuntime(args) {
-	if (!args.chainTarget) return null;
-	const lane = {
-		kind: "active_wallet_authority_ecdsa_lane_projection_v1",
-		source: "active_wallet_authority",
-		chainTarget: args.chainTarget,
-		runtime: args.runtime,
-		key: args.runtime.key,
-		materialActivation: args.runtime.materialActivation,
-		publicFacts: args.runtime.publicFacts,
-		state: "deferred",
-		authorizationState: "authorization_required"
-	};
-	if (args.runtime.auth.kind === "passkey") {
-		if (!args.runtime.resolvedKey) return null;
-		return {
-			...lane,
-			auth: args.runtime.auth,
-			resolvedKey: args.runtime.resolvedKey
-		};
-	}
-	return {
-		...lane,
-		auth: args.runtime.auth
-	};
-}
-async function resolveActiveWalletAuthorityEcdsaRuntimeV1(args) {
-	const { input, ports } = args;
-	const requiredCapability = input.requiredCapability || "sign";
-	const nowMs = Math.floor(Number(input.nowMs) || Date.now());
-	let walletId;
-	try {
-		walletId = toWalletId(input.walletId);
-	} catch (error) {
-		return blocked("invalid_selected_authority", error instanceof Error ? error.message : String(error));
-	}
-	let selectedResult;
-	try {
-		selectedResult = await ports.resolveSelectedWalletAuthority(String(walletId));
-	} catch (error) {
-		return blocked("persistence_unavailable", error instanceof Error ? error.message : String(error));
-	}
-	const selected = exactAuthorityResolution(selectedResult);
-	if ("kind" in selected) return selected;
-	const ecdsaActivation = activeAuthorityEcdsaActivation(selected.authority);
-	if (!ecdsaActivation) return blocked("missing_ecdsa_signer");
-	const signer = ecdsaActivation.ecdsa.signer;
-	const materialActivation = ecdsaActivation.ecdsa.materialActivation;
-	if (input.materialActivation && !mpcMaterialActivationRefsEqual(input.materialActivation, materialActivation)) return blocked("authority_identity_mismatch");
-	const linkedMaterial = exactEcdsaSignerMaterial({
-		materials: selected.signerMaterials,
-		authority: selected.authority,
-		authMethod: selected.authMethod,
-		materialActivation
-	});
-	if (!linkedMaterial || !linkedMaterialTargetFactorMatches({
-		material: linkedMaterial,
-		authMethod: selected.authMethod
-	})) return blocked("missing_holder_runtime");
-	if (String(linkedMaterial.publicFacts.ecdsaThresholdKeyId) !== String(linkedMaterial.ecdsaThresholdKeyId)) return blocked("holder_runtime_identity_mismatch");
-	const holderRuntime = exactHolderRuntime({
-		walletId,
-		authority: selected.authority,
-		authMethod: selected.authMethod,
-		materialActivation,
-		ecdsaThresholdKeyId: String(linkedMaterial.ecdsaThresholdKeyId),
-		material: linkedMaterial
-	});
-	if (!holderRuntime) return blocked("holder_runtime_identity_mismatch");
-	let sessionWithCredential;
-	try {
-		sessionWithCredential = await ports.readExactWithOperationCredential({
-			walletId,
-			authorityId: selected.authority.authorityId,
-			authMethodId: selected.authMethod.walletAuthMethodId
-		});
-	} catch (error) {
-		return blocked("persistence_unavailable", error instanceof Error ? error.message : String(error));
-	}
-	switch (sessionWithCredential.kind) {
-		case "found": break;
-		case "missing": return blocked("missing_wallet_session");
-		case "upgrade_required": return blocked("upgrade_required", "Wallet Session authorization requires a newer client");
-	}
-	const session = sessionWithCredential.record;
-	const operationCredential = sessionWithCredential.operationCredential;
-	if (session.expiresAtMs <= nowMs) return blocked("wallet_session_expired");
-	if (session.walletId !== walletId || session.authorityId !== selected.authority.authorityId || session.authMethodId !== selected.authMethod.walletAuthMethodId || session.authorityDigestB64u !== selected.authority.authorityDigestB64u || session.authorityRevocationEpoch !== selected.authority.revocationEpoch || operationCredential.walletSessionId.length === 0 || operationCredential.token.trim().length === 0) return blocked("wallet_session_identity_mismatch");
-	if (!exactSessionCapability({
-		session,
-		capability: requiredCapability,
-		materialActivation
-	})) return blocked("wallet_session_capability_mismatch");
-	const factorAuthority = holderRuntime.factorAuthority;
-	const runtime = await buildActiveRuntime({
-		selected,
-		session,
-		operationCredential,
-		requiredCapability,
-		signer,
-		materialActivation,
-		holderRuntime,
-		factorAuthority
-	});
-	if (runtime.kind !== "active_wallet_authority_ecdsa_runtime_v1") return runtime;
-	return {
-		kind: "resolved",
-		runtime,
-		lane: projectActiveRuntime({
-			runtime,
-			chainTarget: input.chainTarget
-		})
-	};
-}
-//#endregion
-//#region src/core/signingEngine/flows/signEvmFamily/signingFlowRuntime.ts
-function buildActiveWalletAuthorityConfirmationAuthPlan(runtime) {
-	return {
-		kind: "active_wallet_authority",
-		method: runtime.auth.kind,
-		accountId: String(runtime.walletId),
-		intent: "transaction_sign",
-		curve: "ecdsa",
-		walletSessionId: runtime.operationCredential.walletSessionId,
-		authorityId: runtime.authorityId,
-		authMethodId: runtime.walletAuthMethodId,
-		expiresAtMs: runtime.session.expiresAtMs
-	};
-}
-function signerAuthMethodForWalletAuthority(authority) {
-	switch (authority.factor.kind) {
-		case "passkey": return "passkey";
-		case "email_otp": return "email_otp";
-		default:
-			authority.factor;
-			throw new Error("[SigningEngine] unsupported wallet authorization factor");
-	}
-}
-function capabilityMatchesOperationScope(args) {
-	const manifest = args.capability.manifest;
-	return manifest.signer.walletId === args.scope.walletId && mpcMaterialActivationRefsEqual(manifest.activation.materialActivation, args.scope.materialActivation) && manifest.signer.scope.targetMemberships.some((target) => thresholdEcdsaChainTargetsEqual(target, args.scope.chainTarget));
-}
-function sessionAuthorizesCanonicalEcdsaCapability(args) {
-	const materialActivation = args.capability.manifest.activation.materialActivation;
-	return args.session.capabilitySubjects.filter((subject) => subject.kind === "sign" && subject.keyFamily === "ecdsa_secp256k1" && mpcMaterialActivationRefsEqual(subject.materialActivation, materialActivation)).length === 1;
-}
-async function resolveExactEcdsaOperationStepUpSession(args) {
-	if (!capabilityMatchesOperationScope(args)) throw new Error("[SigningEngine] exact ECDSA Wallet Session material changed");
-	const ports = args.ports;
-	const selected = await ports.resolveSelectedWalletAuthority(String(args.scope.walletId));
-	const selectedReason = selectedStepUpAuthorityUnavailableReason(selected, args.scope.walletId);
-	if (selectedReason || selected.kind !== "resolved") throw exactEcdsaWalletSessionUnavailable(selectedReason ?? "selected_authority_invalid");
-	const capabilityAuthority = await walletAuthAuthorityRef({ authority: args.capability.authority });
-	const manifestAuthority = args.capability.manifest.signer.authority;
-	const selectedActivation = selected.authority.signerActivations.ecdsa;
-	if (capabilityAuthority.walletId !== manifestAuthority.walletId || capabilityAuthority.walletAuthMethodId !== manifestAuthority.walletAuthMethodId || capabilityAuthority.authorityDigest !== manifestAuthority.authorityDigest || manifestAuthority.walletId !== selected.authority.walletId || manifestAuthority.walletAuthMethodId !== selected.authMethod.walletAuthMethodId || !selectedActivation || !mpcMaterialActivationRefsEqual(selectedActivation.materialActivation, args.scope.materialActivation)) throw new Error("[SigningEngine] exact ECDSA Wallet Session material changed");
-	const read = await ports.readExactWithOperationCredential({
-		walletId: args.scope.walletId,
-		authorityId: selected.authority.authorityId,
-		authMethodId: selected.authMethod.walletAuthMethodId
-	});
-	if (read.kind !== "found") throw exactEcdsaWalletSessionUnavailable(read.kind === "missing" ? "wallet_session_missing" : "wallet_session_upgrade_required");
-	const session = read.record;
-	const sessionReason = stepUpSessionRecordUnavailableReason({
-		session,
-		operationCredential: read.operationCredential,
-		walletId: args.scope.walletId,
-		authority: selected.authority,
-		authMethod: selected.authMethod,
-		capability: args.capability
-	});
-	if (sessionReason) throw exactEcdsaWalletSessionUnavailable(sessionReason);
-	return {
-		credential: read.operationCredential,
-		expiresAtMs: session.expiresAtMs
-	};
-}
-function exactEcdsaWalletSessionUnavailable(reason) {
-	return /* @__PURE__ */ new Error(`[SigningEngine] exact ECDSA Wallet Session is unavailable: ${reason}`);
-}
-function selectedStepUpAuthorityUnavailableReason(selected, walletId) {
-	if (selected.kind !== "resolved") return selected.kind === "missing_selection" ? "selected_authority_missing" : "selected_authority_invalid";
-	if (selected.selection.walletId !== walletId || selected.authMethod.walletId !== walletId || selected.authority.walletId !== walletId || selected.selection.walletAuthMethodId !== selected.authMethod.walletAuthMethodId || selected.authMethod.walletAuthorityId !== selected.authority.authorityId) return "authority_identity_mismatch";
-	if (selected.selection.lockState !== "unlocked") return "wallet_locked";
-	if (selected.authMethod.status !== "active") return "auth_method_inactive";
-	if (selected.authority.state !== "active") return "authority_inactive";
-	return null;
-}
-function stepUpSessionRecordUnavailableReason(args) {
-	const { session } = args;
-	if (session.walletId !== args.walletId || session.authorityId !== args.authority.authorityId || session.authMethodId !== args.authMethod.walletAuthMethodId) return "wallet_session_identity_mismatch (authority or method)";
-	if (session.authorityDigestB64u !== args.authority.authorityDigestB64u) return "wallet_session_identity_mismatch (authority digest)";
-	if (session.authorityRevocationEpoch !== args.authority.revocationEpoch) return "wallet_session_identity_mismatch (authority revocation epoch)";
-	if (!args.operationCredential.token.trim()) return "wallet_session_identity_mismatch (operation credential)";
-	if (session.expiresAtMs <= Date.now()) return "wallet_session_expired";
-	if (!sessionAuthorizesCanonicalEcdsaCapability({
-		session,
-		capability: args.capability
-	})) return "wallet_session_capability_mismatch";
-	return null;
-}
-async function prepareSessionBoundEcdsaOperationStepUp(sessionScope, input) {
-	const session = await resolveExactEcdsaOperationStepUpSession(sessionScope);
-	return await prepareEvmFamilyEcdsaOperationStepUp({
-		operation: input.operation,
-		operationDigests: input.operationDigests,
-		material: input.material,
-		sessionExpiresAtMs: session.expiresAtMs
-	});
-}
-async function runSerializedEcdsaMaterialUse(args, task) {
-	return await args.deps.withThresholdEcdsaSigningQueue({
-		queueKey: resolveThresholdCommitQueueKey({ materialActivation: args.materialActivation }),
-		walletId: args.walletId,
-		enabled: true,
-		...args.shouldAbort ? { shouldAbort: args.shouldAbort } : {},
-		task
-	});
-}
-function requireEvmFamilyRelayerUrl(deps) {
-	const relayerUrl = String(deps.seamsWebConfigs.network.relayer?.url || "").trim();
-	if (!relayerUrl) throw new Error("[SigningEngine] EVM-family signing requires relayerUrl");
-	return relayerUrl;
-}
-async function resolveCurrentActiveWalletAuthorityRuntime(args) {
-	const current = await resolveActiveWalletAuthorityEcdsaRuntimeV1({
-		ports: args.deps.activeWalletAuthorityEcdsaRuntimeReadPorts,
-		input: {
-			walletId: args.signer.walletId,
-			chainTarget: args.signer.chainTarget,
-			requiredCapability: "sign",
-			materialActivation: args.signer.materialActivation,
-			nowMs: Date.now()
-		}
-	});
-	if (current.kind !== "resolved") throw new Error(`[SigningEngine] active Wallet Authority ECDSA runtime is ${current.reason}`);
-	const runtime = current.runtime;
-	if (runtime.authorityId !== args.prepared.authorityId || runtime.walletAuthMethodId !== args.prepared.walletAuthMethodId || runtime.authorityDigestB64u !== args.prepared.authorityDigestB64u || runtime.authorityRevocationEpoch !== args.prepared.authorityRevocationEpoch || runtime.walletSessionId !== args.prepared.walletSessionId || runtime.publicFacts.keyHandle !== args.signer.keyHandle) throw new Error("[SigningEngine] active Wallet Authority ECDSA runtime was replaced");
-	return runtime;
-}
-/** The wallet's active manifest names the material that may be used right now.
-* When it has moved on from the one this operation was prepared against, the
-* preparation is superseded -- material activation is advance-only, so the
-* prepared side is always the stale one. That is a re-resolution, not a failure
-* and not a request for the wrong material. */
-function ecdsaSigningMaterialSupersession(args) {
-	if (mpcMaterialActivationRefsEqual(args.currentMaterialActivation, args.preparedMaterialActivation)) return null;
-	return {
-		kind: "superseded",
-		supersessionKind: "material_activation_replaced",
-		preparedMaterialActivation: args.preparedMaterialActivation,
-		currentMaterialActivation: args.currentMaterialActivation
-	};
-}
-function ecdsaSigningCapabilitySupersession(args) {
-	const preparedManifest = args.preparedCapability.manifest;
-	const preparedActivation = preparedManifest.activation.materialActivation;
-	const currentActivation = args.currentManifest.activation.materialActivation;
-	const activationSupersession = ecdsaSigningMaterialSupersession({
-		preparedMaterialActivation: preparedActivation,
-		currentMaterialActivation: currentActivation
-	});
-	if (activationSupersession) return activationSupersession;
-	const preparedSigner = preparedManifest.signer;
-	const currentSigner = args.currentManifest.signer;
-	if (String(preparedManifest.identity.manifestId) === String(args.currentManifest.identity.manifestId) && Number(preparedManifest.identity.manifestRevision) === Number(args.currentManifest.identity.manifestRevision) && String(preparedSigner.capability) === String(currentSigner.capability) && String(preparedSigner.authority.walletId) === String(currentSigner.authority.walletId) && String(preparedSigner.authority.authorityDigest) === String(currentSigner.authority.authorityDigest)) return null;
-	return {
-		kind: "superseded",
-		supersessionKind: "capability_authority_replaced",
-		preparedMaterialActivation: preparedActivation,
-		currentMaterialActivation: currentActivation
-	};
-}
-function ecdsaSigningAuthorizationSupersession(args) {
-	const prepared = args.preparedAuthorization;
-	const current = args.currentAuthorization;
-	if (current && prepared.selectedAuthority.authorityId === current.selectedAuthority.authorityId && prepared.selectedAuthMethod.kind === current.selectedAuthMethod.kind && prepared.selectedAuthMethod.walletAuthMethodId === current.selectedAuthMethod.walletAuthMethodId && prepared.session.walletId === current.session.walletId && prepared.session.authorityId === current.session.authorityId && prepared.session.authMethodId === current.session.authMethodId && prepared.session.authorizationId === current.session.authorizationId && prepared.session.quotaId === current.session.quotaId && (prepared.session.authorityDigestB64u === current.session.authorityDigestB64u || isEd25519ExtensionOfEcdsaWalletAuthority(prepared.selectedAuthority, current.selectedAuthority) && walletSessionPreservesCapabilities(prepared.session, current.session)) && prepared.session.issuedAtMs === current.session.issuedAtMs && prepared.session.expiresAtMs === current.session.expiresAtMs && prepared.session.authorityRevocationEpoch === current.session.authorityRevocationEpoch && prepared.operationCredential.walletSessionId === current.operationCredential.walletSessionId && prepared.operationCredential.token === current.operationCredential.token && exactEcdsaWalletSessionRuntimesMatch(prepared.runtime, current.runtime) && mpcMaterialActivationRefsEqual(current.runtime.materialActivation, args.materialActivation)) return null;
-	return {
-		kind: "superseded",
-		supersessionKind: "reusable_authorization_replaced",
-		preparedMaterialActivation: args.materialActivation,
-		currentMaterialActivation: args.materialActivation
-	};
-}
-async function resolveEcdsaSigningMaterialHydrationPlan(args) {
-	const activeRuntimeResolution = await resolveExactEcdsaCapabilityRuntime({
-		manifest: args.capability.manifest,
-		chainTarget: args.chainTarget,
-		relayerUrl: args.relayerUrl
-	});
-	if (activeRuntimeResolution.kind !== "resolved") return {
-		kind: "failed",
-		failure: {
-			kind: "unavailable",
-			reason: "runtime_correlation_mismatch"
-		}
-	};
-	const superseded = ecdsaSigningCapabilitySupersession({
-		preparedCapability: args.capability,
-		currentManifest: activeRuntimeResolution.manifest
-	});
-	if (superseded) return {
-		kind: "superseded",
-		replacement: superseded
-	};
-	if (args.preparedAuthorization) {
-		const authorizationSupersession = ecdsaSigningAuthorizationSupersession({
-			preparedAuthorization: args.preparedAuthorization,
-			currentAuthorization: args.currentAuthorization,
-			materialActivation: args.materialActivation
-		});
-		if (authorizationSupersession) return {
-			kind: "superseded",
-			replacement: authorizationSupersession
-		};
-	}
-	const resolution = await resolveHydratedSecp256k1SigningMaterial({
-		capability: args.capability,
-		runtime: activeRuntimeResolution.runtime,
-		chainTarget: args.chainTarget,
-		materialActivation: args.materialActivation,
-		workerCtx: args.workerCtx
-	});
-	if (resolution.kind === "unavailable") return {
-		kind: "failed",
-		failure: resolution
-	};
-	if (!args.preparedAuthorization) return {
-		kind: "authorization_required",
-		requirement: {
-			kind: "material_for_step_up",
-			material: resolution.material
-		}
-	};
-	if (!args.currentAuthorization) return {
-		kind: "superseded",
-		replacement: {
-			kind: "superseded",
-			supersessionKind: "reusable_authorization_replaced",
-			preparedMaterialActivation: args.materialActivation,
-			currentMaterialActivation: args.materialActivation
-		}
-	};
-	return {
-		kind: "ready",
-		value: {
-			kind: "material_from_canonical_capability",
-			material: attachExactEcdsaWalletSessionAuthorization({
-				material: resolution.material,
-				capability: args.capability,
-				authorization: args.currentAuthorization,
-				nowMs: Date.now()
-			})
-		}
-	};
-}
-async function createEvmFamilySigningFlowRuntime(args) {
-	const [Secp256k1Engine, WebAuthnP256Engine] = await Promise.all([loadSecp256k1EngineCtor(), loadWebAuthnP256EngineCtor()]);
-	const workerCtx = args.deps.getSignerWorkerContext();
-	const ctx = args.deps.touchConfirm.getContext();
-	const walletId = toWalletId(args.walletSession.walletId);
-	const relayerUrl = requireEvmFamilyRelayerUrl(args.deps);
-	const resolvedSigner = args.senderSignatureAlgorithm === "secp256k1" ? requireEvmFamilyEcdsaSigner(args.preparedSession.kind === "authorized" ? args.preparedSession.signingLane.identity : args.preparedSession.identity, "ECDSA signing material hydration") : void 0;
-	if (args.activeWalletAuthority && !resolvedSigner) throw new Error("[SigningEngine] active Wallet Authority runtime requires a threshold ECDSA signer");
-	const capability = resolvedSigner && !args.activeWalletAuthority ? await args.deps.resolveCanonicalEcdsaSigningCapability({
-		walletId: resolvedSigner.walletId,
-		chainTarget: resolvedSigner.chainTarget,
-		materialActivation: resolvedSigner.materialActivation
-	}) : void 0;
-	const preparedAuthorization = args.preparedSession?.kind === "authorized" ? args.preparedSession.selection.lane.authorization : null;
-	const activeAuthorization = capability && preparedAuthorization && preparedAuthorization.runtime.remainingUses > 0 && exactAuthorizationMatchesCapability({
-		capability,
-		authorization: preparedAuthorization,
-		nowMs: Date.now()
-	}) ? preparedAuthorization : null;
-	const exactOperationCredentialScope = resolvedSigner && capability && !args.activeWalletAuthority ? {
-		walletId: resolvedSigner.walletId,
-		chainTarget: resolvedSigner.chainTarget,
-		materialActivation: resolvedSigner.materialActivation
-	} : void 0;
-	const thresholdEcdsaStepUpRuntime = !args.activeWalletAuthority && capability && exactOperationCredentialScope ? {
-		...args.emailOtpSigningForFlow ? { emailOtpSigning: args.emailOtpSigningForFlow } : {},
-		reusableAuthorization: activeAuthorization ? { kind: "active" } : {
-			kind: "absent",
-			requiredFactor: signerAuthMethodForWalletAuthority(capability.authority)
-		},
-		operationStepUp: {
-			prepare: prepareSessionBoundEcdsaOperationStepUp.bind(void 0, {
-				ports: args.deps.activeWalletAuthorityEcdsaRuntimeReadPorts,
-				scope: exactOperationCredentialScope,
-				capability
-			}),
-			authorize: async ({ authorization, prepared, material }) => {
-				args.onAuthSideEffectStarted?.(authorization.kind === "passkey" ? "passkey_reauth" : "email_otp_challenge");
-				const session = await resolveExactEcdsaOperationStepUpSession({
-					ports: args.deps.activeWalletAuthorityEcdsaRuntimeReadPorts,
-					scope: exactOperationCredentialScope,
-					capability
-				});
-				return await authorizeEvmFamilyEcdsaOperationStepUp({
-					relayerUrl,
-					authority: capability.authority,
-					authorization,
-					prepared,
-					material,
-					walletSessionToken: session.credential.token
-				});
-			}
-		},
-		...args.onAuthSideEffectStarted ? { onAuthSideEffectStarted: args.onAuthSideEffectStarted } : {}
-	} : void 0;
-	const secp256k1Engine = new Secp256k1Engine({
-		beforeSigning: args.deps.beforeSigning,
-		getRpId: () => ctx.touchIdPrompt.getRpId(),
-		workerCtx,
-		shouldAbort: args.shouldAbort
-	});
-	const activeWalletAuthority = args.activeWalletAuthority;
-	const activeWalletAuthorityAuthorization = activeWalletAuthority && resolvedSigner ? {
-		kind: "active_wallet_authority",
-		confirmationAuthPlan: activeWalletAuthority.confirmationAuthPlan,
-		sign: async (input) => {
-			if (String(activeWalletAuthority.intent.operationId) !== input.operationId) throw new Error("[SigningEngine] active Wallet Authority signing operation identity changed");
-			return await runSerializedEcdsaMaterialUse({
-				deps: args.deps,
-				walletId: resolvedSigner.walletId,
-				materialActivation: resolvedSigner.materialActivation,
-				...args.shouldAbort ? { shouldAbort: args.shouldAbort } : {}
-			}, async () => {
-				const readyMaterial = buildActiveWalletAuthorityReadySecp256k1Material({
-					authorityRuntime: await resolveCurrentActiveWalletAuthorityRuntime({
-						deps: args.deps,
-						prepared: activeWalletAuthority.runtime,
-						signer: resolvedSigner
-					}),
-					chainTarget: resolvedSigner.chainTarget,
-					relayerUrl
-				});
-				return await secp256k1Engine.signReady({
-					kind: "digest",
-					algorithm: "secp256k1",
-					digest32: input.signingDigest32
-				}, readyMaterial, {
-					intent: activeWalletAuthority.intent,
-					authPlan: activeWalletAuthority.confirmationAuthPlan
-				}, input.operationDigests);
-			});
-		}
-	} : void 0;
-	return { flowArgs: {
-		ctx,
-		touchConfirm: args.deps.touchConfirm,
-		workerCtx,
-		walletId,
-		onEvent: args.onEvent,
-		engines: {
-			secp256k1: secp256k1Engine,
-			webauthnP256: new WebAuthnP256Engine(workerCtx, args.deps.beforeSigning)
-		},
-		...resolvedSigner && capability ? {
-			runEcdsaMaterialUse: runSerializedEcdsaMaterialUse.bind(null, {
-				deps: args.deps,
-				walletId: resolvedSigner.walletId,
-				materialActivation: resolvedSigner.materialActivation,
-				...args.shouldAbort ? { shouldAbort: args.shouldAbort } : {}
-			}),
-			resolveEcdsaSigningMaterialPlan: async () => await resolveEcdsaSigningMaterialHydrationPlan({
-				capability,
-				preparedAuthorization: activeAuthorization,
-				currentAuthorization: activeAuthorization ? await args.deps.resolveActiveEcdsaWalletSessionAuthorization({
-					walletId: resolvedSigner.walletId,
-					chainTarget: resolvedSigner.chainTarget,
-					materialActivation: resolvedSigner.materialActivation
-				}) : null,
-				walletId: resolvedSigner.walletId,
-				chainTarget: resolvedSigner.chainTarget,
-				materialActivation: resolvedSigner.materialActivation,
-				relayerUrl,
-				workerCtx
-			})
-		} : {},
-		...activeWalletAuthorityAuthorization ? { authorization: activeWalletAuthorityAuthorization } : {},
-		...args.signingSessionPlan ? { signingSessionPlan: args.signingSessionPlan } : {},
-		...args.signingOperation ? { signingOperation: args.signingOperation } : {},
-		onSigningOperationTransition: args.onSigningOperationTransition || emitEvmFamilySigningOperationTrace,
-		...thresholdEcdsaStepUpRuntime ? { thresholdEcdsaStepUpRuntime } : {},
-		confirmationConfigOverride: args.confirmationConfigOverride
-	} };
-}
-//#endregion
-//#region src/core/signingEngine/flows/signEvmFamily/freshAuthRetryPolicy.ts
-function ownerOperationAuthorizationDecisionFromError(error) {
-	return error instanceof WalletSessionQuotaAdmissionError ? error.authorizationDecision : void 0;
-}
-async function runEvmFamilyFreshAuthRetry(args) {
-	switch (args.decision.retryMode) {
-		case "await_admission_owner_completion": return await args.signingSessionCoordinator.runWalletSessionQuotaAdmissionRetry({
-			queueKey: args.queueKey,
-			refresh: args.rereadAuthoritativeReadiness,
-			retryAfterRefresh: args.rereadAuthoritativeReadiness
-		});
-		case "email_otp_single_operation_step_up":
-		case "fresh_auth": return await args.signingSessionCoordinator.runWalletSessionQuotaAdmissionRetry({
-			queueKey: args.queueKey,
-			refresh: args.performFreshAuth,
-			retryAfterRefresh: args.rereadAuthoritativeReadiness
-		});
-		default: return assertNeverEvmFamilyFreshAuthRetryMode(args.decision);
-	}
-}
-function assertNeverEvmFamilyFreshAuthRetryMode(value) {
-	throw new Error(`[SigningEngine][ecdsa] unsupported fresh-auth retry mode: ${String(value)}`);
-}
-function buildBlockedEvmFamilyFreshAuthRetryDecision(args) {
-	return {
-		kind: "do_not_retry",
-		trigger: args.trigger,
-		sideEffectState: args.sideEffectState,
-		blockedReason: args.blockedReason
-	};
-}
-function blockEvmFamilyFreshAuthRetry(args, blockedReason) {
-	return buildBlockedEvmFamilyFreshAuthRetryDecision({
-		trigger: args.trigger,
-		sideEffectState: args.sideEffectState,
-		blockedReason
-	});
-}
-function nextEvmFamilyFreshAuthRetrySideEffectState(args) {
-	if (args.current === "threshold_reconnect_started") return args.current;
-	switch (args.sideEffect) {
-		case "auth_prompt_shown":
-		case "email_otp_challenge":
-		case "passkey_reauth": return args.current === "no_auth_side_effect_started" ? "auth_prompt_shown" : args.current;
-		case "auth_confirmed": return "auth_confirmed";
-		case "threshold_reconnect": return "threshold_reconnect_started";
-	}
-}
-function classifyEvmFamilyFreshAuthRetry(args) {
-	if (args.alreadyRetryingFreshAuth) return blockEvmFamilyFreshAuthRetry(args, "already_retrying");
-	if (args.senderSignatureAlgorithm !== "secp256k1") return blockEvmFamilyFreshAuthRetry(args, "non_secp256k1_sender");
-	const ownerDecision = ownerOperationAuthorizationDecisionFromError(args.error);
-	const admissionFailure = classifyWalletSessionQuotaAdmissionFailure(args.error);
-	const admissionDecision = args.trigger === "wallet_signing_budget_exhausted" ? ownerDecision?.kind === "step_up_required" ? decideWalletSessionQuotaAdmissionFailure(admissionFailure ?? {
-		kind: "exhausted",
-		source: "server_prepare",
-		detail: "Server requires owner operation step-up"
-	}) : admissionFailure?.kind === "in_flight" ? decideWalletSessionQuotaAdmissionFailure(admissionFailure) : null : null;
-	const admissionCanRetryAfterSideEffect = admissionDecision?.kind === "request_fresh_step_up" || admissionDecision?.kind === "wait_and_retry_admission";
-	if (args.sideEffectState !== "no_auth_side_effect_started" && !admissionCanRetryAfterSideEffect) return blockEvmFamilyFreshAuthRetry(args, "auth_side_effect_started");
-	if (args.trigger === "wallet_session_reauthorization_required") {
-		if (args.hasEmailOtpSigningPlan || args.hasStepUpAuthPlan) return blockEvmFamilyFreshAuthRetry(args, "signing_auth_plan_already_selected");
-		if (ownerDecision?.kind !== "step_up_required") return blockEvmFamilyFreshAuthRetry(args, "error_not_retryable");
-		if (args.accountAuth.primaryAuthMethod !== SIGNER_AUTH_METHODS.emailOtp && args.accountAuth.primaryAuthMethod !== SIGNER_AUTH_METHODS.passkey) return blockEvmFamilyFreshAuthRetry(args, "unsupported_primary_auth");
-	} else {
-		if (!admissionDecision) return blockEvmFamilyFreshAuthRetry(args, "error_not_retryable");
-		if (args.hasStepUpAuthPlan && admissionDecision.kind !== "request_fresh_step_up" && admissionDecision.kind !== "wait_and_retry_admission") return blockEvmFamilyFreshAuthRetry(args, "step_up_auth_plan_already_selected");
-		if (admissionDecision.kind === "wait_and_retry_admission") {
-			if (args.admissionRetryState.kind === "authoritative_readiness_reread") return blockEvmFamilyFreshAuthRetry(args, "authoritative_readiness_still_in_flight");
-			return {
-				kind: "retry",
-				trigger: args.trigger,
-				sideEffectState: args.sideEffectState,
-				retryMode: "await_admission_owner_completion",
-				admissionDecision
-			};
-		}
-		if (args.activeSigningAuthMethod === SIGNER_AUTH_METHODS.emailOtp) return {
-			kind: "retry",
-			trigger: args.trigger,
-			sideEffectState: args.sideEffectState,
-			retryMode: "email_otp_single_operation_step_up",
-			admissionDecision
-		};
-	}
-	return {
-		kind: "retry",
-		trigger: args.trigger,
-		sideEffectState: args.sideEffectState,
-		retryMode: "fresh_auth"
-	};
-}
-//#endregion
-//#region src/core/signingEngine/flows/signEvmFamily/freshWalletSessionRetry.ts
-function resolveEvmFamilyWalletSessionExpiryContext(args) {
-	if (walletSessionFailureFromError(args.error)?.kind !== "expired") return { kind: "not_expired" };
-	if (args.candidate.kind === "unavailable") return { kind: "expired_without_exact_lane" };
-	return {
-		kind: "authoritative_expiry",
-		state: requireAuthoritativeExpiredWalletSessionAuthorizationBoundary({
-			source: {
-				kind: "ecdsa",
-				laneIdentity: args.candidate.identity,
-				authorization: args.candidate.authorization
-			},
-			expiresAtMs: args.candidate.expiresAtMs,
-			detectedAtMs: args.detectedAtMs
-		})
-	};
-}
-async function invalidateAuthoritativeEvmFamilyWalletSessionExpiry(args) {
-	switch (args.context.kind) {
-		case "not_expired":
-		case "expired_without_exact_lane": return;
-		case "authoritative_expiry":
-			if ((await args.coordinator.invalidateExpiredWalletSession({
-				state: args.context.state,
-				source: SIGNING_SESSION_EXPIRY_DETECTION_SOURCES.serverRejection
-			})).kind === "unavailable") throw new Error("[SigningEngine][ecdsa] expired Wallet Session cleanup failed");
-			return;
-		default: return assertNeverEvmFamilyWalletSessionExpiryContext(args.context);
-	}
-}
-function assertNeverEvmFamilyWalletSessionExpiryContext(value) {
-	throw new Error(`[SigningEngine][ecdsa] unsupported Wallet Session expiry context: ${String(value)}`);
-}
-async function retryEvmFamilyWithFreshWalletSessionAuthWhenRequired(args) {
-	const decision = classifyEvmFamilyFreshAuthRetry({
-		trigger: "wallet_session_reauthorization_required",
-		error: args.error,
-		senderSignatureAlgorithm: args.senderSignatureAlgorithm,
-		accountAuth: args.accountAuth,
-		alreadyRetryingFreshAuth: args.alreadyRetryingFreshEmailOtpAuth,
-		hasEmailOtpSigningPlan: args.hasEmailOtpSigningPlan,
-		sideEffectState: args.sideEffectState
-	});
-	args.onDecision?.(decision);
-	if (decision.kind !== "retry") return null;
-	await invalidateAuthoritativeEvmFamilyWalletSessionExpiry({
-		context: args.expiryContext,
-		coordinator: args.signingSessionCoordinator
-	});
-	const emailOtp = args.accountAuth.primaryAuthMethod === SIGNER_AUTH_METHODS.emailOtp;
-	emitEvmFamilySigningEvent(args.onEvent, {
-		phase: emailOtp ? SigningEventPhase.STEP_06_AUTH_EMAIL_OTP_CHALLENGE_STARTED : SigningEventPhase.STEP_09_THRESHOLD_SESSION_RECONNECT_STARTED,
-		status: "running",
-		walletId: args.walletId,
-		message: emailOtp ? "Signing session expired; requesting Email OTP reauthorization" : "Signing session expired; requesting passkey reauthorization",
-		interaction: {
-			kind: "none",
-			overlay: "none"
-		},
-		data: {
-			chain: args.chain,
-			reason: "threshold_session_expired"
-		}
-	});
-	return await args.retry();
-}
-//#endregion
-//#region src/core/signingEngine/flows/signEvmFamily/operationIds.ts
-function createEvmFamilySigningOperationId() {
-	const randomId = secureRandomBase64Url(32, "EVM family signing operation IDs");
-	return SigningSessionIds.signingOperation(`evm-family-sign:${randomId}`);
-}
-function createEvmFamilySigningOperationIds(providedOperationId) {
-	if (providedOperationId) return {
-		planningOperationId: providedOperationId,
-		confirmationOperationId: providedOperationId,
-		callerProvided: true
-	};
-	return {
-		planningOperationId: createEvmFamilySigningOperationId(),
-		callerProvided: false
-	};
-}
-function ensureEvmFamilyConfirmationOperationId(operationIds) {
-	operationIds.confirmationOperationId = operationIds.confirmationOperationId || createEvmFamilySigningOperationId();
-	return operationIds.confirmationOperationId;
-}
-function bindEvmFamilyCallerProvidedOperationIdToFingerprint(operationIds, operationFingerprint, binder) {
-	if (!operationIds.callerProvided) return;
-	binder.bindCallerProvidedOperationIdToFingerprint({
-		operationId: operationIds.planningOperationId,
-		operationFingerprint
-	});
-}
-//#endregion
-//#region src/core/signingEngine/flows/signEvmFamily/executorThresholdState.ts
-function resolvePreparedEvmFamilyThresholdOwnerAddress(args) {
-	switch (args.publicIdentityContinuity.kind) {
-		case "lane_identity_only": return args.laneThresholdOwnerAddress;
-		case "verified_material_identity":
-			if (args.publicIdentityContinuity.verifiedMaterialThresholdOwnerAddress !== args.laneThresholdOwnerAddress) throw new Error("[SigningEngine][ecdsa] prepared material owner address does not match the exact signing lane");
-			return args.laneThresholdOwnerAddress;
-		default:
-			args.publicIdentityContinuity;
-			throw new Error("[SigningEngine][ecdsa] unsupported prepared public identity state");
-	}
-}
-function buildPreparedEvmFamilyExecutorThresholdEcdsaState(args) {
-	return {
-		kind: "prepared",
-		thresholdOwnerAddress: resolvePreparedEvmFamilyThresholdOwnerAddress(args)
-	};
-}
-//#endregion
-//#region src/core/signingEngine/flows/signEvmFamily/signEvmFamily.ts
-var signEvmFamily_exports = /* @__PURE__ */ __exportAll({
-	reconcileEvmFamilyNonceLane: () => reconcileEvmFamilyNonceLane,
-	reconcileTempoNonceLane: () => reconcileTempoNonceLane,
-	reportEvmFamilyBroadcastAccepted: () => reportEvmFamilyBroadcastAccepted,
-	reportEvmFamilyBroadcastRejected: () => reportEvmFamilyBroadcastRejected,
-	reportEvmFamilyDroppedOrReplaced: () => reportEvmFamilyDroppedOrReplaced,
-	reportEvmFamilyFinalized: () => reportEvmFamilyFinalized,
-	reportTempoBroadcastAccepted: () => reportTempoBroadcastAccepted,
-	reportTempoBroadcastRejected: () => reportTempoBroadcastRejected,
-	reportTempoDroppedOrReplaced: () => reportTempoDroppedOrReplaced,
-	reportTempoFinalized: () => reportTempoFinalized,
-	signEvmFamily: () => signEvmFamily
-});
-function evmFamilyWalletSessionExpiryCandidate(args) {
-	if (!args.prepared || args.prepared.kind !== "authorized") return { kind: "unavailable" };
-	return {
-		kind: "exact_ecdsa_lane",
-		identity: exactEcdsaSigningLaneIdentityFromSelectedLane(args.prepared.signingLane),
-		authorization: args.prepared.signingLane.authorization,
-		expiresAtMs: args.prepared.signingLane.authorization.session.expiresAtMs
-	};
-}
-function ecdsaOperationAuthorizationQueueKey(args) {
-	const authorizationId = args.prepared.signingLane.authorization.session.authorizationId;
-	return buildOperationAuthorizationQueueKey({
-		walletId: args.walletId,
-		materialActivationId: args.prepared.signingLane.materialActivation.activationId,
-		authorizationId,
-		authorityKey: signingLaneAuthBindingKey(args.prepared.signingLane.auth),
-		targetKey: thresholdEcdsaChainTargetKey(args.prepared.signingLane.chainTarget)
-	});
-}
-function activeWalletAuthorityFlowRuntimeFromPrepared(prepared) {
-	if (prepared.kind !== "authorization_required" || prepared.candidate.source !== "active_wallet_authority") return null;
-	const confirmationAuthPlan = buildActiveWalletAuthorityConfirmationAuthPlan(prepared.candidate.runtime);
-	return {
-		runtime: prepared.candidate.runtime,
-		intent: prepared.intent,
-		confirmationAuthPlan
-	};
-}
-function buildEvmFamilyPreparationDisplayModel(args) {
-	const title = args.chainTarget.kind === "tempo" ? "Sign Tempo Transaction" : "Sign EVM Transaction";
-	const displayArgs = {
-		request: args.request,
-		signerAccount: String(args.walletSession.walletId),
-		title,
-		subtitle: ""
-	};
-	if (args.request.kind === "eip1559") return buildEvmDisplayModel({
-		...displayArgs,
-		request: args.request
-	});
-	return buildTempoDisplayModel({
-		...displayArgs,
-		request: args.request
-	});
-}
-async function executeEvmFamilyFreshAuthRetry(args) {
-	const rereadAuthoritativeReadiness = signEvmFamilyAttempt.bind(null, args.deps, args.signingArgs, {
-		admissionRetryState: { kind: "authoritative_readiness_reread" },
-		forceFreshAuth: false,
-		operationIds: args.operationIds,
-		retryingFreshAuth: args.retryingFreshAuth,
-		signingSessionCoordinator: args.signingSessionCoordinator
-	});
-	const performFreshAuth = signEvmFamilyAttempt.bind(null, args.deps, args.signingArgs, {
-		admissionRetryState: { kind: "initial_admission" },
-		forceFreshAuth: true,
-		operationIds: args.operationIds,
-		retryingFreshAuth: true,
-		signingSessionCoordinator: args.signingSessionCoordinator
-	});
-	return await runEvmFamilyFreshAuthRetry({
-		decision: args.decision,
-		queueKey: args.queueKey,
-		signingSessionCoordinator: args.signingSessionCoordinator,
-		rereadAuthoritativeReadiness,
-		performFreshAuth
-	});
-}
-function emitEvmFamilyFreshAuthRetryEvent(args) {
-	const isEmailOtp = args.accountAuth.primaryAuthMethod === SIGNER_AUTH_METHODS.emailOtp;
-	emitEvmFamilySigningEvent(args.onEvent, {
-		phase: isEmailOtp ? SigningEventPhase.STEP_06_AUTH_EMAIL_OTP_CHALLENGE_STARTED : SigningEventPhase.STEP_09_THRESHOLD_SESSION_RECONNECT_STARTED,
-		status: "running",
-		walletId: args.walletId,
-		message: isEmailOtp ? "Signing session needs reauthorization; requesting Email OTP" : "Signing session needs reauthorization; requesting passkey",
-		interaction: {
-			kind: "none",
-			overlay: "none"
-		},
-		data: {
-			chain: args.chain,
-			reason: "wallet_signing_budget_reserved"
-		}
-	});
-}
-async function signEvmFamily(deps, args) {
-	const admission = reviewAdmissionForBinding(deps.touchConfirm.getContext().surfaceMeasurementBinding);
-	if (admission) {
-		admission.assertPending();
-		deps = {
-			...deps,
-			beforeSigning: admission.beforeSigning
-		};
-	}
-	const attempt = {
-		admissionRetryState: { kind: "initial_admission" },
-		operationIds: createEvmFamilySigningOperationIds(args.signingOperationId)
-	};
-	await deps.touchConfirm.openTransactionPreparationModal({
-		chain: "evm_family",
-		walletLabel: String(args.walletSession.walletId),
-		model: buildEvmFamilyPreparationDisplayModel(args),
-		confirmationConfigOverride: args.confirmationConfigOverride
-	});
-	try {
-		return await signEvmFamilyAttempt(deps, args, attempt);
-	} finally {
-		deps.touchConfirm.closeTransactionPreparationModal();
-	}
-}
-async function signEvmFamilyAttempt(deps, args, attempt) {
-	throwIfEvmFamilySigningCancelled(args.shouldAbort);
-	const walletId = toWalletId(args.walletSession.walletId);
-	const signingTarget = evmFamilySigningTargetFromExplicitTarget({
-		request: args.request,
-		chainTarget: args.chainTarget
-	});
-	await ensureSealedRefreshStartupParityForTransactionSigning(deps.ensureSealedRefreshStartupParity, {
-		walletId,
-		chainTarget: signingTarget
-	});
-	const requestChain = signingTarget.kind;
-	const requestChainTarget = signingTarget;
-	let accountAuth;
-	let ecdsaSigningLane;
-	let selectedEcdsaAuthMethod;
-	let preparedEcdsaSigningSession;
-	let activeWalletAuthorityFlowRuntime;
-	const ecdsaAttemptDiagnostics = {
-		walletId,
-		chain: requestChain,
-		chainTarget: requestChainTarget,
-		senderSignatureAlgorithm: args.request.senderSignatureAlgorithm
-	};
-	const signingSessionCoordinator = attempt.signingSessionCoordinator || deps.signingSessionCoordinator;
-	if (!signingSessionCoordinator) throw new Error("[SigningEngine][ecdsa] production signing session coordinator is required");
-	const operationIds = attempt.operationIds || createEvmFamilySigningOperationIds(args.signingOperationId);
-	const operationFingerprint = await computeSigningOperationFingerprint({
-		kind: `evm-family:${requestChain}`,
-		payload: {
-			walletId,
-			chainTarget: requestChainTarget,
-			request: args.request
-		}
-	});
-	const operationFingerprintDigest = parseSigningOperationFingerprintDigest(operationFingerprint);
-	bindEvmFamilyCallerProvidedOperationIdToFingerprint(operationIds, operationFingerprint, signingSessionCoordinator);
-	const ensureConfirmationOperationId = () => ensureEvmFamilyConfirmationOperationId(operationIds);
-	const createTransactionSigningOperation = () => ({
-		operationId: ensureConfirmationOperationId(),
-		operationFingerprint,
-		intent: SigningOperationIntent.TransactionSign
-	});
-	const derivePreparedEvmFamilyKeyFingerprint = (_prepared) => void 0;
-	let freshAuthRetrySideEffectState = "no_auth_side_effect_started";
-	const markFreshAuthRetrySideEffect = (sideEffect) => {
-		freshAuthRetrySideEffectState = nextEvmFamilyFreshAuthRetrySideEffectState({
-			current: freshAuthRetrySideEffectState,
-			sideEffect
-		});
-	};
-	const recordFreshAuthRetryDecision = (decision, error) => {
-		const errorMessage = error instanceof Error ? error.message : String(error || "unknown error");
-		ecdsaAttemptDiagnostics.freshAuthRetry = {
-			decision,
-			sideEffectState: freshAuthRetrySideEffectState,
-			errorMessage
-		};
-		emitSigningSessionFlowTrace("evm-family", {
-			stage: "fresh_auth_retry.decision",
-			walletId,
-			chain: requestChain,
-			chainTarget: requestChainTarget,
-			decision,
-			sideEffectState: freshAuthRetrySideEffectState,
-			errorMessage
-		});
-	};
-	const markConfirmationDisplayed = () => {
-		markFreshAuthRetrySideEffect("auth_prompt_shown");
-		return ensureConfirmationOperationId();
-	};
-	if (args.request.senderSignatureAlgorithm === "secp256k1") {
-		preparedEcdsaSigningSession = await prepareEvmFamilyEcdsaSigningSession({
-			deps,
-			walletSession: args.walletSession,
-			signingTarget,
-			signingOperation: createTransactionSigningOperation(),
-			diagnostics: ecdsaAttemptDiagnostics,
-			signingSessionCoordinator,
-			forceFreshAuth: attempt.forceFreshAuth === true
-		});
-		activeWalletAuthorityFlowRuntime = activeWalletAuthorityFlowRuntimeFromPrepared(preparedEcdsaSigningSession) ?? void 0;
-		ecdsaSigningLane = preparedEcdsaSigningSession.kind === "authorized" ? preparedEcdsaSigningSession.signingLane : void 0;
-		selectedEcdsaAuthMethod = preparedEcdsaSigningSession.authMethod;
-		accountAuth = preparedEcdsaSigningSession.kind === "authorized" ? preparedEcdsaSigningSession.accountAuth : await resolveEvmFamilyTransactionWalletAuth({
-			senderSignatureAlgorithm: "secp256k1",
-			signerAuthMethod: preparedEcdsaSigningSession.authMethod
-		});
-		emitSigningSessionFlowTrace("evm-family", {
-			stage: "ecdsa_attempt.prepared",
-			walletId,
-			chain: requestChain,
-			chainTarget: requestChainTarget,
-			...derivePreparedEvmFamilyKeyFingerprint(preparedEcdsaSigningSession) ? { evmFamilyKeyFingerprint: derivePreparedEvmFamilyKeyFingerprint(preparedEcdsaSigningSession) } : {},
-			authorizationState: preparedEcdsaSigningSession.kind,
-			authMethod: selectedEcdsaAuthMethod,
-			lane: summarizeEvmFamilyEcdsaLane(ecdsaSigningLane)
-		});
-	} else accountAuth = await resolveEvmFamilyTransactionWalletAuth({ senderSignatureAlgorithm: args.request.senderSignatureAlgorithm });
-	const resolvedAccountAuth = accountAuth;
-	throwIfEvmFamilySigningCancelled(args.shouldAbort);
-	const requestEmailOtpTransactionSigningChallenge = deps.requestEmailOtpTransactionSigningChallenge;
-	const authPlanningArgsBase = {
-		confirmedDeps: {
-			...deps,
-			requestEmailOtpTransactionSigningChallenge
-		},
-		walletSession: args.walletSession,
-		chain: requestChain,
-		accountAuth: resolvedAccountAuth,
-		operationFingerprintDigest,
-		onEvent: args.onEvent
-	};
-	const getPreparedEcdsaSigningSession = () => {
-		if (preparedEcdsaSigningSession) return preparedEcdsaSigningSession;
-		throw new Error("[SigningEngine][ecdsa] prepared signing session is required");
-	};
-	const getPreparedEcdsaSigningSessionIfEcdsa = () => args.request.senderSignatureAlgorithm === "secp256k1" ? getPreparedEcdsaSigningSession() : void 0;
-	const reResolveSupersededPreparation = async (error) => {
-		if (!isEvmFamilyEcdsaMaterialSupersededError(error)) return null;
-		if (attempt.reResolvedAfterSupersession) return null;
-		emitSigningSessionFlowTrace("evm-family", {
-			stage: "ecdsa_attempt.material_superseded",
-			walletId,
-			chain: requestChain,
-			chainTarget: requestChainTarget,
-			supersessionKind: error.superseded.supersessionKind,
-			preparedMaterialActivationId: String(error.superseded.preparedMaterialActivation.activationId),
-			currentMaterialActivationId: String(error.superseded.currentMaterialActivation.activationId)
-		});
-		return await signEvmFamilyAttempt(deps, args, {
-			admissionRetryState: { kind: "initial_admission" },
-			operationIds,
-			signingSessionCoordinator,
-			reResolvedAfterSupersession: true,
-			...attempt.retryingFreshAuth ? { retryingFreshAuth: true } : {}
-		});
-	};
-	const resolveAuthPlanningResult = async () => args.request.senderSignatureAlgorithm === "secp256k1" ? await (async () => {
-		const prepared = getPreparedEcdsaSigningSession();
-		if (activeWalletAuthorityFlowRuntime) return { signingAuthPlan: activeWalletAuthorityFlowRuntime.confirmationAuthPlan };
-		return prepared.kind === "authorized" ? await resolveEvmFamilyTransactionStepUp({
-			...authPlanningArgsBase,
-			chainTarget: signingTarget,
-			senderSignatureAlgorithm: "secp256k1",
-			ecdsaAuthorization: "reusable_wallet_session",
-			preparedOperation: prepared.preparedOperation
-		}) : await (async () => {
-			const signer = requireEvmFamilyEcdsaSigner(prepared.identity, "auth-neutral ECDSA step-up planning");
-			const capability = await deps.resolveCanonicalEcdsaSigningCapability({
-				walletId: signer.walletId,
-				chainTarget: signer.chainTarget,
-				materialActivation: signer.materialActivation
-			});
-			return await resolveEvmFamilyTransactionStepUp({
-				...authPlanningArgsBase,
-				chainTarget: signingTarget,
-				senderSignatureAlgorithm: "secp256k1",
-				ecdsaAuthorization: "operation_step_up",
-				capability,
-				materialActivation: signer.materialActivation,
-				operationFingerprint
-			});
-		})();
-	})() : await resolveEvmFamilyTransactionStepUp({
-		...authPlanningArgsBase,
-		chainTarget: signingTarget,
-		senderSignatureAlgorithm: args.request.senderSignatureAlgorithm
-	});
-	const prepareFlowForExecution = async () => {
-		const { signingAuthPlan, signingSessionPlan, emailOtpSigning } = await resolveAuthPlanningResult();
-		const emailOtpSigningForFlow = emailOtpSigning ? {
-			prepare: emailOtpSigning.prepare,
-			...emailOtpSigning.resend ? { resend: emailOtpSigning.resend } : {}
-		} : void 0;
-		const { flowArgs } = await createEvmFamilySigningFlowRuntime({
-			deps,
-			walletSession: args.walletSession,
-			request: args.request,
-			chainTarget: requestChainTarget,
-			...args.request.senderSignatureAlgorithm === "secp256k1" ? {
-				senderSignatureAlgorithm: args.request.senderSignatureAlgorithm,
-				preparedSession: getPreparedEcdsaSigningSession(),
-				...activeWalletAuthorityFlowRuntime ? { activeWalletAuthority: activeWalletAuthorityFlowRuntime } : {}
-			} : { senderSignatureAlgorithm: args.request.senderSignatureAlgorithm },
-			...signingSessionPlan ? { signingSessionPlan } : {},
-			signingOperation: createTransactionSigningOperation(),
-			onSigningOperationTransition: emitEvmFamilySigningOperationTrace,
-			...emailOtpSigningForFlow ? { emailOtpSigningForFlow } : {},
-			confirmationConfigOverride: args.confirmationConfigOverride,
-			shouldAbort: args.shouldAbort,
-			onEvent: args.onEvent,
-			onAuthSideEffectStarted: markFreshAuthRetrySideEffect
-		});
-		return {
-			signingAuthPlan,
-			signingSessionPlan,
-			emailOtpSigning,
-			flowArgs
-		};
-	};
-	let preparedFlow;
-	try {
-		preparedFlow = await prepareFlowForExecution();
-	} catch (error) {
-		const reResolved = await reResolveSupersededPreparation(error);
-		if (reResolved) return reResolved;
-		throw error;
-	}
-	const { signingAuthPlan, emailOtpSigning, flowArgs } = preparedFlow;
-	let freshAuthRetryHandledFinalization = false;
-	const retryWithFreshWalletSessionAuth = async (error) => {
-		return await retryEvmFamilyWithFreshWalletSessionAuthWhenRequired({
-			error,
-			walletId,
-			chain: args.request.chain,
-			senderSignatureAlgorithm: args.request.senderSignatureAlgorithm,
-			accountAuth: resolvedAccountAuth,
-			alreadyRetryingFreshEmailOtpAuth: attempt.retryingFreshAuth,
-			hasEmailOtpSigningPlan: !!emailOtpSigning,
-			sideEffectState: freshAuthRetrySideEffectState,
-			signingSessionCoordinator,
-			expiryContext: resolveEvmFamilyWalletSessionExpiryContext({
-				error,
-				candidate: evmFamilyWalletSessionExpiryCandidate({ prepared: preparedEcdsaSigningSession }),
-				detectedAtMs: Date.now()
-			}),
-			onDecision: (decision) => recordFreshAuthRetryDecision(decision, error),
-			onEvent: args.onEvent,
-			retry: async () => {
-				const result = await signEvmFamilyAttempt(deps, args, {
-					admissionRetryState: { kind: "initial_admission" },
-					forceFreshAuth: true,
-					operationIds,
-					retryingFreshAuth: true,
-					signingSessionCoordinator
-				});
-				freshAuthRetryHandledFinalization = true;
-				return result;
-			}
-		});
-	};
-	const retryWithFreshAuth = async (error) => {
-		if (isEvmFamilyEcdsaMaterialSupersededError(error)) {
-			const reResolved = await reResolveSupersededPreparation(error);
-			if (reResolved) {
-				freshAuthRetryHandledFinalization = true;
-				return reResolved;
-			}
-			return null;
-		}
-		const walletSessionRetry = await retryWithFreshWalletSessionAuth(error);
-		if (walletSessionRetry) return walletSessionRetry;
-		const decision = classifyEvmFamilyFreshAuthRetry({
-			trigger: "wallet_signing_budget_exhausted",
-			error,
-			senderSignatureAlgorithm: args.request.senderSignatureAlgorithm,
-			accountAuth: resolvedAccountAuth,
-			activeSigningAuthMethod: getPreparedEcdsaSigningSession().authMethod,
-			admissionRetryState: attempt.admissionRetryState,
-			alreadyRetryingFreshAuth: attempt.retryingFreshAuth,
-			hasStepUpAuthPlan: isEmailOtpSigningAuthPlan(signingAuthPlan) || isPasskeySigningAuthPlan(signingAuthPlan),
-			sideEffectState: freshAuthRetrySideEffectState
-		});
-		recordFreshAuthRetryDecision(decision, error);
-		if (decision.kind !== "retry") return null;
-		const preparedForRetry = getPreparedEcdsaSigningSession();
-		if (preparedForRetry.kind !== "authorized") return null;
-		if (decision.retryMode !== "await_admission_owner_completion") emitEvmFamilyFreshAuthRetryEvent({
-			walletId,
-			chain: args.request.chain,
-			accountAuth: resolvedAccountAuth,
-			onEvent: args.onEvent
-		});
-		const result = await executeEvmFamilyFreshAuthRetry({
-			deps,
-			signingArgs: args,
-			decision,
-			queueKey: ecdsaOperationAuthorizationQueueKey({
-				walletId,
-				prepared: preparedForRetry
-			}),
-			operationIds,
-			retryingFreshAuth: attempt.retryingFreshAuth === true,
-			signingSessionCoordinator
-		});
-		freshAuthRetryHandledFinalization = true;
-		return result;
-	};
-	const preparedNonceSession = getPreparedEcdsaSigningSessionIfEcdsa();
-	const nonceOperation = {
-		...createTransactionSigningOperation(),
-		accountId: String(walletId)
-	};
-	if (preparedNonceSession) {
-		const nonceFingerprint = derivePreparedEvmFamilyKeyFingerprint(preparedNonceSession);
-		emitSigningSessionFlowTrace("evm-family", {
-			stage: "ecdsa_attempt.nonce_operation_prepared",
-			walletId,
-			chain: requestChain,
-			chainTarget: requestChainTarget,
-			...nonceFingerprint ? { evmFamilyKeyFingerprint: nonceFingerprint } : {},
-			...preparedNonceSession.kind === "authorized" ? { walletSessionId: preparedNonceSession.signingLane.authorization.operationCredential.walletSessionId } : {},
-			materialActivationId: preparedNonceSession.kind === "authorized" ? preparedNonceSession.signingLane.materialActivation.activationId : preparedNonceSession.candidate.materialActivation.activationId
-		});
-	}
-	const preparedExecutorSession = getPreparedEcdsaSigningSessionIfEcdsa();
-	const requireThresholdEcdsaStepUpRuntime = () => {
-		const runtime = flowArgs.thresholdEcdsaStepUpRuntime;
-		if (!runtime) throw new Error("[SigningEngine][ecdsa] prepared executor requires threshold step-up runtime");
-		return runtime;
-	};
-	const thresholdEcdsaStepUp = preparedExecutorSession && !activeWalletAuthorityFlowRuntime ? {
-		kind: "required",
-		authPlan: {
-			kind: "planned",
-			signingAuthPlan
-		},
-		operation: {
-			intent: preparedExecutorSession.kind === "authorized" ? preparedExecutorSession.transactionOperation.intent : preparedExecutorSession.intent,
-			authPlan: signingAuthPlan
-		},
-		runtime: requireThresholdEcdsaStepUpRuntime()
-	} : { kind: "not_required" };
-	let thresholdEcdsaState;
-	if (!preparedExecutorSession) thresholdEcdsaState = { kind: "not_required" };
-	else thresholdEcdsaState = buildPreparedEvmFamilyExecutorThresholdEcdsaState({
-		laneThresholdOwnerAddress: preparedExecutorSession.kind === "authorized" ? preparedExecutorSession.signingLane.key.thresholdOwnerAddress : preparedExecutorSession.candidate.key.thresholdOwnerAddress,
-		publicIdentityContinuity: { kind: "lane_identity_only" }
-	});
-	const executePayload = {
-		deps,
-		walletId,
-		request: args.request,
-		chainTarget: requestChainTarget,
-		flowArgs,
-		nonceOperation,
-		thresholdEcdsaState,
-		onConfirmationDisplayed: markConfirmationDisplayed,
-		thresholdEcdsaStepUp,
-		retryWithFreshEmailOtpAuth: retryWithFreshAuth
-	};
-	if (preparedExecutorSession) {
-		const result = await executeEvmFamilyTransactionSigning(executePayload);
-		if (freshAuthRetryHandledFinalization) return result;
-		return result;
-	}
-	return await executeEvmFamilyTransactionSigning(executePayload);
-}
-async function reportTempoBroadcastAccepted(deps, args) {
-	await reportEvmFamilyBroadcastAccepted(deps, args);
-}
-async function reportTempoBroadcastRejected(deps, args) {
-	await reportEvmFamilyBroadcastRejected(deps, args);
-}
-async function reportTempoFinalized(deps, args) {
-	await reportEvmFamilyFinalized(deps, args);
-}
-async function reportTempoDroppedOrReplaced(deps, args) {
-	await reportEvmFamilyDroppedOrReplaced(deps, args);
-}
-async function reconcileTempoNonceLane(deps, args) {
-	return await reconcileEvmFamilyNonceLane(deps, args);
-}
-//#endregion
-export { buildCanonicalEvmFamilyEcdsaSigningCapability as A, removeLinkedEcdsaHolderRuntimeV1 as B, isOwnerRelinkRequiredError as C, ecdsaRoleLocalPersistedMaterialSource as D, buildPersistedEcdsaRoleLocalMaterial as E, ensureSealedRefreshStartupParityForThresholdEcdsaBootstrap as F, isRetryableSealedRefreshCapabilityFetchError as I, clearLinkedEcdsaHolderRuntimesV1 as L, buildExactEcdsaDirectCapabilityRuntime as M, buildExactEvmFamilyWalletSessionAuthorization as N, resolveEcdsaRoleLocalMaterial as O, signingAuthorizationFromPreprocessing as P, installLinkedEcdsaHolderRuntimeV1 as R, buildExactPasskeyOwnerLaneScope as S, resolveExactWalletAuthAuthority as T, resolveLinkedEcdsaHolderRuntimeV1 as V, requestEmailOtpSigningSessionChallenge as _, reportTempoFinalized as a, buildExactEcdsaPasskeyOwnerLaneScope as b, resolveActiveWalletAuthorityEcdsaRuntimeV1 as c, createActiveEcdsaCapabilityRuntimeForChainResolver as d, createActiveEcdsaCapabilityRuntimeResolver as f, refreshEmailOtpSigningSession as g, buildRouterAbEcdsaDerivationSigningMaterialRef as h, reportTempoDroppedOrReplaced as i, buildEcdsaPreprocessingCapability as j, authorizeEvmFamilyEcdsaSigningCapability as k, issueEcdsaOperationStepUpAuthorization as l, resolveExactEcdsaSealedRuntime as m, reportTempoBroadcastAccepted as n, signEvmFamily as o, resolveExactEcdsaCapabilityRuntime as p, reportTempoBroadcastRejected as r, signEvmFamily_exports as s, reconcileTempoNonceLane as t, prepareEcdsaOperationStepUp as u, resolveEmailOtpEcdsaSigningSessionAuth as v, resolveExactOwnerLaneScope as w, buildExactLinkedEmailOtpOwnerLaneScope as x, withThresholdEcdsaSigningQueue as y, listLinkedEcdsaHolderRuntimesV1 as z };